@bo-agent/sandbox-windows-acl 0.0.1

package/lib/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAE9L,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAA;AAErC;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC7C,IAAI,MAAM,GAAG,GAAG,CAAA;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,IAAI,WAAW,GAAG,CAAC,CAAA;QACnB,OAAO,KAAK,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAClE,WAAW,EAAE,CAAA;YACb,KAAK,EAAE,CAAA;QACT,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9B,yEAAyE;YACzE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAA;QACxC,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAA;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,GAAG,GAAG,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAuB;IACvE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACnD,CAAC;AAOD,SAAS,UAAU,CAAC,GAAkB;IACpC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAA;IAC/B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IACzF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAA;IAC1F,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB,EAAE,MAAiB,EAAE,KAAa;IAC1E,IAAI,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAkB,EAClB,KAAgB,EAChB,OAAkE;IAElE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC9B,mEAAmE;IACnE,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;IACjD,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;IACrD,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;IAErD,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAA;IACtC,iBAAiB,CAAC,WAAW,EAAE;QAC7B,EAAE,EAAE,GAAG,CAAC,iBAAiB;QACzB,OAAO,EAAE,GAAG,CAAC,oBAAoB;QACjC,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,UAAU,EAAE,MAAM,CAAC,KAAK;QACxB,SAAS,EAAE,MAAM,CAAC,KAAK;KACxB,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAA;IACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CACtC,KAAK,EAAE,IAAI,EAAE,WAAW,EACxB,IAAI,EAAE,IAAI,EACV,CAAC,EAAE,4CAA4C;IAC/C,CAAC,EAAE,qFAAqF;IACxF,IAAI,EAAE,OAAO,CAAC,GAAG,EACjB,WAAW,EAAE,WAAW,CACzB,CAAA;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,8CAA8C;IAC9C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3B,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7B,UAAU,CAAC,GAAG,EAAE,sBAAsB,EAAE,SAAS,EAAE,YAAY,OAAO,CAAC,OAAO,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAA;IACnC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAA;IACjC,IAAI,aAAa,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gFAAgF,IAAI,CAAC,WAAW,GAAG,CAAC,CAAA;IACtH,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7B,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5B,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;IAE7B,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,WAAW;QACrB,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,UAAU,EAAE,MAAM,CAAC,IAAI;KACxB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAkB,EAAE,MAAiB;IACnE,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,SAAS,CAAC;QACR,MAAM,aAAa,GAAG,WAAW,EAAE,CAAA;QACnC,MAAM,cAAc,GAAG,WAAW,EAAE,CAAA;QACpC,MAAM,mBAAmB,GAAG,WAAW,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAA;QACrG,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;YACpC,IAAI,SAAS,KAAK,GAAG,CAAC,iBAAiB,IAAI,SAAS,KAAK,GAAG,CAAC,aAAa;gBAAE,MAAK,CAAC,kCAAkC;YACpH,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,uBAAuB,MAAM,CAAC,MAAM,WAAW,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;YAC9B,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,uBAAuB,MAAM,CAAC,MAAM,WAAW,CAAC,CAAA;YAClF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5D,CAAC;IACD,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IACvB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,GAAkB,EAAE,OAAkB;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACjE,IAAI,UAAU,KAAK,UAAU;QAAE,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;IACzE,MAAM,YAAY,GAAG,WAAW,EAAE,CAAA;IAClC,IAAI,GAAG,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;IAClG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxB,OAAO,YAAY,CAAC,YAAY,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAkB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC5C,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAA;IACnE,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,GAAG,CAAC,qCAAqC,CAAC,CAAA;IAC5G,IAAI,GAAG,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,iCAAiC,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnH,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpB,UAAU,CAAC,GAAG,EAAE,yBAAyB,EAAE,SAAS,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAkB,EAClB,KAAgB,EAChB,OAAkE;IAElE,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACrD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,MAAiB,EAAE,KAAa,EAAQ,EAAE;QACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC,CAAA;IACD,MAAM,cAAc,GAAG,CAAC,MAAiB,EAAQ,EAAE;QACjD,0EAA0E;QAC1E,uEAAuE;QACvE,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAA;IAC9D,CAAC,CAAA;IACD,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC/B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAEjC,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAA;IACtC,iBAAiB,CAAC,WAAW,EAAE;QAC7B,EAAE,EAAE,GAAG,CAAC,iBAAiB;QACzB,OAAO,EAAE,GAAG,CAAC,oBAAoB;QACjC,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAA;IACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CACtC,KAAK,EAAE,IAAI,EAAE,WAAW,EACxB,IAAI,EAAE,IAAI,EACV,CAAC,EAAE,kEAAkE;IACrE,GAAG,CAAC,gBAAgB,EAAE,qDAAqD;IAC3E,IAAI,EAAE,OAAO,CAAC,GAAG,EACjB,WAAW,EAAE,WAAW,CACzB,CAAA;IACD,cAAc,CAAC,KAAK,CAAC,CAAA;IACrB,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpB,UAAU,CAAC,GAAG,EAAE,sBAAsB,EAAE,SAAS,EAAE,YAAY,OAAO,CAAC,OAAO,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAA;IACnC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAA;IACjC,IAAI,aAAa,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACpD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpB,MAAM,IAAI,KAAK,CAAC,gFAAgF,IAAI,CAAC,WAAW,GAAG,CAAC,CAAA;IACtH,CAAC;IAED,IAAI,GAAG,CAAC,wBAAwB,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,uEAAuE;QACvE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;QACtC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;QAC7B,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;QAC9B,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpB,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,UAAU,EAAE,CAAC;QAClD,sEAAsE;QACtE,0EAA0E;QAC1E,eAAe;QACf,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;QAC7B,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;QAC9B,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;IAE7B,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAA;AAC/D,CAAC"}

package/lib/token.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Restricted-token construction: open the current process token, extract its
+ * logon SID, build the well-known SIDs, and call CreateRestrictedToken with
+ * the POC's restricting-SID allowlist. Every API call is checked; any failure
+ * throws with the API name and the exact Win32 code — the original POC ignored
+ * all of these and silently ran children with the FULL, unrestricted token.
