@cybedefend/vibedefend 1.4.0 → 1.4.2

package/dist/hooks/runtime/trusted-api-base.js

@@ -0,0 +1,194 @@
+/**
+ * Origin allowlist for a repository-supplied `apiBase`.
+ *
+ * ─── Why this exists ────────────────────────────────────────────────────────
+ *
+ * `vibedefend link` writes `.cybedefend/config.json` *next to your code*, so
+ * the file is normally COMMITTED. That makes its contents attacker-controlled
+ * the moment you clone someone else's repository — no user interaction beyond
+ * `git clone` and opening the folder in a wired agent, because the PreToolUse
+ * hook fires on the very first tool call in that cwd.
+ *
+ * The file carries an optional `apiBase`, which used to be honoured verbatim
+ * as the base URL of every authenticated hook call. Two consequences:
+ *
+ *   1. CREDENTIAL EXFILTRATION — every request sends
+ *      `Authorization: Bearer <CybeDefend access token>`, so a hostile repo
+ *      simply harvested the token of anyone who opened it.
+ *   2. GUARD NEUTRALISATION — the same host also serves
+ *      `GET /project/:id/action-guards/effective-rules`. Returning `[]`
+ *      silently disables every Action Guard (and the answer is disk-cached
+ *      for 60s), while the redacted-but-real command/file summaries the hooks
+ *      post are delivered straight to the attacker.
+ *
+ * ─── The fix ────────────────────────────────────────────────────────────────
+ *
+ * This is an AUTHORIZATION problem, not a shape problem: the value always was
+ * a well-formed string. So we check the ORIGIN (scheme + host + port) against
+ * what the USER — not the repository — already trusts:
+ *
+ *   • the region catalogue shipped inside the CLI (`REGIONS`);
+ *   • the region the user installed against
+ *     (`~/.cybedefend/runtime-config.json`);
+ *   • user-global custom regions (`~/.cybedefend/regions.json`), the escape
+ *     hatch for internal staging / localhost clusters;
+ *   • an explicitly-consented `extraTrusted` origin, used by `vibedefend link`
+ *     for the region the user just picked in the interactive flow.
+ *
+ * `./vibedefend.regions.json` (cwd) is DELIBERATELY not a source: it lives in
+ * the repository, so reading it would hand the allowlist back to the attacker.
+ * Same reasoning keeps `loadCustomRegions()` — which searches cwd — out of
+ * this module.
+ *
+ * A rejected `apiBase` degrades to `null`, and the caller falls back to the
+ * configured region. Nothing is blocked; the user just keeps talking to their
+ * own gateway. The rejection is announced on stderr so a legitimate custom
+ * cluster is a one-line fix rather than a silent mystery.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { REGIONS } from '../../config.js';
+import { loadRuntimeConfig } from './config.js';
+/** Default path of the user-global custom regions file. */
+export function userRegionsPath() {
+    return join(homedir(), '.cybedefend', 'regions.json');
+}
+/**
+ * Reduce a URL to its comparable origin (`scheme://host[:port]`), or `null`
+ * when it isn't a usable http(s) URL.
+ *
+ * Deliberately strict:
+ *  - only `http:` / `https:` — every other scheme (`file:`, `data:`,
+ *    `javascript:`) serialises to the opaque origin `"null"`, so allowing them
+ *    would make unrelated URLs compare equal;
+ *  - no userinfo — `https://api-eu.cybedefend.com@evil.example` has host
+ *    `evil.example` and is rejected outright rather than quietly normalised,
+ *    and a `user:password@` prefix on an otherwise-trusted host would inject
+ *    attacker-chosen credentials into every request.
+ */
+export function normalizeOrigin(candidate) {
+    if (typeof candidate !== 'string')
+        return null;
+    const trimmed = candidate.trim();
+    if (trimmed.length === 0)
+        return null;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return null;
+    if (url.username.length > 0 || url.password.length > 0)
+        return null;
+    // `URL.origin` is already lower-cased and port-normalised for http(s).
