@descryy/runtime-controller 0.4.0 → 0.4.2

package/dist/sandbox.js

@@ -39,8 +39,64 @@
  * as covered.
  */
 import { execFileSync } from "node:child_process";
-import { accessSync, constants as fsConstants, readFileSync, realpathSync } from "node:fs";
-import { dirname, isAbsolute, join, relative } from "node:path";
+import { accessSync, constants as fsConstants, existsSync, lstatSync, mkdtempSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+/** The hostname a network-denied sandbox runs under, and resolves. The host's own name is not
+ *  used: with the network denied it could not reach anything the host's name reaches anyway. */
+export const SANDBOX_HOSTNAME = "descry-sandbox";
+const ISOLATED_HOSTS = `127.0.0.1\tlocalhost ${SANDBOX_HOSTNAME}\n` + `::1\tlocalhost ip6-localhost ip6-loopback ${SANDBOX_HOSTNAME}\n`;
+const ISOLATED_NSSWITCH = "hosts: files\n";
+let isolatedNamesDir = null;
+/**
+ * The hosts and nsswitch files a network-denied sandbox resolves names from: loopback and its
+ * own hostname, from files only. Written by Descry rather than bound from the host, because the
+ * host's hosts file names internal machines and the host's nsswitch can route a lookup to a
+ * resolver socket the sandbox does not have. One private (0700) directory per process, recreated
+ * if a temp cleaner removed it, removed at exit.
+ */
+function isolatedNameResolutionFiles() {
+    const dir = isolatedNamesDir;
+    if (dir !== null && existsSync(join(dir, "hosts")) && existsSync(join(dir, "nsswitch.conf"))) {
+        return { hosts: join(dir, "hosts"), nsswitch: join(dir, "nsswitch.conf") };
+    }
+    const created = mkdtempSync(join(tmpdir(), "descry-sandbox-names-"));
+    writeFileSync(join(created, "hosts"), ISOLATED_HOSTS, { mode: 0o444 });
+    writeFileSync(join(created, "nsswitch.conf"), ISOLATED_NSSWITCH, { mode: 0o444 });
+    if (isolatedNamesDir === null) {
+        process.once("exit", () => {
+            if (isolatedNamesDir !== null)
+                rmSync(isolatedNamesDir, { recursive: true, force: true });
+        });
+    }
+    isolatedNamesDir = created;
+    return { hosts: join(created, "hosts"), nsswitch: join(created, "nsswitch.conf") };
+}
+/**
+ * Name resolution inside the sandbox, derived from the network policy it runs under.
+ * - Network denied: Descry's own loopback-only files, and no resolv.conf.
+ * - Network not restricted: the host's own files, resolv.conf included (bwrap follows a
+ *   resolv.conf symlink into /run/systemd/resolve to its target) — a filesystem-only policy
+ *   must not silently take DNS away with it.
+ * `-try` on the host files: a host without one of them still starts.
+ */
+function nameResolutionBinds(networkDenied) {
+    if (networkDenied) {
+        const files = isolatedNameResolutionFiles();
+        return ["--ro-bind", files.hosts, "/etc/hosts", "--ro-bind", files.nsswitch, "/etc/nsswitch.conf"];
+    }
+    return [
+        "--ro-bind-try",
+        "/etc/hosts",
+        "/etc/hosts",
+        "--ro-bind-try",
+        "/etc/nsswitch.conf",
+        "/etc/nsswitch.conf",
+        "--ro-bind-try",
+        "/etc/resolv.conf",
+        "/etc/resolv.conf",
+    ];
+}
 /**
  * Whether unprivileged user namespaces -- the kernel feature bwrap needs to build a
  * mount/network namespace without running setuid-root -- are actually enabled on
@@ -119,36 +175,31 @@ function isWithin(root, target) {
     const rel = relative(root, target);
     return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
 }
+function locateExecutable(command, cwd, env) {
+    if (command.includes("/"))
+        return isAbsolute(command) ? command : join(cwd, command);
+    for (const dir of (env.PATH ?? "").split(":")) {
+        if (dir === "")
+            continue;
+        const full = join(dir, command);
+        try {
+            accessSync(full, fsConstants.X_OK);
+            return full;
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
 /**
  * Resolves the real, symlink-followed directory containing the executable
- * `command` would run as -- the one extra host path a sandboxed process needs
- * beyond standard OS dirs and whatever the caller declared. Computed generically,
- * not per-language: an interpreter installed outside `/usr` (nvm, rbenv, pyenv,
- * sdkman) would otherwise be invisible inside the sandbox regardless of language.
