@agentsh/secure-sandbox 0.1.4 → 0.1.6

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { S as SandboxAdapter, a as SecureConfig, b as SecuredSandbox, T as ThreatFeedsConfig } from './types-DuXMpAuv.js';
-export { E as ExecResult, I as InstallStrategy, R as ReadFileResult, c as SecurityMode, d as ThreatFeed, W as WriteFileResult } from './types-DuXMpAuv.js';
-export { P as PolicyDefinition, i as policies } from './index-D0UvBOzr.js';
+import { S as SandboxAdapter, a as SecureConfig, b as SecuredSandbox } from './types-S_fIEFHD.js';
+export { E as ExecResult, I as InstallStrategy, L as LicenseSpdxMatch, P as PackageChecksConfig, c as PackageMatch, d as PackageRule, e as ProviderConfig, R as ReadFileResult, f as SecurityMode, T as ThreatFeed, g as ThreatFeedsConfig, W as WriteFileResult, h as defaultThreatFeeds } from './types-S_fIEFHD.js';
+export { P as PolicyDefinition, i as policies } from './index-Nmlhw9oj.js';
 import { ZodIssue } from 'zod';
-export { i as adapters } from './index-aQ1TVPtG.js';
+export { i as adapters } from './index-D6DG8Lpi.js';
 import './adapters/vercel.js';
 import './adapters/e2b.js';
 import './adapters/daytona.js';
@@ -11,12 +11,6 @@ import './adapters/blaxel.js';
 
 declare function secureSandbox(adapter: SandboxAdapter, config?: SecureConfig): Promise<SecuredSandbox>;
 
-/**
- * Default threat feeds: URLhaus (malware) + Phishing.Database (phishing).
- * Both are free, open source, and updated frequently.
- */
-declare const defaultThreatFeeds: ThreatFeedsConfig;
-
 declare class AgentSHError extends Error {
     constructor(message: string);
 }
@@ -74,4 +68,4 @@ declare class RuntimeError extends AgentSHError {
     });
 }
 
-export { AgentSHError, IncompatibleProviderVersionError, IntegrityError, MissingPeerDependencyError, PolicyValidationError, ProvisioningError, RuntimeError, SandboxAdapter, SecureConfig, SecuredSandbox, ThreatFeedsConfig, defaultThreatFeeds, secureSandbox };
+export { AgentSHError, IncompatibleProviderVersionError, IntegrityError, MissingPeerDependencyError, PolicyValidationError, ProvisioningError, RuntimeError, SandboxAdapter, SecureConfig, SecuredSandbox, secureSandbox };

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   adapters_exports
-} from "./chunk-L4KFLVNU.js";
+} from "./chunk-KXCR2ZML.js";
 import "./chunk-UYEAO27E.js";
 import "./chunk-LMN3KM53.js";
 import "./chunk-45FKFVMC.js";
@@ -20,7 +20,7 @@ import {
   serializePolicy,
   systemPolicyYaml,
   validatePolicy
-} from "./chunk-NWHVZ3DG.js";
+} from "./chunk-GFPHTJLU.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/core/integrity.ts
@@ -95,6 +95,22 @@ var defaultThreatFeeds = {
     "sum.golang.org"
   ]
 };
+var defaultPackageCheckProviders = {
+  local: { enabled: true, priority: 0 },
+  osv: { enabled: true, priority: 1 },
+  depsdev: { enabled: true, priority: 2 }
+};
+function providerConfigToSnakeCase(config) {
+  const result = { enabled: config.enabled ?? true };
+  if (config.priority !== void 0) result.priority = config.priority;
+  if (config.timeout !== void 0) result.timeout = config.timeout;
+  if (config.onFailure !== void 0) result.on_failure = config.onFailure;
+  if (config.apiKeyEnv !== void 0) result.api_key_env = config.apiKeyEnv;
+  if (config.type !== void 0) result.type = config.type;
+  if (config.command !== void 0) result.command = config.command;
+  if (config.options !== void 0) result.options = config.options;
+  return result;
+}
 function generateServerConfig(opts) {
   const config = {
     server: {
@@ -119,7 +135,99 @@ function generateServerConfig(opts) {
     }
   };
   if (opts.watchtower) config.watchtower = opts.watchtower;
-  if (opts.realPaths) config.sessions = { real_paths: true };
+  if (opts.grpc) {
+    config.server.grpc = { enabled: true, addr: opts.grpc.addr };
+  }
+  if (opts.serverTimeouts) {
+    const http = config.server.http;
+    if (opts.serverTimeouts.readTimeout) http.read_timeout = opts.serverTimeouts.readTimeout;
+    if (opts.serverTimeouts.writeTimeout) http.write_timeout = opts.serverTimeouts.writeTimeout;
+    if (opts.serverTimeouts.maxRequestSize) http.max_request_size = opts.serverTimeouts.maxRequestSize;
+  }
+  if (opts.logging) config.logging = { ...opts.logging };
+  const sessionsObj = {};
+  if (opts.realPaths) sessionsObj.real_paths = true;
+  if (opts.sessions) {
+    if (opts.sessions.baseDir) sessionsObj.base_dir = opts.sessions.baseDir;
+    if (opts.sessions.maxSessions !== void 0) sessionsObj.max_sessions = opts.sessions.maxSessions;
+    if (opts.sessions.defaultTimeout) sessionsObj.default_timeout = opts.sessions.defaultTimeout;
+    if (opts.sessions.idleTimeout) sessionsObj.idle_timeout = opts.sessions.idleTimeout;
+    if (opts.sessions.cleanupInterval) sessionsObj.cleanup_interval = opts.sessions.cleanupInterval;
+  }
+  if (Object.keys(sessionsObj).length > 0) config.sessions = sessionsObj;
+  if (opts.audit) {
+    const auditObj = {};
+    if (opts.audit.enabled !== void 0) auditObj.enabled = opts.audit.enabled;
+    if (opts.audit.sqlitePath) auditObj.sqlite_path = opts.audit.sqlitePath;
+    config.audit = auditObj;
+  }
+  if (opts.sandboxLimits) {
+    config.sandbox.limits = {
+      ...opts.sandboxLimits.maxMemoryMb !== void 0 && { max_memory_mb: opts.sandboxLimits.maxMemoryMb },
+      ...opts.sandboxLimits.maxCpuPercent !== void 0 && { max_cpu_percent: opts.sandboxLimits.maxCpuPercent },
+      ...opts.sandboxLimits.maxProcesses !== void 0 && { max_processes: opts.sandboxLimits.maxProcesses }
+    };
+  }
+  if (opts.fuse?.deferred !== void 0) {
+    config.sandbox.fuse.deferred = opts.fuse.deferred;
+  }
+  if (opts.networkIntercept) {
+    const net = config.sandbox.network;
+    if (opts.networkIntercept.interceptMode) net.intercept_mode = opts.networkIntercept.interceptMode;
+    if (opts.networkIntercept.proxyListenAddr) net.proxy_listen_addr = opts.networkIntercept.proxyListenAddr;
+  }
+  if (opts.seccompDetails) {
+    const sec = config.sandbox.seccomp;
+    if (opts.seccompDetails.execve !== void 0) sec.execve = opts.seccompDetails.execve;
+    if (opts.seccompDetails.fileMonitor) {
+      sec.file_monitor = {
+        ...opts.seccompDetails.fileMonitor.enabled !== void 0 && { enabled: opts.seccompDetails.fileMonitor.enabled },
+        ...opts.seccompDetails.fileMonitor.enforceWithoutFuse !== void 0 && { enforce_without_fuse: opts.seccompDetails.fileMonitor.enforceWithoutFuse }
+      };
+    }
+  }
+  if (opts.cgroups) {
+    config.sandbox.cgroups = { ...opts.cgroups };
+  }
+  if (opts.unixSockets) {
+    config.sandbox.unix_sockets = { ...opts.unixSockets };
+  }
+  if (opts.proxy) {
+    config.proxy = { ...opts.proxy };
+  }
+  if (opts.dlp) {
+    const dlpObj = {};
+    if (opts.dlp.mode) dlpObj.mode = opts.dlp.mode;
+    if (opts.dlp.patterns) dlpObj.patterns = opts.dlp.patterns;
+    if (opts.dlp.customPatterns) {
+      dlpObj.custom_patterns = opts.dlp.customPatterns.map((p) => ({
+        name: p.name,
+        display: p.display,
+        regex: p.regex
+      }));
+    }
+    config.dlp = dlpObj;
+  }
+  if (opts.policiesOverride) {
+    config.policies = {
+      ...opts.policiesOverride.dir && { dir: opts.policiesOverride.dir },
+      ...opts.policiesOverride.defaultPolicy && { default: opts.policiesOverride.defaultPolicy }
+    };
+  }
+  if (opts.approvals) config.approvals = { ...opts.approvals };
+  if (opts.metrics) config.metrics = { ...opts.metrics };
+  if (opts.health) {
+    const healthObj = {};
+    if (opts.health.path) healthObj.path = opts.health.path;
+    if (opts.health.readinessPath) healthObj.readiness_path = opts.health.readinessPath;
+    config.health = healthObj;
+  }
+  if (opts.development) {
+    const devObj = {};
+    if (opts.development.disableAuth !== void 0) devObj.disable_auth = opts.development.disableAuth;
+    if (opts.development.verboseErrors !== void 0) devObj.verbose_errors = opts.development.verboseErrors;
+    config.development = devObj;
+  }
   const feeds = opts.threatFeeds === false ? void 0 : opts.threatFeeds ?? defaultThreatFeeds;
   if (feeds) {
     config.threat_feeds = {
@@ -134,6 +242,30 @@ function generateServerConfig(opts) {
       ...feeds.allowlist?.length ? { allowlist: feeds.allowlist } : {}
     };
   }
+  if (opts.packageChecks) {
+    const pc = opts.packageChecks;
+    const providers = {};
+    for (const [name, def] of Object.entries(defaultPackageCheckProviders)) {
+      providers[name] = { ...def };
+    }
+    if (pc.providers) {
+      for (const [name, value] of Object.entries(pc.providers)) {
+        if (value === false) {
+          providers[name] = { enabled: false };
+        } else if (value === true) {
+          providers[name] = { ...providers[name] ?? {}, enabled: true };
+        } else {
+          const base = providers[name] ?? {};
+          providers[name] = { ...base, ...providerConfigToSnakeCase(value) };
+        }
+      }
+    }
+    config.package_checks = {
+      enabled: true,
+      scope: pc.scope ?? "new_packages_only",
+      providers
+    };
+  }
   return yaml.dump(config, { lineWidth: -1 });
 }
 
@@ -199,7 +331,9 @@ async function provision(adapter, config = {}) {
     realPaths: realPathsOverride,
     traceParent,
     policyName = "policy",
-    threatFeeds
+    threatFeeds,
+    packageChecks,
+    serverConfig: extendedConfig
   } = config;
   const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();
   let securityMode = "full";
@@ -331,7 +465,9 @@ async function provision(adapter, config = {}) {
   const serverConfig = generateServerConfig({
     watchtower,
     realPaths,
-    threatFeeds
+    threatFeeds,
+    packageChecks,
+    ...extendedConfig
   });
   await adapter.writeFile("/etc/agentsh/config.yml", serverConfig, {
     sudo: true

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/integrity.ts","../src/core/config.ts","../src/core/traceparent.ts","../src/core/provision.ts","../src/core/runtime.ts","../src/api.ts"],"sourcesContent":["import { IntegrityError } from './errors.js';\n\nexport const PINNED_VERSION = '0.15.0';\n\nexport const CHECKSUMS: Record<string, Record<string, string>> = {\n  '0.15.0': {\n    linux_amd64:\n      '89f7ebbfd75ffd961245ec62b2602fd0cc387740502ac858dbc39c367c5699c5',\n    linux_arm64:\n      '3fabbd749f9e98fb9f96ddfc94c389a6868cda7ed3668daa8440c39ceec85f3b',\n  },\n  '0.14.0': {\n    linux_amd64:\n      '2ab8ba0d6637fe1a5badf840c3db197161a6f9865d721ed216029d229b1b9bbc',\n    linux_arm64:\n      '929d18dd9fe36e9b2fa830d7ae64b4fb481853e743ade8674fcfcdc73470ed53',\n  },\n};\n\n/**\n * Returns the checksum to verify against.\n * If `override` is provided, returns it directly.\n * Otherwise looks up the checksum in the pinned CHECKSUMS map.\n * Throws IntegrityError if no checksum is found.\n */\nexport function getChecksum(\n  version: string,\n  arch: string,\n  override?: string,\n): string {\n  if (override) {\n    return override;\n  }\n\n  const versionChecksums = CHECKSUMS[version];\n  if (versionChecksums && versionChecksums[arch]) {\n    return versionChecksums[arch];\n  }\n\n  throw new IntegrityError({\n    expected: '',\n    actual: '',\n    message: `No pinned checksum for agentsh v${version}. Provide \\`agentshChecksum\\` explicitly or use \\`skipIntegrityCheck: true\\`.`,\n  });\n}\n\n/**\n * Returns an array of shell commands to try for computing SHA-256 checksums.\n * Each command extracts just the hex hash value from the given file.\n */\nexport function buildVerifyCommand(filePath: string): string[] {\n  return [\n    `sha256sum \"${filePath}\" | awk '{print $1}'`,\n    `shasum -a 256 \"${filePath}\" | awk '{print $1}'`,\n    `openssl dgst -sha256 \"${filePath}\" | awk '{print $NF}'`,\n  ];\n}\n\n/**\n * Returns the download URL for the agentsh binary.\n * If `overrideUrl` is provided, returns it directly.\n * Otherwise returns the default GitHub releases URL.\n */\nexport function binaryUrl(\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  return `https://github.com/canyonroad/agentsh/releases/download/v${version}/agentsh_${version}_${arch}.tar.gz`;\n}\n","import yaml from 'js-yaml';\nimport type { ThreatFeedsConfig } from './types.js';\n\nexport interface ServerConfigOpts {\n  watchtower?: string;\n  realPaths?: boolean;\n  threatFeeds?: false | ThreatFeedsConfig;\n}\n\n/**\n * Default threat feeds: URLhaus (malware) + Phishing.Database (phishing).