pyric-tools 0.1.0-alpha.7

package/dist/bridge/server/bridge.js

@@ -0,0 +1,410 @@
+/**
+ * Bridge core — process-local state for forwarding MCP tool calls
+ * from external clients to the (one) connected sandbox peer in the
+ * browser. Transport-agnostic: the HTTP MCP server and the WS server
+ * both plug into this through `dispatch()` / `handleSandboxMessage()`
+ * / `registerSandboxPeer()`.
+ *
+ * Multi-tab is naive: last-connection-wins. New peer replaces the
+ * old, pending calls against the old peer reject with a clear error.
+ *
+ * Mode determines architecture:
+ *  - sandbox: every tool call is forwarded over WS to the browser.
+ *    The bridge does not execute tools itself; it acts as a relay
+ *    with a tool-name allow-list pinned by the peer's `hello`.
+ *  - prod: tools execute in-process via `composeMcpRegistry` with
+ *    the supplied `scope` + `adminDeps`. No peer needed.
+ */
+import { randomUUID } from 'node:crypto';
+import { NO_SANDBOX_ERROR_MESSAGE, NO_WORKER_RELAY_ERROR_MESSAGE, WORKER_RELAY_CAPABILITY, } from '../protocol.js';
+/** Build the typed Error worker-op rejections carry. `denialContext` (spike
+ *  gap 6) is re-attached when the wire error carried one, so the structured
+ *  denial frame survives the bridge hop. */
+function workerOpError(code, message, denialContext) {
+    const err = new Error(message);
+    err.code = code;
+    if (denialContext !== undefined)
+        err.denialContext = denialContext;
+    return err;
+}
+export function createBridge(opts) {
+    const mode = opts.mode;
+    const project = opts.project ?? (mode === 'sandbox' ? 'sandbox' : 'unknown');
+    const version = opts.version;
+    const callTimeoutMs = opts.callTimeoutMs ?? 30_000;
+    const startedAt = new Date().toISOString();
+    // Per-process identity (see HealthReport.instanceId): the discovery pointer
+    // records this so a proxy can verify it reached THIS server, not a different
+    // sandbox squatting the same port on the other loopback family.
+    const instanceId = randomUUID();
+    const onToolEvent = opts.onToolEvent;
+    const confirmHandler = opts.confirmHandler ?? null;
+    let peer = null;
+    const pending = new Map();
+    // ── worker relay state ──
+    // Generation counter: bumped on every peer registration. Inbound frames
+    // tagged with an older generation are stale (a replaced tab's socket) and
+    // must not resolve ops / deliver snaps registered under the new peer.
+    let generation = 0;
+    const workerPending = new Map();
+    // Subscription ownership lives on the bridge: entries survive peer churn
+    // and are re-issued to every newly registered relay-capable peer.
+    const workerSubs = new Map();
+    function failAllPending(reason) {
+        for (const call of pending.values()) {
+            clearTimeout(call.timer);
+            call.resolve({
+                ok: false,
+                summary: reason,
+            });
+        }
+        pending.clear();
+        for (const op of workerPending.values()) {
+            clearTimeout(op.timer);
+            op.reject(workerOpError('unavailable', reason));
+        }
+        workerPending.clear();
+    }
+    function peerHasRelay() {
+        return peer !== null && peer.capabilities.has(WORKER_RELAY_CAPABILITY);
+    }
+    function registerSandboxPeer(send, tools, sandboxId, capabilities = [], onReplaced) {
+        if (peer) {
+            // Last-wins: kick the old peer and reject its pending calls.
+            failAllPending('sandbox peer replaced by a newer connection');
+            // Tear the old peer down (the transport closes its socket). The
+            // browser's close handler tears down its relayed worker
+            // subscriptions — otherwise the replaced tab's SharedWorker
+            // listeners would keep posting snaps this bridge drops as
+            // stale-generation until the tab closed.
