wicked-crew 0.7.40 → 0.7.46

package/dist/mcp/policies.js

@@ -0,0 +1,400 @@
+/**
+ * MCP policies: the preview matrix and the approvals (DES-MCP-TOOLS-001 §4.5, §4.7, §8; slice S6).
+ *
+ * - **Preview.** `preview` answers what a call to each tool WOULD get, per phase role × seat × run
+ *   mode, under the policies in the store right now. It is the engine's own evaluation
+ *   (`Core.previewMcpCalls`, the same `evaluate` the broker's `evaluateMcpCall` runs) over
+ *   synthetic unit cells, and nothing is recorded. `previewUnsaved` does the same for a server
+ *   that is being added, judged as if it were saved now.
+ * - **Approvals.** An approval is an audited policy edit, never a grant. It adds a token to the
+ *   `excludes` of the ledger rules the `mcp-defaults` pack ships: `MCP-FIRST-USE` (the first use
+ *   of a server asks in every mode) and `MCP-POSTURE-WRITE` (balanced mode asks for a write until
+ *   the tool is approved). Approving a SERVER (`mcp:<server>`) approves its first use only, so its
+ *   write tools still ask in balanced mode, one by one (§4.5: a server-level grant would hide the
+ *   destructive tools behind the one read the operator tried). Approving a TOOL
+ *   (`mcp:<server>/<tool>`) approves that tool's first use and its writes. Revoking removes the
+ *   token from both. An approval never lifts an engine gate (D-1, D-5) or an explicit deny:
+ *   deny dominates in the engine.
+ * - **Withdrawal.** A saved tool whose schema changed, and a removed server, lose their approvals,
+ *   so the next call asks again (operator decision 1: first use asks, "and again when a tool's
+ *   schema changes"). A server-wide approval cannot exclude one tool, so a changed tool withdraws
+ *   the server's approval too: the server asks again on its next first use.
+ *
+ * Ledger edits are read-modify-write of one rule, so they are serialized here.
+ */
+import { MCP_SERVER_NAME_RE, parseMcpSubject } from './classify.js';
+import { McpRegistryError } from './registry.js';
+/**
+ * A ledger edit that failed part-way. `changed` names the rules still changed after the rollback
+ * (empty when the rollback restored them all); the route audits those before answering 502.
+ */
+export class McpLedgerEditError extends McpRegistryError {
+    changed;
+    constructor(changed, message) {
+        super(502, 'ledger_edit_failed', message);
+        this.changed = changed;
+    }
+}
+/** The first-use approvals ledger (the engine reads its `excludes`, active or retired). */
+export const FIRST_USE_LEDGER = 'MCP-FIRST-USE';
+/** The balanced-mode write approvals ledger. */
+export const WRITE_LEDGER = 'MCP-POSTURE-WRITE';
+/** The six seats a governed unit can run on; the matrix has one column per seat. */
+export const MCP_PREVIEW_SEATS = ['claude', 'codex', 'opencode', 'copilot', 'pi', 'agy'];
+export const MCP_PREVIEW_ROLES = ['creator', 'evaluator', 'recon'];
+export const MCP_RUN_MODES = ['ask', 'balanced', 'autonomous'];
+/** `mcp:<server>` or `mcp:<server>/<tool>` → its parts, or `null`. */
+export function parseApprovalSubject(subject) {
+    if (!subject.startsWith('mcp:'))
+        return null;
+    const rest = subject.slice(4);
+    if (!rest.includes('/'))
+        return MCP_SERVER_NAME_RE.test(rest) ? { server: rest, tool: null } : null;
+    const parts = parseMcpSubject(subject);
+    if (parts === null || !/^[A-Za-z0-9_.-]{1,128}$/.test(parts.tool))
+        return null;
+    return parts;
+}
+/** Engine tool annotations: only the hints (the engine ignores `title`). */
