@cortexkit/aft-bridge 0.18.5 → 0.19.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0BAA0B;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAQrD,oBAAoB;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,4BAA4B;AAC5B,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,WAAW,EACX,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,uBAAuB;AACvB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,2BAA2B;AAC3B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAcvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACxE,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/logger.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":""}

package/dist/onnx-runtime.js

@@ -0,0 +1,631 @@
+/**
+ * Auto-download and manage ONNX Runtime shared library for semantic search.
+ *
+ * Downloads the CPU-only ONNX Runtime from Microsoft's GitHub releases.
+ * The library is cached in the storage directory alongside semantic index data.
+ *
+ * Audit-3 v0.17 #1 hardening (v0.17.1): the previous implementation used
+ * `curl` with no size cap, no archive containment validation, no install
+ * lock, and no integrity verification — leaving an entire parallel install
+ * path that bypassed every defense the LSP GitHub installer had earned in
+ * Phase A through Phase E. This rewrite brings ONNX onto the same security
+ * floor:
+ *
+ *   - Streaming size cap via fetch + ReadableStream transformer (`MAX_DOWNLOAD_BYTES`).
+ *   - Streaming SHA-256 of the downloaded archive, persisted in `.aft-onnx-installed`.
+ *   - Atomic O_EXCL install lock with PID-aware stale-lock recovery.
+ *   - Containment-checked extraction: every file under the staging dir
+ *     must be inside the staging root, no symlinks allowed before move.
+ *   - Total extracted size cap (`MAX_EXTRACT_BYTES`) to defeat decompression
+ *     bombs.
+ *   - TOFU verification: if `.aft-onnx-installed` already records a hash for
+ *     this version, refuse to use a binary that doesn't match.
+ *
+ * Supported platforms:
+ *   - macOS ARM64 (osx-arm64)
+ *   - Linux x64 (linux-x64)
+ *   - Linux ARM64 (linux-aarch64)
+ *   - Windows x64 (win-x64)
+ *   - Windows ARM64 (win-arm64)
+ *
+ * macOS x64 (Intel) is not provided by Microsoft — users must install via:
+ *   brew install onnxruntime
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, closeSync, copyFileSync, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { error, log, warn } from "./active-logger.js";
+const ORT_VERSION = "1.24.4";
+const ORT_REPO = "microsoft/onnxruntime";
+// Audit-3 v0.17 #1: streaming + extraction size caps.
+//
+// ONNX Runtime archives are around 60–80 MB on most platforms and 250 MB
+// extracted (Windows ships extra debug binaries). 256 MB and 1 GiB give
+// generous headroom while preventing a malicious or corrupted CDN response
+// from filling the user's disk. Same numbers as the GitHub LSP installer.
+const MAX_DOWNLOAD_BYTES = 256 * 1024 * 1024;
+const MAX_EXTRACT_BYTES = 1 * 1024 * 1024 * 1024;
+const ONNX_LOCK_FILE = ".aft-onnx-installing";
+const ONNX_INSTALLED_META_FILE = ".aft-onnx-installed";
+const STALE_LOCK_MS = 30 * 60 * 1000;
+const ORT_PLATFORM_MAP = {
+    darwin: {
+        arm64: {
+            assetName: `onnxruntime-osx-arm64-${ORT_VERSION}`,
+            libName: "libonnxruntime.dylib",
+            archiveType: "tgz",
+        },
+        // x64 not available from Microsoft — users need brew install onnxruntime
+    },
+    linux: {
+        x64: {
+            assetName: `onnxruntime-linux-x64-${ORT_VERSION}`,
+            libName: "libonnxruntime.so",
+            archiveType: "tgz",
+        },
+        arm64: {
+            assetName: `onnxruntime-linux-aarch64-${ORT_VERSION}`,
+            libName: "libonnxruntime.so",
+            archiveType: "tgz",
+        },
+    },
+    win32: {
+        x64: {
+            assetName: `onnxruntime-win-x64-${ORT_VERSION}`,
+            libName: "onnxruntime.dll",
+            archiveType: "zip",
+        },
+        arm64: {
+            assetName: `onnxruntime-win-arm64-${ORT_VERSION}`,
+            libName: "onnxruntime.dll",
+            archiveType: "zip",
+        },
+    },
+};
+/** Get platform info for the current system, or null if unsupported */
+function getPlatformInfo() {
+    const platformMap = ORT_PLATFORM_MAP[process.platform];
+    if (!platformMap)
+        return null;
+    return platformMap[process.arch] || null;
+}
+/** Check if this platform can auto-download ONNX Runtime */
+export function isOrtAutoDownloadSupported() {
+    return getPlatformInfo() !== null;
+}
+/** Get the install hint for platforms where auto-download isn't available */
+export function getManualInstallHint() {
+    if (process.platform === "darwin" && process.arch === "x64") {
+        return "brew install onnxruntime";
+    }
+    if (process.platform === "linux") {
+        return "apt install libonnxruntime or download from https://github.com/microsoft/onnxruntime/releases";
+    }
+    return "Download from https://github.com/microsoft/onnxruntime/releases";
+}
+/**
+ * Ensure ONNX Runtime is available. Returns the directory containing the library,
+ * or null if unavailable.
