@safebrowse/daemon 0.1.2 → 0.1.4

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IAClE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAqBD,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,mBAAmB,CA4DrB;AAED,wBAAsB,YAAY,CAChC,IAAI,GAAE,MAAM,EAA0B,EACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IAClE,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA8BD,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,mBAAmB,CA0HrB;AAED,wBAAsB,YAAY,CAChC,IAAI,GAAE,MAAM,EAA0B,EACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/cli.js

@@ -4,12 +4,21 @@ import { startSafeBrowseDaemon } from "./server.js";
 const HELP_TEXT = `SafeBrowse daemon
 
 Usage:
-  safebrowse-daemon [--host 127.0.0.1] [--port 8787] [--root-dir <path>]
+  safebrowse-daemon [--host 127.0.0.1] [--port 8787] [--root-dir <path>] [--deployment-profile development|secure_v5]
+                    [--approval-broker-mode signature_verification|external_service]
+                    [--parser-isolation-mode scrubbed_process|node_permission_process]
 
 Environment:
   SAFEBROWSE_HOST
   SAFEBROWSE_PORT
   SAFEBROWSE_ROOT_DIR
+  SAFEBROWSE_DEPLOYMENT_PROFILE
+  SAFEBROWSE_APPROVAL_BROKER_PUBLIC_KEY_PATH
+  SAFEBROWSE_APPROVAL_BROKER_MODE
+  SAFEBROWSE_PARSER_ISOLATION_MODE
+
+Notes:
+  secure_v6 is accepted as a deprecated alias for secure_v5.
 `;
 function parsePort(value) {
     const port = Number.parseInt(value, 10);
@@ -27,6 +36,10 @@ export function parseDaemonOptions(argv, env = process.env) {
     const envHost = env.SAFEBROWSE_HOST?.trim();
     const envPort = env.SAFEBROWSE_PORT?.trim();
     const envRootDir = env.SAFEBROWSE_ROOT_DIR?.trim();
+    const envDeploymentProfile = env.SAFEBROWSE_DEPLOYMENT_PROFILE?.trim();
+    const envApprovalBrokerPublicKeyPath = env.SAFEBROWSE_APPROVAL_BROKER_PUBLIC_KEY_PATH?.trim();
+    const envApprovalBrokerMode = env.SAFEBROWSE_APPROVAL_BROKER_MODE?.trim();
+    const envParserIsolationMode = env.SAFEBROWSE_PARSER_ISOLATION_MODE?.trim();
     if (envHost) {
         options.host = envHost;
     }
@@ -36,6 +49,21 @@ export function parseDaemonOptions(argv, env = process.env) {
     if (envRootDir) {
         options.rootDir = resolve(envRootDir);
     }
+    if (envDeploymentProfile === "development" ||
+        envDeploymentProfile === "secure_v5" ||
+        envDeploymentProfile === "secure_v6") {
+        options.deploymentProfile = envDeploymentProfile === "secure_v6" ? "secure_v5" : envDeploymentProfile;
+    }
+    if (envApprovalBrokerPublicKeyPath) {
+        options.approvalBrokerPublicKeyPath = resolve(envApprovalBrokerPublicKeyPath);
+    }
+    if (envApprovalBrokerMode === "signature_verification" || envApprovalBrokerMode === "external_service") {
+        options.approvalBrokerMode = envApprovalBrokerMode;
+    }
+    if (envParserIsolationMode === "scrubbed_process" ||
+        envParserIsolationMode === "node_permission_process") {
+        options.parserIsolationMode = envParserIsolationMode;
+    }
     while (queue.length > 0) {
         const arg = queue.shift();
         if (!arg) {
@@ -69,6 +97,41 @@ export function parseDaemonOptions(argv, env = process.env) {
             options.rootDir = resolve(value);
             continue;
         }
+        if (arg === "--deployment-profile") {
+            const value = queue.shift();
+            if (!value || !["development", "secure_v5", "secure_v6"].includes(value)) {
+                throw new Error("Invalid value for --deployment-profile");
+            }
+            options.deploymentProfile =
+                value === "secure_v6"
+                    ? "secure_v5"
+                    : value;
+            continue;
+        }
+        if (arg === "--approval-broker-public-key-path") {
+            const value = queue.shift();
+            if (!value) {
+                throw new Error("Missing value for --approval-broker-public-key-path");
+            }
+            options.approvalBrokerPublicKeyPath = resolve(value);
+            continue;
+        }
+        if (arg === "--approval-broker-mode") {
+            const value = queue.shift();
+            if (!value || !["signature_verification", "external_service"].includes(value)) {
+                throw new Error("Invalid value for --approval-broker-mode");
+            }
+            options.approvalBrokerMode = value;
+            continue;
+        }
+        if (arg === "--parser-isolation-mode") {
+            const value = queue.shift();
+            if (!value || !["scrubbed_process", "node_permission_process"].includes(value)) {
+                throw new Error("Invalid value for --parser-isolation-mode");
+            }
+            options.parserIsolationMode = value;
+            continue;
+        }
         throw new Error(`Unknown argument: ${arg}`);
     }
     return options;