+            try {
+                peer.onReplaced?.();
+            }
+            catch {
+                // A failing transport hook must not block the new registration.
+            }
+        }
+        generation += 1;
+        const myPeer = {
+            send,
+            tools: new Set(tools),
+            sandboxId,
+            capabilities: new Set(capabilities),
+            onReplaced,
+        };
+        peer = myPeer;
+        // Re-issue every registered worker subscription to the new peer — the
+        // replay is cursor-free because each (re)subscribe delivers a fresh
+        // initial snapshot. That snapshot is a DUPLICATE whenever nothing
+        // changed while the peer churned, so `awaitingReissueSnap` arms the
+        // per-sub dedup (see WorkerSubEntry) — without it, tabs cycling through
+        // last-wins registration re-fire every consumer listener with
+        // byte-identical data on every registration.
+        if (myPeer.capabilities.has(WORKER_RELAY_CAPABILITY)) {
+            for (const [subId, entry] of workerSubs) {
+                entry.awaitingReissueSnap = true;
+                try {
+                    myPeer.send({ type: 'worker-sub', subId, sub: entry.sub });
+                }
+                catch {
+                    // Socket failure surfaces via the transport's close handler.
+                }
+            }
+        }
+        return () => {
+            if (peer === myPeer) {
+                failAllPending(NO_SANDBOX_ERROR_MESSAGE);
+                peer = null;
+            }
+        };
+    }
+    function isSandboxConnected() {
+        return peer !== null;
+    }
+    function peerGeneration() {
+        return generation;
+    }
+    function toolNames() {
+        if (mode === 'sandbox') {
+            return peer ? Array.from(peer.tools).sort() : [];
+        }
+        // Prod mode: caller provides tool names via composeMcpRegistry
+        // wiring. Bridge core doesn't own that registry; the caller
+        // (standalone server or vite plugin) supplies dispatch handlers
+        // for prod tools directly. See createProdBridge in standalone.ts.
+        return [];
+    }
+    async function dispatch(name, args) {
+        const startedAtMs = Date.now();
+        let result;
+        try {
+            if (mode === 'sandbox') {
+                result = await dispatchSandbox(name, args);
+            }
+            else {
+                // Prod mode dispatch is wired by the caller (standalone or
+                // vite plugin) when constructing the MCP server. createBridge
+                // itself only models sandbox-mode forwarding. Calling
+                // dispatch() on a prod bridge therefore indicates a wiring
+                // error.
+                result = {
+                    ok: false,
+                    summary: 'bridge.dispatch() called in prod mode — prod tools dispatch via composeMcpRegistry directly, not through the bridge',
+                };
+            }
+        }
+        catch (err) {
+            result = {
+                ok: false,
+                summary: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (onToolEvent) {
+            try {
+                onToolEvent({
+                    timestamp: new Date(startedAtMs).toISOString(),
+                    mode,
+                    project,
+                    tool: name,
+                    args,
+                    result,
+                    durationMs: Date.now() - startedAtMs,
+                });
+            }
+            catch {
+                // Audit-log failures must not break tool dispatch.
