dodo-mcp 1.0.0

package/dist/setup/sandboxProbe.js

@@ -0,0 +1,172 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import net from 'node:net';
+import { randomUUID } from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { DodoError } from '../errors.js';
+import { ensurePrivateDirectory } from '../platform/privateFs.js';
+import { renameWithRetry, removeWithRetry } from '../platform/fsRetry.js';
+import { windowsSystemExecutable } from '../platform/system.js';
+import { signalOwnedProcess } from '../platform/processTree.js';
+import { buildChildEnv } from '../security/env.js';
+import { wrapInSandbox } from '../services/jobs/sandbox.js';
+import { windowsSandboxInvocation, windowsSandboxScratchParent, findWindowsSandbox, sandboxFingerprint, SANDBOX_RECEIPT, SANDBOX_CHECKS } from '../platform/windowsSandbox.js';
+/** Fixed synthetic test. No owner files are discovered or read. */
+const PROBE = String.raw `
+const fs = require('node:fs'), net = require('node:net');
+const spec = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+(async () => {
+  const checks = {};
+  fs.writeFileSync('workspace-write.txt', 'DODO sandbox fixture', { flag: 'wx' });
+  checks['workspace-write'] = fs.readFileSync('workspace-write.txt', 'utf8') === 'DODO sandbox fixture';
+  try { fs.writeFileSync(spec.outside, 'must be denied', { flag: 'wx' }); checks['outside-write-denied'] = false; }
+  catch (e) { checks['outside-write-denied'] = ['EACCES', 'EPERM', 'EROFS'].includes(e.code); }
+  try { fs.readFileSync(spec.owner); checks['owner-read-denied'] = false; }
+  catch (e) { checks['owner-read-denied'] = ['EACCES', 'EPERM'].includes(e.code); }
+  // A live host listener was checked before launching this child. Timeouts
+  // are NOT evidence of confinement; only deterministic OS denial counts.
+  const networkCode = await new Promise(resolve => {
+    const s = net.createConnection({host:'127.0.0.1',port:spec.port});
+    s.setTimeout(4000, () => { s.destroy(); resolve('TIMEOUT'); });
+    s.once('connect', () => { s.destroy(); resolve('CONNECTED'); });
+    s.once('error', e => resolve(e.code));
+  });
+  checks['direct-network-denied'] = (process.platform === 'win32' ? ['EACCES','EPERM'] : ['EACCES','EPERM','ENETUNREACH','ECONNREFUSED']).includes(networkCode);
+  console.log('DODO_SANDBOX_PROBE ' + JSON.stringify({checks,networkCode}));
+  // POSIX adapter explicitly limits writes/network, not reads. Do not
+  // pretend it enforces the stronger Windows owner-profile isolation.
+  const required = process.platform === 'win32' ? Object.values(checks) : Object.entries(checks).filter(([k]) => k !== 'owner-read-denied').map(([,v]) => v);
+  process.exitCode = required.every(Boolean) ? 0 : 1;
+})().catch(() => { process.exitCode = 1; });
+`;
+const ACL_SNAPSHOT = String.raw `
+$ErrorActionPreference='Stop'
+$r=@(); foreach($p in (ConvertFrom-Json $env:DODO_PROBE_PATHS)) {
+  $a=Get-Acl -LiteralPath $p
+  $r+= $a.GetSecurityDescriptorSddlForm([Security.AccessControl.AccessControlSections]::Access)
+}
+ConvertTo-Json -InputObject $r -Compress
+`;
+function aclSnapshot(paths) {
+    if (process.platform !== 'win32')
+        return JSON.stringify(paths.map(p => ({ mode: fs.statSync(p).mode, uid: fs.statSync(p).uid })));
+    const r = spawnSync(windowsSystemExecutable('WindowsPowerShell/v1.0/powershell.exe'), ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(ACL_SNAPSHOT, 'utf16le').toString('base64')], {
+        shell: false, windowsHide: true, encoding: 'utf8', timeout: 15000, maxBuffer: 65536,