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAgC,MAAM,aAAa,CAAC;AAMlF,MAAM,SAAS,GAAG;;;;;;;;;CASjB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAc,EACd,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAExB,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAEnD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC;YACrB,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAgC,MAAM,aAAa,CAAC;AAMlF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;CAkBjB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAc,EACd,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAExB,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,oBAAoB,GAAG,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IACvE,MAAM,8BAA8B,GAAG,GAAG,CAAC,0CAA0C,EAAE,IAAI,EAAE,CAAC;IAC9F,MAAM,qBAAqB,GAAG,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE,CAAC;IAC1E,MAAM,sBAAsB,GAAG,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,CAAC;IAE5E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IACD,IACE,oBAAoB,KAAK,aAAa;QACtC,oBAAoB,KAAK,WAAW;QACpC,oBAAoB,KAAK,WAAW,EACpC,CAAC;QACD,OAAO,CAAC,iBAAiB,GAAG,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACxG,CAAC;IACD,IAAI,8BAA8B,EAAE,CAAC;QACnC,OAAO,CAAC,2BAA2B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,qBAAqB,KAAK,wBAAwB,IAAI,qBAAqB,KAAK,kBAAkB,EAAE,CAAC;QACvG,OAAO,CAAC,kBAAkB,GAAG,qBAAqB,CAAC;IACrD,CAAC;IACD,IACE,sBAAsB,KAAK,kBAAkB;QAC7C,sBAAsB,KAAK,yBAAyB,EACpD,CAAC;QACD,OAAO,CAAC,mBAAmB,GAAG,sBAAsB,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC;YACrB,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,iBAAiB;gBACvB,KAAK,KAAK,WAAW;oBACnB,CAAC,CAAC,WAAW;oBACb,CAAC,CAAE,KAAqC,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,mCAAmC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,CAAC,2BAA2B,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,CAAC,kBAAkB,GAAG,KAAsD,CAAC;YACpF,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,yBAAyB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,CAAC,mBAAmB,GAAG,KAAuD,CAAC;YACtF,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
 export { formatDaemonHelp, parseDaemonOptions, runDaemonCli } from "./cli.js";
+export { compileObservationInIsolation, createParserIsolationService, probeParserIsolation } from "./parserIsolation.js";
 export { createSafeBrowseServer, startSafeBrowseDaemon } from "./server.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -2,8 +2,10 @@
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { formatDaemonHelp, parseDaemonOptions, runDaemonCli } from "./cli.js";
+import { compileObservationInIsolation, createParserIsolationService, probeParserIsolation } from "./parserIsolation.js";
 import { createSafeBrowseServer, startSafeBrowseDaemon } from "./server.js";
 export { formatDaemonHelp, parseDaemonOptions, runDaemonCli } from "./cli.js";
+export { compileObservationInIsolation, createParserIsolationService, probeParserIsolation } from "./parserIsolation.js";
 export { createSafeBrowseServer, startSafeBrowseDaemon } from "./server.js";
 function isDirectExecution() {
     if (!process.argv[1]) {
@@ -12,10 +14,15 @@ function isDirectExecution() {
     return fileURLToPath(import.meta.url) === resolve(process.argv[1]);
 }
 if (isDirectExecution()) {
-    runDaemonCli().catch((error) => {
+    const startupKeepalive = setInterval(() => undefined, 1 << 30);
+    runDaemonCli()
+        .catch((error) => {
         console.error(error instanceof Error ? error.message : String(error));
         console.error(formatDaemonHelp());
         process.exitCode = 1;
+    })
+        .finally(() => {
+        clearInterval(startupKeepalive);
     });
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,SAAS,iBAAiB;IACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,SAAS,iBAAiB;IACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,YAAY,EAAE;SACX,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACf,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/parserIsolation.d.ts