+function hints(a) {
+    if (a === null)
+        return null;
+    const out = {};
+    if (a.readOnlyHint !== undefined)
+        out.readOnlyHint = a.readOnlyHint;
+    if (a.destructiveHint !== undefined)
+        out.destructiveHint = a.destructiveHint;
+    if (a.idempotentHint !== undefined)
+        out.idempotentHint = a.idempotentHint;
+    if (a.openWorldHint !== undefined)
+        out.openWorldHint = a.openWorldHint;
+    return out;
+}
+function approvalState(tokens, server, subject) {
+    if (tokens.has(`mcp:${server}`))
+        return 'server';
+    if (tokens.has(subject))
+        return 'tool';
+    return null;
+}
+export class McpPolicies {
+    registry;
+    engine;
+    chain = Promise.resolve();
+    constructor(registry, engine) {
+        this.registry = registry;
+        this.engine = engine;
+    }
+    // ── the preview ────────────────────────────────────────────────────────────────────────────
+    async preview(query) {
+        const cells = this.cells(query);
+        const { servers } = await this.registry.list();
+        let targets;
+        if (query.subject !== undefined) {
+            const parts = parseMcpSubject(query.subject);
+            const server = parts === null ? undefined : servers.find((s) => s.name === parts.server);
+            const tool = server?.tools.find((t) => t.name === parts?.tool);
+            if (server === undefined || tool === undefined)
+                throw new McpRegistryError(404, 'unknown_tool', `no tool ${query.subject}`);
+            targets = [{ server, tool }];
+        }
+        else if (query.server !== undefined) {
+            const server = servers.find((s) => s.name === query.server);
+            if (server === undefined)
+                throw new McpRegistryError(404, 'unknown_server', `no MCP server named ${query.server}`);
+            targets = server.tools.filter((t) => t.status !== 'gone').map((tool) => ({ server, tool }));
+        }
+        else {
+            targets = servers.flatMap((server) => server.tools.filter((t) => t.status !== 'gone').map((tool) => ({ server, tool })));
+        }
+        const ledgers = await this.ledgers();
+        const calls = targets.map(({ server, tool }) => ({
+            server: server.name,
+            tool: tool.name,
+            annotations: hints(tool.annotations),
+            classOverride: tool.classOverride,
+            // What the broker will send (§6 step 2): unknown, disabled or changed is unregistered.
+            registered: server.enabled && tool.enabled && tool.status === 'registered',
+            kind: server.kind,
+        }));
+        const results = await this.judge(calls, cells);
+        return {
+            ...this.axes(cells, query.phaseId),
+            withdrawOnSave: [],
+            tools: targets.map(({ server, tool }, i) => ({
+                subject: tool.subject,
+                server: server.name,
+                tool: tool.name,
+                class: results[i]?.[0]?.class ?? tool.class,
+                status: tool.status,
+                enabled: server.enabled && tool.enabled,
+                registered: calls[i]?.registered ?? false,
+                approval: this.approvalOf(ledgers, server.name, tool.subject),
+                cells: results[i] ?? [],
+            })),
+        };
+    }
+    /**
+     * The matrix for a server that is being added (`POST /mcp/servers/preview`): every tool judged
+     * as if the preview were saved now, so the operator sees what would run, ask or be denied.
