@aitne/daemon 0.1.0

package/dist/core/atomic-write.js

@@ -0,0 +1,135 @@
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, renameSync, unlinkSync, writeSync, constants as fsConstants, } from "node:fs";
+import { dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+/**
+ * Symlink-safe atomic file write.
+ *
+ * Closes the TOCTOU race that exists between a path-validation step
+ * (e.g. `safePath` in the Context API) and the actual `writeFileSync`.
+ * Without this, an attacker who can place a symlink at the validated
+ * destination *after* validation but *before* the write would cause
+ * `writeFileSync` to follow the symlink and overwrite an arbitrary file.
+ *
+ * Two layers of defense:
+ *
+ * 1. **`O_NOFOLLOW` + `O_EXCL` on a fresh temp path.** We never open the
+ *    final destination directly. Instead we open a randomly-suffixed temp
+ *    file in the same directory using `O_NOFOLLOW`, which makes `open(2)`
+ *    fail with `ELOOP` if a symlink ever appears at the temp path, and
+ *    `O_EXCL`, which makes `open(2)` fail with `EEXIST` if anything is
+ *    already there. The random suffix ensures an attacker cannot
+ *    pre-place a target.
+ *
+ * 2. **`rename(2)` over the destination.** POSIX `rename` replaces the
+ *    target atomically *without* dereferencing a symlink that may exist
+ *    at the destination — the symlink itself is replaced by the renamed
+ *    file. Combined with the temp-file open above, this means at no
+ *    point does our process write through a symlink.
+ *
+ * The caller is still responsible for validating that the destination is
+ * inside an allowed root (the Context API does this via `safePath`). This
+ * helper only protects the write step.
+ *
+ * Notes:
+ * - `fsync` is called on the temp fd before rename so a power loss between
+ *   write and rename does not leave a half-written file as the canonical
+ *   one. The directory itself is not fsync'd; the existing context-api
+ *   write path does not do this either, and adding it would be a separate
+ *   durability change beyond the scope of the symlink fix.
+ * - The parent directory is created with `mkdirSync({ recursive: true })`
+ *   if missing — the same behavior as the original write paths. After
+ *   creation we `lstat` it to assert it is a regular directory, not a
+ *   symlink. This is defense-in-depth: the caller should already have
+ *   resolved the parent through realpath, but a TOCTOU swap between
+ *   that resolution and our open is still possible in theory.
+ *
+ * Throws on:
+ * - The destination already exists and is a symlink (`EEXIST`-style error
+ *   thrown explicitly so the caller surfaces a clear message rather than
+ *   silently following the link).
+ * - The parent directory is itself a symlink after `mkdirSync`.
+ * - Any underlying I/O failure from `open` / `write` / `rename`.
+ */
+export function writeFileAtomically(fullPath, content) {
+    const dir = dirname(fullPath);
+    mkdirSync(dir, { recursive: true });
+    // Defense-in-depth: refuse if the parent directory itself is a symlink.
+    // Realistic exploits require an attacker who can create symlinks inside
+    // the validated context root — which is not reachable through the
+    // public API surface, but the kernel accepts symlinks at any component
+    // of the path. Asserting this here makes the failure mode loud rather
+    // than silent if the invariant is ever violated.
+    const dirStat = lstatSync(dir);
+    if (dirStat.isSymbolicLink()) {
+        throw Object.assign(new Error(`atomic-write: parent directory is a symlink: ${dir}`), { code: "EATOMIC_PARENT_SYMLINK" });
+    }
+    // Refuse to overwrite a symlink at the final path. lstat is racy on its
+    // own — the actual TOCTOU defense is the rename below — but surfacing
+    // the symlink early gives a clearer error than letting rename quietly
+    // replace an attacker's link.
+    try {
+        const targetStat = lstatSync(fullPath);
+        if (targetStat.isSymbolicLink()) {
+            throw Object.assign(new Error(`atomic-write: refusing to overwrite symlink: ${fullPath}`), { code: "EATOMIC_TARGET_SYMLINK" });
+        }
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "EATOMIC_TARGET_SYMLINK")
+            throw err;
+        /* c8 ignore start — non-ENOENT errors (EACCES, EIO) are platform-rare;
+           the rethrow is a defensive guard, not a tested path. */
+        if (code !== "ENOENT")
+            throw err;
+        /* c8 ignore stop */
+        // ENOENT is expected when the file does not exist yet.
+    }
+    // Random suffix prevents an attacker from pre-placing a symlink at our
+    // temp path even if they can guess the pid. 16 hex chars = 64 bits of
+    // entropy, more than enough for collision avoidance.
+    const tempPath = `${fullPath}.tmp.${process.pid}.${randomBytes(8).toString("hex")}`;
+    const flags = fsConstants.O_WRONLY |
+        fsConstants.O_CREAT |
+        fsConstants.O_EXCL |
+        fsConstants.O_NOFOLLOW;
+    const fd = openSync(tempPath, flags, 0o644);
+    try {
+        const buf = Buffer.from(content, "utf-8");
+        let offset = 0;
+        while (offset < buf.length) {
+            offset += writeSync(fd, buf, offset, buf.length - offset);
+        }
+        fsyncSync(fd);
+    }
+    catch (err) {
+        try {
+            closeSync(fd);
+        }
+        catch {
+            // If close fails after a write/fsync error, the original error is
+            // more informative. Swallow the secondary failure.
+        }
+        try {
+            unlinkSync(tempPath);
+        }
+        catch {
+            // Best-effort cleanup. If unlink fails the temp file will be
+            // garbage-collected by the next retention sweep or restart.
+        }
+        throw err;
+    }
+    closeSync(fd);
+    try {
+        renameSync(tempPath, fullPath);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tempPath);
+        }
+        catch {
+            // Same rationale as the unlink above: best-effort.
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=atomic-write.js.map