+ * @module @bo-agent/sandbox-windows-acl/token
+ */
+import type { NativePtr, Win32Bindings } from './ffi.ts';
+/**
+ * Open the current process's access token with the rights
+ * CreateRestrictedToken requires (the POC's OpenProcessToken call; the token
+ * handle is obtained through a real OpenProcess handle because the
+ * GetCurrentProcess() pseudo-handle is not addressable through koffi).
+ * @param api - the binding table.
+ * @returns the opened token handle.
+ */
+export declare function openCurrentProcessToken(api: Win32Bindings): NativePtr;
+/**
+ * Find and copy the token's logon session SID (S-1-5-5-x-y, attribute
+ * SE_GROUP_LOGON_ID). The restricted token needs it for WinSta0/desktop and
+ * other per-logon objects; the POC extracts it the same way.
+ * @param api - the binding table.
+ * @param token - the token whose groups are scanned.
+ * @returns a copied logon SID (thrown when the token carries none).
+ */
+export declare function findLogonSid(api: Win32Bindings, token: NativePtr): NativePtr;
+/**
+ * Create one well-known SID (68-byte buffer) and assert its validity.
+ * @param api - the binding table.
+ * @param type - the WELL_KNOWN_SID_TYPE to create.
+ * @returns the created SID pointer.
+ */
+export declare function makeWellKnownSid(api: Win32Bindings, type: number): NativePtr;
+/**
+ * Merge one full-access allow ACE for `sidPtr` into the token's DEFAULT DACL
+ * — the DACL every NEW object the token holder creates (without an explicit
+ * security descriptor) takes. The restricted token inherits the user's
+ * default DACL verbatim, which names no restricting SID: a new anonymous pipe
+ * (child stdio) therefore fails the write pass-2 check at creation
+ * (ERROR_ACCESS_DENIED; Node surfaces it as spawn EPERM), breaking every
+ * piped-stdio grandchild spawn. The merged ACE names a RESTRICTING SID (the
+ * write SID under workspace-write, Everyone under read-only), so each new
+ * object's own DACL passes pass-2 while object creation itself stays gated by
+ * the parent container's DACL (files outside the granted trees remain
+ * uncreatable). Fails closed: any Win32 failure throws before the spawn.
+ * @param api - the binding table.
+ * @param token - the restricted token to adjust (requires TOKEN_ADJUST_DEFAULT).
+ * @param sidPtr - the restricting SID whose full-access ACE joins the default DACL.
+ */
+export declare function setTokenDefaultDaclGrant(api: Win32Bindings, token: NativePtr, sidPtr: NativePtr): void;
+/** The well-known SID packed into every restricted token's restricting list. */
+export interface RestrictingSidSet {
+    world: NativePtr;
+}
+/**
+ * Create the write-restricted token with the mode-selected restricting list
+ * (verified on Win11 26200, see the POC-worktree restrict-variant harness):
+ *  - read-only:       [logon SID, EVERYONE]
+ *  - workspace-write: [logon SID, EVERYONE, workspace SID, optional temp SID]
+ *
+ * The logon SID + EVERYONE keep-alive group is shared by both modes: early
+ * DLL init dies with 0xC0000142 and CNG (`\Device\CNG` write trustee —
+ * pwsh crashes 0xE0434352) fails without them. The write SIDs join ONLY
+ * workspace-write — read-only carries no write SID, so a standing grant ACE
+ * from an earlier workspace-write period (a `/permission` mode downgrade, or
+ * a crash-resumed session) stays INERT under read-only: the WRITE_RESTRICTED
+ * pass-2 check grants only what the restricting list carries, keeping that
+ * workspace grant inert under read-only while the unrevoked ACE keeps the
+ * re-upgrade free (the grant's exact-ACE skip — no re-propagation).
+ * Everyone's own ambient grants remain the documented partial boundary.
+ * Authenticated Users is absent from BOTH lists: the WMI
+ * namespace security check fails (0x80041003), so CIM is unavailable in
+ * every confined mode, and the C:\-root tree-creation escape (standing
+ * `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACEs) is closed in both — documented in
+ * README. INTERACTIVE/LOCAL are absent from BOTH lists too — the host's
+ * Public tree grants write to INTERACTIVE, so removing it closes that
+ * escape. S-1-2-1 (console logon) is intentionally absent: see win32-abi.ts
+ * for the verified failure modes. FAILS CLOSED: any failure throws — never
+ * spawn unrestricted.
+ * @param api - the binding table.
+ * @param currentToken - the process token to restrict.
+ * @param logonSid - the copied logon session SID.
+ * @param writeSids - the distinct write SIDs forming the workspace and
+ * optional temp allowlists (workspace-write only; empty under read-only).
+ * @param known - the well-known SIDs entering the restricting list.
+ * @param mode - selects the restricting list (workspace-write adds the capability SIDs).
+ * @returns the restricted token handle.