+     */
+    async previewUnsaved(server, tools) {
+        const cells = this.cells({});
+        const ledgers = await this.ledgers();
+        const withdrawOnSave = await this.withdrawnBySave({ name: server.name, tools });
+        const calls = tools.map((t) => ({
+            server: server.name,
+            tool: t.name,
+            annotations: hints(t.annotations),
+            classOverride: null,
+            registered: true,
+            kind: server.kind,
+        }));
+        const results = await this.judge(calls, cells);
+        return {
+            ...this.axes(cells, undefined),
+            withdrawOnSave,
+            tools: tools.map((t, i) => ({
+                subject: t.subject,
+                server: server.name,
+                tool: t.name,
+                class: results[i]?.[0]?.class ?? t.class,
+                status: 'registered',
+                enabled: true,
+                registered: true,
+                approval: this.approvalOf(ledgers, server.name, t.subject),
+                cells: results[i] ?? [],
+            })),
+        };
+    }
+    // ── approvals ──────────────────────────────────────────────────────────────────────────────
+    async approvals() {
+        const ledgers = await this.ledgers();
+        const tokens = new Set([...ledgers.firstUse.tokens, ...ledgers.write.tokens]);
+        const approved = [...tokens].sort().map((subject) => ({
+            subject,
+            scope: subject.includes('/') ? 'tool' : 'server',
+            firstUse: ledgers.firstUse.tokens.has(subject),
+            write: ledgers.write.tokens.has(subject),
+        }));
+        const { servers } = await this.registry.list();
+        const pending = [];
+        for (const s of servers) {
+            if (!s.enabled)
+                continue;
+            for (const t of s.tools) {
+                if (!t.enabled || t.status !== 'registered')
+                    continue;
+                const needs = [];
+                if (approvalState(ledgers.firstUse.tokens, s.name, t.subject) === null)
+                    needs.push('first-use');
+                if (t.class !== 'read' && approvalState(ledgers.write.tokens, s.name, t.subject) === null)
+                    needs.push('write');
+                if (needs.length > 0)
+                    pending.push({ subject: t.subject, server: s.name, tool: t.name, class: t.class, needs });
+            }
+        }
+        return { approved, pending, ledgers: { firstUse: ledgers.firstUse.state, write: ledgers.write.state } };
+    }
+    /** Approve a subject (a server: first use; a tool: first use and writes). Answers the rule ids that changed. */
+    async approve(subject) {
+        const parts = parseApprovalSubject(subject);
+        if (parts === null)
+            throw new McpRegistryError(400, 'bad_subject', 'a subject is mcp:<server> or mcp:<server>/<tool>');
+        const server = (await this.registry.list()).servers.find((s) => s.name === parts.server);
+        if (server === undefined)
+            throw new McpRegistryError(404, 'unknown_server', `no MCP server named ${parts.server}`);
+        if (parts.tool !== null && !server.tools.some((t) => t.name === parts.tool && t.status !== 'gone')) {
+            throw new McpRegistryError(404, 'unknown_tool', `no tool ${subject}`);
+        }
+        const ledgers = parts.tool === null ? [FIRST_USE_LEDGER] : [FIRST_USE_LEDGER, WRITE_LEDGER];
+        return this.edit((rule) => {
+            if (!ledgers.includes(rule.id))
+                return null;
+            const excludes = rule.excludes ?? [];
+            if (excludes.includes(subject))
+                return null;
+            return [...excludes, subject];
+        });
+    }
+    /** Revoke a subject's approval from both ledgers. 404 when neither holds it. */
+    async revoke(subject) {
+        if (parseApprovalSubject(subject) === null)
+            throw new McpRegistryError(400, 'bad_subject', 'a subject is mcp:<server> or mcp:<server>/<tool>');
+        const changed = await this.withdraw([subject]);
+        if (changed.length === 0)
+            throw new McpRegistryError(404, 'not_approved', `${subject} is not approved`);
+        return changed;
+    }
+    /** Remove every listed token from both ledgers (revoke, a changed schema, a removed server). */
+    async withdraw(tokens) {
+        if (tokens.length === 0)
+            return [];
+        const drop = new Set(tokens);
+        return this.edit((rule) => {
+            const excludes = rule.excludes ?? [];
+            const kept = excludes.filter((x) => !drop.has(x));
+            return kept.length === excludes.length ? null : kept;
+        });
+    }
+    /**
+     * The approval tokens saving `next` over the registered server of the same name withdraws: each
+     * tool whose saved schema changed, and the server's own token when any did (a server-wide
+     * approval cannot leave one tool out). Empty for a new server or an unchanged one.
