dodo-mcp 1.0.0

package/dist/platform/speech.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"speech.js","sourceRoot":"","sources":["../../src/platform/speech.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAKtD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;CAqB9C,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEzK,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzL,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACtH,CAAC;QAAC,MAAM,CAAC,CAAC,8DAA8D,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACtH,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAoB,EAAE,KAAa,EAAE,MAAc,EAAE,KAAc;IACpG,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC;IACjJ,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;QAC7F,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAC9D,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,KAAK,GAAG,KAAK,EAAE,OAA0B,CAAC;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;YAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,2DAA2D;QAClF,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzI,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,KAAK;gBAAE,OAAO;YACvC,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC;iBACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,SAAS,CAAC,eAAe,EAAE,+DAA+D,CAAC,CAAC,CAAC;;gBACxH,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;AACtN,CAAC"}

package/dist/platform/system.js

@@ -0,0 +1,28 @@
+import path from 'node:path';
+import { DodoError } from '../errors.js';
+export function envValue(env, name, platform = process.platform) {
+    if (platform !== 'win32')
+        return env[name];
+    const key = Object.keys(env).sort().find(k => k.toUpperCase() === name.toUpperCase());
+    return key === undefined ? undefined : env[key];
+}
+/** Recover the machine-common data path even under an older sanitized parent. */
+export function windowsProgramDataDirectory(env = process.env) {
+    const explicit = envValue(env, 'ProgramData', 'win32');
+    if (explicit && /^[a-z]:[\\/]/i.test(explicit) && !/[\u0000-\u001f]/u.test(explicit))
+        return path.win32.normalize(explicit);
+    const configuredDrive = envValue(env, 'SystemDrive', 'win32');
+    const root = envValue(env, 'SystemRoot', 'win32') ?? envValue(env, 'windir', 'win32');
+    const drive = configuredDrive && /^[a-z]:$/i.test(configuredDrive)
+        ? configuredDrive
+        : root && /^[a-z]:[\\/]/i.test(root) ? path.win32.parse(root).root.slice(0, 2) : undefined;
+    return drive ? `${drive}\\ProgramData` : undefined;
+}
+/** OS utilities never resolve through cwd, PATH, or repository COMSPEC. */
+export function windowsSystemExecutable(name, env = process.env) {
+    const root = envValue(env, 'SystemRoot', 'win32') ?? envValue(env, 'windir', 'win32');
+    if (!root || !/^[a-z]:[\\/]/i.test(root) || /[\u0000-\u001f]/u.test(root))
+        throw new DodoError('NOT_SUPPORTED', 'a valid Windows SystemRoot is required; no cwd/PATH fallback is allowed');
+    return path.win32.join(root, 'System32', ...name.split('/'));
+}
+//# sourceMappingURL=system.js.map

package/dist/platform/system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../src/platform/system.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,UAAU,QAAQ,CAAC,GAAsB,EAAE,IAAY,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACzG,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5H,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,eAAe,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;QAChE,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,IAAwG,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpL,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,yEAAyE,CAAC,CAAC;IAC3L,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/platform/windowsSandbox.js

@@ -0,0 +1,129 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { DodoError } from '../errors.js';
+import { resolveTrustedExecutable } from './execResolve.js';
+import { isWithinPath } from './pathPolicy.js';
+import { resolveConfigDir } from '../config/paths.js';
+import { assertSetupPrivatePaths } from '../setup/managedTools.js';
+import { buildChildEnv } from '../security/env.js';
+import { windowsProgramDataDirectory } from './system.js';
+export const SRT_VERSION = '0.0.75';
+export const SANDBOX_RECEIPT = 'windows-sandbox-validation.json';
+export const SANDBOX_CHECKS = ['workspace-write', 'outside-write-denied', 'owner-read-denied', 'direct-network-denied', 'cleanup'];
+/**
+ * A Windows sandbox process must not execute its launcher from the owner's
+ * private profile: the dedicated srt-sandbox account cannot traverse that
+ * profile before session ACL grants apply. ProgramData is machine-common and
+ * traversable; each actual scratch directory created below it is still made
+ * owner-private before any content is written, then receives a scoped SRT
+ * session grant that is removed during reset().
