jishushell 0.4.2 → 0.4.10

package/dist/utils/fs.js

@@ -0,0 +1,111 @@
+/**
+ * Semantic file-system primitives for JishuShell.
+ *
+ * Every file write in the codebase should go through one of these functions.
+ * The function name describes the *kind* of file being written; the correct
+ * permissions follow from that classification — callers never touch raw mode
+ * numbers.
+ *
+ * Classification:
+ *
+ *   writeConfigFile        0o644  Config / state files (openclaw.json, instance.json, …)
+ *   writeSecretFile        0o600  Cryptographic keys, tokens, hashes (jwt-secret, …)
+ *   writeExecutableFile    0o755  Shell scripts and binary wrappers
+ *   writeSystemTmpFile     0o600  Temp files for privileged hand-off (sudo cp)
+ *
+ *   ensureDirHost          0o755  Host-only directories never bind-mounted into
+ *                   (Linux)       containers (JISHUSHELL_HOME, bin/, nomad/,
+ *                   0o755         packages/).  0o755 on both platforms: Linux
+ *                   (macOS)       Docker daemon (root) bypasses DAC so tighter
+ *                                 modes would only inconvenience the host user;
+ *                                 on macOS, VirtioFS requires the execute bit on
+ *                                 every ancestor of a bind-mount.  The write bit
+ *                                 is withheld from group/other on both platforms,
+ *                                 so containers cannot create files in host dirs.
+ *
+ *   ensureDirContainer     0o755  Directories bind-mounted into Docker containers.
+ *                   (Linux)       Docker Desktop's VirtioFS uses virtiofsd in
+ *                   0o755         passthrough mode: macOS host uid numbers are
+ *                   (macOS)       exposed verbatim inside the Linux VM and the
+ *                                 container, so a process running as --user 502
+ *                                 sees files owned by host uid 502 as "owner".
+ *                                 0o755 therefore suffices on macOS just as on
+ *                                 Linux — the container process hits owner bits,
+ *                                 not "other" bits.  (Confirmed by lima-vm/lima
+ *                                 #4053: Docker Desktop correctly shows uid=501
+ *                                 from host as uid=501 in the container, unlike
+ *                                 Lima's VirtioFS which squashes to root.)
+ */
+import { chmodSync, mkdirSync, writeFileSync } from "fs";
+import { dirname } from "path";
+// ── Directories ────────────────────────────────────────────────────────────
+/**
+ * Create a host-only directory (never bind-mounted into containers).
+ * 0o755 on both Linux and macOS: on Linux the Docker daemon runs as root and
+ * bypasses DAC, so stricter modes only inconvenience the local user; on macOS,
+ * VirtioFS requires the execute bit on every ancestor of a bind-mounted path.
+ * Write is withheld from group/other on both platforms, so containers cannot
+ * create files inside host directories.
+ */
+export function ensureDirHost(path) {
+    mkdirSync(path, { recursive: true, mode: 0o755 });
+    chmodSync(path, 0o755);
+}
+/**
+ * Create a directory bind-mounted into Docker containers.
+ *
+ * Docker Desktop's VirtioFS runs virtiofsd in passthrough mode: the macOS host
+ * uid is exposed verbatim inside the Linux VM, so a container process running
+ * as --user 502 sees bind-mounted files owned by host uid 502 as "owner" and
+ * gets owner-class permission bits.  0o755 (rwxr-xr-x) is therefore sufficient
+ * on macOS, same as on Linux.
+ *
+ * chmodSync is called after mkdirSync so that the mode is applied
+ * unconditionally regardless of the process umask (mkdirSync mode is masked by
+ * umask; chmodSync / chmod(2) is not).  This is safe on already-existing
+ * directories — it only updates the mode bits, it does not fail.
+ */
+export function ensureDirContainer(path) {
+    mkdirSync(path, { recursive: true, mode: 0o755 });
+    chmodSync(path, 0o755);
+}
+// ── Files ──────────────────────────────────────────────────────────────────
+/**
+ * Write a config/state file with 0o644.
+ * Creates parent directories if they do not yet exist, but does NOT chmod an
+ * already-existing parent — the caller owns the directory lifecycle.
+ */
+export function writeConfigFile(path, content) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content, { mode: 0o644 });
+    chmodSync(path, 0o644);
+}
+/**
+ * Write a secret file with 0o600.
+ * Creates parent directories if they do not yet exist, but does NOT chmod an
+ * already-existing parent.
+ */
+export function writeSecretFile(path, content) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/**
+ * Write an executable file (script or binary wrapper) with 0o755.
+ * Creates parent directories if they do not yet exist, but does NOT chmod an
+ * already-existing parent.
+ */
+export function writeExecutableFile(path, content) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content, { mode: 0o755 });
+    chmodSync(path, 0o755);
+}
+/**
+ * Write a temporary file to /tmp with 0o600 for privileged hand-off (sudo cp).
+ * /tmp already exists; no directory creation needed.
+ */
+export function writeSystemTmpFile(path, content) {
+    writeFileSync(path, content, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+//# sourceMappingURL=fs.js.map

