@smthrs/platform-node 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/ProcessSandbox.d.ts

@@ -0,0 +1,391 @@
+/**
+ * The one operating-system sandbox every confined process goes through.
+ *
+ * A caller resolves what a run may touch, a {@link Request}: the network
+ * posture, the read and write sets, and optionally which mechanism it wants.
+ * This module turns the request into an argv the host enforces, or into an
+ * {@link Unenforceable} refusal naming what the host lacks. Two callers share
+ * it: the build graph confines every target's tool run under its declared
+ * inputs and outputs (`@smthrs/targets/ExecSandbox`), and the Node
+ * `ProcessConfinement` confines every approved agent command under the
+ * grants in force.
+ *
+ * Three mechanisms, one contract:
+ *
+ * - Linux: bubblewrap. An empty root contains only enumerated system/runtime
+ *   paths and declared reads and writes. The workspace and root are remounted
+ *   read-only after mounting grants. A private tmp supplies HOME. The network
+ *   namespace is unshared unless explicitly opened; loopback-only is refused.
+ * - macOS: seatbelt (`sandbox-exec`). Host reads are denied except enumerated
+ *   system/runtime paths, declared inputs, external reads, writes and private
+ *   tmp. Host credential locations are re-closed under broad grants. Writes
+ *   and network access are denied except what the request opens.
+ * - Docker: `docker run` with a read-only root, declared reads mounted
+ *   read-only at their host paths, declared writes read-write, `--network
+ *   none` unless the request opens it. The image supplies the toolchain. It is
+ *   the path on Windows and on any host without the native mechanism.
+ *
+ * Every declared confinement is enforced or the caller fails closed. Nothing
+ * here logs "unenforced" and carries on; the one caller that may run
+ * unconfined when no mechanism exists, `ProcessConfinement`, says so in its
+ * own options and never on this module's behalf.
+ *
+ * @since 1.0.0-rc.1
+ */
+/**
+ * The network posture a run is confined to. `"none"` closes IP networking.
+ * Build tools retain host Unix sockets by default. Native agent confinement
+ * additionally closes host Unix sockets regardless of the IP posture, except
+ * macOS's system DNS resolver endpoint when IP networking is open, and
+ * refuses all Linux socket creation when IP networking is closed;
+ * socketpair remains available for communication inside the process family.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export type Network = "none" | "loopback" | "open";
+/**
+ * Which mechanism a request asks for. Absent means the platform's native
+ * mechanism: bubblewrap on Linux, seatbelt on macOS.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export type Selection = {
+    readonly _tag: "bubblewrap";
+} | {
+    readonly _tag: "docker";
+    readonly image: string;
+};
+/**
+ * What a caller asks for: the network posture, the mechanism choice, and the
+ * read and write sets. Every path is workspace-relative and posix-shaped;
+ * a read may name a file or a directory, a write names a directory. A
+ * `readOnly` entry re-closes a subtree under a declared write.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Request {
+    readonly network: Network;
+    /** Whether host Unix sockets are permitted; defaults to true for build tools. */
+    readonly unixSockets?: boolean | undefined;
+    /** Closed-by-default process and IPC policy for untrusted native commands. */
+    readonly strict?: boolean | undefined;
+    readonly mechanism?: Selection | undefined;
+    readonly reads: ReadonlyArray<string>;
+    readonly writes: ReadonlyArray<string>;
+    /**
+     * Declared outputs whose leaf is a file rather than a directory. A file
+     * cannot be bound writable on its own and does not exist before the tool
+     * writes it, so its parent directory becomes the writable bind. Kept apart
+     * from `writes` because only the caller knows which of the two a
+     * declaration meant: inferring it from the path would hand a not-yet-created
+     * `.cargo-home` or `dist.new` its parent, and a parent that is the
+     * workspace root opens the whole workspace for the run.
+     */
+    readonly writeFiles?: ReadonlyArray<string> | undefined;
+    readonly readOnly?: ReadonlyArray<string> | undefined;
+    /**
+     * Absolute host paths outside the workspace the tool reads: a git
+     * submodule's local source repository, for one. Bound read-only where the
+     * mechanism would otherwise hide them; a path that does not exist, or that
+     * sits inside the workspace, is dropped.