+    return url.origin;
+}
+/** Read the user-global regions file and yield its `apiBase` values. */
+function readUserRegionApiBases(path) {
+    try {
+        if (!existsSync(path))
+            return [];
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed
+            .map((entry) => entry && typeof entry === 'object'
+            ? entry.apiBase
+            : null)
+            .filter((v) => typeof v === 'string');
+    }
+    catch {
+        // Unreadable / malformed → contributes nothing. Never throws: the hook
+        // runtime must stay fail-open.
+        return [];
+    }
+}
+/**
+ * The set of origins a repository is allowed to redirect the API to.
+ * Always contains the built-in regions, so the allowlist is never empty
+ * (an empty allowlist would silently disable the whole mechanism).
+ */
+export function collectTrustedOrigins(deps = {}) {
+    const origins = new Set();
+    const add = (value) => {
+        const origin = normalizeOrigin(value);
+        if (origin)
+            origins.add(origin);
+    };
+    for (const region of REGIONS)
+        add(region.apiBase);
+    try {
+        const config = (deps.loadConfig ?? loadRuntimeConfig)();
+        add(config?.region?.apiBase);
+    }
+    catch {
+        /* absent or corrupt runtime config — built-ins still apply */
+    }
+    for (const apiBase of readUserRegionApiBases(deps.userRegionsFile ?? userRegionsPath())) {
+        add(apiBase);
+    }
+    for (const extra of deps.extraTrusted ?? [])
+        add(extra);
+    return origins;
+}
+/** True when `candidate` resolves to an origin the user already trusts. */
+export function isTrustedApiBase(candidate, deps = {}) {
+    const origin = normalizeOrigin(candidate);
+    if (!origin)
+        return false;
+    return collectTrustedOrigins(deps).has(origin);
+}
+/** Max length of an attacker-controlled value echoed into a warning. */
+const MAX_ECHO_LEN = 200;
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
+/**
+ * Make an untrusted value safe to print: strip control characters (a rejected
+ * `apiBase` is attacker-controlled, and ANSI escapes in a terminal warning are
+ * their own little injection surface) and bound the length.
+ */
+function safeForLog(value) {
+    const stripped = value.replace(CONTROL_CHARS, '');
+    return stripped.length > MAX_ECHO_LEN
+        ? `${stripped.slice(0, MAX_ECHO_LEN)}…`
+        : stripped;
+}
+function defaultWarn(message) {
+    try {
+        process.stderr.write(message.endsWith('\n') ? message : `${message}\n`);
+    }
+    catch {
+        /* never let logging break a hook */
+    }
+}
+/**
+ * Gate a repository-supplied `apiBase`.
+ *
+ * Returns the value unchanged when its origin is trusted (so a hand-authored
+ * override against the user's OWN cluster keeps working — see `src/link.ts`,
+ * which intentionally preserves such a key on merge), and `null` otherwise,
+ * with a loud one-line warning naming the rejected origin.
+ *
+ * An absent `apiBase` is not a rejection: it returns `null` silently.
