visus-mcp 0.6.1 → 0.6.2

package/lambda-package/index.js

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+/**
+ * Visus MCP - Dual-Mode Entry Point (Phase 2)
+ *
+ * Supports two runtime modes:
+ * 1. stdio MCP server (npx visus-mcp) - Open source tier
+ * 2. AWS Lambda handler (API Gateway) - Hosted tier
+ *
+ * Runtime detection determines which mode to use based on environment variables.
+ *
+ * Tools:
+ * - visus_fetch: Fetch and sanitize web page content
+ * - visus_fetch_structured: Extract structured data from web pages
+ *
+ * ALL content passes through the Lateos injection sanitizer before reaching the LLM.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import { visusFetch, visusFetchToolDefinition } from './tools/fetch.js';
+import { visusFetchStructured, visusFetchStructuredToolDefinition } from './tools/fetch-structured.js';
+import { visusRead, visusReadToolDefinition } from './tools/read.js';
+import { visusSearch, visusSearchToolDefinition } from './tools/search.js';
+import { closeBrowser } from './browser/playwright-renderer.js';
+import { detectRuntime, logRuntimeConfig, validateRuntime } from './runtime.js';
+import { shouldElicit } from './sanitizer/hitl-gate.js';
+import { runElicitation } from './sanitizer/elicit-runner.js';
+/**
+ * Create and configure the MCP server
+ */
+const server = new Server({
+    name: 'visus-mcp',
+    version: '0.6.0'
+}, {
+    capabilities: {
+        tools: {}
+    }
+});
+/**
+ * Handle tool list requests
+ */
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+    return {
+        tools: [
+            visusFetchToolDefinition,
+            visusFetchStructuredToolDefinition,
+            visusReadToolDefinition,
+            visusSearchToolDefinition
+        ]
+    };
+});
+/**
+ * Helper function to handle HITL elicitation for CRITICAL threats
+ *
+ * Returns modified output with threat_report removed if user declined,
+ * or blocked response if user declined to proceed.
+ */
+async function handleCriticalThreatElicitation(output, url) {
+    const threatReport = output.threat_report;
+    // Check if elicitation is needed
+    if (shouldElicit(threatReport ?? null)) {
+        const { proceed, includeReport } = await runElicitation(server, threatReport, url);
+        if (!proceed) {
+            // User declined — return blocked response with threat report
+            return {
+                output: {
+                    url,
+                    blocked: true,
+                    reason: 'User declined to proceed after CRITICAL threat detected',
+                    threat_report: threatReport
+                },
+                blocked: true
+            };
+        }
+        // User accepted — proceed with sanitized content
+        // Remove threat_report if user didn't request it
+        if (!includeReport && output.threat_report) {
+            const { threat_report, ...outputWithoutReport } = output;
+            return { output: outputWithoutReport, blocked: false };
+        }
+    }
+    return { output, blocked: false };
+}
+/**
+ * Handle tool execution requests
+ */
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    try {
+        switch (name) {
+            case 'visus_fetch': {
+                const result = await visusFetch(args);
+                if (!result.ok) {
+                    throw new McpError(ErrorCode.InternalError, `visus_fetch failed: ${result.error.message}`);
+                }
+                // Handle HITL elicitation for CRITICAL threats
+                const { output } = await handleCriticalThreatElicitation(result.value, args.url);
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify(output, null, 2)
+                        }
+                    ]
+                };
+            }
+            case 'visus_fetch_structured': {
+                const result = await visusFetchStructured(args);
+                if (!result.ok) {
+                    throw new McpError(ErrorCode.InternalError, `visus_fetch_structured failed: ${result.error.message}`);
+                }
+                // Handle HITL elicitation for CRITICAL threats
+                const { output } = await handleCriticalThreatElicitation(result.value, args.url);
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify(output, null, 2)
+                        }
+                    ]
+                };
+            }
+            case 'visus_read': {
+                const result = await visusRead(args);
+                if (!result.ok) {
+                    throw new McpError(ErrorCode.InternalError, `visus_read failed: ${result.error.message}`);
+                }
+                // Handle HITL elicitation for CRITICAL threats
+                const { output } = await handleCriticalThreatElicitation(result.value, args.url);
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify(output, null, 2)
+                        }
+                    ]