+        env: { ...buildChildEnv({ parentEnv: process.env, workspaceRoot: os.tmpdir(), extraAllowlist: [] }), DODO_PROBE_PATHS: JSON.stringify(paths) },
+    });
+    if (r.error || r.status !== 0)
+        throw new Error('sandbox fixture ACL could not be inspected');
+    return JSON.stringify(JSON.parse(r.stdout));
+}
+async function run(program, args, cwd, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(program, args, { cwd, shell: false, windowsHide: true, detached: process.platform !== 'win32', env: buildChildEnv({ parentEnv: process.env, workspaceRoot: cwd, extraAllowlist: [] }), stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '', stderr = '', failure;
+        const stop = () => { try {
+            signalOwnedProcess(child, 'SIGKILL');
+        }
+        catch { /* reject the probe, never retry without confinement */ } };
+        const timer = setTimeout(() => { failure = new Error('sandbox verification timed out'); stop(); }, timeoutMs);
+        child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); if (stdout.length > 65536) {
+            failure = new Error('sandbox probe output exceeded limit');
+            stop();
+        } });
+        child.stderr.on('data', (chunk) => { stderr = (stderr + chunk.toString('utf8')).slice(-8000); });
+        child.once('error', e => { clearTimeout(timer); reject(e); });
+        child.once('close', code => { clearTimeout(timer); if (failure)
+            reject(failure);
+        else
+            resolve({ code, stdout, stderr }); });
+    });
+}
+/** Run the real adapter in disposable directories; a failed probe cannot create a success receipt. */
+export async function verifySandbox(configDir, workspaceRoot = process.cwd()) {
+    ensurePrivateDirectory(configDir);
+    const id = randomUUID();
+    const scratchParent = process.platform === 'win32' ? windowsSandboxScratchParent() : os.tmpdir();
+    const base = fs.realpathSync.native(fs.mkdtempSync(path.join(scratchParent, 'dodo-confinement-')));
+    const outside = process.platform === 'win32'
+        ? fs.realpathSync.native(fs.mkdtempSync(path.join(scratchParent, 'dodo-confinement-outside-')))
+        : path.join(os.homedir(), `.dodo-confinement-${id}`);
+    const owner = path.join(configDir, `sandbox-probe-${id}.txt`);
+    // On Windows the project must be a direct child of a machine-common,
+    // traversable parent. The leaf itself is still owner-private until SRT
+    // applies the temporary allowWrite grant used by the real adapter.
+    const project = process.platform === 'win32' ? base : path.join(base, 'project');
+    ensurePrivateDirectory(project);
+    if (process.platform !== 'win32')
+        fs.mkdirSync(outside, { mode: 0o700 });
+    fs.writeFileSync(owner, 'synthetic DODO fixture; not a credential', { flag: 'wx', mode: 0o600 });
+    const listener = net.createServer(socket => socket.end());
+    let listening = false, success;
+    try {
+        await new Promise((resolve, reject) => { listener.once('error', reject); listener.listen(0, '127.0.0.1', resolve); });
+        listening = true;
+        const address = listener.address();
+        if (!address || typeof address === 'string')
+            throw new Error('probe listener has no address');
+        if (address.port >= 60080 && address.port <= 60089)
+            throw new Error('probe randomly selected a reserved proxy port; rerun setup');
+        // Positive control: the same destination must be reachable without the sandbox.
