ssh-mcp-pro 1.0.0

package/dist/remote/agent-executor.js

@@ -0,0 +1,400 @@
+import { spawn } from "node:child_process";
+import { constants, createReadStream } from "node:fs";
+import { access, writeFile } from "node:fs/promises";
+import os from "node:os";
+import { isContainerAllowed, isPathAllowed, isServiceAllowed } from "./policy.js";
+import { nowIso, randomToken, signEnvelope } from "./crypto.js";
+const SAFE_IDENTIFIER_PATTERN = /^[A-Za-z0-9_.@:-]{1,128}$/u;
+function truncateBuffer(buffer, maxBytes) {
+    if (buffer.byteLength <= maxBytes) {
+        return { value: buffer, truncated: false };
+    }
+    return appendTruncationMarker(buffer, maxBytes);
+}
+function platformShell(command) {
+    if (process.platform === "win32") {
+        return {
+            command: "powershell.exe",
+            args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", command],
+        };
+    }
+    return { command: "/bin/sh", args: ["-lc", command] };
+}
+function powerShell(command, args = []) {
+    return {
+        command: "powershell.exe",
+        args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", command, ...args],
+    };
+}
+function posixSingleQuote(value) {
+    return `'${value.replace(/'/gu, "'\\''")}'`;
+}
+function truncationMarker(maxBytes) {
+    return Buffer.from(`\n[truncated after ${maxBytes} bytes]\n`);
+}
+function appendTruncationMarker(buffer, maxBytes) {
+    if (maxBytes <= 0) {
+        return { value: Buffer.alloc(0), truncated: true };
+    }
+    const marker = truncationMarker(maxBytes);
+    if (marker.byteLength >= maxBytes) {
+        return { value: marker.subarray(0, maxBytes), truncated: true };
+    }
+    const payloadBytes = Math.max(0, maxBytes - marker.byteLength);
+    return {
+        value: Buffer.concat([buffer.subarray(0, payloadBytes), marker], maxBytes),
+        truncated: true,
+    };
+}
+function assertSafeIdentifier(value, label) {
+    if (!SAFE_IDENTIFIER_PATTERN.test(value)) {
+        throw Object.assign(new Error(`${label} contains unsupported characters`), {
+            code: "POLICY_DENIED",
+        });
+    }
+}
+function appendBoundedOutput(accumulator, chunk, maxBytes) {
+    if (maxBytes <= 0) {
+        accumulator.truncated ||= chunk.byteLength > 0;
+        return;
+    }
+    const remaining = maxBytes - accumulator.bytes;
+    if (remaining <= 0) {
+        accumulator.truncated = true;
+        return;
+    }
+    const slice = chunk.subarray(0, remaining);
+    accumulator.chunks.push(slice);
+    accumulator.bytes += slice.byteLength;
+    accumulator.truncated ||= slice.byteLength !== chunk.byteLength;
+}
+function finalizeBoundedOutput(accumulator, maxBytes) {
+    const value = Buffer.concat(accumulator.chunks, accumulator.bytes);
+    if (!accumulator.truncated) {
+        return { value, truncated: false };
+    }
+    return appendTruncationMarker(value, maxBytes);
+}
+function readFileBounded(filePath, maxBytes) {
+    return new Promise((resolve, reject) => {
+        const cappedBytes = Math.max(0, maxBytes);
+        const bytesToRead = cappedBytes + 1;
+        const chunks = [];
+        let bytes = 0;
+        const stream = createReadStream(filePath, {
+            start: 0,
+            end: bytesToRead - 1,
+            highWaterMark: Math.max(1, Math.min(64 * 1024, bytesToRead)),
+        });
+        stream.on("data", (chunk) => {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            chunks.push(buffer);
+            bytes += buffer.byteLength;
+        });
+        stream.once("error", reject);
+        stream.once("end", () => {
+            resolve(truncateBuffer(Buffer.concat(chunks, bytes), cappedBytes));
+        });
+    });
+}
+function isLogFileTarget(target) {
+    return target.includes("/") || target.includes("\\") || /^[A-Za-z]:[\\/]/u.test(target);
+}
+function runCommand(command, args, options) {
+    return new Promise((resolve) => {
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            windowsHide: true,
+            detached: process.platform !== "win32",
+        });
+        const stdout = { bytes: 0, chunks: [], truncated: false };
+        const stderr = { bytes: 0, chunks: [], truncated: false };
+        let timedOut = false;
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            if (process.platform !== "win32" && child.pid) {
+                try {
+                    process.kill(-child.pid, "SIGTERM");
+                }
+                catch {
+                    child.kill("SIGTERM");
+                }
+                setTimeout(() => {
+                    try {
+                        if (child.pid) {
+                            process.kill(-child.pid, "SIGKILL");
+                        }
+                    }
+                    catch {
+                        child.kill("SIGKILL");
+                    }
+                }, 1500).unref();
+            }
+            else {
+                child.kill("SIGTERM");