- * Returns `null` when unresolvable -- the caller proceeds without an extra bind;
- * the exec fails inside the sandbox the same honest way it would outside one.
+ * `command` would run as. Computed generically, not per-language. Returns `null` when
+ * unresolvable. `applySandbox` binds the wider installation through
+ * `planInterpreterRoots`; this is the narrow, single-directory answer.
  */
 export function resolveExecutableDirectory(command, cwd, env) {
-    let candidate = null;
-    if (command.includes("/")) {
-        candidate = isAbsolute(command) ? command : join(cwd, command);
-    }
-    else {
-        const pathVar = env.PATH ?? "";
-        for (const dir of pathVar.split(":")) {
-            if (dir === "")
-                continue;
-            const full = join(dir, command);
-            try {
-                accessSync(full, fsConstants.X_OK);
-                candidate = full;
-                break;
-            }
-            catch {
-                continue;
-            }
-        }
-    }
+    const candidate = locateExecutable(command, cwd, env);
     if (candidate === null)
         return null;
     try {
@@ -158,20 +209,262 @@ export function resolveExecutableDirectory(command, cwd, env) {
         return null;
     }
 }
-/**
- * Wraps `command`/`args` with `bwrap` so the OS enforces `filesystemPolicy`/
- * `networkPolicy`. Neither declared returns them unchanged -- same non-regression
- * contract as `applyResourceLimits`.
- *
- * **Throws rather than silently spawning unconstrained** when a policy is
- * requested and the real mechanism can't back it -- no mechanism on this platform,
- * or a declared shape this mechanism doesn't implement.
- *
- * Composes with `applyResourceLimits` by wrapping *outside* it (`bwrap … --
- * prlimit … -- realCommand`) -- the mount namespace must exist before `prlimit` or
- * the real command run inside it; `prlimit` (in `/usr/bin`) is reachable through
- * the same base OS binding every sandboxed process gets.
- */
+export const NO_SANDBOX_DISCLOSURES = Object.freeze({ boundInterpreterRoots: [], refusedInterpreterRoots: [] });
+const MAXIMUM_SYMLINK_HOPS = 40;
+function canonicalOrSelf(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+function symlinkChain(start) {
+    const files = [start];
+    const directories = [];
+    let current = start;
+    for (let hop = 0; hop < MAXIMUM_SYMLINK_HOPS; hop += 1) {
+        let isLink = false;
+        try {
+            isLink = lstatSync(current).isSymbolicLink();
+        }
+        catch {
+            break;
+        }
+        if (!isLink)
+            break;
+        const directory = dirname(current);
+        directories.push(directory);
+        let target;
+        try {
+            target = readlinkSync(current);
+        }
+        catch {
+            break;
+        }
+        current = resolve(directory, target);
+        if (files.includes(current))
+            break;
+        files.push(current);
+    }
+    return { files, directories };
+}
+function virtualenvRootOf(executable) {
+    const binDirectory = dirname(executable);
+    if (basename(binDirectory) !== "bin")
+        return null;
+    const root = dirname(binDirectory);
+    return existsSync(join(root, "pyvenv.cfg")) ? root : null;
+}
+function installationPrefixOf(executableDirectory) {
+    if (basename(executableDirectory) !== "bin")
+        return { path: executableDirectory };
+    return { path: dirname(executableDirectory), fallback: executableDirectory };
+}
+function virtualenvHome(virtualenvRoot) {
+    const configPath = join(virtualenvRoot, "pyvenv.cfg");
+    let text;
+    try {
+        text = readFileSync(configPath, "utf8");
+    }
+    catch (error) {
+        return { kind: "refusal", refusal: { path: configPath, reason: `pyvenv.cfg could not be read: ${error instanceof Error ? error.message : String(error)}` } };
+    }
+    for (const line of text.split(/\r?\n/)) {
+        const separator = line.indexOf("=");
+        if (separator === -1 || line.slice(0, separator).trim().toLowerCase() !== "home")
+            continue;
+        const home = line.slice(separator + 1).trim();
+        if (home === "")
+            break;
+        return { kind: "home", candidate: installationPrefixOf(home) };
+    }
+    return { kind: "refusal", refusal: { path: configPath, reason: "pyvenv.cfg has no home entry, so the interpreter it was built on cannot be located" } };
+}