package/dist/utils/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAwB;IACpE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAwB;IACpE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IAC/D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC"}

package/dist/utils/safe-json.d.ts

@@ -1,2 +1,4 @@
 export declare function safeReadJson<T = Record<string, any>>(path: string, label: string): T | null;
+export declare function safeReadSecretJson<T = Record<string, any>>(path: string, label: string): T | null;
 export declare function safeWriteJson(path: string, data: any, fsync?: boolean): void;
+export declare function safeWriteSecretJson(path: string, data: any, fsync?: boolean): void;

package/dist/utils/safe-json.js

@@ -1,7 +1,7 @@
-import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, copyFileSync, openSync, fdatasyncSync, closeSync } from "fs";
+import { chmodSync, existsSync, readFileSync, writeFileSync, renameSync, copyFileSync, openSync, fdatasyncSync, closeSync, mkdirSync } from "fs";
 import { dirname } from "path";
 const BACKUP_SUFFIXES = [".bak", ".bak.1", ".bak.2"];
-export function safeReadJson(path, label) {
+function recoverJson(path, label, mode) {
     for (const f of [path, ...BACKUP_SUFFIXES.map(s => path + s)]) {
         if (!existsSync(f))
             continue;
@@ -10,7 +10,8 @@ export function safeReadJson(path, label) {
             if (f !== path) {
                 console.warn(`[${label}] ${path} corrupted, recovered from ${f}`);
                 const tmp = path + ".tmp";
-                writeFileSync(tmp, JSON.stringify(data), { mode: 0o600 });
+                writeFileSync(tmp, JSON.stringify(data), { mode });
+                chmodSync(tmp, mode);
                 renameSync(tmp, path);
             }
             return data;
@@ -21,13 +22,16 @@ export function safeReadJson(path, label) {
     }
     return null;
 }
-// Per-path lock to detect concurrent writes (synchronous re-entrancy guard)
-// Stores start timestamp so stale entries from crashed writes can be detected
+export function safeReadJson(path, label) {
+    return recoverJson(path, label, 0o644);
+}
+export function safeReadSecretJson(path, label) {
+    return recoverJson(path, label, 0o600);
+}
 const _activeWrites = new Map();
-export function safeWriteJson(path, data, fsync = false) {
+function withWriteLock(path, fn) {
     const existing = _activeWrites.get(path);
     if (existing !== undefined) {
-        // If a write has been "active" for over 60s, it's stale from a previous crash
         if (Date.now() - existing > 60_000) {
             _activeWrites.delete(path);
         }
@@ -35,23 +39,21 @@ export function safeWriteJson(path, data, fsync = false) {
             console.warn(`[safe-json] Concurrent write detected for ${path}, serializing`);
         }
     }
-    // In Node.js single-threaded model, synchronous code can't truly interleave,
-    // but this guard catches programming errors where safeWriteJson is called
-    // from within a safeWriteJson callback (re-entrancy).
     _activeWrites.set(path, Date.now());
     try {
-        _safeWriteJsonImpl(path, data, fsync);
+        fn();
     }
     finally {
         _activeWrites.delete(path);
     }
 }
-function _safeWriteJsonImpl(path, data, fsync) {
+function atomicWriteJson(path, data, fsync, mode) {
     mkdirSync(dirname(path), { recursive: true });
     const tmp = path + ".tmp";
     const json = typeof data === "string" ? data : JSON.stringify(data);
-    writeFileSync(tmp, json, { mode: 0o600 });
-    JSON.parse(readFileSync(tmp, "utf-8")); // validate before commit
+    writeFileSync(tmp, json, { mode });
+    chmodSync(tmp, mode);
+    JSON.parse(readFileSync(tmp, "utf-8"));
     if (fsync) {
         try {
             const fd = openSync(tmp, "r");
@@ -60,8 +62,6 @@ function _safeWriteJsonImpl(path, data, fsync) {
         }
         catch { }
     }
-    // Rolling backup: rotate .bak → .bak.1 → .bak.2 (keep 3 versions)
-    // Copy (not rename) so the original stays in place until the atomic rename below.
     if (existsSync(path)) {
         try {
             if (existsSync(path + ".bak.1"))
@@ -77,4 +77,10 @@ function _safeWriteJsonImpl(path, data, fsync) {
     }
     renameSync(tmp, path);
 }
+export function safeWriteJson(path, data, fsync = false) {
+    withWriteLock(path, () => atomicWriteJson(path, data, fsync, 0o644));
+}
+export function safeWriteSecretJson(path, data, fsync = false) {
+    withWriteLock(path, () => atomicWriteJson(path, data, fsync, 0o600));
+}
 //# sourceMappingURL=safe-json.js.map