+ */
+export declare function createRestrictedToken(api: Win32Bindings, currentToken: NativePtr, logonSid: NativePtr, writeSids: readonly NativePtr[], known: RestrictingSidSet, mode: 'read-only' | 'workspace-write'): NativePtr;
+//# sourceMappingURL=token.d.ts.map

package/lib/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAIxD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CAmBrE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAyB5E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAS5E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAiCtG;AAWD,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,aAAa,EAClB,YAAY,EAAE,SAAS,EACvB,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,SAAS,SAAS,EAAE,EAC/B,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,WAAW,GAAG,iBAAiB,GACpC,SAAS,CAoBX"}

package/lib/token.js

@@ -0,0 +1,200 @@
+/**
+ * Restricted-token construction: open the current process token, extract its
+ * logon SID, build the well-known SIDs, and call CreateRestrictedToken with
+ * the POC's restricting-SID allowlist. Every API call is checked; any failure
+ * throws with the API name and the exact Win32 code — the original POC ignored
+ * all of these and silently ran children with the FULL, unrestricted token.
+ * @module @bo-agent/sandbox-windows-acl/token
+ */
+import { allocBytes, allocPtrSlot, allocUint32, decodePtr, decodePtrAt, decodeUint32, encodeUint32, isNullPtr, ptrAddress, throwLastError, throwWin32 } from "./ffi.js";
+import { buildExplicitAccess } from "./acl.js";
+import * as abi from "./win32-abi.js";
+/**
+ * Open the current process's access token with the rights
+ * CreateRestrictedToken requires (the POC's OpenProcessToken call; the token
+ * handle is obtained through a real OpenProcess handle because the
+ * GetCurrentProcess() pseudo-handle is not addressable through koffi).
+ * @param api - the binding table.
+ * @returns the opened token handle.
+ */
+export function openCurrentProcessToken(api) {
+    const processHandle = api.openProcess(abi.PROCESS_QUERY_INFORMATION, 0, process.pid);
+    if (isNullPtr(processHandle))
+        throwLastError(api, 'OpenProcess', `pid ${process.pid}`);
+    const tokenSlot = allocPtrSlot();
+    const opened = api.openProcessToken(processHandle, abi.TOKEN_QUERY | abi.TOKEN_DUPLICATE | abi.TOKEN_ADJUST_DEFAULT | abi.TOKEN_ASSIGN_PRIMARY, tokenSlot);
+    if (opened === 0) {
+        const win32Code = api.getLastError();
+        api.closeHandle(processHandle); // best-effort on the error path
+        throwWin32(api, 'OpenProcessToken', win32Code, `pid ${process.pid}`);
+    }
+    if (api.closeHandle(processHandle) === 0)
+        throwLastError(api, 'CloseHandle', 'OpenProcess process handle');
+    const token = decodePtr(tokenSlot);
+    if (token === null)
+        throwWin32(api, 'OpenProcessToken', api.getLastError(), 'null token handle');
+    return token;
+}
+/**
+ * Find and copy the token's logon session SID (S-1-5-5-x-y, attribute
+ * SE_GROUP_LOGON_ID). The restricted token needs it for WinSta0/desktop and
+ * other per-logon objects; the POC extracts it the same way.
+ * @param api - the binding table.
+ * @param token - the token whose groups are scanned.
+ * @returns a copied logon SID (thrown when the token carries none).
+ */
+export function findLogonSid(api, token) {
+    const neededSlot = allocUint32();
+    api.getTokenInformation(token, abi.TokenGroups, null, 0, neededSlot); // expected to fail with ERROR_INSUFFICIENT_BUFFER
+    const needed = decodeUint32(neededSlot);
+    if (needed === 0)
+        throwLastError(api, 'GetTokenInformation', 'TokenGroups size query');
+    if (needed < abi.TOKEN_GROUPS_OFFSET)
+        throwWin32(api, 'GetTokenInformation', api.getLastError(), `implausible TokenGroups size ${needed}`);
+    const groups = Buffer.alloc(needed);
+    if (api.getTokenInformation(token, abi.TokenGroups, groups, groups.length, neededSlot) === 0) {
+        throwLastError(api, 'GetTokenInformation', 'TokenGroups');
+    }
+    const groupCount = groups.readUInt32LE(0);
+    for (let index = 0; index < groupCount; index++) {
+        const sidPtr = decodePtrAt(groups, abi.TOKEN_GROUPS_OFFSET + index * abi.SID_AND_ATTRIBUTES_SIZE);
+        const attributes = groups.readUInt32LE(abi.TOKEN_GROUPS_OFFSET + index * abi.SID_AND_ATTRIBUTES_SIZE + 8);
+        // >>> 0: JS bitwise & is signed 32-bit; SE_GROUP_LOGON_ID has bit 31 set.
+        const isLogonId = ((attributes & abi.SE_GROUP_LOGON_ID) >>> 0) === (abi.SE_GROUP_LOGON_ID >>> 0);
+        if (sidPtr === null || !isLogonId)
+            continue;
+        const sidLength = api.getLengthSid(sidPtr);
+        if (sidLength === 0)
+            throwLastError(api, 'GetLengthSid', `logon SID group ${index}`);
+        const copy = allocBytes(sidLength);
+        if (api.copySid(sidLength, copy, sidPtr) === 0)
+            throwLastError(api, 'CopySid', `logon SID group ${index}`);
+        return copy;
+    }
+    throw new Error(`CreateRestrictedToken prerequisite failed: no logon SID found among ${groupCount} token groups`);
+}
+/**
+ * Create one well-known SID (68-byte buffer) and assert its validity.
+ * @param api - the binding table.
+ * @param type - the WELL_KNOWN_SID_TYPE to create.
+ * @returns the created SID pointer.
