@rushstack/playwright-browser-tunnel 0.1.0

package/lib/HttpServer.d.ts

@@ -0,0 +1,20 @@
+import { URL } from 'node:url';
+import { WebSocketServer } from 'ws';
+import type { ITerminal } from '@rushstack/terminal';
+/**
+ * This HttpServer is used for the localProxyWs WebSocketServer.
+ * The purpose is to parse the query params and path for the websocket url to get the
+ * browserName and launchOptions.
+ */
+export declare class HttpServer {
+    private readonly _server;
+    private readonly _wsServer;
+    private _listeningAddress;
+    private _logger;
+    constructor(logger: ITerminal);
+    listenAsync(): Promise<URL>;
+    get endpoint(): string;
+    get wsServer(): WebSocketServer;
+    [Symbol.dispose](): void;
+}
+//# sourceMappingURL=HttpServer.d.ts.map

package/lib/HttpServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpServer.d.ts","sourceRoot":"","sources":["../src/HttpServer.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAerD;;;;GAIG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,OAAO,CAAY;gBAER,MAAM,EAAE,SAAS;IAevB,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAqBxC,IAAW,QAAQ,IAAI,MAAM,CAK5B;IAED,IAAW,QAAQ,IAAI,eAAe,CAErC;IAEM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;CAIhC"}

package/lib/HttpServer.js

@@ -0,0 +1,77 @@
+"use strict";
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpServer = void 0;
+const node_http_1 = __importDefault(require("node:http"));
+const node_url_1 = require("node:url");
+const ws_1 = require("ws");
+const LOCALHOST = 'localhost';
+/**
+ * Formats an address info object into a WebSocket-compatible address string.
+ * IPv6 addresses are formatted with brackets: [address]:port
+ * IPv4 addresses are formatted as: address:port
+ */
+function formatAddress(addressInfo) {
+    return addressInfo.family === 'IPv6'
+        ? `[${addressInfo.address}]:${addressInfo.port}`
+        : `${addressInfo.address}:${addressInfo.port}`;
+}
+/**
+ * This HttpServer is used for the localProxyWs WebSocketServer.
+ * The purpose is to parse the query params and path for the websocket url to get the
+ * browserName and launchOptions.
+ */
+class HttpServer {
+    constructor(logger) {
+        this._logger = logger;
+        // We'll create an HTTP server and attach a WebSocketServer in noServer mode so we can
+        // manually parse the URL and extract query parameters before upgrading.
+        this._server = node_http_1.default.createServer();
+        this._wsServer = new ws_1.WebSocketServer({ noServer: true });
+        this._server.on('upgrade', (request, socket, head) => {
+            // Accept all upgrades on the root path. We parse query string for browserName + launchOptions.
+            this._wsServer.handleUpgrade(request, socket, head, (ws) => {
+                this._wsServer.emit('connection', ws, request);
+            });
+        });
+    }
+    async listenAsync() {
+        return await new Promise((resolve) => {
+            // Bind to 'localhost' which resolves to IPv4 (127.0.0.1) or IPv6 (::1)
+            // depending on system configuration and DNS resolution
+            this._server.listen(0, LOCALHOST, () => {
+                const addressInfo = this._server.address();
+                if (!addressInfo) {
+                    throw new Error('Server address is null - server may not be bound properly');
+                }
+                if (typeof addressInfo === 'string') {
+                    throw new Error(`Server address is a pipe/socket path (${addressInfo}), expected an IP address`);
+                }
+                const formattedAddress = formatAddress(addressInfo);
+                this._listeningAddress = formattedAddress;
+                // This MUST be printed to terminal so VS Code can auto-port forward
+                this._logger.writeLine(`Local proxy HttpServer listening at ws://${formattedAddress}`);
+                resolve(new node_url_1.URL(`ws://${formattedAddress}`));
+            });
+        });
+    }
+    get endpoint() {
+        if (this._listeningAddress === undefined) {
+            throw new Error('HttpServer not listening yet');
+        }
+        return `ws://${this._listeningAddress}`;
+    }
+    get wsServer() {
+        return this._wsServer;
+    }
+    [Symbol.dispose]() {
+        this._wsServer.close();
+        this._server.close();
+    }
+}
+exports.HttpServer = HttpServer;
+//# sourceMappingURL=HttpServer.js.map