+                };
+            }
+            case 'visus_search': {
+                const result = await visusSearch(args);
+                if (!result.ok) {
+                    throw new McpError(ErrorCode.InternalError, `visus_search failed: ${result.error.message}`);
+                }
+                // Handle HITL elicitation for CRITICAL threats
+                // For search, use the query as the "URL" in the elicitation message
+                const { output } = await handleCriticalThreatElicitation(result.value, `search: ${args.query}`);
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify(output, null, 2)
+                        }
+                    ]
+                };
+            }
+            default:
+                throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);
+        }
+    }
+    catch (error) {
+        if (error instanceof McpError) {
+            throw error;
+        }
+        throw new McpError(ErrorCode.InternalError, `Tool execution failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+});
+/**
+ * Start the MCP server (stdio mode)
+ */
+async function startMcpServer() {
+    const transport = new StdioServerTransport();
+    // Connect server to transport
+    await server.connect(transport);
+    // Log startup to stderr (not stdout - MCP uses stdout)
+    console.error(JSON.stringify({
+        timestamp: new Date().toISOString(),
+        event: 'mcp_server_started',
+        name: 'visus-mcp',
+        version: '0.6.0',
+        tools: ['visus_fetch', 'visus_fetch_structured', 'visus_read', 'visus_search']
+    }));
+    // Graceful shutdown
+    process.on('SIGINT', async () => {
+        console.error(JSON.stringify({
+            timestamp: new Date().toISOString(),
+            event: 'mcp_server_shutdown'
+        }));
+        await closeBrowser();
+        process.exit(0);
+    });
+    process.on('SIGTERM', async () => {
+        console.error(JSON.stringify({
+            timestamp: new Date().toISOString(),
+            event: 'mcp_server_shutdown'
+        }));
+        await closeBrowser();
+        process.exit(0);
+    });
+}
+/**
+ * Main entry point - Dual-mode detection
+ */
+async function main() {
+    // Detect runtime environment
+    const runtime = detectRuntime();
+    logRuntimeConfig(runtime);
+    validateRuntime(runtime);
+    // Route to appropriate entry point
+    if (runtime.isStdio) {
+        // Open-source tier: stdio MCP server
+        await startMcpServer();
+    }
+    else if (runtime.isLambda) {
+        // Hosted tier: Lambda handler
+        // In Lambda mode, the handler is exported and invoked by AWS
+        // This code path is not executed; see lambda-handler.ts export below
+        console.error(JSON.stringify({
+            timestamp: new Date().toISOString(),
+            event: 'lambda_mode_detected',
+            message: 'Lambda handler will be invoked by AWS runtime'
+        }));
+    }
+}
+// Export Lambda handler (for AWS deployment)
+// This is only used when the file is imported as a module by Lambda runtime
+export { handler } from './lambda-handler.js';
+// Run stdio MCP server when executed directly (not in Lambda)
+if (!process.env.AWS_LAMBDA_FUNCTION_NAME) {
+    main().catch((error) => {
+        console.error(JSON.stringify({
+            timestamp: new Date().toISOString(),
+            event: 'startup_error',
+            error: error instanceof Error ? error.message : String(error)
+        }));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/lambda-package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,SAAS,EACT,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D;;GAEG;AACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;CACjB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE;YACL,wBAAwB;YACxB,kCAAkC;YAClC,uBAAuB;YACvB,yBAAyB;SAC1B;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,KAAK,UAAU,+BAA+B,CAC5C,MAAW,EACX,GAAW;IAEX,MAAM,YAAY,GAAG,MAAM,CAAC,aAAyC,CAAC;IAEtE,iCAAiC;IACjC,IAAI,YAAY,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CACrD,MAAM,EACN,YAAa,EACb,GAAG,CACJ,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,6DAA6D;YAC7D,OAAO;gBACL,MAAM,EAAE;oBACN,GAAG;oBACH,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,yDAAyD;oBACjE,aAAa,EAAE,YAAY;iBAC5B;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,iDAAiD;QACjD,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,EAAE,aAAa,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC;YACzD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAEjD,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAW,CAAC,CAAC;gBAE7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,uBAAuB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC9C,CAAC;gBACJ,CAAC;gBAED,+CAA+C;gBAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,+BAA+B,CACtD,MAAM,CAAC,KAAK,EACX,IAAY,CAAC,GAAG,CAClB,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