+ */
+export function windowsSandboxScratchParent() {
+    if (process.platform !== 'win32')
+        throw new DodoError('NOT_SUPPORTED', 'Windows sandbox scratch was requested on another OS');
+    const raw = windowsProgramDataDirectory(process.env);
+    if (!raw || !path.win32.isAbsolute(raw) || raw.startsWith('\\\\') || raw.includes('\0'))
+        throw new DodoError('NOT_SUPPORTED', 'Windows sandbox requires a local ProgramData directory');
+    const stat = fs.lstatSync(raw);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new DodoError('PATH_DENIED', 'ProgramData sandbox scratch parent must be a real directory');
+    return fs.realpathSync.native(raw);
+}
+/** Parse the exact JSON contract emitted by pinned srt-win 0.0.75. */
+export function parseWindowsSandboxStatus(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const status = value;
+    const fence = status.wfp?.state;
+    if (!['installed', 'absent', 'cannot-read'].includes(fence ?? ''))
+        return undefined;
+    const outer = status.user, account = outer?.user, sid = account?.sid;
+    const provisioned = outer?.cred_present === true
+        && Number.isInteger(outer.marker_version) && (outer.marker_version ?? 0) >= 1
+        && typeof sid === 'string' && /^S-1-5-(?:\d+-)+\d+$/.test(sid)
+        && outer.marker_user_sid === sid
+        && account?.exists === true && account.group_exists === true
+        && account.in_builtin_users === true && account.in_sandbox_group === true
+        && account.hidden_from_logon === true
+        && (fence !== 'installed' || status.wfp?.user_sid === sid);
+    return { provisioned, fence: fence };
+}
+function regularBytes(file) {
+    const s = fs.lstatSync(file);
+    if (!s.isFile() || s.isSymbolicLink() || s.nlink !== 1 || s.size > 64 * 1024 * 1024)
+        throw new Error('unsafe sandbox file');
+    return fs.readFileSync(file);
+}
+/** A receipt becomes stale after changing the runtime, launcher, architecture or Node ABI. */
+export function sandboxFingerprint(executable) {
+    const hash = createHash('sha256').update(`${SRT_VERSION}:${process.arch}:${process.versions.node}`);
+    for (const file of [executable, fileURLToPath(new URL('../services/jobs/windowsSandboxWorker.js', import.meta.url)), fileURLToPath(new URL('../services/jobs/windowsSandboxChild.js', import.meta.url))]) {
+        hash.update(file);
+        hash.update(regularBytes(file));
+    }
+    return hash.digest('hex');
+}
+export function validSandboxReceipt(value, fingerprint) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const r = value;
+    return r.version === 1 && r.platform === 'win32' && r.runtimeVersion === SRT_VERSION && r.passed === true && r.fingerprint === fingerprint
+        && Array.isArray(r.checks) && SANDBOX_CHECKS.every(check => r.checks.includes(check)) && typeof r.checkedAt === 'string' && Number.isFinite(Date.parse(r.checkedAt));
+}
+export function hasSandboxReceipt(executable, ownerStateDir) {
+    try {
+        const receipt = path.join(ownerStateDir, SANDBOX_RECEIPT);
+        assertSetupPrivatePaths([ownerStateDir, receipt]);
+        if (fs.statSync(receipt).size > 16384)
+            return false;
+        return validSandboxReceipt(JSON.parse(regularBytes(receipt).toString('utf8')), sandboxFingerprint(executable));
+    }
+    catch {
+        return false;
+    }
+}
+/** Read-only native status; never installs, repairs ACLs, prompts for UAC or trusts a marker alone. */
+export function findWindowsSandbox(root, ownerStateDir = resolveConfigDir(process.env).dir) {
+    if (process.platform !== 'win32')
+        return undefined;
+    try {
+        const executable = resolveTrustedExecutable('srt-win.exe', root, { allowBatch: false });
+        let directory = path.dirname(executable);
+        for (let depth = 0; depth < 5; depth++, directory = path.dirname(directory)) {
+            const manifest = path.join(directory, 'package.json');
+            if (!fs.existsSync(manifest))
+                continue;
+            const pkg = JSON.parse(regularBytes(manifest).toString('utf8'));
+            if (pkg.name !== '@anthropic-ai/sandbox-runtime' || pkg.version !== SRT_VERSION)
+                continue;
+            if (isWithinPath(root, directory))
+                return undefined;
+            const probe = spawnSync(executable, ['status'], { cwd: directory, env: buildChildEnv({ parentEnv: process.env, workspaceRoot: root, extraAllowlist: [] }), shell: false, windowsHide: true, encoding: 'utf8', timeout: 10000, maxBuffer: 65536 });
+            if (probe.error || probe.status !== 0)
+                return undefined;
+            const status = parseWindowsSandboxStatus(JSON.parse(probe.stdout));
+            if (!status)
+                return undefined;
+            return { executable, packageRoot: directory, provisioned: status.provisioned,
+                fence: status.fence, validated: hasSandboxReceipt(executable, ownerStateDir) };
+        }
+    }
+    catch { /* No readiness claim; execution fails closed and setup reports the missing prerequisite. */ }
+    return undefined;
+}