package/lib/HttpServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpServer.js","sourceRoot":"","sources":["../src/HttpServer.ts"],"names":[],"mappings":";AAAA,4FAA4F;AAC5F,2DAA2D;;;;;;AAE3D,0DAA6B;AAE7B,uCAA+B;AAE/B,2BAAqD;AAIrD,MAAM,SAAS,GAAW,WAAW,CAAC;AAEtC;;;;GAIG;AACH,SAAS,aAAa,CAAC,WAAwB;IAC7C,OAAO,WAAW,CAAC,MAAM,KAAK,MAAM;QAClC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,KAAK,WAAW,CAAC,IAAI,EAAE;QAChD,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAa,UAAU;IAMrB,YAAmB,MAAiB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,sFAAsF;QACtF,wEAAwE;QACxE,IAAI,CAAC,OAAO,GAAG,mBAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YACnD,+FAA+F;YAC/F,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAa,EAAE,EAAE;gBACpE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,WAAW;QACtB,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,uEAAuE;YACvE,uDAAuD;YACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;gBACrC,MAAM,WAAW,GAAgC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,WAAW,2BAA2B,CAAC,CAAC;gBACnG,CAAC;gBACD,MAAM,gBAAgB,GAAW,aAAa,CAAC,WAAW,CAAC,CAAC;gBAC5D,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;gBAC1C,oEAAoE;gBACpE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,4CAA4C,gBAAgB,EAAE,CAAC,CAAC;gBACvF,OAAO,CAAC,IAAI,cAAG,CAAC,QAAQ,gBAAgB,EAAE,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAW,QAAQ;QACjB,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,QAAQ,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC1C,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEM,CAAC,MAAM,CAAC,OAAO,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAzDD,gCAyDC","sourcesContent":["// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.\n// See LICENSE in the project root for license information.\n\nimport http from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport { URL } from 'node:url';\n\nimport { WebSocketServer, type WebSocket } from 'ws';\n\nimport type { ITerminal } from '@rushstack/terminal';\n\nconst LOCALHOST: string = 'localhost';\n\n/**\n * Formats an address info object into a WebSocket-compatible address string.\n * IPv6 addresses are formatted with brackets: [address]:port\n * IPv4 addresses are formatted as: address:port\n */\nfunction formatAddress(addressInfo: AddressInfo): string {\n  return addressInfo.family === 'IPv6'\n    ? `[${addressInfo.address}]:${addressInfo.port}`\n    : `${addressInfo.address}:${addressInfo.port}`;\n}\n\n/**\n * This HttpServer is used for the localProxyWs WebSocketServer.\n * The purpose is to parse the query params and path for the websocket url to get the\n * browserName and launchOptions.\n */\nexport class HttpServer {\n  private readonly _server: http.Server;\n  private readonly _wsServer: WebSocketServer; // local proxy websocket server accepting browser clients\n  private _listeningAddress: string | undefined;\n  private _logger: ITerminal;\n\n  public constructor(logger: ITerminal) {\n    this._logger = logger;\n    // We'll create an HTTP server and attach a WebSocketServer in noServer mode so we can\n    // manually parse the URL and extract query parameters before upgrading.\n    this._server = http.createServer();\n    this._wsServer = new WebSocketServer({ noServer: true });\n\n    this._server.on('upgrade', (request, socket, head) => {\n      // Accept all upgrades on the root path. We parse query string for browserName + launchOptions.\n      this._wsServer.handleUpgrade(request, socket, head, (ws: WebSocket) => {\n        this._wsServer.emit('connection', ws, request);\n      });\n    });\n  }\n\n  public async listenAsync(): Promise<URL> {\n    return await new Promise((resolve) => {\n      // Bind to 'localhost' which resolves to IPv4 (127.0.0.1) or IPv6 (::1)\n      // depending on system configuration and DNS resolution\n      this._server.listen(0, LOCALHOST, () => {\n        const addressInfo: AddressInfo | string | null = this._server.address();\n        if (!addressInfo) {\n          throw new Error('Server address is null - server may not be bound properly');\n        }\n        if (typeof addressInfo === 'string') {\n          throw new Error(`Server address is a pipe/socket path (${addressInfo}), expected an IP address`);\n        }\n        const formattedAddress: string = formatAddress(addressInfo);\n        this._listeningAddress = formattedAddress;\n        // This MUST be printed to terminal so VS Code can auto-port forward\n        this._logger.writeLine(`Local proxy HttpServer listening at ws://${formattedAddress}`);\n        resolve(new URL(`ws://${formattedAddress}`));\n      });\n    });\n  }\n\n  public get endpoint(): string {\n    if (this._listeningAddress === undefined) {\n      throw new Error('HttpServer not listening yet');\n    }\n    return `ws://${this._listeningAddress}`;\n  }\n\n  public get wsServer(): WebSocketServer {\n    return this._wsServer;\n  }\n\n  public [Symbol.dispose](): void {\n    this._wsServer.close();\n    this._server.close();\n  }\n}\n"]}