\n * Both are free, open source, and updated frequently.\n */\nexport const defaultThreatFeeds: ThreatFeedsConfig = {\n  action: 'deny',\n  feeds: [\n    {\n      name: 'urlhaus',\n      url: 'https://urlhaus.abuse.ch/downloads/hostfile/',\n      format: 'hostfile',\n      refreshInterval: '6h',\n    },\n    {\n      name: 'phishing',\n      url: 'https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-domains-ACTIVE.txt',\n      format: 'domain-list',\n      refreshInterval: '12h',\n    },\n  ],\n  allowlist: [\n    'github.com',\n    '*.github.com',\n    'registry.npmjs.org',\n    'registry.yarnpkg.com',\n    'pypi.org',\n    'files.pythonhosted.org',\n    'crates.io',\n    'static.crates.io',\n    'index.crates.io',\n    'proxy.golang.org',\n    'sum.golang.org',\n  ],\n};\n\nexport function generateServerConfig(opts: ServerConfigOpts): string {\n  const config: Record<string, unknown> = {\n    server: {\n      http: {\n        addr: '127.0.0.1:18080',\n      },\n    },\n    auth: {\n      type: 'none',\n    },\n    policies: {\n      system_dir: '/etc/agentsh/system',\n      dir: '/etc/agentsh',\n      default: 'policy',\n    },\n    sandbox: {\n      enabled: true,\n      allow_degraded: true,\n      fuse: { enabled: true },\n      network: { enabled: true },\n      seccomp: { enabled: true },\n    },\n  };\n  if (opts.watchtower) config.watchtower = opts.watchtower;\n  if (opts.realPaths) config.sessions = { real_paths: true };\n\n  // Threat feeds: enabled by default, opt-out with `threatFeeds: false`\n  const feeds = opts.threatFeeds === false ? undefined : (opts.threatFeeds ?? defaultThreatFeeds);\n  if (feeds) {\n    config.threat_feeds = {\n      enabled: true,\n      action: feeds.action ?? 'deny',\n      feeds: feeds.feeds.map(f => ({\n        name: f.name,\n        url: f.url,\n        format: f.format,\n        refresh_interval: f.refreshInterval ?? '6h',\n      })),\n      ...(feeds.allowlist?.length ? { allowlist: feeds.allowlist } : {}),\n    };\n  }\n\n  return yaml.dump(config, { lineWidth: -1 });\n}\n","/**\n * Read W3C traceparent from the active OpenTelemetry span, if available.\n *\n * Uses dynamic import so @opentelemetry/api is an optional peer dependency.\n * Returns undefined when OTEL is not installed, no span is active, or the\n * trace context is invalid (all-zero trace ID).\n */\nexport async function getTraceparent(): Promise<string | undefined> {\n  try {\n    const { trace } = await import('@opentelemetry/api');\n    const span = trace.getActiveSpan();\n    const ctx = span?.spanContext();\n    if (!ctx?.traceId || ctx.traceId === '00000000000000000000000000000000') {\n      return undefined;\n    }\n    const flags = (ctx.traceFlags ?? 0).toString(16).padStart(2, '0');\n    return `00-${ctx.traceId}-${ctx.spanId}-${flags}`;\n  } catch {\n    return undefined;\n  }\n}\n","import type {\n  SandboxAdapter,\n  SecureConfig,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport {\n  getChecksum,\n  buildVerifyCommand,\n  binaryUrl,\n  PINNED_VERSION,\n} from './integrity.js';\nimport { generateServerConfig } from './config.js';\nimport { ProvisioningError, IntegrityError } from './errors.js';\nimport { serializePolicy, systemPolicyYaml } from '../policies/serialize.js';\nimport { agentDefault } from '../policies/presets.js';\nimport { validatePolicy } from '../policies/schema.js';\nimport { getTraceparent } from './traceparent.js';\n\n// ─── Security mode ordering (strongest to weakest) ────────────\n\nconst SECURITY_MODE_RANK: Record<SecurityMode, number> = {\n  full: 4,\n  landlock: 3,\n  'landlock-only': 2,\n  minimal: 1,\n};\n\nfunction isWeakerThan(detected: SecurityMode, required: SecurityMode): boolean {\n  return SECURITY_MODE_RANK[detected] < SECURITY_MODE_RANK[required];\n}\n\n// ─── Architecture mapping ─────────────────────────────────────\n\nfunction mapArch(uname: string): 'linux_amd64' | 'linux_arm64' {\n  const trimmed = uname.trim();\n  if (trimmed === 'x86_64') return 'linux_amd64';\n  if (trimmed === 'aarch64') return 'linux_arm64';\n  throw new ProvisioningError({\n    phase: 'install',\n    command: 'uname -m',\n    stderr: `Unsupported architecture: ${trimmed}`,\n  });\n}\n\n// ─── Helper: check if binary exists ───────────────────────────\n\nconst AGENTSH_PATHS = ['/usr/local/bin/agentsh', '/usr/bin/agentsh'];\n\nasync function binaryExists(adapter: SandboxAdapter): Promise<boolean> {\n  for (const path of AGENTSH_PATHS) {\n    const found = adapter.fileExists\n      ? await adapter.fileExists(path)\n      : (await adapter.exec('test', ['-f', path])).exitCode === 0;\n    if (found) return true;\n  }\n  return false;\n}\n\n// ─── Helper: sleep ────────────────────────────────────────────\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n// ─── Main provisioning function ───────────────────────────────\n\nexport interface ProvisionResult {\n  sessionId: string;\n  securityMode: SecurityMode;\n  /** When true, the shell shim enforces policy — skip agentsh exec wrapper. */\n  passthrough?: boolean;\n}\n\nexport async function provision(\n  adapter: SandboxAdapter,\n  config: SecureConfig = {},\n): Promise<ProvisionResult> {\n  const {\n    policy: rawPolicy,\n    workspace = '/workspace',\n    watchtower,\n    installStrategy = 'download',\n    agentshVersion = PINNED_VERSION,\n    agentshArch: archOverride,\n    agentshBinaryUrl,\n    agentshChecksum,\n    skipIntegrityCheck = false,\n    minimumSecurityMode,\n    realPaths: realPathsOverride,\n    traceParent,\n    policyName = 'policy',\n    threatFeeds,\n  } = config;\n\n  // Resolve and validate policy\n  const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();\n\n  let securityMode: SecurityMode = 'full';\n\n  if (installStrategy === 'running') {\n    // agentsh is already fully provisioned and running with the shell shim\n    // installed. Commands go through the shim automatically, so we don't\n    // create a new session (which would deadlock the server via nested\n    // agentsh connections). Instead, read the existing session ID from\n    // the environment and use passthrough mode at runtime.\n    //\n    // Skip detectSecurityMode() — running `agentsh detect` inside a sandbox\n    // where the shell shim is already installed would route the command\n    // through agentsh's exec API, causing the server to try binding port\n    // 18080 again (\"address already in use\"). Default to 'full' since\n    // pre-provisioned environments typically have full capabilities.\n    await healthCheck(adapter);\n\n    securityMode = config.securityMode ?? 'full';\n\n    if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: 'securityMode check',\n        stderr: `Security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n      });\n    }\n\n    // Read the existing session ID from config or from the environment\n    let sessionId = config.sessionId;\n    if (!sessionId) {\n      const envResult = await adapter.exec('sh', ['-c', 'echo $AGENTSH_SESSION_ID']);\n      sessionId = envResult.stdout.trim();\n    }\n    if (!sessionId) {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'echo $AGENTSH_SESSION_ID',\n        stderr: 'AGENTSH_SESSION_ID not set — running strategy requires a pre-created session',\n      });\n    }\n\n    return { sessionId, securityMode, passthrough: true };\n  }\n\n  // ─── Phase 1: Binary Installation ───────────────────────────\n\n  // Step 1: Check if binary exists\n  const exists = await binaryExists(adapter);\n\n  if (installStrategy === 'preinstalled') {\n    if (!exists) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: AGENTSH_PATHS.map(p => `test -f ${p}`).join(' || '),\n        stderr: 'Binary not found but installStrategy is preinstalled',\n      });\n    }\n    // Binary exists and strategy is preinstalled, skip to detect\n  } else if (installStrategy === 'download' || installStrategy === 'upload') {\n    // If binary already exists, skip installation but still detect\n    if (!exists) {\n      // Step 2: Detect architecture\n      const arch =\n        archOverride ?? await detectArch(adapter);\n\n      if (installStrategy === 'download') {\n        // Step 3a: Download\n        await downloadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      } else {\n        // Step 3b: Upload\n        await uploadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      }\n\n      // Step 4: Verify checksum\n      if (!skipIntegrityCheck) {\n        await verifyChecksum(\n          adapter,\n          agentshVersion,\n          arch,\n          agentshChecksum,\n          '/tmp/agentsh.tar.gz',\n        );\n      }\n\n      // Step 5: Install binaries (agentsh + agentsh-shell-shim + agentsh-unixwrap)\n      const binaries = [\n        { src: '/tmp/agentsh', dest: '/usr/local/bin/agentsh' },\n        { src: '/tmp/agentsh-shell-shim', dest: '/usr/bin/agentsh-shell-shim' },\n        { src: '/tmp/agentsh-unixwrap', dest: '/usr/local/bin/agentsh-unixwrap' },\n      ];\n      for (const { src, dest } of binaries) {\n        const installResult = await adapter.exec(\n          'install',\n          ['-m', '0755', src, dest],\n          { sudo: true },\n        );\n        if (installResult.exitCode !== 0) {\n          throw new ProvisioningError({\n            phase: 'install',\n            command: `install -m 0755 ${src} ${dest}`,\n            stderr: installResult.stderr,\n          });\n        }\n      }\n    }\n  }\n\n  // Step 5b: Detect security mode\n  securityMode = await detectSecurityMode(adapter);\n\n  // Check minimum security mode\n  if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --json',\n      stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n    });\n  }\n\n  // Auto-enable realPaths when FUSE is available (full or landlock modes),\n  // unless the user explicitly set it.\n  const hasFuse = securityMode === 'full' || securityMode === 'landlock';\n  const realPaths = realPathsOverride ?? hasFuse;\n\n  // Step 6: Install shell shim\n  const shimResult = await adapter.exec(\n    'agentsh',\n    [\n      'shim', 'install-shell',\n      '--root', '/',\n      '--shim', '/usr/bin/agentsh-shell-shim',\n      '--bash',\n      '--i-understand-this-modifies-the-host',\n    ],\n    { sudo: true },\n  );\n  if (shimResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh shim install-shell',\n      stderr: shimResult.stderr,\n    });\n  }\n\n  // ─── Phase 2: Policy & Config ───────────────────────────────\n\n  // Step 7: Create dirs and make writable for file writes\n  const mkdirResult = await adapter.exec(\n    'mkdir',\n    ['-p', '/etc/agentsh/system'],\n    { sudo: true },\n  );\n  if (mkdirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'mkdir -p /etc/agentsh/system',\n      stderr: mkdirResult.stderr,\n    });\n  }\n\n  // Temporarily make writable so adapter.writeFile (which may not support sudo) can write\n  await adapter.exec('chmod', ['-R', '777', '/etc/agentsh/'], { sudo: true });\n\n  await adapter.writeFile(\n    '/etc/agentsh/system/policy.yml',\n    systemPolicyYaml(),\n    { sudo: true },\n  );\n\n  // Step 8: Write user policy\n  await adapter.writeFile(\n    '/etc/agentsh/policy.yml',\n    serializePolicy(policy),\n    { sudo: true },\n  );\n\n  // Step 9: Write server config\n  const serverConfig = generateServerConfig({\n    watchtower,\n    realPaths,\n    threatFeeds,\n  });\n\n  await adapter.writeFile('/etc/agentsh/config.yml', serverConfig, {\n    sudo: true,\n  });\n\n  // Step 10: Set permissions\n  const chmodDirResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'd', '-exec', 'chmod', '555', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodDirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type d -exec chmod 555 {} +',\n      stderr: chmodDirResult.stderr,\n    });\n  }\n\n  const chmodFileResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'f', '-exec', 'chmod', '444', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodFileResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type f -exec chmod 