+export function windowsSandboxInvocation(program, args, options, validating = false) {
+    if (!options.ownerStateDir)
+        throw new DodoError('NOT_SUPPORTED', 'Windows sandbox requires an explicit owner-state boundary');
+    const runtime = findWindowsSandbox(options.workspaceRoot, options.ownerStateDir);
+    if (!runtime?.provisioned || runtime.fence === 'absent' || (!validating && !runtime.validated))
+        throw new DodoError('NOT_SUPPORTED', 'Windows sandbox requires local installation and successful confinement checks; run dodo setup --components sandbox');
+    const request = { runtimeRoot: runtime.packageRoot, program, args, windowsVerbatimArguments: options.windowsVerbatimArguments ?? false,
+        workspaceRoot: options.workspaceRoot, writablePaths: options.writablePaths ?? [], readablePaths: options.readablePaths ?? [],
+        ...(options.privateScript ? { privateScript: options.privateScript } : {}),
+        allowNetwork: options.allowNetwork ?? true, ownerStateDir: options.ownerStateDir };
+    return { program: process.execPath, args: [fileURLToPath(new URL('../services/jobs/windowsSandboxWorker.js', import.meta.url)), Buffer.from(JSON.stringify(request), 'utf8').toString('base64')] };
+}
+//# sourceMappingURL=windowsSandbox.js.map

package/dist/platform/windowsSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSandbox.js","sourceRoot":"","sources":["../../src/platform/windowsSandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AACpC,MAAM,CAAC,MAAM,eAAe,GAAG,iCAAiC,CAAC;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,SAAS,CAAU,CAAC;AAC5I;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IAC9H,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IACxL,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,6DAA6D,CAAC,CAAC;IACpJ,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAgBD,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,EAAE,YAAY,KAAK,IAAI;WAC3C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC;WAC1E,OAAO,GAAG,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;WAC3D,KAAK,CAAC,eAAe,KAAK,GAAG;WAC7B,OAAO,EAAE,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI;WACzD,OAAO,CAAC,gBAAgB,KAAK,IAAI,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI;WACtE,OAAO,CAAC,iBAAiB,KAAK,IAAI;WAClC,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,GAAG,CAAC,CAAC;IAC7D,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAuC,EAAE,CAAC;AACzE,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5H,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AACD,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,0CAA0C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,WAAmB;IACrE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAA0C,CAAC;IACrD,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,cAAc,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;WACrI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1K,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,aAAqB;IACzE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAC1D,uBAAuB,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IACjH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AACD,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG;IAChG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,wBAAwB,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwC,CAAC;YACvG,IAAI,GAAG,CAAC,IAAI,KAAK,+BAA+B,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW;gBAAE,SAAS;YAC1F,IAAI,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClP,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC1E,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,4FAA4F,CAAC,CAAC;IACxG,OAAO,SAAS,CAAC;AACnB,CAAC;AAMD,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,IAAc,EAAE,OAGzE,EAAE,UAAU,GAAG,KAAK;IACnB,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;IAC9H,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjF,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,oHAAoH,CAAC,CAAC;IAC7J,MAAM,OAAO,GAA0B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,IAAI,KAAK;QAC3J,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;QAC5H,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,0CAA0C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;AACrM,CAAC"}

package/dist/projects/federation.js

@@ -0,0 +1,312 @@
+import { isOwner, projectAuthority } from '../security/projectAuthority.js';
+import { DodoError, toDodoError } from '../errors.js';
+import { loadProjectConfig } from '../config/projectConfig.js';
+import { GitService } from '../services/git/gitService.js';
+import { ReadService, ListService } from '../services/files/readService.js';
+import { OverviewService } from '../services/overview.js';
+import { SearchService } from '../services/search/searchService.js';
+import { digestOf } from '../util/hash.js';
+import { mintEpoch } from '../workspace/identity.js';
+import { WorkspaceFS } from '../workspace/fs.js';
+import { IgnoreEngine } from '../workspace/ignores.js';
+import { ProjectRegistry } from './registry.js';
+const MAX_VISIBLE_PROJECTS = 100;
+export const MAX_FEDERATED_PROJECTS = 8;
+const MAX_CACHED_RUNTIMES = 16;
+/**
+ * Read-only, owner-curated multi-project federation (Phase 03).