+        await new Promise((resolve, reject) => {
+            const s = net.createConnection(address.port, '127.0.0.1');
+            s.setTimeout(3000, () => { s.destroy(); reject(new Error('positive network control timed out')); });
+            s.once('error', reject);
+            s.once('connect', () => { s.destroy(); resolve(); });
+        });
+        const script = path.join(project, 'probe.cjs'), spec = path.join(project, 'input.json');
+        fs.writeFileSync(script, PROBE, { flag: 'wx', mode: 0o600 });
+        fs.writeFileSync(spec, JSON.stringify({ owner, outside: path.join(outside, 'forbidden.txt'), port: address.port }), { flag: 'wx', mode: 0o600 });
+        const watched = [project, script, spec, configDir, owner];
+        const before = aclSnapshot(watched);
+        const wrapped = process.platform === 'win32'
+            ? windowsSandboxInvocation(process.execPath, [script, spec], { workspaceRoot: project, ownerStateDir: configDir, allowNetwork: false }, true)
+            : wrapInSandbox(process.execPath, [script, spec], { workspaceRoot: project, ownerStateDir: configDir, writablePaths: [], allowNetwork: false });
+        const result = await run(wrapped.program, wrapped.args, project, 120000);
+        const record = result.stdout.split(/\r?\n/).find(line => line.startsWith('DODO_SANDBOX_PROBE '));
+        if (result.code !== 0 || !record)
+            throw new DodoError('NOT_SUPPORTED', `sandbox confinement probe failed (exit ${result.code}); ${result.stderr.slice(-2000)}`);
+        const parsed = JSON.parse(record.slice('DODO_SANDBOX_PROBE '.length));
+        const required = process.platform === 'win32' ? SANDBOX_CHECKS.filter(c => c !== 'cleanup') : ['workspace-write', 'outside-write-denied', 'direct-network-denied'];
+        if (!required.every(check => parsed.checks[check] === true))
+            throw new Error('sandbox result did not prove every required check');
+        if (fs.existsSync(path.join(outside, 'forbidden.txt')))
+            throw new Error('sandbox allowed an outside write');
+        if (aclSnapshot(watched) !== before)
+            throw new Error('sandbox cleanup did not restore fixture/owner ACLs');
+        success = { platform: process.platform, checkedAt: new Date().toISOString(), checks: [...required, 'cleanup'], networkCode: parsed.networkCode, passed: true };
+    }
+    finally {
+        if (listening)
+            await new Promise(resolve => listener.close(() => resolve()));
+        // Delete only this invocation's synthetic files, never owner state itself.
+        fs.unlinkSync(owner);
+        removeWithRetry(base, true);
+        removeWithRetry(outside, true);
+    }
+    if (!success)
+        throw new Error('sandbox verification produced no result');
+    if (process.platform === 'win32') {
+        const runtime = findWindowsSandbox(workspaceRoot, configDir);
+        if (!runtime)
+            throw new Error('sandbox runtime disappeared after verification');
+        const receipt = { version: 1, runtimeVersion: '0.0.75', fingerprint: sandboxFingerprint(runtime.executable), checks: success.checks, passed: true, checkedAt: success.checkedAt, platform: 'win32' };
+        const target = path.join(configDir, SANDBOX_RECEIPT), temp = `${target}.${id}.tmp`;
+        if (fs.existsSync(target)) {
+            const s = fs.lstatSync(target);
+            if (!s.isFile() || s.isSymbolicLink() || s.nlink !== 1)
+                throw new Error('unsafe sandbox receipt target');
+        }
+        fs.writeFileSync(temp, JSON.stringify(receipt, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+        try {
+            renameWithRetry(temp, target);
+        }
+        finally {
+            if (fs.existsSync(temp))
+                fs.unlinkSync(temp);
+        }
+    }
+    return success;
+}
+//# sourceMappingURL=sandboxProbe.js.map

package/dist/setup/sandboxProbe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxProbe.js","sourceRoot":"","sources":["../../src/setup/sandboxProbe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAE9M,mEAAmE;AACnE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BvB,CAAC;AACF,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;CAO9B,CAAC;AACF,SAAS,WAAW,CAAC,KAAe;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAClI,MAAM,CAAC,GAAG,SAAS,CAAC,uBAAuB,CAAC,uCAAuC,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE;QAC9M,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;QACnF,GAAG,EAAE,EAAE,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KAC/I,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9C,CAAC;AACD,KAAK,UAAU,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW,EAAE,SAAiB;IAChF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChP,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,OAA0B,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAC;QACvI,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9G,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAAC,IAAI,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrL,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,OAAO,CAAC,CAAC;;YAAM,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE;IAClF,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjG,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC9D,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjF,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,0CAA0C,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,IAAI,SAAS,GAAG,KAAK,EAAE,OAAsC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,SAAS,GAAG,IAAI,CAAC;QAC9I,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAClI,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClI,gFAAgF;QAChF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1D,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpG,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACxF,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjJ,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC1C,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC;YAC7I,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,0CAA0C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChK,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAA6D,CAAC;QAClI,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;QACnK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAClI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC5G,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC3G,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjK,CAAC;YAAS,CAAC;QACT,IAAI,SAAS;YAAE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnF,2EAA2E;QAC3E,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9I,MAAM,OAAO,GAA6B,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/N,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG,GAAG,MAAM,IAAI,EAAE,MAAM,CAAC;QACnF,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAAC,CAAC;QACxK,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC;YAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}