444 {} +',\n      stderr: chmodFileResult.stderr,\n    });\n  }\n\n  const chownResult = await adapter.exec(\n    'chown',\n    ['-R', 'root:root', '/etc/agentsh/'],\n    { sudo: true },\n  );\n  if (chownResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'chown -R root:root /etc/agentsh/',\n      stderr: chownResult.stderr,\n    });\n  }\n\n  // ─── Phase 3: Server Startup ────────────────────────────────\n\n  // Step 10b: Ensure workspace directory exists\n  await adapter.exec('mkdir', ['-p', workspace], { sudo: true });\n\n  // Step 11: Start server\n  const serverResult = await adapter.exec(\n    'agentsh',\n    ['server', '--config', '/etc/agentsh/config.yml'],\n    { detached: true, sudo: true },\n  );\n  if (serverResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'startup',\n      command: 'agentsh server --config /etc/agentsh/config.yml',\n      stderr: serverResult.stderr,\n    });\n  }\n\n  // Step 12: Health check\n  await healthCheck(adapter);\n\n  // Step 13: Create session\n  const sessionResult = await adapter.exec('agentsh', [\n    'session',\n    'create',\n    '--workspace',\n    workspace,\n    '--policy',\n    'policy',\n  ]);\n  if (sessionResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'session',\n      command: 'agentsh session create',\n      stderr: sessionResult.stderr,\n    });\n  }\n\n  let sessionId: string;\n  try {\n    const sessionData = JSON.parse(sessionResult.stdout);\n    sessionId = sessionData.session_id;\n  } catch {\n    // Fallback: parse text output like \"Session session-xxx started\"\n    const match = sessionResult.stdout.match(/Session\\s+(session-[^\\s]+)/);\n    if (match) {\n      sessionId = match[1];\n    } else {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'agentsh session create',\n        stderr: `Failed to parse session output: ${sessionResult.stdout}`,\n      });\n    }\n  }\n\n  // Step 13b: Set trace context if traceParent is provided or OTEL span is active\n  const effectiveTraceParent = traceParent ?? (await getTraceparent());\n  if (effectiveTraceParent) {\n    await adapter.exec('curl', [\n      '-X',\n      'PUT',\n      `http://127.0.0.1:18080/sessions/${sessionId}/trace-context`,\n      '-H',\n      'Content-Type: application/json',\n      '-d',\n      JSON.stringify({ traceparent: effectiveTraceParent }),\n    ]);\n  }\n\n  // ─── Phase 4: Handoff ───────────────────────────────────────\n\n  // Step 14: Return result\n  return { sessionId, securityMode };\n}\n\n// ─── Phase 1 helpers ──────────────────────────────────────────\n\nasync function detectArch(\n  adapter: SandboxAdapter,\n): Promise<'linux_amd64' | 'linux_arm64'> {\n  const result = await adapter.exec('uname', ['-m']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'uname -m',\n      stderr: result.stderr,\n    });\n  }\n  return mapArch(result.stdout);\n}\n\nasync function downloadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Try curl first\n  const curlResult = await adapter.exec('curl', [\n    '-fsSL',\n    url,\n    '-o',\n    '/tmp/agentsh.tar.gz',\n  ]);\n\n  if (curlResult.exitCode !== 0) {\n    // Fallback to wget (may not be available on all platforms)\n    let wgetResult: ExecResult;\n    try {\n      wgetResult = await adapter.exec('wget', [\n        '-q',\n        url,\n        '-O',\n        '/tmp/agentsh.tar.gz',\n      ]);\n    } catch {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `curl -fsSL ${url} -o /tmp/agentsh.tar.gz`,\n        stderr: curlResult.stderr || 'Download failed (curl failed, wget not available)',\n      });\n    }\n    if (wgetResult.exitCode !== 0) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `wget -q ${url} -O /tmp/agentsh.tar.gz`,\n        stderr: wgetResult.stderr,\n      });\n    }\n  }\n\n  // Extract\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function uploadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Download on host side using fetch (Node 18+)\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: `fetch ${url}`,\n      stderr: `HTTP ${response.status}: ${response.statusText}`,\n    });\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n\n  // Upload tarball to sandbox and extract\n  await adapter.writeFile('/tmp/agentsh.tar.gz', buffer);\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function verifyChecksum(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  checksumOverride: string | undefined,\n  filePath: string,\n): Promise<void> {\n  const expected = getChecksum(version, arch, checksumOverride);\n  const commands = buildVerifyCommand(filePath);\n\n  let actual: string | undefined;\n\n  for (const cmd of commands) {\n    const result = await adapter.exec('sh', ['-c', cmd]);\n    if (result.exitCode === 0 && result.stdout.trim()) {\n      actual = result.stdout.trim();\n      break;\n    }\n  }\n\n  if (actual === undefined) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'sha256sum / shasum / openssl',\n      stderr: 'No checksum tool available in sandbox',\n    });\n  }\n\n  if (actual !== expected) {\n    throw new IntegrityError({\n      expected,\n      actual,\n      message: `Checksum mismatch: expected ${expected}, got ${actual}`,\n    });\n  }\n}\n\nasync function detectSecurityMode(\n  adapter: SandboxAdapter,\n): Promise<SecurityMode> {\n  const result = await adapter.exec('agentsh', ['detect', '--output', 'json']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: result.stderr,\n    });\n  }\n\n  // agentsh detect outputs JSON to stderr\n  const jsonOutput = result.stderr || result.stdout;\n  let parsed: { security_mode: string };\n  try {\n    parsed = JSON.parse(jsonOutput);\n  } catch {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Failed to parse detect JSON: ${jsonOutput.slice(0, 200)}`,\n    });\n  }\n\n  const mode = parsed.security_mode;\n  const validModes: SecurityMode[] = ['full', 'landlock', 'landlock-only', 'minimal'];\n  if (!validModes.includes(mode as SecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Unknown security mode: '${mode}'`,\n    });\n  }\n  return mode as SecurityMode;\n}\n\nasync function healthCheck(adapter: SandboxAdapter): Promise<void> {\n  const maxRetries = 10;\n  const delayMs = 500;\n\n  for (let i = 0; i < maxRetries; i++) {\n    const result = await adapter.exec('curl', [\n      '-sf',\n      'http://127.0.0.1:18080/health',\n    ]);\n    if (result.exitCode === 0) {\n      return;\n    }\n    if (i < maxRetries - 1) {\n      await sleep(delayMs);\n    }\n  }\n\n  throw new ProvisioningError({\n    phase: 'startup',\n    command: 'curl http://127.0.0.1:18080/health',\n    stderr: 'Health check failed after 10 attempts',\n  });\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport { RuntimeError } from './errors.js';\nimport { getTraceparent } from './traceparent.js';\n\n/** Build env object with TRACEPARENT if an OTEL span is active. */\nasync function traceEnv(): Promise<Record<string, string> | undefined> {\n  const tp = await getTraceparent();\n  return tp ? { TRACEPARENT: tp } : undefined;\n}\n\n/** Parse the JSON envelope from `agentsh exec --output json`. */\nfunction parseExecJson(raw: ExecResult): ExecResult {\n  try {\n    const json = JSON.parse(raw.stdout);\n    const result = json.result ?? {};\n    return {\n      exitCode: result.exit_code ?? raw.exitCode,\n      stdout: result.stdout ?? '',\n      stderr: result.stderr ?? result.error?.message ?? '',\n    };\n  } catch {\n    // If not valid JSON, return as-is (e.g. mock adapters)\n    return raw;\n  }\n}\n\nexport function createSecuredSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n  options?: { passthrough?: boolean },\n): SecuredSandbox {\n  if (options?.passthrough) {\n    return createPassthroughSandbox(adapter, sessionId, securityMode);\n  }\n  return createAgentshSandbox(adapter, sessionId, securityMode);\n}\n\n/**\n * Passthrough mode: the shell shim enforces policy on every command,\n * so we run commands directly through the adapter without wrapping\n * them in `agentsh exec`. Used with the 'running' install strategy.\n */\nfunction createPassthroughSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const result = await adapter.exec('bash', ['-c', command], {\n        cwd: opts?.cwd,\n      });\n      return result;\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const result = await adapter.exec('sh', [\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const result = await adapter.exec('cat', [path]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\n/** Standard mode: wraps commands in `agentsh exec` for policy enforcement. */\nfunction createAgentshSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const args = [\n        'exec',\n        '--output',\n        'json',\n        sessionId,\n        '--',\n        'bash',\n        '-c',\n        command,\n      ];\n      const env = await traceEnv();\n      const execOpts = { cwd: opts?.cwd, env };\n      const result = await adapter.exec('agentsh', args, execOpts);\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command,\n          stderr: result.stderr,\n        });\n      }\n      return parseExecJson(result);\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const args = [\n        'exec',\n        sessionId,\n        '--',\n        'sh',\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `writeFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const args = ['exec', sessionId, '--', 'cat', path];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `readFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\nfunction isTransportFailure(result: ExecResult): boolean {\n  return result.exitCode === 127 && result.stderr.includes('agentsh');\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecureConfig,\n} from './core/types.js';\nimport { provision } from './core/provision.js';\nimport { createSecuredSandbox } from './core/runtime.js';\n\nexport async function secureSandbox(\n  adapter: SandboxAdapter,\n  config?: SecureConfig,\n): Promise<SecuredSandbox> {\n  const resolvedConfig = config ?? {};\n  const { sessionId, securityMode, passthrough } = await provision(adapter, {\n    workspace: '/workspace',\n    ...resolvedConfig,\n  });\n  return createSecuredSandbox(adapter, sessionId, securityMode, { passthrough });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,IAAM,iBAAiB;AAEvB,IAAM,YAAoD;AAAA,EAC/D,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AAAA,EACA,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AACF;AAQO,SAAS,YACd,SACA,MACA,UACQ;AACR,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,mBAAmB,UAAU,OAAO;AAC1C,MAAI,oBAAoB,iBAAiB,IAAI,GAAG;AAC9C,WAAO,iBAAiB,IAAI;AAAA,EAC9B;AAEA,QAAM,IAAI,eAAe;AAAA,IACvB,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,mCAAmC,OAAO;AAAA,EACrD,CAAC;AACH;AAMO,SAAS,mBAAmB,UAA4B;AAC7D,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,kBAAkB,QAAQ;AAAA,IAC1B,yBAAyB,QAAQ;AAAA,EACnC;AACF;AAOO,SAAS,UACd,SACA,MACA,aACQ;AACR,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,SAAO,4DAA4D,OAAO,YAAY,OAAO,IAAI,IAAI;AACvG;;;ACzEA,OAAO,UAAU;AAaV,IAAM,qBAAwC;AAAA,EACnD,QAAQ;AAAA,EACR,OAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,MAAgC;AACnE,QAAM,SAAkC;AAAA,IACtC,QAAQ;AAAA,MACN,MAAM;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,SAAS;AAAA,IACX;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,MAAM,EAAE,SAAS,KAAK;AAAA,MACtB,SAAS,EAAE,SAAS,KAAK;AAAA,MACzB,SAAS,EAAE,SAAS,KAAK;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,KAAK,WAAY,QAAO,aAAa,KAAK;AAC9C,MAAI,KAAK,UAAW,QAAO,WAAW,EAAE,YAAY,KAAK;AAGzD,QAAM,QAAQ,KAAK,gBAAgB,QAAQ,SAAa,KAAK,eAAe;AAC5E,MAAI,OAAO;AACT,WAAO,eAAe;AAAA,MACpB,SAAS;AAAA,MACT,QAAQ,MAAM,UAAU;AAAA,MACxB,OAAO,MAAM,MAAM,IAAI,QAAM;AAAA,QAC3B,MAAM,EAAE;AAAA,QACR,KAAK,EAAE;AAAA,QACP,QAAQ,EAAE;AAAA,QACV,kBAAkB,EAAE,mBAAmB;AAAA,MACzC,EAAE;AAAA,MACF,GAAI,MAAM,WAAW,SAAS,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,KAAK,KAAK,QAAQ,EAAE,WAAW,GAAG,CAAC;AAC5C;;;AChFA,eAAsB,iBAA8C;AAClE,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,mBAAoB;AACnD,UAAM,OAAO,MAAM,cAAc;AACjC,UAAM,MAAM,MAAM,YAAY;AAC9B,QAAI,CAAC,KAAK,WAAW,IAAI,YAAY,oCAAoC;AACvE,aAAO;AAAA,IACT;AACA,UAAM,SAAS,IAAI,cAAc,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAChE,WAAO,MAAM,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACCA,IAAM,qBAAmD;AAAA,EACvD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,SAAS;AACX;AAEA,SAAS,aAAa,UAAwB,UAAiC;AAC7E,SAAO,mBAAmB,QAAQ,IAAI,mBAAmB,QAAQ;AACnE;AAIA,SAAS,QAAQ,OAA8C;AAC7D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,SAAU,QAAO;AACjC,MAAI,YAAY,UAAW,QAAO;AAClC,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ,6BAA6B,OAAO;AAAA,EAC9C,CAAC;AACH;AAIA,IAAM,gBAAgB,CAAC,0BAA0B,kBAAkB;AAEnE,eAAe,aAAa,SAA2C;AACrE,aAAW,QAAQ,eAAe;AAChC,UAAM,QAAQ,QAAQ,aAClB,MAAM,QAAQ,WAAW,IAAI,KAC5B,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa;AAC5D,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAIA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAWA,eAAsB,UACpB,SACA,SAAuB,CAAC,GACE;AAC1B,QAAM;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ;AAAA,IACA,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA,aAAa;AAAA,IACb;AAAA,EACF,IAAI;AAGJ,QAAM,SAAS,YAAY,eAAe,SAAS,IAAI,aAAa;AAEpE,MAAI,eAA6B;AAEjC,MAAI,oBAAoB,WAAW;AAYjC,UAAM,YAAY,OAAO;AAEzB,mBAAe,OAAO,gBAAgB;AAEtC,QAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,kBAAkB,YAAY,8BAA8B,mBAAmB;AAAA,MACzF,CAAC;AAAA,IACH;AAGA,QAAIA,aAAY,OAAO;AACvB,QAAI,CAACA,YAAW;AACd,YAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,0BAA0B,CAAC;AAC7E,MAAAA,aAAY,UAAU,OAAO,KAAK;AAAA,IACpC;AACA,QAAI,CAACA,YAAW;AACd,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,WAAAA,YAAW,cAAc,aAAa,KAAK;AAAA,EACtD;AAKA,QAAM,SAAS,MAAM,aAAa,OAAO;AAEzC,MAAI,oBAAoB,gBAAgB;AACtC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,IAAI,OAAK,WAAW,CAAC,EAAE,EAAE,KAAK,MAAM;AAAA,QAC3D,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EAEF,WAAW,oBAAoB,cAAc,oBAAoB,UAAU;AAEzE,QAAI,CAAC,QAAQ;AAEX,YAAM,OACJ,gBAAgB,MAAM,WAAW,OAAO;AAE1C,UAAI,oBAAoB,YAAY;AAElC,cAAM,eAAe,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACtE,OAAO;AAEL,cAAM,aAAa,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACpE;AAGA,UAAI,CAAC,oBAAoB;AACvB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,WAAW;AAAA,QACf,EAAE,KAAK,gBAAgB,MAAM,yBAAyB;AAAA,QACtD,EAAE,KAAK,2BAA2B,MAAM,8BAA8B;AAAA,QACtE,EAAE,KAAK,yBAAyB,MAAM,kCAAkC;AAAA,MAC1E;AACA,iBAAW,EAAE,KAAK,KAAK,KAAK,UAAU;AACpC,cAAM,gBAAgB,MAAM,QAAQ;AAAA,UAClC;AAAA,UACA,CAAC,MAAM,QAAQ,KAAK,IAAI;AAAA,UACxB,EAAE,MAAM,KAAK;AAAA,QACf;AACA,YAAI,cAAc,aAAa,GAAG;AAChC,gBAAM,IAAI,kBAAkB;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS,mBAAmB,GAAG,IAAI,IAAI;AAAA,YACvC,QAAQ,cAAc;AAAA,UACxB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,MAAM,mBAAmB,OAAO;AAG/C,MAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,YAAY,8BAA8B,mBAAmB;AAAA,IAClG,CAAC;AAAA,EACH;AAIA,QAAM,UAAU,iBAAiB,UAAU,iBAAiB;AAC5D,QAAM,YAAY,qBAAqB;AAGvC,QAAM,aAAa,MAAM,QAAQ;AAAA,IAC/B;AAAA,IACA;AAAA,MACE;AAAA,MAAQ;AAAA,MACR;AAAA,MAAU;AAAA,MACV;AAAA,MAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,WAAW,aAAa,GAAG;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH;AAKA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,qBAAqB;AAAA,IAC5B,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAGA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,OAAO,eAAe,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1E,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,iBAAiB;AAAA,IACjB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,eAAe,qBAAqB;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,UAAU,2BAA2B,cAAc;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AAGD,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,eAAe,aAAa,GAAG;AACjC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,eAAe;AAAA,IACzB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,QAAQ;AAAA,IACpC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,gBAAgB,aAAa,GAAG;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gBAAgB;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,aAAa,eAAe;AAAA,IACnC,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAKA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,SAAS,GAAG,EAAE,MAAM,KAAK,CAAC;AAG7D,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC;AAAA,IACA,CAAC,UAAU,YAAY,yBAAyB;AAAA,IAChD,EAAE,UAAU,MAAM,MAAM,KAAK;AAAA,EAC/B;AACA,MAAI,aAAa,aAAa,GAAG;AAC/B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,aAAa;AAAA,IACvB,CAAC;AAAA,EACH;AAGA,QAAM,YAAY,OAAO;AAGzB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,WAAW;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,cAAc,aAAa,GAAG;AAChC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,cAAc;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,KAAK,MAAM,cAAc,MAAM;AACnD,gBAAY,YAAY;AAAA,EAC1B,QAAQ;AAEN,UAAM,QAAQ,cAAc,OAAO,MAAM,4BAA4B;AACrE,QAAI,OAAO;AACT,kBAAY,MAAM,CAAC;AAAA,IACrB,OAAO;AACL,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,mCAAmC,cAAc,MAAM;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,uBAAuB,eAAgB,MAAM,eAAe;AAClE,MAAI,sBAAsB;AACxB,UAAM,QAAQ,KAAK,QAAQ;AAAA,MACzB;AAAA,MACA;AAAA,MACA,mCAAmC,SAAS;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,UAAU,EAAE,aAAa,qBAAqB,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAKA,SAAO,EAAE,WAAW,aAAa;AACnC;AAIA,eAAe,WACb,SACwC;AACxC,QAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC;AACjD,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,OAAO,MAAM;AAC9B;AAEA,eAAe,eACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,aAAa,GAAG;AAE7B,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,GAAG;AAAA,QAC1B,QAAQ,WAAW,UAAU;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,aAAa,GAAG;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,WAAW,GAAG;AAAA,QACvB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,aACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS,SAAS,GAAG;AAAA,MACrB,QAAQ,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AAGvD,QAAM,QAAQ,UAAU,uBAAuB,MAAM;AACrD,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,eACb,SACA,SACA,MACA,kBACA,UACe;AACf,QAAM,WAAW,YAAY,SAAS,MAAM,gBAAgB;AAC5D,QAAM,WAAW,mBAAmB,QAAQ;AAE5C,MAAI;AAEJ,aAAW,OAAO,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;AACnD,QAAI,OAAO,aAAa,KAAK,OAAO,OAAO,KAAK,GAAG;AACjD,eAAS,OAAO,OAAO,KAAK;AAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,eAAe;AAAA,MACvB;AAAA,MACA;AAAA,MACA,SAAS,+BAA+B,QAAQ,SAAS,MAAM;AAAA,IACjE,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBACb,SACuB;AACvB,QAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,CAAC,UAAU,YAAY,MAAM,CAAC;AAC3E,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,QAAM,aAAa,OAAO,UAAU,OAAO;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gCAAgC,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,IAClE,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,aAA6B,CAAC,QAAQ,YAAY,iBAAiB,SAAS;AAClF,MAAI,CAAC,WAAW,SAAS,IAAoB,GAAG;AAC9C,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,IAAI;AAAA,IACzC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,YAAY,SAAwC;AACjE,QAAM,aAAa;AACnB,QAAM,UAAU;AAEhB,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,UAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ;AAAA,MACxC;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,OAAO,aAAa,GAAG;AACzB;AAAA,IACF;AACA,QAAI,IAAI,aAAa,GAAG;AACtB,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,EACV,CAAC;AACH;;;ACxlBA,eAAe,WAAwD;AACrE,QAAM,KAAK,MAAM,eAAe;AAChC,SAAO,KAAK,EAAE,aAAa,GAAG,IAAI;AACpC;AAGA,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,WAAO;AAAA,MACL,UAAU,OAAO,aAAa,IAAI;AAAA,MAClC,QAAQ,OAAO,UAAU;AAAA,MACzB,QAAQ,OAAO,UAAU,OAAO,OAAO,WAAW;AAAA,IACpD;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBACd,SACA,WACA,cACA,SACgB;AAChB,MAAI,SAAS,aAAa;AACxB,WAAO,yBAAyB,SAAS,WAAW,YAAY;AAAA,EAClE;AACA,SAAO,qBAAqB,SAAS,WAAW,YAAY;AAC9D;AAOA,SAAS,yBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,OAAO,GAAG;AAAA,QACzD,KAAK,MAAM;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC;AAC/C,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAGA,SAAS,qBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,WAAW,EAAE,KAAK,MAAM,KAAK,IAAI;AACvC,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,QAAQ;AAC3D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA;AAAA,UACA,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,aAAO,cAAc,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,aAAa,IAAI;AAAA,UAC1B,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,CAAC,QAAQ,WAAW,MAAM,OAAO,IAAI;AAClD,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,YAAY,IAAI;AAAA,UACzB,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,QAA6B;AACvD,SAAO,OAAO,aAAa,OAAO,OAAO,OAAO,SAAS,SAAS;AACpE;;;AC5LA,eAAsB,cACpB,SACA,QACyB;AACzB,QAAM,iBAAiB,UAAU,CAAC;AAClC,QAAM,EAAE,WAAW,cAAc,YAAY,IAAI,MAAM,UAAU,SAAS;AAAA,IACxE,WAAW;AAAA,IACX,GAAG;AAAA,EACL,CAAC;AACD,SAAO,qBAAqB,SAAS,WAAW,cAAc,EAAE,YAAY,CAAC;AAC/E;","names":["sessionId"]}
+{"version":3,"sources":["../src/core/integrity.ts","../src/core/config.ts","../src/core/traceparent.ts","../src/core/provision.ts","../src/core/runtime.ts","../src/api.ts"],"sourcesContent":["import { IntegrityError } from './errors.js';\n\nexport const PINNED_VERSION = '0.15.0';\n\nexport const CHECKSUMS: Record<string, Record<string, string>> = {\n  '0.15.0': {\n    linux_amd64:\n      '89f7ebbfd75ffd961245ec62b2602fd0cc387740502ac858dbc39c367c5699c5',\n    linux_arm64:\n      '3fabbd749f9e98fb9f96ddfc94c389a6868cda7ed3668daa8440c39ceec85f3b',\n  },\n  '0.14.0': {\n    linux_amd64:\n      '2ab8ba0d6637fe1a5badf840c3db197161a6f9865d721ed216029d229b1b9bbc',\n    linux_arm64:\n      '929d18dd9fe36e9b2fa830d7ae64b4fb481853e743ade8674fcfcdc73470ed53',\n  },\n};\n\n/**\n * Returns the checksum to verify against.\n * If `override` is provided, returns it directly.\n * Otherwise looks up the checksum in the pinned CHECKSUMS map.\n * Throws IntegrityError if no checksum is found.\n */\nexport function getChecksum(\n  version: string,\n  arch: string,\n  override?: string,\n): string {\n  if (override) {\n    return override;\n  }\n\n  const versionChecksums = CHECKSUMS[version];\n  if (versionChecksums && versionChecksums[arch]) {\n    return versionChecksums[arch];\n  }\n\n  throw new IntegrityError({\n    expected: '',\n    actual: '',\n    message: `No pinned checksum for agentsh v${version}. Provide \\`agentshChecksum\\` explicitly or use \\`skipIntegrityCheck: true\\`.`,\n  });\n}\n\n/**\n * Returns an array of shell commands to try for computing SHA-256 checksums.\n * Each command extracts just the hex hash value from the given file.\n */\nexport function buildVerifyCommand(filePath: string): string[] {\n  return [\n    `sha256sum \"${filePath}\" | awk '{print $1}'`,\n    `shasum -a 256 \"${filePath}\" | awk '{print $1}'`,\n    `openssl dgst -sha256 \"${filePath}\" | awk '{print $NF}'`,\n  ];\n}\n\n/**\n * Returns the download URL for the agentsh binary.\n * If `overrideUrl` is provided, returns it directly.\n * Otherwise returns the default GitHub releases URL.\n */\nexport function binaryUrl(\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  return `https://github.com/canyonroad/agentsh/releases/download/v${version}/agentsh_${version}_${arch}.tar.gz`;\n}\n","import yaml from 'js-yaml';\nimport type { ThreatFeedsConfig, PackageChecksConfig, ProviderConfig } from './types.js';\n\nexport interface ServerConfigOpts {\n  watchtower?: string;\n  realPaths?: boolean;\n  threatFeeds?: false | ThreatFeedsConfig;\n  packageChecks?: false | PackageChecksConfig;\n  grpc?: { addr: string };\n  serverTimeouts?: { readTimeout?: string; writeTimeout?: string; maxRequestSize?: string };\n  logging?: { level?: string; format?: string; output?: string };\n  sessions?: { baseDir?: string; maxSessions?: number; defaultTimeout?: string; idleTimeout?: string; cleanupInterval?: string };\n  audit?: { enabled?: boolean; sqlitePath?: string };\n  sandboxLimits?: { maxMemoryMb?: number; maxCpuPercent?: number; maxProcesses?: number };\n  fuse?: { deferred?: boolean };\n  networkIntercept?: { interceptMode?: string; proxyListenAddr?: string };\n  seccompDetails?: { execve?: boolean; fileMonitor?: { enabled?: boolean; enforceWithoutFuse?: boolean } };\n  cgroups?: { enabled?: boolean };\n  unixSockets?: { enabled?: boolean };\n  proxy?: { mode?: string; port?: number; providers?: Record<string, string> };\n  dlp?: { mode?: string; patterns?: Record<string, boolean>; customPatterns?: Array<{ name: string; display: string; regex: string }> };\n  policiesOverride?: { dir?: string; defaultPolicy?: string };\n  approvals?: { enabled?: boolean; mode?: string; timeout?: string };\n  metrics?: { enabled?: boolean; path?: string };\n  health?: { path?: string; readinessPath?: string };\n  development?: { disableAuth?: boolean; verboseErrors?: boolean };\n}\n\n/**\n * Default threat feeds: URLhaus (malware) + Phishing.Database (phishing).