@@ -0,0 +1,48 @@
+import type { CompiledObservation, ParserIsolationMode, ParserWorkerProbe, RuntimeContext, StructuredPlannerInput, SurfaceCapture } from "@safebrowse/core";
+type ToolManifestDigests = {
+    manifestHash?: string;
+    schemaHash?: string;
+};
+export interface ParserIsolationProbeSnapshot {
+    probe: ParserWorkerProbe;
+    lastCheckedAt: string;
+}
+export interface ParserIsolationService {
+    compileObservation(input: {
+        capture: SurfaceCapture;
+        workflowHash?: string;
+        allowlistedEgress?: string[];
+        runtime?: Partial<RuntimeContext>;
+        compilerVersion?: "v4" | "v5";
+        parserIsolationMode?: ParserIsolationMode;
+    }): Promise<{
+        compiledObservation: CompiledObservation;
+        plannerInput?: StructuredPlannerInput;
+        plannerView?: unknown;
+        toolManifestDigests?: ToolManifestDigests;
+    }>;
+    getCachedProbe(): Promise<ParserIsolationProbeSnapshot>;
+    refreshProbe(): Promise<ParserIsolationProbeSnapshot>;
+    close(): Promise<void>;
+}
+interface ParserIsolationServiceOptions {
+    allowlistedEgress?: string[];
+    runtime?: Partial<RuntimeContext>;
+}
+export declare function createParserIsolationService(parserIsolationMode?: ParserIsolationMode, options?: ParserIsolationServiceOptions): ParserIsolationService;
+export declare function compileObservationInIsolation(input: {
+    capture: SurfaceCapture;
+    workflowHash?: string;
+    allowlistedEgress?: string[];
+    runtime?: Partial<RuntimeContext>;
+    compilerVersion?: "v4" | "v5";
+    parserIsolationMode?: ParserIsolationMode;
+}): Promise<{
+    compiledObservation: CompiledObservation;
+    plannerInput?: StructuredPlannerInput;
+    plannerView?: unknown;
+    toolManifestDigests?: ToolManifestDigests;
+}>;
+export declare function probeParserIsolation(parserIsolationMode?: ParserIsolationMode): Promise<ParserWorkerProbe>;
+export {};
+//# sourceMappingURL=parserIsolation.d.ts.map