+function interpreterRootCandidates(executable, refusals) {
+    const candidates = [];
+    let real;
+    try {
+        real = realpathSync(executable);
+    }
+    catch {
+        return candidates;
+    }
+    candidates.push(installationPrefixOf(dirname(real)));
+    const chain = symlinkChain(executable);
+    for (const file of chain.files) {
+        const virtualenvRoot = virtualenvRootOf(file);
+        if (virtualenvRoot === null)
+            continue;
+        candidates.push({ path: virtualenvRoot });
+        const home = virtualenvHome(virtualenvRoot);
+        if (home.kind === "home")
+            candidates.push(home.candidate);
+        else
+            refusals.push(home.refusal);
+    }
+    for (const directory of chain.directories)
+        candidates.push({ path: directory });
+    return candidates;
+}
+function homeDirectories(env) {
+    const homes = new Set();
+    const declared = env.HOME;
+    if (declared !== undefined && isAbsolute(declared))
+        homes.add(canonicalOrSelf(declared));
+    try {
+        homes.add(canonicalOrSelf(homedir()));
+    }
+    catch {
+        return [...homes];
+    }
+    return [...homes];
+}
+const SHARED_HOME_DIRECTORIES = new Set([".local", ".config", ".cache", ".var", "snap", "Library", ".npm", ".cargo"]);
+export const CREDENTIAL_STORES = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".azure",
+    ".kube",
+    ".docker",
+    ".netrc",
+    ".git-credentials",
+    ".password-store",
+    ".pypirc",
+    ".npmrc",
+    "share/keyrings",
+    ".config/gcloud",
+    ".descry/credentials",
+];
+function credentialStoreInside(directory, ignoredEntries = new Set()) {
+    for (const entry of CREDENTIAL_STORES) {
+        if (ignoredEntries.has(entry))
+            continue;
+        if (existsSync(join(directory, entry)))
+            return entry;
+    }
+    return null;
+}
+const PROJECT_LEVEL_CREDENTIAL_FILES = new Set([".npmrc"]);
+export function sandboxPathRefusalReason(path, role, env = process.env) {
+    if (typeof path !== "string" || path === "")
+        return `${role} is empty`;
+    if (!isAbsolute(path))
+        return `${role} ${path} is not an absolute path`;
+    const canonical = canonicalOrSelf(path);
+    if (canonical === "/")
+        return `${role} ${path} resolves to the filesystem root, which a sandbox never binds`;
+    for (const home of homeDirectories(env)) {
+        if (canonical === home)
+            return `${role} ${path} is the user's home directory, which holds credential stores a sandboxed run must never read`;
+        if (isWithin(canonical, home))
+            return `${role} ${path} is an ancestor of the user's home directory, which a sandbox never binds`;
+    }
+    const store = credentialStoreInside(canonical, PROJECT_LEVEL_CREDENTIAL_FILES);
+    if (store !== null)
+        return `${role} ${path} contains a credential store (${store}), which a sandboxed run must never read`;
+    return null;
+}
+export function writableAllowedRoots(policy) {
+    const readOnly = new Set((policy?.readOnlyRoots ?? []).map((root) => resolve(root)));
+    return (policy?.allowedRoots ?? []).filter((root) => !readOnly.has(resolve(root)));
+}
+function assertSandboxPathsAllowed(options, env) {
+    const policy = options.filesystemPolicy;
+    const candidates = [["working directory", options.cwd]];
+    for (const root of policy?.allowedRoots ?? [])
+        candidates.push(["allowed root", root]);
+    for (const root of policy?.readOnlyRoots ?? [])
+        candidates.push(["read-only root", root]);
+    for (const [role, path] of candidates) {
+        const reason = sandboxPathRefusalReason(path, role, env);
+        if (reason !== null)
+            throw new Error(`sandbox refused: ${reason}`);
+    }
+}
+function interpreterRootRefusalReason(path, canonical, homes, cwd, allowedRoots) {
+    if (!isAbsolute(path))
+        return `${path} is not an absolute path`;
+    if (canonical === null)
+        return `${path} does not exist`;
+    try {
+        if (!statSync(canonical).isDirectory())
+            return `${path} is not a directory`;
+    }
+    catch {
+        return `${path} does not exist`;
+    }
+    if (canonical === "/")
+        return "the filesystem root is never bound";
+    for (const home of homes) {
+        if (canonical === home)
+            return "the user's home directory itself is never bound";
+        if (isWithin(canonical, home))
+            return "an ancestor of the user's home directory is never bound";