+ */
+export function sanitizeRepoApiBase(candidate, deps = {}) {
+    if (candidate === null || candidate === undefined)
+        return null;
+    if (typeof candidate !== 'string' || candidate.trim().length === 0) {
+        return null;
+    }
+    if (isTrustedApiBase(candidate, deps))
+        return candidate;
+    const warn = deps.warn ?? defaultWarn;
+    warn(`[VibeDefend] Ignoring the \`apiBase\` supplied by this repository ` +
+        `(${safeForLog(candidate)}): its origin is not in the trusted region ` +
+        `allowlist, and honouring it would send your access token there. ` +
+        `Using your configured region instead. If that host is legitimately ` +
+        `yours, add it to ~/.cybedefend/regions.json or re-run \`vibedefend install\`.`);
+    return null;
+}
+//# sourceMappingURL=trusted-api-base.js.map

package/dist/hooks/runtime/trusted-api-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-api-base.js","sourceRoot":"","sources":["../../../src/hooks/runtime/trusted-api-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAwBhD,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,SAAkB;IAChD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,uEAAuE;IACvE,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,wEAAwE;AACxE,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAChC,CAAC,CAAE,KAAiC,CAAC,OAAO;YAC5C,CAAC,CAAC,IAAI,CACT;aACA,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,+BAA+B;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAQ,EAAE;QACnC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,sBAAsB,CAC1C,IAAI,CAAC,eAAe,IAAI,eAAe,EAAE,CAC1C,EAAE,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAExD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAC9B,SAAkB,EAClB,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,4CAA4C;AAC5C,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,MAAM,GAAG,YAAY;QACnC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG;QACvC,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAkB,EAClB,OAA2B,EAAE;IAE7B,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,IAAI,CACF,oEAAoE;QAClE,IAAI,UAAU,CAAC,SAAS,CAAC,6CAA6C;QACtE,kEAAkE;QAClE,qEAAqE;QACrE,+EAA+E,CAClF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/link.js

@@ -3,8 +3,11 @@
  *
  * Writes `<path>/.cybedefend/config.json` with the resolved `projectId`,
  * MERGING into any existing file (so a hand-authored `apiBase` override
- * survives). No secret is ever written — the config only ever carries the
- * project id (and whatever keys were already there).
+ * survives — but ONLY when its origin is one the user trusts; see
+ * `hooks/runtime/trusted-api-base.ts`. The file is committed, so an `apiBase`
+ * found there may have been authored by whoever published the repo). No secret
+ * is ever written — the config only ever carries the project id (and whatever
+ * keys were already there).
  *
  * Flow (spec §2.2):
  *   1. Region  — from `~/.cybedefend/runtime-config.json` when present,
@@ -38,6 +41,7 @@ import { deriveLogtoEndpoint } from './endpoints.js';
 import { getOriginRemote as getOriginRemoteImpl, parseRemoteUrl } from './git.js';
 import { loadRuntimeConfig as loadRuntimeConfigImpl } from './hooks/runtime/config.js';
 import { resolveTokenWithRefresh } from './hooks/runtime/resolve.js';
+import { sanitizeRepoApiBase } from './hooks/runtime/trusted-api-base.js';
 import { runLogin as runLoginImpl } from './login.js';
 import { log, readJson, writeJson } from './utils.js';
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -306,7 +310,29 @@ export async function runLinkCommand(opts = {}, deps = {}) {
     const targetPath = await resolveTargetPath(opts, deps);
     const configPath = join(targetPath, '.cybedefend', 'config.json');
     const existing = readJson(configPath, {});
-    const merged = { ...existing, projectId: project.projectId };
+    const merged = {
+        ...existing,
+        projectId: project.projectId,
+    };
+    // SECURITY. This file is committed, so an existing `apiBase` may well have
+    // been authored by whoever published the repo rather than by the user. We
+    // still preserve a hand-authored override (that is the point of merging),
+    // but only when it points at an origin the user actually trusts: a built-in
+    // region, a user-global custom region, or the region just resolved for THIS
+    // link (which the user either installed against or picked interactively).
+    // Anything else is dropped here so it can't sit in the file looking
+    // authoritative — the hook runtime ignores it either way.