\n * Both are free, open source, and updated frequently.\n */\nexport const defaultThreatFeeds: ThreatFeedsConfig = {\n  action: 'deny',\n  feeds: [\n    {\n      name: 'urlhaus',\n      url: 'https://urlhaus.abuse.ch/downloads/hostfile/',\n      format: 'hostfile',\n      refreshInterval: '6h',\n    },\n    {\n      name: 'phishing',\n      url: 'https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-domains-ACTIVE.txt',\n      format: 'domain-list',\n      refreshInterval: '12h',\n    },\n  ],\n  allowlist: [\n    'github.com',\n    '*.github.com',\n    'registry.npmjs.org',\n    'registry.yarnpkg.com',\n    'pypi.org',\n    'files.pythonhosted.org',\n    'crates.io',\n    'static.crates.io',\n    'index.crates.io',\n    'proxy.golang.org',\n    'sum.golang.org',\n  ],\n};\n\n/**\n * Default package check providers: local, osv, depsdev.\n * All are free and require no API key.\n */\nexport const defaultPackageCheckProviders: Record<string, { enabled: boolean; priority: number }> = {\n  local: { enabled: true, priority: 0 },\n  osv: { enabled: true, priority: 1 },\n  depsdev: { enabled: true, priority: 2 },\n};\n\n/**\n * Convert a camelCase ProviderConfig key to snake_case.\n */\nfunction providerConfigToSnakeCase(config: ProviderConfig): Record<string, unknown> {\n  const result: Record<string, unknown> = { enabled: config.enabled ?? true };\n  if (config.priority !== undefined) result.priority = config.priority;\n  if (config.timeout !== undefined) result.timeout = config.timeout;\n  if (config.onFailure !== undefined) result.on_failure = config.onFailure;\n  if (config.apiKeyEnv !== undefined) result.api_key_env = config.apiKeyEnv;\n  if (config.type !== undefined) result.type = config.type;\n  if (config.command !== undefined) result.command = config.command;\n  if (config.options !== undefined) result.options = config.options;\n  return result;\n}\n\nexport function generateServerConfig(opts: ServerConfigOpts): string {\n  const config: Record<string, unknown> = {\n    server: {\n      http: {\n        addr: '127.0.0.1:18080',\n      },\n    },\n    auth: {\n      type: 'none',\n    },\n    policies: {\n      system_dir: '/etc/agentsh/system',\n      dir: '/etc/agentsh',\n      default: 'policy',\n    },\n    sandbox: {\n      enabled: true,\n      allow_degraded: true,\n      fuse: { enabled: true },\n      network: { enabled: true },\n      seccomp: { enabled: true },\n    },\n  };\n  if (opts.watchtower) config.watchtower = opts.watchtower;\n\n  // ─── Extended config sections ─────────────────────────────────\n\n  // gRPC\n  if (opts.grpc) {\n    (config.server as any).grpc = { enabled: true, addr: opts.grpc.addr };\n  }\n\n  // Server timeouts → merge into server.http\n  if (opts.serverTimeouts) {\n    const http = (config.server as any).http;\n    if (opts.serverTimeouts.readTimeout) http.read_timeout = opts.serverTimeouts.readTimeout;\n    if (opts.serverTimeouts.writeTimeout) http.write_timeout = opts.serverTimeouts.writeTimeout;\n    if (opts.serverTimeouts.maxRequestSize) http.max_request_size = opts.serverTimeouts.maxRequestSize;\n  }\n\n  // Logging\n  if (opts.logging) config.logging = { ...opts.logging };\n\n  // Sessions (merge realPaths + extended sessions)\n  const sessionsObj: Record<string, unknown> = {};\n  if (opts.realPaths) sessionsObj.real_paths = true;\n  if (opts.sessions) {\n    if (opts.sessions.baseDir) sessionsObj.base_dir = opts.sessions.baseDir;\n    if (opts.sessions.maxSessions !== undefined) sessionsObj.max_sessions = opts.sessions.maxSessions;\n    if (opts.sessions.defaultTimeout) sessionsObj.default_timeout = opts.sessions.defaultTimeout;\n    if (opts.sessions.idleTimeout) sessionsObj.idle_timeout = opts.sessions.idleTimeout;\n    if (opts.sessions.cleanupInterval) sessionsObj.cleanup_interval = opts.sessions.cleanupInterval;\n  }\n  if (Object.keys(sessionsObj).length > 0) config.sessions = sessionsObj;\n\n  // Audit\n  if (opts.audit) {\n    const auditObj: Record<string, unknown> = {};\n    if (opts.audit.enabled !== undefined) auditObj.enabled = opts.audit.enabled;\n    if (opts.audit.sqlitePath) auditObj.sqlite_path = opts.audit.sqlitePath;\n    config.audit = auditObj;\n  }\n\n  // Sandbox limits\n  if (opts.sandboxLimits) {\n    (config.sandbox as any).limits = {\n      ...(opts.sandboxLimits.maxMemoryMb !== undefined && { max_memory_mb: opts.sandboxLimits.maxMemoryMb }),\n      ...(opts.sandboxLimits.maxCpuPercent !== undefined && { max_cpu_percent: opts.sandboxLimits.maxCpuPercent }),\n      ...(opts.sandboxLimits.maxProcesses !== undefined && { max_processes: opts.sandboxLimits.maxProcesses }),\n    };\n  }\n\n  // FUSE deferred\n  if (opts.fuse?.deferred !== undefined) {\n    (config.sandbox as any).fuse.deferred = opts.fuse.deferred;\n  }\n\n  // Network intercept\n  if (opts.networkIntercept) {\n    const net = (config.sandbox as any).network;\n    if (opts.networkIntercept.interceptMode) net.intercept_mode = opts.networkIntercept.interceptMode;\n    if (opts.networkIntercept.proxyListenAddr) net.proxy_listen_addr = opts.networkIntercept.proxyListenAddr;\n  }\n\n  // Seccomp details\n  if (opts.seccompDetails) {\n    const sec = (config.sandbox as any).seccomp;\n    if (opts.seccompDetails.execve !== undefined) sec.execve = opts.seccompDetails.execve;\n    if (opts.seccompDetails.fileMonitor) {\n      sec.file_monitor = {\n        ...(opts.seccompDetails.fileMonitor.enabled !== undefined && { enabled: opts.seccompDetails.fileMonitor.enabled }),\n        ...(opts.seccompDetails.fileMonitor.enforceWithoutFuse !== undefined && { enforce_without_fuse: opts.seccompDetails.fileMonitor.enforceWithoutFuse }),\n      };\n    }\n  }\n\n  // Cgroups\n  if (opts.cgroups) {\n    (config.sandbox as any).cgroups = { ...opts.cgroups };\n  }\n\n  // Unix sockets\n  if (opts.unixSockets) {\n    (config.sandbox as any).unix_sockets = { ...opts.unixSockets };\n  }\n\n  // Proxy\n  if (opts.proxy) {\n    config.proxy = { ...opts.proxy };\n  }\n\n  // DLP\n  if (opts.dlp) {\n    const dlpObj: Record<string, unknown> = {};\n    if (opts.dlp.mode) dlpObj.mode = opts.dlp.mode;\n    if (opts.dlp.patterns) dlpObj.patterns = opts.dlp.patterns;\n    if (opts.dlp.customPatterns) {\n      dlpObj.custom_patterns = opts.dlp.customPatterns.map(p => ({\n        name: p.name,\n        display: p.display,\n        regex: p.regex,\n      }));\n    }\n    config.dlp = dlpObj;\n  }\n\n  // Policies override\n  if (opts.policiesOverride) {\n    config.policies = {\n      ...(opts.policiesOverride.dir && { dir: opts.policiesOverride.dir }),\n      ...(opts.policiesOverride.defaultPolicy && { default: opts.policiesOverride.defaultPolicy }),\n    };\n  }\n\n  // Approvals\n  if (opts.approvals) config.approvals = { ...opts.approvals };\n\n  // Metrics\n  if (opts.metrics) config.metrics = { ...opts.metrics };\n\n  // Health\n  if (opts.health) {\n    const healthObj: Record<string, unknown> = {};\n    if (opts.health.path) healthObj.path = opts.health.path;\n    if (opts.health.readinessPath) healthObj.readiness_path = opts.health.readinessPath;\n    config.health = healthObj;\n  }\n\n  // Development\n  if (opts.development) {\n    const devObj: Record<string, unknown> = {};\n    if (opts.development.disableAuth !== undefined) devObj.disable_auth = opts.development.disableAuth;\n    if (opts.development.verboseErrors !== undefined) devObj.verbose_errors = opts.development.verboseErrors;\n    config.development = devObj;\n  }\n\n  // Threat feeds: enabled by default, opt-out with `threatFeeds: false`\n  const feeds = opts.threatFeeds === false ? undefined : (opts.threatFeeds ?? defaultThreatFeeds);\n  if (feeds) {\n    config.threat_feeds = {\n      enabled: true,\n      action: feeds.action ?? 'deny',\n      feeds: feeds.feeds.map(f => ({\n        name: f.name,\n        url: f.url,\n        format: f.format,\n        refresh_interval: f.refreshInterval ?? '6h',\n      })),\n      ...(feeds.allowlist?.length ? { allowlist: feeds.allowlist } : {}),\n    };\n  }\n\n  // Package checks: disabled by default, opt-in with `packageChecks: {}`\n  if (opts.packageChecks) {\n    const pc = opts.packageChecks;\n    const providers: Record<string, Record<string, unknown>> = {};\n\n    // Start with defaults\n    for (const [name, def] of Object.entries(defaultPackageCheckProviders)) {\n      providers[name] = { ...def };\n    }\n\n    // Merge user-provided providers\n    if (pc.providers) {\n      for (const [name, value] of Object.entries(pc.providers)) {\n        if (value === false) {\n          providers[name] = { enabled: false };\n        } else if (value === true) {\n          providers[name] = { ...(providers[name] ?? {}), enabled: true };\n        } else {\n          // ProviderConfig object — merge with existing default if present\n          const base = providers[name] ?? {};\n          providers[name] = { ...base, ...providerConfigToSnakeCase(value) };\n        }\n      }\n    }\n\n    config.package_checks = {\n      enabled: true,\n      scope: pc.scope ?? 'new_packages_only',\n      providers,\n    };\n  }\n\n  return yaml.dump(config, { lineWidth: -1 });\n}\n","/**\n * Read W3C traceparent from the active OpenTelemetry span, if available.\n *\n * Uses dynamic import so @opentelemetry/api is an optional peer dependency.\n * Returns undefined when OTEL is not installed, no span is active, or the\n * trace context is invalid (all-zero trace ID).\n */\nexport async function getTraceparent(): Promise<string | undefined> {\n  try {\n    const { trace } = await import('@opentelemetry/api');\n    const span = trace.getActiveSpan();\n    const ctx = span?.spanContext();\n    if (!ctx?.traceId || ctx.traceId === '00000000000000000000000000000000') {\n      return undefined;\n    }\n    const flags = (ctx.traceFlags ?? 0).toString(16).padStart(2, '0');\n    return `00-${ctx.traceId}-${ctx.spanId}-${flags}`;\n  } catch {\n    return undefined;\n  }\n}\n","import type {\n  SandboxAdapter,\n  SecureConfig,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport {\n  getChecksum,\n  buildVerifyCommand,\n  binaryUrl,\n  PINNED_VERSION,\n} from './integrity.js';\nimport { generateServerConfig } from './config.js';\nimport { ProvisioningError, IntegrityError } from './errors.js';\nimport { serializePolicy, systemPolicyYaml } from '../policies/serialize.js';\nimport { agentDefault } from '../policies/presets.js';\nimport { validatePolicy } from '../policies/schema.js';\nimport { getTraceparent } from './traceparent.js';\n\n// ─── Security mode ordering (strongest to weakest) ────────────\n\nconst SECURITY_MODE_RANK: Record<SecurityMode, number> = {\n  full: 4,\n  landlock: 3,\n  'landlock-only': 2,\n  minimal: 1,\n};\n\nfunction isWeakerThan(detected: SecurityMode, required: SecurityMode): boolean {\n  return SECURITY_MODE_RANK[detected] < SECURITY_MODE_RANK[required];\n}\n\n// ─── Architecture mapping ─────────────────────────────────────\n\nfunction mapArch(uname: string): 'linux_amd64' | 'linux_arm64' {\n  const trimmed = uname.trim();\n  if (trimmed === 'x86_64') return 'linux_amd64';\n  if (trimmed === 'aarch64') return 'linux_arm64';\n  throw new ProvisioningError({\n    phase: 'install',\n    command: 'uname -m',\n    stderr: `Unsupported architecture: ${trimmed}`,\n  });\n}\n\n// ─── Helper: check if binary exists ───────────────────────────\n\nconst AGENTSH_PATHS = ['/usr/local/bin/agentsh', '/usr/bin/agentsh'];\n\nasync function binaryExists(adapter: SandboxAdapter): Promise<boolean> {\n  for (const path of AGENTSH_PATHS) {\n    const found = adapter.fileExists\n      ? await adapter.fileExists(path)\n      : (await adapter.exec('test', ['-f', path])).exitCode === 0;\n    if (found) return true;\n  }\n  return false;\n}\n\n// ─── Helper: sleep ────────────────────────────────────────────\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n// ─── Main provisioning function ───────────────────────────────\n\nexport interface ProvisionResult {\n  sessionId: string;\n  securityMode: SecurityMode;\n  /** When true, the shell shim enforces policy — skip agentsh exec wrapper. */\n  passthrough?: boolean;\n}\n\nexport async function provision(\n  adapter: SandboxAdapter,\n  config: SecureConfig = {},\n): Promise<ProvisionResult> {\n  const {\n    policy: rawPolicy,\n    workspace = '/workspace',\n    watchtower,\n    installStrategy = 'download',\n    agentshVersion = PINNED_VERSION,\n    agentshArch: archOverride,\n    agentshBinaryUrl,\n    agentshChecksum,\n    skipIntegrityCheck = false,\n    minimumSecurityMode,\n    realPaths: realPathsOverride,\n    traceParent,\n    policyName = 'policy',\n    threatFeeds,\n    packageChecks,\n    serverConfig: extendedConfig,\n  } = config;\n\n  // Resolve and validate policy\n  const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();\n\n  let securityMode: SecurityMode = 'full';\n\n  if (installStrategy === 'running') {\n    // agentsh is already fully provisioned and running with the shell shim\n    // installed. Commands go through the shim automatically, so we don't\n    // create a new session (which would deadlock the server via nested\n    // agentsh connections). Instead, read the existing session ID from\n    // the environment and use passthrough mode at runtime.