veto-sdk 2.2.1 → 2.4.0

package/dist/proxy/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4kB9C;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAuBxF"}

package/dist/proxy/server.js

@@ -0,0 +1,545 @@
+/**
+ * veto intercept — HTTP proxy for OpenAI and Anthropic streaming APIs.
+ *
+ * Intercepts tool calls in streaming responses (SSE format) and validates
+ * them against Veto policies before forwarding to the client.
+ *
+ * Architecture — full buffering:
+ *   1. Non-tool-call responses → passthrough chunks as they arrive
+ *   2. Tool-call responses → buffer all chunks until stream signals completion
+ *   3. Validate assembled tool call → allow (flush buffer) or block (synthetic error)
+ *   4. Buffer overflow (> maxBufferBytes) → flush + passthrough, skip validation
+ *
+ * @module proxy/server
+ */
+import http from 'node:http';
+import https from 'node:https';
+import { URL } from 'node:url';
+import { finalizeToolCall, mergeToolCallDeltas, parseSSELine, synthBlockedEvent, } from './interceptor.js';
+import { finalizeAnthropicToolUse, mergeAnthropicToolUseDelta, parseAnthropicSSELines, synthAnthropicBlockedEvent, } from './anthropic-interceptor.js';
+import { Veto } from '../core/veto.js';
+const MAX_REQUEST_BODY_BYTES = 10 * 1024 * 1024; // 10 MB
+function resolveFormat(config) {
+    const fmt = config.format ?? 'auto';
+    if (fmt === 'openai' || fmt === 'anthropic')
+        return fmt;
+    return config.target.includes('anthropic') ? 'anthropic' : 'openai';
+}
+/**
+ * Handle one proxied request.
+ */
+async function handleRequest(clientReq, clientRes, config, veto) {
+    const target = new URL(config.target);
+    const reqUrl = clientReq.url ?? '/';
+    const format = resolveFormat(config);
+    const isInterceptTarget = format === 'anthropic'
+        ? reqUrl.includes('/v1/messages')
+        : reqUrl.includes('/chat/completions');
+    // Forward request headers, replacing host
+    const headers = {
+        ...clientReq.headers,
+        host: target.host,
+    };
+    // Remove transfer-encoding since we may buffer the body
+    delete headers['content-length'];
+    // Collect request body with size limit
+    const bodyChunks = [];
+    let bodySize = 0;
+    let bodyLimitExceeded = false;
+    for await (const chunk of clientReq) {
+        const buf = chunk;
+        bodySize += buf.length;
+        if (bodySize > MAX_REQUEST_BODY_BYTES) {
+            bodyLimitExceeded = true;
+            clientReq.destroy();
+            break;
+        }
+        bodyChunks.push(buf);
+    }
+    if (bodyLimitExceeded) {
+        clientRes.writeHead(413, { 'Content-Type': 'text/plain' });
+        clientRes.end('Request body too large');
+        return;
+    }
+    const body = Buffer.concat(bodyChunks);
+    let parsedBody = null;
+    if (isInterceptTarget) {
+        try {
+            parsedBody = JSON.parse(body.toString('utf-8'));
+        }
+        catch {
+            // Not valid JSON — treat as non-streaming passthrough
+        }
+    }
+    const isStream = parsedBody?.['stream'] === true;
+    const upstreamOptions = {
+        hostname: target.hostname,
+        port: target.port || (target.protocol === 'https:' ? 443 : 80),
+        path: reqUrl,
+        method: clientReq.method,
+        headers: {
+            ...headers,
+            'content-length': body.length.toString(),
+        },
+    };
+    const upstreamLib = target.protocol === 'https:' ? https : http;
+    await new Promise((resolve, reject) => {
+        const upstreamReq = upstreamLib.request(upstreamOptions, (upstreamRes) => {
+            if (!isInterceptTarget) {
+                clientRes.writeHead(upstreamRes.statusCode ?? 200, upstreamRes.headers);
+                upstreamRes.pipe(clientRes);
+                upstreamRes.on('end', resolve);
+                upstreamRes.on('error', reject);
+                return;
+            }
+            if (format === 'anthropic') {
+                if (isStream) {
+                    clientRes.writeHead(upstreamRes.statusCode ?? 200, upstreamRes.headers);
+                    interceptAnthropicSSEStream(upstreamRes, clientRes, config, veto).then(resolve).catch(reject);
+                }
+                else {
+                    interceptAnthropicNonStreamResponse(upstreamRes, clientRes, veto).then(resolve).catch(reject);
+                }
+            }
+            else {
+                if (isStream) {
+                    clientRes.writeHead(upstreamRes.statusCode ?? 200, upstreamRes.headers);
+                    interceptSSEStream(upstreamRes, clientRes, config, veto).then(resolve).catch(reject);
+                }
+                else {
+                    interceptNonStreamResponse(upstreamRes, clientRes, veto).then(resolve).catch(reject);
+                }
+            }
+        });
+        upstreamReq.on('error', (err) => {
+            console.error('[veto intercept] Upstream connection error:', err.message);
+            if (!clientRes.headersSent) {
+                clientRes.writeHead(502, { 'Content-Type': 'text/plain' });
+                clientRes.end('Bad Gateway');
+            }
+            reject(err);
+        });
+        upstreamReq.write(body);
+        upstreamReq.end();
+    });
+}
+/**
+ * Intercept a non-streaming chat completion response.