+        if (dirname(canonical) === home && SHARED_HOME_DIRECTORIES.has(basename(canonical))) {
+            return `${basename(canonical)} in the home directory is shared by every program the user runs, so it is never bound whole`;
+        }
+    }
+    const store = credentialStoreInside(canonical);
+    if (store !== null)
+        return `it contains a credential store (${store}), which a sandboxed run must never read`;
+    const canonicalCwd = canonicalOrSelf(cwd);
+    if (canonical !== canonicalCwd && isWithin(canonical, canonicalCwd)) {
+        return "an ancestor of the working directory is never bound -- it would expose sibling projects";
+    }
+    for (const allowed of allowedRoots) {
+        const canonicalAllowed = canonicalOrSelf(allowed);
+        if (canonical !== canonicalAllowed && isWithin(canonical, canonicalAllowed)) {
+            return `it contains the allowed root ${allowed}, which a read-only bind would shadow`;
+        }
+    }
+    return null;
+}
+function planInterpreterRoots(input) {
+    const executable = locateExecutable(input.command, input.cwd, input.env);
+    if (executable === null)
+        return { binds: [], disclosures: NO_SANDBOX_DISCLOSURES };
+    const refusals = [];
+    const candidates = interpreterRootCandidates(executable, refusals);
+    const homes = homeDirectories(input.env);
+    const boundRoots = [...input.boundRoots];
+    const binds = [];
+    const alreadyBound = (path, canonical) => boundRoots.some((bound) => isWithin(bound, path) || (canonical !== null && (isWithin(bound, canonical) || isWithin(canonicalOrSelf(bound), canonical))));
+    function tryBind(path) {
+        let canonical = null;
+        try {
+            canonical = realpathSync(path);
+        }
+        catch {
+            canonical = null;
+        }
+        if (isAbsolute(path) && alreadyBound(path, canonical))
+            return "covered";
+        const reason = interpreterRootRefusalReason(path, canonical, homes, input.cwd, input.allowedRoots);
+        if (reason !== null || canonical === null) {
+            refusals.push({ path, reason: reason ?? `${path} does not exist` });
+            return "refused";
+        }
+        binds.push({ source: canonical, destination: path });
+        boundRoots.push(path);
+        return "bound";
+    }
+    for (const candidate of candidates) {
+        const outcome = tryBind(candidate.path);
+        if (outcome === "refused" && candidate.fallback !== undefined)
+            tryBind(candidate.fallback);
+    }
+    const seenRefusals = new Set();
+    const refusedInterpreterRoots = refusals.filter((refusal) => {
+        const key = JSON.stringify([refusal.path, refusal.reason]);
+        if (seenRefusals.has(key))
+            return false;
+        seenRefusals.add(key);
+        return true;
+    });
+    return { binds, disclosures: { boundInterpreterRoots: binds.map((bind) => bind.destination), refusedInterpreterRoots } };
+}
 export function applySandbox(options) {
     const { filesystemPolicy, networkPolicy } = options;
     if (filesystemPolicy === undefined && networkPolicy === undefined) {
@@ -179,6 +472,7 @@ export function applySandbox(options) {
     }
     const env = options.env ?? process.env;
     const platform = options.platform ?? process.platform;
+    assertSandboxPathsAllowed(options, env);
     if (networkPolicy !== undefined) {
         const shapeReason = unsupportedNetworkPolicyReason(networkPolicy);
         if (shapeReason !== null) {
@@ -196,16 +490,34 @@ export function applySandbox(options) {
         }
     }
     const bwrapArgs = [];
+    let sandboxDisclosures = NO_SANDBOX_DISCLOSURES;
     if (filesystemPolicy !== undefined) {
-        bwrapArgs.push("--ro-bind", "/usr", "/usr", "--symlink", "/usr/bin", "/bin", "--symlink", "/usr/lib", "/lib", "--symlink", "/usr/lib64", "/lib64", "--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--bind", options.cwd, options.cwd);
-        const boundRoots = ["/usr", options.cwd, ...filesystemPolicy.allowedRoots];
-        for (const root of filesystemPolicy.allowedRoots) {
+        bwrapArgs.push("--ro-bind", "/usr", "/usr", "--symlink", "/usr/bin", "/bin", "--symlink", "/usr/lib", "/lib", "--symlink", "/usr/lib64", "/lib64", "--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--bind", options.cwd, options.cwd, 
+        // Without these a suite that talks to its own local server fails with EAI_AGAIN.