package/dist/parserIsolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parserIsolation.d.ts","sourceRoot":"","sources":["../src/parserIsolation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACf,MAAM,kBAAkB,CAAC;AAgC1B,KAAK,mBAAmB,GAAG;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAoBF,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,iBAAiB,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,cAAc,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAClC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;KAC3C,GAAG,OAAO,CAAC;QACV,mBAAmB,EAAE,mBAAmB,CAAC;QACzC,YAAY,CAAC,EAAE,sBAAsB,CAAC;QACtC,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;KAC3C,CAAC,CAAC;IACH,cAAc,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACxD,YAAY,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,6BAA6B;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC;AAsPD,wBAAgB,4BAA4B,CAC1C,mBAAmB,GAAE,mBAAwC,EAC7D,OAAO,GAAE,6BAAkC,GAC1C,sBAAsB,CAExB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,OAAO,CAAC;IACV,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC,CAMD;AAED,wBAAgB,oBAAoB,CAClC,mBAAmB,GAAE,mBAAwC,GAC5D,OAAO,CAAC,iBAAiB,CAAC,CAI5B"}

package/dist/parserIsolation.js

@@ -0,0 +1,207 @@
+import { randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { fork } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { resolve, dirname } from "node:path";
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+const compiledWorkerPath = resolve(moduleDir, "parserWorker.js");
+const sourceWorkerPath = resolve(moduleDir, "parserWorker.ts");
+const workerPath = existsSync(compiledWorkerPath) ? compiledWorkerPath : sourceWorkerPath;
+function parserReadRoots() {
+    return [...new Set([resolve(process.cwd()), resolve(dirname(workerPath), "..", "..")])];
+}
+function buildExecArgv(mode) {
+    const baseArgs = workerPath.endsWith(".ts")
+        ? mode === "node_permission_process"
+            ? ["--experimental-strip-types"]
+            : ["--import", "tsx"]
+        : [];
+    if (mode !== "node_permission_process") {
+        return baseArgs;
+    }
+    return [
+        "--permission",
+        ...parserReadRoots().map((root) => `--allow-fs-read=${root}`),
+        ...baseArgs
+    ];
+}
+class ParserIsolationServiceImpl {
+    mode;
+    options;
+    child;
+    closed = false;
+    cachedProbe;
+    startup;
+    pending = new Map();
+    constructor(mode, options = {}) {
+        this.mode = mode;
+        this.options = options;
+    }
+    async compileObservation(input) {
+        const result = await this.sendRequest({
+            kind: "parse",
+            compilerVersion: input.compilerVersion,
+            parserIsolationMode: input.parserIsolationMode ?? this.mode,
+            capture: input.capture,
+            workflowHash: input.workflowHash,
+            allowlistedEgress: input.allowlistedEgress ?? this.options.allowlistedEgress,
+            runtime: input.runtime ?? this.options.runtime
+        });
+        return result;
+    }
+    async getCachedProbe() {
+        if (this.cachedProbe) {
+            return this.cachedProbe;
+        }
+        return this.refreshProbe();
+    }
+    async refreshProbe() {
+        const probe = await this.sendRequest({
+            kind: "probe"
+        });
+        this.cachedProbe = {
+            probe,
+            lastCheckedAt: new Date().toISOString()
+        };
+        return this.cachedProbe;
+    }
+    async close() {
+        this.closed = true;
+        this.cachedProbe = undefined;
+        const pendingError = new Error("parser isolation service closed");
+        for (const [requestId, pending] of this.pending.entries()) {
+            this.pending.delete(requestId);
+            pending.reject(pendingError);
+        }
+        this.startup = undefined;
+        const child = this.child;
+        this.child = undefined;
+        if (!child) {
+            return;
+        }
+        await new Promise((resolvePromise) => {
+            child.once("close", () => resolvePromise());
+            child.kill();
+        });
+    }
+    async ensureWorker() {
+        if (this.closed) {
+            throw new Error("parser isolation service closed");
+        }
+        if (this.child?.connected) {
+            return;