+ * Buffer the full response, extract tool calls, validate, then forward or block.
+ */
+async function interceptNonStreamResponse(upstream, clientRes, veto) {
+    const chunks = [];
+    for await (const chunk of upstream) {
+        chunks.push(chunk);
+    }
+    const responseBody = Buffer.concat(chunks).toString('utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(responseBody);
+    }
+    catch {
+        // Not JSON — forward as-is
+        clientRes.writeHead(upstream.statusCode ?? 200, upstream.headers);
+        clientRes.end(responseBody);
+        return;
+    }
+    const choices = Array.isArray(parsed['choices']) ? parsed['choices'] : [];
+    let blocked = false;
+    let blockReason = 'Tool call blocked by veto policy';
+    for (const choice of choices) {
+        if (typeof choice !== 'object' || choice === null)
+            continue;
+        const c = choice;
+        const message = c['message'];
+        if (!message || !Array.isArray(message['tool_calls']))
+            continue;
+        for (const tc of message['tool_calls']) {
+            const fn = tc['function'];
+            if (!fn || typeof fn['name'] !== 'string')
+                continue;
+            let args = {};
+            if (typeof fn['arguments'] === 'string') {
+                try {
+                    const p = JSON.parse(fn['arguments']);
+                    if (p && typeof p === 'object' && !Array.isArray(p))
+                        args = p;
+                }
+                catch {
+                    console.warn(`[veto intercept] Malformed tool arguments for '${fn['name']}', validating with empty args`);
+                }
+            }
+            try {
+                const result = await veto.guard(fn['name'], args);
+                if (result.decision !== 'allow') {
+                    blocked = true;
+                    blockReason = result.reason ?? `Tool call '${fn['name']}' blocked`;
+                    break;
+                }
+            }
+            catch (err) {
+                console.error('[veto intercept] Unexpected guard error:', err instanceof Error ? err.message : String(err));
+                blocked = true;
+                blockReason = 'Tool call validation failed';
+                break;
+            }
+        }
+        if (blocked)
+            break;
+    }
+    if (blocked) {
+        const blockedResponse = {
+            ...parsed,
+            choices: [
+                {
+                    index: 0,
+                    message: { role: 'assistant', content: `[BLOCKED by veto] ${blockReason}` },
+                    finish_reason: 'stop',
+                },
+            ],
+        };
+        const body = JSON.stringify(blockedResponse);
+        const headers = { ...upstream.headers };
+        headers['content-length'] = Buffer.byteLength(body).toString();
+        clientRes.writeHead(200, headers);
+        clientRes.end(body);
+    }
+    else {
+        clientRes.writeHead(upstream.statusCode ?? 200, upstream.headers);
+        clientRes.end(responseBody);
+    }
+}
+/**
+ * Read the upstream SSE stream, buffer tool-call chunks, validate, then
+ * either flush the buffer or send a synthetic error.