+    if (existing.apiBase !== undefined) {
+        const trusted = sanitizeRepoApiBase(existing.apiBase, {
+            loadConfig: deps.loadRuntimeConfig ?? loadRuntimeConfigImpl,
+            extraTrusted: [region.apiBase],
+            warn: (message) => log.warn(message),
+        });
+        if (trusted === null)
+            delete merged.apiBase;
+        else
+            merged.apiBase = trusted;
+    }
     writeJson(configPath, merged);
     const label = project.projectName
         ? `${project.projectName} (${project.projectId})`

package/dist/link.js.map

@@ -1 +1 @@
-{"version":3,"file":"link.js","sourceRoot":"","sources":["../src/link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,iBAAiB,IAAI,qBAAqB,EAC1C,YAAY,IAAI,gBAAgB,EAChC,0BAA0B,IAAI,8BAA8B,GAC7D,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAqB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,eAAe,IAAI,mBAAmB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyDtD,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,iFAAiF;AAEjF,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAiB,EACjB,IAAc;IAEd,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACpE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7C,wEAAwE;QACxE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CACN,qBAAqB,IAAI,CAAC,MAAM,oCAAoC,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI;gBAClF,6CAA6C,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,MAEjB,CAAC;QACF,MAAM,aAAa,GACjB,MAAM,CAAC,aAAa;YACnB,EAAiD,CAAC,aAAa;YAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE;gBAChB,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;gBAC1B,OAAO;gBACP,aAAa;gBACb,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK;aACvB;YACD,oBAAoB,EAAE,IAAI;SAC3B,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,iBAAiB,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,IAAI,MAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,MAAM,qBAAqB,OAAO;iBACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,MAAM,CAAe;YAClC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;gBAChD,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EACV,MAAoD,CAAC,aAAa;gBACnE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;YACrC,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB;QACD,oBAAoB,EAAE,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,gFAAgF;AAChF,KAAK,UAAU,UAAU,CAAC,MAAsB,EAAE,IAAc;IAC9D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,OAAO;QAAE,OAAO;IAEpB,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,4CAA4C,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAiB,EACjB,IAAc,EACd,MAAsB;IAEtB,gEAAgE;IAChE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,IAAI,EAAE,gDAAgD,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,gBAAgB,EAAE,GAAG;YAC9B,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,kCAAkC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,mBAAmB,CAAC;IAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;YACrB,MAAM,aAAa,GACjB,IAAI,CAAC,0BAA0B,IAAI,8BAA8B,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,iEAAiE;gBACjE,GAAG,CAAC,IAAI,CACN,qFAAqF,CACtF,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;oBACvB,OAAO,EAAE,uBAAuB,CAAC,CAAC,WAAW,OAAO,CAAC,CAAC,SAAS,IAAI;oBACnE,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBACH,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAChE,CAAC;gBACD,qDAAqD;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,OAAO,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAAc,EACd,MAAsB,EACtB,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GACT,IAAI,CAAC,MAAM,KAAK,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACZ,CAAC,CAAC,MAAM,MAAM,CAAS;YACnB,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC1D,CAAC,CAAC;IAET,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAExD,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,kEAAkE;IAClE,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,CACb,MAAM,KAAK,CAAC;YACV,OAAO,EAAE,4CAA4C;YACrD,OAAO,EAAE,EAAE;SACZ,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM;YACrB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;YACvD,CAAC,CAAC,OAAO,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAsC;YAC/D,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE;gBAClD,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC,CAAC,IAAI;aACd,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAAiB,EACjB,IAAc;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,OAAO,EAAE,0CAA0C;QACnD,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE;YACtB,MAAM,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,CAAC,CAAC;gBACb,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,sDAAsD,CAAC;QAC7D,CAAC;KACF,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAoB,EAAE,EACtB,OAAiB,EAAE;IAEnB,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEzE,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC7D,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW;QAC/B,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,SAAS,GAAG;QACjD,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"link.js","sourceRoot":"","sources":["../src/link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,iBAAiB,IAAI,qBAAqB,EAC1C,YAAY,IAAI,gBAAgB,EAChC,0BAA0B,IAAI,8BAA8B,GAC7D,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAqB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,eAAe,IAAI,mBAAmB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyDtD,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,iFAAiF;AAEjF,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAiB,EACjB,IAAc;IAEd,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACpE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7C,wEAAwE;QACxE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CACN,qBAAqB,IAAI,CAAC,MAAM,oCAAoC,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI;gBAClF,6CAA6C,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,MAEjB,CAAC;QACF,MAAM,aAAa,GACjB,MAAM,CAAC,aAAa;YACnB,EAAiD,CAAC,aAAa;YAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE;gBACN,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE;gBAChB,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;gBAC1B,OAAO;gBACP,aAAa;gBACb,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK;aACvB;YACD,oBAAoB,EAAE,IAAI;SAC3B,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,iBAAiB,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,IAAI,MAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,MAAM,qBAAqB,OAAO;iBACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,MAAM,CAAe;YAClC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;gBAChD,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EACV,MAAoD,CAAC,aAAa;gBACnE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;YACrC,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB;QACD,oBAAoB,EAAE,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,gFAAgF;AAChF,KAAK,UAAU,UAAU,CAAC,MAAsB,EAAE,IAAc;IAC9D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,OAAO;QAAE,OAAO;IAEpB,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,4CAA4C,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAiB,EACjB,IAAc,EACd,MAAsB;IAEtB,gEAAgE;IAChE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,IAAI,EAAE,gDAAgD,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,gBAAgB,EAAE,GAAG;YAC9B,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,kCAAkC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,mBAAmB,CAAC;IAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;YACrB,MAAM,aAAa,GACjB,IAAI,CAAC,0BAA0B,IAAI,8BAA8B,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,iEAAiE;gBACjE,GAAG,CAAC,IAAI,CACN,qFAAqF,CACtF,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;oBACvB,OAAO,EAAE,uBAAuB,CAAC,CAAC,WAAW,OAAO,CAAC,CAAC,SAAS,IAAI;oBACnE,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBACH,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAChE,CAAC;gBACD,qDAAqD;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,OAAO,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAAc,EACd,MAAsB,EACtB,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GACT,IAAI,CAAC,MAAM,KAAK,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACZ,CAAC,CAAC,MAAM,MAAM,CAAS;YACnB,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC1D,CAAC,CAAC;IAET,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAExD,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,kEAAkE;IAClE,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,CACb,MAAM,KAAK,CAAC;YACV,OAAO,EAAE,4CAA4C;YACrD,OAAO,EAAE,EAAE;SACZ,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM;YACrB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;YACvD,CAAC,CAAC,OAAO,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAsC;YAC/D,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE;gBAClD,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC,CAAC,IAAI;aACd,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAAiB,EACjB,IAAc;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,OAAO,EAAE,0CAA0C;QACnD,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE;YACtB,MAAM,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,CAAC,CAAC;gBACb,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,sDAAsD,CAAC;QAC7D,CAAC;KACF,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAoB,EAAE,EACtB,OAAiB,EAAE;IAEnB,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEzE,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAA4B;QACtC,GAAG,QAAQ;QACX,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,oEAAoE;IACpE,0DAA0D;IAC1D,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE;YACpD,UAAU,EAAE,IAAI,CAAC,iBAAiB,IAAI,qBAAqB;YAC3D,YAAY,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;YAC9B,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;;YACvC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW;QAC/B,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,SAAS,GAAG;QACjD,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU;KACX,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cybedefend/vibedefend",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "VibeDefend — one-shot installer for CybeDefend's MCP server and Claude Code / Cursor / Codex / Windsurf hooks (for AI coding agents).",
   "type": "module",
   "bin": {
@@ -26,21 +26,28 @@
     "node": ">=18.17"
   },
   "dependencies": {
-    "@inquirer/prompts": "^7.2.1",
+    "@inquirer/prompts": "^7.10.1",
     "commander": "^12.1.0",
     "kleur": "^4.1.5",
     "re2-wasm": "^1.0.2",
-    "shell-quote": "^1.8.3",
-    "update-notifier": "^7.3.1"
+    "shell-quote": "^1.10.0",
+    "update-notifier": "^7.3.1",
+    "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@types/node": "^20.14.0",
+    "@types/node": "^20.19.43",
     "@types/shell-quote": "^1.7.5",
     "@types/update-notifier": "^6.0.8",
-    "esbuild": "^0.28.0",
-    "tsx": "^4.20.6",
-    "typescript": "^5.6.0",
-    "vitest": "^2.1.0"
+    "esbuild": "^0.28.2",
+    "tsx": "^4.23.13",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.7"
+  },
+  "pnpm": {
+    "overrides": {
+      "vite": ">=6.4.3 <8.0.0",
+      "postcss": ">=8.5.18 <9.0.0"
+    }
   },
   "license": "BUSL-1.1",
   "repository": {