+ *
+ * Resolution order:
+ *   1. Cached in storageDir/onnxruntime/<version>/ (with TOFU verification)
+ *   2. System install (brew, apt, etc.)
+ *   3. Auto-download from GitHub releases (if platform supported)
+ *   4. null (user needs manual install)
+ */
+export async function ensureOnnxRuntime(storageDir) {
+    const info = getPlatformInfo();
+    // 1. Cached location with TOFU.
+    const ortDir = join(storageDir, "onnxruntime", ORT_VERSION);
+    const libPath = join(ortDir, info?.libName ?? "libonnxruntime.dylib");
+    if (existsSync(libPath)) {
+        // Audit-3 v0.17 #1 (TOFU): if we recorded a hash for this version,
+        // verify the library still matches. A mismatch means tampering or
+        // partial install corruption. Refuse to use it and let the caller
+        // either retry the download (after the user clears the cache) or
+        // fall back to system install.
+        const meta = readOnnxInstalledMeta(ortDir);
+        if (meta?.sha256) {
+            try {
+                const currentHash = sha256File(libPath);
+                if (currentHash !== meta.sha256) {
+                    error(`ONNX Runtime at ${ortDir}: TOFU sha256 mismatch — refusing to use ` +
+                        `tampered binary. Recorded ${meta.sha256}, current ${currentHash}. ` +
+                        `Run \`aft doctor --clear\` to re-download from scratch.`);
+                    // Fall through to system path / re-download attempt below.
+                }
+                else {
+                    log(`ONNX Runtime found at ${ortDir} (TOFU verified)`);
+                    return ortDir;
+                }
+            }
+            catch (err) {
+                warn(`Could not verify ONNX Runtime hash at ${ortDir}: ${err}`);
+                // Treat unreadable hash as "trust on existence" since we already
+                // owned this install — better than blocking semantic search.
+                return ortDir;
+            }
+        }
+        else {
+            log(`ONNX Runtime found at ${ortDir} (no recorded hash, accepting)`);
+            return ortDir;
+        }
+    }
+    // 2. System locations.
+    const systemPath = findSystemOnnxRuntime(info?.libName);
+    if (systemPath) {
+        log(`ONNX Runtime found at system path: ${systemPath}`);
+        return systemPath;
+    }
+    // 3. Auto-download.
+    if (!info) {
+        warn(`ONNX Runtime auto-download not available for ${process.platform}/${process.arch}. Install manually: ${getManualInstallHint()}`);
+        return null;
+    }
+    // Audit-3 v0.17 #1: serialize concurrent installs.
+    //
+    // Two AFT plugin instances starting at the same time would otherwise both
+    // download and extract into overlapping temp dirs and clobber each other.
+    // The lock is held for the full install duration via the manual try/finally
+    // below (we don't reuse withInstallLock from lsp-cache because that helper
+    // is keyed on lspPackageDir, while ONNX lives in storageDir).