+ */
+async function interceptSSEStream(upstream, clientRes, config, veto) {
+    const maxBufferBytes = config.maxBufferBytes;
+    // Decoder for SSE text
+    let partial = '';
+    const pendingToolCalls = new Map();
+    let bufferedLines = [];
+    let bufferedBytes = 0;
+    let mode = 'passthrough';
+    let bufferOverflowed = false;
+    const flushBuffer = () => {
+        for (const line of bufferedLines) {
+            clientRes.write(line + '\n');
+        }
+        bufferedLines = [];
+        bufferedBytes = 0;
+    };
+    for await (const rawChunk of upstream) {
+        const chunk = rawChunk.toString('utf-8');
+        partial += chunk;
+        // SSE lines are separated by \n (or \r\n)
+        const lines = partial.split('\n');
+        partial = lines.pop() ?? '';
+        for (const rawLine of lines) {
+            const line = rawLine.replace(/\r$/, '');
+            const parsed = parseSSELine(line);
+            if (parsed.done) {
+                if (mode === 'buffer') {
+                    // Stream ended during buffering without finishing tool calls — flush
+                    flushBuffer();
+                }
+                clientRes.write('data: [DONE]\n\n');
+                continue;
+            }
+            if (mode === 'overflow') {
+                // Buffer overflowed — just passthrough
+                clientRes.write(line + '\n');
+                continue;
+            }
+            if (mode === 'passthrough') {
+                if (parsed.hasToolCalls) {
+                    // Switch to buffer mode
+                    mode = 'buffer';
+                }
+                else {
+                    clientRes.write(line + '\n');
+                    continue;
+                }
+            }
+            // Buffer mode: accumulate
+            if (parsed.data) {
+                mergeToolCallDeltas(pendingToolCalls, parsed.data);
+            }
+            const lineBytes = Buffer.byteLength(line, 'utf-8');
+            bufferedBytes += lineBytes;
+            bufferedLines.push(line);
+            if (bufferedBytes > maxBufferBytes) {
+                // Overflow: flush everything and passthrough rest
+                bufferOverflowed = true;
+                mode = 'overflow';
+                flushBuffer();
+                console.warn('[veto intercept] Buffer limit exceeded — flushing without validation');
+                continue;
+            }
+            if (parsed.finishReasonToolCalls) {
+                // Validate assembled tool calls
+                let blocked = false;
+                let blockReason = 'Tool call blocked by veto policy';
+                for (const [, tc] of pendingToolCalls) {
+                    const finalized = finalizeToolCall(tc);
+                    try {
+                        const result = await veto.guard(finalized.name, finalized.arguments);
+                        if (result.decision !== 'allow') {
+                            blocked = true;
+                            blockReason = result.reason ?? `Tool call '${finalized.name}' blocked`;
+                            break;
+                        }
+                    }
+                    catch (err) {
+                        console.error('[veto intercept] Unexpected guard error:', err instanceof Error ? err.message : String(err));
+                        blocked = true;
+                        blockReason = 'Tool call validation failed';
+                        break;
+                    }
+                }
+                if (blocked) {
+                    // Clear buffered chunks — send synthetic block event
+                    bufferedLines = [];
+                    clientRes.write(synthBlockedEvent(blockReason));
+                }
+                else {
+                    flushBuffer();
+                }
+                mode = 'passthrough';
+                pendingToolCalls.clear();
+            }
+        }
+    }
+    // Flush any remaining partial line (shouldn't happen with well-formed SSE)
+    if (partial.trim()) {
+        clientRes.write(partial + '\n');
+    }
+    if (mode === 'buffer' && !bufferOverflowed) {
+        // Stream ended mid-buffer (connection closed?) — flush what we have
+        flushBuffer();
+    }
+    clientRes.end();
+}
+/**
+ * Intercept a non-streaming Anthropic Messages response.
+ * Tool calls are content blocks with type "tool_use", where input is an object (not stringified).
