@swarmdo/cli 1.4.8

package/vendor/cli-core/dist/src/mcp-tools/validate-input.js

@@ -0,0 +1,248 @@
+/**
+ * Input Validation for MCP Tools
+ *
+ * Loads @swarmdo/security validators when available
+ * and provides lightweight fallback validation otherwise.
+ *
+ * Addresses #1425: security validators were implemented but never wired to runtime.
+ */
+// Patterns for input sanitization (inline — no external dependency required)
+const SHELL_META = /[;&|`$(){}[\]<>!#\\]/;
+const PATH_TRAVERSAL = /\.\.[/\\]/;
+const IDENTIFIER_RE = /^[a-zA-Z0-9_][a-zA-Z0-9_\-.:]{0,127}$/;
+const GIT_REF_RE = /^[a-zA-Z0-9_][a-zA-Z0-9_\-.:~^/]{0,255}$/;
+const NPM_PACKAGE_RE = /^(@[a-zA-Z0-9_\-]+\/)?[a-zA-Z0-9_\-][a-zA-Z0-9_\-.]{0,213}$/;
+/**
+ * Validate an identifier (agent ID, agent type, namespace, key, etc.)
+ * Rejects shell metacharacters and path traversal.
+ */
+export function validateIdentifier(value, label) {
+    if (typeof value !== 'string' || value.length === 0) {
+        return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
+    }
+    if (value.length > 128) {
+        return { valid: false, sanitized: '', error: `${label} exceeds 128 characters` };
+    }
+    if (SHELL_META.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains disallowed characters` };
+    }
+    if (PATH_TRAVERSAL.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains path traversal` };
+    }
+    if (!IDENTIFIER_RE.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains invalid characters (allowed: alphanumeric, _, -, ., :)` };
+    }
+    return { valid: true, sanitized: value };
+}
+/**
+ * Validate a git ref (HEAD~1, main..feature, commit hashes, etc.).
+ * Allows ~, ^, and / which are standard git revision selectors.
+ */
+export function validateGitRef(value, label) {
+    if (typeof value !== 'string' || value.length === 0) {
+        return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
+    }
+    if (value.length > 256) {
+        return { valid: false, sanitized: '', error: `${label} exceeds 256 characters` };
+    }
+    if (SHELL_META.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains disallowed characters` };
+    }
+    if (!GIT_REF_RE.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains invalid characters (allowed: alphanumeric, _, -, ., :, ~, ^, /)` };
+    }
+    return { valid: true, sanitized: value };
+}
+/**
+ * Validate an npm package name (allows @scope/name format).
+ */
+export function validatePackageName(value, label) {
+    if (typeof value !== 'string' || value.length === 0) {
+        return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
+    }
+    if (value.length > 214) {
+        return { valid: false, sanitized: '', error: `${label} exceeds 214 characters` };
+    }
+    if (SHELL_META.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains disallowed characters` };
+    }
+    if (!NPM_PACKAGE_RE.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains invalid characters (expected npm package name, e.g. @scope/name)` };
+    }
+    return { valid: true, sanitized: value };
+}
+// Path-specific shell-meta check: backslash is a legitimate Windows path
+// separator (e.g. `E:\Repos\app\file.ts`) and Claude Code's hook events
+// deliver absolute paths in `tool_input.file_path` with backslashes on
+// Windows. The general SHELL_META set includes `\` for identifier safety,
+// but paths are not shell-expanded — normalizing to forward slashes for
+// the check keeps every other shell metacharacter rejected while letting
+// absolute Windows paths through (#2352).
+const PATH_SHELL_META = /[;&|`$(){}[\]<>!#]/;
+/**
+ * Validate a file path (prevents traversal and shell injection).