+        ...nameResolutionBinds(networkPolicy !== undefined));
+        const writableRoots = writableAllowedRoots(filesystemPolicy);
+        const boundRoots = ["/usr", options.cwd, ...writableRoots];
+        for (const root of writableRoots) {
             bwrapArgs.push("--bind", root, root);
         }
-        const interpreterDir = resolveExecutableDirectory(options.interpreterCommand, options.cwd, env);
-        if (interpreterDir !== null && !boundRoots.some((root) => isWithin(root, interpreterDir))) {
-            bwrapArgs.push("--ro-bind", interpreterDir, interpreterDir);
+        // Read-only, and skipped when already inside a bound root: a nested --ro-bind under a
+        // read-write bind would make part of an allowed root read-only.
+        for (const root of filesystemPolicy.readOnlyRoots ?? []) {
+            if (boundRoots.some((bound) => isWithin(bound, root)))
+                continue;
+            bwrapArgs.push("--ro-bind-try", root, root);
+            boundRoots.push(root);
         }
+        const plan = planInterpreterRoots({
+            command: options.interpreterCommand,
+            cwd: options.cwd,
+            env,
+            boundRoots,
+            allowedRoots: writableRoots,
+        });
+        for (const bind of plan.binds)
+            bwrapArgs.push("--ro-bind", bind.source, bind.destination);
+        sandboxDisclosures = plan.disclosures;
     }
     else {
         // No filesystem restriction declared -- mirror the host root exactly (matches
@@ -214,15 +526,18 @@ export function applySandbox(options) {
         // /proc, /dev, /tmp are remounted explicitly -- a plain `--bind / /` is not
         // recursive and would leave them looking empty inside otherwise.
         bwrapArgs.push("--bind", "/", "/", "--dev", "/dev", "--proc", "/proc", "--bind", "/tmp", "/tmp");
+        // Reaching this branch means a network policy was declared (both absent returned above), so
+        // the host's own name files are overlaid, after the root bind so the root bind cannot cover them.
+        bwrapArgs.push(...nameResolutionBinds(true));
     }
-    bwrapArgs.push("--chdir", options.cwd);
+    bwrapArgs.push("--chdir", options.cwd, "--unshare-pid", "--unshare-ipc", "--unshare-cgroup-try", "--cap-drop", "ALL");
     if (networkPolicy !== undefined) {
-        bwrapArgs.push("--unshare-net");
+        bwrapArgs.push("--unshare-net", "--unshare-uts", "--hostname", SANDBOX_HOSTNAME);
     }
     // Kills the sandboxed tree if bwrap's parent (this Node process) dies
     // unexpectedly -- a second, independent backstop alongside process-manager.ts's
     // group-kill, not a replacement for it.
