ssh-mcp-pro 1.0.0

package/dist/policy.d.ts

@@ -0,0 +1,64 @@
+import type { PolicyMode } from "./types.js";
+export interface PolicyConfig {
+    mode: PolicyMode;
+    allowRootLogin: boolean;
+    allowRawSudo: boolean;
+    allowDestructiveCommands: boolean;
+    allowDestructiveFs: boolean;
+    allowedHosts: string[];
+    commandAllow: string[];
+    commandDeny: string[];
+    pathAllowPrefixes: string[];
+    pathDenyPrefixes: string[];
+    localPathAllowPrefixes: string[];
+    localPathDenyPrefixes: string[];
+    tunnelAllowBindHosts: string[];
+    tunnelDenyBindHosts: string[];
+    tunnelAllowRemoteHosts: string[];
+    tunnelDenyRemoteHosts: string[];
+    tunnelAllowPorts: string[];
+    tunnelDenyPorts: string[];
+}
+export type PolicyAction = "ssh.open" | "proc.exec" | "proc.sudo" | "fs.read" | "fs.stat" | "fs.list" | "fs.write" | "fs.remove" | "fs.mkdir" | "fs.rename" | "ensure.package" | "ensure.service" | "ensure.lines" | "patch.apply" | "transfer.upload" | "transfer.download" | "transfer.local.read" | "transfer.local.write" | "transfer.local.create" | "transfer.local.overwrite" | "tunnel.local" | "tunnel.remote";
+export interface PolicyContext {
+    action: PolicyAction;
+    host?: string;
+    username?: string;
+    command?: string;
+    path?: string;
+    secondaryPath?: string;
+    localBindHost?: string;
+    localPort?: number;
+    remoteHost?: string;
+    remotePort?: number;
+    mode?: PolicyMode;
+    rawSudo?: boolean;
+    destructive?: boolean;
+}
+export interface PolicyDecision {
+    allowed: boolean;
+    mode: PolicyMode;
+    action: PolicyAction;
+    reason?: string;
+    hint?: string;
+    riskLevel?: string;
+}
+export type PolicyDecisionObserver = (decision: PolicyDecision, context: PolicyContext) => void;
+export declare function isSegmentBoundaryPathMatch(candidate: string, prefix: string, separator: string): boolean;
+export declare function normalizeRemotePosixPath(pathValue: string): string;
+export declare class PolicyEngine {
+    private readonly config;
+    private readonly observer?;
+    private readonly pathAllowPrefixes;
+    private readonly pathDenyPrefixes;
+    private readonly defaultPathAllowPrefixes;
+    private readonly localPathAllowPrefixes;
+    private readonly localPathDenyPrefixes;
+    constructor(config: PolicyConfig, observer?: PolicyDecisionObserver | undefined);
+    getEffectivePolicy(): PolicyConfig;
+    evaluate(context: PolicyContext): PolicyDecision;
+    assertAllowed(context: PolicyContext): PolicyDecision;
+    check(context: PolicyContext): PolicyDecision;
+    explain(context: PolicyContext): PolicyDecision;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,wBAAwB,EAAE,OAAO,CAAC;IAClC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GACpB,UAAU,GACV,WAAW,GACX,WAAW,GACX,SAAS,GACT,SAAS,GACT,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,iBAAiB,GACjB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GACtB,uBAAuB,GACvB,0BAA0B,GAC1B,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;AAuDhG,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAET;AA8BD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASlE;AAmCD,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAR5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAW;gBAG9B,MAAM,EAAE,YAAY,EACpB,QAAQ,CAAC,EAAE,sBAAsB,YAAA;IAqBpD,kBAAkB,IAAI,YAAY;IAmBlC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc;IA4PhD,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc;IASrD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc;IAM7C,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc;CAKhD"}

package/dist/policy.js

@@ -0,0 +1,368 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { posix as posixPath } from "node:path";
+import { createPolicyError } from "./errors.js";
+import { checkCommandSafety } from "./safety.js";
+const DEFAULT_ALLOWED_MUTATION_PREFIXES = ["/tmp", "/var/tmp", "/home", "/Users"];
+const LOCAL_TRANSFER_ACTIONS = new Set([
+    "transfer.local.read",
+    "transfer.local.write",
+    "transfer.local.create",
+    "transfer.local.overwrite",
+]);
+function compile(pattern) {
+    try {
+        return new RegExp(pattern);
+    }
+    catch {
+        return undefined;
+    }
+}
+function matchesAny(value, patterns) {
+    return patterns.some((pattern) => compile(pattern)?.test(value));
+}
+function matchesPolicyValue(value, policies) {
+    return policies.some((policy) => policy === value || matchesAny(value, [policy]));
+}
+function parsePortRange(policy) {
+    const trimmed = policy.trim();
+    const range = /^(\d{1,5})(?:-(\d{1,5}))?$/u.exec(trimmed);
+    if (!range) {
+        return undefined;
+    }
+    const start = Number(range[1]);
+    const end = range[2] === undefined ? start : Number(range[2]);
+    if (!Number.isInteger(start) ||
+        !Number.isInteger(end) ||