+ */
+export function validatePath(value, label) {
+    if (typeof value !== 'string' || value.length === 0) {
+        return { valid: false, sanitized: '', error: `${label} must be a non-empty string` };
+    }
+    if (value.length > 4096) {
+        return { valid: false, sanitized: '', error: `${label} exceeds 4096 characters` };
+    }
+    if (PATH_TRAVERSAL.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains path traversal (..)` };
+    }
+    if (PATH_SHELL_META.test(value)) {
+        return { valid: false, sanitized: '', error: `${label} contains shell metacharacters` };
+    }
+    // Normalize Windows backslashes to forward slashes in the sanitized value
+    // so downstream consumers see a single path shape regardless of OS.
+    const sanitized = value.replace(/\\/g, '/');
+    return { valid: true, sanitized };
+}
+/**
+ * Validate a free-text string (description, value, etc.)
+ * Allows most characters but rejects shell metacharacters that could cause injection.
+ */
+export function validateText(value, label, maxLen = 10_000) {
+    if (typeof value !== 'string') {
+        return { valid: false, sanitized: '', error: `${label} must be a string` };
+    }
+    if (value.length > maxLen) {
+        return { valid: false, sanitized: '', error: `${label} exceeds ${maxLen} characters` };
+    }
+    // Strip null bytes
+    const sanitized = value.replace(/\0/g, '');
+    return { valid: true, sanitized };
+}
+/**
+ * Names that let an attacker pivot a child process before any user code runs:
+ * shared-library injection on Linux/macOS, Node hooks, and command resolution.
+ *
+ * audit_1776853149979: terminal_create previously merged caller-supplied env
+ * straight into execSync's environment for every subsequent command in the
+ * session. Setting LD_PRELOAD or NODE_OPTIONS via that path is functionally
+ * equivalent to remote code execution, so the env input needs an allowlist
+ * shape and a denylist on these specific names.
+ */
+const DENYLISTED_ENV_NAMES = new Set([
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'LD_AUDIT',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+    'DYLD_FALLBACK_LIBRARY_PATH',
+    'DYLD_FORCE_FLAT_NAMESPACE',
+    'NODE_OPTIONS',
+    'NODE_PATH',
+]);
+const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+/**
+ * Validate a Record<string,string> of environment variables: enforce POSIX
+ * names, reject hijack-prone names (LD_PRELOAD, NODE_OPTIONS, …), forbid null
+ * bytes in values, and cap value length so a malicious caller can't bloat the
+ * stored session past reasonable bounds.
+ */
+export function validateEnv(value, label = 'env') {
+    if (value === undefined || value === null) {
+        return { valid: true, sanitized: {} };
+    }
+    if (typeof value !== 'object' || Array.isArray(value)) {
+        return { valid: false, sanitized: {}, error: `${label} must be an object of string→string` };
+    }
+    const out = {};
+    for (const [name, rawVal] of Object.entries(value)) {
+        if (!ENV_NAME_RE.test(name)) {
+            return { valid: false, sanitized: {}, error: `${label} key "${name}" is not a valid POSIX env name` };
+        }
+        if (DENYLISTED_ENV_NAMES.has(name)) {
+            return { valid: false, sanitized: {}, error: `${label} key "${name}" is denylisted (loader/runtime hijack)` };
+        }
+        if (typeof rawVal !== 'string') {
+            return { valid: false, sanitized: {}, error: `${label}["${name}"] must be a string` };
+        }
+        if (rawVal.length > 32_768) {
+            return { valid: false, sanitized: {}, error: `${label}["${name}"] exceeds 32768 characters` };
+        }
+        if (rawVal.includes('\0')) {
+            return { valid: false, sanitized: {}, error: `${label}["${name}"] contains a null byte` };
+        }
+        out[name] = rawVal;
+    }
+    return { valid: true, sanitized: out };
+}
+/**
+ * Assert validation or throw with a structured error.
+ */
+export function assertValid(result) {
+    if (!result.valid) {
+        throw new Error(`Validation failed: ${result.error}`);
+    }
+    return result.sanitized;
+}
+// Try to load the full @swarmdo/security module for enhanced validation
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let _securityModule = null;
+let _securityLoaded = false;
+async function getSecurityModule() {
+    if (_securityLoaded)
+        return _securityModule;
+    _securityLoaded = true;
+    try {
+        // Dynamic import — @swarmdo/security is an optional dependency
+        _securityModule = await Function('return import("@swarmdo/security")')();
+    }
+    catch {
+        // @swarmdo/security is optional — fallback to inline validation above
+    }
+    return _securityModule;
+}
+/**
+ * Enhanced validation using @swarmdo/security Zod schemas when available.