+ */
+export function makeWellKnownSid(api, type) {
+    const sid = allocBytes(abi.SECURITY_MAX_SID_SIZE);
+    const sizeSlot = allocUint32();
+    encodeUint32(sizeSlot, abi.SECURITY_MAX_SID_SIZE);
+    if (api.createWellKnownSid(type, null, sid, sizeSlot) === 0) {
+        throwLastError(api, 'CreateWellKnownSid', `type ${type}`);
+    }
+    if (api.isValidSid(sid) === 0)
+        throwLastError(api, 'IsValidSid', `CreateWellKnownSid type ${type}`);
+    return sid;
+}
+/**
+ * Merge one full-access allow ACE for `sidPtr` into the token's DEFAULT DACL
+ * — the DACL every NEW object the token holder creates (without an explicit
+ * security descriptor) takes. The restricted token inherits the user's
+ * default DACL verbatim, which names no restricting SID: a new anonymous pipe
+ * (child stdio) therefore fails the write pass-2 check at creation
+ * (ERROR_ACCESS_DENIED; Node surfaces it as spawn EPERM), breaking every
+ * piped-stdio grandchild spawn. The merged ACE names a RESTRICTING SID (the
+ * write SID under workspace-write, Everyone under read-only), so each new
+ * object's own DACL passes pass-2 while object creation itself stays gated by
+ * the parent container's DACL (files outside the granted trees remain
+ * uncreatable). Fails closed: any Win32 failure throws before the spawn.
+ * @param api - the binding table.
+ * @param token - the restricted token to adjust (requires TOKEN_ADJUST_DEFAULT).
+ * @param sidPtr - the restricting SID whose full-access ACE joins the default DACL.
+ */
+export function setTokenDefaultDaclGrant(api, token, sidPtr) {
+    const neededSlot = allocUint32();
+    api.getTokenInformation(token, abi.TokenDefaultDacl, null, 0, neededSlot); // expected to fail with ERROR_INSUFFICIENT_BUFFER
+    const needed = decodeUint32(neededSlot);
+    if (needed === 0)
+        throwLastError(api, 'GetTokenInformation', 'TokenDefaultDacl size query');
+    const buffer = Buffer.alloc(needed);
+    if (api.getTokenInformation(token, abi.TokenDefaultDacl, buffer, buffer.length, neededSlot) === 0) {
+        throwLastError(api, 'GetTokenInformation', 'TokenDefaultDacl');
+    }
+    const currentDacl = decodePtrAt(buffer, 0);
+    if (currentDacl === null) {
+        throw new Error('setTokenDefaultDaclGrant: the token carries no default DACL to extend');
+    }
+    const newDaclSlot = allocPtrSlot();
+    const result = api.setEntriesInAclW(1, buildExplicitAccess(sidPtr, abi.GRANT_ACCESS, abi.FILE_ALL_ACCESS), currentDacl, newDaclSlot);
+    if (result !== abi.ERROR_SUCCESS)
+        throwWin32(api, 'SetEntriesInAclW', result, 'default DACL merge');
+    const newDacl = decodePtr(newDaclSlot);
+    if (newDacl === null)
+        throwWin32(api, 'SetEntriesInAclW', result, 'null merged default DACL');
+    // TOKEN_DEFAULT_DACL { PACL DefaultDacl; } — the struct is exactly the
+    // pointer; SetTokenInformation copies the ACL before returning.
+    const info = Buffer.alloc(8);
+    info.writeBigUInt64LE(newDacl, 0);
+    if (api.setTokenInformation(token, abi.TokenDefaultDacl, info, info.length) === 0) {
+        const win32Code = api.getLastError();
+        api.localFree(newDacl);
+        throwWin32(api, 'SetTokenInformation', win32Code, 'TokenDefaultDacl');
+    }
+    api.localFree(newDacl);
+}
+/** Pack `SID_AND_ATTRIBUTES[count]` (16-byte stride; Attributes stay 0). */
+function buildRestrictingSids(sids) {
+    const buffer = Buffer.alloc(abi.SID_AND_ATTRIBUTES_SIZE * sids.length);
+    sids.forEach((sid, index) => {
+        buffer.writeBigUInt64LE(ptrAddress(sid), abi.SID_AND_ATTRIBUTES_SIZE * index);
+    });
+    return buffer;
+}
+/**
+ * Create the write-restricted token with the mode-selected restricting list
+ * (verified on Win11 26200, see the POC-worktree restrict-variant harness):
+ *  - read-only:       [logon SID, EVERYONE]
+ *  - workspace-write: [logon SID, EVERYONE, workspace SID, optional temp SID]
+ *
+ * The logon SID + EVERYONE keep-alive group is shared by both modes: early
+ * DLL init dies with 0xC0000142 and CNG (`\Device\CNG` write trustee —
+ * pwsh crashes 0xE0434352) fails without them. The write SIDs join ONLY
+ * workspace-write — read-only carries no write SID, so a standing grant ACE
+ * from an earlier workspace-write period (a `/permission` mode downgrade, or
+ * a crash-resumed session) stays INERT under read-only: the WRITE_RESTRICTED
+ * pass-2 check grants only what the restricting list carries, keeping that
+ * workspace grant inert under read-only while the unrevoked ACE keeps the
+ * re-upgrade free (the grant's exact-ACE skip — no re-propagation).
+ * Everyone's own ambient grants remain the documented partial boundary.