package/dist/core/atomic-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../../src/core/atomic-write.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,UAAU,EACV,UAAU,EACV,SAAS,EACT,SAAS,IAAI,WAAW,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,wEAAwE;IACxE,wEAAwE;IACxE,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,gDAAgD,GAAG,EAAE,CAAC,EAChE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CACnC,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,EACrE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,wBAAwB;YAAE,MAAM,GAAG,CAAC;QACjD;kEAC0D;QAC1D,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QACjC,oBAAoB;QACpB,uDAAuD;IACzD,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,QAAQ,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,MAAM,KAAK,GACT,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,OAAO;QACnB,WAAW,CAAC,MAAM;QAClB,WAAW,CAAC,UAAU,CAAC;IAEzB,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAC5D,CAAC;QACD,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,mDAAmD;QACrD,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,4DAA4D;QAC9D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAC;IAEd,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/core/backends/api-key-probe.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Server-side API key verification via provider model-listing endpoints.
+ *
+ * Replaces the format-only check in each backend's `checkAuthDetailed()` API
+ * key branch with a real HTTP call to the provider. The response tells us
+ * whether the key is valid (`ok`), revoked/invalid (`unauthorized`), or
+ * unreachable (`network_error`).
+ *
+ * **Design constraints** (roadmap §9.1):
+ *  - 5 s timeout per request (`AbortSignal.timeout`).
+ *  - Branded User-Agent on every request (Anthropic rate-limits empty UA —
+ *    observed in Phase 0 §0-3). Brand tracks APP_NAME for rebrand cleanliness.
+ *  - The API key MUST NOT appear in any log output. Callers that log the
+ *    returned `detail` must run it through `redactSensitiveString` first
+ *    (enforced by the existing `writeAuth*Detail` wrappers).
+ *  - Network errors (DNS failure, timeout, ECONNRESET) throw so that
+ *    `checkAll()` catches them and records `probe_network_error` telemetry
+ *    without flipping the DB cache.
+ */
+export type ApiKeyProbeResult = {
+    ok: boolean;
+    /** Human-readable detail for DB `auth_detail`. */
+    detail: string;
+};
+export type ApiKeyProvider = "anthropic" | "openai" | "google";
+/**
+ * Probe a provider's models endpoint to verify whether an API key is valid.
+ *
+ * - **200** → `{ ok: true, detail: "Server-verified at HH:MM UTC" }`
+ * - **401 / 403** → `{ ok: false, detail: "API key rejected by <provider> (HTTP <code>)" }`
+ * - **Other HTTP status** → `{ ok: false, detail: "Unexpected HTTP <code> …" }`
+ * - **Network / timeout** → throws (caller should catch and record `probe_network_error`)
+ *
+ * The function intentionally throws on network errors so that
+ * `AuthHealthMonitor.checkAll()` can distinguish "key is revoked" (a result)
+ * from "network is down" (an exception). The latter must NOT flip the DB
+ * cache to `expired`.
+ */
+export declare function probeApiKeyServerSide(provider: ApiKeyProvider, apiKey: string): Promise<ApiKeyProbeResult>;
+//# sourceMappingURL=api-key-probe.d.ts.map