+ * Falls back to inline regex validation otherwise.
+ */
+export async function validateAgentSpawn(input) {
+    const errors = [];
+    // Always run inline validation
+    if (input.agentType) {
+        const r = validateIdentifier(input.agentType, 'agentType');
+        if (!r.valid)
+            errors.push(r.error);
+    }
+    if (input.agentId) {
+        const r = validateIdentifier(input.agentId, 'agentId');
+        if (!r.valid)
+            errors.push(r.error);
+    }
+    if (input.domain) {
+        const r = validateIdentifier(input.domain, 'domain');
+        if (!r.valid)
+            errors.push(r.error);
+    }
+    // Try enhanced Zod validation if available.
+    // Fix for #1567: @swarmdo/security's SpawnAgentSchema expects `type` and
+    // `id` (not `agentType`/`name`), so the previous call always failed with
+    // "type: Required". Also swallow `invalid_enum_value` errors because the
+    // schema enumerates only 15 built-in agent types — we support custom types
+    // (the inline validator already checked the identifier is safe).
+    const sec = await getSecurityModule();
+    if (sec?.SpawnAgentSchema) {
+        try {
+            sec.SpawnAgentSchema.parse({
+                type: input.agentType,
+                id: input.agentId,
+            });
+        }
+        catch (zodErr) {
+            if (zodErr.issues) {
+                for (const issue of zodErr.issues) {
+                    if (issue.code === 'invalid_enum_value')
+                        continue;
+                    errors.push(`${issue.path.join('.')}: ${issue.message}`);
+                }
+            }
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
+//# sourceMappingURL=validate-input.js.map

package/vendor/cli-core/dist/src/mcp-tools/validate-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-input.js","sourceRoot":"","sources":["../../../src/mcp-tools/validate-input.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6EAA6E;AAC7E,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAC1C,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAC9D,MAAM,cAAc,GAAG,6DAA6D,CAAC;AAQrF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,KAAa;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,yBAAyB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,kEAAkE,EAAE,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,KAAa;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,yBAAyB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,2EAA2E,EAAE,CAAC;IACrI,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,KAAa;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,yBAAyB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,4EAA4E,EAAE,CAAC;IACtI,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,0CAA0C;AAC1C,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,+BAA+B,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,gCAAgC,EAAE,CAAC;IAC1F,CAAC;IACD,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAa,EAAE,MAAM,GAAG,MAAM;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,mBAAmB,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,MAAM,aAAa,EAAE,CAAC;IACzF,CAAC;IACD,mBAAmB;IACnB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,uBAAuB;IACvB,mBAAmB;IACnB,4BAA4B;IAC5B,2BAA2B;IAC3B,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAQrD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,KAAK,GAAG,KAAK;IACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,qCAAqC,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,SAAS,IAAI,iCAAiC,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,SAAS,IAAI,yCAAyC,EAAE,CAAC;QAChH,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,IAAI,6BAA6B,EAAE,CAAC;QAChG,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC5F,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwB;IAClD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC;AAC1B,CAAC;AAED,wEAAwE;AACxE,8DAA8D;AAC9D,IAAI,eAAe,GAA+B,IAAI,CAAC;AACvD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,KAAK,UAAU,iBAAiB;IAC9B,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,eAAe,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,+DAA+D;QAC/D,eAAe,GAAG,MAAO,QAAQ,CAAC,oCAAoC,CAAC,EAAmC,CAAC;IAC7G,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,+BAA+B;IAC/B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC;IACtC,CAAC;IAED,4CAA4C;IAC5C,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACtC,IAAI,GAAG,EAAE,gBAAgB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC;gBACzB,IAAI,EAAE,KAAK,CAAC,SAAS;gBACrB,EAAE,EAAE,KAAK,CAAC,OAAO;aAClB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,MAAW,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;wBAAE,SAAS;oBAClD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/vendor/cli-core/dist/src/memory/backend.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Memory backend abstraction (ADR-100 alpha.1).