+            }
+        }, options.timeoutSeconds * 1000);
+        child.stdout.on("data", (chunk) => appendBoundedOutput(stdout, chunk, options.maxOutputBytes));
+        child.stderr.on("data", (chunk) => appendBoundedOutput(stderr, chunk, options.maxOutputBytes));
+        child.on("close", (code) => {
+            clearTimeout(timeout);
+            const out = finalizeBoundedOutput(stdout, options.maxOutputBytes);
+            const err = finalizeBoundedOutput(stderr, options.maxOutputBytes);
+            resolve({
+                exitCode: timedOut ? 124 : (code ?? 0),
+                stdout: out.value.toString("utf8"),
+                stderr: err.value.toString("utf8"),
+                truncated: out.truncated || err.truncated,
+            });
+        });
+        child.on("error", (error) => {
+            clearTimeout(timeout);
+            resolve({
+                exitCode: 127,
+                stdout: "",
+                stderr: error.message,
+                truncated: false,
+            });
+        });
+    });
+}
+export class AgentExecutor {
+    policy;
+    privateKeyPem;
+    constructor(policy, privateKeyPem) {
+        this.policy = policy;
+        this.privateKeyPem = privateKeyPem;
+    }
+    updatePolicy(policy) {
+        this.policy = policy;
+    }
+    async execute(action) {
+        const startedAt = nowIso();
+        try {
+            const result = await this.executeAllowed(action);
+            return this.signResult({
+                type: "action.result",
+                action_id: action.action_id,
+                agent_id: action.agent_id,
+                nonce: randomToken(16),
+                status: "ok",
+                exit_code: result.exitCode,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                started_at: startedAt,
+                finished_at: nowIso(),
+                truncated: result.truncated,
+                signature: "",
+            });
+        }
+        catch (error) {
+            const code = error && typeof error === "object" && "code" in error
+                ? error.code
+                : "INTERNAL_ERROR";
+            const message = error instanceof Error ? error.message : String(error);
+            return this.signResult({
+                type: "action.result",
+                action_id: action.action_id,
+                agent_id: action.agent_id,
+                nonce: randomToken(16),
+                status: "error",
+                started_at: startedAt,
+                finished_at: nowIso(),
+                truncated: false,
+                error_code: code,
+                message,
+                signature: "",
+            });
+        }
+    }
+    async executeAllowed(action) {
+        if (!this.policy.capabilities[action.capability]) {
+            throw Object.assign(new Error(`Capability ${action.capability} is not enabled`), {
+                code: "CAPABILITY_DENIED",
+            });
+        }
+        const timeoutSeconds = Math.min(Number(action.args.timeout_seconds ?? this.policy.maxActionTimeoutSeconds), this.policy.maxActionTimeoutSeconds);
+        switch (action.tool) {
+            case "get_system_status":
+                return this.getSystemStatus(timeoutSeconds);
+            case "tail_logs":
+                return this.tailLogs(String(action.args.unit_or_file ?? ""), timeoutSeconds);
+            case "restart_service":
+                return this.restartService(String(action.args.service ?? ""), timeoutSeconds);
+            case "docker_ps":
+                return runCommand("docker", ["ps", "--format", "json"], {
+                    timeoutSeconds,
+                    maxOutputBytes: this.policy.maxOutputBytes,
+                });
+            case "docker_logs":
+                return this.dockerLogs(String(action.args.container ?? ""), Number(action.args.lines ?? 100), timeoutSeconds);
+            case "docker_restart":
+                return this.dockerRestart(String(action.args.container ?? ""), timeoutSeconds);
+            case "file_read":
+                return this.fileRead(String(action.args.path ?? ""));
+            case "file_write":
+                return this.fileWrite(String(action.args.path ?? ""), String(action.args.content ?? ""));
+            case "run_shell":
+                return this.runShell(String(action.args.command ?? ""), action.args.cwd ? String(action.args.cwd) : undefined, timeoutSeconds);
+            case "run_shell_as_root":
+                return this.runShellAsRoot(String(action.args.command ?? ""), action.args.cwd ? String(action.args.cwd) : undefined, timeoutSeconds);
+            default:
+                throw Object.assign(new Error(`Unsupported action ${action.tool}`), {
+                    code: "UNSUPPORTED_PLATFORM",
+                });
+        }
+    }
+    getSystemStatus(timeoutSeconds) {
+        const command = process.platform === "win32"
