dns-security-mcp 0.1.0

package/dist/ct/index.js

@@ -0,0 +1,534 @@
+import { z } from "zod";
+import { text, json } from "../types/index.js";
+import { resolveAll } from "../utils/dns-client.js";
+import { TTLCache } from "../utils/cache.js";
+import { RateLimiter } from "../utils/rate-limiter.js";
+// ─── Constants ───
+const CRT_SH_BASE = "https://crt.sh";
+const FETCH_TIMEOUT = 10_000;
+// ─── Rate Limiter & Cache ───
+const crtshLimiter = new RateLimiter(1000);
+const ctCache = new TTLCache(5 * 60 * 1000); // 5 min
+async function queryCrtSh(query) {
+    await crtshLimiter.acquire();
+    const url = `${CRT_SH_BASE}/?q=${encodeURIComponent(query)}&output=json`;
+    const res = await fetch(url, {
+        signal: AbortSignal.timeout(FETCH_TIMEOUT),
+        headers: { Accept: "application/json" },
+    });
+    if (!res.ok)
+        throw new Error(`crt.sh error: ${res.status} ${res.statusText}`);
+    const data = await res.json();
+    return data ?? [];
+}
+function parseCaName(issuerName) {
+    const match = issuerName.match(/O=([^,]+)/);
+    return match ? match[1].trim() : issuerName;
+}
+function daysBetween(a, b) {
+    return Math.floor((b.getTime() - a.getTime()) / (1000 * 60 * 60 * 24));
+}
+// ─── Tool 1: ct_search ───
+const ctSearch = {
+    name: "ct_search",
+    description: "Search Certificate Transparency logs via crt.sh for certificates issued for a domain. " +
+        "Returns issuer, validity dates, serial number, and common name.",
+    schema: {
+        domain: z.string().describe("The domain to search certificates for (e.g. 'example.com')"),
+        include_subdomains: z
+            .boolean()
+            .optional()
+            .describe("Include subdomain certificates by prepending wildcard to query. Default false."),
+        limit: z
+            .number()
+            .optional()
+            .describe("Maximum number of certificate entries to return. Default 100."),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const includeSubdomains = args.include_subdomains ?? false;
+        const limit = args.limit ?? 100;
+        const query = includeSubdomains ? `%.${domain}` : domain;
+        const cacheKey = `ct_search:${query}:${limit}`;
+        const cached = ctCache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        try {
+            const entries = await queryCrtSh(query);
+            const results = entries.slice(0, limit).map((e) => ({
+                common_name: e.common_name,
+                issuer: parseCaName(e.issuer_name),
+                not_before: e.not_before,
+                not_after: e.not_after,
+                serial: e.serial_number,
+                name_value: e.name_value,
+            }));
+            const result = {
+                domain,
+                include_subdomains: includeSubdomains,
+                total_found: entries.length,
+                returned: results.length,
+                certificates: results,
+            };
+            ctCache.set(cacheKey, result);
+            return json(result);
+        }
+        catch (err) {
+            return text(`Error searching CT logs for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 2: ct_wildcard_audit ───
+const ctWildcardAudit = {
+    name: "ct_wildcard_audit",
+    description: "Audit Certificate Transparency logs for wildcard certificates (*.domain). " +
+        "Reports number of wildcards, issuing CAs, date ranges, and flags multiple wildcards from different CAs.",
+    schema: {
+        domain: z.string().describe("The domain to audit for wildcard certificates (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const cacheKey = `ct_wildcard_audit:${domain}`;
+        const cached = ctCache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        try {
+            const entries = await queryCrtSh(`*.${domain}`);
+            const wildcards = entries.filter((e) => e.common_name.startsWith("*.") || e.name_value.includes("*."));
+            const issuers = new Map();
+            let earliestDate = null;
+            let latestDate = null;
+            for (const w of wildcards) {
+                const ca = parseCaName(w.issuer_name);
+                issuers.set(ca, (issuers.get(ca) ?? 0) + 1);
+                if (!earliestDate || w.not_before < earliestDate)
+                    earliestDate = w.not_before;
+                if (!latestDate || w.not_after > latestDate)
+                    latestDate = w.not_after;
+            }
+            const issuerDistribution = Array.from(issuers.entries())
+                .map(([ca, count]) => ({ ca, count }))
+                .sort((a, b) => b.count - a.count);
+            const flags = [];
+            if (issuers.size > 1) {
+                flags.push(`Multiple CAs (${issuers.size}) have issued wildcard certificates — potential security concern`);