+ *
+ * Defines the contract that any memory implementation in the Swarmdo
+ * ecosystem must satisfy. cli-core ships JsonMemoryBackend (this directory)
+ * for the lite path; @swarmdo/cli ships SqliteHnswMemoryBackend (heavy
+ * path with vector search) which implements the same interface.
+ *
+ * Plugins / scripts that only need basic key-value persistence
+ * (cost-tracker's session records, budget config, etc.) work against this
+ * interface — semantic search degrades to substring fallback in the lite
+ * backend, but every other operation is feature-complete.
+ */
+export interface MemoryEntry {
+    key: string;
+    value: unknown;
+    namespace: string;
+    tags: string[];
+    storedAt: string;
+    accessCount: number;
+    lastAccessed: string;
+    ttlSeconds?: number;
+}
+export interface MemorySearchResult extends MemoryEntry {
+    /**
+     * Similarity score [0, 1]. The lite (JSON) backend produces a substring-
+     * match score (1.0 = exact substring, 0 < x < 1 = fuzzy). The heavy
+     * (SQLite/HNSW) backend produces a true cosine similarity from the vector
+     * index. Callers ranking by score should treat the value as backend-
+     * specific — comparing scores across backends is meaningless.
+     */
+    score: number;
+    /** Which backend produced this result. Useful for observability. */
+    backend: 'json' | 'sqlite-hnsw' | string;
+}
+export interface StoreOptions {
+    namespace?: string;
+    tags?: string[];
+    ttl?: number;
+    upsert?: boolean;
+}
+export interface SearchOptions {
+    namespace?: string;
+    limit?: number;
+    threshold?: number;
+}
+export interface ListOptions {
+    namespace?: string;
+    limit?: number;
+    tags?: string[];
+}
+export interface MemoryStats {
+    totalEntries: number;
+    namespaces: string[];
+    sizeBytes: number;
+    backend: string;
+}
+/**
+ * The contract every memory backend implements.
+ * All methods are async to allow for I/O-heavy or remote backends.
+ */
+export interface MemoryBackend {
+    /**
+     * Store a value under (namespace, key). If a record exists at that
+     * coordinate AND opts.upsert is false (default), throws a UNIQUE-constraint
+     * error. With upsert: true, replaces.
+     */
+    store(key: string, value: unknown, opts?: StoreOptions): Promise<void>;
+    /**
+     * Read by exact (namespace, key). Returns null on miss.
+     * Increments accessCount + lastAccessed.
+     */
+    retrieve(key: string, opts?: {
+        namespace?: string;
+    }): Promise<MemoryEntry | null>;
+    /**
+     * Search by query. Lite backend = substring match (score=1 for exact
+     * substring, 0.5 for case-insensitive partial); heavy backend = cosine
+     * similarity over HNSW. Both honor namespace + threshold + limit.
+     */
+    search(query: string, opts?: SearchOptions): Promise<MemorySearchResult[]>;
+    /**
+     * Enumerate entries (with optional namespace + tag filtering).
+     * Does NOT increment accessCount.
+     */
+    list(opts?: ListOptions): Promise<MemoryEntry[]>;
+    /**
+     * Remove an entry by exact (namespace, key). Returns true if deleted,
+     * false if no such entry existed.
+     */
+    delete(key: string, opts?: {
+        namespace?: string;
+    }): Promise<boolean>;
+    /**
+     * Backend health + size summary. Used by `memory stats` CLI subcommand.
+     */
+    stats(): Promise<MemoryStats>;
+    /**
+     * Backend identifier. cli-core's JSON backend returns 'json'; cli's
+     * SQLite/HNSW backend returns 'sqlite-hnsw'. Used for observability and
+     * for `memory_search` MCP-tool callers that want to know which scoring
+     * regime they're dealing with.