\n    //\n    // Skip detectSecurityMode() — running `agentsh detect` inside a sandbox\n    // where the shell shim is already installed would route the command\n    // through agentsh's exec API, causing the server to try binding port\n    // 18080 again (\"address already in use\"). Default to 'full' since\n    // pre-provisioned environments typically have full capabilities.\n    await healthCheck(adapter);\n\n    securityMode = config.securityMode ?? 'full';\n\n    if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: 'securityMode check',\n        stderr: `Security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n      });\n    }\n\n    // Read the existing session ID from config or from the environment\n    let sessionId = config.sessionId;\n    if (!sessionId) {\n      const envResult = await adapter.exec('sh', ['-c', 'echo $AGENTSH_SESSION_ID']);\n      sessionId = envResult.stdout.trim();\n    }\n    if (!sessionId) {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'echo $AGENTSH_SESSION_ID',\n        stderr: 'AGENTSH_SESSION_ID not set — running strategy requires a pre-created session',\n      });\n    }\n\n    return { sessionId, securityMode, passthrough: true };\n  }\n\n  // ─── Phase 1: Binary Installation ───────────────────────────\n\n  // Step 1: Check if binary exists\n  const exists = await binaryExists(adapter);\n\n  if (installStrategy === 'preinstalled') {\n    if (!exists) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: AGENTSH_PATHS.map(p => `test -f ${p}`).join(' || '),\n        stderr: 'Binary not found but installStrategy is preinstalled',\n      });\n    }\n    // Binary exists and strategy is preinstalled, skip to detect\n  } else if (installStrategy === 'download' || installStrategy === 'upload') {\n    // If binary already exists, skip installation but still detect\n    if (!exists) {\n      // Step 2: Detect architecture\n      const arch =\n        archOverride ?? await detectArch(adapter);\n\n      if (installStrategy === 'download') {\n        // Step 3a: Download\n        await downloadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      } else {\n        // Step 3b: Upload\n        await uploadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);\n      }\n\n      // Step 4: Verify checksum\n      if (!skipIntegrityCheck) {\n        await verifyChecksum(\n          adapter,\n          agentshVersion,\n          arch,\n          agentshChecksum,\n          '/tmp/agentsh.tar.gz',\n        );\n      }\n\n      // Step 5: Install binaries (agentsh + agentsh-shell-shim + agentsh-unixwrap)\n      const binaries = [\n        { src: '/tmp/agentsh', dest: '/usr/local/bin/agentsh' },\n        { src: '/tmp/agentsh-shell-shim', dest: '/usr/bin/agentsh-shell-shim' },\n        { src: '/tmp/agentsh-unixwrap', dest: '/usr/local/bin/agentsh-unixwrap' },\n      ];\n      for (const { src, dest } of binaries) {\n        const installResult = await adapter.exec(\n          'install',\n          ['-m', '0755', src, dest],\n          { sudo: true },\n        );\n        if (installResult.exitCode !== 0) {\n          throw new ProvisioningError({\n            phase: 'install',\n            command: `install -m 0755 ${src} ${dest}`,\n            stderr: installResult.stderr,\n          });\n        }\n      }\n    }\n  }\n\n  // Step 5b: Detect security mode\n  securityMode = await detectSecurityMode(adapter);\n\n  // Check minimum security mode\n  if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --json',\n      stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`,\n    });\n  }\n\n  // Auto-enable realPaths when FUSE is available (full or landlock modes),\n  // unless the user explicitly set it.\n  const hasFuse = securityMode === 'full' || securityMode === 'landlock';\n  const realPaths = realPathsOverride ?? hasFuse;\n\n  // Step 6: Install shell shim\n  const shimResult = await adapter.exec(\n    'agentsh',\n    [\n      'shim', 'install-shell',\n      '--root', '/',\n      '--shim', '/usr/bin/agentsh-shell-shim',\n      '--bash',\n      '--i-understand-this-modifies-the-host',\n    ],\n    { sudo: true },\n  );\n  if (shimResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh shim install-shell',\n      stderr: shimResult.stderr,\n    });\n  }\n\n  // ─── Phase 2: Policy & Config ───────────────────────────────\n\n  // Step 7: Create dirs and make writable for file writes\n  const mkdirResult = await adapter.exec(\n    'mkdir',\n    ['-p', '/etc/agentsh/system'],\n    { sudo: true },\n  );\n  if (mkdirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'mkdir -p /etc/agentsh/system',\n      stderr: mkdirResult.stderr,\n    });\n  }\n\n  // Temporarily make writable so adapter.writeFile (which may not support sudo) can write\n  await adapter.exec('chmod', ['-R', '777', '/etc/agentsh/'], { sudo: true });\n\n  await adapter.writeFile(\n    '/etc/agentsh/system/policy.yml',\n    systemPolicyYaml(),\n    { sudo: true },\n  );\n\n  // Step 8: Write user policy\n  await adapter.writeFile(\n    '/etc/agentsh/policy.yml',\n    serializePolicy(policy),\n    { sudo: true },\n  );\n\n  // Step 9: Write server config\n  const serverConfig = generateServerConfig({\n    watchtower,\n    realPaths,\n    threatFeeds,\n    packageChecks,\n    ...extendedConfig,\n  });\n\n  await adapter.writeFile('/etc/agentsh/config.yml', serverConfig, {\n    sudo: true,\n  });\n\n  // Step 10: Set permissions\n  const chmodDirResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'd', '-exec', 'chmod', '555', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodDirResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type d -exec chmod 555 {} +',\n      stderr: chmodDirResult.stderr,\n    });\n  }\n\n  const chmodFileResult = await adapter.exec(\n    'find',\n    ['/etc/agentsh', '-type', 'f', '-exec', 'chmod', '444', '{}', '+'],\n    { sudo: true },\n  );\n  if (chmodFileResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'find /etc/agentsh -type f -exec chmod 444 {} +',\n      stderr: chmodFileResult.stderr,\n    });\n  }\n\n  const chownResult = await adapter.exec(\n    'chown',\n    ['-R', 'root:root', '/etc/agentsh/'],\n    { sudo: true },\n  );\n  if (chownResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'policy',\n      command: 'chown -R root:root /etc/agentsh/',\n      stderr: chownResult.stderr,\n    });\n  }\n\n  // ─── Phase 3: Server Startup ────────────────────────────────\n\n  // Step 10b: Ensure workspace directory exists\n  await adapter.exec('mkdir', ['-p', workspace], { sudo: true });\n\n  // Step 11: Start server\n  const serverResult = await adapter.exec(\n    'agentsh',\n    ['server', '--config', '/etc/agentsh/config.yml'],\n    { detached: true, sudo: true },\n  );\n  if (serverResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'startup',\n      command: 'agentsh server --config /etc/agentsh/config.yml',\n      stderr: serverResult.stderr,\n    });\n  }\n\n  // Step 12: Health check\n  await healthCheck(adapter);\n\n  // Step 13: Create session\n  const sessionResult = await adapter.exec('agentsh', [\n    'session',\n    'create',\n    '--workspace',\n    workspace,\n    '--policy',\n    'policy',\n  ]);\n  if (sessionResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'session',\n      command: 'agentsh session create',\n      stderr: sessionResult.stderr,\n    });\n  }\n\n  let sessionId: string;\n  try {\n    const sessionData = JSON.parse(sessionResult.stdout);\n    sessionId = sessionData.session_id;\n  } catch {\n    // Fallback: parse text output like \"Session session-xxx started\"\n    const match = sessionResult.stdout.match(/Session\\s+(session-[^\\s]+)/);\n    if (match) {\n      sessionId = match[1];\n    } else {\n      throw new ProvisioningError({\n        phase: 'session',\n        command: 'agentsh session create',\n        stderr: `Failed to parse session output: ${sessionResult.stdout}`,\n      });\n    }\n  }\n\n  // Step 13b: Set trace context if traceParent is provided or OTEL span is active\n  const effectiveTraceParent = traceParent ?? (await getTraceparent());\n  if (effectiveTraceParent) {\n    await adapter.exec('curl', [\n      '-X',\n      'PUT',\n      `http://127.0.0.1:18080/sessions/${sessionId}/trace-context`,\n      '-H',\n      'Content-Type: application/json',\n      '-d',\n      JSON.stringify({ traceparent: effectiveTraceParent }),\n    ]);\n  }\n\n  // ─── Phase 4: Handoff ───────────────────────────────────────\n\n  // Step 14: Return result\n  return { sessionId, securityMode };\n}\n\n// ─── Phase 1 helpers ──────────────────────────────────────────\n\nasync function detectArch(\n  adapter: SandboxAdapter,\n): Promise<'linux_amd64' | 'linux_arm64'> {\n  const result = await adapter.exec('uname', ['-m']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'uname -m',\n      stderr: result.stderr,\n    });\n  }\n  return mapArch(result.stdout);\n}\n\nasync function downloadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Try curl first\n  const curlResult = await adapter.exec('curl', [\n    '-fsSL',\n    url,\n    '-o',\n    '/tmp/agentsh.tar.gz',\n  ]);\n\n  if (curlResult.exitCode !== 0) {\n    // Fallback to wget (may not be available on all platforms)\n    let wgetResult: ExecResult;\n    try {\n      wgetResult = await adapter.exec('wget', [\n        '-q',\n        url,\n        '-O',\n        '/tmp/agentsh.tar.gz',\n      ]);\n    } catch {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `curl -fsSL ${url} -o /tmp/agentsh.tar.gz`,\n        stderr: curlResult.stderr || 'Download failed (curl failed, wget not available)',\n      });\n    }\n    if (wgetResult.exitCode !== 0) {\n      throw new ProvisioningError({\n        phase: 'install',\n        command: `wget -q ${url} -O /tmp/agentsh.tar.gz`,\n        stderr: wgetResult.stderr,\n      });\n    }\n  }\n\n  // Extract\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function uploadBinary(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  overrideUrl?: string,\n): Promise<void> {\n  const url = binaryUrl(version, arch, overrideUrl);\n\n  // Download on host side using fetch (Node 18+)\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: `fetch ${url}`,\n      stderr: `HTTP ${response.status}: ${response.statusText}`,\n    });\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n\n  // Upload tarball to sandbox and extract\n  await adapter.writeFile('/tmp/agentsh.tar.gz', buffer);\n  const tarResult = await adapter.exec('tar', [\n    'xz',\n    '-C',\n    '/tmp/',\n    '-f',\n    '/tmp/agentsh.tar.gz',\n  ]);\n  if (tarResult.