+ * Authenticated Users is absent from BOTH lists: the WMI
+ * namespace security check fails (0x80041003), so CIM is unavailable in
+ * every confined mode, and the C:\-root tree-creation escape (standing
+ * `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACEs) is closed in both — documented in
+ * README. INTERACTIVE/LOCAL are absent from BOTH lists too — the host's
+ * Public tree grants write to INTERACTIVE, so removing it closes that
+ * escape. S-1-2-1 (console logon) is intentionally absent: see win32-abi.ts
+ * for the verified failure modes. FAILS CLOSED: any failure throws — never
+ * spawn unrestricted.
+ * @param api - the binding table.
+ * @param currentToken - the process token to restrict.
+ * @param logonSid - the copied logon session SID.
+ * @param writeSids - the distinct write SIDs forming the workspace and
+ * optional temp allowlists (workspace-write only; empty under read-only).
+ * @param known - the well-known SIDs entering the restricting list.
+ * @param mode - selects the restricting list (workspace-write adds the capability SIDs).
+ * @returns the restricted token handle.
+ */
+export function createRestrictedToken(api, currentToken, logonSid, writeSids, known, mode) {
+    const restrictingSids = buildRestrictingSids(mode === 'read-only'
+        ? [logonSid, known.world]
+        : writeSids.length === 0
+            ? (() => { throw new Error('createRestrictedToken: workspace-write restricting list requires at least one write SID'); })()
+            : [logonSid, known.world, ...writeSids]);
+    const tokenSlot = allocPtrSlot();
+    const created = api.createRestrictedToken(currentToken, abi.DISABLE_MAX_PRIVILEGE | abi.LUA_TOKEN | abi.WRITE_RESTRICTED, 0, null, // no SIDs disabled
+    0, null, // no privileges deleted
+    restrictingSids.length / abi.SID_AND_ATTRIBUTES_SIZE, restrictingSids, tokenSlot);
+    if (created === 0)
+        throwLastError(api, 'CreateRestrictedToken', `restricting SIDs: ${restrictingSids.length / abi.SID_AND_ATTRIBUTES_SIZE}`);
+    const token = decodePtr(tokenSlot);
+    if (token === null)
+        throwWin32(api, 'CreateRestrictedToken', api.getLastError(), 'null token handle');
+    return token;
+}
+//# sourceMappingURL=token.js.map

package/lib/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAEvK,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAA;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAkB;IACxD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IACpF,IAAI,SAAS,CAAC,aAAa,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAEtF,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CACjC,aAAa,EACb,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,EAC3F,SAAS,CACV,CAAA;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA,CAAC,gCAAgC;QAC/D,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,4BAA4B,CAAC,CAAA;IAC1G,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAChG,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB,EAAE,KAAgB;IAC/D,MAAM,UAAU,GAAG,WAAW,EAAE,CAAA;IAChC,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA,CAAC,kDAAkD;IACvH,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,wBAAwB,CAAC,CAAA;IACtF,IAAI,MAAM,GAAG,GAAG,CAAC,mBAAmB;QAAE,UAAU,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,gCAAgC,MAAM,EAAE,CAAC,CAAA;IAE1I,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACzC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,mBAAmB,GAAG,KAAK,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAA;QACjG,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,GAAG,KAAK,GAAG,GAAG,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAA;QACzG,0EAA0E;QAC1E,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAA;QAChG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS;YAAE,SAAQ;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,SAAS,KAAK,CAAC;YAAE,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,mBAAmB,KAAK,EAAE,CAAC,CAAA;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;QAClC,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,mBAAmB,KAAK,EAAE,CAAC,CAAA;QAC1G,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uEAAuE,UAAU,eAAe,CAAC,CAAA;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAY;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;IACjD,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAA;IACnG,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAkB,EAAE,KAAgB,EAAE,MAAiB;IAC9F,MAAM,UAAU,GAAG,WAAW,EAAE,CAAA;IAChC,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA,CAAC,kDAAkD;IAC5H,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,6BAA6B,CAAC,CAAA;IAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClG,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CACjC,CAAC,EACD,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,EAClE,WAAW,EACX,WAAW,CACZ,CAAA;IACD,IAAI,MAAM,KAAK,GAAG,CAAC,aAAa;QAAE,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAA;IACnG,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IACtC,IAAI,OAAO,KAAK,IAAI;QAAE,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAA;IAC7F,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACjC,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACtB,UAAU,CAAC,GAAG,EAAE,qBAAqB,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;IACvE,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;AACxB,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAAC,IAA0B;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,uBAAuB,GAAG,KAAK,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAkB,EAClB,YAAuB,EACvB,QAAmB,EACnB,SAA+B,EAC/B,KAAwB,EACxB,IAAqC;IAErC,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,KAAK,WAAW;QAC/D,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAA,CAAC,CAAC,CAAC,EAAE;YAC1H,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,CACvC,YAAY,EACZ,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,gBAAgB,EAChE,CAAC,EAAE,IAAI,EAAE,mBAAmB;IAC5B,CAAC,EAAE,IAAI,EAAE,wBAAwB;IACjC,eAAe,CAAC,MAAM,GAAG,GAAG,CAAC,uBAAuB,EACpD,eAAe,EACf,SAAS,CACV,CAAA;IACD,IAAI,OAAO,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,qBAAqB,eAAe,CAAC,MAAM,GAAG,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAA;IAC5I,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,UAAU,CAAC,GAAG,EAAE,uBAAuB,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAA;IACrG,OAAO,KAAK,CAAA;AACd,CAAC"}

package/lib/win32-abi.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Windows ABI constants for the ACL-sandbox backend.
+ *
+ * Every value was verified against the actual MinGW Windows headers on this
+ * machine (C:\Strawberry\c\x86_64-w64-mingw32\include\) and cross-checked at
+ * runtime by verify/abi-probe.cpp (same numbers; static_asserts passed).