;yBACtC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAW,CAAC,CAAC;gBAEvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,kCAAkC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CACzD,CAAC;gBACJ,CAAC;gBAED,+CAA+C;gBAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,+BAA+B,CACtD,MAAM,CAAC,KAAK,EACX,IAAY,CAAC,GAAG,CAClB,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;yBACtC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAW,CAAC,CAAC;gBAE5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,sBAAsB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7C,CAAC;gBACJ,CAAC;gBAED,+CAA+C;gBAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,+BAA+B,CACtD,MAAM,CAAC,KAAK,EACX,IAAY,CAAC,GAAG,CAClB,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;yBACtC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAW,CAAC,CAAC;gBAE9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC/C,CAAC;gBACJ,CAAC;gBAED,+CAA+C;gBAC/C,oEAAoE;gBACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,+BAA+B,CACtD,MAAM,CAAC,KAAK,EACZ,WAAY,IAAY,CAAC,KAAK,EAAE,CACjC,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;yBACtC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED;gBACE,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,cAAc,EACxB,iBAAiB,IAAI,EAAE,CACxB,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,KAAK,UAAU,cAAc;IAC3B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,8BAA8B;IAC9B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,uDAAuD;IACvD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,CAAC,aAAa,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC;KAC/E,CAAC,CAAC,CAAC;IAEJ,oBAAoB;IACpB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,qBAAqB;SAC7B,CAAC,CAAC,CAAC;QAEJ,MAAM,YAAY,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,qBAAqB;SAC7B,CAAC,CAAC,CAAC;QAEJ,MAAM,YAAY,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,6BAA6B;IAC7B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,mCAAmC;IACnC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,qCAAqC;QACrC,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC5B,8BAA8B;QAC9B,6DAA6D;QAC7D,qEAAqE;QACrE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,+CAA+C;SACzD,CAAC,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,4EAA4E;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,8DAA8D;AAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;IAC1C,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,eAAe;YACtB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lambda-package/lambda-handler.d.ts

@@ -0,0 +1,28 @@
+/**
+ * AWS Lambda Handler - Phase 2 Hosted Tier
+ *
+ * Provides RESTful API endpoint for Visus sanitization service
+ * Invoked via API Gateway → Lambda → DynamoDB audit logging
+ *
+ * SECURITY RULES (from CLAUDE.md):
+ * - No secrets in code (use Secrets Manager)
+ * - No wildcard IAM permissions
+ * - All user input sanitized
+ * - No cross-user data access
+ * - Reserved concurrent executions set
+ * - No plaintext logging of tokens/PII
+ */
+import type { APIGatewayProxyEvent, APIGatewayProxyResult, Context } from 'aws-lambda';
+/**
+ * Lambda handler for Visus API
+ *
+ * Routes:
+ * - POST /fetch → visus_fetch
+ * - POST /fetch-structured → visus_fetch_structured
+ *
+ * @param event API Gateway event
+ * @param context Lambda context
+ * @returns API Gateway response
+ */
+export declare function handler(event: APIGatewayProxyEvent, context: Context): Promise<APIGatewayProxyResult>;
+//# sourceMappingURL=lambda-handler.d.ts.map

package/lambda-package/lambda-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambda-handler.d.ts","sourceRoot":"","sources":["../src/lambda-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAsFvF;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,CAC3B,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,qBAAqB,CAAC,CAsNhC"}

package/lambda-package/lambda-handler.js

@@ -0,0 +1,257 @@
+/**
+ * AWS Lambda Handler - Phase 2 Hosted Tier
+ *
+ * Provides RESTful API endpoint for Visus sanitization service
+ * Invoked via API Gateway → Lambda → DynamoDB audit logging
+ *
+ * SECURITY RULES (from CLAUDE.md):
+ * - No secrets in code (use Secrets Manager)
+ * - No wildcard IAM permissions
+ * - All user input sanitized
+ * - No cross-user data access
+ * - Reserved concurrent executions set
+ * - No plaintext logging of tokens/PII
+ */
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { DynamoDBDocumentClient, PutCommand } from '@aws-sdk/lib-dynamodb';
+import { visusFetch } from './tools/fetch.js';
+import { visusFetchStructured } from './tools/fetch-structured.js';
+import { closeBrowser } from './browser/playwright-renderer.js';
+// Initialize DynamoDB client
+const ddbClient = new DynamoDBClient({});
+const docClient = DynamoDBDocumentClient.from(ddbClient);
+/**
+ * Fire-and-forget audit logging to DynamoDB
+ *
+ * Logs request metadata without blocking the response.