+            }
+            if (wildcards.length > 10) {
+                flags.push(`High number of wildcard certificates (${wildcards.length}) — review if all are necessary`);
+            }
+            if (wildcards.length === 0) {
+                flags.push("No wildcard certificates found — good practice for security");
+            }
+            const result = {
+                domain,
+                wildcard_count: wildcards.length,
+                unique_issuers: issuers.size,
+                date_range: {
+                    earliest: earliestDate,
+                    latest: latestDate,
+                },
+                issuer_distribution: issuerDistribution,
+                flags,
+            };
+            ctCache.set(cacheKey, result);
+            return json(result);
+        }
+        catch (err) {
+            return text(`Error auditing wildcards for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 3: ct_unauthorized_detect ───
+const ctUnauthorizedDetect = {
+    name: "ct_unauthorized_detect",
+    description: "Detect potentially unauthorized certificates by cross-referencing CT logs with CAA DNS records. " +
+        "Flags certificates issued by CAs not authorized in the domain's CAA record.",
+    schema: {
+        domain: z.string().describe("The domain to check for unauthorized certificates (e.g. 'example.com')"),
+        allowed_cas: z
+            .array(z.string())
+            .optional()
+            .describe("Optional explicit list of allowed CA names to override CAA-based detection"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const allowedCasArg = args.allowed_cas ?? [];
+        try {
+            // Fetch CAA records
+            const caaRecords = await resolveAll(domain, ["CAA"]);
+            const caaIssuers = [];
+            for (const r of caaRecords) {
+                // CAA data format: "0 issue letsencrypt.org" or similar
+                const parts = r.data.split(/\s+/);
+                if (parts.length >= 3 && (parts[1] === "issue" || parts[1] === "issuewild")) {
+                    caaIssuers.push(parts.slice(2).join(" ").replace(/"/g, "").toLowerCase());
+                }
+            }
+            const allowedCas = allowedCasArg.length > 0
+                ? allowedCasArg.map((ca) => ca.toLowerCase())
+                : caaIssuers;
+            // Fetch CT log entries
+            const entries = await queryCrtSh(`%.${domain}`);
+            // Group by CA
+            const caGroups = new Map();
+            for (const e of entries) {
+                const ca = parseCaName(e.issuer_name);
+                const group = caGroups.get(ca) ?? [];
+                group.push(e);
+                caGroups.set(ca, group);
+            }
+            // Detect unauthorized
+            const unauthorized = [];
+            const authorized = [];
+            for (const [ca, certs] of caGroups) {
+                const caLower = ca.toLowerCase();
+                const isAllowed = allowedCas.length === 0 ||
+                    allowedCas.some((allowed) => caLower.includes(allowed) || allowed.includes(caLower));
+                if (isAllowed) {
+                    authorized.push({ ca, cert_count: certs.length });
+                }
+                else {
+                    const commonNames = [...new Set(certs.map((c) => c.common_name))].slice(0, 10);
+                    unauthorized.push({
+                        ca,
+                        cert_count: certs.length,
+                        common_names: commonNames,
+                        reason: allowedCasArg.length > 0
+                            ? "Not in provided allowed CA list"
+                            : caaIssuers.length > 0
+                                ? "Not authorized by CAA record"
+                                : "No CAA record exists — any CA could issue",
+                    });
+                }
+            }
+            const result = {
+                domain,
+                caa_records: caaRecords.map((r) => r.data),
+                caa_authorized_issuers: caaIssuers,
+                has_caa: caaIssuers.length > 0,
+                total_cas_found: caGroups.size,
+                authorized_cas: authorized,
+                unauthorized_cas: unauthorized,
+                risk_level: unauthorized.length === 0
+                    ? "low"
+                    : caaIssuers.length === 0
+                        ? "medium"
+                        : "high",
+            };
+            return json(result);
+        }
+        catch (err) {
+            return text(`Error detecting unauthorized certs for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 4: ct_monitor ───
+const ctMonitor = {
+    name: "ct_monitor",