+            ? "Get-ComputerInfo | Select-Object CsName,OsName,OsVersion,CsTotalPhysicalMemory | ConvertTo-Json -Compress"
+            : "uname -a && uptime && df -h /";
+        const shell = platformShell(command);
+        return runCommand(shell.command, shell.args, {
+            timeoutSeconds,
+            maxOutputBytes: this.policy.maxOutputBytes,
+        });
+    }
+    tailLogs(target, timeoutSeconds) {
+        if (!target) {
+            throw Object.assign(new Error("unit_or_file is required"), {
+                code: "POLICY_DENIED",
+            });
+        }
+        const isFileTarget = isLogFileTarget(target);
+        if (isFileTarget && !isPathAllowed(this.policy, target)) {
+            throw Object.assign(new Error("Log path is not allowed by local policy"), {
+                code: "POLICY_DENIED",
+            });
+        }
+        if (process.platform === "win32") {
+            if (isFileTarget) {
+                const shell = powerShell("Get-Content -Path $args[0] -Tail 100", [target]);
+                return runCommand(shell.command, shell.args, {
+                    timeoutSeconds,
+                    maxOutputBytes: this.policy.maxOutputBytes,
+                });
+            }
+            assertSafeIdentifier(target, "Log target");
+            const shell = powerShell("Get-EventLog -LogName $args[0] -Newest 100 | ConvertTo-Json -Compress", [target]);
+            return runCommand(shell.command, shell.args, {
+                timeoutSeconds,
+                maxOutputBytes: this.policy.maxOutputBytes,
+            });
+        }
+        if (isFileTarget) {
+            return runCommand("tail", ["-n", "100", target], {
+                timeoutSeconds,
+                maxOutputBytes: this.policy.maxOutputBytes,
+            });
+        }
+        assertSafeIdentifier(target, "Systemd unit");
+        return runCommand("journalctl", ["-u", target, "-n", "100", "--no-pager"], {
+            timeoutSeconds,
+            maxOutputBytes: this.policy.maxOutputBytes,
+        });
+    }
+    restartService(service, timeoutSeconds) {
+        if (!service || !isServiceAllowed(this.policy, service)) {
+            throw Object.assign(new Error("Service is not allowed by local policy"), {
+                code: "POLICY_DENIED",
+            });
+        }
+        assertSafeIdentifier(service, "Service name");
+        const shell = process.platform === "win32"
+            ? powerShell("Restart-Service -Name $args[0]", [service])
+            : { command: "systemctl", args: ["restart", service] };
+        return runCommand(shell.command, shell.args, {
+            timeoutSeconds,
+            maxOutputBytes: this.policy.maxOutputBytes,
+        });
+    }
+    dockerLogs(container, lines, timeoutSeconds) {
+        if (!container || !isContainerAllowed(this.policy, container)) {
+            throw Object.assign(new Error("Container is not allowed by local policy"), {
+                code: "POLICY_DENIED",
+            });
+        }
+        assertSafeIdentifier(container, "Container name");
+        return runCommand("docker", ["logs", "--tail", String(Math.min(lines, 500)), container], {
+            timeoutSeconds,
+            maxOutputBytes: this.policy.maxOutputBytes,
+        });
+    }
+    dockerRestart(container, timeoutSeconds) {
+        if (!container || !isContainerAllowed(this.policy, container)) {
+            throw Object.assign(new Error("Container is not allowed by local policy"), {
+                code: "POLICY_DENIED",
+            });
+        }
+        assertSafeIdentifier(container, "Container name");
+        return runCommand("docker", ["restart", container], {
+            timeoutSeconds,
+            maxOutputBytes: this.policy.maxOutputBytes,
+        });
+    }
+    async fileRead(filePath) {
+        if (!isPathAllowed(this.policy, filePath)) {
+            throw Object.assign(new Error("Path is not allowed by local policy"), {
+                code: "POLICY_DENIED",
+            });
+        }
+        const truncated = await readFileBounded(filePath, this.policy.maxOutputBytes);
+        return {
+            exitCode: 0,
+            stdout: truncated.value.toString("utf8"),
+            stderr: "",
+            truncated: truncated.truncated,
+        };
+    }
+    async fileWrite(filePath, content) {
+        if (!isPathAllowed(this.policy, filePath)) {
+            throw Object.assign(new Error("Path is not allowed by local policy"), {
+                code: "POLICY_DENIED",
+            });
+        }
+        await writeFile(filePath, content, { mode: constants.S_IRUSR | constants.S_IWUSR });
+        return { exitCode: 0, stdout: "written", stderr: "", truncated: false };
+    }
+    async runShell(command, cwd, timeoutSeconds) {
+        if (cwd) {
+            await access(cwd);
+        }
+        const shell = platformShell(command);
+        return runCommand(shell.command, shell.args, {
+            cwd,
+            timeoutSeconds,