package/lib/LaunchOptionsValidator.d.ts

@@ -0,0 +1,93 @@
+import type { LaunchOptions } from 'playwright-core';
+import type { ITerminal } from '@rushstack/terminal';
+/**
+ * The filename used to store the launch options allowlist.
+ * Stored in the user's home directory/.playwright-browser-tunnel folder.
+ * @beta
+ */
+export declare const LAUNCH_OPTIONS_ALLOWLIST_FILENAME: string;
+/**
+ * Interface for the allowlist configuration stored in the user's local file system.
+ * @beta
+ */
+export interface ILaunchOptionsAllowlist {
+    /**
+     * Set of launch option keys that the user has explicitly allowed.
+     * These bypass the default security restrictions.
+     */
+    allowedOptions: string[];
+    /**
+     * Version of the allowlist format, for future compatibility.
+     */
+    version: number;
+}
+/**
+ * Result of validating launch options against the allowlist.
+ * @beta
+ */
+export interface ILaunchOptionsValidationResult {
+    /**
+     * Whether the launch options are valid and allowed.
+     */
+    isValid: boolean;
+    /**
+     * Launch options that were denied due to security restrictions.
+     */
+    deniedOptions: Array<keyof LaunchOptions>;
+    /**
+     * Filtered launch options with denied properties removed.
+     */
+    filteredOptions: LaunchOptions;
+    /**
+     * Warning messages about denied options.
+     */
+    warnings: string[];
+}
+/**
+ * Validates Playwright launch options against security allowlists.
+ * Provides utilities for managing client-side allowlist configuration.
+ * @beta
+ */
+export declare class LaunchOptionsValidator {
+    private static readonly _allowlistVersion;
+    /**
+     * Gets the path to the allowlist file in the user's local preferences folder.
+     * This follows the pattern of playwright-browser-installed.txt but stores in user's home directory.
+     */
+    static getAllowlistFilePath(): string;
+    /**
+     * Reads the allowlist from the user's local file system.
+     * Returns an empty allowlist if the file doesn't exist or is invalid.
+     */
+    static readAllowlistAsync(): Promise<ILaunchOptionsAllowlist>;
+    /**
+     * Writes the allowlist to the user's local file system.
+     */
+    static writeAllowlistAsync(allowlist: ILaunchOptionsAllowlist): Promise<void>;
+    /**
+     * Validates launch options against the security allowlist.
+     * All launch options are denied by default unless explicitly allowed by the user.
+     *
+     * @param launchOptions - The launch options to validate
+     * @param terminal - Optional terminal for logging warnings
+     * @returns Validation result with filtered options and warnings
+     */
+    static validateLaunchOptionsAsync(launchOptions: LaunchOptions, terminal?: ITerminal): Promise<ILaunchOptionsValidationResult>;
+    /**
+     * Adds an option to the allowlist.
+     */
+    static addToAllowlistAsync(option: keyof LaunchOptions): Promise<void>;
+    /**
+     * Removes an option from the allowlist.
+     */
+    static removeFromAllowlistAsync(option: keyof LaunchOptions): Promise<void>;
+    /**
+     * Clears the entire allowlist.
+     */
+    static clearAllowlistAsync(): Promise<void>;
+    /**
+     * Gets a human-readable description of the allowlist security model.
+     */
+    static getAllowlistDescription(): string;
+}
+//# sourceMappingURL=LaunchOptionsValidator.d.ts.map

package/lib/LaunchOptionsValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LaunchOptionsValidator.d.ts","sourceRoot":"","sources":["../src/LaunchOptionsValidator.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAoD,CAAC;AAErG;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,aAAa,EAAE,KAAK,CAAC,MAAM,aAAa,CAAC,CAAC;IAE1C;;OAEG;IACH,eAAe,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAa;IAEtD;;;OAGG;WACW,oBAAoB,IAAI,MAAM;IAO5C;;;OAGG;WACiB,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAuC1E;;OAEG;WACiB,mBAAmB,CAAC,SAAS,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1F;;;;;;;OAOG;WACiB,0BAA0B,CAC5C,aAAa,EAAE,aAAa,EAC5B,QAAQ,CAAC,EAAE,SAAS,GACnB,OAAO,CAAC,8BAA8B,CAAC;IA4C1C;;OAEG;WACiB,mBAAmB,CAAC,MAAM,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASnF;;OAEG;WACiB,wBAAwB,CAAC,MAAM,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxF;;OAEG;WACiB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOxD;;OAEG;WACW,uBAAuB,IAAI,MAAM;CAOhD"}