+        start < 0 ||
+        end > 65535 ||
+        start > end) {
+        return undefined;
+    }
+    return { start, end };
+}
+function matchesPortPolicy(port, policies) {
+    return policies.some((policy) => {
+        const range = parsePortRange(policy);
+        return range ? port >= range.start && port <= range.end : false;
+    });
+}
+export function isSegmentBoundaryPathMatch(candidate, prefix, separator) {
+    return candidate === prefix || candidate.startsWith(`${prefix}${separator}`);
+}
+function stripTrailingSeparators(value, separator, root) {
+    let stripped = value;
+    while (stripped.length > root.length && stripped.endsWith(separator)) {
+        stripped = stripped.slice(0, -separator.length);
+    }
+    return stripped;
+}
+function resolveLocalExistingPrefix(normalizedPath) {
+    const pendingSegments = [];
+    let candidate = normalizedPath;
+    while (true) {
+        try {
+            const resolvedPrefix = fs.realpathSync.native(candidate);
+            return path.join(resolvedPrefix, ...pendingSegments.reverse());
+        }
+        catch {
+            const parent = path.dirname(candidate);
+            if (parent === candidate) {
+                return normalizedPath;
+            }
+            pendingSegments.push(path.basename(candidate));
+            candidate = parent;
+        }
+    }
+}
+export function normalizeRemotePosixPath(pathValue) {
+    if (pathValue.includes("\0")) {
+        throw new Error("Path contains NUL byte");
+    }
+    const unixSeparators = pathValue.replace(/\\/g, "/");
+    const absolutePath = unixSeparators.startsWith("/") ? unixSeparators : `/${unixSeparators}`;
+    const normalized = posixPath.normalize(absolutePath);
+    return stripTrailingSeparators(normalized, "/", "/");
+}
+function normalizeLocalPolicyPath(pathValue) {
+    if (pathValue.includes("\0")) {
+        throw new Error("Path contains NUL byte");
+    }
+    const absolutePath = path.resolve(pathValue);
+    const normalized = resolveLocalExistingPrefix(path.normalize(absolutePath));
+    return stripTrailingSeparators(normalized, path.sep, path.parse(normalized).root);
+}
+function normalizePolicyPaths(paths, normalizer) {
+    return [...new Set((paths ?? []).map((pathValue) => normalizer(pathValue)))];
+}
+function isPathUnder(pathValue, prefix, separator) {
+    if (prefix === "/" || prefix === path.parse(prefix).root) {
+        return true;
+    }
+    return isSegmentBoundaryPathMatch(pathValue, prefix, separator);
+}
+function denied(decision) {
+    return { ...decision, allowed: false };
+}
+function allowed(decision) {
+    return { ...decision, allowed: true };
+}
+export class PolicyEngine {
+    config;
+    observer;
+    pathAllowPrefixes;
+    pathDenyPrefixes;
+    defaultPathAllowPrefixes;
+    localPathAllowPrefixes;
+    localPathDenyPrefixes;
+    constructor(config, observer) {
+        this.config = config;
+        this.observer = observer;
+        this.pathAllowPrefixes = normalizePolicyPaths(config.pathAllowPrefixes, normalizeRemotePosixPath);
+        this.pathDenyPrefixes = normalizePolicyPaths(config.pathDenyPrefixes, normalizeRemotePosixPath);
+        this.defaultPathAllowPrefixes = normalizePolicyPaths(DEFAULT_ALLOWED_MUTATION_PREFIXES, normalizeRemotePosixPath);
+        this.localPathAllowPrefixes = normalizePolicyPaths(config.localPathAllowPrefixes, normalizeLocalPolicyPath);
+        this.localPathDenyPrefixes = normalizePolicyPaths(config.localPathDenyPrefixes, normalizeLocalPolicyPath);
+    }
+    getEffectivePolicy() {
+        return {
+            ...this.config,
+            allowedHosts: [...this.config.allowedHosts],
+            commandAllow: [...this.config.commandAllow],
+            commandDeny: [...this.config.commandDeny],
+            pathAllowPrefixes: [...this.config.pathAllowPrefixes],
+            pathDenyPrefixes: [...this.config.pathDenyPrefixes],
+            localPathAllowPrefixes: [...(this.config.localPathAllowPrefixes ?? [])],
+            localPathDenyPrefixes: [...(this.config.localPathDenyPrefixes ?? [])],
+            tunnelAllowBindHosts: [...(this.config.tunnelAllowBindHosts ?? [])],
+            tunnelDenyBindHosts: [...(this.config.tunnelDenyBindHosts ?? [])],
+            tunnelAllowRemoteHosts: [...(this.config.tunnelAllowRemoteHosts ?? [])],
+            tunnelDenyRemoteHosts: [...(this.config.tunnelDenyRemoteHosts ?? [])],
+            tunnelAllowPorts: [...(this.config.tunnelAllowPorts ?? [])],
+            tunnelDenyPorts: [...(this.config.tunnelDenyPorts ?? [])],
+        };
+    }
+    evaluate(context) {
+        const mode = context.mode ?? this.config.mode;
+        if (context.host && this.config.allowedHosts.length > 0) {
+            const hostAllowed = this.config.allowedHosts.some((host) => host === context.host || matchesAny(context.host ?? "", [host]));