+     */
+    async withdrawnBySave(next) {
+        let prior;
+        try {
+            prior = await this.registry.get(next.name);
+        }
+        catch (err) {
+            if (err instanceof McpRegistryError && err.status === 404)
+                return [];
+            throw err;
+        }
+        // A `gone` tool keeps its last saved schema hash (the registry never deletes one), so a tool
+        // that is dropped and later returns with a different schema counts as changed here too; one
+        // that returns unchanged keeps its approval, and while gone it is unregistered (D-5) anyway.
+        const changed = prior.tools.filter((t) => {
+            if (t.schemaHash === null)
+                return false;
+            const now = next.tools.find((x) => x.name === t.name);
+            return now !== undefined && now.schemaHash !== t.schemaHash;
+        });
+        if (changed.length === 0)
+            return [];
+        const held = new Set(await this.tokensOf(next.name));
+        return [`mcp:${next.name}`, ...changed.map((t) => t.subject)].filter((t) => held.has(t));
+    }
+    /** Every approval token that names `server` (the server's own and each of its tools'). */
+    async tokensOf(server) {
+        const l = await this.ledgers();
+        return [...new Set([...l.firstUse.tokens, ...l.write.tokens])].filter((t) => t === `mcp:${server}` || t.startsWith(`mcp:${server}/`));
+    }
+    // ── internals ──────────────────────────────────────────────────────────────────────────────
+    cells(query) {
+        const roles = query.phaseRole !== undefined ? [query.phaseRole] : MCP_PREVIEW_ROLES;
+        const seats = query.seat !== undefined ? [query.seat] : MCP_PREVIEW_SEATS;
+        const modes = query.mode !== undefined ? [query.mode] : MCP_RUN_MODES;
+        const cells = [];
+        for (const role of roles)
+            for (const seat of seats)
+                for (const mode of modes)
+                    cells.push({ role, seat, mode, ...(query.phaseId !== undefined ? { phaseId: query.phaseId } : {}) });
+        return cells;
+    }
+    axes(cells, phaseId) {
+        const uniq = (xs) => [...new Set(xs)];
+        return {
+            roles: uniq(cells.map((c) => c.role)),
+            seats: uniq(cells.map((c) => c.seat)),
+            modes: uniq(cells.map((c) => c.mode)),
+            phaseId: phaseId ?? null,
+        };
+    }
+    async judge(calls, cells) {
+        if (calls.length === 0)
+            return [];
+        let raw;
+        try {
+            raw = await this.engine.previewCalls(JSON.stringify({ calls, cells }));
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.startsWith('bad_request:'))
+                throw new McpRegistryError(400, 'bad_request', msg);
+            if (msg.startsWith('mcp_preview_unsupported:'))
+                throw new McpRegistryError(501, 'mcp_preview_unsupported', msg);
+            throw new McpRegistryError(502, 'preview_failed', `the engine could not judge the preview: ${msg}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+            if (!Array.isArray(parsed) || parsed.length !== calls.length || !parsed.every((r) => Array.isArray(r?.cells)))
+                throw new Error('not one verdict row per call');
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new McpRegistryError(502, 'preview_failed', `the engine answered an unreadable preview: ${msg}`);
+        }
+        return parsed.map((r) => r.cells.map((c) => ({
+            role: c.role,
+            seat: c.seat,
+            mode: c.mode,
+            ...(c.phaseId !== undefined ? { phaseId: c.phaseId } : {}),
+            decision: c.decision,
+            class: c.class,
+            ruleIds: c.ruleIds,
+            obligations: c.obligations,
+            reason: c.reason ?? null,
+        })));
+    }
+    async ledgers() {
+        const rules = await this.engine.listRules();
+        const one = (id) => {
+            const r = rules.find((x) => x.id === id);
+            return {
+                state: { id, present: r !== undefined, retired: r?.retired === true },
+                tokens: new Set(r?.excludes ?? []),
+            };
+        };
+        return { firstUse: one(FIRST_USE_LEDGER), write: one(WRITE_LEDGER) };
+    }
+    approvalOf(ledgers, server, subject) {
+        return {
+            firstUse: approvalState(ledgers.firstUse.tokens, server, subject),
+            write: approvalState(ledgers.write.tokens, server, subject),
+        };
+    }
+    /**
+     * Apply `next` to both ledgers' `excludes`, serialized. `next` answers the new list or `null` for
+     * no change. A missing ledger refuses the edit: the pack is seeded at boot, so its absence means
+     * the store is not the engine's (fail closed, nothing half-written).