+ * Errors are logged but do not affect the API response.
+ *
+ * @param userId User ID from Cognito JWT
+ * @param requestId AWS request ID
+ * @param url URL being fetched
+ * @param endpoint API endpoint (/fetch or /fetch-structured)
+ * @param patternsDetected Sanitization patterns detected
+ * @param piiRedacted PII types redacted
+ */
+function logAuditEvent(userId, requestId, url, endpoint, patternsDetected, piiRedacted) {
+    const tableName = process.env.AUDIT_TABLE_NAME;
+    if (!tableName) {
+        console.error('AUDIT_TABLE_NAME not set - skipping audit logging');
+        return;
+    }
+    const now = new Date();
+    const ttl = Math.floor(now.getTime() / 1000) + (30 * 24 * 60 * 60); // 30 days from now
+    const item = {
+        user_id: userId,
+        timestamp: now.toISOString(),
+        request_id: requestId,
+        url,
+        endpoint,
+        patterns_detected: patternsDetected,
+        pii_redacted: piiRedacted,
+        ttl, // Auto-delete after 30 days
+    };
+    // Fire-and-forget: do not await
+    docClient.send(new PutCommand({
+        TableName: tableName,
+        Item: item,
+    })).catch((error) => {
+        // Log error but do not throw (fire-and-forget pattern)
+        console.error(JSON.stringify({
+            timestamp: now.toISOString(),
+            event: 'audit_logging_failed',
+            error: error instanceof Error ? error.message : String(error),
+            request_id: requestId,
+        }));
+    });
+}
+/**
+ * Lambda handler for Visus API
+ *
+ * Routes:
+ * - POST /fetch → visus_fetch
+ * - POST /fetch-structured → visus_fetch_structured
+ *
+ * @param event API Gateway event
+ * @param context Lambda context
+ * @returns API Gateway response
+ */
+export async function handler(event, context) {
+    const requestId = context.awsRequestId;
+    // Log request to stderr
+    console.error(JSON.stringify({
+        timestamp: new Date().toISOString(),
+        event: 'lambda_invocation',
+        request_id: requestId,
+        path: event.path,
+        method: event.httpMethod,
+        source_ip: event.requestContext.identity.sourceIp,
+        user_agent: event.headers['User-Agent'] || event.headers['user-agent'],
+    }));
+    try {
+        // CORS headers for all responses (environment-variable-driven allowlist)
+        const allowedOrigins = (process.env.ALLOWED_ORIGINS || '*').split(',');
+        const origin = event.headers.origin || event.headers.Origin || '';
+        const allowOrigin = allowedOrigins.includes(origin) ? origin : allowedOrigins[0] || '*';
+        const corsHeaders = {
+            'Access-Control-Allow-Origin': allowOrigin,
+            'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+            'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+            'Content-Type': 'application/json',
+        };
+        // Handle preflight OPTIONS request
+        if (event.httpMethod === 'OPTIONS') {
+            return {
+                statusCode: 200,
+                headers: corsHeaders,
+                body: '',
+            };
+        }
+        // Health check endpoint (no auth required, allows GET and POST)
+        // SECURITY FIX (FINDING 2): Moved before POST-only validation to support standard GET health checks
+        if (event.path === '/health' || event.path === '/dev/health' || event.path === '/prod/health') {
+            return {
+                statusCode: 200,
+                headers: corsHeaders,
+                body: JSON.stringify({
+                    status: 'healthy',
+                    service: 'visus-mcp',
+                    version: '0.3.1',
+                    timestamp: new Date().toISOString(),
+                }),
+            };
+        }
+        // Only allow POST requests for protected endpoints
+        if (event.httpMethod !== 'POST') {
+            return {
+                statusCode: 405,
+                headers: corsHeaders,
+                body: JSON.stringify({ error: 'Method not allowed. Use POST.' }),
+            };
+        }
+        // Parse request body
+        let body;
+        try {
+            body = JSON.parse(event.body || '{}');
+        }
+        catch (error) {
+            return {
+                statusCode: 400,
+                headers: corsHeaders,
+                body: JSON.stringify({ error: 'Invalid JSON in request body' }),
+            };
+        }
+        // SECURITY FIX (FINDING 1): Application-level authentication enforcement