     bwrapArgs.push("--die-with-parent", "--", options.command, ...options.args);
-    return { command: "bwrap", args: bwrapArgs };
+    return { command: "bwrap", args: bwrapArgs, sandboxDisclosures };
 }
 //# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGhE;;;;;;;;;;;GAWG;AACH,SAAS,+BAA+B;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxF,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8FAA8F,EAAE,CAAC;QAC/H,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sFAAsF,EAAE,CAAC;QACvH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,0OAA0O;AAC1O,MAAM,UAAU,6BAA6B,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC9H,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,qDAAqD,QAAQ,+KAA+K,QAAQ,2CAA2C;SACxS,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,yFAAyF;SAClG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,6EAA6E,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/I,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,gPAAgP;AAChP,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC3H,OAAO,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,CACL,6GAA6G;QAC7G,8GAA8G;QAC9G,4DAA4D,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,GAAW,EAAE,GAAsB;IAC7F,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACnC,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEtD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,yEAAyE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,4EAA4E,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,SAAS,CAAC,IAAI,CACZ,WAAW,EACX,MAAM,EACN,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,EACP,MAAM,EACN,SAAS,EACT,MAAM,EACN,QAAQ,EACR,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,GAAG,CACZ,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,cAAc,GAAG,0BAA0B,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChG,IAAI,cAAc,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YAC1F,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,iEAAiE;QACjE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnG,CAAC;IAED,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,wCAAwC;IACxC,SAAS,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,UAAU,EACV,SAAS,IAAI,WAAW,EACxB,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGnF;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD,MAAM,cAAc,GAClB,wBAAwB,gBAAgB,IAAI,GAAG,6CAA6C,gBAAgB,IAAI,CAAC;AACnH,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAE3C,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,gBAAgB,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACrE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACxB,IAAI,gBAAgB,KAAK,IAAI;gBAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;IACL,CAAC;IACD,gBAAgB,GAAG,OAAO,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,aAAsB;IACjD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,2BAA2B,EAAE,CAAC;QAC5C,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACrG,CAAC;IACD,OAAO;QACL,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,eAAe;QACf,oBAAoB;QACpB,oBAAoB;QACpB,eAAe;QACf,kBAAkB;QAClB,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,+BAA+B;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxF,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8FAA8F,EAAE,CAAC;QAC/H,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sFAAsF,EAAE,CAAC;QACvH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,0OAA0O;AAC1O,MAAM,UAAU,6BAA6B,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC9H,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,qDAAqD,QAAQ,+KAA+K,QAAQ,2CAA2C;SACxS,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,yFAAyF;SAClG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,6EAA6E,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/I,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,gPAAgP;AAChP,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC3H,OAAO,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,CACL,6GAA6G;QAC7G,8GAA8G;QAC9G,4DAA4D,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,GAAW,EAAE,GAAsB;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,GAAW,EAAE,GAAsB;IAC7F,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,MAAM,sBAAsB,GAAuB,MAAM,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC;AAyBpI,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,oBAAoB,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM;QACR,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM;QACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,SAAS,oBAAoB,CAAC,mBAA2B;IACvD,IAAI,QAAQ,CAAC,mBAAmB,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAClF,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;AAC/E,CAAC;AAID,SAAS,cAAc,CAAC,cAAsB;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;IAC/J,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,SAAS;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM;QACvB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,oFAAoF,EAAE,EAAE,CAAC;AAC1J,CAAC;AAED,SAAS,yBAAyB,CAChC,UAAkB,EAClB,QAAkC;IAElC,MAAM,UAAU,GAA+B,EAAE,CAAC;IAClD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,cAAc,KAAK,IAAI;YAAE,SAAS;QACtC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;;YACrD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAChF