@cleocode/core 2.0.0

package/src/security/input-sanitization.ts

@@ -0,0 +1,437 @@
+/**
+ * Security Hardening and Input Sanitization (Core)
+ *
+ * Canonical location for input sanitization and security validation.
+ * Self-contained with no dispatch or MCP dependencies.
+ *
+ * Canonical location: src/core/security/input-sanitization.ts
+ * Re-exported from: src/dispatch/lib/security.ts (backward compat)
+ *
+ * @task T3144
+ * @task T5706
+ * @epic T3125
+ */
+
+import { isAbsolute, normalize, relative, resolve } from 'path';
+import {
+  LIFECYCLE_STAGE_STATUSES,
+  MANIFEST_STATUSES,
+  SESSION_STATUSES,
+  TASK_STATUSES,
+} from '@cleocode/contracts';
+import { TASK_PRIORITIES } from '../store/tasks-schema.js';
+import { normalizeTaskId } from '../tasks/id-generator.js';
+
+/**
+ * Security validation error thrown when input fails sanitization
+ */
+export class SecurityError extends Error {
+  constructor(
+    message: string,
+    public code: string = 'E_SECURITY_VIOLATION',
+    public field?: string,
+  ) {
+    super(message);
+    this.name = 'SecurityError';
+  }
+}
+
+/**
+ * Maximum task ID numeric value (prevent absurdly large IDs)
+ */
+const MAX_TASK_ID_NUMBER = 999999;
+
+/**
+ * Control character pattern (C0 and C1 control chars, excluding newline/tab/cr)
+ */
+const CONTROL_CHAR_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F]/g;
+
+/**
+ * Default maximum content length (64KB)
+ */
+const DEFAULT_MAX_CONTENT_LENGTH = 64 * 1024;
+
+/**
+ * Sanitize and validate a task ID
+ */
+export function sanitizeTaskId(value: unknown): string {
+  if (typeof value !== 'string') {
+    throw new SecurityError('Task ID must be a string', 'E_INVALID_TASK_ID', 'taskId');
+  }
+
+  const normalized = normalizeTaskId(value);
+  if (normalized === null) {
+    throw new SecurityError(`Invalid task ID format: ${value}`, 'E_INVALID_TASK_ID', 'taskId');
+  }
+
+  const numericPart = parseInt(normalized.slice(1), 10);
+  if (numericPart > MAX_TASK_ID_NUMBER) {
+    throw new SecurityError(
+      `Task ID exceeds maximum value: ${value}`,
+      'E_INVALID_TASK_ID',
+      'taskId',
+    );
+  }
+
+  return normalized;
+}
+
+/**
+ * Sanitize and validate a file path
+ */
+export function sanitizePath(path: string, projectRoot: string): string {
+  if (typeof path !== 'string') {
+    throw new SecurityError('Path must be a string', 'E_INVALID_PATH', 'path');
+  }
+
+  if (typeof projectRoot !== 'string' || projectRoot.length === 0) {
+    throw new SecurityError(
+      'Project root must be a non-empty string',
+      'E_INVALID_PATH',
+      'projectRoot',
+    );
+  }
+
+  const trimmedPath = path.trim();
+
+  if (trimmedPath.length === 0) {
+    throw new SecurityError('Path cannot be empty', 'E_INVALID_PATH', 'path');
+  }
+
+  if (trimmedPath.includes('\0')) {
+    throw new SecurityError('Path contains null bytes', 'E_PATH_TRAVERSAL', 'path');
+  }
+
+  const normalizedRoot = resolve(projectRoot);
+
+  let resolvedPath: string;
+  if (isAbsolute(trimmedPath)) {
+    resolvedPath = normalize(trimmedPath);
+  } else {
+    resolvedPath = resolve(normalizedRoot, trimmedPath);
+  }
+
+  const relativePath = relative(normalizedRoot, resolvedPath);
+
+  if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
+    throw new SecurityError(
+      `Path traversal detected: "${path}" resolves outside project root`,
+      'E_PATH_TRAVERSAL',
+      'path',
+    );
+  }
+
+  return resolvedPath;
+}
+
+/**
+ * Sanitize content string
+ */
+export function sanitizeContent(
+  content: string,
+  maxLength: number = DEFAULT_MAX_CONTENT_LENGTH,
+): string {
+  if (typeof content !== 'string') {