+    const onnxBaseDir = join(storageDir, "onnxruntime");
+    mkdirSync(onnxBaseDir, { recursive: true });
+    const lockPath = join(onnxBaseDir, ONNX_LOCK_FILE);
+    if (!acquireLock(lockPath)) {
+        warn(`ONNX Runtime install already in progress in another process (lock: ${lockPath}). Skipping.`);
+        return null;
+    }
+    try {
+        return await downloadOnnxRuntime(info, ortDir);
+    }
+    finally {
+        releaseLock(lockPath);
+    }
+}
+/** Check common system locations for ONNX Runtime */
+function findSystemOnnxRuntime(libName) {
+    if (!libName)
+        return null;
+    const searchPaths = [];
+    if (process.platform === "darwin") {
+        // Homebrew locations
+        searchPaths.push("/opt/homebrew/lib", "/usr/local/lib");
+    }
+    else if (process.platform === "linux") {
+        searchPaths.push("/usr/lib", "/usr/lib/x86_64-linux-gnu", "/usr/lib/aarch64-linux-gnu", "/usr/local/lib");
+    }
+    for (const dir of searchPaths) {
+        if (existsSync(join(dir, libName))) {
+            return dir;
+        }
+    }
+    return null;
+}
+/**
+ * Streaming download with size cap. Mirrors the hardened path in
+ * `lsp-github-install.ts:downloadFile` so ONNX gets the same defenses
+ * the LSP installer already has.
+ *
+ * The URL is hardcoded to `https://github.com/${ORT_REPO}/...` so we don't
+ * need a hostname allowlist — the constant cannot be attacker-influenced.
+ */
+async function downloadFileWithCap(url, destPath) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 300_000);
+    try {
+        const res = await fetch(url, {
+            headers: { accept: "application/octet-stream" },
+            redirect: "follow",
+            signal: controller.signal,
+        });
+        if (!res.ok || !res.body) {
+            throw new Error(`download failed (HTTP ${res.status})`);
+        }
+        const advertised = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+        if (Number.isFinite(advertised) && advertised > MAX_DOWNLOAD_BYTES) {
+            throw new Error(`Content-Length ${advertised} exceeds max ${MAX_DOWNLOAD_BYTES}`);
+        }
+        mkdirSync(dirname(destPath), { recursive: true });
+        let bytesWritten = 0;
+        const guard = new TransformStream({
+            transform(chunk, transformController) {
+                bytesWritten += chunk.byteLength;
+                if (bytesWritten > MAX_DOWNLOAD_BYTES) {
+                    transformController.error(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES} bytes after streaming (server lied about size or sent unbounded body)`));
+                    return;
+                }
+                transformController.enqueue(chunk);
+            },
+        });
+        const guarded = res.body.pipeThrough(guard);
+        // biome-ignore lint/suspicious/noExplicitAny: ReadableStream→Node stream conversion
+        const nodeStream = Readable.fromWeb(guarded);
+        await pipeline(nodeStream, createWriteStream(destPath), { signal: controller.signal });
+    }
+    catch (err) {
+        try {
+            unlinkSync(destPath);
+        }
+        catch {
+            // partial file may not exist — fine
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Validate that every file/dir under `stagingRoot` is contained inside it
+ * AND that the total extracted bytes do not exceed `MAX_EXTRACT_BYTES`.
+ *
+ * Audit-3 v0.17 #1: zip-slip + symlink containment + decompression-bomb
+ * defense. tar and unzip both can produce paths like `../../etc/passwd`;
+ * Windows tar.exe and unzip can also produce symlinks that point outside
+ * the destination. We walk the tree post-extraction and reject anything
+ * suspicious before moving files into the final cache.