+            }
+        }
+        return result;
+    }
+    function dispatchSandbox(name, args) {
+        if (!peer) {
+            return Promise.resolve({ ok: false, summary: NO_SANDBOX_ERROR_MESSAGE });
+        }
+        if (!peer.tools.has(name)) {
+            return Promise.resolve({
+                ok: false,
+                summary: `tool '${name}' is not registered with the connected sandbox peer`,
+            });
+        }
+        return new Promise((resolve) => {
+            const id = randomUUID();
+            const timer = setTimeout(() => {
+                if (pending.has(id)) {
+                    pending.delete(id);
+                    resolve({
+                        ok: false,
+                        summary: `sandbox call timed out after ${callTimeoutMs}ms (tool: ${name})`,
+                    });
+                }
+            }, callTimeoutMs);
+            pending.set(id, { id, resolve, timer, tool: name });
+            try {
+                peer.send({
+                    type: 'tool-call',
+                    id,
+                    name,
+                    args,
+                });
+            }
+            catch (err) {
+                clearTimeout(timer);
+                pending.delete(id);
+                resolve({
+                    ok: false,
+                    summary: `failed to send tool call to sandbox: ${err instanceof Error ? err.message : String(err)}`,
+                });
+            }
+        });
+    }
+    function dispatchWorkerOp(op) {
+        if (!peer) {
+            return Promise.reject(workerOpError('unavailable', NO_SANDBOX_ERROR_MESSAGE));
+        }
+        if (!peerHasRelay()) {
+            return Promise.reject(workerOpError('unimplemented', NO_WORKER_RELAY_ERROR_MESSAGE));
+        }
+        return new Promise((resolve, reject) => {
+            const id = randomUUID();
+            const timer = setTimeout(() => {
+                if (workerPending.has(id)) {
+                    workerPending.delete(id);
+                    reject(workerOpError('deadline-exceeded', `sandbox worker op timed out after ${callTimeoutMs}ms (op: ${op.method})`));
+                }
+            }, callTimeoutMs);
+            workerPending.set(id, { resolve, reject, timer, method: op.method });
+            try {
+                peer.send({ type: 'worker-op', id, op });
+            }
+            catch (err) {
+                clearTimeout(timer);
+                workerPending.delete(id);
+                reject(workerOpError('unavailable', `failed to send worker op to sandbox: ${err instanceof Error ? err.message : String(err)}`));
+            }
+        });
+    }
+    function subscribeWorker(sub, onSnap) {
+        const subId = randomUUID();
+        workerSubs.set(subId, { sub, onSnap });
+        if (peerHasRelay()) {
+            try {
+                peer.send({ type: 'worker-sub', subId, sub });
+            }
+            catch {
+                // Socket failure surfaces via the transport's close handler; the
+                // registry entry replays on the next peer registration.
+            }
+        }
+        // No peer (or a relay-less peer) is NOT an error here: the registry is
+        // replayed on the next registration, mirroring RTDB's offline semantics.
+        return () => {
+            if (!workerSubs.delete(subId))
+                return;
+            if (peerHasRelay()) {
+                try {
+                    peer.send({ type: 'worker-unsub', subId });
+                }
+                catch { }
+            }
+        };
+    }
+    function handleSandboxMessage(msg, msgGeneration) {
+        // Frames from a REPLACED peer's socket must not act on the current
+        // peer's state (subscriptions make stale delivery likely on tab
+        // refresh: the old tab's worker port keeps firing until its WS dies).
+        const stale = msgGeneration !== undefined && msgGeneration !== generation;
+        switch (msg.type) {
+            case 'worker-res': {
+                if (stale)
+                    return;
+                const res = msg;
+                const op = workerPending.get(res.id);
+                if (!op)
+                    return; // late or unknown — drop silently
+                clearTimeout(op.timer);
+                workerPending.delete(res.id);
+                if (res.ok) {
+                    op.resolve(res.value);
+                }
+                else {
+                    op.reject(workerOpError(res.error?.code ?? 'unknown', res.error?.message ?? 'unknown sandbox error', res.error?.denialContext));
+                }
+                return;
+            }
+            case 'worker-snap': {
+                if (stale)
+                    return;
+                const snap = msg;
+                const entry = workerSubs.get(snap.subId);
+                if (!entry)
+                    return; // unsubscribed or unknown — drop silently
+                // Re-issue dedup (see WorkerSubEntry.awaitingReissueSnap): the first
+                // snap after a peer (re)registration is the re-established listener's
+                // initial snapshot — suppress it when byte-identical to what the
+                // consumer already holds. Values are JSON-clean (they crossed the WS
+                // legs) and produced by the same serializer each time, so string
+                // equality is exact. One-frame window: the flag clears on the first
+                // snap either way, keeping steady-state delivery 1:1.