+ *
+ * A registered path is metadata, never authority. Every access re-reads the
+ * registry, checks its directory identity/readiness, and evaluates the live
+ * target authority. Personal mode uses the approved grant scopes; managed mode
+ * intersects them with the TARGET workspace ACL. The active process workspace
+ * is never switched and process.cwd() is never touched.
+ */
+export class FederationService {
+    store;
+    config;
+    limits;
+    registry;
+    runtimes = new Map();
+    constructor(store, config, limits) {
+        this.store = store;
+        this.config = config;
+        this.limits = limits;
+        this.registry = new ProjectRegistry(store);
+    }
+    listAuthorized(principal) {
+        const authorized = this.registry.list()
+            .filter((project) => this.canRead(project, principal))
+            .map((project) => summary(project));
+        return { projects: authorized.slice(0, MAX_VISIBLE_PROJECTS), truncated: authorized.length > MAX_VISIBLE_PROJECTS };
+    }
+    async overview(projectId, principal, activeRequestContext) {
+        const runtime = this.runtime(projectId, principal);
+        const started = Date.now();
+        try {
+            const data = await runtime.overview.build({
+                workspaceId: runtime.project.workspaceId,
+                epoch: runtime.epoch,
+                trustMode: this.store.trustMode(runtime.project.workspaceId),
+                modeDescription: 'federated read-only access; switch this project into the active workspace before any write or command',
+                projectConfig: runtime.projectConfig,
+                searchBackend: runtime.search.rgAvailable() ? 'ripgrep' : 'js',
+                semanticAvailable: false,
+            });
+            const sourceHash = digestOf(data);
+            this.audit(runtime.project, principal, 'federation.project_overview', 'ok', started, sourceHash);
+            return {
+                data: {
+                    ...data,
+                    instructions: 'This is a federated read-only overview. The project.workspaceId/project.workspaceEpoch identify the target evidence only. ' +
+                        'For the next MCP call, keep using the ACTIVE workspaceId/workspaceEpoch from this response envelope and pass projectId inside the selected read operation. ' +
+                        'For an edit or command, call project_overview with targetProjectId and use that returned workspace context on later target-routed calls.',
+                    project: scope(runtime, sourceHash),
+                    federation: { mode: 'read-only', activeWorkspaceChanged: false, requestContext: activeRequestContext },
+                },
+                warnings: ['This projectId access is read-only. Use explicit targetProjectId routing for edits or commands.'],
+                truncated: data.treeTruncated,
+            };
+        }
+        catch (error) {
+            this.auditFailure(runtime.project, principal, 'federation.project_overview', error, started);
+            throw error;
+        }
+    }
+    listFiles(projectId, principal, startPath, options) {
+        const runtime = this.runtime(projectId, principal);
+        const started = Date.now();
+        try {
+            const result = runtime.list.tree(startPath, options);
+            const sourceHash = digestOf({ tree: result.root, entryCount: result.entryCount });
+            this.audit(runtime.project, principal, 'federation.list_files', 'ok', started, sourceHash);
+            return { tree: result.root, entryCount: result.entryCount, project: scope(runtime, sourceHash), truncated: result.truncated };
+        }
+        catch (error) {
+            this.auditFailure(runtime.project, principal, 'federation.list_files', error, started);
+            throw error;
+        }
+    }
+    readFiles(projectId, principal, files) {
+        const runtime = this.runtime(projectId, principal);
+        const started = Date.now();
+        try {
+            const result = runtime.read.readBatch(files);
+            const sourceHash = digestOf(result.files.map((file) => ({ path: file.path, hash: file.hash })));
+            this.audit(runtime.project, principal, 'federation.read_files', 'ok', started, sourceHash);
+            return { ...result, project: scope(runtime, sourceHash) };
+        }
+        catch (error) {
+            this.auditFailure(runtime.project, principal, 'federation.read_files', error, started);
+            throw error;
+        }
+    }
+    /** Bounded metadata fingerprint used only to invalidate derived read caches. */
+    manifest(projectId, principal) {
+        const runtime = this.runtime(projectId, principal);
+        const started = Date.now();
+        try {
+            const limit = Math.min(10_000, this.limits.semanticFilesMax * 4);
+            const files = [];
+            for (const entry of runtime.wfs.walk({ maxEntries: limit + 1, maxDepth: 64 })) {
+                if (!entry.stat.isFile())
+                    continue;
+                files.push({ path: entry.rel, bytes: entry.stat.size, mtimeMs: entry.stat.mtimeMs, ctimeMs: entry.stat.ctimeMs });
+                if (files.length > limit)
+                    break;
+            }
+            const truncated = files.length > limit;