+ */
+function validateExtractedTree(stagingRoot) {
+    const realRoot = realpathSync(stagingRoot);
+    let totalBytes = 0;
+    const walk = (dir) => {
+        const entries = readdirSync(dir);
+        for (const entry of entries) {
+            const fullPath = join(dir, entry);
+            const lst = lstatSync(fullPath);
+            if (lst.isSymbolicLink()) {
+                // Symlinks must be either rejected outright or contained. Tarballs
+                // from Microsoft's official ONNX Runtime release ship with versioned
+                // .so symlinks (libonnxruntime.so → libonnxruntime.so.1.24.4), so
+                // we cannot simply reject all of them. Instead resolve the link
+                // target (relative to the symlink's directory) and verify it stays
+                // inside the staging root.
+                const linkTarget = readlinkSync(fullPath);
+                const resolvedTarget = resolve(dirname(fullPath), linkTarget);
+                const rel = relative(realRoot, resolvedTarget);
+                if (rel.startsWith("..") || (process.platform !== "win32" && rel.startsWith("/"))) {
+                    throw new Error(`extracted symlink ${fullPath} points outside staging root: ${linkTarget}`);
+                }
+                continue;
+            }
+            const rel = relative(realRoot, fullPath);
+            if (rel.startsWith("..") || (process.platform !== "win32" && rel.startsWith("/"))) {
+                throw new Error(`extracted entry ${fullPath} escapes staging root`);
+            }
+            if (lst.isDirectory()) {
+                walk(fullPath);
+                continue;
+            }
+            if (lst.isFile()) {
+                totalBytes += lst.size;
+                if (totalBytes > MAX_EXTRACT_BYTES) {
+                    throw new Error(`extracted size ${totalBytes} exceeds max ${MAX_EXTRACT_BYTES} (decompression bomb defense)`);
+                }
+            }
+        }
+    };
+    walk(realRoot);
+}
+/** Download and extract ONNX Runtime from GitHub releases */
+async function downloadOnnxRuntime(info, targetDir) {
+    const url = `https://github.com/${ORT_REPO}/releases/download/v${ORT_VERSION}/${info.assetName}.${info.archiveType === "tgz" ? "tgz" : "zip"}`;
+    log(`Downloading ONNX Runtime v${ORT_VERSION} for ${process.platform}/${process.arch}...`);
+    // Use a parent-of-targetDir staging path so the validation walk can compare
+    // resolved paths via realpathSync without rejecting symlinks that happen to
+    // resolve into the parent (e.g. when storageDir is itself behind a symlink).
+    const tmpDir = `${targetDir}.tmp.${process.pid}.${Date.now().toString(36)}`;
+    try {
+        mkdirSync(tmpDir, { recursive: true });
+        const archivePath = join(tmpDir, `onnxruntime.${info.archiveType}`);
+        // Audit-3 v0.17 #1: download with streaming size cap (no more curl).
+        await downloadFileWithCap(url, archivePath);
+        // Audit-3 v0.17 #1: hash the archive for TOFU.
+        const archiveSha256 = sha256File(archivePath);
+        log(`ONNX Runtime archive sha256=${archiveSha256}`);
+        // Extract.
+        if (info.archiveType === "tgz") {
+            execFileSync("tar", ["xzf", archivePath, "-C", tmpDir], {
+                stdio: "pipe",
+                timeout: 120_000,
+            });
+        }
+        else {
+            await extractZipArchive(archivePath, tmpDir);
+        }
+        // Drop the archive itself before validation so it doesn't double-count
+        // toward the extracted-size budget.
+        try {
+            unlinkSync(archivePath);
+        }
+        catch {
+            // ignore
+        }
+        // Audit-3 v0.17 #1: containment + size-bomb check.
+        validateExtractedTree(tmpDir);
+        // Find and copy the library file.
+        const extractedDir = join(tmpDir, info.assetName, "lib");
+        if (!existsSync(extractedDir)) {
+            throw new Error(`Expected directory not found: ${extractedDir}`);
+        }
+        // Create target directory and copy library files.
+        mkdirSync(targetDir, { recursive: true });
+        // Copy all library files (main + versioned symlinks).
+        // On Linux, .so files are often symlinks (libonnxruntime.so → libonnxruntime.so.1.24.4).
+        // Process real files first, then recreate symlinks in the target directory to avoid
+        // ENOENT when renaming a symlink whose target was already moved.