+                const json = JSON.stringify(snap.value);
+                const duplicate = entry.awaitingReissueSnap === true && json === entry.lastDeliveredJson;
+                entry.awaitingReissueSnap = false;
+                entry.lastDeliveredJson = json;
+                if (duplicate)
+                    return;
+                try {
+                    entry.onSnap(snap.value);
+                }
+                catch {
+                    // Consumer callback failures must not break the relay loop.
+                }
+                return;
+            }
+            default:
+                break;
+        }
+        switch (msg.type) {
+            case 'tool-result': {
+                const response = msg;
+                const call = pending.get(response.id);
+                if (!call)
+                    return; // late or unknown — drop silently
+                clearTimeout(call.timer);
+                pending.delete(response.id);
+                if (response.ok && response.result) {
+                    call.resolve({
+                        ok: response.result.ok,
+                        summary: response.result.summary,
+                        data: response.result.data,
+                    });
+                }
+                else {
+                    const error = response.error;
+                    call.resolve({
+                        ok: false,
+                        summary: error?.message ?? 'unknown sandbox error',
+                    });
+                }
+                break;
+            }
+            case 'pong': {
+                // Keepalive ack; no-op.
+                break;
+            }
+            case 'ping': {
+                // Browser-initiated ping; echo back.
+                if (peer) {
+                    peer.send({ type: 'pong', id: msg.id });
+                }
+                break;
+            }
+            case 'hello': {
+                // Re-hello after reconnect would arrive here, but the
+                // registration path is owned by the transport layer (it sees
+                // the WS first). Ignore.
+                break;
+            }
+            default:
+                break;
+        }
+    }
+    function health() {
+        return {
+            status: 'ok',
+            mode,
+            project,
+            sandboxConnected: peer !== null,
+            version,
+            startedAt,
+            instanceId,
+        };
+    }
+    function recordToolEvent(event) {
+        if (!onToolEvent)
+            return;
+        try {
+            onToolEvent(event);
+        }
+        catch {
+            // Audit-log failures must not break tool dispatch.
+        }
+    }
+    return {
+        mode,
+        project,
+        version,
+        startedAt,
+        instanceId,
+        confirmHandler,
+        recordToolEvent,
+        registerSandboxPeer,
+        isSandboxConnected,
+        peerGeneration,
+        toolNames,
+        dispatch,
+        dispatchWorkerOp,
+        subscribeWorker,
+        handleSandboxMessage,
+        health,
+    };
+}
+//# sourceMappingURL=bridge.js.map

package/dist/bridge/server/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/bridge/server/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAgNxB;;4CAE4C;AAC5C,SAAS,aAAa,CACpB,IAAY,EACZ,OAAe,EACf,aAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAsD,CAAC;IACpF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,aAAa,GAAG,aAAa,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,4EAA4E;IAC5E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IAEnD,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,2BAA2B;IAC3B,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;IACzD,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAErD,SAAS,cAAc,CAAC,MAAc;QACpC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC;gBACX,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;YACvB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,aAAa,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,SAAS,YAAY;QACnB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IAED,SAAS,mBAAmB,CAC1B,IAAgB,EAChB,KAAe,EACf,SAAiB,EACjB,eAAyB,EAAE,EAC3B,UAAuB;QAEvB,IAAI,IAAI,EAAE,CAAC;YACT,6DAA6D;YAC7D,cAAc,CAAC,6CAA6C,CAAC,CAAC;YAC9D,gEAAgE;YAChE,wDAAwD;YACxD,4DAA4D;YAC5D,0DAA0D;YAC1D,yCAAyC;YACzC,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;QACD,UAAU,IAAI,CAAC,CAAC;QAChB,MAAM,MAAM,GAAe;YACzB,IAAI;YACJ,KAAK,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC;YACrB,SAAS;YACT,YAAY,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC;YACnC,UAAU;SACX,CAAC;QACF,IAAI,GAAG,MAAM,CAAC;QACd,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,oEAAoE;QACpE,wEAAwE;QACxE,8DAA8D;QAC9D,6CAA6C;QAC7C,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBACxC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC;oBACP,6DAA6D;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,cAAc,CAAC,wBAAwB,CAAC,CAAC;gBACzC,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,kBAAkB;QACzB,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAED,SAAS,cAAc;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,CAAC;QACD,+DAA+D;QAC/D,4DAA4D;QAC5D,gEAAgE;QAChE,kEAAkE;QAClE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,IAA6B;QAE7B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,8DAA8D;gBAC9D,sDAAsD;gBACtD,2DAA2D;gBAC3D,SAAS;gBACT,MAAM,GAAG;oBACP,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,qHAAqH;iBAC/H,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG;gBACP,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,WAAW,CAAC;oBACV,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;oBAC9C,IAAI;oBACJ,OAAO;oBACP,IAAI,EAAE,IAAI;oBACV,IAAI;oBACJ,MAAM;oBACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;iBACrC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,eAAe,CACtB,IAAY,EACZ,IAA6B;QAE7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,SAAS,IAAI,qDAAqD;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;YAC/C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACnB,OAAO,CAAC;wBACN,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,gCAAgC,aAAa,aAAa,IAAI,GAAG;qBAC3E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,IAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,WAAW;oBACjB,EAAE;oBACF,IAAI;oBACJ,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,OAAO,CAAC;oBACN,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACpG,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,gBAAgB,CAAC,EAAmB;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACzB,MAAM,CACJ,aAAa,CACX,mBAAmB,EACnB,qCAAqC,aAAa,WAAW,EAAE,CAAC,MAAM,GAAG,CAC1E,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC;gBACH,IAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,MAAM,CACJ,aAAa,CACX,aAAa,EACb,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3F,CACF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,eAAe,CACtB,GAAqB,EACrB,MAAgC;QAEhC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,IAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,wDAAwD;YAC1D,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO;YACtC,IAAI,YAAY,EAAE,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,IAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,oBAAoB,CAAC,GAAkB,EAAE,aAAsB;QACtE,mEAAmE;QACnE,gEAAgE;QAChE,sEAAsE;QACtE,MAAM,KAAK,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,UAAU,CAAC;QAC1E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,IAAI,KAAK;oBAAE,OAAO;gBAClB,MAAM,GAAG,GAAG,GAAqB,CAAC;gBAClC,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,EAAE;oBAAE,OAAO,CAAC,kCAAkC;gBACnD,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBACvB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,MAAM,CACP,aAAa,CACX,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS,EAC5B,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,uBAAuB,EAC7C,GAAG,CAAC,KAAK,EAAE,aAAa,CACzB,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,IAAI,KAAK;oBAAE,OAAO;gBAClB,MAAM,IAAI,GAAG,GAAsB,CAAC;gBACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,KAAK;oBAAE,OAAO,CAAC,0CAA0C;gBAC9D,qEAAqE;gBACrE,sEAAsE;gBACtE,iEAAiE;gBACjE,qEAAqE;gBACrE,iEAAiE;gBACjE,oEAAoE;gBACpE,sDAAsD;gBACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,iBAAiB,CAAC;gBACzF,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;gBAClC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC/B,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,OAAO;YACT,CAAC;YACD;gBACE,MAAM;QACV,CAAC;QACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,QAAQ,GAAG,GAAuB,CAAC;gBACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,OAAO,CAAC,kCAAkC;gBACrD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACnC,IAAI,CAAC,OAAO,CAAC;wBACX,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;wBACtB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO;wBAChC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;qBAC3B,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;oBAC7B,IAAI,CAAC,OAAO,CAAC;wBACX,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,uBAAuB;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,wBAAwB;gBACxB,MAAM;YACR,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,qCAAqC;gBACrC,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,sDAAsD;gBACtD,6DAA6D;gBAC7D,yBAAyB;gBACzB,MAAM;YACR,CAAC;YACD;gBACE,MAAM;QACV,CAAC;IACH,CAAC;IAED,SAAS,MAAM;QACb,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI;YACJ,OAAO;YACP,gBAAgB,EAAE,IAAI,KAAK,IAAI;YAC/B,OAAO;YACP,SAAS;YACT,UAAU;SACX,CAAC;IACJ,CAAC;IAED,SAAS,eAAe,CAAC,KAAsB;QAC7C,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO;QACP,OAAO;QACP,SAAS;QACT,UAAU;QACV,cAAc;QACd,eAAe;QACf,mBAAmB;QACnB,kBAAkB;QAClB,cAAc;QACd,SAAS;QACT,QAAQ;QACR,gBAAgB;QAChB,eAAe;QACf,oBAAoB;QACpB,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/bridge/server/confirm-policy.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Per-tool confirmation policies for prod-mode bridge.