+     */
+    readonly externalReads?: ReadonlyArray<string> | undefined;
+}
+/**
+ * The host facts mechanism selection reads. Injectable so every platform's
+ * argv can be tested on every other platform.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Host {
+    readonly platform: NodeJS.Platform;
+    /** Selected Xcode developer tree on a macOS runner. */
+    readonly developerDirectory?: string | undefined;
+    /** The real host home, used to mask credentials and locate runtime caches. */
+    readonly home?: string | undefined;
+    /** Resolves an executable name on `PATH` to an absolute path, or nothing. */
+    readonly executable: (name: string) => string | undefined;
+    /** Whether a host path exists. */
+    readonly exists: (path: string) => boolean;
+    /** Whether a host path is a directory. */
+    readonly isDirectory: (path: string) => boolean;
+    /** Tests the entry itself, including dangling links; defaults to the real host. */
+    readonly isSymbolicLink?: ((path: string) => boolean) | undefined;
+    /**
+     * The names of a directory's direct children, or undefined when the host
+     * cannot list it. Optional: a host without it keeps every declared file as
+     * its own entry, which is correct and merely long.
+     */
+    readonly entries?: ((directory: string) => ReadonlyArray<string> | undefined) | undefined;
+    /**
+     * Where a path's bytes actually live once every symbolic link on it is
+     * followed, or `undefined` when the host cannot say. Write validation uses
+     * the real host when this probe is omitted and refuses unresolved existing
+     * paths. Read aliases are only collected when this probe is supplied.
+     */
+    readonly realpath?: ((path: string) => string | undefined) | undefined;
+    /**
+     * The program a package-manager shim script runs: the absolute path on the
+     * `# cmd-shim-target=` line pnpm's cmd-shim writes, or `undefined` for any
+     * other file. Optional: a host without it treats a shim as the program.
+     */
+    readonly shimTarget?: ((path: string) => string | undefined) | undefined;
+    readonly uid: number | undefined;
+    readonly gid: number | undefined;
+}
+/**
+ * One selected enforcement mechanism.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export type Mechanism = {
+    readonly _tag: "bubblewrap";
+    readonly executable: string;
+} | {
+    readonly _tag: "seatbelt";
+    readonly executable: string;
+} | {
+    readonly _tag: "docker";
+    readonly executable: string;
+    readonly image: string;
+} | {
+    readonly _tag: "none";
+};
+/**
+ * The refusal a host that cannot enforce a declared confinement produces.
+ * `mechanism` names what was selected, `missing` what the host lacks.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Unenforceable {
+    readonly _tag: "@smthrs/platform-node/SandboxUnenforceable";
+    readonly platform: NodeJS.Platform;
+    readonly mechanism: string;
+    readonly missing: string;
+    readonly message: string;
+}
+/**
+ * Checks for an {@link Unenforceable} refusal.
+ *
+ * @category guards
+ * @since 1.0.0-rc.1
+ */
+export declare const isUnenforceable: (value: unknown) => value is Unenforceable;
+/**
+ * Builds an {@link Unenforceable} refusal.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.1
+ */
+export declare const unenforceable: (platform: NodeJS.Platform, mechanism: string, missing: string, detail: string) => Unenforceable;
+/**
+ * The resolved confinement one spawn runs under. Every path is absolute and
+ * canonical.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Plan {
+    readonly mechanism: Exclude<Mechanism, {
+        readonly _tag: "none";
+    }>;
+    readonly network: Network;
+    /** Whether host Unix sockets are permitted; defaults to true for build tools. */
+    readonly unixSockets?: boolean | undefined;
+    /** Closed-by-default process and IPC policy for untrusted native commands. */
+    readonly strict?: boolean | undefined;
+    readonly workspaceRoot: string;
+    readonly cwd: string;
+    readonly reads: ReadonlyArray<string>;
+    /**
+     * Paths inside a granted directory that the declaration did not cover,
+     * re-closed after the grant. Only a mechanism with deny rules (seatbelt)
+     * folds; the others keep every declared file as its own entry.