+ * Regenerate the probe with:
+ *   g++ -std=c++20 -municode -O2 -o abi-probe.exe abi-probe.cpp -ladvapi32 && .\abi-probe.exe
+ *
+ * The port intentionally excludes two pieces of the original POC
+ * (github.com/huoyaoyuan/windows-acl-restrict-poc @ 10e4dfb), both verified
+ * empirically on Windows 11 build 26200:
+ *  - S-1-2-1 (console logon SID) in the restricting list: the POC created it
+ *    via CreateWellKnownSid(WinLocalLogonSid) which fails here with
+ *    ERROR_INVALID_PARAMETER (87), leaving a garbage SID that makes
+ *    CreateRestrictedToken fail with ERROR_INVALID_SID (1337); using the
+ *    correct WinConsoleLogonSid does produce a valid S-1-2-1, but the child
+ *    then still dies with STATUS_DLL_INIT_FAILED (0xC0000142) whenever
+ *    CREATE_NO_WINDOW / CREATE_NEW_CONSOLE is used.
+ *  - Console isolation: under this restriction scheme a hidden console is not
+ *    attainable, so children share the host console (stdio redirection is
+ *    pipe-based and unaffected).
+ * @module @bo-agent/sandbox-windows-acl/win32-abi
+ */
+/** TOKEN_ASSIGN_PRIMARY: required to create a process with the token (CreateProcessAsUser). */
+export declare const TOKEN_ASSIGN_PRIMARY = 1;
+/** TOKEN_DUPLICATE: required to duplicate a token (DuplicateTokenEx). */
+export declare const TOKEN_DUPLICATE = 2;
+/** TOKEN_QUERY: required to read token information (GetTokenInformation). */
+export declare const TOKEN_QUERY = 8;
+/** TOKEN_ADJUST_DEFAULT: required to change a token's default DACL. */
+export declare const TOKEN_ADJUST_DEFAULT = 128;
+/**
+ * SE_GROUP_LOGON_ID: marks a token group SID as the logon SID (compared with
+ * `>>> 0` — the flag's high bit makes it negative as a signed 32-bit number).
+ */
+export declare const SE_GROUP_LOGON_ID = 3221225472;
+/** STANDARD_RIGHTS_WRITE (== READ_CONTROL): the standard-rights component of generic write access. */
+export declare const STANDARD_RIGHTS_WRITE = 131072;
+/** FILE_GENERIC_WRITE: every file-write permission bit plus SYNCHRONIZE. */
+export declare const FILE_GENERIC_WRITE = 1179926;
+/** DELETE: remove or rename the object (winnt.h line ~3009). */
+export declare const DELETE = 65536;
+/** FILE_DELETE_CHILD: remove or rename a directory's children (winnt.h line ~5907). */
+export declare const FILE_DELETE_CHILD = 64;
+/**
+ * GRANT_MASK: FILE_GENERIC_WRITE minus READ_CONTROL plus DELETE and
+ * FILE_DELETE_CHILD — the write+delete access mask the capability-SID ACEs grant
+ * (displays as "Modify" in Explorer/icacls). WRITE_DAC/WRITE_OWNER are
+ * deliberately excluded: they would let the confined child take ownership or
+ * rewrite DACLs.
+ */
+export declare const GRANT_MASK: number;
+/**
+ * FILE_ALL_ACCESS (winnt.h line ~2789: STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE
+ * | 0x1FF): full file-object access. The mask of the ACE merged into the
+ * restricted token's DEFAULT DACL — the token holder must keep full access to
+ * every NEW object it creates (pipes included), and the ACE must name a
+ * restricting SID so the write pass-2 check passes at creation.
+ */
+export declare const FILE_ALL_ACCESS = 2032127;
+/** DISABLE_MAX_PRIVILEGE: strip the token's maximum-privilege elevation so the confined child cannot escalate. */
+export declare const DISABLE_MAX_PRIVILEGE = 1;
+/** LUA_TOKEN: produce a limited-user (filtered admin) token. */
+export declare const LUA_TOKEN = 4;
+/** WRITE_RESTRICTED: intersect write access with the restricting SIDs' ACL grants — the sandbox's core mechanism. */
+export declare const WRITE_RESTRICTED = 8;
+/** WinWorldSid: S-1-1-0 (Everyone) — the only well-known SID the restricted tokens use (keep-alive group; see token.ts). */
+export declare const WinWorldSid = 1;
+/** TokenGroups: GetTokenInformation class returning the token's group SIDs. */
+export declare const TokenGroups = 2;
+/** TokenDefaultDacl: the token's default DACL — the DACL every NEW object created without an explicit SD takes. */
+export declare const TokenDefaultDacl = 6;
+/** DACL_SECURITY_INFORMATION: read/write only the DACL of a security descriptor. */
+export declare const DACL_SECURITY_INFORMATION = 4;
+/** PROCESS_QUERY_INFORMATION: read exit status and times of a process handle. */
+export declare const PROCESS_QUERY_INFORMATION = 1024;
+/** SE_FILE_OBJECT: the trustee path names a filesystem object. */
+export declare const SE_FILE_OBJECT = 1;
+/** TRUSTEE_IS_UNKNOWN: TRUSTEE_TYPE unknown (TrusteeForm carries the shape). */
+export declare const TRUSTEE_IS_UNKNOWN = 0;
+/** TRUSTEE_IS_SID: TRUSTEE_FORM — Trustee.ptstrName is a SID pointer. */
+export declare const TRUSTEE_IS_SID = 0;
+/** NO_MULTIPLE_TRUSTEE: Trustee.pMultipleTrustee is null. */
+export declare const NO_MULTIPLE_TRUSTEE = 0;
+/** GRANT_ACCESS: SetEntriesInAclW adds the entry as an allow ACE. */
+export declare const GRANT_ACCESS = 1;
+/** REVOKE_ACCESS: SetEntriesInAclW removes the matching allow ACE. */
+export declare const REVOKE_ACCESS = 4;
+/**
+ * SUB_CONTAINERS_AND_OBJECTS_INHERIT: the ACE applies to the directory, its
+ * subdirectories, and files (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE).