+            maxOutputBytes: this.policy.maxOutputBytes,
+        });
+    }
+    runShellAsRoot(command, cwd, timeoutSeconds) {
+        if (process.platform === "win32") {
+            throw Object.assign(new Error("Root execution requires an elevated Windows agent service"), {
+                code: "UNSUPPORTED_PLATFORM_OR_PRIVILEGE",
+            });
+        }
+        if (typeof process.getuid === "function" && process.getuid() !== 0) {
+            const shell = platformShell(`sudo -n /bin/sh -lc ${posixSingleQuote(command)}`);
+            return runCommand(shell.command, shell.args, {
+                cwd,
+                timeoutSeconds,
+                maxOutputBytes: this.policy.maxOutputBytes,
+            });
+        }
+        return this.runShell(command, cwd, timeoutSeconds);
+    }
+    signResult(result) {
+        return {
+            ...result,
+            signature: signEnvelope(result, this.privateKeyPem),
+        };
+    }
+}
+export function defaultHostMetadata() {
+    return {
+        hostname: os.hostname(),
+        os: os.type(),
+        arch: os.arch(),
+        platform: process.platform,
+    };
+}
+//# sourceMappingURL=agent-executor.js.map

package/dist/remote/agent-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-executor.js","sourceRoot":"","sources":["../../src/remote/agent-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOlF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAShE,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAQ7D,SAAS,cAAc,CAAC,MAAc,EAAE,QAAgB;IACtD,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,OAAiB,EAAE;IACtD,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,sBAAsB,QAAQ,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAc,EACd,QAAgB;IAKhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC1E,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,EAAE;YACzE,IAAI,EAAE,eAAwB;SAC/B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAA8B,EAC9B,KAAa,EACb,QAAgB;IAEhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC;IAC/C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,WAAW,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IACtC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;AAClE,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAA8B,EAC9B,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,QAAgB;IAKhB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YACxC,KAAK,EAAE,CAAC;YACR,GAAG,EAAE,WAAW,GAAG,CAAC;YACpB,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;YACtB,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CACjB,OAAe,EACf,IAAc,EACd,OAAqF;IAErF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;QACH,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC9C,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBACD,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC;wBACH,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;4BACd,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;wBACtC,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,EAAE,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QAElC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CACxC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAC3D,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CACxC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAC3D,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YAClE,OAAO,CAAC;gBACN,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBACtC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAClC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS;aAC1C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC;gBACN,QAAQ,EAAE,GAAG;gBACb,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,aAAa;IAEd;IACS;IAFnB,YACU,MAAmB,EACV,aAAqB;QAD9B,WAAM,GAAN,MAAM,CAAa;QACV,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEJ,YAAY,CAAC,MAAmB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAA6B;QACzC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,UAAU,CAAC;gBACrB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;gBACtB,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;gBACnD,CAAC,CAAE,KAAmC,CAAC,IAAI;gBAC3C,CAAC,CAAC,gBAAgB,CAAC;YACvB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC,UAAU,CAAC;gBACrB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;gBACtB,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,MAAM,EAAE;gBACrB,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,IAAI;gBAChB,OAAO;gBACP,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAA6B;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,UAAU,iBAAiB,CAAC,EAAE;gBAC/E,IAAI,EAAE,mBAA4B;aACnC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAC1E,IAAI,CAAC,MAAM,CAAC,uBAAuB,CACpC,CAAC;QAEF,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;YAC9C,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;YAC/E,KAAK,iBAAiB;gBACpB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;YAChF,KAAK,WAAW;gBACd,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;oBACtD,cAAc;oBACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;iBAC3C,CAAC,CAAC;YACL,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC,UAAU,CACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,EAChC,cAAc,CACf,CAAC;YACJ,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;YACjF,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3F,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EACrD,cAAc,CACf,CAAC;YACJ,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EACrD,cAAc,CACf,CAAC;YACJ;gBACE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE;oBAClE,IAAI,EAAE,sBAA+B;iBACtC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,cAAsB;QAC5C,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,+BAA+B,CAAC;QACtC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;YAC3C,cAAc;YACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,cAAsB;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE;gBACzD,IAAI,EAAE,eAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,YAAY,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,EAAE;gBACxE,IAAI,EAAE,eAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,UAAU,CAAC,sCAAsC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3E,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;oBAC3C,cAAc;oBACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;iBAC3C,CAAC,CAAC;YACL,CAAC;YACD,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,UAAU,CACtB,uEAAuE,EACvE,CAAC,MAAM,CAAC,CACT,CAAC;YACF,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;gBAC3C,cAAc;gBACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC/C,cAAc;gBACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC7C,OAAO,UAAU,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE;YACzE,cAAc;YACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,OAAe,EAAE,cAAsB;QAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACxD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE;gBACvE,IAAI,EAAE,eAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC9C,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1B,CAAC,CAAC,UAAU,CAAC,gCAAgC,EAAE,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;YAC3C,cAAc;YACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAChB,SAAiB,EACjB,KAAa,EACb,cAAsB;QAEtB,IAAI,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,EAAE;gBACzE,IAAI,EAAE,eAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAClD,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;YACvF,cAAc;YACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,SAAiB,EAAE,cAAsB;QAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,EAAE;gBACzE,IAAI,EAAE,eAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAClD,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE;YAClD,cAAc;YACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,QAAgB;QACrC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE;gBACpE,IAAI,EAAE,eAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9E,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,OAAe;QACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE;gBACpE,IAAI,EAAE,eAAwB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAe,EACf,GAAuB,EACvB,cAAsB;QAEtB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;YAC3C,GAAG;YACH,cAAc;YACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CACpB,OAAe,EACf,GAAuB,EACvB,cAAsB;QAEtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE;gBAC1F,IAAI,EAAE,mCAA4C;aACnD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,aAAa,CAAC,uBAAuB,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChF,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;gBAC3C,GAAG;gBACH,cAAc;gBACd,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IACrD,CAAC;IAEO,UAAU,CAAC,MAA4B;QAC7C,OAAO;YACL,GAAG,MAAM;YACT,SAAS,EAAE,YAAY,CAAC,MAA4C,EAAE,IAAI,CAAC,aAAa,CAAC;SAC1F,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QACvB,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE;QACb,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC"}

package/dist/remote/config.d.ts

@@ -0,0 +1,3 @@
+import type { RemoteConfig } from "./types.js";
+export declare function loadRemoteConfig(): RemoteConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/remote/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/remote/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAqB/C,wBAAgB,gBAAgB,IAAI,YAAY,CAyC/C"}

package/dist/remote/config.js

@@ -0,0 +1,52 @@
+import path from "node:path";
+import { parseList } from "./util.js";
+function parseBoolean(value, fallback) {
+    if (value === undefined) {
+        return fallback;
+    }
+    return ["1", "true", "yes", "on"].includes(value.toLowerCase());
+}
+function parseInteger(value, fallback) {
+    if (value === undefined) {
+        return fallback;
+    }
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) ? parsed : fallback;
+}
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/u, "");
+}
+export function loadRemoteConfig() {
+    const publicBaseUrl = stripTrailingSlash(process.env.PUBLIC_BASE_URL ??