+     */
+    readonly id: string;
+}
+//# sourceMappingURL=backend.d.ts.map

package/vendor/cli-core/dist/src/memory/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../../src/memory/backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD;;;;;;OAMG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd,oEAAoE;IACpE,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAElF;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE3E;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEjD;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB"}

package/vendor/cli-core/dist/src/memory/backend.js

@@ -0,0 +1,15 @@
+/**
+ * Memory backend abstraction (ADR-100 alpha.1).
+ *
+ * Defines the contract that any memory implementation in the Swarmdo
+ * ecosystem must satisfy. cli-core ships JsonMemoryBackend (this directory)
+ * for the lite path; @swarmdo/cli ships SqliteHnswMemoryBackend (heavy
+ * path with vector search) which implements the same interface.
+ *
+ * Plugins / scripts that only need basic key-value persistence
+ * (cost-tracker's session records, budget config, etc.) work against this
+ * interface — semantic search degrades to substring fallback in the lite
+ * backend, but every other operation is feature-complete.
+ */
+export {};
+//# sourceMappingURL=backend.js.map

package/vendor/cli-core/dist/src/memory/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../../src/memory/backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/vendor/cli-core/dist/src/memory/json-backend.d.ts

@@ -0,0 +1,39 @@
+/**
+ * JsonMemoryBackend — the lite memory implementation that ships in cli-core.
+ *
+ * Persists entries to a JSON file (default: `.swarm/memory.json`, override
+ * via SWARMDO_MEMORY_PATH). No SQLite, no HNSW, no ONNX embeddings —
+ * deliberately so that cli-core stays under 250 KB packed.
+ *
+ * Search degrades to substring matching (case-insensitive). For real
+ * semantic search install @swarmdo/cli (the heavy SqliteHnswMemoryBackend
+ * implements the same interface).
+ *
+ * Atomicity: every write goes through a temp file + atomic rename. No
+ * inflight reader sees a half-written JSON. Concurrent writers across
+ * processes are NOT coordinated — the last writer wins. Acceptable for
+ * single-developer plugin workloads; not safe under high write contention.
+ */
+import type { MemoryBackend, MemoryEntry, MemorySearchResult, MemoryStats, StoreOptions, SearchOptions, ListOptions } from './backend.js';
+export declare class JsonMemoryBackend implements MemoryBackend {
+    readonly id = "json";
+    private readonly path;
+    private cache;
+    constructor(opts?: {
+        path?: string;
+    });
+    private load;
+    private save;
+    private isExpired;
+    store(key: string, value: unknown, opts?: StoreOptions): Promise<void>;
+    retrieve(key: string, opts?: {
+        namespace?: string;
+    }): Promise<MemoryEntry | null>;
+    search(query: string, opts?: SearchOptions): Promise<MemorySearchResult[]>;
+    list(opts?: ListOptions): Promise<MemoryEntry[]>;
+    delete(key: string, opts?: {
+        namespace?: string;
+    }): Promise<boolean>;
+    stats(): Promise<MemoryStats>;
+}
+//# sourceMappingURL=json-backend.d.ts.map

package/vendor/cli-core/dist/src/memory/json-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-backend.d.ts","sourceRoot":"","sources":["../../../src/memory/json-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,WAAW,EACZ,MAAM,cAAc,CAAC;AAoBtB,qBAAa,iBAAkB,YAAW,aAAa;IACrD,QAAQ,CAAC,EAAE,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,KAAK,CAA0B;gBAE3B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;IAIpC,OAAO,CAAC,IAAI;IA0BZ,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,SAAS;IAMX,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBtE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAiBjF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAyB1E,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAkBhD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAUpE,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC;CAcpC"}

package/vendor/cli-core/dist/src/memory/json-backend.js

@@ -0,0 +1,186 @@
+/**
+ * JsonMemoryBackend — the lite memory implementation that ships in cli-core.
+ *
+ * Persists entries to a JSON file (default: `.swarm/memory.json`, override
+ * via SWARMDO_MEMORY_PATH). No SQLite, no HNSW, no ONNX embeddings —
+ * deliberately so that cli-core stays under 250 KB packed.