package/lib/LaunchOptionsValidator.js

@@ -0,0 +1,163 @@
+"use strict";
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LaunchOptionsValidator = exports.LAUNCH_OPTIONS_ALLOWLIST_FILENAME = void 0;
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_core_library_1 = require("@rushstack/node-core-library");
+/**
+ * The filename used to store the launch options allowlist.
+ * Stored in the user's home directory/.playwright-browser-tunnel folder.
+ * @beta
+ */
+exports.LAUNCH_OPTIONS_ALLOWLIST_FILENAME = '.playwright-launch-options-allowlist.json';
+/**
+ * Validates Playwright launch options against security allowlists.
+ * Provides utilities for managing client-side allowlist configuration.
+ * @beta
+ */
+class LaunchOptionsValidator {
+    /**
+     * Gets the path to the allowlist file in the user's local preferences folder.
+     * This follows the pattern of playwright-browser-installed.txt but stores in user's home directory.
+     */
+    static getAllowlistFilePath() {
+        // Store in user's home directory under .playwright-browser-tunnel
+        const homeDir = node_os_1.default.homedir();
+        const configDir = node_path_1.default.join(homeDir, '.playwright-browser-tunnel');
+        return node_path_1.default.join(configDir, exports.LAUNCH_OPTIONS_ALLOWLIST_FILENAME);
+    }
+    /**
+     * Reads the allowlist from the user's local file system.
+     * Returns an empty allowlist if the file doesn't exist or is invalid.
+     */
+    static async readAllowlistAsync() {
+        const allowlistPath = this.getAllowlistFilePath();
+        try {
+            if (!node_core_library_1.FileSystem.exists(allowlistPath)) {
+                return {
+                    allowedOptions: [],
+                    version: this._allowlistVersion
+                };
+            }
+            const content = await node_core_library_1.FileSystem.readFileAsync(allowlistPath);
+            const parsed = JSON.parse(content);
+            if (typeof parsed === 'object' &&
+                parsed !== null &&
+                'allowedOptions' in parsed &&
+                Array.isArray(parsed.allowedOptions) &&
+                'version' in parsed &&
+                typeof parsed.version === 'number') {
+                return parsed;
+            }
+            // Invalid format, return empty allowlist
+            return {
+                allowedOptions: [],
+                version: this._allowlistVersion
+            };
+        }
+        catch (error) {
+            // If we can't read the file, return empty allowlist
+            return {
+                allowedOptions: [],
+                version: this._allowlistVersion
+            };
+        }
+    }
+    /**
+     * Writes the allowlist to the user's local file system.
+     */
+    static async writeAllowlistAsync(allowlist) {
+        const allowlistPath = this.getAllowlistFilePath();
+        const configDir = node_path_1.default.dirname(allowlistPath);
+        // Ensure the config directory exists
+        await node_core_library_1.FileSystem.ensureFolderAsync(configDir);
+        const content = JSON.stringify(allowlist, null, 2);
+        await node_core_library_1.FileSystem.writeFileAsync(allowlistPath, content, { ensureFolderExists: true });
+    }
+    /**
+     * Validates launch options against the security allowlist.
+     * All launch options are denied by default unless explicitly allowed by the user.
+     *
+     * @param launchOptions - The launch options to validate
+     * @param terminal - Optional terminal for logging warnings
+     * @returns Validation result with filtered options and warnings
+     */
+    static async validateLaunchOptionsAsync(launchOptions, terminal) {
+        const allowlist = await this.readAllowlistAsync();
+        const allowedOptionsSet = new Set(allowlist.allowedOptions);
+        const deniedOptions = [];
+        const warnings = [];
+        const filteredOptions = {};
+        // Check each provided launch option - deny all unless explicitly allowed
+        for (const key of Object.keys(launchOptions)) {
+            if (allowedOptionsSet.has(key)) {
+                // Option is in the user's allowlist - permit it
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                filteredOptions[key] = launchOptions[key];
+                if (terminal) {
+                    terminal.writeWarningLine(`Launch option '${key}' is allowed by user allowlist. ` +
+                        `Value: ${JSON.stringify(launchOptions[key])}`);
+                }
+            }
+            else {
+                // Option is not in allowlist - deny it
+                deniedOptions.push(key);
+                const warning = `Launch option '${key}' was denied (not in allowlist). ` +
+                    `To allow this option, add it to your local allowlist at: ${this.getAllowlistFilePath()}`;
+                warnings.push(warning);
+                if (terminal) {
+                    terminal.writeWarningLine(warning);
+                }
+            }
+        }
+        return {
+            isValid: deniedOptions.length === 0,
+            deniedOptions,
+            filteredOptions,
+            warnings
+        };
+    }
+    /**
+     * Adds an option to the allowlist.
+     */
+    static async addToAllowlistAsync(option) {
+        const allowlist = await this.readAllowlistAsync();
+        if (!allowlist.allowedOptions.includes(option)) {
+            allowlist.allowedOptions.push(option);
+            await this.writeAllowlistAsync(allowlist);
+        }
+    }
+    /**
+     * Removes an option from the allowlist.
+     */
+    static async removeFromAllowlistAsync(option) {
+        const allowlist = await this.readAllowlistAsync();
+        allowlist.allowedOptions = allowlist.allowedOptions.filter((opt) => opt !== option);
+        await this.writeAllowlistAsync(allowlist);
+    }
+    /**
+     * Clears the entire allowlist.
+     */
+    static async clearAllowlistAsync() {
+        await this.writeAllowlistAsync({
+            allowedOptions: [],
+            version: this._allowlistVersion
+        });
+    }
+    /**
+     * Gets a human-readable description of the allowlist security model.
+     */
+    static getAllowlistDescription() {
+        return (`All launch options are denied by default for security.\n` +
+            `Only options explicitly added to your allowlist will be permitted.\n\n` +
+            `Allowlist location: ${this.getAllowlistFilePath()}`);
+    }
+}
+exports.LaunchOptionsValidator = LaunchOptionsValidator;
+LaunchOptionsValidator._allowlistVersion = 1;
+//# sourceMappingURL=LaunchOptionsValidator.js.map