+    description: "Monitor Certificate Transparency logs for recently issued certificates. " +
+        "Returns certificates issued within the last N days for a given domain.",
+    schema: {
+        domain: z.string().describe("The domain to monitor for new certificates (e.g. 'example.com')"),
+        days: z
+            .number()
+            .optional()
+            .describe("Number of days to look back for new certificates. Default 7."),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const days = args.days ?? 7;
+        try {
+            const entries = await queryCrtSh(`%.${domain}`);
+            const cutoff = new Date();
+            cutoff.setDate(cutoff.getDate() - days);
+            const recentCerts = entries.filter((e) => {
+                const notBefore = new Date(e.not_before);
+                return notBefore >= cutoff;
+            });
+            // Deduplicate by serial
+            const seen = new Set();
+            const uniqueCerts = recentCerts.filter((e) => {
+                if (seen.has(e.serial_number))
+                    return false;
+                seen.add(e.serial_number);
+                return true;
+            });
+            // Extract unique subdomains
+            const subdomains = new Set();
+            for (const c of uniqueCerts) {
+                const names = c.name_value.split("\n");
+                for (const n of names) {
+                    const trimmed = n.trim();
+                    if (trimmed)
+                        subdomains.add(trimmed);
+                }
+            }
+            const certificates = uniqueCerts.map((c) => ({
+                common_name: c.common_name,
+                issuer: parseCaName(c.issuer_name),
+                not_before: c.not_before,
+                not_after: c.not_after,
+                serial: c.serial_number,
+                type: c.common_name.startsWith("*.") ? "wildcard" : "specific",
+                names: c.name_value.split("\n").map((n) => n.trim()).filter(Boolean),
+            }));
+            return json({
+                domain,
+                monitoring_period_days: days,
+                cutoff_date: cutoff.toISOString(),
+                new_certificates_count: certificates.length,
+                unique_subdomains: [...subdomains].sort(),
+                certificates,
+            });
+        }
+        catch (err) {
+            return text(`Error monitoring CT logs for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 5: ct_check_caa ───
+const ctCheckCaa = {
+    name: "ct_check_caa",
+    description: "Check CAA (Certification Authority Authorization) DNS records for a domain and its parents. " +
+        "Analyzes issue, issuewild, and iodef tags. Flags missing CAA, unrestricted wildcards, and missing iodef.",
+    schema: {
+        domain: z.string().describe("The domain to check CAA records for (e.g. 'sub.example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            // Check CAA at domain level and parent levels
+            const parts = domain.split(".");
+            const levels = [];
+            for (let i = 0; i < parts.length - 1; i++) {
+                levels.push(parts.slice(i).join("."));
+            }
+            const caaResults = [];
+            for (const level of levels) {
+                try {
+                    const records = await resolveAll(level, ["CAA"]);
+                    if (records.length > 0) {
+                        const parsed = records.map((r) => {
+                            const parts = r.data.split(/\s+/);
+                            const critical = parts[0] === "128";
+                            const tag = parts[1] ?? "unknown";
+                            const value = parts.slice(2).join(" ").replace(/"/g, "");
+                            return { tag, value, critical };
+                        });
+                        caaResults.push({ domain: level, records: parsed });
+                    }
+                }
+                catch {
+                    // Skip resolution errors at parent levels
+                }
+            }
+            // Analyze findings
+            const flags = [];
+            const allRecords = caaResults.flatMap((r) => r.records);
+            const issueRecords = allRecords.filter((r) => r.tag === "issue");
+            const issuewildRecords = allRecords.filter((r) => r.tag === "issuewild");
+            const iodefRecords = allRecords.filter((r) => r.tag === "iodef");
+            if (caaResults.length === 0) {
+                flags.push("CRITICAL: No CAA records found at any level — any CA can issue certificates for this domain");
+            }
+            if (issueRecords.length === 0 && caaResults.length > 0) {