+        }
+        if (this.startup) {
+            return this.startup;
+        }
+        this.startup = (async () => {
+            const child = fork(workerPath, [], {
+                env: workerPath.endsWith(".ts") && this.mode !== "node_permission_process"
+                    ? { TSX_DISABLE_CACHE: "1" }
+                    : {},
+                stdio: ["ignore", "ignore", "ignore", "ipc"],
+                execArgv: buildExecArgv(this.mode)
+            });
+            child.unref();
+            child.on("message", (message) => this.handleMessage(message));
+            child.on("error", (error) => this.handleWorkerFailure(error));
+            child.on("exit", (code, signal) => {
+                const suffix = signal ? ` (${signal})` : "";
+                this.handleWorkerFailure(code && code !== 0 ? new Error(`parser worker exited with code ${code}${suffix}`) : undefined);
+            });
+            this.child = child;
+            if (this.options.allowlistedEgress || this.options.runtime) {
+                await this.sendRequest({
+                    kind: "configure",
+                    parserIsolationMode: this.mode,
+                    allowlistedEgress: this.options.allowlistedEgress,
+                    runtime: this.options.runtime
+                });
+            }
+        })().finally(() => {
+            this.startup = undefined;
+        });
+        return this.startup;
+    }
+    handleMessage(message) {
+        if (!message || typeof message !== "object" || !("requestId" in message)) {
+            return;
+        }
+        const response = message;
+        const pending = this.pending.get(response.requestId);
+        if (!pending) {
+            return;
+        }
+        this.pending.delete(response.requestId);
+        if (!response.ok) {
+            pending.reject(new Error(response.error));
+            return;
+        }
+        pending.resolve((response.probe ?? response.result));
+    }
+    handleWorkerFailure(error) {
+        this.cachedProbe = undefined;
+        const child = this.child;
+        this.child = undefined;
+        if (child) {
+            child.removeAllListeners();
+        }
+        if (this.closed && this.pending.size === 0) {
+            return;
+        }
+        const failure = error ?? new Error("parser worker exited unexpectedly");
+        for (const [requestId, pending] of this.pending.entries()) {
+            this.pending.delete(requestId);
+            pending.reject(failure);
+        }
+    }
+    async sendRequest(payload) {
+        await this.ensureWorker();
+        const child = this.child;
+        if (!child?.connected) {
+            throw new Error("parser worker is not connected");
+        }
+        return new Promise((resolvePromise, rejectPromise) => {
+            const requestId = randomUUID();
+            this.pending.set(requestId, {
+                resolve: (value) => resolvePromise(value),
+                reject: rejectPromise
+            });
+            try {
+                child.send({
+                    requestId,
+                    payload
+                });
+            }
+            catch (error) {
+                this.pending.delete(requestId);
+                rejectPromise(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
+    }
+}
+const defaultServices = new Map();
+function defaultServiceForMode(mode) {
+    let service = defaultServices.get(mode);
+    if (!service) {
+        service = createParserIsolationService(mode);
+        defaultServices.set(mode, service);
+    }
+    return service;
+}
+export function createParserIsolationService(parserIsolationMode = "scrubbed_process", options = {}) {
+    return new ParserIsolationServiceImpl(parserIsolationMode, options);
+}
+export function compileObservationInIsolation(input) {
+    const mode = input.parserIsolationMode ?? "scrubbed_process";
+    return defaultServiceForMode(mode).compileObservation({
+        ...input,
+        parserIsolationMode: mode
+    });
+}
+export function probeParserIsolation(parserIsolationMode = "scrubbed_process") {
+    return defaultServiceForMode(parserIsolationMode)
+        .refreshProbe()
+        .then((snapshot) => snapshot.probe);
+}
+//# sourceMappingURL=parserIsolation.js.map