+        process.env.SSHAUTOMATOR_PUBLIC_BASE_URL ??
+        "http://localhost:3000");
+    return {
+        enabled: parseBoolean(process.env.SSH_MCP_REMOTE_AGENT_CONTROL_PLANE ??
+            process.env.SSHAUTOMATOR_REMOTE_AGENT_CONTROL_PLANE, false),
+        publicBaseUrl,
+        mcpResourceUrl: process.env.MCP_RESOURCE_URL ??
+            process.env.SSHAUTOMATOR_MCP_RESOURCE_URL ??
+            `${publicBaseUrl}/mcp`,
+        databaseUrl: process.env.DATABASE_URL ??
+            process.env.SSHAUTOMATOR_DATABASE_URL ??
+            "file:./data/sshautomator.db",
+        githubClientId: process.env.GITHUB_CLIENT_ID,
+        githubClientSecret: process.env.GITHUB_CLIENT_SECRET,
+        githubCallbackUrl: process.env.GITHUB_CALLBACK_URL ??
+            process.env.SSHAUTOMATOR_GITHUB_CALLBACK_URL ??
+            `${publicBaseUrl}/oauth/callback/github`,
+        allowAllUsers: parseBoolean(process.env.AUTH_ALLOW_ALL_USERS, false),
+        allowedGitHubLogins: parseList(process.env.AUTH_ALLOWED_GITHUB_LOGINS),
+        allowedGitHubIds: parseList(process.env.AUTH_ALLOWED_GITHUB_IDS),
+        accessTokenTtlSeconds: parseInteger(process.env.ACCESS_TOKEN_TTL_SECONDS, 900),
+        authCodeTtlSeconds: parseInteger(process.env.AUTH_CODE_TTL_SECONDS, 300),
+        enrollmentTokenTtlSeconds: parseInteger(process.env.ENROLLMENT_TOKEN_TTL_SECONDS, 600),
+        controlPlaneSigningKeyPath: process.env.CONTROL_PLANE_SIGNING_KEY_PATH ?? path.join("data", "control-plane-ed25519.json"),
+        jwtSigningKeyPath: process.env.JWT_SIGNING_KEY_PATH ?? path.join("data", "jwt-ed25519.json"),
+        agentWsPath: process.env.AGENT_WS_PATH ?? "/api/agents/connect",
+        maxActionTimeoutSeconds: parseInteger(process.env.MAX_ACTION_TIMEOUT_SECONDS, 120),
+        maxOutputBytes: parseInteger(process.env.MAX_OUTPUT_BYTES, 200_000),
+        maxOAuthClients: parseInteger(process.env.OAUTH_DCR_MAX_CLIENTS, 100),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/remote/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/remote/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,SAAS,YAAY,CAAC,KAAyB,EAAE,QAAiB;IAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,QAAgB;IAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,aAAa,GAAG,kBAAkB,CACtC,OAAO,CAAC,GAAG,CAAC,eAAe;QACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B;QACxC,uBAAuB,CAC1B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,YAAY,CACnB,OAAO,CAAC,GAAG,CAAC,kCAAkC;YAC5C,OAAO,CAAC,GAAG,CAAC,uCAAuC,EACrD,KAAK,CACN;QACD,aAAa;QACb,cAAc,EACZ,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAC5B,OAAO,CAAC,GAAG,CAAC,6BAA6B;YACzC,GAAG,aAAa,MAAM;QACxB,WAAW,EACT,OAAO,CAAC,GAAG,CAAC,YAAY;YACxB,OAAO,CAAC,GAAG,CAAC,yBAAyB;YACrC,6BAA6B;QAC/B,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACpD,iBAAiB,EACf,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,OAAO,CAAC,GAAG,CAAC,gCAAgC;YAC5C,GAAG,aAAa,wBAAwB;QAC1C,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC;QACpE,mBAAmB,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACtE,gBAAgB,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAChE,qBAAqB,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,GAAG,CAAC;QAC9E,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,GAAG,CAAC;QACtF,0BAA0B,EACxB,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC;QAC/F,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC;QAC5F,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,qBAAqB;QAC/D,uBAAuB,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,GAAG,CAAC;QAClF,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC;QACnE,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/remote/control-plane.d.ts