+        const libFiles = readdirSync(extractedDir).filter((f) => f.startsWith("libonnxruntime") || f.startsWith("onnxruntime"));
+        // Separate real files from symlinks
+        const realFiles = [];
+        const symlinks = [];
+        for (const libFile of libFiles) {
+            const src = join(extractedDir, libFile);
+            try {
+                const stat = lstatSync(src);
+                log(`ORT extract: ${libFile} — isSymlink=${stat.isSymbolicLink()}, isFile=${stat.isFile()}, size=${stat.size}`);
+                if (stat.isSymbolicLink()) {
+                    symlinks.push({ name: libFile, target: readlinkSync(src) });
+                }
+                else {
+                    realFiles.push(libFile);
+                }
+            }
+            catch (e) {
+                log(`ORT extract: ${libFile} — stat failed: ${e}`);
+                realFiles.push(libFile);
+            }
+        }
+        // Copy real files first
+        for (const libFile of realFiles) {
+            const src = join(extractedDir, libFile);
+            const dst = join(targetDir, libFile);
+            try {
+                copyFileSync(src, dst);
+                if (process.platform !== "win32") {
+                    chmodSync(dst, 0o755);
+                }
+            }
+            catch (copyErr) {
+                log(`ORT extract: failed to copy ${libFile}: ${copyErr}`);
+            }
+        }
+        // Recreate symlinks in target directory
+        for (const link of symlinks) {
+            const dst = join(targetDir, link.name);
+            try {
+                unlinkSync(dst); // remove if exists from a previous partial install
+            }
+            catch {
+                // ignore
+            }
+            symlinkSync(link.target, dst);
+        }
+        // Audit-3 v0.17 #1: persist version + archive sha256 for TOFU on
+        // future sessions. Hash the actual main library file (not the
+        // archive) because that's what we'll re-hash on the next ensure call.
+        const libPath = join(targetDir, info.libName);
+        let libHash = null;
+        try {
+            libHash = sha256File(libPath);
+        }
+        catch (err) {
+            // If we can't even hash our just-installed library, skip TOFU rather
+            // than blocking semantic search. Future sessions will trust the path.
+            warn(`Could not hash newly-installed ONNX library at ${libPath}: ${err}`);
+        }
+        writeOnnxInstalledMeta(targetDir, ORT_VERSION, libHash, archiveSha256);
+        // Cleanup temp directory
+        rmSync(tmpDir, { recursive: true, force: true });
+        log(`ONNX Runtime v${ORT_VERSION} installed to ${targetDir}`);
+        return targetDir;
+    }
+    catch (err) {
+        error(`Failed to download ONNX Runtime: ${err}`);
+        // Cleanup on failure — both the staging dir and any partially populated
+        // target dir, so the next attempt starts from a clean slate.
+        try {
+            rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            // ignore cleanup errors
+        }
+        try {
+            rmSync(targetDir, { recursive: true, force: true });
+        }
+        catch {
+            // ignore
+        }
+        return null;
+    }
+}
+async function extractZipArchive(archivePath, destinationDir) {
+    if (process.platform === "win32") {
+        // Audit-2 v0.17 #12: drop PowerShell. Even via execFileSync, PowerShell
+        // applies its own quoting rules to `$args[N]` lookups that could allow
+        // attacker-controlled fragments to escape into command interpretation.
+        // tar.exe ships in System32 on Windows 10 build 17063+ — execFileSync
+        // with argv has no shell parser in the chain.