+    throw new SecurityError('Content must be a string', 'E_INVALID_CONTENT', 'content');
+  }
+
+  if (content.length > maxLength) {
+    throw new SecurityError(
+      `Content exceeds maximum length (${maxLength} characters): got ${content.length}`,
+      'E_CONTENT_TOO_LARGE',
+      'content',
+    );
+  }
+
+  return content.replace(CONTROL_CHAR_PATTERN, '');
+}
+
+/**
+ * Validate that a value is in an allowed enum set
+ */
+export function validateEnum(value: string, allowed: string[], fieldName: string): string {
+  if (typeof value !== 'string') {
+    throw new SecurityError(`${fieldName} must be a string`, 'E_INVALID_ENUM', fieldName);
+  }
+
+  const trimmed = value.trim();
+
+  if (!allowed.includes(trimmed)) {
+    throw new SecurityError(
+      `Invalid ${fieldName}: "${trimmed}". Allowed values: ${allowed.join(', ')}`,
+      'E_INVALID_ENUM',
+      fieldName,
+    );
+  }
+
+  return trimmed;
+}
+
+/**
+ * Known enum values for CLEO domains
+ */
+export const VALID_DOMAINS = [
+  'tasks',
+  'session',
+  'orchestrate',
+  'research',
+  'lifecycle',
+  'validate',
+  'release',
+  'system',
+] as const;
+
+export const VALID_GATEWAYS = ['query', 'mutate'] as const;
+
+export const VALID_MANIFEST_STATUSES = MANIFEST_STATUSES;
+
+export const VALID_LIFECYCLE_STAGE_STATUSES = LIFECYCLE_STAGE_STATUSES;
+
+export const ALL_VALID_STATUSES = [...TASK_STATUSES, ...MANIFEST_STATUSES] as const;
+
+export const VALID_PRIORITIES = TASK_PRIORITIES;
+
+/**
+ * Rate limiter configuration
+ */
+export interface RateLimitConfig {
+  maxRequests: number;
+  windowMs: number;
+}
+
+/**
+ * Rate limit check result
+ */
+export interface RateLimitResult {
+  allowed: boolean;
+  remaining: number;
+  resetMs: number;
+  limit: number;
+}
+
+/**
+ * Default rate limit configurations per operation type
+ */
+export const DEFAULT_RATE_LIMITS: Record<string, RateLimitConfig> = {
+  query: { maxRequests: 100, windowMs: 60_000 },
+  mutate: { maxRequests: 30, windowMs: 60_000 },
+  spawn: { maxRequests: 10, windowMs: 60_000 },
+};
+
+/**
+ * In-memory sliding window rate limiter
+ */
+export class RateLimiter {
+  private windows: Map<string, number[]> = new Map();
+  private configs: Map<string, RateLimitConfig> = new Map();
+
+  constructor(configs?: Record<string, RateLimitConfig>) {
+    const effectiveConfigs = configs ?? DEFAULT_RATE_LIMITS;
+    for (const [key, config] of Object.entries(effectiveConfigs)) {
+      this.configs.set(key, config);
+    }
+  }
+
+  check(key: string): RateLimitResult {
+    const config = this.configs.get(key);
+    if (!config) {
+      return { allowed: true, remaining: Infinity, resetMs: 0, limit: Infinity };
+    }
+
+    const now = Date.now();
+    const windowStart = now - config.windowMs;
+
+    let timestamps = this.windows.get(key);
+    if (!timestamps) {
+      timestamps = [];
+      this.windows.set(key, timestamps);
+    }
+
+    const validTimestamps = timestamps.filter((t) => t > windowStart);
+    this.windows.set(key, validTimestamps);
+
+    const remaining = Math.max(0, config.maxRequests - validTimestamps.length);
+    const oldestInWindow = validTimestamps.length > 0 ? validTimestamps[0] : now;
+    const resetMs = Math.max(0, oldestInWindow + config.windowMs - now);
+
+    return {
+      allowed: validTimestamps.length < config.maxRequests,
+      remaining,
+      resetMs,
+      limit: config.maxRequests,
+    };
+  }
+
+  record(key: string): void {
+    const timestamps = this.windows.get(key) ?? [];
+    timestamps.push(Date.now());
+    this.windows.set(key, timestamps);
+  }
+
+  consume(key: string): RateLimitResult {