@@ -0,0 +1,57 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Duplex } from "node:stream";
+import { type PemKeyPair } from "./crypto.js";
+import { RemoteStore } from "./store.js";
+import type { RemoteConfig } from "./types.js";
+export declare class RemoteControlPlane {
+    readonly config: RemoteConfig;
+    readonly store: RemoteStore;
+    private readonly authorizeTransactions;
+    private readonly agentConnections;
+    private readonly agentHelloNonces;
+    private readonly pendingActions;
+    private readonly cleanupInterval;
+    private jwtKeyPair;
+    private readonly controlPlaneKeyPair;
+    constructor(config?: RemoteConfig);
+    initialize(): Promise<void>;
+    close(): void;
+    private cleanupEphemeralState;
+    handleHttp(req: IncomingMessage, res: ServerResponse, pathname: string): Promise<boolean>;
+    handleUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer<ArrayBufferLike>, pathname: string): boolean;
+    private protectedResourceMetadata;
+    private authorizationServerMetadata;
+    private handleRegister;
+    private handleAuthorize;
+    private validateAuthorizeParams;
+    private handleGitHubCallback;
+    private fetchGitHubUser;
+    private testGitHubUser;
+    private upsertGitHubUser;
+    private isGitHubUserAllowed;
+    private issueAuthorizationCode;
+    private handleToken;
+    private userFromId;
+    private handleJwks;
+    private handleMcp;
+    private handleApi;
+    private handleAgentEnroll;
+    private handleAgentMessage;
+    private handleAgentHello;
+    private handleActionResult;
+    private authenticate;
+    private sendUnauthorized;
+    private callRemoteTool;
+    private createEnrollmentToken;
+    private installCommand;
+    private updateAgentPolicy;
+    private revokeAgent;
+    private dispatchAction;
+    private requireAgent;
+    private resolveAgent;
+    private audit;
+    private requireJwtKeyPair;
+}
+export declare function createRemoteControlPlane(): Promise<RemoteControlPlane>;
+export declare function controlPlanePublicKeyId(controlPlaneKeyPair: PemKeyPair): string;
+//# sourceMappingURL=control-plane.d.ts.map

package/dist/remote/control-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../src/remote/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAeL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAUV,YAAY,EAMb,MAAM,YAAY,CAAC;AAuMpB,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsC;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;gBAErC,MAAM,eAAqB;IAQjC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,KAAK,IAAI,IAAI;IAgBb,OAAO,CAAC,qBAAqB;IAiBvB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiD/F,aAAa,CACX,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO;IAkBV,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,2BAA2B;YAerB,cAAc;YA4Cd,eAAe;IA0D7B,OAAO,CAAC,uBAAuB;YA4BjB,oBAAoB;YAoBpB,eAAe;IAuB7B,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,sBAAsB;YAoBhB,WAAW;IA6CzB,OAAO,CAAC,UAAU;YAWJ,UAAU;YAUV,SAAS;YAsET,SAAS;YAsDT,iBAAiB;YAsDjB,kBAAkB;YAsBlB,gBAAgB;YA+HhB,kBAAkB;YAsElB,YAAY;IAiB1B,OAAO,CAAC,gBAAgB;YAWV,cAAc;IA4D5B,OAAO,CAAC,qBAAqB;IAmD7B,OAAO,CAAC,cAAc;IA8BtB,OAAO,CAAC,iBAAiB;IAsDzB,OAAO,CAAC,WAAW;YAkBL,cAAc;IA4H5B,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,iBAAiB;CAM1B;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAI5E;AAED,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,UAAU,GAAG,MAAM,CAE/E"}