package/dist/utils/safe-json.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-json.js","sourceRoot":"","sources":["../../src/utils/safe-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACtI,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAErD,MAAM,UAAU,YAAY,CAA0B,IAAY,EAAE,KAAa;IAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,8BAA8B,CAAC,EAAE,CAAC,CAAC;gBAClE,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;gBAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAS,EAAE,KAAK,GAAG,KAAK;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,8EAA8E;QAC9E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC;YACnC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,eAAe,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,sDAAsD;IACtD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,IAAS,EAAE,KAAc;IACjE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpE,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,yBAAyB;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACnF,CAAC;IACD,kEAAkE;IAClE,kFAAkF;IAClF,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC;gBAAE,YAAY,CAAC,IAAI,GAAG,QAAQ,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACjG,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC;gBAAE,YAAY,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAC7F,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"safe-json.js","sourceRoot":"","sources":["../../src/utils/safe-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACjJ,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAErD,SAAS,WAAW,CAAI,IAAY,EAAE,KAAa,EAAE,IAAY;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,8BAA8B,CAAC,EAAE,CAAC,CAAC;gBAClE,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;gBAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACrB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAA0B,IAAY,EAAE,KAAa;IAC/E,OAAO,WAAW,CAAI,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAA0B,IAAY,EAAE,KAAa;IACrF,OAAO,WAAW,CAAI,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,SAAS,aAAa,CAAC,IAAY,EAAE,EAAc;IACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC;YACnC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,eAAe,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,EAAE,EAAE,CAAC;IACP,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAS,EAAE,KAAc,EAAE,IAAY;IAC5E,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpE,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC;gBAAE,YAAY,CAAC,IAAI,GAAG,QAAQ,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACjG,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC;gBAAE,YAAY,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAC7F,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAS,EAAE,KAAK,GAAG,KAAK;IAClE,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAS,EAAE,KAAK,GAAG,KAAK;IACxE,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC"}