+                flags.push("WARNING: No 'issue' tag found — certificate issuance policy is not explicitly defined");
+            }
+            if (issuewildRecords.length === 0 && caaResults.length > 0) {
+                flags.push("WARNING: No 'issuewild' tag — wildcard certificate issuance is not restricted separately");
+            }
+            if (iodefRecords.length === 0 && caaResults.length > 0) {
+                flags.push("INFO: No 'iodef' tag — CA violation reports will not be sent to domain owner");
+            }
+            if (issueRecords.some((r) => r.value === ";")) {
+                flags.push("INFO: 'issue ;' found — explicitly prohibiting certificate issuance");
+            }
+            const allowedCas = issueRecords
+                .filter((r) => r.value !== ";")
+                .map((r) => r.value);
+            const allowedWildcardCas = issuewildRecords
+                .filter((r) => r.value !== ";")
+                .map((r) => r.value);
+            const reportingUrls = iodefRecords.map((r) => r.value);
+            return json({
+                domain,
+                levels_checked: levels,
+                caa_found: caaResults.length > 0,
+                caa_records: caaResults,
+                analysis: {
+                    allowed_cas: allowedCas,
+                    allowed_wildcard_cas: allowedWildcardCas.length > 0 ? allowedWildcardCas : allowedCas,
+                    reporting_urls: reportingUrls,
+                    wildcard_restricted: issuewildRecords.length > 0,
+                    has_reporting: iodefRecords.length > 0,
+                },
+                flags,
+            });
+        }
+        catch (err) {
+            return text(`Error checking CAA for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 6: ct_cert_inventory ───
+const ctCertInventory = {
+    name: "ct_cert_inventory",
+    description: "Build a full certificate inventory from CT logs for a domain. Groups by active/expired, " +
+        "wildcard/specific, and CA. Returns total count, active count, unique subdomains, and CA distribution.",
+    schema: {
+        domain: z.string().describe("The domain to inventory certificates for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const cacheKey = `ct_cert_inventory:${domain}`;
+        const cached = ctCache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        try {
+            const entries = await queryCrtSh(`%.${domain}`);
+            // Deduplicate by serial
+            const seen = new Set();
+            const unique = entries.filter((e) => {
+                if (seen.has(e.serial_number))
+                    return false;
+                seen.add(e.serial_number);
+                return true;
+            });
+            const now = new Date();
+            let activeCount = 0;
+            let expiredCount = 0;
+            let wildcardCount = 0;
+            let specificCount = 0;
+            const caDistribution = new Map();
+            const subdomains = new Set();
+            for (const cert of unique) {
+                const notAfter = new Date(cert.not_after);
+                const notBefore = new Date(cert.not_before);
+                const isActive = notAfter >= now && notBefore <= now;
+                if (isActive)
+                    activeCount++;
+                else
+                    expiredCount++;
+                if (cert.common_name.startsWith("*."))
+                    wildcardCount++;
+                else
+                    specificCount++;
+                const ca = parseCaName(cert.issuer_name);
+                caDistribution.set(ca, (caDistribution.get(ca) ?? 0) + 1);
+                const names = cert.name_value.split("\n");
+                for (const n of names) {
+                    const trimmed = n.trim();
+                    if (trimmed && !trimmed.startsWith("*."))
+                        subdomains.add(trimmed);
+                }
+            }
+            const sortedCaDistribution = Array.from(caDistribution.entries())
+                .map(([ca, count]) => ({ ca, count }))
+                .sort((a, b) => b.count - a.count);
+            const result = {
+                domain,
+                total_certificates: unique.length,
+                active: activeCount,
+                expired: expiredCount,
+                wildcard: wildcardCount,
+                specific: specificCount,
+                unique_subdomains_count: subdomains.size,
+                unique_subdomains: [...subdomains].sort().slice(0, 200),
+                ca_distribution: sortedCaDistribution,
+                summary: {
+                    wildcard_ratio: unique.length > 0 ? (wildcardCount / unique.length * 100).toFixed(1) + "%" : "0%",
+                    active_ratio: unique.length > 0 ? (activeCount / unique.length * 100).toFixed(1) + "%" : "0%",