+    const result = this.check(key);
+    if (result.allowed) {
+      this.record(key);
+      result.remaining = Math.max(0, result.remaining - 1);
+    }
+    return result;
+  }
+
+  reset(key?: string): void {
+    if (key) {
+      this.windows.delete(key);
+    } else {
+      this.windows.clear();
+    }
+  }
+
+  getConfig(key: string): RateLimitConfig | undefined {
+    return this.configs.get(key);
+  }
+
+  setConfig(key: string, config: RateLimitConfig): void {
+    this.configs.set(key, config);
+  }
+}
+
+/**
+ * Parameters that expect array values.
+ * MCP clients may send comma-separated strings instead of arrays.
+ */
+const ARRAY_PARAMS = new Set([
+  'labels',
+  'addLabels',
+  'removeLabels',
+  'depends',
+  'addDepends',
+  'removeDepends',
+  'files',
+  'acceptance',
+  'findings',
+  'sources',
+  'tasks',
+  'removeTasks',
+  'taskIds',
+]);
+
+/**
+ * Normalize a value to an array of strings.
+ * Handles MCP clients sending comma-separated strings where arrays are expected.
+ */
+export function ensureArray(value: unknown, separator = ','): string[] | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (Array.isArray(value)) return value.map((v) => (typeof v === 'string' ? v.trim() : String(v)));
+  if (typeof value === 'string')
+    return value
+      .split(separator)
+      .map((s) => s.trim())
+      .filter(Boolean);
+  return [String(value)];
+}
+
+/**
+ * Sanitize all params in a request before routing
+ */
+export function sanitizeParams(
+  params: Record<string, unknown> | undefined,
+  projectRoot?: string,
+  context?: { domain?: string; operation?: string },
+): Record<string, unknown> | undefined {
+  if (!params) {
+    return params;
+  }
+
+  const sanitized: Record<string, unknown> = { ...params };
+
+  for (const [key, value] of Object.entries(sanitized)) {
+    if (value === undefined || value === null) {
+      continue;
+    }
+
+    if (
+      typeof value === 'string' &&
+      (key === 'taskId' ||
+        key === 'parent' ||
+        key === 'epicId' ||
+        key === 'parentId' ||
+        key === 'newParentId' ||
+        key === 'relatedId' ||
+        key === 'targetId')
+    ) {
+      if (key === 'parent' && value === '') {
+        continue;
+      }
+      sanitized[key] = sanitizeTaskId(value);
+      continue;
+    }
+
+    if (
+      (key === 'depends' || key === 'addDepends' || key === 'removeDepends') &&
+      Array.isArray(value)
+    ) {
+      sanitized[key] = value.map((v) => {
+        if (typeof v === 'string') {
+          return sanitizeTaskId(v);
+        }
+        return v;
+      });
+      continue;
+    }
+
+    if (typeof value === 'string' && (key === 'path' || key === 'file') && projectRoot) {
+      sanitized[key] = sanitizePath(value, projectRoot);
+      continue;
+    }
+
+    if (
+      typeof value === 'string' &&
+      (key === 'title' || key === 'description' || key === 'content')
+    ) {
+      const maxLen = key === 'title' ? 200 : DEFAULT_MAX_CONTENT_LENGTH;
+      sanitized[key] = sanitizeContent(value, maxLen);
+      continue;
+    }
+
+    if (key === 'notes') {
+      if (typeof value === 'string') {
+        sanitized[key] = sanitizeContent(value);
+      } else if (Array.isArray(value)) {
+        sanitized[key] = value.map((v) => (typeof v === 'string' ? sanitizeContent(v) : v));
+      }
+      continue;
+    }
+
+    if (typeof value === 'string' && key === 'status') {
+      const isLifecycleStageStatus =
+        context?.domain === 'pipeline' && context?.operation === 'stage.record';
+      const isAdrStatus = context?.domain === 'admin' && context?.operation?.startsWith('adr.');