+            if (!hostAllowed) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: `Host ${context.host} is not allowed by policy`,
+                    hint: "Add the host to allowedHosts or use an SSH config alias that is allowed.",
+                });
+            }
+        }
+        if (context.action === "tunnel.local" || context.action === "tunnel.remote") {
+            const bindHost = context.localBindHost;
+            if (bindHost &&
+                (this.config.tunnelDenyBindHosts ?? []).length > 0 &&
+                matchesPolicyValue(bindHost, this.config.tunnelDenyBindHosts)) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: `Tunnel bind host ${bindHost} is denied by policy`,
+                    hint: "Choose an allowed bind host or adjust tunnelDenyBindHosts.",
+                });
+            }
+            if (bindHost &&
+                (this.config.tunnelAllowBindHosts ?? []).length > 0 &&
+                !matchesPolicyValue(bindHost, this.config.tunnelAllowBindHosts)) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: `Tunnel bind host ${bindHost} is outside allowed policy`,
+                    hint: "Choose an allowed bind host or adjust tunnelAllowBindHosts.",
+                });
+            }
+            const remoteHost = context.remoteHost;
+            if (remoteHost &&
+                (this.config.tunnelDenyRemoteHosts ?? []).length > 0 &&
+                matchesPolicyValue(remoteHost, this.config.tunnelDenyRemoteHosts)) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: `Tunnel remote host ${remoteHost} is denied by policy`,
+                    hint: "Choose an allowed remote host or adjust tunnelDenyRemoteHosts.",
+                });
+            }
+            if (remoteHost &&
+                (this.config.tunnelAllowRemoteHosts ?? []).length > 0 &&
+                !matchesPolicyValue(remoteHost, this.config.tunnelAllowRemoteHosts)) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: `Tunnel remote host ${remoteHost} is outside allowed policy`,
+                    hint: "Choose an allowed remote host or adjust tunnelAllowRemoteHosts.",
+                });
+            }
+            const ports = [context.localPort, context.remotePort].filter((port) => typeof port === "number");
+            for (const port of ports) {
+                if ((this.config.tunnelDenyPorts ?? []).length > 0 &&
+                    matchesPortPolicy(port, this.config.tunnelDenyPorts)) {
+                    return denied({
+                        mode,
+                        action: context.action,
+                        reason: `Tunnel port ${port} is denied by policy`,
+                        hint: "Choose a different port or adjust tunnelDenyPorts.",
+                    });
+                }
+                if ((this.config.tunnelAllowPorts ?? []).length > 0 &&
+                    !matchesPortPolicy(port, this.config.tunnelAllowPorts)) {
+                    return denied({
+                        mode,
+                        action: context.action,
+                        reason: `Tunnel port ${port} is outside allowed policy`,
+                        hint: "Choose an allowed port or adjust tunnelAllowPorts.",
+                    });
+                }
+            }
+        }
+        if (context.username === "root" && !this.config.allowRootLogin) {
+            return denied({
+                mode,
+                action: context.action,
+                reason: "Root SSH login is disabled by policy",
+                hint: "Connect as an unprivileged user and use approved ensure tools where possible.",
+            });
+        }
+        if (context.rawSudo && !this.config.allowRawSudo) {
+            return denied({
+                mode,
+                action: context.action,
+                reason: "Raw sudo command execution is disabled by policy",
+                hint: "Use an idempotent ensure_* tool or enable allowRawSudo explicitly.",
+            });
+        }
+        if (context.command) {
+            if (this.config.commandDeny.length > 0 &&
+                matchesAny(context.command, this.config.commandDeny)) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: "Command matched commandDeny policy",
+                    hint: "Review the command or adjust the policy.",
+                });
+            }
+            if (this.config.commandAllow.length > 0 &&
+                !matchesAny(context.command, this.config.commandAllow)) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: "Command does not match commandAllow policy",
+                    hint: "Use an allowed command or update commandAllow.",
+                });
+            }
+            const safety = checkCommandSafety(context.command);