+                    top_ca: sortedCaDistribution[0]?.ca ?? "N/A",
+                },
+            };
+            ctCache.set(cacheKey, result);
+            return json(result);
+        }
+        catch (err) {
+            return text(`Error building cert inventory for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 7: ct_expiry_monitor ───
+const ctExpiryMonitor = {
+    name: "ct_expiry_monitor",
+    description: "Find certificates expiring within N days for a domain. Returns expiring certificates with subject, " +
+        "issuer, expiry date, and days remaining.",
+    schema: {
+        domain: z.string().describe("The domain to check for expiring certificates (e.g. 'example.com')"),
+        days_threshold: z
+            .number()
+            .optional()
+            .describe("Number of days threshold for expiry warning. Default 30."),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const daysThreshold = args.days_threshold ?? 30;
+        try {
+            const entries = await queryCrtSh(`%.${domain}`);
+            const now = new Date();
+            const threshold = new Date();
+            threshold.setDate(threshold.getDate() + daysThreshold);
+            // Deduplicate by serial
+            const seen = new Set();
+            const unique = entries.filter((e) => {
+                if (seen.has(e.serial_number))
+                    return false;
+                seen.add(e.serial_number);
+                return true;
+            });
+            // Filter active certs expiring within threshold
+            const expiring = unique
+                .filter((e) => {
+                const notAfter = new Date(e.not_after);
+                const notBefore = new Date(e.not_before);
+                return notBefore <= now && notAfter >= now && notAfter <= threshold;
+            })
+                .map((e) => {
+                const notAfter = new Date(e.not_after);
+                const daysRemaining = daysBetween(now, notAfter);
+                return {
+                    common_name: e.common_name,
+                    issuer: parseCaName(e.issuer_name),
+                    not_before: e.not_before,
+                    not_after: e.not_after,
+                    serial: e.serial_number,
+                    days_remaining: daysRemaining,
+                    urgency: daysRemaining <= 7
+                        ? "critical"
+                        : daysRemaining <= 14
+                            ? "high"
+                            : daysRemaining <= 21
+                                ? "medium"
+                                : "low",
+                    names: e.name_value.split("\n").map((n) => n.trim()).filter(Boolean),
+                };
+            })
+                .sort((a, b) => a.days_remaining - b.days_remaining);
+            return json({
+                domain,
+                days_threshold: daysThreshold,
+                check_date: now.toISOString(),
+                threshold_date: threshold.toISOString(),
+                expiring_count: expiring.length,
+                critical_count: expiring.filter((e) => e.urgency === "critical").length,
+                high_count: expiring.filter((e) => e.urgency === "high").length,
+                certificates: expiring,
+            });
+        }
+        catch (err) {
+            return text(`Error checking cert expiry for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Export All CT Tools ───
+export const ctTools = [
+    ctSearch,
+    ctWildcardAudit,
+    ctUnauthorizedDetect,
+    ctMonitor,
+    ctCheckCaa,
+    ctCertInventory,
+    ctExpiryMonitor,
+];
+//# sourceMappingURL=index.js.map

package/dist/ct/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ct/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAkB,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,oBAAoB;AAEpB,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,+BAA+B;AAE/B,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3C,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ;AAgB9D,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,GAAG,WAAW,OAAO,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;QAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAQ,IAAqB,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,CAAO,EAAE,CAAO;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,4BAA4B;AAE5B,MAAM,QAAQ,GAAY;IACxB,IAAI,EAAE,WAAW;IACjB,WAAW,EACT,wFAAwF;QACxF,iEAAiE;IACnE,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;QACzF,kBAAkB,EAAE,CAAC;aAClB,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,gFAAgF,CAAC;QAC7F,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,+DAA+D,CAAC;KAC7E;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,iBAAiB,GAAI,IAAI,CAAC,kBAA8B,IAAI,KAAK