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'tar xz -C /tmp/ -f /tmp/agentsh.tar.gz',\n      stderr: tarResult.stderr,\n    });\n  }\n}\n\nasync function verifyChecksum(\n  adapter: SandboxAdapter,\n  version: string,\n  arch: string,\n  checksumOverride: string | undefined,\n  filePath: string,\n): Promise<void> {\n  const expected = getChecksum(version, arch, checksumOverride);\n  const commands = buildVerifyCommand(filePath);\n\n  let actual: string | undefined;\n\n  for (const cmd of commands) {\n    const result = await adapter.exec('sh', ['-c', cmd]);\n    if (result.exitCode === 0 && result.stdout.trim()) {\n      actual = result.stdout.trim();\n      break;\n    }\n  }\n\n  if (actual === undefined) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'sha256sum / shasum / openssl',\n      stderr: 'No checksum tool available in sandbox',\n    });\n  }\n\n  if (actual !== expected) {\n    throw new IntegrityError({\n      expected,\n      actual,\n      message: `Checksum mismatch: expected ${expected}, got ${actual}`,\n    });\n  }\n}\n\nasync function detectSecurityMode(\n  adapter: SandboxAdapter,\n): Promise<SecurityMode> {\n  const result = await adapter.exec('agentsh', ['detect', '--output', 'json']);\n  if (result.exitCode !== 0) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: result.stderr,\n    });\n  }\n\n  // agentsh detect outputs JSON to stderr\n  const jsonOutput = result.stderr || result.stdout;\n  let parsed: { security_mode: string };\n  try {\n    parsed = JSON.parse(jsonOutput);\n  } catch {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Failed to parse detect JSON: ${jsonOutput.slice(0, 200)}`,\n    });\n  }\n\n  const mode = parsed.security_mode;\n  const validModes: SecurityMode[] = ['full', 'landlock', 'landlock-only', 'minimal'];\n  if (!validModes.includes(mode as SecurityMode)) {\n    throw new ProvisioningError({\n      phase: 'install',\n      command: 'agentsh detect --output json',\n      stderr: `Unknown security mode: '${mode}'`,\n    });\n  }\n  return mode as SecurityMode;\n}\n\nasync function healthCheck(adapter: SandboxAdapter): Promise<void> {\n  const maxRetries = 10;\n  const delayMs = 500;\n\n  for (let i = 0; i < maxRetries; i++) {\n    const result = await adapter.exec('curl', [\n      '-sf',\n      'http://127.0.0.1:18080/health',\n    ]);\n    if (result.exitCode === 0) {\n      return;\n    }\n    if (i < maxRetries - 1) {\n      await sleep(delayMs);\n    }\n  }\n\n  throw new ProvisioningError({\n    phase: 'startup',\n    command: 'curl http://127.0.0.1:18080/health',\n    stderr: 'Health check failed after 10 attempts',\n  });\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecurityMode,\n  ExecResult,\n} from './types.js';\nimport { RuntimeError } from './errors.js';\nimport { getTraceparent } from './traceparent.js';\n\n/** Build env object with TRACEPARENT if an OTEL span is active. */\nasync function traceEnv(): Promise<Record<string, string> | undefined> {\n  const tp = await getTraceparent();\n  return tp ? { TRACEPARENT: tp } : undefined;\n}\n\n/** Parse the JSON envelope from `agentsh exec --output json`. */\nfunction parseExecJson(raw: ExecResult): ExecResult {\n  try {\n    const json = JSON.parse(raw.stdout);\n    const result = json.result ?? {};\n    return {\n      exitCode: result.exit_code ?? raw.exitCode,\n      stdout: result.stdout ?? '',\n      stderr: result.stderr ?? result.error?.message ?? '',\n    };\n  } catch {\n    // If not valid JSON, return as-is (e.g. mock adapters)\n    return raw;\n  }\n}\n\nexport function createSecuredSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n  options?: { passthrough?: boolean },\n): SecuredSandbox {\n  if (options?.passthrough) {\n    return createPassthroughSandbox(adapter, sessionId, securityMode);\n  }\n  return createAgentshSandbox(adapter, sessionId, securityMode);\n}\n\n/**\n * Passthrough mode: the shell shim enforces policy on every command,\n * so we run commands directly through the adapter without wrapping\n * them in `agentsh exec`. Used with the 'running' install strategy.\n */\nfunction createPassthroughSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const result = await adapter.exec('bash', ['-c', command], {\n        cwd: opts?.cwd,\n      });\n      return result;\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const result = await adapter.exec('sh', [\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const result = await adapter.exec('cat', [path]);\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\n/** Standard mode: wraps commands in `agentsh exec` for policy enforcement. */\nfunction createAgentshSandbox(\n  adapter: SandboxAdapter,\n  sessionId: string,\n  securityMode: SecurityMode,\n): SecuredSandbox {\n  return {\n    sessionId,\n    securityMode,\n\n    async exec(command, opts) {\n      const args = [\n        'exec',\n        '--output',\n        'json',\n        sessionId,\n        '--',\n        'bash',\n        '-c',\n        command,\n      ];\n      const env = await traceEnv();\n      const execOpts = { cwd: opts?.cwd, env };\n      const result = await adapter.exec('agentsh', args, execOpts);\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command,\n          stderr: result.stderr,\n        });\n      }\n      return parseExecJson(result);\n    },\n\n    async writeFile(path, content) {\n      const b64 = Buffer.from(content, 'utf-8').toString('base64');\n      const args = [\n        'exec',\n        sessionId,\n        '--',\n        'sh',\n        '-c',\n        'printf \"%s\" \"$1\" | base64 -d > \"$2\"',\n        '_',\n        b64,\n        path,\n      ];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `writeFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'writeFile failed',\n        };\n      }\n      return { success: true as const, path };\n    },\n\n    async readFile(path) {\n      const args = ['exec', sessionId, '--', 'cat', path];\n      const env = await traceEnv();\n      const result = await adapter.exec('agentsh', args, { env });\n      if (isTransportFailure(result)) {\n        throw new RuntimeError({\n          sessionId,\n          command: `readFile ${path}`,\n          stderr: result.stderr,\n        });\n      }\n      if (result.exitCode !== 0) {\n        return {\n          success: false as const,\n          path,\n          error: result.stderr || 'readFile failed',\n        };\n      }\n      return { success: true as const, path, content: result.stdout };\n    },\n\n    async stop() {\n      await adapter.stop?.();\n    },\n  };\n}\n\nfunction isTransportFailure(result: ExecResult): boolean {\n  return result.exitCode === 127 && result.stderr.includes('agentsh');\n}\n","import type {\n  SandboxAdapter,\n  SecuredSandbox,\n  SecureConfig,\n} from './core/types.js';\nimport { provision } from './core/provision.js';\nimport { createSecuredSandbox } from './core/runtime.js';\n\nexport async function secureSandbox(\n  adapter: SandboxAdapter,\n  config?: SecureConfig,\n): Promise<SecuredSandbox> {\n  const resolvedConfig = config ?? {};\n  const { sessionId, securityMode, passthrough } = await provision(adapter, {\n    workspace: '/workspace',\n    ...resolvedConfig,\n  });\n  return createSecuredSandbox(adapter, sessionId, securityMode, { passthrough });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,IAAM,iBAAiB;AAEvB,IAAM,YAAoD;AAAA,EAC/D,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AAAA,EACA,UAAU;AAAA,IACR,aACE;AAAA,IACF,aACE;AAAA,EACJ;AACF;AAQO,SAAS,YACd,SACA,MACA,UACQ;AACR,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,mBAAmB,UAAU,OAAO;AAC1C,MAAI,oBAAoB,iBAAiB,IAAI,GAAG;AAC9C,WAAO,iBAAiB,IAAI;AAAA,EAC9B;AAEA,QAAM,IAAI,eAAe;AAAA,IACvB,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,mCAAmC,OAAO;AAAA,EACrD,CAAC;AACH;AAMO,SAAS,mBAAmB,UAA4B;AAC7D,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,kBAAkB,QAAQ;AAAA,IAC1B,yBAAyB,QAAQ;AAAA,EACnC;AACF;AAOO,SAAS,UACd,SACA,MACA,aACQ;AACR,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,SAAO,4DAA4D,OAAO,YAAY,OAAO,IAAI,IAAI;AACvG;;;ACzEA,OAAO,UAAU;AAgCV,IAAM,qBAAwC;AAAA,EACnD,QAAQ;AAAA,EACR,OAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,iBAAiB;AAAA,IACnB;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAMO,IAAM,+BAAuF;AAAA,EAClG,OAAO,EAAE,SAAS,MAAM,UAAU,EAAE;AAAA,EACpC,KAAK,EAAE,SAAS,MAAM,UAAU,EAAE;AAAA,EAClC,SAAS,EAAE,SAAS,MAAM,UAAU,EAAE;AACxC;AAKA,SAAS,0BAA0B,QAAiD;AAClF,QAAM,SAAkC,EAAE,SAAS,OAAO,WAAW,KAAK;AAC1E,MAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO;AAC5D,MAAI,OAAO,YAAY,OAAW,QAAO,UAAU,OAAO;AAC1D,MAAI,OAAO,cAAc,OAAW,QAAO,aAAa,OAAO;AAC/D,MAAI,OAAO,cAAc,OAAW,QAAO,cAAc,OAAO;AAChE,MAAI,OAAO,SAAS,OAAW,QAAO,OAAO,OAAO;AACpD,MAAI,OAAO,YAAY,OAAW,QAAO,UAAU,OAAO;AAC1D,MAAI,OAAO,YAAY,OAAW,QAAO,UAAU,OAAO;AAC1D,SAAO;AACT;AAEO,SAAS,qBAAqB,MAAgC;AACnE,QAAM,SAAkC;AAAA,IACtC,QAAQ;AAAA,MACN,MAAM;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,KAAK;AAAA,MACL,SAAS;AAAA,IACX;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,MAAM,EAAE,SAAS,KAAK;AAAA,MACtB,SAAS,EAAE,SAAS,KAAK;AAAA,MACzB,SAAS,EAAE,SAAS,KAAK;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,KAAK,WAAY,QAAO,aAAa,KAAK;AAK9C,MAAI,KAAK,MAAM;AACb,IAAC,OAAO,OAAe,OAAO,EAAE,SAAS,MAAM,MAAM,KAAK,KAAK,KAAK;AAAA,EACtE;AAGA,MAAI,KAAK,gBAAgB;AACvB,UAAM,OAAQ,OAAO,OAAe;AACpC,QAAI,KAAK,eAAe,YAAa,MAAK,eAAe,KAAK,eAAe;AAC7E,QAAI,KAAK,eAAe,aAAc,MAAK,gBAAgB,KAAK,eAAe;AAC/E,QAAI,KAAK,eAAe,eAAgB,MAAK,mBAAmB,KAAK,eAAe;AAAA,EACtF;AAGA,MAAI,KAAK,QAAS,QAAO,UAAU,EAAE,GAAG,KAAK,QAAQ;AAGrD,QAAM,cAAuC,CAAC;AAC9C,MAAI,KAAK,UAAW,aAAY,aAAa;AAC7C,MAAI,KAAK,UAAU;AACjB,QAAI,KAAK,SAAS,QAAS,aAAY,WAAW,KAAK,SAAS;AAChE,QAAI,KAAK,SAAS,gBAAgB,OAAW,aAAY,eAAe,KAAK,SAAS;AACtF,QAAI,KAAK,SAAS,eAAgB,aAAY,kBAAkB,KAAK,SAAS;AAC9E,QAAI,KAAK,SAAS,YAAa,aAAY,eAAe,KAAK,SAAS;AACxE,QAAI,KAAK,SAAS,gBAAiB,aAAY,mBAAmB,KAAK,SAAS;AAAA,EAClF;AACA,MAAI,OAAO,KAAK,WAAW,EAAE,SAAS,EAAG,QAAO,WAAW;AAG3D,MAAI,KAAK,OAAO;AACd,UAAM,WAAoC,CAAC;AAC3C,QAAI,KAAK,MAAM,YAAY,OAAW,UAAS,UAAU,KAAK,MAAM;AACpE,QAAI,KAAK,MAAM,WAAY,UAAS,cAAc,KAAK,MAAM;AAC7D,WAAO,QAAQ;AAAA,EACjB;AAGA,MAAI,KAAK,eAAe;AACtB,IAAC,OAAO,QAAgB,SAAS;AAAA,MAC/B,GAAI,KAAK,cAAc,gBAAgB,UAAa,EAAE,eAAe,KAAK,cAAc,YAAY;AAAA,MACpG,GAAI,KAAK,cAAc,kBAAkB,UAAa,EAAE,iBAAiB,KAAK,cAAc,cAAc;AAAA,MAC1G,GAAI,KAAK,cAAc,iBAAiB,UAAa,EAAE,eAAe,KAAK,cAAc,aAAa;AAAA,IACxG;AAAA,EACF;AAGA,MAAI,KAAK,MAAM,aAAa,QAAW;AACrC,IAAC,OAAO,QAAgB,KAAK,WAAW,KAAK,KAAK;AAAA,EACpD;AAGA,MAAI,KAAK,kBAAkB;AACzB,UAAM,MAAO,OAAO,QAAgB;AACpC,QAAI,KAAK,iBAAiB,cAAe,KAAI,iBAAiB,KAAK,iBAAiB;AACpF,QAAI,KAAK,iBAAiB,gBAAiB,KAAI,oBAAoB,KAAK,iBAAiB;AAAA,EAC3F;AAGA,MAAI,KAAK,gBAAgB;AACvB,UAAM,MAAO,OAAO,QAAgB;AACpC,QAAI,KAAK,eAAe,WAAW,OAAW,KAAI,SAAS,KAAK,eAAe;AAC/E,QAAI,KAAK,eAAe,aAAa;AACnC,UAAI,eAAe;AAAA,QACjB,GAAI,KAAK,eAAe,YAAY,YAAY,UAAa,EAAE,SAAS,KAAK,eAAe,YAAY,QAAQ;AAAA,QAChH,GAAI,KAAK,eAAe,YAAY,uBAAuB,UAAa,EAAE,sBAAsB,KAAK,eAAe,YAAY,mBAAmB;AAAA,MACrJ;AAAA,IACF;AAAA,EACF;AAGA,MAAI,KAAK,SAAS;AAChB,IAAC,OAAO,QAAgB,UAAU,EAAE,GAAG,KAAK,QAAQ;AAAA,EACtD;AAGA,MAAI,KAAK,aAAa;AACpB,IAAC,OAAO,QAAgB,eAAe,EAAE,GAAG,KAAK,YAAY;AAAA,EAC/D;AAGA,MAAI,KAAK,OAAO;AACd,WAAO,QAAQ,EAAE,GAAG,KAAK,MAAM;AAAA,EACjC;AAGA,MAAI,KAAK,KAAK;AACZ,UAAM,SAAkC,CAAC;AACzC,QAAI,KAAK,IAAI,KAAM,QAAO,OAAO,KAAK,IAAI;AAC1C,QAAI,KAAK,IAAI,SAAU,QAAO,WAAW,KAAK,IAAI;AAClD,QAAI,KAAK,IAAI,gBAAgB;AAC3B,aAAO,kBAAkB,KAAK,IAAI,eAAe,IAAI,QAAM;AAAA,QACzD,MAAM,EAAE;AAAA,QACR,SAAS,EAAE;AAAA,QACX,OAAO,EAAE;AAAA,MACX,EAAE;AAAA,IACJ;AACA,WAAO,MAAM;AAAA,EACf;AAGA,MAAI,KAAK,kBAAkB;AACzB,WAAO,WAAW;AAAA,MAChB,GAAI,KAAK,iBAAiB,OAAO,EAAE,KAAK,KAAK,iBAAiB,IAAI;AAAA,MAClE,GAAI,KAAK,iBAAiB,iBAAiB,EAAE,SAAS,KAAK,iBAAiB,cAAc;AAAA,IAC5F;AAAA,EACF;AAGA,MAAI,KAAK,UAAW,QAAO,YAAY,EAAE,GAAG,KAAK,UAAU;AAG3D,MAAI,KAAK,QAAS,QAAO,UAAU,EAAE,GAAG,KAAK,QAAQ;AAGrD,MAAI,KAAK,QAAQ;AACf,UAAM,YAAqC,CAAC;AAC5C,QAAI,KAAK,OAAO,KAAM,WAAU,OAAO,KAAK,OAAO;AACnD,QAAI,KAAK,OAAO,cAAe,WAAU,iBAAiB,KAAK,OAAO;AACtE,WAAO,SAAS;AAAA,EAClB;AAGA,MAAI,KAAK,aAAa;AACpB,UAAM,SAAkC,CAAC;AACzC,QAAI,KAAK,YAAY,gBAAgB,OAAW,QAAO,eAAe,KAAK,YAAY;AACvF,QAAI,KAAK,YAAY,kBAAkB,OAAW,QAAO,iBAAiB,KAAK,YAAY;AAC3F,WAAO,cAAc;AAAA,EACvB;AAGA,QAAM,QAAQ,KAAK,gBAAgB,QAAQ,SAAa,KAAK,eAAe;AAC5E,MAAI,OAAO;AACT,WAAO,eAAe;AAAA,MACpB,SAAS;AAAA,MACT,QAAQ,MAAM,UAAU;AAAA,MACxB,OAAO,MAAM,MAAM,IAAI,QAAM;AAAA,QAC3B,MAAM,EAAE;AAAA,QACR,KAAK,EAAE;AAAA,QACP,QAAQ,EAAE;AAAA,QACV,kBAAkB,EAAE,mBAAmB;AAAA,MACzC,EAAE;AAAA,MACF,GAAI,MAAM,WAAW,SAAS,