+      const isSessionStatus = context?.domain === 'session';
+
+      sanitized[key] = validateEnum(
+        value,
+        isLifecycleStageStatus
+          ? [...LIFECYCLE_STAGE_STATUSES]
+          : isAdrStatus
+            ? ['proposed', 'accepted', 'superseded', 'deprecated']
+            : isSessionStatus
+              ? [...SESSION_STATUSES]
+              : [...TASK_STATUSES, ...MANIFEST_STATUSES],
+        'status',
+      );
+      continue;
+    }
+
+    if (typeof value === 'string' && key === 'priority') {
+      sanitized[key] = validateEnum(value, [...VALID_PRIORITIES], 'priority');
+    }
+  }
+
+  // Normalize array parameters (MCP clients may send comma-separated strings)
+  for (const key of Object.keys(sanitized)) {
+    if (ARRAY_PARAMS.has(key) && sanitized[key] !== undefined) {
+      sanitized[key] = ensureArray(sanitized[key]);
+    }
+  }
+
+  return sanitized;
+}

package/src/sequence/__tests__/allocate.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Tests for atomic task ID allocation (allocateNextTaskId).
+ * @task T5184
+ */
+export {};
+//# sourceMappingURL=allocate.test.d.ts.map

package/src/sequence/__tests__/allocate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allocate.test.d.ts","sourceRoot":"","sources":["allocate.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/src/sequence/__tests__/allocate.test.js

@@ -0,0 +1,113 @@
+/**
+ * Tests for atomic task ID allocation (allocateNextTaskId).
+ * @task T5184
+ */
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { getDb, getNativeDb, resetDbState } from '../../store/sqlite.js';
+import { allocateNextTaskId, showSequence } from '../index.js';
+describe('allocateNextTaskId', () => {
+    let tempDir;
+    beforeEach(async () => {
+        // Reset any existing DB singleton
+        resetDbState();
+        tempDir = await mkdtemp(join(tmpdir(), 'cleo-alloc-test-'));
+        await mkdir(join(tempDir, '.cleo'), { recursive: true });
+        // Initialize DB by calling getDb — this creates schema, seeds sequence counter
+        await getDb(tempDir);
+    });
+    afterEach(async () => {
+        resetDbState();
+        await rm(tempDir, { recursive: true, force: true });
+    });
+    it('returns T001 on fresh database', async () => {
+        const id = await allocateNextTaskId(tempDir);
+        expect(id).toBe('T001');
+    });
+    it('returns sequential IDs on multiple calls', async () => {
+        const id1 = await allocateNextTaskId(tempDir);
+        const id2 = await allocateNextTaskId(tempDir);
+        const id3 = await allocateNextTaskId(tempDir);
+        expect(id1).toBe('T001');
+        expect(id2).toBe('T002');
+        expect(id3).toBe('T003');
+    });
+    it('persists counter in sequence state', async () => {
+        await allocateNextTaskId(tempDir);
+        await allocateNextTaskId(tempDir);
+        await allocateNextTaskId(tempDir);
+        // The sequence counter should now be 3
+        const seq = await showSequence(tempDir);
+        expect(seq.counter).toBe(3);
+        expect(seq.lastId).toBe('T003');
+    });
+    it('self-repairs when counter is behind actual data', async () => {
+        const nativeDb = getNativeDb();
+        // Manually insert a task with ID T010 to simulate stale counter
+        nativeDb
+            .prepare(`INSERT INTO tasks (id, title, status, priority, created_at) VALUES (?, ?, 'pending', 'medium', datetime('now'))`)
+            .run('T010', 'Existing task');
+        // Counter is at 0 (seed), so allocateNextTaskId will try T001 first,
+        // which doesn't collide. It should return T001 since T001 doesn't exist.
