@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/mcp/config/lock.js

@@ -0,0 +1,102 @@
+/**
+ * One sync at a time, across processes.
+ *
+ * The proxy runs one process per MCP server, and each of them wants to sync
+ * at startup. Five processes rewriting `~/.claude.json` at the same second is
+ * how a lost update happens: they all read the same document, they all write,
+ * and the last one wins — taking with it whatever the others (or the client
+ * itself) had just added.
+ *
+ * `open(…, 'wx')` is the whole mechanism: it creates the file or fails, in
+ * one syscall, on every platform we ship to. No dependency, no daemon.
+ *
+ * A lock is stolen once it is older than `STALE_AFTER_MS`. A proxy killed
+ * with SIGKILL leaves its lock behind, and a park that never syncs again
+ * because of a file nobody will ever delete is worse than the race the lock
+ * exists to prevent.
+ */
+import { closeSync, mkdirSync, openSync, readFileSync, unlinkSync, writeSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { mcpHomeDir } from '../proxy/paths.js';
+export const STALE_AFTER_MS = 60_000;
+export function syncLockPath(env = process.env) {
+    return join(mcpHomeDir(env), 'sync.lock');
+}
+/**
+ * Runs `body` while holding the lock, or returns `null` without running it.
+ *
+ * `null` is not a failure: it means another process is already doing exactly
+ * this work, and the right thing is to let it.
+ */
+export async function withSyncLock(body, deps = {}) {
+    const path = syncLockPath(deps.env ?? process.env);
+    const now = deps.now ?? Date.now;
+    const staleAfter = deps.staleAfterMs ?? STALE_AFTER_MS;
+    if (!acquire(path, now(), staleAfter, now))
+        return null;
+    try {
+        return await body();
+    }
+    finally {
+        try {
+            unlinkSync(path);
+        }
+        catch {
+            /* someone stole it; they own the cleanup */
+        }
+    }
+}
+function acquire(path, stamp, staleAfter, now) {
+    try {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    }
+    catch {
+        return false;
+    }
+    if (tryCreate(path, stamp))
+        return true;
+    // Held. Only steal it if whoever wrote it is long gone.
+    let age = Number.POSITIVE_INFINITY;
+    try {
+        const held = Number(JSON.parse(readFileSync(path, 'utf8')).at ?? 0);
+        age = now() - held;
+    }
+    catch {
+        // Unreadable lock file: treat it as stale rather than as a permanent
+        // block, which is what a truncated write would otherwise cause.
+    }
+    if (age < staleAfter)
+        return false;
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        return false;
+    }
+    return tryCreate(path, stamp);
+}
+function tryCreate(path, stamp) {
+    let handle;
+    try {
+        handle = openSync(path, 'wx', 0o600);
+    }
+    catch {
+        return false;
+    }
+    try {
+        writeSync(handle, JSON.stringify({ pid: process.pid, at: stamp }));
+    }
+    catch {
+        /* the lock is held either way; the contents are only a diagnostic */
+    }
+    finally {
+        try {
+            closeSync(handle);
+        }
+        catch {
+            /* nothing to close */
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=lock.js.map

package/dist/mcp/config/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/mcp/config/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAA0B,EAC1B,OAAiB,EAAE;IAEnB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC;IAEvD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,UAAkB,EAAE,GAAiB;IACjF,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,wDAAwD;IACxD,IAAI,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,gEAAgE;IAClE,CAAC;IACD,IAAI,GAAG,GAAG,UAAU;QAAE,OAAO,KAAK,CAAC;IAEnC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mcp/config/proxyBinary.js

@@ -0,0 +1,211 @@
+/**
+ * Is the `vibedefend` that is running the one a client would spawn?
+ *
+ * A wrapped entry says `{"command":"vibedefend","args":["mcp","--name",…]}`
+ * and nothing more, so it works only if the `vibedefend` a client finds on
+ * the PATH is a release that has the `mcp` subcommand. Two things follow:
+ *
+ *  - the proxy's background sync may rewrite a client config only when the
+ *    proxy itself IS that binary — the entries it writes then point at the
+ *    thing that is demonstrably running. `node dist/index.js` in a checkout
+ *    is somebody else, and its entries would point at whatever older release
+ *    the PATH holds: measured on 2026-09-08, three clients broken at once;
+ *  - an explicit install may proceed from another binary, but only after
+ *    asking the PATH's `vibedefend` whether it knows `mcp`.