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAGA,MAAI,KAAK,eAAe;AACtB,UAAM,KAAK,KAAK;AAChB,UAAM,YAAqD,CAAC;AAG5D,eAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,4BAA4B,GAAG;AACtE,gBAAU,IAAI,IAAI,EAAE,GAAG,IAAI;AAAA,IAC7B;AAGA,QAAI,GAAG,WAAW;AAChB,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,SAAS,GAAG;AACxD,YAAI,UAAU,OAAO;AACnB,oBAAU,IAAI,IAAI,EAAE,SAAS,MAAM;AAAA,QACrC,WAAW,UAAU,MAAM;AACzB,oBAAU,IAAI,IAAI,EAAE,GAAI,UAAU,IAAI,KAAK,CAAC,GAAI,SAAS,KAAK;AAAA,QAChE,OAAO;AAEL,gBAAM,OAAO,UAAU,IAAI,KAAK,CAAC;AACjC,oBAAU,IAAI,IAAI,EAAE,GAAG,MAAM,GAAG,0BAA0B,KAAK,EAAE;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB;AAAA,MACtB,SAAS;AAAA,MACT,OAAO,GAAG,SAAS;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,KAAK,KAAK,QAAQ,EAAE,WAAW,GAAG,CAAC;AAC5C;;;AC9RA,eAAsB,iBAA8C;AAClE,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,mBAAoB;AACnD,UAAM,OAAO,MAAM,cAAc;AACjC,UAAM,MAAM,MAAM,YAAY;AAC9B,QAAI,CAAC,KAAK,WAAW,IAAI,YAAY,oCAAoC;AACvE,aAAO;AAAA,IACT;AACA,UAAM,SAAS,IAAI,cAAc,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAChE,WAAO,MAAM,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACCA,IAAM,qBAAmD;AAAA,EACvD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,SAAS;AACX;AAEA,SAAS,aAAa,UAAwB,UAAiC;AAC7E,SAAO,mBAAmB,QAAQ,IAAI,mBAAmB,QAAQ;AACnE;AAIA,SAAS,QAAQ,OAA8C;AAC7D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,SAAU,QAAO;AACjC,MAAI,YAAY,UAAW,QAAO;AAClC,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ,6BAA6B,OAAO;AAAA,EAC9C,CAAC;AACH;AAIA,IAAM,gBAAgB,CAAC,0BAA0B,kBAAkB;AAEnE,eAAe,aAAa,SAA2C;AACrE,aAAW,QAAQ,eAAe;AAChC,UAAM,QAAQ,QAAQ,aAClB,MAAM,QAAQ,WAAW,IAAI,KAC5B,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa;AAC5D,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAIA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAWA,eAAsB,UACpB,SACA,SAAuB,CAAC,GACE;AAC1B,QAAM;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ;AAAA,IACA,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,cAAc;AAAA,EAChB,IAAI;AAGJ,QAAM,SAAS,YAAY,eAAe,SAAS,IAAI,aAAa;AAEpE,MAAI,eAA6B;AAEjC,MAAI,oBAAoB,WAAW;AAYjC,UAAM,YAAY,OAAO;AAEzB,mBAAe,OAAO,gBAAgB;AAEtC,QAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,kBAAkB,YAAY,8BAA8B,mBAAmB;AAAA,MACzF,CAAC;AAAA,IACH;AAGA,QAAIA,aAAY,OAAO;AACvB,QAAI,CAACA,YAAW;AACd,YAAM,YAAY,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,0BAA0B,CAAC;AAC7E,MAAAA,aAAY,UAAU,OAAO,KAAK;AAAA,IACpC;AACA,QAAI,CAACA,YAAW;AACd,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,WAAAA,YAAW,cAAc,aAAa,KAAK;AAAA,EACtD;AAKA,QAAM,SAAS,MAAM,aAAa,OAAO;AAEzC,MAAI,oBAAoB,gBAAgB;AACtC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,IAAI,OAAK,WAAW,CAAC,EAAE,EAAE,KAAK,MAAM;AAAA,QAC3D,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EAEF,WAAW,oBAAoB,cAAc,oBAAoB,UAAU;AAEzE,QAAI,CAAC,QAAQ;AAEX,YAAM,OACJ,gBAAgB,MAAM,WAAW,OAAO;AAE1C,UAAI,oBAAoB,YAAY;AAElC,cAAM,eAAe,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACtE,OAAO;AAEL,cAAM,aAAa,SAAS,gBAAgB,MAAM,gBAAgB;AAAA,MACpE;AAGA,UAAI,CAAC,oBAAoB;AACvB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,WAAW;AAAA,QACf,EAAE,KAAK,gBAAgB,MAAM,yBAAyB;AAAA,QACtD,EAAE,KAAK,2BAA2B,MAAM,8BAA8B;AAAA,QACtE,EAAE,KAAK,yBAAyB,MAAM,kCAAkC;AAAA,MAC1E;AACA,iBAAW,EAAE,KAAK,KAAK,KAAK,UAAU;AACpC,cAAM,gBAAgB,MAAM,QAAQ;AAAA,UAClC;AAAA,UACA,CAAC,MAAM,QAAQ,KAAK,IAAI;AAAA,UACxB,EAAE,MAAM,KAAK;AAAA,QACf;AACA,YAAI,cAAc,aAAa,GAAG;AAChC,gBAAM,IAAI,kBAAkB;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS,mBAAmB,GAAG,IAAI,IAAI;AAAA,YACvC,QAAQ,cAAc;AAAA,UACxB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,MAAM,mBAAmB,OAAO;AAG/C,MAAI,uBAAuB,aAAa,cAAc,mBAAmB,GAAG;AAC1E,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,YAAY,8BAA8B,mBAAmB;AAAA,IAClG,CAAC;AAAA,EACH;AAIA,QAAM,UAAU,iBAAiB,UAAU,iBAAiB;AAC5D,QAAM,YAAY,qBAAqB;AAGvC,QAAM,aAAa,MAAM,QAAQ;AAAA,IAC/B;AAAA,IACA;AAAA,MACE;AAAA,MAAQ;AAAA,MACR;AAAA,MAAU;AAAA,MACV;AAAA,MAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,WAAW,aAAa,GAAG;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH;AAKA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,qBAAqB;AAAA,IAC5B,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAGA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,OAAO,eAAe,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1E,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,iBAAiB;AAAA,IACjB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,EAAE,MAAM,KAAK;AAAA,EACf;AAGA,QAAM,eAAe,qBAAqB;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,CAAC;AAED,QAAM,QAAQ,UAAU,2BAA2B,cAAc;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AAGD,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,eAAe,aAAa,GAAG;AACjC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,eAAe;AAAA,IACzB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,QAAQ;AAAA,IACpC;AAAA,IACA,CAAC,gBAAgB,SAAS,KAAK,SAAS,SAAS,OAAO,MAAM,GAAG;AAAA,IACjE,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,gBAAgB,aAAa,GAAG;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gBAAgB;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,CAAC,MAAM,aAAa,eAAe;AAAA,IACnC,EAAE,MAAM,KAAK;AAAA,EACf;AACA,MAAI,YAAY,aAAa,GAAG;AAC9B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH;AAKA,QAAM,QAAQ,KAAK,SAAS,CAAC,MAAM,SAAS,GAAG,EAAE,MAAM,KAAK,CAAC;AAG7D,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC;AAAA,IACA,CAAC,UAAU,YAAY,yBAAyB;AAAA,IAChD,EAAE,UAAU,MAAM,MAAM,KAAK;AAAA,EAC/B;AACA,MAAI,aAAa,aAAa,GAAG;AAC/B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,aAAa;AAAA,IACvB,CAAC;AAAA,EACH;AAGA,QAAM,YAAY,OAAO;AAGzB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,WAAW;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,cAAc,aAAa,GAAG;AAChC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,cAAc;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,KAAK,MAAM,cAAc,MAAM;AACnD,gBAAY,YAAY;AAAA,EAC1B,QAAQ;AAEN,UAAM,QAAQ,cAAc,OAAO,MAAM,4BAA4B;AACrE,QAAI,OAAO;AACT,kBAAY,MAAM,CAAC;AAAA,IACrB,OAAO;AACL,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,QAAQ,mCAAmC,cAAc,MAAM;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,uBAAuB,eAAgB,MAAM,eAAe;AAClE,MAAI,sBAAsB;AACxB,UAAM,QAAQ,KAAK,QAAQ;AAAA,MACzB;AAAA,MACA;AAAA,MACA,mCAAmC,SAAS;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,UAAU,EAAE,aAAa,qBAAqB,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAKA,SAAO,EAAE,WAAW,aAAa;AACnC;AAIA,eAAe,WACb,SACwC;AACxC,QAAM,SAAS,MAAM,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC;AACjD,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,OAAO,MAAM;AAC9B;AAEA,eAAe,eACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,aAAa,GAAG;AAE7B,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,KAAK,QAAQ;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,cAAc,GAAG;AAAA,QAC1B,QAAQ,WAAW,UAAU;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,aAAa,GAAG;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,OAAO;AAAA,QACP,SAAS,WAAW,GAAG;AAAA,QACvB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,aACb,SACA,SACA,MACA,aACe;AACf,QAAM,MAAM,UAAU,SAAS,MAAM,WAAW;AAGhD,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS,SAAS,GAAG;AAAA,MACrB,QAAQ,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AAGvD,QAAM,QAAQ,UAAU,uBAAuB,MAAM;AACrD,QAAM,YAAY,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU,aAAa,GAAG;AAC5B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,eACb,SACA,SACA,MACA,kBACA,UACe;AACf,QAAM,WAAW,YAAY,SAAS,MAAM,gBAAgB;AAC5D,QAAM,WAAW,mBAAmB,QAAQ;AAE5C,MAAI;AAEJ,aAAW,OAAO,UAAU;AAC1B,UAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;AACnD,QAAI,OAAO,aAAa,KAAK,OAAO,OAAO,KAAK,GAAG;AACjD,eAAS,OAAO,OAAO,KAAK;AAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI,eAAe;AAAA,MACvB;AAAA,MACA;AAAA,MACA,SAAS,+BAA+B,QAAQ,SAAS,MAAM;AAAA,IACjE,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBACb,SACuB;AACvB,QAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,CAAC,UAAU,YAAY,MAAM,CAAC;AAC3E,MAAI,OAAO,aAAa,GAAG;AACzB,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,QAAM,aAAa,OAAO,UAAU,OAAO;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,gCAAgC,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,IAClE,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,aAA6B,CAAC,QAAQ,YAAY,iBAAiB,SAAS;AAClF,MAAI,CAAC,WAAW,SAAS,IAAoB,GAAG;AAC9C,UAAM,IAAI,kBAAkB;AAAA,MAC1B,OAAO;AAAA,MACP,SAAS;AAAA,MACT,QAAQ,2BAA2B,IAAI;AAAA,IACzC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,YAAY,SAAwC;AACjE,QAAM,aAAa;AACnB,QAAM,UAAU;AAEhB,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,UAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ;AAAA,MACxC;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,OAAO,aAAa,GAAG;AACzB;AAAA,IACF;AACA,QAAI,IAAI,aAAa,GAAG;AACtB,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,IAAI,kBAAkB;AAAA,IAC1B,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,EACV,CAAC;AACH;;;AC5lBA,eAAe,WAAwD;AACrE,QAAM,KAAK,MAAM,eAAe;AAChC,SAAO,KAAK,EAAE,aAAa,GAAG,IAAI;AACpC;AAGA,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,WAAO;AAAA,MACL,UAAU,OAAO,aAAa,IAAI;AAAA,MAClC,QAAQ,OAAO,UAAU;AAAA,MACzB,QAAQ,OAAO,UAAU,OAAO,OAAO,WAAW;AAAA,IACpD;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBACd,SACA,WACA,cACA,SACgB;AAChB,MAAI,SAAS,aAAa;AACxB,WAAO,yBAAyB,SAAS,WAAW,YAAY;AAAA,EAClE;AACA,SAAO,qBAAqB,SAAS,WAAW,YAAY;AAC9D;AAOA,SAAS,yBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,OAAO,GAAG;AAAA,QACzD,KAAK,MAAM;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC;AAC/C,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAGA,SAAS,qBACP,SACA,WACA,cACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,MAAM,KAAK,SAAS,MAAM;AACxB,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,WAAW,EAAE,KAAK,MAAM,KAAK,IAAI;AACvC,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,QAAQ;AAC3D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA;AAAA,UACA,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,aAAO,cAAc,MAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,UAAU,MAAM,SAAS;AAC7B,YAAM,MAAM,OAAO,KAAK,SAAS,OAAO,EAAE,SAAS,QAAQ;AAC3D,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,aAAa,IAAI;AAAA,UAC1B,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,MAAM;AACnB,YAAM,OAAO,CAAC,QAAQ,WAAW,MAAM,OAAO,IAAI;AAClD,YAAM,MAAM,MAAM,SAAS;AAC3B,YAAM,SAAS,MAAM,QAAQ,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC;AAC1D,UAAI,mBAAmB,MAAM,GAAG;AAC9B,cAAM,IAAI,aAAa;AAAA,UACrB;AAAA,UACA,SAAS,YAAY,IAAI;AAAA,UACzB,QAAQ,OAAO;AAAA,QACjB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,aAAa,GAAG;AACzB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,UACA,OAAO,OAAO,UAAU;AAAA,QAC1B;AAAA,MACF;AACA,aAAO,EAAE,SAAS,MAAe,MAAM,SAAS,OAAO,OAAO;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,QAA6B;AACvD,SAAO,OAAO,aAAa,OAAO,OAAO,OAAO,SAAS,SAAS;AACpE;;;AC5LA,eAAsB,cACpB,SACA,QACyB;AACzB,QAAM,iBAAiB,UAAU,CAAC;AAClC,QAAM,EAAE,WAAW,cAAc,YAAY,IAAI,MAAM,UAAU,SAAS;AAAA,IACxE,WAAW;AAAA,IACX,GAAG;AAAA,EACL,CAAC;AACD,SAAO,qBAAqB,SAAS,WAAW,cAAc,EAAE,YAAY,CAAC;AAC/E;","names":["sessionId"]}

package/dist/policies/index.d.ts

@@ -1,2 +1,2 @@
-export { C as CommandRule, a as ConnectRedirect, D as DnsRedirect, E as EnvRule, F as FileRule, N as NetworkRule, P as PolicyDefinition, b as PolicyDefinitionSchema, c as agentDefault, d as agentSandbox, e as ciStrict, f as devSafe, m as merge, g as mergePrepend, s as serializePolicy, h as systemPolicyYaml, v as validatePolicy } from '../index-D0UvBOzr.js';
+export { C as CommandRule, a as ConnectRedirect, D as DnsRedirect, E as EnvRule, F as FileRule, N as NetworkRule, P as PolicyDefinition, b as PolicyDefinitionSchema, c as agentDefault, d as agentSandbox, e as ciStrict, f as devSafe, m as merge, g as mergePrepend, s as serializePolicy, h as systemPolicyYaml, v as validatePolicy } from '../index-Nmlhw9oj.js';
 import 'zod';

package/dist/policies/index.js

@@ -9,7 +9,7 @@ import {
   serializePolicy,
   systemPolicyYaml,
   validatePolicy
-} from "../chunk-NWHVZ3DG.js";
+} from "../chunk-GFPHTJLU.js";
 import "../chunk-PZ5AY32C.js";
 export {
   PolicyDefinitionSchema,

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { E as ExecResult, c as SecurityMode, b as SecuredSandbox } from '../types-DuXMpAuv.js';
+import { E as ExecResult, f as SecurityMode, b as SecuredSandbox } from '../types-S_fIEFHD.js';
 
 interface MockConfig {
     commands?: Record<string, ExecResult>;