+            if (!safety.safe && !this.config.allowDestructiveCommands) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: safety.warning ?? "Command is considered unsafe",
+                    hint: safety.suggestion ?? "Review the command before enabling destructive command policy.",
+                    ...(safety.riskLevel ? { riskLevel: safety.riskLevel } : {}),
+                });
+            }
+        }
+        const paths = [context.path, context.secondaryPath].filter((pathValue) => Boolean(pathValue));
+        if (LOCAL_TRANSFER_ACTIONS.has(context.action)) {
+            for (const pathValue of paths) {
+                let normalizedPath;
+                try {
+                    normalizedPath = normalizeLocalPolicyPath(pathValue);
+                }
+                catch {
+                    return denied({
+                        mode,
+                        action: context.action,
+                        reason: "Local path contains NUL byte",
+                        hint: "Choose a valid local path without NUL bytes.",
+                    });
+                }
+                if (this.localPathDenyPrefixes.some((prefix) => isPathUnder(normalizedPath, prefix, path.sep))) {
+                    return denied({
+                        mode,
+                        action: context.action,
+                        reason: `Local path ${pathValue} is denied by policy`,
+                        hint: "Choose a different local path or adjust localPathDenyPrefixes.",
+                    });
+                }
+                if (this.localPathAllowPrefixes.length === 0) {
+                    return denied({
+                        mode,
+                        action: context.action,
+                        reason: "Local transfer path policy has no allowed prefixes",
+                        hint: "Set localPathAllowPrefixes for MCP-server-host transfer paths.",
+                    });
+                }
+                const underAllowedPrefix = this.localPathAllowPrefixes.some((prefix) => isPathUnder(normalizedPath, prefix, path.sep));
+                if (!underAllowedPrefix) {
+                    return denied({
+                        mode,
+                        action: context.action,
+                        reason: `Local path ${pathValue} is outside allowed prefixes`,
+                        hint: `Allowed local transfer prefixes: ${this.localPathAllowPrefixes.join(", ")}`,
+                    });
+                }
+            }
+            return allowed({ mode, action: context.action });
+        }
+        for (const pathValue of paths) {
+            let normalizedPath;
+            try {
+                normalizedPath = normalizeRemotePosixPath(pathValue);
+            }
+            catch {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: "Path contains NUL byte",
+                    hint: "Choose a valid remote path without NUL bytes.",
+                });
+            }
+            if (this.pathDenyPrefixes.some((prefix) => isPathUnder(normalizedPath, prefix, "/"))) {
+                return denied({
+                    mode,
+                    action: context.action,
+                    reason: `Path ${pathValue} is denied by policy`,
+                    hint: "Choose a different path or adjust pathDenyPrefixes.",
+                });
+            }
+            const isDestructiveFs = (context.destructive ?? false) || context.action === "fs.remove";
+            const allowPrefixes = this.pathAllowPrefixes.length > 0 ? this.pathAllowPrefixes : this.defaultPathAllowPrefixes;
+            if (isDestructiveFs && !this.config.allowDestructiveFs) {
+                const underAllowedPrefix = allowPrefixes.some((prefix) => isPathUnder(normalizedPath, prefix, "/"));
+                if (!underAllowedPrefix) {
+                    return denied({
+                        mode,
+                        action: context.action,
+                        reason: `Destructive filesystem operation on ${pathValue} is outside allowed prefixes`,
+                        hint: `Allowed destructive prefixes: ${allowPrefixes.join(", ")}`,
+                    });
+                }
+            }
+        }
+        return allowed({ mode, action: context.action });
+    }
+    assertAllowed(context) {
+        const decision = this.evaluate(context);
+        this.observer?.(decision, context);
+        if (!decision.allowed && decision.mode === "enforce") {
+            throw createPolicyError(decision.reason ?? "Operation denied by policy", decision.hint);
+        }
+        return decision;
+    }
+    check(context) {
+        const decision = this.evaluate(context);
+        this.observer?.(decision, context);
+        return decision;
+    }
+    explain(context) {
+        const decision = this.evaluate({ ...context, mode: "explain" });