+ *
+ * What "the binary on the PATH" delegates to is read from the shim itself:
+ * a symlink (npm on POSIX), a shell script (pnpm everywhere, npm's cmd-shim
+ * for POSIX callers on Windows) or a `.cmd` (npm on Windows) all name the
+ * JavaScript entry point they run, and that entry point is what
+ * `process.argv[1]` resolves to in the running process.
+ */
+import { spawnSync } from 'node:child_process';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, resolve, sep } from 'node:path';
+const BINARY_NAME = 'vibedefend';
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
+/** A shim is a few hundred bytes; anything bigger is a real program, not a pointer. */
+const MAX_SHIM_BYTES = 64 * 1024;
+const SCRIPT_SUFFIX = /\.(?:js|cjs|mjs)$/i;
+/** The first `vibedefend` on the PATH, the way a client's `spawn` would find it. */
+export function findProxyBinaryOnPath(deps = {}) {
+    const env = deps.env ?? process.env;
+    const platform = deps.platform ?? process.platform;
+    const existsFn = deps.existsFn ?? isFile;
+    const path = envValue(env, 'PATH');
+    if (!path)
+        return null;
+    const names = platform === 'win32'
+        ? (envValue(env, 'PATHEXT') ?? DEFAULT_PATHEXT)
+            .split(';')
+            .filter((ext) => ext.trim() !== '')
+            // The file system is case-insensitive there and PATHEXT is spelled
+            // in capitals; probing the lower-case name returns the path as npm
+            // wrote it.
+            .map((ext) => BINARY_NAME + ext.trim().toLowerCase())
+        : [BINARY_NAME];
+    for (const dir of path.split(platform === 'win32' ? ';' : ':')) {
+        if (dir.trim() === '')
+            continue;
+        for (const name of names) {
+            const candidate = resolve(dir, name);
+            if (existsFn(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * The real paths a PATH entry ends up running.
+ *
+ * Always its own real path (a symlink resolves to the script; a script is
+ * itself). Then, when it is a small text file, every token in it that names a
+ * JavaScript file, with the placeholders the shim generators use for "the
+ * directory I am in" filled in. A token that still holds a variable after
+ * that is somebody else's and is ignored.
+ */
+export function proxyBinaryDelegates(shim, deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const existsFn = deps.existsFn ?? isFile;
+    const readFileFn = deps.readFileFn ?? readShim;
+    const realpathFn = deps.realpathFn ?? realpathSync;
+    const out = new Set();
+    try {
+        out.add(realpathFn(shim));
+    }
+    catch {
+        /* dangling symlink: nothing to delegate to */
+    }
+    let text;
+    try {
+        text = readFileFn(shim);
+    }
+    catch {
+        return [...out];
+    }
+    const shimDir = dirname(shim);
+    for (const token of text.split(/["'\s]+/)) {
+        if (!SCRIPT_SUFFIX.test(token))
+            continue;
+        let candidate = token
+            .replace(/%~dp0/gi, shimDir)
+            .replace(/%dp0%/gi, shimDir)
+            .replace(/\$\{basedir\}|\$basedir/g, shimDir);
+        if (/[$%]/.test(candidate))
+            continue;
+        if (platform === 'win32')
+            candidate = candidate.replace(/\\/g, sep);
+        if (!isAbsolute(candidate))
+            candidate = resolve(shimDir, candidate);
+        if (!existsFn(candidate))
+            continue;
+        try {
+            out.add(realpathFn(candidate));
+        }
+        catch {
+            /* raced away; not a delegate */
+        }
+    }
+    return [...out];
+}
+export function checkProxyBinary(deps = {}) {
+    const env = deps.env ?? process.env;
+    const platform = deps.platform ?? process.platform;
+    const existsFn = deps.existsFn ?? isFile;
+    const realpathFn = deps.realpathFn ?? realpathSync;
+    let running = null;
+    const argv1 = deps.argv1 ?? process.argv[1];
+    if (argv1 && existsFn(argv1)) {
+        try {
+            running = realpathFn(argv1);
+        }
+        catch {
+            running = null;
+        }
+    }
+    const onPath = findProxyBinaryOnPath({ ...deps, env, platform });
+    const base = { running, onPath, platform, env };
+    if (!onPath)
+        return { ...base, delegates: [], matches: false, reason: 'not-on-path' };
+    const delegates = proxyBinaryDelegates(onPath, { ...deps, env, platform });
+    if (!running)
+        return { ...base, delegates, matches: false, reason: 'no-entry-point' };
+    const matches = delegates.includes(running);
+    return matches
+        ? { ...base, delegates, matches: true }
+        : { ...base, delegates, matches: false, reason: 'different-binary' };
+}
+/**
+ * The option every wrapped entry passes. A help text that describes it is a
+ * release that can serve the entry; one that does not is not, whatever its
+ * exit code says.