+ */
+async function interceptAnthropicNonStreamResponse(upstream, clientRes, veto) {
+    const chunks = [];
+    for await (const chunk of upstream) {
+        chunks.push(chunk);
+    }
+    const responseBody = Buffer.concat(chunks).toString('utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(responseBody);
+    }
+    catch {
+        clientRes.writeHead(upstream.statusCode ?? 200, upstream.headers);
+        clientRes.end(responseBody);
+        return;
+    }
+    const content = Array.isArray(parsed['content']) ? parsed['content'] : [];
+    let blocked = false;
+    let blockReason = 'Tool call blocked by veto policy';
+    for (const block of content) {
+        if (typeof block !== 'object' || block === null)
+            continue;
+        const b = block;
+        if (b['type'] !== 'tool_use')
+            continue;
+        const name = typeof b['name'] === 'string' ? b['name'] : '';
+        let args = {};
+        if (b['input'] && typeof b['input'] === 'object' && !Array.isArray(b['input'])) {
+            args = b['input'];
+        }
+        try {
+            const result = await veto.guard(name, args);
+            if (result.decision !== 'allow') {
+                blocked = true;
+                blockReason = result.reason ?? `Tool call '${name}' blocked`;
+                break;
+            }
+        }
+        catch (err) {
+            console.error('[veto intercept] Unexpected guard error:', err instanceof Error ? err.message : String(err));
+            blocked = true;
+            blockReason = 'Tool call validation failed';
+            break;
+        }
+    }
+    if (blocked) {
+        const blockedResponse = {
+            ...parsed,
+            content: [{ type: 'text', text: `[BLOCKED by veto] ${blockReason}` }],
+            stop_reason: 'end_turn',
+        };
+        const body = JSON.stringify(blockedResponse);
+        const headers = { ...upstream.headers };
+        headers['content-length'] = Buffer.byteLength(body).toString();
+        clientRes.writeHead(200, headers);
+        clientRes.end(body);
+    }
+    else {
+        clientRes.writeHead(upstream.statusCode ?? 200, upstream.headers);
+        clientRes.end(responseBody);
+    }
+}
+/**
+ * Intercept an Anthropic SSE stream.
+ *
+ * Anthropic events come as `event: <type>\ndata: <json>\n\n` pairs.
+ * Tool calls span content_block_start → content_block_delta(s) → content_block_stop.
+ * We buffer from the first tool_use block start until message_stop, then validate.
+ */
+async function interceptAnthropicSSEStream(upstream, clientRes, config, veto) {
+    const maxBufferBytes = config.maxBufferBytes;
+    let partial = '';
+    const pendingToolUses = new Map();
+    let bufferedChunks = [];
+    let bufferedBytes = 0;
+    let mode = 'passthrough';
+    let bufferOverflowed = false;
+    // Track which content block indexes are tool_use blocks
+    const toolUseIndexes = new Set();
+    // Accumulate event: + data: line pairs
+    let eventLineBuf = [];
+    const flushBuffer = () => {
+        for (const chunk of bufferedChunks) {
+            clientRes.write(chunk);
+        }
+        bufferedChunks = [];
+        bufferedBytes = 0;
+    };
+    for await (const rawChunk of upstream) {
+        const chunk = rawChunk.toString('utf-8');
+        partial += chunk;
+        const lines = partial.split('\n');
+        partial = lines.pop() ?? '';
+        for (const rawLine of lines) {
+            const line = rawLine.replace(/\r$/, '');
+            // Accumulate event: + data: pairs; empty line signals end of an SSE event
+            if (line !== '') {
+                eventLineBuf.push(line);
+                continue;
+            }
+            // Empty line = end of SSE event
+            if (eventLineBuf.length === 0) {
+                if (mode === 'passthrough')
+                    clientRes.write('\n');
+                continue;
+            }
+            const sseBlock = eventLineBuf.join('\n') + '\n\n';
+            const parsed = parseAnthropicSSELines(eventLineBuf);
+            eventLineBuf = [];
+            // Track tool_use block indexes
+            if (parsed.eventType === 'content_block_start' && parsed.data) {
+                const block = parsed.data['content_block'];
+                if (block && block['type'] === 'tool_use') {
+                    const idx = typeof parsed.data['index'] === 'number' ? parsed.data['index'] : 0;
+                    toolUseIndexes.add(idx);
+                }
+            }
+            // Determine if this event relates to a tool_use block
+            const isToolUseEvent = parsed.hasToolUse
+                || (parsed.toolUseStop && parsed.data && toolUseIndexes.has(typeof parsed.data['index'] === 'number' ? parsed.data['index'] : -1));
+            if (mode === 'overflow') {
+                clientRes.write(sseBlock);
+                continue;
+            }
+            if (mode === 'passthrough') {
+                if (isToolUseEvent) {
+                    mode = 'buffer';
+                }
+                else if (parsed.messageStop) {
+                    clientRes.write(sseBlock);
+                    continue;
+                }
+                else {
+                    clientRes.write(sseBlock);
+                    continue;
+                }
+            }
+            // Buffer mode
+            if (parsed.data && parsed.eventType) {
+                mergeAnthropicToolUseDelta(pendingToolUses, parsed.data, parsed.eventType);
+            }
+            const blockBytes = Buffer.byteLength(sseBlock, 'utf-8');