+ *
+ * Pure data + lookup. No I/O, no side effects, no terminal access.
+ * Lives separate from the prompt + handler so the policy decisions
+ * are reviewable in one place — the file you grep when you ask
+ * "does this tool require confirmation in prod?"
+ *
+ * Reads default to `never`; writes / deletes / deploys default to
+ * `always`. Anything not in the table defaults to `always` in prod
+ * mode (fail-safe). Sandbox mode uses `never` universally.
+ */
+export type ConfirmPolicy = 'never' | 'session' | 'always' | 'deny';
+/**
+ * Default policies for prod mode. Conservative: writes and deploys
+ * always prompt; reads and pure compute never prompt.
+ */
+export declare const DEFAULT_PROD_POLICIES: ReadonlyMap<string, ConfirmPolicy>;
+/** Sandbox mode bypasses confirmation entirely. */
+export declare const DEFAULT_SANDBOX_POLICY: ConfirmPolicy;
+/** Default for prod-mode tools NOT in DEFAULT_PROD_POLICIES — fail-safe. */
+export declare const FALLBACK_PROD_POLICY: ConfirmPolicy;
+export interface PolicyOverrides {
+    /** Tool names to lower to `never` (auto-approve). */
+    autoApprove?: string[];
+    /** Tool names to raise to `always`. Overrides `autoApprove` if both list it. */
+    requireConfirm?: string[];
+    /** Force every tool to `always`, even reads. Paranoid mode. */
+    requireConfirmAll?: boolean;
+    /** Default policy for tools NOT in the base map. Prod defaults to `always`. */
+    fallback?: ConfirmPolicy;
+}
+/**
+ * Merge a base policy map with overrides. Returns a fresh map (does
+ * not mutate the base). Use this once at bridge startup.
+ *
+ * Override precedence (high to low):
+ *   1. requireConfirmAll: forces every key to `always`
+ *   2. requireConfirm: forces listed keys to `always`
+ *   3. autoApprove: lowers listed keys to `never`
+ *   4. base map
+ *
+ * Unknown tools (not in base) get `fallback` (default `always` for
+ * prod). Override mechanisms can introduce new keys: if `autoApprove`
+ * lists a tool not in the base map, that tool gets `never`.
+ */
+export declare function buildPolicyMap(base: ReadonlyMap<string, ConfirmPolicy>, overrides?: PolicyOverrides): Map<string, ConfirmPolicy>;
+/**
+ * Look up a tool's policy, falling back as appropriate.
+ *
+ *   - If the tool is in the map, return its mapped policy.
+ *   - If not in the map AND `requireConfirmAll`, return `always`.
+ *   - Otherwise return `fallback` (default `always` for prod).