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;IAC1B,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3I,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,iBAAiB;IACjB,SAAS;IACT,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;CACtB,CAAC;AAEF,SAAS,qBAAqB,CAAC,SAAiB,EAAE,iBAAsC,IAAI,GAAG,EAAE;IAC/F,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,GAAG,IAAI,WAAW,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,IAAI,IAAI,IAAI,0BAA0B,CAAC;IACxE,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,GAAG;QAAE,OAAO,GAAG,IAAI,IAAI,IAAI,+DAA+D,CAAC;IAC7G,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,GAAG,IAAI,IAAI,IAAI,8FAA8F,CAAC;QAC7I,IAAI,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,GAAG,IAAI,IAAI,IAAI,2EAA2E,CAAC;IACnI,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IAC/E,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,IAAI,IAAI,iCAAiC,KAAK,0CAA0C,CAAC;IAC3H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAuB,EAAE,GAAsB;IAChF,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,MAAM,UAAU,GAAqC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,YAAY,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,aAAa,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,IAAY,EACZ,SAAwB,EACxB,KAAwB,EACxB,GAAW,EACX,YAA+B;IAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,IAAI,0BAA0B,CAAC;IAChE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,iBAAiB,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,GAAG,IAAI,qBAAqB,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,iBAAiB,CAAC;IAClC,CAAC;IACD,IAAI,SAAS,KAAK,GAAG;QAAE,OAAO,oCAAoC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,iDAAiD,CAAC;QACjF,IAAI,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,yDAAyD,CAAC;QAChG,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,6FAA6F,CAAC;QAC7H,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,mCAAmC,KAAK,0CAA0C,CAAC;IAC9G,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,YAAY,IAAI,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QACpE,OAAO,yFAAyF,CAAC;IACnG,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,gBAAgB,IAAI,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC5E,OAAO,gCAAgC,OAAO,uCAAuC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA+B;IAC3D,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACnF,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,SAAwB,EAAW,EAAE,CACvE,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3J,SAAS,OAAO,CAAC,IAAY;QAC3B,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACxE,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnG,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,IAAI,iBAAiB,EAAE,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,qBAAqB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,uBAAuB,EAAE,EAAE,CAAC;AAC3H,CAAC;AAmCD,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEtD,yBAAyB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAExC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,yEAAyE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,4EAA4E,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,kBAAkB,GAAuB,sBAAsB,CAAC;IAEpE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,SAAS,CAAC,IAAI,CACZ,WAAW,EACX,MAAM,EACN,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,EACP,MAAM,EACN,SAAS,EACT,MAAM,EACN,QAAQ,EACR,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,GAAG;QACX,iFAAiF;QACjF,GAAG,mBAAmB,CAAC,aAAa,KAAK,SAAS,CAAC,CACpD,CAAC;QACF,MAAM,aAAa,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,sFAAsF;QACtF,gEAAgE;QAChE,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAAE,SAAS;YAChE,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,oBAAoB,CAAC;YAChC,OAAO,EAAE,OAAO,CAAC,kBAAkB;YACnC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG;YACH,UAAU;YACV,YAAY,EAAE,aAAa;SAC5B,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1F,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,iEAAiE;QACjE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjG,4FAA4F;QAC5F,kGAAkG;QAClG,SAAS,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAEtH,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACnF,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,wCAAwC;IACxC,SAAS,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AACnE,CAAC"}

package/dist/spawn-environment.d.ts

@@ -0,0 +1,16 @@
+export interface HostEnvironmentDisclosure {
+    readonly inherited: boolean;
+    readonly droppedNames: readonly string[];
+}
+export interface ChildEnvironment {
+    readonly env: NodeJS.ProcessEnv;
+    readonly hostEnvironment: HostEnvironmentDisclosure;
+}
+export interface ChildEnvironmentInput {
+    readonly host?: NodeJS.ProcessEnv;
+    readonly declared?: Readonly<Record<string, string | undefined>>;
+    readonly inheritHostEnvironment?: boolean;
+    readonly platform?: NodeJS.Platform;
+}
+export declare function buildChildEnvironment(input?: ChildEnvironmentInput): ChildEnvironment;
+//# sourceMappingURL=spawn-environment.d.ts.map

package/dist/spawn-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-environment.d.ts","sourceRoot":"","sources":["../src/spawn-environment.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;CACrD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CACrC;AAQD,wBAAgB,qBAAqB,CAAC,KAAK,GAAE,qBAA0B,GAAG,gBAAgB,CAwBzF"}