+            bufferedBytes += blockBytes;
+            bufferedChunks.push(sseBlock);
+            if (bufferedBytes > maxBufferBytes) {
+                bufferOverflowed = true;
+                mode = 'overflow';
+                flushBuffer();
+                console.warn('[veto intercept] Buffer limit exceeded — flushing without validation');
+                continue;
+            }
+            if (parsed.messageStop) {
+                // Validate all assembled tool uses
+                let blocked = false;
+                let blockReason = 'Tool call blocked by veto policy';
+                for (const [, tc] of pendingToolUses) {
+                    const finalized = finalizeAnthropicToolUse(tc);
+                    try {
+                        const result = await veto.guard(finalized.name, finalized.arguments);
+                        if (result.decision !== 'allow') {
+                            blocked = true;
+                            blockReason = result.reason ?? `Tool call '${finalized.name}' blocked`;
+                            break;
+                        }
+                    }
+                    catch (err) {
+                        console.error('[veto intercept] Unexpected guard error:', err instanceof Error ? err.message : String(err));
+                        blocked = true;
+                        blockReason = 'Tool call validation failed';
+                        break;
+                    }
+                }
+                if (blocked) {
+                    bufferedChunks = [];
+                    clientRes.write(synthAnthropicBlockedEvent(blockReason));
+                }
+                else {
+                    flushBuffer();
+                }
+                mode = 'passthrough';
+                pendingToolUses.clear();
+                toolUseIndexes.clear();
+            }
+        }
+    }
+    // Flush remaining partial event lines
+    if (partial.trim()) {
+        clientRes.write(partial + '\n');
+    }
+    if (mode === 'buffer' && !bufferOverflowed) {
+        flushBuffer();
+    }
+    clientRes.end();
+}
+/**
+ * Start the veto intercept proxy server.
+ * Returns a cleanup function that stops the server and destroys the Veto instance.
+ */
+export async function startProxyServer(config) {
+    const veto = await Veto.init({ configDir: config.configDir });
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            handleRequest(req, res, config, veto).catch((err) => {
+                if (!res.headersSent) {
+                    res.writeHead(500, { 'Content-Type': 'text/plain' });
+                    const detail = err instanceof Error ? err.message : String(err);
+                    console.error('[veto intercept] Internal proxy error:', detail);
+                    res.end('Internal proxy error');
+                }
+            });
+        });
+        server.on('error', reject);
+        server.listen(config.port, '127.0.0.1', () => {
+            resolve(async () => {
+                await new Promise((r, e) => server.close((err) => (err ? e(err) : r())));
+                veto.dispose();
+            });
+        });
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/proxy/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,GAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAEzD,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IACpC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAC1B,SAA+B,EAC/B,SAA8B,EAC9B,MAAmB,EACnB,IAAU;IAEV,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAErC,MAAM,iBAAiB,GACrB,MAAM,KAAK,WAAW;QACpB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE3C,0CAA0C;IAC1C,MAAM,OAAO,GAAkD;QAC7D,GAAG,SAAS,CAAC,OAAO;QACpB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IACF,wDAAwD;IACxD,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjC,uCAAuC;IACvC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,KAAe,CAAC;QAC5B,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC;QACvB,IAAI,QAAQ,GAAG,sBAAsB,EAAE,CAAC;YACtC,iBAAiB,GAAG,IAAI,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM;QACR,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,UAAU,GAAmC,IAAI,CAAC;IACtD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA4B,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IAEjD,MAAM,eAAe,GAAyB;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE;YACP,GAAG,OAAO;YACV,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;SACzC;KACF,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,WAAW,EAAE,EAAE;YACvE,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,IAAI,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;gBACxE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC5B,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/B,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,IAAI,QAAQ,EAAE,CAAC;oBACb,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,IAAI,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;oBACxE,2BAA2B,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChG,CAAC;qBAAM,CAAC;oBACN,mCAAmC,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,QAAQ,EAAE,CAAC;oBACb,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,IAAI,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;oBACxE,kBAAkB,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvF,CAAC;qBAAM,CAAC;oBACN,0BAA0B,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC9B,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1E,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;gBAC3B,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC3D,