+ *
+ * Search degrades to substring matching (case-insensitive). For real
+ * semantic search install @swarmdo/cli (the heavy SqliteHnswMemoryBackend
+ * implements the same interface).
+ *
+ * Atomicity: every write goes through a temp file + atomic rename. No
+ * inflight reader sees a half-written JSON. Concurrent writers across
+ * processes are NOT coordinated — the last writer wins. Acceptable for
+ * single-developer plugin workloads; not safe under high write contention.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+const DEFAULT_PATH = '.swarm/memory.json';
+function compositeKey(namespace, key) {
+    return `${namespace}::${key}`;
+}
+function nowIso() {
+    return new Date().toISOString();
+}
+export class JsonMemoryBackend {
+    id = 'json';
+    path;
+    cache = null;
+    constructor(opts) {
+        this.path = resolve(opts?.path || process.env.SWARMDO_MEMORY_PATH || DEFAULT_PATH);
+    }
+    load() {
+        if (this.cache)
+            return this.cache;
+        if (!existsSync(this.path)) {
+            const fresh = {
+                version: 1,
+                backend: 'json',
+                entries: {},
+                createdAt: nowIso(),
+                updatedAt: nowIso(),
+            };
+            this.cache = fresh;
+            return fresh;
+        }
+        try {
+            const raw = readFileSync(this.path, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (parsed.version !== 1) {
+                throw new Error(`Unsupported memory file version: ${parsed.version}`);
+            }
+            this.cache = parsed;
+            return parsed;
+        }
+        catch (err) {
+            throw new Error(`memory: failed to load ${this.path}: ${err.message}`);
+        }
+    }
+    save(state) {
+        state.updatedAt = nowIso();
+        this.cache = state;
+        const dir = dirname(this.path);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        const tmp = `${this.path}.tmp.${process.pid}.${Date.now()}`;
+        writeFileSync(tmp, JSON.stringify(state, null, 2), 'utf-8');
+        renameSync(tmp, this.path);
+    }
+    isExpired(entry) {
+        if (!entry.ttlSeconds)
+            return false;
+        const expiresAt = new Date(entry.storedAt).getTime() + entry.ttlSeconds * 1000;
+        return Date.now() > expiresAt;
+    }
+    async store(key, value, opts) {
+        const namespace = opts?.namespace || 'default';
+        const ck = compositeKey(namespace, key);
+        const state = this.load();
+        if (state.entries[ck] && !opts?.upsert) {
+            throw new Error(`memory: UNIQUE constraint failed for namespace='${namespace}' key='${key}' (pass --upsert to overwrite)`);
+        }
+        state.entries[ck] = {
+            key,
+            value,
+            namespace,
+            tags: opts?.tags || [],
+            storedAt: nowIso(),
+            accessCount: 0,
+            lastAccessed: nowIso(),
+            ttlSeconds: opts?.ttl,
+        };
+        this.save(state);
+    }
+    async retrieve(key, opts) {
+        const namespace = opts?.namespace || 'default';
+        const ck = compositeKey(namespace, key);
+        const state = this.load();
+        const entry = state.entries[ck];
+        if (!entry)
+            return null;
+        if (this.isExpired(entry)) {
+            delete state.entries[ck];
+            this.save(state);
+            return null;
+        }
+        entry.accessCount++;
+        entry.lastAccessed = nowIso();
+        this.save(state);
+        return { ...entry };
+    }
+    async search(query, opts) {
+        const namespace = opts?.namespace;
+        const limit = opts?.limit ?? 10;
+        const threshold = opts?.threshold ?? 0;
+        const q = query.toLowerCase();
+        const state = this.load();
+        const out = [];
+        for (const entry of Object.values(state.entries)) {
+            if (this.isExpired(entry))
+                continue;
+            if (namespace && entry.namespace !== namespace)
+                continue;
+            // Simple substring scoring:
+            //   1.0  → exact substring of key OR exact substring of value (string form)
+            //   0.5  → case-insensitive partial (currently the same — kept distinct so
+            //          the heavy backend's similarity scoring can map cleanly)
+            //   0    → no match
+            const haystack = `${entry.key} ${JSON.stringify(entry.value)}`.toLowerCase();
+            let score = 0;