+ */
+export declare function policyFor(policies: ReadonlyMap<string, ConfirmPolicy>, tool: string, fallback?: ConfirmPolicy): ConfirmPolicy;
+//# sourceMappingURL=confirm-policy.d.ts.map

package/dist/bridge/server/confirm-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-policy.d.ts","sourceRoot":"","sources":["../../../src/bridge/server/confirm-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CA4CnE,CAAC;AAEH,mDAAmD;AACnD,eAAO,MAAM,sBAAsB,EAAE,aAAuB,CAAC;AAE7D,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,aAAwB,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,EACxC,SAAS,GAAE,eAAoB,GAC9B,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAoB5B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,EAC5C,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,aAAoC,GAC7C,aAAa,CAEf"}

package/dist/bridge/server/confirm-policy.js

@@ -0,0 +1,107 @@
+/**
+ * Per-tool confirmation policies for prod-mode bridge.
+ *
+ * Pure data + lookup. No I/O, no side effects, no terminal access.
+ * Lives separate from the prompt + handler so the policy decisions
+ * are reviewable in one place — the file you grep when you ask
+ * "does this tool require confirmation in prod?"
+ *
+ * Reads default to `never`; writes / deletes / deploys default to
+ * `always`. Anything not in the table defaults to `always` in prod
+ * mode (fail-safe). Sandbox mode uses `never` universally.
+ */
+/**
+ * Default policies for prod mode. Conservative: writes and deploys
+ * always prompt; reads and pure compute never prompt.
+ */
+export const DEFAULT_PROD_POLICIES = new Map([
+    // ── Reads / pure compute — never prompt ─────────────────────────
+    ['firestore_get_document', 'never'],
+    ['firestore_list_documents', 'never'],
+    ['firestore_query_where', 'never'],
+    ['sandbox_inspect', 'never'],
+    ['firestore_get_rules', 'never'],
+    ['firestore_get_index_status', 'never'],
+    ['firestore_discover_paths', 'never'],
+    ['firestore_extract_indexes', 'never'],
+    ['firestore_lint_rules', 'never'],
+    ['firestore_simulate_rules', 'never'],
+    ['firestore_resolve_modules', 'never'],
+    ['firestore_test_rules', 'never'],
+    ['firestore_rules_stdlib_list', 'never'],
+    ['firestore_rules_stdlib_get', 'never'],
+    ['rtdb_get', 'never'],
+    ['rtdb_get_rules', 'never'],
+    ['rtdb_simulate_access', 'never'],
+    ['rtdb_build_expression', 'never'],
+    ['rtdb_crawl_structure', 'never'],
+    // ── Writes — always prompt ──────────────────────────────────────
+    ['firestore_create_document', 'always'],
+    ['firestore_add_document', 'always'],
+    ['firestore_update_document', 'always'],
+    ['firestore_delete_document', 'always'],
+    ['firestore_batch_write', 'always'],
+    ['rtdb_set', 'always'],
+    ['rtdb_update', 'always'],
+    ['rtdb_push', 'always'],
+    ['rtdb_delete', 'always'],
+    ['rtdb_validated_write', 'always'],
+    // ── Deploys / control plane — always prompt ─────────────────────
+    ['firestore_deploy_rules', 'always'],
+    ['firestore_ensure_rules', 'always'],
+    ['firestore_provision_database', 'always'],
+    ['firestore_deploy_indexes', 'always'],
+    ['firestore_create_index', 'always'],
+    ['rtdb_deploy_rules', 'always'],
+    ['hosting_deploy', 'always'],
+    ['hosting_ensure_site', 'always'],
+    ['functions_deploy', 'always'],
+]);
+/** Sandbox mode bypasses confirmation entirely. */
+export const DEFAULT_SANDBOX_POLICY = 'never';
+/** Default for prod-mode tools NOT in DEFAULT_PROD_POLICIES — fail-safe. */
+export const FALLBACK_PROD_POLICY = 'always';
+/**
+ * Merge a base policy map with overrides. Returns a fresh map (does
+ * not mutate the base). Use this once at bridge startup.