package/lib/LaunchOptionsValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LaunchOptionsValidator.js","sourceRoot":"","sources":["../src/LaunchOptionsValidator.ts"],"names":[],"mappings":";AAAA,4FAA4F;AAC5F,2DAA2D;;;;;;AAE3D,sDAAyB;AACzB,0DAA6B;AAI7B,oEAA0D;AAG1D;;;;GAIG;AACU,QAAA,iCAAiC,GAAW,2CAA2C,CAAC;AA6CrG;;;;GAIG;AACH,MAAa,sBAAsB;IAGjC;;;OAGG;IACI,MAAM,CAAC,oBAAoB;QAChC,kEAAkE;QAClE,MAAM,OAAO,GAAW,iBAAE,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,SAAS,GAAW,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;QAC3E,OAAO,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yCAAiC,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,kBAAkB;QACpC,MAAM,aAAa,GAAW,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE1D,IAAI,CAAC;YACH,IAAI,CAAC,8BAAU,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,cAAc,EAAE,EAAE;oBAClB,OAAO,EAAE,IAAI,CAAC,iBAAiB;iBAChC,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAW,MAAM,8BAAU,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YACtE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5C,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,gBAAgB,IAAI,MAAM;gBAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;gBACpC,SAAS,IAAI,MAAM;gBACnB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAClC,CAAC;gBACD,OAAO,MAAiC,CAAC;YAC3C,CAAC;YAED,yCAAyC;YACzC,OAAO;gBACL,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,IAAI,CAAC,iBAAiB;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oDAAoD;YACpD,OAAO;gBACL,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,IAAI,CAAC,iBAAiB;aAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAkC;QACxE,MAAM,aAAa,GAAW,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAW,mBAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEtD,qCAAqC;QACrC,MAAM,8BAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAW,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,8BAAU,CAAC,cAAc,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,aAA4B,EAC5B,QAAoB;QAEpB,MAAM,SAAS,GAA4B,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3E,MAAM,iBAAiB,GAAgB,IAAI,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAEzE,MAAM,aAAa,GAA+B,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,eAAe,GAAkB,EAAE,CAAC;QAE1C,yEAAyE;QACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAA+B,EAAE,CAAC;YAC3E,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,gDAAgD;gBAChD,8DAA8D;gBAC7D,eAAuB,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBAEnD,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,gBAAgB,CACvB,kBAAkB,GAAG,kCAAkC;wBACrD,UAAU,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,uCAAuC;gBACvC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAExB,MAAM,OAAO,GACX,kBAAkB,GAAG,mCAAmC;oBACxD,4DAA4D,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC5F,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEvB,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC;YACnC,aAAa;YACb,eAAe;YACf,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAA2B;QACjE,MAAM,SAAS,GAA4B,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE3E,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAA2B;QACtE,MAAM,SAAS,GAA4B,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3E,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;QACpF,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB;QACrC,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAC7B,cAAc,EAAE,EAAE;YAClB,OAAO,EAAE,IAAI,CAAC,iBAAiB;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,uBAAuB;QACnC,OAAO,CACL,0DAA0D;YAC1D,wEAAwE;YACxE,uBAAuB,IAAI,CAAC,oBAAoB,EAAE,EAAE,CACrD,CAAC;IACJ,CAAC;;AAtKH,wDAuKC;AAtKyB,wCAAiB,GAAW,CAAC,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.\n// See LICENSE in the project root for license information.