+        execFileSync("tar.exe", ["-xf", archivePath, "-C", destinationDir], {
+            stdio: "pipe",
+            timeout: 120_000,
+        });
+        return;
+    }
+    execFileSync("unzip", ["-q", archivePath, "-d", destinationDir], {
+        stdio: "pipe",
+        timeout: 120_000,
+    });
+}
+function writeOnnxInstalledMeta(installDir, version, sha256, archiveSha256) {
+    try {
+        const meta = {
+            version,
+            installedAt: new Date().toISOString(),
+            ...(sha256 ? { sha256 } : {}),
+            archiveSha256,
+        };
+        writeFileSync(join(installDir, ONNX_INSTALLED_META_FILE), JSON.stringify(meta), "utf8");
+    }
+    catch (err) {
+        log(`[onnx] failed to write installed-meta in ${installDir}: ${err}`);
+    }
+}
+function readOnnxInstalledMeta(installDir) {
+    const path = join(installDir, ONNX_INSTALLED_META_FILE);
+    try {
+        if (!statSync(path).isFile())
+            return null;
+        const raw = readFileSync(path, "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.version !== "string" || parsed.version.length === 0)
+            return null;
+        return {
+            version: parsed.version,
+            installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : "",
+            ...(typeof parsed.sha256 === "string" && parsed.sha256.length > 0
+                ? { sha256: parsed.sha256 }
+                : {}),
+            ...(typeof parsed.archiveSha256 === "string" && parsed.archiveSha256.length > 0
+                ? { archiveSha256: parsed.archiveSha256 }
+                : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Synchronous SHA-256 of a file. ONNX libs are ~50 MB so a single
+ * `readFileSync` is fine — we accept the brief blocking read in exchange
+ * for keeping the call sites simple (no awaits inside the path-resolution
+ * fast path that runs every plugin start).
+ */
+function sha256File(path) {
+    const hash = createHash("sha256");
+    hash.update(readFileSync(path));
+    return hash.digest("hex");
+}
+/* ─────────────────────────── install lock ─────────────────────────── */
+/**
+ * Acquire a process-exclusive lock. Atomic O_EXCL create with PID-aware
+ * stale-lock recovery. Mirrors `acquireInstallLock` in lsp-cache.ts but
+ * lives here because the ONNX install dir is keyed on `storageDir`,
+ * not `lspPackageDir`.
+ */
+function acquireLock(lockPath) {
+    const tryClaim = () => {
+        try {
+            const fd = openSync(lockPath, "wx");
+            try {
+                writeFileSync(fd, `${process.pid}\n${new Date().toISOString()}\n`);
+            }
+            finally {
+                closeSync(fd);
+            }
+            return true;
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "EEXIST")
+                return false;
+            warn(`[onnx] unexpected error acquiring lock ${lockPath}: ${err}`);
+            return false;
+        }
+    };
+    if (tryClaim())
+        return true;
+    let owningPid = null;
+    let lockMtimeMs = 0;
+    try {
+        const raw = readFileSync(lockPath, "utf8");
+        const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+        const parsed = Number.parseInt(firstLine, 10);
+        if (Number.isFinite(parsed) && parsed > 0)
+            owningPid = parsed;
+        lockMtimeMs = statSync(lockPath).mtimeMs;
+    }
+    catch {
+        return tryClaim();
+    }
+    const age = Date.now() - lockMtimeMs;
+    const ageWithinFresh = Math.abs(age) < STALE_LOCK_MS;
+    const skipLiveness = process.platform === "win32";
+    const ownerAlive = !skipLiveness && owningPid !== null && isProcessAlive(owningPid);
+    if (skipLiveness ? ageWithinFresh : ownerAlive && ageWithinFresh) {
+        return false;
+    }
+    log(`[onnx] reclaiming install lock (owner_pid=${owningPid ?? "unknown"}, alive=${ownerAlive}, age_ms=${age})`);
+    try {
+        unlinkSync(lockPath);
+    }
+    catch {
+        // ignore
+    }
+    return tryClaim();
+}
+function releaseLock(lockPath) {
+    // Same TOCTOU-safe release as releaseInstallLock — only unlink if our PID owns it.