+     */
+    readonly readDenies: ReadonlyArray<string>;
+    readonly writes: ReadonlyArray<string>;
+    readonly readOnly: ReadonlyArray<string>;
+    /**
+     * Where a declared read's bytes actually live when the path reaches them
+     * through a symbolic link that leaves the workspace.
+     *
+     * Bubblewrap needs them because it replaces `/tmp` with a private tmpfs, so
+     * a link into the host's `/tmp` (the scratch tree's `node_modules`, which
+     * points back at the real workspace) resolves to nothing inside the sandbox.
+     * Binding the real location read-only makes the link resolve to the same
+     * bytes the host sees, which is what declaring the read asked for. Docker
+     * mounts them for the same reason: the image supplies everything outside
+     * the workspace, and these paths are on the host. Seatbelt leaves the host
+     * filesystem in place but must grant the resolved spelling too. The
+     * request's own `externalReads` land here too.
+     */
+    readonly externalReads: ReadonlyArray<string>;
+    /** A host directory the run may scribble in; created by the caller, removed after. */
+    readonly tmp: string;
+    readonly uid: number | undefined;
+    readonly gid: number | undefined;
+}
+/**
+ * The real host: platform, `PATH` lookup, and filesystem probes.
+ *
+ * @category resolution
+ * @since 0.1.0
+ */
+export declare const host: (env?: Readonly<Record<string, string | undefined>>) => Host;
+/**
+ * Selects the mechanism a request runs under on a host.
+ *
+ * A docker selection is honored when `docker` is on `PATH` and refused
+ * otherwise; a bubblewrap selection is refused off Linux. With no selection
+ * the platform decides: bubblewrap on Linux, seatbelt on macOS, and a refusal
+ * elsewhere, because Windows has no user-level process sandbox and Docker
+ * needs an image only the caller can name.
+ *
+ * @category resolution
+ * @since 1.0.0-rc.1
+ */
+export declare const select: (request: Pick<Request, "network" | "mechanism">, hostFacts: Host) => Exclude<Mechanism, {
+    readonly _tag: "none";
+}> | Unenforceable;
+/**
+ * Rechecks write grants before directory creation and before rendering. Throws
+ * an {@link Unenforceable} refusal if a path changed since planning. Callers
+ * must keep the workspace stable until the operating system consumes mounts.
+ *
+ * @category resolution
+ * @since 0.1.0
+ */
+export declare const validateWrites: (confinement: Plan, hostFacts?: Host) => void;
+/**
+ * Resolves a request against a workspace into a {@link Plan}, or refuses.
+ *
+ * Every relative path is anchored at the canonical workspace root; one that
+ * escapes the workspace is dropped, because the sandbox never grants anything
+ * outside the tree the key covers. Reads that do not exist are dropped too:
+ * bubblewrap cannot bind a missing path, and a declared input that vanished is
+ * the executor's measurement failure, not this module's. A write containing
+ * any symbolic link below the canonical root is refused, including a missing
+ * output below a linked ancestor.
+ *
+ * @category resolution
+ * @since 0.1.0
+ */
+export declare const plan: (request: Request, location: {
+    readonly workspaceRoot: string;
+    readonly cwd: string;
+    readonly tmp: string;
+}, hostFacts: Host) => Plan | Unenforceable;
+/**
+ * Environment the confined process receives on top of the tool environment:
+ * a private temporary directory and home, so nothing a tool caches lands in
+ * the real home or the shared temp directory.
+ *
+ * `COREPACK_HOME` is the one host cache kept: it holds the package-manager
+ * program a corepack shim execs, the run may only read it (the mechanisms
+ * deny writes outside the workspace), and without it a confined `pnpm` is a
+ * shim with nothing to run. A non-default cache location requires an explicit
+ * `externalReads` grant; preserving the variable does not grant access.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const environment: (confinement: Plan, hostEnv?: Readonly<Record<string, string | undefined>>, hostHome?: string) => Readonly<Record<string, string>>;
+/**
+ * The program a confined run execs, made reachable inside its empty root.