\n\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport type { LaunchOptions } from 'playwright-core';\n\nimport { FileSystem } from '@rushstack/node-core-library';\nimport type { ITerminal } from '@rushstack/terminal';\n\n/**\n * The filename used to store the launch options allowlist.\n * Stored in the user's home directory/.playwright-browser-tunnel folder.\n * @beta\n */\nexport const LAUNCH_OPTIONS_ALLOWLIST_FILENAME: string = '.playwright-launch-options-allowlist.json';\n\n/**\n * Interface for the allowlist configuration stored in the user's local file system.\n * @beta\n */\nexport interface ILaunchOptionsAllowlist {\n  /**\n   * Set of launch option keys that the user has explicitly allowed.\n   * These bypass the default security restrictions.\n   */\n  allowedOptions: string[];\n\n  /**\n   * Version of the allowlist format, for future compatibility.\n   */\n  version: number;\n}\n\n/**\n * Result of validating launch options against the allowlist.\n * @beta\n */\nexport interface ILaunchOptionsValidationResult {\n  /**\n   * Whether the launch options are valid and allowed.\n   */\n  isValid: boolean;\n\n  /**\n   * Launch options that were denied due to security restrictions.\n   */\n  deniedOptions: Array<keyof LaunchOptions>;\n\n  /**\n   * Filtered launch options with denied properties removed.\n   */\n  filteredOptions: LaunchOptions;\n\n  /**\n   * Warning messages about denied options.\n   */\n  warnings: string[];\n}\n\n/**\n * Validates Playwright launch options against security allowlists.\n * Provides utilities for managing client-side allowlist configuration.\n * @beta\n */\nexport class LaunchOptionsValidator {\n  private static readonly _allowlistVersion: number = 1;\n\n  /**\n   * Gets the path to the allowlist file in the user's local preferences folder.\n   * This follows the pattern of playwright-browser-installed.txt but stores in user's home directory.\n   */\n  public static getAllowlistFilePath(): string {\n    // Store in user's home directory under .playwright-browser-tunnel\n    const homeDir: string = os.homedir();\n    const configDir: string = path.join(homeDir, '.playwright-browser-tunnel');\n    return path.join(configDir, LAUNCH_OPTIONS_ALLOWLIST_FILENAME);\n  }\n\n  /**\n   * Reads the allowlist from the user's local file system.\n   * Returns an empty allowlist if the file doesn't exist or is invalid.\n   */\n  public static async readAllowlistAsync(): Promise<ILaunchOptionsAllowlist> {\n    const allowlistPath: string = this.getAllowlistFilePath();\n\n    try {\n      if (!FileSystem.exists(allowlistPath)) {\n        return {\n          allowedOptions: [],\n          version: this._allowlistVersion\n        };\n      }\n\n      const content: string = await FileSystem.readFileAsync(allowlistPath);\n      const parsed: unknown = JSON.parse(content);\n\n      if (\n        typeof parsed === 'object' &&\n        parsed !== null &&\n        'allowedOptions' in parsed &&\n        Array.isArray(parsed.allowedOptions) &&\n        'version' in parsed &&\n        typeof parsed.version === 'number'\n      ) {\n        return parsed as ILaunchOptionsAllowlist;\n      }\n\n      // Invalid format, return empty allowlist\n      return {\n        allowedOptions: [],\n        version: this._allowlistVersion\n      };\n    } catch (error) {\n      // If we can't read the file, return empty allowlist\n      return {\n        allowedOptions: [],\n        version: this._allowlistVersion\n      };\n    }\n  }\n\n  /**\n   * Writes the allowlist to the user's local file system.