+            const hash = digestOf(files.slice(0, limit));
+            this.audit(runtime.project, principal, 'federation.context_manifest', 'ok', started, hash);
+            return { workspaceId: runtime.project.workspaceId, hash, truncated };
+        }
+        catch (error) {
+            this.auditFailure(runtime.project, principal, 'federation.context_manifest', error, started);
+            throw error;
+        }
+    }
+    async searchMany(projectIds, principal, query, cursor) {
+        if (projectIds.length < 1 || projectIds.length > MAX_FEDERATED_PROJECTS) {
+            throw new DodoError('INVALID_INPUT', `projectIds must contain 1..${MAX_FEDERATED_PROJECTS} registered project IDs`);
+        }
+        const unique = [...new Set(projectIds)];
+        if (unique.length !== projectIds.length)
+            throw new DodoError('INVALID_INPUT', 'projectIds must not contain duplicates');
+        if (cursor !== undefined && unique.length !== 1) {
+            throw new DodoError('INVALID_INPUT', 'cursor is supported only when searching one federated project');
+        }
+        // Authorize every named project before returning any result. This keeps an
+        // unauthorized target from becoming a partial-result existence oracle.
+        const projects = unique.map((projectId) => this.authorizedProject(projectId, principal));
+        const ready = [];
+        const failures = [];
+        for (let index = 0; index < projects.length; index += 1) {
+            const project = projects[index];
+            if (!project.available) {
+                this.audit(project, principal, 'federation.search_code', 'NOT_FOUND', Date.now());
+                failures.push({ projectId: project.projectId, code: 'NOT_FOUND', message: `registered project is unavailable (${project.availability})`, retryable: project.availability === 'inaccessible' });
+            }
+            else {
+                ready.push({ index, runtime: this.runtimeFor(project) });
+            }
+        }
+        const base = Math.floor(query.maxResults / Math.max(1, ready.length));
+        let remainder = query.maxResults % Math.max(1, ready.length);
+        const searched = await Promise.all(ready.map(async ({ index, runtime }) => {
+            const started = Date.now();
+            const allocation = Math.max(1, base + (remainder-- > 0 ? 1 : 0));
+            try {
+                const result = await runtime.search.search({ ...query, maxResults: allocation }, {
+                    principal: principal.grantId,
+                    epoch: runtime.epoch,
+                    ...(cursor !== undefined ? { cursor } : {}),
+                });
+                const sources = this.sourceHashes(runtime, result);
+                const sourceHash = digestOf(sources);
+                this.audit(runtime.project, principal, 'federation.search_code', 'ok', started, sourceHash);
+                return { index, value: { project: scope(runtime, sourceHash), result, sources } };
+            }
+            catch (error) {
+                this.auditFailure(runtime.project, principal, 'federation.search_code', error, started);
+                const err = toDodoError(error);
+                return { index, failure: { projectId: runtime.project.projectId, code: err.code, message: err.message, retryable: err.retryable } };
+            }
+        }));
+        const ordered = searched.sort((a, b) => a.index - b.index);
+        const results = ordered.flatMap((entry) => entry.value ? [entry.value] : []);
+        failures.push(...ordered.flatMap((entry) => entry.failure ? [entry.failure] : []));
+        const nextCursor = unique.length === 1 ? results[0]?.result.nextCursor : undefined;
+        return {
+            results,
+            failures,
+            truncated: failures.length > 0 || results.some((entry) => entry.result.truncated),
+            ...(nextCursor !== undefined ? { nextCursor } : {}),
+        };
+    }
+    authorizedProject(projectId, principal) {
+        let project;
+        try {
+            project = this.registry.get(projectId);
+        }
+        catch (error) {
+            if (isLocalOwner(principal))
+                throw error;
+            throw new DodoError('FORBIDDEN', 'project is not authorized for this client');
+        }
+        if (!this.canRead(project, principal))
+            throw new DodoError('FORBIDDEN', 'project is not authorized for this client');
+        return project;
+    }
+    runtime(projectId, principal) {
+        const project = this.authorizedProject(projectId, principal);
+        if (!project.available) {
+            throw new DodoError('NOT_FOUND', `registered project is unavailable (${project.availability})`, {
+                retryable: project.availability === 'inaccessible',
+                detail: { projectId: project.projectId, availability: project.availability },
+            });
+        }
+        return this.runtimeFor(project);
+    }
+    runtimeFor(project) {
+        const cacheKey = `${project.workspaceId}:${project.updatedAt}:${project.identity.dev}:${project.identity.ino}:${project.identity.birthtimeNs}`;
+        const cached = this.runtimes.get(project.projectId);
+        if (cached?.cacheKey === cacheKey) {
+            // Refresh insertion order for the bounded LRU cache.