+    try {
+        let owningPid = null;
+        try {
+            const raw = readFileSync(lockPath, "utf8");
+            const firstLine = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+            const parsed = Number.parseInt(firstLine, 10);
+            if (Number.isFinite(parsed) && parsed > 0)
+                owningPid = parsed;
+        }
+        catch (readErr) {
+            const code = readErr.code;
+            if (code === "ENOENT")
+                return;
+            warn(`[onnx] could not read lock ${lockPath} during release: ${readErr}`);
+            return;
+        }
+        if (owningPid !== process.pid) {
+            log(`[onnx] not releasing lock ${lockPath}: owned by pid ${owningPid ?? "unknown"} (we are ${process.pid})`);
+            return;
+        }
+        try {
+            unlinkSync(lockPath);
+        }
+        catch (unlinkErr) {
+            const code = unlinkErr.code;
+            if (code !== "ENOENT") {
+                warn(`[onnx] failed to release lock ${lockPath}: ${unlinkErr}`);
+            }
+        }
+    }
+    catch (err) {
+        warn(`[onnx] unexpected error releasing lock ${lockPath}: ${err}`);
+    }
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ESRCH")
+            return false;
+        return true;
+    }
+}
+/**
+ * Remove ONNX Runtime from temp files. Cleanup helper for test isolation.
+ */
+export function cleanupOnnxRuntime(storageDir) {
+    try {
+        const ortBase = join(storageDir, "onnxruntime");
+        if (existsSync(ortBase)) {
+            rmSync(ortBase, { recursive: true, force: true });
+        }
+    }
+    catch {
+        // ignore
+    }
+}
+//# sourceMappingURL=onnx-runtime.js.map

package/dist/onnx-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onnx-runtime.js","sourceRoot":"","sources":["../src/onnx-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,WAAW,EACX,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,WAAW,GAAG,QAAQ,CAAC;AAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEzC,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7C,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AACvD,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AASrC,MAAM,gBAAgB,GAAoD;IACxE,MAAM,EAAE;QACN,KAAK,EAAE;YACL,SAAS,EAAE,yBAAyB,WAAW,EAAE;YACjD,OAAO,EAAE,sBAAsB;YAC/B,WAAW,EAAE,KAAK;SACnB;QACD,yEAAyE;KAC1E;IACD,KAAK,EAAE;QACL,GAAG,EAAE;YACH,SAAS,EAAE,yBAAyB,WAAW,EAAE;YACjD,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,KAAK;SACnB;QACD,KAAK,EAAE;YACL,SAAS,EAAE,6BAA6B,WAAW,EAAE;YACrD,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,KAAK;SACnB;KACF;IACD,KAAK,EAAE;QACL,GAAG,EAAE;YACH,SAAS,EAAE,uBAAuB,WAAW,EAAE;YAC/C,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,KAAK;SACnB;QACD,KAAK,EAAE;YACL,SAAS,EAAE,yBAAyB,WAAW,EAAE;YACjD,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,KAAK;SACnB;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,SAAS,eAAe;IACtB,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,0BAA0B;IACxC,OAAO,eAAe,EAAE,KAAK,IAAI,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,+FAA+F,CAAC;IACzG,CAAC;IACD,OAAO,iEAAiE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAE/B,gCAAgC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,IAAI,sBAAsB,CAAC,CAAC;IAEtE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,+BAA+B;QAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,WAAW,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,KAAK,CACH,mBAAmB,MAAM,2CAA2C;wBAClE,6BAA6B,IAAI,CAAC,MAAM,aAAa,WAAW,IAAI;wBACpE,yDAAyD,CAC5D,CAAC;oBACF,2DAA2D;gBAC7D,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,yBAAyB,MAAM,kBAAkB,CAAC,CAAC;oBACvD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,yCAAyC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;gBAChE,iEAAiE;gBACjE,6DAA6D;gBAC7D,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,yBAAyB,MAAM,gCAAgC,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACxD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CACF,gDAAgD,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,uBAAuB,oBAAoB,EAAE,EAAE,CAChI,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,IAAI,CACF,sEAAsE,QAAQ,cAAc,CAC7F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,qBAAqB;QACrB,WAAW,CAAC,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CACd,UAAU,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,QAAgB;IAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE;YAC/C,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,kBAAkB,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,gBAAgB,kBAAkB,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAyB;YACxD,SAAS,CAAC,KAAK,EAAE,mBAAmB;gBAClC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC;gBACjC,IAAI,YAAY,GAAG,kBAAkB,EAAE,CAAC;oBACtC,mBAAmB,CAAC,KAAK,CACvB,IAAI,KAAK,CACP,qBAAqB,kBAAkB,wEAAwE,CAChH,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5C,oFAAoF;QACpF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;QACpD,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YAEhC,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