package/dist/parserIsolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parserIsolation.js","sourceRoot":"","sources":["../src/parserIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAW7C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AACjE,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AA+E1F,SAAS,eAAe;IACtB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,aAAa,CAAC,IAAyB;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzC,CAAC,CAAC,IAAI,KAAK,yBAAyB;YAClC,CAAC,CAAC,CAAC,4BAA4B,CAAC;YAChC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,cAAc;QACd,GAAG,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAC7D,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC;AAOD,MAAM,0BAA0B;IAYX;IACA;IAZX,KAAK,CAAgB;IAErB,MAAM,GAAG,KAAK,CAAC;IAEf,WAAW,CAAgC;IAE3C,OAAO,CAAiB;IAEf,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEtE,YACmB,IAAyB,EACzB,UAAyC,EAAE;QAD3C,SAAI,GAAJ,IAAI,CAAqB;QACzB,YAAO,GAAP,OAAO,CAAoC;IAC3D,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CAAC,KAOxB;QAMC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAKlC;YACD,IAAI,EAAE,OAAO;YACb,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI;YAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,iBAAiB,EACf,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAC3D,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO;SAC/C,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAoB;YACtD,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG;YACjB,KAAK;YACL,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QAED,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,EAAE;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE;gBACjC,GAAG,EACD,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,yBAAyB;oBACnE,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,EAAE;oBAC5B,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;gBAC5C,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;aACnC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;YAEd,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,mBAAmB,CACtB,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,kCAAkC,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAC9F,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAEnB,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC3D,MAAM,IAAI,CAAC,WAAW,CAAO;oBAC3B,IAAI,EAAE,WAAW;oBACjB,mBAAmB,EAAE,IAAI,CAAC,IAAI;oBAC9B,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;oBACjD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,EAAE,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,OAAiC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAY,CAAC,CAAC;IAClE,CAAC;IAEO,mBAAmB,CAAC,KAAa;QACvC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAI,OAAsB;QACjD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,OAAO,CAAI,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;YACtD,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAU,CAAC;gBAC9C,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC;oBACT,SAAS;oBACT,OAAO;iBACwB,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/B,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA+C,CAAC;AAE/E,SAAS,qBAAqB,CAAC,IAAyB;IACtD,IAAI,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAC7C,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,sBAA2C,kBAAkB,EAC7D,UAAyC,EAAE;IAE3C,OAAO,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAO7C;IAMC,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB,IAAI,kBAAkB,CAAC;IAC7D,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC;QACpD,GAAG,KAAK;QACR,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,sBAA2C,kBAAkB;IAE7D,OAAO,qBAAqB,CAAC,mBAAmB,CAAC;SAC9C,YAAY,EAAE;SACd,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC"}

package/dist/parserWorker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parserWorker.d.ts.map

package/dist/parserWorker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parserWorker.d.ts","sourceRoot":"","sources":["../src/parserWorker.ts"],"names":[],"mappings":""}