\n   */\n  public static async writeAllowlistAsync(allowlist: ILaunchOptionsAllowlist): Promise<void> {\n    const allowlistPath: string = this.getAllowlistFilePath();\n    const configDir: string = path.dirname(allowlistPath);\n\n    // Ensure the config directory exists\n    await FileSystem.ensureFolderAsync(configDir);\n\n    const content: string = JSON.stringify(allowlist, null, 2);\n    await FileSystem.writeFileAsync(allowlistPath, content, { ensureFolderExists: true });\n  }\n\n  /**\n   * Validates launch options against the security allowlist.\n   * All launch options are denied by default unless explicitly allowed by the user.\n   *\n   * @param launchOptions - The launch options to validate\n   * @param terminal - Optional terminal for logging warnings\n   * @returns Validation result with filtered options and warnings\n   */\n  public static async validateLaunchOptionsAsync(\n    launchOptions: LaunchOptions,\n    terminal?: ITerminal\n  ): Promise<ILaunchOptionsValidationResult> {\n    const allowlist: ILaunchOptionsAllowlist = await this.readAllowlistAsync();\n    const allowedOptionsSet: Set<string> = new Set(allowlist.allowedOptions);\n\n    const deniedOptions: Array<keyof LaunchOptions> = [];\n    const warnings: string[] = [];\n    const filteredOptions: LaunchOptions = {};\n\n    // Check each provided launch option - deny all unless explicitly allowed\n    for (const key of Object.keys(launchOptions) as Array<keyof LaunchOptions>) {\n      if (allowedOptionsSet.has(key)) {\n        // Option is in the user's allowlist - permit it\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        (filteredOptions as any)[key] = launchOptions[key];\n\n        if (terminal) {\n          terminal.writeWarningLine(\n            `Launch option '${key}' is allowed by user allowlist. ` +\n              `Value: ${JSON.stringify(launchOptions[key])}`\n          );\n        }\n      } else {\n        // Option is not in allowlist - deny it\n        deniedOptions.push(key);\n\n        const warning: string =\n          `Launch option '${key}' was denied (not in allowlist). ` +\n          `To allow this option, add it to your local allowlist at: ${this.getAllowlistFilePath()}`;\n        warnings.push(warning);\n\n        if (terminal) {\n          terminal.writeWarningLine(warning);\n        }\n      }\n    }\n\n    return {\n      isValid: deniedOptions.length === 0,\n      deniedOptions,\n      filteredOptions,\n      warnings\n    };\n  }\n\n  /**\n   * Adds an option to the allowlist.\n   */\n  public static async addToAllowlistAsync(option: keyof LaunchOptions): Promise<void> {\n    const allowlist: ILaunchOptionsAllowlist = await this.readAllowlistAsync();\n\n    if (!allowlist.allowedOptions.includes(option)) {\n      allowlist.allowedOptions.push(option);\n      await this.writeAllowlistAsync(allowlist);\n    }\n  }\n\n  /**\n   * Removes an option from the allowlist.\n   */\n  public static async removeFromAllowlistAsync(option: keyof LaunchOptions): Promise<void> {\n    const allowlist: ILaunchOptionsAllowlist = await this.readAllowlistAsync();\n    allowlist.allowedOptions = allowlist.allowedOptions.filter((opt) => opt !== option);\n    await this.writeAllowlistAsync(allowlist);\n  }\n\n  /**\n   * Clears the entire allowlist.\n   */\n  public static async clearAllowlistAsync(): Promise<void> {\n    await this.writeAllowlistAsync({\n      allowedOptions: [],\n      version: this._allowlistVersion\n    });\n  }\n\n  /**\n   * Gets a human-readable description of the allowlist security model.\n   */\n  public static getAllowlistDescription(): string {\n    return (\n      `All launch options are denied by default for security.\\n` +\n      `Only options explicitly added to your allowlist will be permitted.\\n\\n` +\n      `Allowlist location: ${this.getAllowlistFilePath()}`\n    );\n  }\n}\n"]}