;gBACzB,mEAAmE;gBACnE,qEAAqE;gBACrE,kEAAkE;gBAClE,gEAAgE;gBAChE,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;gBAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAClF,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,iCAAiC,UAAU,EAAE,CAC3E,CAAC;gBACJ,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClF,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,uBAAuB,CAAC,CAAC;YACtE,CAAC;YAED,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC;gBACvB,IAAI,UAAU,GAAG,iBAAiB,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,UAAU,gBAAgB,iBAAiB,+BAA+B,CAC7F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,mBAAmB,CAChC,IAAqB,EACrB,SAAiB;IAEjB,MAAM,GAAG,GAAG,sBAAsB,QAAQ,uBAAuB,WAAW,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAE/I,GAAG,CAAC,6BAA6B,WAAW,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IAE3F,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IAE5E,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAEpE,qEAAqE;QACrE,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAE5C,+CAA+C;QAC/C,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAC9C,GAAG,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC;QAEpD,WAAW;QACX,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC/B,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;gBACtD,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,uEAAuE;QACvE,oCAAoC;QACpC,IAAI,CAAC;YACH,UAAU,CAAC,WAAW,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,mDAAmD;QACnD,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE9B,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,kDAAkD;QAClD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,sDAAsD;QACtD,yFAAyF;QACzF,oFAAoF;QACpF,iEAAiE;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CACrE,CAAC;QAEF,oCAAoC;QACpC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAA4C,EAAE,CAAC;QAC7D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC5B,GAAG,CACD,gBAAgB,OAAO,gBAAgB,IAAI,CAAC,cAAc,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,CAC3G,CAAC;gBACF,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,gBAAgB,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBACnD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACjC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,+BAA+B,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,mDAAmD;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,iEAAiE;QACjE,8DAA8D;QAC9D,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,sEAAsE;YACtE,IAAI,CAAC,kDAAkD,OAAO,KAAK,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,sBAAsB,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAEvE,yBAAyB;QACzB,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,GAAG,CAAC,iBAAiB,WAAW,iBAAiB,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QACjD,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,cAAsB;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,8CAA8C;QAC9C,YAAY,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE;YAClE,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE;QAC/D,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC;AAaD,SAAS,sBAAsB,CAC7B,UAAkB,EAClB,OAAe,EACf,MAAqB,EACrB,aAAqB;IAErB,IAAI,CAAC;QACH,MAAM,IAAI,GAAsB;YAC9B,OAAO;YACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,aAAa;SACd,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,4CAA4C,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QAC7D,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YAC7E,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAC/D,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC3B,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBAC7E,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAE1E;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,QAAQ,GAAG,GAAY,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,aAAa,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,CAAC,0CAA0C,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,SAAS,GAAG,MAAM,CAAC;QAC9D,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IACrC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAClD,MAAM,UAAU,GAAG,CAAC,YAAY,IAAI,SAAS,KAAK,IAAI,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,IAAI,cAAc,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG,CACD,6CAA6C,SAAS,IAAI,SAAS,WAAW,UAAU,YAAY,GAAG,GAAG,CAC3G,CAAC;IACF,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,mFAAmF;IACnF,IAAI,CAAC;QACH,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;gBAAE,SAAS,GAAG,MAAM,CAAC;QAChE,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,GAAI,OAAiC,CAAC,IAAI,CAAC;YACrD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC9B,IAAI,CAAC,8BAA8B,QAAQ,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAC9B,GAAG,CACD,6BAA6B,QAAQ,kBAAkB,SAAS,IAAI,SAAS,YAAY,OAAO,CAAC,GAAG,GAAG,CACxG,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,GAAI,SAAmC,CAAC,IAAI,CAAC;YACvD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,IAAI,CAAC,iCAAiC,QAAQ,KAAK,SAAS,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,0CAA0C,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC"}