+ *
+ * Override precedence (high to low):
+ *   1. requireConfirmAll: forces every key to `always`
+ *   2. requireConfirm: forces listed keys to `always`
+ *   3. autoApprove: lowers listed keys to `never`
+ *   4. base map
+ *
+ * Unknown tools (not in base) get `fallback` (default `always` for
+ * prod). Override mechanisms can introduce new keys: if `autoApprove`
+ * lists a tool not in the base map, that tool gets `never`.
+ */
+export function buildPolicyMap(base, overrides = {}) {
+    const result = new Map(base);
+    if (overrides.autoApprove) {
+        for (const name of overrides.autoApprove) {
+            result.set(name, 'never');
+        }
+    }
+    if (overrides.requireConfirm) {
+        for (const name of overrides.requireConfirm) {
+            result.set(name, 'always');
+        }
+    }
+    if (overrides.requireConfirmAll) {
+        for (const name of result.keys()) {
+            result.set(name, 'always');
+        }
+    }
+    return result;
+}
+/**
+ * Look up a tool's policy, falling back as appropriate.
+ *
+ *   - If the tool is in the map, return its mapped policy.
+ *   - If not in the map AND `requireConfirmAll`, return `always`.
+ *   - Otherwise return `fallback` (default `always` for prod).
+ */
+export function policyFor(policies, tool, fallback = FALLBACK_PROD_POLICY) {
+    return policies.get(tool) ?? fallback;
+}
+//# sourceMappingURL=confirm-policy.js.map

package/dist/bridge/server/confirm-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-policy.js","sourceRoot":"","sources":["../../../src/bridge/server/confirm-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAuC,IAAI,GAAG,CAAC;IAC/E,mEAAmE;IACnE,CAAC,wBAAwB,EAAE,OAAO,CAAC;IACnC,CAAC,0BAA0B,EAAE,OAAO,CAAC;IACrC,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAClC,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,qBAAqB,EAAE,OAAO,CAAC;IAChC,CAAC,4BAA4B,EAAE,OAAO,CAAC;IACvC,CAAC,0BAA0B,EAAE,OAAO,CAAC;IACrC,CAAC,2BAA2B,EAAE,OAAO,CAAC;IACtC,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACjC,CAAC,0BAA0B,EAAE,OAAO,CAAC;IACrC,CAAC,2BAA2B,EAAE,OAAO,CAAC;IACtC,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACjC,CAAC,6BAA6B,EAAE,OAAO,CAAC;IACxC,CAAC,4BAA4B,EAAE,OAAO,CAAC;IACvC,CAAC,UAAU,EAAE,OAAO,CAAC;IACrB,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAC3B,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACjC,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAClC,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAEjC,mEAAmE;IACnE,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,CAAC,wBAAwB,EAAE,QAAQ,CAAC;IACpC,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,CAAC,uBAAuB,EAAE,QAAQ,CAAC;IACnC,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,WAAW,EAAE,QAAQ,CAAC;IACvB,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,sBAAsB,EAAE,QAAQ,CAAC;IAElC,mEAAmE;IACnE,CAAC,wBAAwB,EAAE,QAAQ,CAAC;IACpC,CAAC,wBAAwB,EAAE,QAAQ,CAAC;IACpC,CAAC,8BAA8B,EAAE,QAAQ,CAAC;IAC1C,CAAC,0BAA0B,EAAE,QAAQ,CAAC;IACtC,CAAC,wBAAwB,EAAE,QAAQ,CAAC;IACpC,CAAC,mBAAmB,EAAE,QAAQ,CAAC;IAC/B,CAAC,gBAAgB,EAAE,QAAQ,CAAC;IAC5B,CAAC,qBAAqB,EAAE,QAAQ,CAAC;IACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAEH,mDAAmD;AACnD,MAAM,CAAC,MAAM,sBAAsB,GAAkB,OAAO,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAkB,QAAQ,CAAC;AAa5D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAwC,EACxC,YAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,QAA4C,EAC5C,IAAY,EACZ,WAA0B,oBAAoB;IAE9C,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACxC,CAAC"}