package/lib/PlaywrightBrowserTunnel.d.ts

@@ -0,0 +1,92 @@
+import type { LaunchOptions } from 'playwright-core';
+import semver from 'semver';
+import { type ITerminal } from '@rushstack/terminal';
+/**
+ * Allowed Playwright browser names.
+ * @beta
+ */
+export type BrowserName = 'chromium' | 'firefox' | 'webkit';
+/**
+ * Status values reported by {@link PlaywrightTunnel}.
+ * @beta
+ */
+export type TunnelStatus = 'waiting-for-connection' | 'browser-server-running' | 'stopped' | 'setting-up-browser-server' | 'error';
+/**
+ * Handshake data exchanged during the initial WebSocket connection.
+ * @beta
+ */
+export interface IHandshake {
+    action: 'handshake';
+    browserName: BrowserName;
+    launchOptions: LaunchOptions;
+    playwrightVersion: semver.SemVer;
+}
+/**
+ * Options for configuring a {@link PlaywrightTunnel} instance.
+ * @beta
+ */
+export type IPlaywrightTunnelOptions = {
+    terminal: ITerminal;
+    onStatusChange: (status: TunnelStatus) => void;
+    playwrightInstallPath: string;
+    /**
+     * Optional callback invoked before launching the browser server.
+     * Receives the handshake data including launch options.
+     * If the callback returns false, the browser server launch will be aborted.
+     * This allows the client to prompt the user for approval before starting.
+     */
+    onBeforeLaunch?: (handshake: IHandshake) => Promise<boolean> | boolean;
+} & ({
+    mode: 'poll-connection';
+    wsEndpoint: string;
+} | {
+    mode: 'wait-for-incoming-connection';
+    listenPort: number;
+});
+/**
+ * Hosts a Playwright browser server and forwards traffic over a WebSocket tunnel.
+ * @beta
+ */
+export declare class PlaywrightTunnel {
+    private readonly _terminal;
+    private readonly _onStatusChange;
+    private readonly _onBeforeLaunch?;
+    private readonly _playwrightBrowsersInstalled;
+    private readonly _wsEndpoint;
+    private readonly _listenPort;
+    private readonly _playwrightInstallPath;
+    private _status;
+    private _initWsPromise?;
+    private _keepRunning;
+    private _ws?;
+    private _mode;
+    private _pendingConnectionAttempt?;
+    private _pollInterval?;
+    constructor(options: IPlaywrightTunnelOptions);
+    get status(): TunnelStatus;
+    private set status(value);
+    waitForCloseAsync(): Promise<void>;
+    startAsync(options?: {
+        keepRunning?: boolean;
+    }): Promise<void>;
+    stopAsync(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+    cleanTempFilesAsync(): Promise<void>;
+    private _runCommandAsync;
+    private _installPlaywrightCoreAsync;
+    private _installPlaywrightBrowsersAsync;
+    private _tryConnectAsync;
+    private _pollConnectionAsync;
+    private _waitForIncomingConnectionAsync;
+    private _setupPlaywrightAsync;
+    private _getPlaywrightBrowserServerProxyAsync;
+    private _validateHandshake;
+    private _setupForwardingAsync;
+    /**
+     * Initializes the Playwright browser tunnel by establishing a WebSocket connection
+     * and setting up the browser server.
+     * Returns when the handshake is complete and the browser server is running.
+     */
+    private _initPlaywrightBrowserTunnelAsync;
+}
+//# sourceMappingURL=PlaywrightBrowserTunnel.d.ts.map

package/lib/PlaywrightBrowserTunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlaywrightBrowserTunnel.d.ts","sourceRoot":"","sources":["../src/PlaywrightBrowserTunnel.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAA8B,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEjF,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAMvG;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAM5D;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,SAAS,GACT,2BAA2B,GAC3B,OAAO,CAAC;AAEZ;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC;CAClC;AAID;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,SAAS,CAAC;IACpB,cAAc,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IAC/C,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACxE,GAAG,CACA;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,8BAA8B,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB,CACJ,CAAC;AAOF;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiC;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAwD;IACzF,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA0B;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,cAAc,CAAC,CAAqB;IAC5C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,GAAG,CAAC,CAAY;IACxB,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,yBAAyB,CAAC,CAAqB;IACvD,OAAO,CAAC,aAAa,CAAC,CAAiB;gBAEpB,OAAO,EAAE,wBAAwB;IA6BpD,IAAW,MAAM,IAAI,YAAY,CAEhC;IAGD,OAAO,KAAK,MAAM,QAGjB;IAEY,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAWlC,UAAU,CAAC,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAclE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAW1B,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtC,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;YAcnC,gBAAgB;YA8BhB,2BAA2B;YAU3B,+BAA+B;YAa/B,gBAAgB;YAmBhB,oBAAoB;YAyBpB,+BAA+B;YAwC/B,qBAAqB;YAkBrB,qCAAqC;IA0DnD,OAAO,CAAC,kBAAkB;YAwCZ,qBAAqB;IAoCnC;;;;OAIG;YACW,iCAAiC;CAoGhD"}