+     */
+    edit(next) {
+        const run = async () => {
+            const rules = await this.engine.listRules();
+            const changed = [];
+            const edits = [];
+            for (const id of [FIRST_USE_LEDGER, WRITE_LEDGER]) {
+                const rule = rules.find((r) => r.id === id);
+                if (rule === undefined) {
+                    throw new McpRegistryError(503, 'ledger_missing', `the mcp-defaults rule ${id} is not in the policy store; restart the daemon to seed it`);
+                }
+                const excludes = next(rule);
+                if (excludes === null)
+                    continue;
+                edits.push({ ...rule, excludes });
+                changed.push(id);
+            }
+            // Two rules, no store transaction: on a failed write, put back the ones already written, so
+            // an approval lands in both ledgers or in neither. What a failed rollback leaves changed is
+            // named on the error, so the route audits it (every ledger change is audited, even a partial one).
+            const applied = [];
+            try {
+                for (const rule of edits) {
+                    await this.engine.upsertRule(rule);
+                    applied.push(rules.find((r) => r.id === rule.id));
+                }
+            }
+            catch (err) {
+                const stuck = [];
+                for (const original of applied.reverse()) {
+                    try {
+                        await this.engine.upsertRule(original);
+                    }
+                    catch {
+                        stuck.push(original.id);
+                    }
+                }
+                const msg = err instanceof Error ? err.message : String(err);
+                throw new McpLedgerEditError(stuck, `the approval ledger edit failed and was rolled back${stuck.length > 0 ? ` except ${stuck.join(', ')}` : ''}: ${msg}`);
+            }
+            return changed;
+        };
+        const result = this.chain.then(run, run);
+        this.chain = result.catch(() => undefined);
+        return result;
+    }
+}
+//# sourceMappingURL=policies.js.map

package/dist/mcp/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/mcp/policies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAqBH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAoB,MAAM,eAAe,CAAC;AAEnE;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAE3C;IADX,YACW,OAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAHjC,YAAO,GAAP,OAAO,CAAU;IAI5B,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,gDAAgD;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEhD,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAU,CAAC;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAA4B,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,aAAa,GAA0B,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AA2CtF,sEAAsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,KAAK,CAAC,CAA4B;IACzC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IAC7E,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS;QAAE,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC1E,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAA2B,EAAE,MAAc,EAAE,OAAe;IACjF,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IAJX,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEpD,YACmB,QAAqB,EACrB,MAAuB;QADvB,aAAQ,GAAR,QAAQ,CAAa;QACrB,WAAM,GAAN,MAAM,CAAiB;IACvC,CAAC;IAEJ,8FAA8F;IAE9F,KAAK,CAAC,OAAO,CAAC,KAAqB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,OAAoD,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5H,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACnH,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAiB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YACpC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,uFAAuF;YACvF,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY;YAC1E,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO;YACL,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YAClC,cAAc,EAAE,EAAE;YAClB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK;gBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;gBACvC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,KAAK;gBACzC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;gBAC7D,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;aACxB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,MAA+C,EAAE,KAAuB;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,MAAM,KAAK,GAAiB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;YACjC,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO;YACL,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC;YAC9B,cAAc;YACd,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK;gBACxC,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gBAC1D,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;aACxB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,8FAA8F;IAE9F,KAAK,CAAC,SAAS;QACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAkB,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;SACzC,CAAC,CAAC,CAAC;QACJ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,SAAS;YACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY;oBAAE,SAAS;gBACtD,MAAM,KAAK,GAAgC,EAAE,CAAC;gBAC9C,IAAI,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChG,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/G,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1G,CAAC;IAED,gHAAgH;IAChH,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,kDAAkD,CAAC,CAAC;QACvH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACzF,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnH,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,OAAO,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,kDAAkD,CAAC,CAAC;QAC/I,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC;QACxG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,QAAQ,CAAC,MAAyB;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,IAAkF;QACtG,IAAI,KAAgB,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YACrE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6FAA6F;QAC7F,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,MAAM,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC;IACxI,CAAC;IAED,8FAA8F;IAEtF,KAAK,CAAC,KAAqB;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACtE,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK;gBACtB,KAAK,MAAM,IAAI,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnI,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,IAAI,CAAC,KAAmB,EAAE,OAA2B;QAC3D,MAAM,IAAI,GAAG,CAAI,EAAO,EAAO,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,EAAE,OAAO,IAAI,IAAI;SACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAAmB,EAAE,KAAmB;QAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACxF,IAAI,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAChH,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,2CAA2C,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,MAA0D,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuD,CAAC;YAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjK,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,8CAA8C,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;SACzB,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO;QAInB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACzC,OAAO;gBACL,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,EAAE;gBACrE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;aACnC,CAAC;QACJ,CAAC,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;IACvE,CAAC;IAEO,UAAU,CAAC,OAAoD,EAAE,MAAc,EAAE,OAAe;QACtG,OAAO;YACL,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;YACjE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,IAAI,CAAC,IAAgD;QAC3D,MAAM,GAAG,GAAG,KAAK,IAAuB,EAAE;YACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAsB,EAAE,CAAC;YACpC,KAAK,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,4DAA4D,CAAC,CAAC;gBAC7I,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,QAAQ,KAAK,IAAI;oBAAE,SAAS;gBAChC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,mGAAmG;YACnG,MAAM,OAAO,GAAsB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACnC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAoB,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;oBACzC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACzC,CAAC;oBAAC,MAAM,CAAC;wBACP,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,sDAAsD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;YAC7J,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/mcp/probe.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Probe an upstream MCP server: connect, `initialize`, page through `tools/list`, disconnect
+ * (DES-MCP-TOOLS-001 §8 `POST /mcp/servers/preview` and `/test`).
+ *
+ * - Bounded: the whole probe has one deadline (10 s by default); a server that hangs is closed and
+ *   the probe fails with `timed out`.
+ * - Hardened env for stdio: the SDK's safe inherited set (HOME, LOGNAME, PATH, SHELL, TERM, USER on
+ *   POSIX) plus, when the server has auth, the ONE variable the secret is injected into. Nothing
+ *   else of the daemon's env (tokens, `WICKED_*`) reaches the upstream.
+ * - Scrubbed: the resolved secret is removed from everything the probe returns — tool
+ *   descriptions and schemas, server info, and an error's message and stderr tail — so an
+ *   upstream that echoes its credential cannot carry it into a response (D-2).
+ */
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { McpAuthConfig, McpRestMapping, McpToolAnnotations, McpUpstreamKind } from '../core/types.js';
+export declare const MCP_PROBE_TIMEOUT_MS = 10000;
+/** What crew needs to reach an upstream. Secret values are passed separately, never stored here. */
+export interface McpUpstreamConfig {
+    name: string;
+    kind: McpUpstreamKind;
+    command: string | null;
+    args: string[];
+    url: string | null;
+    auth: McpAuthConfig | null;
+    /** `rest` only (slice S5a): where the OpenAPI document is fetched from. */
+    openapiUrl?: string | null;
+    /** `rest` only: the OpenAPI document as pasted (instead of `openapiUrl`). */
+    openapi?: Record<string, unknown> | null;
+    /** `rest` only: the operations to wrap; `null`/absent = all. */
+    operations?: string[] | null;
+}
+export interface ProbedTool {
+    name: string;
+    description: string | null;
+    inputSchema: Record<string, unknown> | null;
+    outputSchema: Record<string, unknown> | null;
+    annotations: McpToolAnnotations | null;
+    /** A `rest` tool's request mapping; absent/`null` for an MCP server's tool. */
+    rest?: McpRestMapping | null;
+}
+export type ProbeResult = {
+    ok: true;
+    serverInfo: {
+        name: string;
+        version: string;
+    } | null;
+    tools: ProbedTool[];
+    skipped?: string[];
+} | {
+    ok: false;
+    error: string;
+};
+export type Prober = (config: McpUpstreamConfig, secret: string | null) => Promise<ProbeResult>;
+/** Keep only the annotation fields the spec defines, with the types it defines. */
+export declare function normalizeAnnotations(raw: unknown): McpToolAnnotations | null;
+/**
+ * The transport to one upstream, with the hardened env (stdio) or the auth header (http). Shared by
+ * the probe and the broker's call path (`invoke.ts`), so both reach an upstream the same way.