package/dist/core/backends/api-key-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-probe.d.ts","sourceRoot":"","sources":["../../../src/core/backends/api-key-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAsD/D;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAiD5B"}

package/dist/core/backends/api-key-probe.js

@@ -0,0 +1,116 @@
+/**
+ * Server-side API key verification via provider model-listing endpoints.
+ *
+ * Replaces the format-only check in each backend's `checkAuthDetailed()` API
+ * key branch with a real HTTP call to the provider. The response tells us
+ * whether the key is valid (`ok`), revoked/invalid (`unauthorized`), or
+ * unreachable (`network_error`).
+ *
+ * **Design constraints** (roadmap §9.1):
+ *  - 5 s timeout per request (`AbortSignal.timeout`).
+ *  - Branded User-Agent on every request (Anthropic rate-limits empty UA —
+ *    observed in Phase 0 §0-3). Brand tracks APP_NAME for rebrand cleanliness.
+ *  - The API key MUST NOT appear in any log output. Callers that log the
+ *    returned `detail` must run it through `redactSensitiveString` first
+ *    (enforced by the existing `writeAuth*Detail` wrappers).
+ *  - Network errors (DNS failure, timeout, ECONNRESET) throw so that
+ *    `checkAll()` catches them and records `probe_network_error` telemetry
+ *    without flipping the DB cache.
+ */
+import { APP_NAME } from "@aitne/shared";
+// ---------------------------------------------------------------------------
+// Per-provider endpoint config
+// ---------------------------------------------------------------------------
+const PROBE_TIMEOUT_MS = 5_000;
+// Lowercase, daemon-suffix form for HTTP User-Agent. The brand part is taken
+// from APP_NAME so a rebrand surfaces in provider-side telemetry too. Spaces
+// in APP_NAME are stripped (HTTP UA convention is single-token).
+const USER_AGENT = `${APP_NAME.toLowerCase().replace(/\s+/g, "-")}-daemon/1.0`;
+const PROVIDER_CONFIG = {
+    anthropic: {
+        url: () => "https://api.anthropic.com/v1/models",
+        headers: (key) => ({
+            "x-api-key": key,
+            "anthropic-version": "2023-06-01",
+            "User-Agent": USER_AGENT,
+        }),
+        label: "Anthropic",
+    },
+    openai: {
+        url: () => "https://api.openai.com/v1/models",
+        headers: (key) => ({
+            Authorization: `Bearer ${key}`,
+            "User-Agent": USER_AGENT,
+        }),
+        label: "OpenAI",
+    },
+    google: {
+        // Google puts the key in the query string, not a header.
+        url: (key) => `https://generativelanguage.googleapis.com/v1beta/models?key=${key}`,
+        headers: () => ({
+            "User-Agent": USER_AGENT,
+        }),
+        label: "Google AI",
+    },
+};
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Probe a provider's models endpoint to verify whether an API key is valid.
+ *
+ * - **200** → `{ ok: true, detail: "Server-verified at HH:MM UTC" }`
+ * - **401 / 403** → `{ ok: false, detail: "API key rejected by <provider> (HTTP <code>)" }`
+ * - **Other HTTP status** → `{ ok: false, detail: "Unexpected HTTP <code> …" }`
+ * - **Network / timeout** → throws (caller should catch and record `probe_network_error`)
+ *
+ * The function intentionally throws on network errors so that
+ * `AuthHealthMonitor.checkAll()` can distinguish "key is revoked" (a result)
+ * from "network is down" (an exception). The latter must NOT flip the DB
+ * cache to `expired`.
+ */
+export async function probeApiKeyServerSide(provider, apiKey) {
+    const config = PROVIDER_CONFIG[provider];
+    const url = config.url(apiKey);
+    const headers = config.headers(apiKey);
+    // Wrap fetch in try/catch to sanitize error messages. Two leak vectors:
+    //  1. Google puts the API key in the query string — Node's native fetch
+    //     may include the full URL in `err.cause`.
+    //  2. Some fetch implementations embed the URL in `err.message` itself
+    //     (e.g. "Failed to fetch https://...?key=AIza...").
+    // Re-throwing a new Error strips the cause chain, and `sanitizeMessage`
+    // replaces any literal occurrence of the key in the message text.
+    let response;
+    try {
+        response = await fetch(url, {
+            method: "GET",
+            headers,
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        const raw = err instanceof Error ? err.message : "unknown network error";
+        const safe = raw.replaceAll(apiKey, "[REDACTED]");
+        throw new Error(`${config.label} probe failed: ${safe}`);
+    }
+    // Drain the response body so undici can reuse the TCP socket. The
+    // /v1/models payload can be several KB; leaving it unconsumed pins the
+    // connection until GC or the AbortSignal fires.
+    response.body?.cancel();
+    if (response.ok) {
+        const hhmm = new Date().toISOString().slice(11, 16); // "HH:MM"
+        return { ok: true, detail: `Server-verified at ${hhmm} UTC` };
+    }
+    if (response.status === 401 || response.status === 403) {
+        return {
+            ok: false,
+            detail: `API key rejected by ${config.label} (HTTP ${response.status})`,
+        };
+    }
+    // Unexpected status (429 rate-limit, 500 server error, etc.). Treat as
+    // transient — don't flip the cache, but return a non-ok result so the
+    // caller can decide. We throw here to match the "network_error" contract:
+    // any non-definitive failure should leave the DB cache untouched.
+    throw new Error(`${config.label} probe returned unexpected HTTP ${response.status}`);
+}
+//# sourceMappingURL=api-key-probe.js.map