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,WAAW,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,0BAA0B,CACvC,QAA8B,EAC9B,SAA8B,EAC9B,IAAU;IAEV,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE7D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;QAC3B,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,kCAAkC,CAAC;IAErD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAwC,CAAC;QACpE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAAE,SAAS;QAEhE,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,YAAY,CAA8B,EAAE,CAAC;YACpE,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAwC,CAAC;YACjE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAEpD,IAAI,IAAI,GAA4B,EAAE,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAW,CAAC,CAAC;oBAChD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;wBAAE,IAAI,GAAG,CAA4B,CAAC;gBAC3F,CAAC;gBAAC,MAAM,CAAC;oBAEP,OAAO,CAAC,IAAI,CAAC,kDAAkD,EAAE,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;gBAC5G,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAW,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAChC,OAAO,GAAG,IAAI,CAAC;oBACf,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;oBACnE,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5G,OAAO,GAAG,IAAI,CAAC;gBACf,WAAW,GAAG,6BAA6B,CAAC;gBAC5C,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,OAAO;YAAE,MAAM;IACrB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,eAAe,GAAG;YACtB,GAAG,MAAM;YACT,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,CAAC;oBACR,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,WAAW,EAAE,EAAE;oBAC3E,aAAa,EAAE,MAAM;iBACtB;aACF;SACF,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/D,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,QAA8B,EAC9B,SAA8B,EAC9B,MAAmB,EACnB,IAAU;IAEV,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAE7C,uBAAuB;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5D,IAAI,aAAa,GAAa,EAAE,CAAC;IACjC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,IAAI,GAA0C,aAAa,CAAC;IAChE,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,aAAa,GAAG,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,KAAK,GAAI,QAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,KAAK,CAAC;QAEjB,0CAA0C;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAE5B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAElC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,qEAAqE;oBACrE,WAAW,EAAE,CAAC;gBAChB,CAAC;gBACD,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,uCAAuC;gBACvC,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC3B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxB,wBAAwB;oBACxB,IAAI,GAAG,QAAQ,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;oBAC7B,SAAS;gBACX,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnD,aAAa,IAAI,SAAS,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEzB,IAAI,aAAa,GAAG,cAAc,EAAE,CAAC;gBACnC,kDAAkD;gBAClD,gBAAgB,GAAG,IAAI,CAAC;gBACxB,IAAI,GAAG,UAAU,CAAC;gBAClB,WAAW,EAAE,CAAC;gBAEd,OAAO,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACjC,gCAAgC;gBAChC,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,WAAW,GAAG,kCAAkC,CAAC;gBAErD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;oBACtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;oBACvC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;wBACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;4BAChC,OAAO,GAAG,IAAI,CAAC;4BACf,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,SAAS,CAAC,IAAI,WAAW,CAAC;4BACvE,MAAM;wBACR,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC5G,OAAO,GAAG,IAAI,CAAC;wBACf,WAAW,GAAG,6BAA6B,CAAC;wBAC5C,MAAM;oBACR,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ,qDAAqD;oBACrD,aAAa,GAAG,EAAE,CAAC;oBACnB,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,WAAW,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,GAAG,aAAa,CAAC;gBACrB,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,oEAAoE;QACpE,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,GAAG,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mCAAmC,CAChD,QAA8B,EAC9B,SAA8B,EAC9B,IAAU;IAEV,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE7D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,kCAAkC,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,SAAS;QAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC/E,IAAI,GAAG,CAAC,CAAC,OAAO,CAA4B,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChC,OAAO,GAAG,IAAI,CAAC;gBACf,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,IAAI,WAAW,CAAC;gBAC7D,MAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5G,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,GAAG,6BAA6B,CAAC;YAC5C,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,eAAe,GAAG;YACtB,GAAG,MAAM;YACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,WAAW,EAAE,EAAE,CAAC;YACrE,WAAW,EAAE,UAAU;SACxB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/D,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,2BAA2B,CACxC,QAA8B,EAC9B,SAA8B,EAC9B,MAAmB,EACnB,IAAU;IAEV,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAE7C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAC;IACnE,IAAI,cAAc,GAAa,EAAE,CAAC;IAClC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,IAAI,GAA0C,aAAa,CAAC;IAChE,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,wDAAwD;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,uCAAuC;IACvC,IAAI,YAAY,GAAa,EAAE,CAAC;IAEhC,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,cAAc,GAAG,EAAE,CAAC;QACpB,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,KAAK,GAAI,QAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,KAAK,CAAC;QAEjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAE5B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAExC,0EAA0E;YAC1E,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,gCAAgC;YAChC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,aAAa;oBAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClD,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YAClD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;YACpD,YAAY,GAAG,EAAE,CAAC;YAElB,+BAA+B;YAC/B,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAwC,CAAC;gBAClF,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC1C,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU;mBACnC,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CACzD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC,CAAC;YAEL,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC3B,IAAI,cAAc,EAAE,CAAC;oBACnB,IAAI,GAAG,QAAQ,CAAC;gBAClB,CAAC;qBAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC9B,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC1B,SAAS;gBACX,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC1B,SAAS;gBACX,CAAC;YACH,CAAC;YAED,cAAc;YACd,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpC,0BAA0B,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7E,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxD,aAAa,IAAI,UAAU,CAAC;YAC5B,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,aAAa,GAAG,cAAc,EAAE,CAAC;gBACnC,gBAAgB,GAAG,IAAI,CAAC;gBACxB,IAAI,GAAG,UAAU,CAAC;gBAClB,WAAW,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,mCAAmC;gBACnC,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,WAAW,GAAG,kCAAkC,CAAC;gBAErD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;oBACrC,MAAM,SAAS,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;oBAC/C,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;wBACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;4BAChC,OAAO,GAAG,IAAI,CAAC;4BACf,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,SAAS,CAAC,IAAI,WAAW,CAAC;4BACvE,MAAM;wBACR,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC5G,OAAO,GAAG,IAAI,CAAC;wBACf,WAAW,GAAG,6BAA6B,CAAC;wBAC5C,MAAM;oBACR,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ,cAAc,GAAG,EAAE,CAAC;oBACpB,SAAS,CAAC,KAAK,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3D,CAAC;qBAAM,CAAC;oBACN,WAAW,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,GAAG,aAAa,CAAC;gBACrB,eAAe,CAAC,KAAK,EAAE,CAAC;gBACxB,cAAc,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,GAAG,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAmB;IACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;oBACrD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAChE,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,MAAM,CAAC,CAAC;oBAChE,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YAC3C,OAAO,CAAC,KAAK,IAAI,EAAE;gBACjB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/proxy/types.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Type definitions for veto intercept proxy.
+ *
+ * @module proxy/types
+ */
+export interface ProxyConfig {
+    /** Port for the local proxy to listen on. Default: 8080 */
+    port: number;
+    /** Upstream target URL. Default: https://api.openai.com */
+    target: string;
+    /** Max bytes to buffer before giving up and flushing. Default: 1MB */
+    maxBufferBytes: number;
+    /** Path to veto config directory. Default: ./veto */
+    configDir: string;
+    /** SSE format to intercept. 'auto' detects from target URL. Default: 'auto' */
+    format?: 'openai' | 'anthropic' | 'auto';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/proxy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/proxy/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;CAC1C"}

package/dist/proxy/types.js

@@ -0,0 +1,7 @@
+/**
+ * Type definitions for veto intercept proxy.
+ *
+ * @module proxy/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/proxy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/proxy/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/rate-limiting/evaluator.d.ts

@@ -0,0 +1,17 @@
+import type { RateLimitEntry } from './types.js';
+import type { ValidationContext } from '../types/config.js';
+import type { Logger } from '../utils/logger.js';
+export interface RateLimitStore {
+    checkAndRecord(key: string, maxCalls: number, windowMs: number): boolean | Promise<boolean>;
+    clear(): void | Promise<void>;
+}
+export declare function buildScopeKey(entry: RateLimitEntry, ctx: Pick<ValidationContext, 'agentId' | 'userId' | 'sessionId'>, toolName: string, logger: Logger, ruleId?: string): string;
+/**
+ * Evaluate rate limits for a tool call.
+ * Returns null if all limits pass, or a denial reason string if any limit is exceeded.
+ *
+ * When no store is provided, falls back to the built-in in-memory sliding window store.
+ * Accepts async stores (e.g. Redis) — callers must await the result.
+ */
+export declare function evaluateRateLimits(rateLimits: RateLimitEntry[], ctx: Pick<ValidationContext, 'agentId' | 'userId' | 'sessionId'>, toolName: string, logger: Logger, ruleId?: string, store?: RateLimitStore): Promise<string | null>;
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/rate-limiting/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/rate-limiting/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,KAAK,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,EAChE,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAgBR;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,cAAc,EAAE,EAC5B,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,EAChE,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBxB"}