+        // Extract user ID from Cognito authorizer
+        const userId = event.requestContext.authorizer?.claims?.sub;
+        // Require authentication for all protected endpoints (not already handled above)
+        if (!userId) {
+            console.error(JSON.stringify({
+                timestamp: new Date().toISOString(),
+                event: 'auth_required',
+                request_id: requestId,
+                path: event.path,
+                reason: 'Missing Cognito authorizer context - Lambda must be invoked via API Gateway',
+            }));
+            return {
+                statusCode: 401,
+                headers: corsHeaders,
+                body: JSON.stringify({
+                    error: 'Unauthorized: Authentication required. This Lambda must be invoked via API Gateway with Cognito authorizer.',
+                }),
+            };
+        }
+        // Route based on path
+        if (event.path === '/fetch' || event.path === '/dev/fetch' || event.path === '/prod/fetch') {
+            const fetchReq = body;
+            // Validate request
+            if (!fetchReq.url || typeof fetchReq.url !== 'string') {
+                return {
+                    statusCode: 400,
+                    headers: corsHeaders,
+                    body: JSON.stringify({ error: 'Missing or invalid "url" field' }),
+                };
+            }
+            // Call visus_fetch
+            const result = await visusFetch(fetchReq);
+            if (!result.ok) {
+                return {
+                    statusCode: 500,
+                    headers: corsHeaders,
+                    body: JSON.stringify({ error: result.error.message }),
+                };
+            }
+            // Fire-and-forget audit logging
+            logAuditEvent(userId, requestId, fetchReq.url, '/fetch', result.value.sanitization.patterns_detected, result.value.sanitization.pii_types_redacted);
+            return {
+                statusCode: 200,
+                headers: corsHeaders,
+                body: JSON.stringify(result.value),
+            };
+        }
+        if (event.path === '/fetch-structured' || event.path === '/dev/fetch-structured' || event.path === '/prod/fetch-structured') {
+            const fetchReq = body;
+            // Validate request
+            if (!fetchReq.url || typeof fetchReq.url !== 'string') {
+                return {
+                    statusCode: 400,
+                    headers: corsHeaders,
+                    body: JSON.stringify({ error: 'Missing or invalid "url" field' }),
+                };
+            }
+            if (!fetchReq.schema || typeof fetchReq.schema !== 'object') {
+                return {
+                    statusCode: 400,
+                    headers: corsHeaders,
+                    body: JSON.stringify({ error: 'Missing or invalid "schema" field' }),
+                };
+            }
+            // Call visus_fetch_structured
+            const result = await visusFetchStructured(fetchReq);
+            if (!result.ok) {
+                return {
+                    statusCode: 500,
+                    headers: corsHeaders,
+                    body: JSON.stringify({ error: result.error.message }),
+                };
+            }
+            // Fire-and-forget audit logging
+            logAuditEvent(userId, requestId, fetchReq.url, '/fetch-structured', result.value.sanitization.patterns_detected, result.value.sanitization.pii_types_redacted);
+            return {
+                statusCode: 200,
+                headers: corsHeaders,
+                body: JSON.stringify(result.value),
+            };
+        }
+        // Unknown path
+        return {
+            statusCode: 404,
+            headers: corsHeaders,
+            body: JSON.stringify({ error: 'Not found. Use /fetch or /fetch-structured' }),
+        };
+    }
+    catch (error) {
+        // Log error to stderr (CloudWatch Logs)
+        console.error(JSON.stringify({
+            timestamp: new Date().toISOString(),
+            event: 'lambda_error',
+            request_id: requestId,
+            error: error instanceof Error ? error.message : String(error),
+            stack: error instanceof Error ? error.stack : undefined,
+        }));
+        return {
+            statusCode: 500,
+            headers: {
+                'Content-Type': 'application/json',