,CAAC;QACxE,MAAM,KAAK,GAAI,IAAI,CAAC,KAAgB,IAAI,GAAG,CAAC;QAE5C,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACzD,MAAM,QAAQ,GAAG,aAAa,KAAK,IAAI,KAAK,EAAE,CAAC;QAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YAExC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;gBAClC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,CAAC,CAAC,aAAa;gBACvB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC,CAAC;YAEJ,MAAM,MAAM,GAAG;gBACb,MAAM;gBACN,kBAAkB,EAAE,iBAAiB;gBACrC,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,OAAO,CAAC,MAAM;gBACxB,YAAY,EAAE,OAAO;aACtB,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,+BAA+B,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF,CAAC;AAEF,oCAAoC;AAEpC,MAAM,eAAe,GAAY;IAC/B,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,4EAA4E;QAC5E,yGAAyG;IAC3G,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;KAClG;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,QAAQ,GAAG,qBAAqB,MAAM,EAAE,CAAC;QAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAEhD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE,CAAC;YAEF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC1C,IAAI,YAAY,GAAkB,IAAI,CAAC;YACvC,IAAI,UAAU,GAAkB,IAAI,CAAC;YAErC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE5C,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,GAAG,YAAY;oBAAE,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC;gBAC9E,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,GAAG,UAAU;oBAAE,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC;YACxE,CAAC;YAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;iBACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;iBACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAErC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CACR,iBAAiB,OAAO,CAAC,IAAI,kEAAkE,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CACR,yCAAyC,SAAS,CAAC,MAAM,iCAAiC,CAC3F,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,MAAM,GAAG;gBACb,MAAM;gBACN,cAAc,EAAE,SAAS,CAAC,MAAM;gBAChC,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC5B,UAAU,EAAE;oBACV,QAAQ,EAAE,YAAY;oBACtB,MAAM,EAAE,UAAU;iBACnB;gBACD,mBAAmB,EAAE,kBAAkB;gBACvC,KAAK;aACN,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF,CAAC;AAEF,yCAAyC;AAEzC,MAAM,oBAAoB,GAAY;IACpC,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,kGAAkG;QAClG,6EAA6E;IAC/E,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;QACrG,WAAW,EAAE,CAAC;aACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CAAC,4EAA4E,CAAC;KAC1F;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,aAAa,GAAI,IAAI,CAAC,WAAoC,IAAI,EAAE,CAAC;QAEvE,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACrD,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;oBAC5E,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;gBACzC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC7C,CAAC,CAAC,UAAU,CAAC;YAEf,uBAAuB;YACvB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAEhD,cAAc;YACd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;YACjD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAKb,EAAE,CAAC;YAER,MAAM,UAAU,GAA8C,EAAE,CAAC;YAEjE,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM,SAAS,GACb,UAAU,CAAC,MAAM,KAAK,CAAC;oBACvB,UAAU,CAAC,IAAI,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CACpE,CAAC;gBAEJ,IAAI,SAAS,EAAE,CAAC;oBACd,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/E,YAAY,CAAC,IAAI,CAAC;wBAChB,EAAE;wBACF,UAAU,EAAE,KAAK,CAAC,MAAM;wBACxB,YAAY,EAAE,WAAW;wBACzB,MAAM,EACJ,aAAa,CAAC,MAAM,GAAG,CAAC;4BACtB,CAAC,CAAC,iCAAiC;4BACnC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gCACrB,CAAC,CAAC,8BAA8B;gCAChC,CAAC,CAAC,2CAA2C;qBACpD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG;gBACb,MAAM;gBACN,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1C,sBAAsB,EAAE,UAAU;gBAClC,OAAO,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;gBAC9B,eAAe,EAAE,QAAQ,CAAC,IAAI;gBAC9B,cAAc,EAAE,UAAU;gBAC1B,gBAAgB,EAAE,YAAY;gBAC9B,UAAU,EACR,YAAY,CAAC,MAAM,KAAK,CAAC;oBACvB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;wBACvB,CAAC,CAAC,QAAQ;wBACV,CAAC,CAAC,MAAM;aACf,CAAC;YAEF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,0CAA0C,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;CACF,CAAC;AAEF,6BAA6B;AAE7B,MAAM,SAAS,GAAY;IACzB,IAAI,EAAE,YAAY;IAClB,WAAW,EACT,0EAA0E;QAC1E,wEAAwE;IAC1E,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;QAC9F,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,8DAA8D,CAAC;KAC5E;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,IAAI,GAAI,IAAI,CAAC,IAAe,IAAI,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YAExC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACzC,OAAO,SAAS,IAAI,MAAM,CAAC;YAC7B,CAAC,CAAC,CAAC;YAEH,wBAAwB;YACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,4BAA4B;YAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzB,IAAI,OAAO;wBAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;gBAClC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,CAAC,CAAC,aAAa;gBACvB,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;gBAC9D,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;aACrE,CAAC,CAAC,CAAC;YAEJ,OAAO,IAAI,CAAC;gBACV,MAAM;gBACN,sBAAsB,EAAE,IAAI;gBAC5B,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;gBACjC,sBAAsB,EAAE,YAAY,CAAC,MAAM;gBAC3C,iBAAiB,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;gBACzC,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF,CAAC;AAEF,+BAA+B;AAE/B,MAAM,UAAU,GAAY;IAC1B,IAAI,EAAE,cAAc;IACpB,WAAW,EACT,8FAA8F;QAC9F,0GAA0G;IAC5G,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;KAC5F;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QAErC,IAAI,CAAC;YACH,8CAA8C;YAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,UAAU,GAGX,EAAE,CAAC;YAER,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;oBACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;4BAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;4BACpC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;4BAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BACzD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;wBAClC,CAAC,CAAC,CAAC;wBACH,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;YACH,CAAC;YAED,mBAAmB;YACnB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAExD,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;YACjE,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;YACzE,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;YAEjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC9C,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;YACpF,CAAC;YAED,MAAM,UAAU,GAAG,YAAY;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAEvB,MAAM,kBAAkB,GAAG,gBAAgB;iBACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAEvB,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAEvD,OAAO,IAAI,CAAC;gBACV,MAAM;gBACN,cAAc,EAAE,MAAM;gBACtB,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;gBAChC,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE;oBACR,WAAW,EAAE,UAAU;oBACvB,oBAAoB,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU;oBACrF,cAAc,EAAE,aAAa;oBAC7B,mBAAmB,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC;oBAChD,aAAa,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;iBACvC;gBACD,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,0BAA0B,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;CACF,CAAC;AAEF,oCAAoC;AAEpC,MAAM,eAAe,GAAY;IAC/B,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,0FAA0F;QAC1F,uGAAuG;IACzG,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;KAC7F;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,QAAQ,GAAG,qBAAqB,MAAM,EAAE,CAAC;QAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAEhD,wBAAwB;YACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;YACjD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YAErC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,QAAQ,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,CAAC;gBAErD,IAAI,QAAQ;oBAAE,WAAW,EAAE,CAAC;;oBACvB,YAAY,EAAE,CAAC;gBAEpB,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,aAAa,EAAE,CAAC;;oBAClD,aAAa,EAAE,CAAC;gBAErB,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACzC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;wBAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;iBAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;iBACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAErC,MAAM,MAAM,GAAG;gBACb,MAAM;gBACN,kBAAkB,EAAE,MAAM,CAAC,MAAM;gBACjC,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,aAAa;gBACvB,uBAAuB,EAAE,UAAU,CAAC,IAAI;gBACxC,iBAAiB,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvD,eAAe,EAAE,oBAAoB;gBACrC,OAAO,EAAE;oBACP,cAAc,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;oBACjG,YAAY,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;oBAC7F,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,KAAK;iBAC7C;aACF,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,qCAAqC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;CACF,CAAC;AAEF,oCAAoC;AAEpC,MAAM,eAAe,GAAY;IAC/B,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,qGAAqG;QACrG,0CAA0C;IAC5C,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;QACjG,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,0DAA0D,CAAC;KACxE;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,aAAa,GAAI,IAAI,CAAC,cAAyB,IAAI,EAAE,CAAC;QAE5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAEhD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;YAEvD,wBAAwB;YACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,gDAAgD;YAChD,MAAM,QAAQ,GAAG,MAAM;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACzC,OAAO,SAAS,IAAI,GAAG,IAAI,QAAQ,IAAI,GAAG,IAAI,QAAQ,IAAI,SAAS,CAAC;YACtE,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACvC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACjD,OAAO;oBACL,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;oBAClC,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,MAAM,EAAE,CAAC,CAAC,aAAa;oBACvB,cAAc,EAAE,aAAa;oBAC7B,OAAO,EACL,aAAa,IAAI,CAAC;wBAChB,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,aAAa,IAAI,EAAE;4BACnB,CAAC,CAAC,MAAM;4BACR,CAAC,CAAC,aAAa,IAAI,EAAE;gCACnB,CAAC,CAAC,QAAQ;gCACV,CAAC,CAAC,KAAK;oBACf,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;iBACrE,CAAC;YACJ,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;YAEvD,OAAO,IAAI,CAAC;gBACV,MAAM;gBACN,cAAc,EAAE,aAAa;gBAC7B,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC7B,cAAc,EAAE,SAAS,CAAC,WAAW,EAAE;gBACvC,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAC/B,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,MAAM;gBACvE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM;gBAC/D,YAAY,EAAE,QAAQ;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,kCAAkC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;CACF,CAAC;AAEF,8BAA8B;AAE9B,MAAM,CAAC,MAAM,OAAO,GAAc;IAChC,QAAQ;IACR,eAAe;IACf,oBAAoB;IACpB,SAAS;IACT,UAAU;IACV,eAAe;IACf,eAAe;CAChB,CAAC"}

package/dist/data/dkim-selectors.d.ts

@@ -0,0 +1,2 @@
+export declare const DKIM_SELECTORS: string[];
+//# sourceMappingURL=dkim-selectors.d.ts.map

package/dist/data/dkim-selectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dkim-selectors.d.ts","sourceRoot":"","sources":["../../src/data/dkim-selectors.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,cAAc,EAAE,MAAM,EAmFlC,CAAC"}

package/dist/data/dkim-selectors.js

@@ -0,0 +1,60 @@
+// Common DKIM selectors to brute-force during email security checks
+export const DKIM_SELECTORS = [
+    // Generic
+    "default", "dkim", "mail", "email", "smtp", "dk", "sig1",
+    // Google Workspace
+    "google", "google2048",
+    // Microsoft 365
+    "selector1", "selector2",
+    // Amazon SES
+    "ses", "amazonses",
+    // Mandrill / Mailchimp
+    "mandrill", "k1", "k2", "k3",
+    // Mailjet
+    "mailjet",
+    // SendGrid
+    "s1", "s2", "smtpapi", "sgrid",
+    // Postmark
+    "pm", "postmark",
+    // SparkPost
+    "sparkpost",
+    // Protonmail
+    "protonmail", "protonmail2", "protonmail3",
+    // Zoho
+    "zoho", "zmail",
+    // Turbo-SMTP
+    "turbo-smtp",
+    // Brevo (Sendinblue)
+    "brevo", "sendinblue",
+    // Fastmail
+    "fm1", "fm2", "fm3",
+    // MailerLite
+    "ml",
+    // Campaign Monitor
+    "cm",
+    // Constant Contact
+    "ctct1", "ctct2",
+    // ActiveCampaign
+    "dk1", "dk2",
+    // Klaviyo
+    "kl", "kl2",
+    // HubSpot
+    "hs1", "hs2", "hubspot",
+    // Salesforce
+    "sf", "salesforce", "sf1", "sf2",
+    // Zendesk
+    "zendesk1", "zendesk2",
+    // Intercom
+    "intercom",
+    // Everlytic
+    "everlytickey1", "everlytickey2",
+    // MXRoute
+    "mxroute",
+    // Rackspace
+    "rackspace",
+    // Generic numbered
+    "dkim1", "dkim2", "dkim3",
+    "key1", "key2",
+    "mx", "mx1", "mx2",
+];
+//# sourceMappingURL=dkim-selectors.js.map

package/dist/data/dkim-selectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dkim-selectors.js","sourceRoot":"","sources":["../../src/data/dkim-selectors.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,UAAU;IACV,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAExD,mBAAmB;IACnB,QAAQ,EAAE,YAAY;IAEtB,gBAAgB;IAChB,WAAW,EAAE,WAAW;IAExB,aAAa;IACb,KAAK,EAAE,WAAW;IAElB,uBAAuB;IACvB,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAE5B,UAAU;IACV,SAAS;IAET,WAAW;IACX,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO;IAE9B,WAAW;IACX,IAAI,EAAE,UAAU;IAEhB,YAAY;IACZ,WAAW;IAEX,aAAa;IACb,YAAY,EAAE,aAAa,EAAE,aAAa;IAE1C,OAAO;IACP,MAAM,EAAE,OAAO;IAEf,aAAa;IACb,YAAY;IAEZ,qBAAqB;IACrB,OAAO,EAAE,YAAY;IAErB,WAAW;IACX,KAAK,EAAE,KAAK,EAAE,KAAK;IAEnB,aAAa;IACb,IAAI;IAEJ,mBAAmB;IACnB,IAAI;IAEJ,mBAAmB;IACnB,OAAO,EAAE,OAAO;IAEhB,iBAAiB;IACjB,KAAK,EAAE,KAAK;IAEZ,UAAU;IACV,IAAI,EAAE,KAAK;IAEX,UAAU;IACV,KAAK,EAAE,KAAK,EAAE,SAAS;IAEvB,aAAa;IACb,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK;IAEhC,UAAU;IACV,UAAU,EAAE,UAAU;IAEtB,WAAW;IACX,UAAU;IAEV,YAAY;IACZ,eAAe,EAAE,eAAe;IAEhC,UAAU;IACV,SAAS;IAET,YAAY;IACZ,WAAW;IAEX,mBAAmB;IACnB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,KAAK,EAAE,KAAK;CACnB,CAAC"}

package/dist/data/dnsbl-lists.d.ts

@@ -0,0 +1,8 @@
+export interface DnsblEntry {
+    name: string;
+    domain: string;
+    type: "ip" | "domain";
+    category: string;
+}
+export declare const DNSBL_LISTS: DnsblEntry[];
+//# sourceMappingURL=dnsbl-lists.d.ts.map

package/dist/data/dnsbl-lists.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnsbl-lists.d.ts","sourceRoot":"","sources":["../../src/data/dnsbl-lists.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,WAAW,EAAE,UAAU,EAqDnC,CAAC"}