+            this.runtimes.delete(project.projectId);
+            this.runtimes.set(project.projectId, cached);
+            return cached;
+        }
+        const projectConfig = loadProjectConfig(project.root);
+        const ignores = new IgnoreEngine({
+            root: project.root,
+            extraSecretPatterns: this.config.secretDeny,
+            secretAllow: this.config.secretAllow,
+            projectExcludes: projectConfig.config.exclude,
+        });
+        const wfs = new WorkspaceFS(project.root, ignores);
+        const list = new ListService(wfs, this.limits);
+        const runtime = {
+            cacheKey,
+            project,
+            epoch: mintEpoch(),
+            projectConfig,
+            wfs,
+            read: new ReadService(wfs, this.limits),
+            list,
+            search: new SearchService(wfs, this.limits, this.config.searchBackend),
+            overview: new OverviewService(wfs, this.limits, list, new GitService(wfs, this.limits)),
+        };
+        this.runtimes.set(project.projectId, runtime);
+        while (this.runtimes.size > MAX_CACHED_RUNTIMES) {
+            const oldest = this.runtimes.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.runtimes.delete(oldest);
+        }
+        return runtime;
+    }
+    canRead(project, principal) {
+        try {
+            return projectAuthority(this.store, principal, project.workspaceId).scopes.includes('dodo:read');
+        }
+        catch {
+            return false;
+        }
+    }
+    sourceHashes(runtime, result) {
+        const paths = new Set([
+            ...result.matches.map((match) => match.path),
+            ...result.files.map((file) => file.path),
+        ]);
+        const sources = [];
+        for (const file of paths) {
+            try {
+                const read = runtime.wfs.readTextFile(file, this.limits.readFileBytes);
+                sources.push({ path: read.rel, hash: read.hash });
+            }
+            catch {
+                // Search already enforced path/secret policy. A file may disappear
+                // between the search and this freshness read; omit its hash rather
+                // than pretending the source is stable.
+            }
+        }
+        return sources.sort((a, b) => a.path.localeCompare(b.path));
+    }
+    audit(project, principal, tool, result, started, sourceHash) {
+        try {
+            this.store.audit({
+                principal: principal.grantId,
+                workspaceId: project.workspaceId,
+                tool,
+                ...(sourceHash !== undefined ? { inputDigest: sourceHash.slice(0, 24) } : {}),
+                refId: project.projectId,
+                durationMs: Date.now() - started,
+                result,
+            });
+        }
+        catch {
+            throw new DodoError('INTERNAL_ERROR', 'federation audit write failed; the read result was discarded', { retryable: true });
+        }
+    }
+    auditFailure(project, principal, tool, error, started) {
+        const err = toDodoError(error);
+        this.audit(project, principal, tool, err.code, started);
+    }
+}
+function summary(project) {
+    return {
+        projectId: project.projectId,
+        displayName: project.displayName,
+        workspaceId: project.workspaceId,
+        availability: project.availability,
+        available: project.available,
+        statusText: project.statusText,
+    };
+}
+function scope(runtime, sourceHash) {
+    return { ...summary(runtime.project), workspaceEpoch: runtime.epoch, readOnly: true, sourceHash };
+}
+function isLocalOwner(principal) {
+    return isOwner(principal);
+}
+//# sourceMappingURL=federation.js.map

package/dist/projects/federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/projects/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,iBAAiB,EAA4B,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAwB,MAAM,kCAAkC,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAuC,MAAM,qCAAqC,CAAC;AAGzG,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,eAAe,EAA0B,MAAM,eAAe,CAAC;AAExE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AA0C/B;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAKT;IACA;IACA;IANF,QAAQ,CAAkB;IAC1B,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE9D,YACmB,KAAY,EACZ,MAAoB,EACpB,MAAc;QAFd,UAAK,GAAL,KAAK,CAAO;QACZ,WAAM,GAAN,MAAM,CAAc;QACpB,WAAM,GAAN,MAAM,CAAQ;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,cAAc,CAAC,SAAoB;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;aACpC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAiB,EACjB,SAAoB,EACpB,oBAAqE;QAErE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC5D,eAAe,EAAE,uGAAuG;gBACxH,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;gBAC9D,iBAAiB,EAAE,KAAK;aACzB