+ */
+export declare const SUB_CONTAINERS_AND_OBJECTS_INHERIT = 3;
+/**
+ * STARTF_USESTDHANDLES: STARTUPINFOW dwFlags — the child uses the hStd*
+ * handles, required because Node clears stdio inheritability at startup.
+ */
+export declare const STARTF_USESTDHANDLES = 256;
+/** HANDLE_FLAG_INHERIT: SetHandleInformation flag re-enabling handle inheritance for the spawned child's stdio handles. */
+export declare const HANDLE_FLAG_INHERIT = 1;
+/** INFINITE: never-timeout wait value. */
+export declare const INFINITE = 4294967295;
+/** MAX_PATH: legacy path length bound. */
+export declare const MAX_PATH = 260;
+/** CREATE_SUSPENDED: create the child with its primary thread suspended until ResumeThread. */
+export declare const CREATE_SUSPENDED = 4;
+/** STD_INPUT_HANDLE: GetStdHandle selector for the standard input. */
+export declare const STD_INPUT_HANDLE = -10;
+/** STD_OUTPUT_HANDLE: GetStdHandle selector for the standard output. */
+export declare const STD_OUTPUT_HANDLE = -11;
+/** STD_ERROR_HANDLE: GetStdHandle selector for the standard error. */
+export declare const STD_ERROR_HANDLE = -12;
+/** FORMAT_MESSAGE_FROM_SYSTEM: format the message from the system message table. */
+export declare const FORMAT_MESSAGE_FROM_SYSTEM = 4096;
+/** FORMAT_MESSAGE_IGNORE_INSERTS: skip insert-sequence substitution. */
+export declare const FORMAT_MESSAGE_IGNORE_INSERTS = 512;
+/** ERROR_SUCCESS: the operation succeeded. */
+export declare const ERROR_SUCCESS = 0;
+/** ERROR_INSUFFICIENT_BUFFER: a size-probe call succeeded but needs a larger buffer. */
+export declare const ERROR_INSUFFICIENT_BUFFER = 122;
+/** ERROR_BROKEN_PIPE: the pipe's other end has closed. */
+export declare const ERROR_BROKEN_PIPE = 109;
+/** ERROR_NO_DATA: the pipe is being closed. */
+export declare const ERROR_NO_DATA = 232;
+/** ERROR_LOCK_VIOLATION: a byte-range lock conflicts with an existing lock (winerror.h line ~78). */
+export declare const ERROR_LOCK_VIOLATION = 33;
+/** GENERIC_READ: generic read access (winnt.h line ~3028). */
+export declare const GENERIC_READ = 2147483648;
+/** GENERIC_WRITE: generic write access (winnt.h line ~3029). */
+export declare const GENERIC_WRITE = 1073741824;
+/** FILE_SHARE_READ: other opens may read (winnt.h line ~5949). */
+export declare const FILE_SHARE_READ = 1;
+/** FILE_SHARE_WRITE: other opens may write (winnt.h line ~5950). */
+export declare const FILE_SHARE_WRITE = 2;
+/** FILE_SHARE_DELETE: other opens may delete (winnt.h line ~5951) — deliberately NOT used for lock files. */
+export declare const FILE_SHARE_DELETE = 4;
+/** OPEN_ALWAYS: create the lock file if absent, open it otherwise (fileapi.h line ~21). */
+export declare const OPEN_ALWAYS = 4;
+/** LOCKFILE_EXCLUSIVE_LOCK: request an exclusive byte-range lock. */
+export declare const LOCKFILE_EXCLUSIVE_LOCK = 2;
+/** LOCKFILE_FAIL_IMMEDIATELY: fail with ERROR_LOCK_VIOLATION instead of waiting. */
+export declare const LOCKFILE_FAIL_IMMEDIATELY = 1;
+/** ACCESS_ALLOWED_ACE_TYPE: an access-allowed ACE granting the mask to the trustee. */
+export declare const ACCESS_ALLOWED_ACE_TYPE = 0;
+/** SID_MAX_SUB_AUTHORITIES: the most subauthorities a SID may carry. */
+export declare const SID_MAX_SUB_AUTHORITIES = 15;
+/** INHERITED_ACE: the ACE was inherited from the parent object, not stored explicitly. */
+export declare const INHERITED_ACE = 16;
+/** JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE: the child dies when the runner's last job handle closes — the orphan-child backstop. */
+export declare const JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 8192;
+/** JobObjectExtendedLimitInformation: JOBOBJECTINFOCLASS for the extended limit structure. */
+export declare const JobObjectExtendedLimitInformation = 9;
+/** sizeof(JOBOBJECT_EXTENDED_LIMIT_INFORMATION), verified by abi-probe. */
+export declare const JOBOBJECT_EXTENDED_LIMIT_SIZE = 144;
+/**
+ * LimitFlags offset inside JOBOBJECT_EXTENDED_LIMIT_INFORMATION
+ * (BasicLimitInformation@0 + PerProcessUserTimeLimit@0 +
+ * PerJobUserTimeLimit@8), verified by abi-probe.