+ */
+export declare function transportFor(config: McpUpstreamConfig, secret: string | null): {
+    transport: Transport;
+    stderrTail: () => string;
+};
+/** The real prober. Every string it returns has `secret` scrubbed out. */
+export declare const probeMcpServer: Prober;
+//# sourceMappingURL=probe.d.ts.map

package/dist/mcp/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/mcp/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAE/E,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAI3G,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAK3C,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,+EAA+E;IAC/E,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3G;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAIhG,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAS5E;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,MAAM,CAAA;CAAE,CAkBjI;AAED,0EAA0E;AAC1E,eAAO,MAAM,cAAc,EAAE,MA0C5B,CAAC"}

package/dist/mcp/probe.js

@@ -0,0 +1,116 @@
+/**
+ * Probe an upstream MCP server: connect, `initialize`, page through `tools/list`, disconnect
+ * (DES-MCP-TOOLS-001 §8 `POST /mcp/servers/preview` and `/test`).
+ *
+ * - Bounded: the whole probe has one deadline (10 s by default); a server that hangs is closed and
+ *   the probe fails with `timed out`.
+ * - Hardened env for stdio: the SDK's safe inherited set (HOME, LOGNAME, PATH, SHELL, TERM, USER on
+ *   POSIX) plus, when the server has auth, the ONE variable the secret is injected into. Nothing
+ *   else of the daemon's env (tokens, `WICKED_*`) reaches the upstream.
+ * - Scrubbed: the resolved secret is removed from everything the probe returns — tool
+ *   descriptions and schemas, server info, and an error's message and stderr tail — so an
+ *   upstream that echoes its credential cannot carry it into a response (D-2).
+ */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { probeRestServer } from './rest.js';
+import { scrubSecrets } from './secrets.js';
+export const MCP_PROBE_TIMEOUT_MS = 10_000;
+const STDERR_TAIL_BYTES = 2048;
+const MAX_TOOLS = 512;
+const MAX_PAGES = 32;
+const ANNOTATION_BOOLEANS = ['readOnlyHint', 'destructiveHint', 'idempotentHint', 'openWorldHint'];
+/** Keep only the annotation fields the spec defines, with the types it defines. */
+export function normalizeAnnotations(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const src = raw;
+    const out = {};
+    for (const key of ANNOTATION_BOOLEANS) {
+        if (typeof src[key] === 'boolean')
+            out[key] = src[key];
+    }
+    if (typeof src['title'] === 'string')
+        out.title = src['title'];
+    return Object.keys(out).length === 0 ? null : out;
+}
+function objectOrNull(raw) {
+    return raw !== null && typeof raw === 'object' && !Array.isArray(raw) ? raw : null;
+}
+/**
+ * The transport to one upstream, with the hardened env (stdio) or the auth header (http). Shared by
+ * the probe and the broker's call path (`invoke.ts`), so both reach an upstream the same way.