package/dist/core/backends/api-key-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-probe.js","sourceRoot":"","sources":["../../../src/core/backends/api-key-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAczC,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,6EAA6E;AAC7E,6EAA6E;AAC7E,iEAAiE;AACjE,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC;AAW/E,MAAM,eAAe,GAAgD;IACnE,SAAS,EAAE;QACT,GAAG,EAAE,GAAG,EAAE,CAAC,qCAAqC;QAChD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACjB,WAAW,EAAE,GAAG;YAChB,mBAAmB,EAAE,YAAY;YACjC,YAAY,EAAE,UAAU;SACzB,CAAC;QACF,KAAK,EAAE,WAAW;KACnB;IACD,MAAM,EAAE;QACN,GAAG,EAAE,GAAG,EAAE,CAAC,kCAAkC;QAC7C,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACjB,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,YAAY,EAAE,UAAU;SACzB,CAAC;QACF,KAAK,EAAE,QAAQ;KAChB;IACD,MAAM,EAAE;QACN,yDAAyD;QACzD,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CACX,+DAA+D,GAAG,EAAE;QACtE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,YAAY,EAAE,UAAU;SACzB,CAAC;QACF,KAAK,EAAE,WAAW;KACnB;CACF,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAwB,EACxB,MAAc;IAEd,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC,wEAAwE;IACxE,wEAAwE;IACxE,+CAA+C;IAC/C,uEAAuE;IACvE,wDAAwD;IACxD,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACzE,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,kEAAkE;IAClE,uEAAuE;IACvE,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAExB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU;QAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,IAAI,MAAM,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAM,GAAG;SACxE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,CAAC,KAAK,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CACpE,CAAC;AACJ,CAAC"}