+ */
+const WRAPPED_ENTRY_OPTION = /--name\b/;
+/**
+ * Does the `vibedefend` on the PATH have the `mcp` subcommand?
+ *
+ * Trivially yes when it is the running binary. Otherwise the only honest
+ * answer comes from asking it — and the exit code of `mcp --help` proves
+ * nothing: measured on 1.4.2, commander prints the PROGRAM help and exits 0
+ * for an unknown command followed by `--help`. What proves it is the help
+ * describing `--name`, the option a wrapped entry runs with. A `.cmd` shim is
+ * not an executable and goes through the command interpreter.
+ */
+export function proxyBinaryKnowsMcp(check, deps = {}) {
+    if (!check.onPath)
+        return false;
+    if (check.matches)
+        return true;
+    const execFileFn = deps.execFileFn ?? defaultExecFile;
+    try {
+        const result = check.platform === 'win32' && /\.(?:cmd|bat)$/i.test(check.onPath)
+            ? execFileFn(envValue(check.env, 'ComSpec') ?? 'cmd.exe', [
+                '/d',
+                '/s',
+                '/c',
+                `"${check.onPath}" mcp --help`,
+            ])
+            : execFileFn(check.onPath, ['mcp', '--help']);
+        return result.status === 0 && WRAPPED_ENTRY_OPTION.test(result.output ?? '');
+    }
+    catch {
+        return false;
+    }
+}
+/** Environment lookups are case-insensitive on Windows (`Path`, `ComSpec`), so be everywhere. */
+function envValue(env, name) {
+    const direct = env[name];
+    if (direct !== undefined)
+        return direct;
+    const wanted = name.toLowerCase();
+    for (const [key, value] of Object.entries(env)) {
+        if (key.toLowerCase() === wanted)
+            return value;
+    }
+    return undefined;
+}
+function isFile(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function readShim(path) {
+    if (statSync(path).size > MAX_SHIM_BYTES)
+        throw new Error('not a shim');
+    return readFileSync(path, 'utf8');
+}
+function defaultExecFile(file, args) {
+    const result = spawnSync(file, args, {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 15_000,
+        windowsHide: true,
+    });
+    if (result.error)
+        throw result.error;
+    return { status: result.status, output: `${result.stdout ?? ''}${result.stderr ?? ''}` };
+}
+//# sourceMappingURL=proxyBinary.js.map

package/dist/mcp/config/proxyBinary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyBinary.js","sourceRoot":"","sources":["../../../src/mcp/config/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA2B9D,MAAM,WAAW,GAAG,YAAY,CAAC;AACjC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,uFAAuF;AACvF,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,OAAwB,EAAE;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IAEzC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,KAAK,GACT,QAAQ,KAAK,OAAO;QAClB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,eAAe,CAAC;aAC1C,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACnC,mEAAmE;YACnE,mEAAmE;YACnE,YAAY;aACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAwB,EAAE;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,IAAI,SAAS,GAAG,KAAK;aAClB,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;aAC3B,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;aAC3B,OAAO,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QACrC,IAAI,QAAQ,KAAK,OAAO;YAAE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAwB,EAAE;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC;IAEnD,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEtF,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAEtF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,OAAO;QACZ,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AACzE,CAAC;AAaD;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAuB,EAAE,OAAqB,EAAE;IAClF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GACV,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,SAAS,EAAE;gBACtD,IAAI;gBACJ,IAAI;gBACJ,IAAI;gBACJ,IAAI,KAAK,CAAC,MAAM,cAAc;aAC/B,CAAC;YACJ,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAc;IACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;QACnC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC;AAC3F,CAAC"}