package/dist/spawn-environment.js

@@ -0,0 +1,35 @@
+import { PASSED_ENV_NAMES, SECRET_LOOKING_NAME } from "./environment-metadata.js";
+const ADDITIONAL_SPAWN_ENV_NAMES = /^(CI|NODE_ENV|NODE_PATH|NODE_EXTRA_CA_CERTS|NODE_NO_WARNINGS|NODE_DISABLE_COLORS|FORCE_COLOR|NO_COLOR|COLORTERM|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|CURL_CA_BUNDLE|LD_LIBRARY_PATH|PYTHONPATH|PYTHONHOME|PYTHONUTF8|PYTHONIOENCODING|PYTHONDONTWRITEBYTECODE|PYTHONUNBUFFERED|XDG_[A-Z_]+|DOCKER_HOST|DOCKER_CONFIG|DOCKER_CONTEXT|DOCKER_TLS_VERIFY|DOCKER_CERT_PATH|GOCACHE|GOMODCACHE|GOENV|GOOS|GOARCH|CGO_[A-Z0-9_]+|GRADLE_[A-Z_]+|DOTNET_[A-Z0-9_]+|NUGET_[A-Z_]+|CARGO_[A-Z_]+|RUSTFLAGS)$/;
+function isPassedHostName(name, platform) {
+    const comparable = platform === "win32" ? name.toUpperCase() : name;
+    if (SECRET_LOOKING_NAME.test(comparable))
+        return false;
+    return PASSED_ENV_NAMES.test(comparable) || ADDITIONAL_SPAWN_ENV_NAMES.test(comparable);
+}
+export function buildChildEnvironment(input = {}) {
+    const host = input.host ?? process.env;
+    const platform = input.platform ?? process.platform;
+    const inherit = input.inheritHostEnvironment === true;
+    const declared = input.declared ?? {};
+    const declaredNames = new Set(Object.keys(declared));
+    const env = {};
+    const droppedNames = [];
+    for (const [name, value] of Object.entries(host)) {
+        if (value === undefined)
+            continue;
+        if (inherit || isPassedHostName(name, platform)) {
+            env[name] = value;
+        }
+        else if (!declaredNames.has(name)) {
+            droppedNames.push(name);
+        }
+    }
+    for (const [name, value] of Object.entries(declared)) {
+        if (value === undefined)
+            delete env[name];
+        else
+            env[name] = value;
+    }
+    return { env, hostEnvironment: { inherited: inherit, droppedNames: droppedNames.sort() } };
+}
+//# sourceMappingURL=spawn-environment.js.map

package/dist/spawn-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-environment.js","sourceRoot":"","sources":["../src/spawn-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAElF,MAAM,0BAA0B,GAC9B,8eAA8e,CAAC;AAmBjf,SAAS,gBAAgB,CAAC,IAAY,EAAE,QAAyB;IAC/D,MAAM,UAAU,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAA+B,EAAE;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,IAAI,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;aAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;;YACrC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;AAC7F,CAAC"}

package/dist/target-pid.d.ts

@@ -0,0 +1,6 @@
+export interface TargetPidOptions {
+    readonly allowOwnProcess?: boolean;
+}
+export declare function targetPidRefusalReason(pid: unknown, options?: TargetPidOptions): string | null;
+export declare function assertTargetPid(pid: unknown, options?: TargetPidOptions): asserts pid is number;
+//# sourceMappingURL=target-pid.d.ts.map

package/dist/target-pid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-pid.d.ts","sourceRoot":"","sources":["../src/target-pid.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,GAAG,IAAI,CAWlG;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAGnG"}

package/dist/target-pid.js

@@ -0,0 +1,18 @@
+export function targetPidRefusalReason(pid, options = {}) {
+    if (typeof pid !== "number" || !Number.isSafeInteger(pid)) {
+        return `pid ${String(pid)} is not an integer`;
+    }
+    if (pid <= 1) {
+        return `pid ${String(pid)} is not a process this runtime may target (0 and negative values address process groups, 1 is init)`;
+    }
+    if (options.allowOwnProcess !== true && (pid === process.pid || pid === process.ppid)) {
+        return `pid ${String(pid)} is this runtime's own process or its parent`;
+    }
+    return null;
+}
+export function assertTargetPid(pid, options = {}) {
+    const reason = targetPidRefusalReason(pid, options);
+    if (reason !== null)
+        throw new RangeError(`invalid target pid: ${reason}`);
+}
+//# sourceMappingURL=target-pid.js.map

package/dist/target-pid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-pid.js","sourceRoot":"","sources":["../src/target-pid.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,UAA4B,EAAE;IACjF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAChD,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,OAAO,OAAO,MAAM,CAAC,GAAG,CAAC,qGAAqG,CAAC;IACjI,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO,OAAO,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,UAA4B,EAAE;IAC1E,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descryy/runtime-controller",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "type": "module",
   "description": "Runtime controller: process manager, readiness, timeout/cancellation, execution IDs, cleanup. Deliverable 2 of the runtime phase — depends on @descryy/runtime-contracts, builds no collectors.",
   "license": "UNLICENSED",
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@descryy/runtime-contracts": "0.4.0"
+    "@descryy/runtime-contracts": "0.4.1"
   },
   "scripts": {
     "build": "tsc -b"