+            if (haystack.includes(q))
+                score = 1.0;
+            if (score < threshold)
+                continue;
+            out.push({ ...entry, score, backend: 'json' });
+        }
+        out.sort((a, b) => b.score - a.score);
+        return out.slice(0, limit);
+    }
+    async list(opts) {
+        const namespace = opts?.namespace;
+        const limit = opts?.limit ?? 100;
+        const tags = opts?.tags;
+        const state = this.load();
+        const out = [];
+        for (const entry of Object.values(state.entries)) {
+            if (this.isExpired(entry))
+                continue;
+            if (namespace && entry.namespace !== namespace)
+                continue;
+            if (tags && tags.length > 0) {
+                const hasAll = tags.every((t) => entry.tags.includes(t));
+                if (!hasAll)
+                    continue;
+            }
+            out.push({ ...entry });
+        }
+        return out.slice(0, limit);
+    }
+    async delete(key, opts) {
+        const namespace = opts?.namespace || 'default';
+        const ck = compositeKey(namespace, key);
+        const state = this.load();
+        if (!state.entries[ck])
+            return false;
+        delete state.entries[ck];
+        this.save(state);
+        return true;
+    }
+    async stats() {
+        const state = this.load();
+        const entries = Object.values(state.entries);
+        const namespaces = [...new Set(entries.map((e) => e.namespace))].sort();
+        const sizeBytes = existsSync(this.path)
+            ? readFileSync(this.path, 'utf-8').length
+            : 0;
+        return {
+            totalEntries: entries.length,
+            namespaces,
+            sizeBytes,
+            backend: this.id,
+        };
+    }
+}
+//# sourceMappingURL=json-backend.js.map

package/vendor/cli-core/dist/src/memory/json-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-backend.js","sourceRoot":"","sources":["../../../src/memory/json-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAW7C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAU1C,SAAS,YAAY,CAAC,SAAiB,EAAE,GAAW;IAClD,OAAO,GAAG,SAAS,KAAK,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,iBAAiB;IACnB,EAAE,GAAG,MAAM,CAAC;IACJ,IAAI,CAAS;IACtB,KAAK,GAAqB,IAAI,CAAC;IAEvC,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,YAAY,CAAC,CAAC;IACrF,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAc;gBACvB,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,MAAM,EAAE;gBACnB,SAAS,EAAE,MAAM,EAAE;aACpB,CAAC;YACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;YACpB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,KAAgB;QAC3B,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5D,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,SAAS,CAAC,KAAkB;QAClC,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QAC/E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAc,EAAE,IAAmB;QAC1D,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC;QAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mDAAmD,SAAS,UAAU,GAAG,gCAAgC,CAAC,CAAC;QAC7H,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG;YAClB,GAAG;YACH,KAAK;YACL,SAAS;YACT,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;YACtB,QAAQ,EAAE,MAAM,EAAE;YAClB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,MAAM,EAAE;YACtB,UAAU,EAAE,IAAI,EAAE,GAAG;SACtB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAA6B;QACvD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC;QAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,WAAW,EAAE,CAAC;QACpB,KAAK,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAAoB;QAC9C,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAyB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YACzD,4BAA4B;YAC5B,4EAA4E;YAC5E,2EAA2E;YAC3E,mEAAmE;YACnE,oBAAoB;YACpB,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7E,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,KAAK,GAAG,GAAG,CAAC;YACtC,IAAI,KAAK,GAAG,SAAS;gBAAE,SAAS;YAChC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAkB;QAC3B,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YACzD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,MAAM;oBAAE,SAAS;YACxB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAA6B;QACrD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC;QAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM;YACzC,CAAC,CAAC,CAAC,CAAC;QACN,OAAO;YACL,YAAY,EAAE,OAAO,CAAC,MAAM;YAC5B,UAAU;YACV,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,EAAE;SACjB,CAAC;IACJ,CAAC;CACF"}