package/dist/parserWorker.js

@@ -0,0 +1,169 @@
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import os from "node:os";
+import process from "node:process";
+const require = createRequire(import.meta.url);
+function denyNetwork(message = "Parser worker egress denied") {
+    const denial = () => {
+        throw new Error(message);
+    };
+    const http = require("node:http");
+    const https = require("node:https");
+    const net = require("node:net");
+    const tls = require("node:tls");
+    const dns = require("node:dns");
+    http.request = denial;
+    http.get = denial;
+    https.request = denial;
+    https.get = denial;
+    net.connect = denial;
+    net.createConnection = denial;
+    tls.connect = denial;
+    dns.lookup = denial;
+    dns.resolve = denial;
+    dns.resolve4 = denial;
+    dns.resolve6 = denial;
+    Object.assign(globalThis, {
+        fetch: async () => {
+            throw new Error(message);
+        }
+    });
+}
+function lockDownEnvironment() {
+    for (const key of Object.keys(process.env)) {
+        delete process.env[key];
+    }
+    denyNetwork();
+}
+async function probeIsolation() {
+    let egressDenied = false;
+    try {
+        await globalThis.fetch("https://example.com");
+    }
+    catch {
+        egressDenied = true;
+    }
+    const permissionModelEnabled = Boolean(process.permission);
+    const fsReadRestricted = permissionModelEnabled
+        ? !process.permission.has("fs.read", os.tmpdir()) && !process.permission.has("fs.read", os.homedir())
+        : false;
+    return {
+        mode: permissionModelEnabled ? "node_permission_process" : "scrubbed_process",
+        envKeys: Object.keys(process.env),
+        egressDenied,
+        processIsolated: true,
+        permissionModelEnabled,
+        fsReadRestricted,
+        childProcessDenied: permissionModelEnabled ? !process.permission.has("child") : false,
+        workerThreadsDenied: permissionModelEnabled ? !process.permission.has("worker") : false
+    };
+}
+lockDownEnvironment();
+let cachedProbePromise;
+let cachedCoreRuntimePromise;
+let workerRuntimeDefaults;
+let workerAllowlistedEgress = [];
+let workerParserIsolationMode;
+async function getCachedProbe() {
+    if (!cachedProbePromise) {
+        cachedProbePromise = probeIsolation();
+    }
+    return cachedProbePromise;
+}
+async function loadCoreRuntime(parserIsolationMode) {
+    if (cachedCoreRuntimePromise) {
+        return cachedCoreRuntimePromise;
+    }
+    cachedCoreRuntimePromise = (async () => {
+        if (import.meta.url.endsWith(".ts")) {
+            if (parserIsolationMode === "node_permission_process") {
+                const distEntryUrl = new URL("../../core/dist/index.js", import.meta.url);
+                if (existsSync(distEntryUrl)) {
+                    return import(distEntryUrl.href);
+                }
+                throw new Error("secure profile parser worker requires a built @safebrowse/core dist runtime");
+            }
+            const sourceEntryUrl = new URL("../../core/src/index.ts", import.meta.url).href;
+            return import(sourceEntryUrl);
+        }
+        return import("@safebrowse/core");
+    })();
+    return cachedCoreRuntimePromise;
+}
+function sendResponse(requestId, message) {
+    process.send?.({
+        requestId,
+        ...message
+    });
+}
+process.on("message", async (message) => {
+    try {
+        const payload = message.payload;
+        if (payload.kind === "configure") {
+            workerRuntimeDefaults = payload.runtime;
+            workerAllowlistedEgress = payload.allowlistedEgress ?? [];
+            workerParserIsolationMode = payload.parserIsolationMode;
+            await loadCoreRuntime(workerParserIsolationMode);
+            sendResponse(message.requestId, {
+                ok: true
+            });
+            return;
+        }
+        if (payload.kind === "probe") {
+            sendResponse(message.requestId, {
+                ok: true,
+                probe: await getCachedProbe()
+            });
+            return;
+        }
+        const parserIsolationMode = payload.parserIsolationMode ??
+            workerParserIsolationMode ??
+            (await getCachedProbe()).mode;
+        const { compileObservation, compileObservationV5, computeToolManifestHash, computeToolSchemaHash } = await loadCoreRuntime(parserIsolationMode);
+        const compiler = payload.compilerVersion === "v5" ? compileObservationV5 : compileObservation;
+        const probe = await getCachedProbe();
+        const runtime = payload.runtime ?? workerRuntimeDefaults ?? {};
+        const allowlistedEgress = payload.allowlistedEgress ?? workerAllowlistedEgress;
+        const result = compiler(payload.capture, runtime, {
+            workflowHash: payload.workflowHash,
+            parserIsolation: {
+                mode: probe.mode,
+                processIsolated: probe.processIsolated,
+                envScrubbed: probe.envKeys.length === 0,
+                egressDenied: probe.egressDenied,
+                permissionModelEnabled: probe.permissionModelEnabled,
+                fsReadRestricted: probe.fsReadRestricted,
+                childProcessDenied: probe.childProcessDenied,
+                workerThreadsDenied: probe.workerThreadsDenied,
+                envKeys: probe.envKeys,
+                allowlistedEgress
+            }
+        });
+        const toolManifestDigests = payload.capture.surfaceType === "tool_manifest"
+            ? {
+                manifestHash: computeToolManifestHash({
+                    toolId: payload.capture.toolId,
+                    description: payload.capture.description,
+                    authType: payload.capture.authType,
+                    requestedScopes: payload.capture.requestedScopes,
+                    callbackUri: payload.capture.callbackUri
+                }),
+                schemaHash: computeToolSchemaHash(payload.capture.schemaDescriptions)
+            }
+            : undefined;
+        sendResponse(message.requestId, {
+            ok: true,
+            result: {
+                ...result,
+                toolManifestDigests
+            }
+        });
+    }
+    catch (error) {
+        sendResponse(message.requestId, {
+            ok: false,
+            error: error instanceof Error ? error.message : String(error)
+        });
+    }
+});
+//# sourceMappingURL=parserWorker.js.map