+ */
+export declare const JOBOBJECT_EXTENDED_LIMIT_FLAGS_OFFSET = 16;
+/** SECURITY_MAX_SID_SIZE: maximum SID byte size. */
+export declare const SECURITY_MAX_SID_SIZE = 68;
+/** SID_AND_ATTRIBUTES stride: { PSID Sid @0 (8); DWORD Attributes @8 (4) } + pad. */
+export declare const SID_AND_ATTRIBUTES_SIZE = 16;
+/** TOKEN_GROUPS.Groups[] starts at offset 8 (GroupCount @0 + alignment). */
+export declare const TOKEN_GROUPS_OFFSET = 8;
+/** sizeof(EXPLICIT_ACCESS_W): perms@0 mode@4 inheritance@8 Trustee@16. */
+export declare const EXPLICIT_ACCESS_W_SIZE = 48;
+/** Trustee offset inside EXPLICIT_ACCESS_W. */
+export declare const TRUSTEE_W_OFFSET = 16;
+/** ptstrName offset inside TRUSTEE_W (=> 40 inside EXPLICIT_ACCESS_W). */
+export declare const TRUSTEE_W_PTSTRNAME_OFFSET = 24;
+/** sizeof(STARTUPINFOW), verified by abi-probe. */
+export declare const STARTUPINFOW_SIZE = 104;
+/** sizeof(PROCESS_INFORMATION), verified by abi-probe. */
+export declare const PROCESS_INFORMATION_SIZE = 24;
+//# sourceMappingURL=win32-abi.d.ts.map

package/lib/win32-abi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"win32-abi.d.ts","sourceRoot":"","sources":["../src/win32-abi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,IAAS,CAAA;AAC1C,yEAAyE;AACzE,eAAO,MAAM,eAAe,IAAS,CAAA;AACrC,6EAA6E;AAC7E,eAAO,MAAM,WAAW,IAAS,CAAA;AACjC,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,MAAS,CAAA;AAG1C;;;GAGG;AACH,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAK3C,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,SAAa,CAAA;AAC/C,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,UAAa,CAAA;AAC5C,gEAAgE;AAChE,eAAO,MAAM,MAAM,QAAa,CAAA;AAChC,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,KAAS,CAAA;AASvC;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAA6E,CAAA;AAEpG;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,UAAW,CAAA;AAGvC,kHAAkH;AAClH,eAAO,MAAM,qBAAqB,IAAM,CAAA;AACxC,gEAAgE;AAChE,eAAO,MAAM,SAAS,IAAM,CAAA;AAC5B,qHAAqH;AACrH,eAAO,MAAM,gBAAgB,IAAM,CAAA;AAGnC,4HAA4H;AAC5H,eAAO,MAAM,WAAW,IAAI,CAAA;AAG5B,+EAA+E;AAC/E,eAAO,MAAM,WAAW,IAAI,CAAA;AAC5B,mHAAmH;AACnH,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAGjC,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,IAAa,CAAA;AAGnD,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,OAAS,CAAA;AAK/C,kEAAkE;AAClE,eAAO,MAAM,cAAc,IAAI,CAAA;AAG/B,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,IAAI,CAAA;AACnC,yEAAyE;AACzE,eAAO,MAAM,cAAc,IAAI,CAAA;AAC/B,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAGpC,qEAAqE;AACrE,eAAO,MAAM,YAAY,IAAI,CAAA;AAC7B,sEAAsE;AACtE,eAAO,MAAM,aAAa,IAAI,CAAA;AAG9B;;;GAGG;AACH,eAAO,MAAM,kCAAkC,IAAM,CAAA;AAIrD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,MAAa,CAAA;AAC9C,2HAA2H;AAC3H,eAAO,MAAM,mBAAmB,IAAM,CAAA;AACtC,0CAA0C;AAC1C,eAAO,MAAM,QAAQ,aAAa,CAAA;AAClC,0CAA0C;AAC1C,eAAO,MAAM,QAAQ,MAAM,CAAA;AAG3B,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,IAAM,CAAA;AAEnC,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,MAAM,CAAA;AACnC,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAGnC,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,OAAa,CAAA;AACpD,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,MAAa,CAAA;AAIvD,8CAA8C;AAC9C,eAAO,MAAM,aAAa,IAAI,CAAA;AAC9B,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAC5C,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,+CAA+C;AAC/C,eAAO,MAAM,aAAa,MAAM,CAAA;AAChC,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAMtC,8DAA8D;AAC9D,eAAO,MAAM,YAAY,aAAa,CAAA;AACtC,gEAAgE;AAChE,eAAO,MAAM,aAAa,aAAa,CAAA;AAIvC,kEAAkE;AAClE,eAAO,MAAM,eAAe,IAAa,CAAA;AACzC,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,IAAa,CAAA;AAC1C,6GAA6G;AAC7G,eAAO,MAAM,iBAAiB,IAAa,CAAA;AAC3C,2FAA2F;AAC3F,eAAO,MAAM,WAAW,IAAI,CAAA;AAE5B,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,IAAM,CAAA;AAC1C,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,IAAM,CAAA;AAG5C,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAIxC,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAKzC,0FAA0F;AAC1F,eAAO,MAAM,aAAa,KAAO,CAAA;AAMjC,+HAA+H;AAC/H,eAAO,MAAM,kCAAkC,OAAa,CAAA;AAE5D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,IAAI,CAAA;AAElD,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,MAAM,CAAA;AAIhD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,KAAK,CAAA;AAIvD,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,KAAK,CAAA;AACzC,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,IAAI,CAAA;AACpC,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,KAAK,CAAA;AACxC,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAClC,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAC5C,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,KAAK,CAAA"}