+ */
+export function transportFor(config, secret) {
+    if (config.kind === 'rest')
+        throw new Error('a rest upstream is not an MCP server; it has no MCP transport');
+    if (config.kind === 'mcp-stdio') {
+        const env = { ...getDefaultEnvironment() };
+        if (config.auth?.env !== undefined && secret !== null)
+            env[config.auth.env] = secret;
+        const transport = new StdioClientTransport({ command: config.command ?? '', args: config.args, env, stderr: 'pipe' });
+        let tail = '';
+        transport.stderr?.on('data', (chunk) => {
+            tail = (tail + chunk.toString('utf8')).slice(-STDERR_TAIL_BYTES);
+        });
+        return { transport, stderrTail: () => tail };
+    }
+    const headers = {};
+    if (config.auth?.header !== undefined && secret !== null)
+        headers[config.auth.header] = `${config.auth.prefix ?? ''}${secret}`;
+    const http = new StreamableHTTPClientTransport(new URL(config.url ?? ''), { requestInit: { headers } });
+    // The SDK's own class declares `sessionId?: string` against its `Transport` interface, which
+    // `exactOptionalPropertyTypes` refuses; the runtime shapes are the same.
+    return { transport: http, stderrTail: () => '' };
+}
+/** The real prober. Every string it returns has `secret` scrubbed out. */
+export const probeMcpServer = async (config, secret) => {
+    if (config.kind === 'rest')
+        return probeRestServer(config, secret);
+    const secrets = secret === null ? [] : [secret];
+    const { transport, stderrTail } = transportFor(config, secret);
+    const client = new Client({ name: 'wicked-crew-mcp-probe', version: '1' }, { capabilities: {} });
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${MCP_PROBE_TIMEOUT_MS / 1000} s`)), MCP_PROBE_TIMEOUT_MS);
+    });
+    const work = (async () => {
+        await client.connect(transport);
+        const tools = [];
+        let cursor;
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const res = await client.listTools(cursor === undefined ? {} : { cursor });
+            for (const t of res.tools) {
+                if (tools.length >= MAX_TOOLS)
+                    break;
+                tools.push({
+                    name: t.name,
+                    description: typeof t.description === 'string' ? t.description : null,
+                    inputSchema: objectOrNull(t.inputSchema),
+                    outputSchema: objectOrNull(t.outputSchema),
+                    annotations: normalizeAnnotations(t.annotations),
+                });
+            }
+            cursor = res.nextCursor;
+            if (cursor === undefined || tools.length >= MAX_TOOLS)
+                break;
+        }
+        const info = client.getServerVersion();
+        return { ok: true, serverInfo: info === undefined ? null : { name: info.name, version: info.version }, tools };
+    })();
+    try {
+        return scrubSecrets(await Promise.race([work, deadline]), secrets);
+    }
+    catch (err) {
+        work.catch(() => undefined);
+        const message = err instanceof Error ? err.message : String(err);
+        const tail = stderrTail().trim();
+        return scrubSecrets({ ok: false, error: tail === '' ? message : `${message}; stderr: ${tail}` }, secrets);
+    }
+    finally {
+        clearTimeout(timer);
+        await client.close().catch(() => undefined);
+    }
+};
+//# sourceMappingURL=probe.js.map

package/dist/mcp/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/mcp/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AAkCrB,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,CAAU,CAAC;AAE5G,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAY,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,IAAI,CAAC;AAClH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAyB,EAAE,MAAqB;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC7G,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,GAAG,GAA2B,EAAE,GAAG,qBAAqB,EAAE,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtH,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC7C,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/H,MAAM,IAAI,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxG,6FAA6F;IAC7F,yEAAyE;IACzE,OAAO,EAAE,SAAS,EAAE,IAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAW,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACjG,IAAI,KAAiC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,oBAAoB,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAK,IAA0B,EAAE;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,IAAI,MAA0B,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;oBAAE,MAAM;gBACrC,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;oBACrE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;oBACxC,YAAY,EAAE,YAAY,CAAE,CAAgC,CAAC,YAAY,CAAC;oBAC1E,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC;iBACjD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;YACxB,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;gBAAE,MAAM;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;IACjH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5G,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,CAAC"}