+        const id = await allocateNextTaskId(tempDir);
+        expect(id).toBe('T001');
+    });
+    it('self-repairs when counter produces a collision', async () => {
+        const nativeDb = getNativeDb();
+        // Set counter to 5
+        nativeDb
+            .prepare(`
+      UPDATE schema_meta
+      SET value = json_set(value, '$.counter', 5, '$.lastId', 'T005')
+      WHERE key = 'task_id_sequence'
+    `)
+            .run();
+        // Insert T006 to cause a collision on next allocation
+        nativeDb
+            .prepare(`INSERT INTO tasks (id, title, status, priority, created_at) VALUES (?, ?, 'pending', 'medium', datetime('now'))`)
+            .run('T006', 'Blocking task');
+        // Should detect collision on T006, repair, and return T007
+        const id = await allocateNextTaskId(tempDir);
+        expect(id).toBe('T007');
+    });
+    it('handles rapid sequential allocation of 100 IDs', async () => {
+        const ids = new Set();
+        for (let i = 0; i < 100; i++) {
+            const id = await allocateNextTaskId(tempDir);
+            ids.add(id);
+        }
+        // All 100 IDs should be unique
+        expect(ids.size).toBe(100);
+        // Should be T001 through T100
+        expect(ids.has('T001')).toBe(true);
+        expect(ids.has('T100')).toBe(true);
+    });
+    it('re-initializes DB if singleton was reset', async () => {
+        // Even after resetDbState(), allocateNextTaskId should work because
+        // it calls getDb() which re-initializes the singleton
+        resetDbState();
+        const id = await allocateNextTaskId(tempDir);
+        expect(id).toBe('T001');
+    });
+    it('pads IDs to at least 3 digits', async () => {
+        const id = await allocateNextTaskId(tempDir);
+        expect(id).toBe('T001');
+        expect(id).toMatch(/^T\d{3,}$/);
+    });
+    it('does not pad beyond necessary digits', async () => {
+        const nativeDb = getNativeDb();
+        // Set counter to 999
+        nativeDb
+            .prepare(`
+      UPDATE schema_meta
+      SET value = json_set(value, '$.counter', 999, '$.lastId', 'T999')
+      WHERE key = 'task_id_sequence'
+    `)
+            .run();
+        const id = await allocateNextTaskId(tempDir);
+        expect(id).toBe('T1000');
+    });
+});
+//# sourceMappingURL=allocate.test.js.map

package/src/sequence/__tests__/allocate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allocate.test.js","sourceRoot":"","sources":["allocate.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,kCAAkC;QAClC,YAAY,EAAE,CAAC;QACf,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,+EAA+E;QAC/E,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAElC,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,WAAW,EAAG,CAAC;QAEhC,gEAAgE;QAChE,QAAQ;aACL,OAAO,CACN,iHAAiH,CAClH;aACA,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAEhC,qEAAqE;QACrE,yEAAyE;QACzE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,QAAQ,GAAG,WAAW,EAAG,CAAC;QAEhC,mBAAmB;QACnB,QAAQ;aACL,OAAO,CAAC;;;;KAIV,CAAC;aACC,GAAG,EAAE,CAAC;QAET,sDAAsD;QACtD,QAAQ;aACL,OAAO,CACN,iHAAiH,CAClH;aACA,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAEhC,2DAA2D;QAC3D,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC7C,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,+BAA+B;QAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE3B,8BAA8B;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,oEAAoE;QACpE,sDAAsD;QACtD,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAG,CAAC;QAEhC,qBAAqB;QACrB,QAAQ;aACL,OAAO,CAAC;;;;KAIV,CAAC;aACC,GAAG,EAAE,CAAC;QAET,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}