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,6BAA6B,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjG,OAAO;gBACL,IAAI,EAAE;oBACJ,GAAG,IAAI;oBACP,YAAY,EACV,4HAA4H;wBAC5H,6JAA6J;wBAC7J,0IAA0I;oBAC5I,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;oBACnC,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE;iBACvG;gBACD,QAAQ,EAAE,CAAC,iGAAiG,CAAC;gBAC7G,SAAS,EAAE,IAAI,CAAC,aAAa;aAC9B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,6BAA6B,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,SAAoB,EAAE,SAAiB,EAAE,OAA0E;QAC9I,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAChI,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,SAAoB,EAAE,KAAwB;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAC3F,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,QAAQ,CAAC,SAAiB,EAAE,SAAoB;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,KAAK,GAA6E,EAAE,CAAC;YAC3F,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;oBAAE,SAAS;gBACnC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClH,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YAClC,CAAC;YACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;YACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,6BAA6B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3F,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,6BAA6B,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CACd,UAAoB,EACpB,SAAoB,EACpB,KAAkB,EAClB,MAAe;QAEf,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACxE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,8BAA8B,sBAAsB,yBAAyB,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;QACxH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,+DAA+D,CAAC,CAAC;QACxG,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAsD,EAAE,CAAC;QACpE,MAAM,QAAQ,GAA6B,EAAE,CAAC;QAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAsB,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,OAAO,CAAC,YAAY,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC,CAAC;YACjM,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,IAAI,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE;oBAC/E,SAAS,EAAE,SAAS,CAAC,OAAO;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACnD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAkC,EAAE,CAAC;YACpH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxF,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAmC,EAAE,CAAC;YACvK,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,OAAO;YACL,OAAO;YACP,QAAQ;YACR,SAAS,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YACjF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,SAAiB,EAAE,SAAoB;QAC/D,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,SAAS,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;QACrH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,OAAO,CAAC,SAAiB,EAAE,SAAoB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,sCAAsC,OAAO,CAAC,YAAY,GAAG,EAAE;gBAC9F,SAAS,EAAE,OAAO,CAAC,YAAY,KAAK,cAAc;gBAClD,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAEO,UAAU,CAAC,OAA0B;QAC3C,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/I,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,qDAAqD;YACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC;YAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAC3C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAmB;YAC9B,QAAQ;YACR,OAAO;YACP,KAAK,EAAE,SAAS,EAAE;YAClB,aAAa;YACb,GAAG;YACH,IAAI,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACvC,IAAI;YACJ,MAAM,EAAE,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACtE,QAAQ,EAAE,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACxF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;YACvE,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,OAAO,CAAC,OAA0B,EAAE,SAAoB;QAC9D,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAAuB,EAAE,MAAoB;QAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS;YAC5B,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,OAAO,GAA0C,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,mEAAmE;gBACnE,wCAAwC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,OAA0B,EAAE,SAAoB,EAAE,IAAY,EAAE,MAAc,EAAE,OAAe,EAAE,UAAmB;QAChI,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACf,SAAS,EAAE,SAAS,CAAC,OAAO;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI;gBACJ,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,KAAK,EAAE,OAAO,CAAC,SAAS;gBACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,8DAA8D,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAA0B,EAAE,SAAoB,EAAE,IAAY,EAAE,KAAc,EAAE,OAAe;QAClH,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,OAAO,CAAC,OAA0B;IACzC,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,OAAuB,EAAE,UAAkB;IACxD,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,YAAY,CAAC,SAAoB;IACxC,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC"}