package/dist/parserWorker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parserWorker.js","sourceRoot":"","sources":["../src/parserWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,OAAO,MAAM,cAAc,CAAC;AAInC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,SAAS,WAAW,CAAC,OAAO,GAAG,6BAA6B;IAC1D,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;IAClB,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC;IACnB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC9B,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACpB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IACtB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAEtB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,WAAW,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc;IAU3B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,sBAAsB;QAC7C,CAAC,CAAC,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QACvG,CAAC,CAAC,KAAK,CAAC;IACV,OAAO;QACL,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB;QAC7E,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,YAAY;QACZ,eAAe,EAAE,IAAI;QACrB,sBAAsB;QACtB,gBAAgB;QAChB,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK;QACtF,mBAAmB,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK;KACzF,CAAC;AACJ,CAAC;AAED,mBAAmB,EAAE,CAAC;AAEtB,IAAI,kBAAmF,CAAC;AACxF,IAAI,wBAOS,CAAC;AACd,IAAI,qBAA0D,CAAC;AAC/D,IAAI,uBAAuB,GAAa,EAAE,CAAC;AAC3C,IAAI,yBAAqF,CAAC;AAE1F,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kBAAkB,GAAG,cAAc,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,mBAAoE;IAOpE,IAAI,wBAAwB,EAAE,CAAC;QAC7B,OAAO,wBAAwB,CAAC;IAClC,CAAC;IAED,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,mBAAmB,KAAK,yBAAyB,EAAE,CAAC;gBACtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1E,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7B,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAChF,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpC,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,wBAAwB,CAAC;AAClC,CAAC;AA+BD,SAAS,YAAY,CACnB,SAAiB,EACjB,OAiBK;IAEL,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,SAAS;QACT,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,OAA4B,EAAE,EAAE;IAC3D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;YACxC,uBAAuB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC1D,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;YACxD,MAAM,eAAe,CAAC,yBAAyB,CAAC,CAAC;YACjD,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC9B,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC9B,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM,cAAc,EAAE;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB;YAC3B,yBAAyB;YACzB,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC;QAChC,MAAM,EACJ,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACtB,GACC,MAAM,eAAe,CAAC,mBAAmB,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,qBAAqB,IAAI,EAAE,CAAC;QAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,uBAAuB,CAAC;QAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE;YAChD,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,eAAe,EAAE;gBACf,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBACvC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,iBAAiB;aAClB;SACF,CAAC,CAAC;QACH,MAAM,mBAAmB,GACvB,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,eAAe;YAC7C,CAAC,CAAC;gBACE,YAAY,EAAE,uBAAuB,CAAC;oBACpC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;oBAC9B,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;oBACxC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;oBAClC,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;oBAChD,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;iBACzC,CAAC;gBACF,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC;aACtE;YACH,CAAC,CAAC,SAAS,CAAC;QAEhB,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;YAC9B,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,GAAG,MAAM;gBACT,mBAAmB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;YAC9B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}