+                'Access-Control-Allow-Origin': '*',
+            },
+            body: JSON.stringify({ error: 'Internal server error' }),
+        };
+    }
+    finally {
+        // Close browser to free resources
+        // Lambda containers are reused, but we clean up after each invocation
+        await closeBrowser();
+    }
+}
+//# sourceMappingURL=lambda-handler.js.map

package/lambda-package/lambda-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambda-handler.js","sourceRoot":"","sources":["../src/lambda-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAEhE,6BAA6B;AAC7B,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,EAAE,CAAC,CAAC;AACzC,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAoBzD;;;;;;;;;;;;GAYG;AACH,SAAS,aAAa,CACpB,MAAc,EACd,SAAiB,EACjB,GAAW,EACX,QAAgB,EAChB,gBAA0B,EAC1B,WAAqB;IAErB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAE/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,mBAAmB;IAEvF,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,GAAG;QACH,QAAQ;QACR,iBAAiB,EAAE,gBAAgB;QACnC,YAAY,EAAE,WAAW;QACzB,GAAG,EAAE,4BAA4B;KAClC,CAAC;IAEF,gCAAgC;IAChC,SAAS,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QAC5B,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;KACX,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC3B,uDAAuD;QACvD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,sBAAsB;YAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,KAA2B,EAC3B,OAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;IAEvC,wBAAwB;IACxB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,mBAAmB;QAC1B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,UAAU;QACxB,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ;QACjD,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;KACvE,CAAC,CAAC,CAAC;IAEJ,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAClE,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAExF,MAAM,WAAW,GAAG;YAClB,6BAA6B,EAAE,WAAW;YAC1C,8BAA8B,EAAE,oBAAoB;YACpD,8BAA8B,EAAE,6BAA6B;YAC7D,cAAc,EAAE,kBAAkB;SACnC,CAAC;QAEF,mCAAmC;QACnC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,EAAE;aACT,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,oGAAoG;QACpG,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC9F,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,OAAO;oBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;aACH,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;aACjE,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,IAAI,IAA2C,CAAC;QAChD,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,0CAA0C;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC;QAE5D,iFAAiF;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,6EAA6E;aACtF,CAAC,CAAC,CAAC;YAEJ,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,6GAA6G;iBACrH,CAAC;aACH,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3F,MAAM,QAAQ,GAAG,IAAoB,CAAC;YAEtC,mBAAmB;YACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACtD,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;iBAClE,CAAC;YACJ,CAAC;YAED,mBAAmB;YACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;iBACtD,CAAC;YACJ,CAAC;YAED,gCAAgC;YAChC,aAAa,CACX,MAAM,EACN,SAAS,EACT,QAAQ,CAAC,GAAG,EACZ,QAAQ,EACR,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,EAC3C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAC7C,CAAC;YAEF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACnC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;YAC5H,MAAM,QAAQ,GAAG,IAA8B,CAAC;YAEhD,mBAAmB;YACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACtD,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;iBAClE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5D,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;iBACrE,CAAC;YACJ,CAAC;YAED,8BAA8B;YAC9B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAEpD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;iBACtD,CAAC;YACJ,CAAC;YAED,gCAAgC;YAChC,aAAa,CACX,MAAM,EACN,SAAS,EACT,QAAQ,CAAC,GAAG,EACZ,mBAAmB,EACnB,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,EAC3C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAC7C,CAAC;YAEF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACnC,CAAC;QACJ,CAAC;QAED,eAAe;QACf,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;SAC9E,CAAC;IAEJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wCAAwC;QACxC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,6BAA6B,EAAE,GAAG;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,kCAAkC;QAClC,sEAAsE;QACtE,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}