+        this.observer?.(decision, { ...context, mode: "explain" });
+        return decision;
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA2EjD,MAAM,iCAAiC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAClF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAe;IACnD,qBAAqB;IACrB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,QAAkB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,QAAkB;IAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACxB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QACtB,KAAK,GAAG,CAAC;QACT,GAAG,GAAG,KAAK;QACX,KAAK,GAAG,GAAG,EACX,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAkB;IACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAY;IAC7E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CAAC,cAAsB;IACxD,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,cAAc,CAAC;IAE/B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/C,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;IAC5F,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,uBAAuB,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAiB;IACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAE5E,OAAO,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA2B,EAC3B,UAAyC;IAEzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,MAAc,EAAE,SAAiB;IACvE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,QAAyC;IACvD,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,OAAO,CAAC,QAAyC;IACxD,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,YAAY;IAQJ;IACA;IARF,iBAAiB,CAAW;IAC5B,gBAAgB,CAAW;IAC3B,wBAAwB,CAAW;IACnC,sBAAsB,CAAW;IACjC,qBAAqB,CAAW;IAEjD,YACmB,MAAoB,EACpB,QAAiC;QADjC,WAAM,GAAN,MAAM,CAAc;QACpB,aAAQ,GAAR,QAAQ,CAAyB;QAElD,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,CAC3C,MAAM,CAAC,iBAAiB,EACxB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;QAChG,IAAI,CAAC,wBAAwB,GAAG,oBAAoB,CAClD,iCAAiC,EACjC,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,sBAAsB,GAAG,oBAAoB,CAChD,MAAM,CAAC,sBAAsB,EAC7B,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,qBAAqB,GAAG,oBAAoB,CAC/C,MAAM,CAAC,qBAAqB,EAC5B,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO;YACL,GAAG,IAAI,CAAC,MAAM;YACd,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC3C,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC3C,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACzC,iBAAiB,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACrD,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACnD,sBAAsB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;YACvE,qBAAqB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;YACrE,oBAAoB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YACnE,mBAAmB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YACjE,sBAAsB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;YACvE,qBAAqB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;YACrE,gBAAgB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;YAC3D,eAAe,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAsB;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAE9C,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAC1E,CAAC;YACF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAQ,OAAO,CAAC,IAAI,2BAA2B;oBACvD,IAAI,EAAE,0EAA0E;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;YACvC,IACE,QAAQ;gBACR,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBAClD,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAC7D,CAAC;gBACD,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,oBAAoB,QAAQ,sBAAsB;oBAC1D,IAAI,EAAE,4DAA4D;iBACnE,CAAC,CAAC;YACL,CAAC;YACD,IACE,QAAQ;gBACR,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAC/D,CAAC;gBACD,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,oBAAoB,QAAQ,4BAA4B;oBAChE,IAAI,EAAE,6DAA6D;iBACpE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,IACE,UAAU;gBACV,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBACpD,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,EACjE,CAAC;gBACD,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,sBAAsB,UAAU,sBAAsB;oBAC9D,IAAI,EAAE,gEAAgE;iBACvE,CAAC,CAAC;YACL,CAAC;YACD,IACE,UAAU;gBACV,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBACrD,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,EACnE,CAAC;gBACD,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,sBAAsB,UAAU,4BAA4B;oBACpE,IAAI,EAAE,iEAAiE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAC1D,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;oBAC9C,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EACpD,CAAC;oBACD,OAAO,MAAM,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,eAAe,IAAI,sBAAsB;wBACjD,IAAI,EAAE,oDAAoD;qBAC3D,CAAC,CAAC;gBACL,CAAC;gBACD,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;oBAC/C,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EACtD,CAAC;oBACD,OAAO,MAAM,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,eAAe,IAAI,4BAA4B;wBACvD,IAAI,EAAE,oDAAoD;qBAC3D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,sCAAsC;gBAC9C,IAAI,EAAE,+EAA+E;aACtF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,kDAAkD;gBAC1D,IAAI,EAAE,oEAAoE;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IACE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBAClC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EACpD,CAAC;gBACD,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,oCAAoC;oBAC5C,IAAI,EAAE,0CAA0C;iBACjD,CAAC,CAAC;YACL,CAAC;YAED,IACE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBACnC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EACtD,CAAC;gBACD,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,4CAA4C;oBACpD,IAAI,EAAE,gDAAgD;iBACvD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;gBAC1D,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,8BAA8B;oBACxD,IAAI,EACF,MAAM,CAAC,UAAU,IAAI,gEAAgE;oBACvF,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAC5F,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;QACF,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC9B,IAAI,cAAsB,CAAC;gBAC3B,IAAI,CAAC;oBACH,cAAc,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;gBACvD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,8BAA8B;wBACtC,IAAI,EAAE,8CAA8C;qBACrD,CAAC,CAAC;gBACL,CAAC;gBAED,IACE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAC1F,CAAC;oBACD,OAAO,MAAM,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,cAAc,SAAS,sBAAsB;wBACrD,IAAI,EAAE,gEAAgE;qBACvE,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,IAAI,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7C,OAAO,MAAM,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,oDAAoD;wBAC5D,IAAI,EAAE,gEAAgE;qBACvE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAC9C,CAAC;gBACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,cAAc,SAAS,8BAA8B;wBAC7D,IAAI,EAAE,oCAAoC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,IAAI,cAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,cAAc,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,wBAAwB;oBAChC,IAAI,EAAE,+CAA+C;iBACtD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrF,OAAO,MAAM,CAAC;oBACZ,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAQ,SAAS,sBAAsB;oBAC/C,IAAI,EAAE,qDAAqD;iBAC5D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;YACzF,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;YAE7F,IAAI,eAAe,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBACvD,MAAM,kBAAkB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,CACzC,CAAC;gBACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,uCAAuC,SAAS,8BAA8B;wBACtF,IAAI,EAAE,iCAAiC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,aAAa,CAAC,OAAsB;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,IAAI,4BAA4B,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,OAAsB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,OAAsB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/process.d.ts

@@ -0,0 +1,24 @@
+import type { PolicyAction, PolicyEngine } from "./policy.js";
+import type { SessionManager } from "./session.js";
+import type { ServerConfig } from "./config.js";
+import type { ExecResult } from "./types.js";
+export interface ProcessService {
+    execCommand(sessionId: string, command: string, cwd?: string, env?: Record<string, string>, timeoutMs?: number): Promise<ExecResult>;
+    execSudo(sessionId: string, command: string, password?: string, cwd?: string, timeoutMs?: number, policyOptions?: SudoPolicyOptions): Promise<ExecResult>;
+    commandExists(sessionId: string, command: string): Promise<boolean>;
+    getAvailableShell(sessionId: string): Promise<string>;
+    execWithShell(sessionId: string, command: string, cwd?: string, env?: Record<string, string>): Promise<ExecResult>;
+}
+export interface SudoPolicyOptions {
+    policyAction?: PolicyAction;
+    rawSudo?: boolean;
+    path?: string;
+    destructive?: boolean;
+}
+export interface ProcessServiceDeps {
+    sessionManager: Pick<SessionManager, "getSession" | "getOSInfo">;
+    config: Pick<ServerConfig, "commandTimeoutMs" | "maxCommandOutputBytes">;
+    policy: Pick<PolicyEngine, "assertAllowed">;
+}
+export declare function createProcessService({ sessionManager, config, policy, }: ProcessServiceDeps): ProcessService;
+//# sourceMappingURL=process.d.ts.map

package/dist/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,WAAW,cAAc;IAC7B,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,QAAQ,CACN,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,iBAAiB,GAChC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,UAAU,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,WAAW,CAAC,CAAC;IACjE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,uBAAuB,CAAC,CAAC;IACzE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;CAC7C;AA+CD,wBAAgB,oBAAoB,CAAC,EACnC,cAAc,EACd,MAAM,EACN,MAAM,GACP,EAAE,kBAAkB,GAAG,cAAc,CAuPrC"}