+ *
+ * Bubblewrap resolves a bare program name with `execvp` against `PATH` inside
+ * the new root, and that root holds only the runtime paths and the declared
+ * sets. A package manager installed outside them — pnpm under the
+ * `pnpm/action-setup` prefix on a CI runner, a `.bin` link into a
+ * `node_modules` tree — is on the host `PATH` and absent from the sandbox, so
+ * the run died with `bwrap: execvp pnpm` before the tool started (#3140).
+ *
+ * A bare name is resolved on the tool's `PATH` (the host's when none is
+ * given). A program already inside a granted path is left exactly as spelled,
+ * so a multi-call binary keeps the name it dispatches on, and so is one inside
+ * the workspace, whose reads only the declaration may open. Otherwise the run
+ * execs the program's real file, and the nearest package directory holding it
+ * (its `package.json`, at most three levels up, never the home or the root)
+ * is bound read-only, because a script like `pnpm.cjs` loads its siblings.
+ * With no package directory only the real file is bound. A name that resolves
+ * nowhere is left for `execvp` to report.
+ *
+ * A package-manager shim script is followed like a link. `pnpm self-update`
+ * under `pnpm/action-setup` installs pnpm as a cmd-shim in `$PNPM_HOME/bin`
+ * that runs node on a package in pnpm's global store, a path relative to the
+ * script; binding the script alone left that package missing. When the
+ * program the shim names is executable, the run execs its real file and binds
+ * its package as above.
+ *
+ * @since 1.0.0
+ * @private
+ */
+export declare const launcher: (program: string, searchPath: string | undefined, granted: ReadonlyArray<string>, workspaceRoot: string, hostFacts: Host) => {
+    readonly program: string;
+    readonly reads: ReadonlyArray<string>;
+};
+/**
+ * The bubblewrap argv for a plan.
+ *
+ * Order matters: bubblewrap applies operations in argument order, so the
+ * empty root goes first, runtime paths are bound, the workspace tmpfs shadows
+ * any broad runtime grant, declared paths are bound on top, and re-closed
+ * subtrees are bound read-only over their writable parents. The tmpfs is
+ * remounted read-only last so an undeclared write
+ * under the workspace fails with `EROFS` instead of vanishing into the tmpfs.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const bubblewrap: (confinement: Plan, argv: ReadonlyArray<string>, hostFacts?: Host, searchPath?: string | undefined) => ReadonlyArray<string>;
+/**
+ * The seatbelt profile for a plan.
+ *
+ * File reads start closed, then enumerated runtime paths and declared sets
+ * are opened. The workspace is re-closed before its grants so a workspace
+ * under a runtime root does not inherit the broad runtime grant. Credentials
+ * are re-closed before explicit external reads, which can opt into them.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const seatbelt: (confinement: Plan, hostFacts?: Host) => string;
+/**
+ * The `docker run` argv for a plan. Paths keep their host spelling inside the
+ * container so an argv that names workspace paths works unchanged; the image
+ * supplies everything outside the workspace.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const docker: (confinement: Plan, argv: ReadonlyArray<string>, env: Readonly<Record<string, string>>, hostFacts?: Host, containerName?: string) => ReadonlyArray<string>;
+/**
+ * Wraps a tool argv in the plan's mechanism and reports the environment the
+ * wrapper needs the child to carry. Docker runs also return the unique
+ * container name the caller must forcibly remove when the client scope closes.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const wrap: (confinement: Plan, argv: ReadonlyArray<string>, env: Readonly<Record<string, string>>, hostFacts?: Host) => {
+    readonly argv: ReadonlyArray<string>;
+    readonly env: Readonly<Record<string, string>>;
+    readonly containerName?: string;
+};
+/**
+ * Names, from a failed tool's own output, the paths it touched outside the
+ * declared set. The sandbox denies at the kernel, so the only witness is the
+ * tool's error text; this reads it back and says which side of the boundary
+ * each path fell on.
+ *
+ * @category diagnostics
+ * @since 0.1.0
+ */
+export declare const diagnose: (confinement: Plan, text: string) => string | undefined;
+//# sourceMappingURL=ProcessSandbox.d.ts.map

package/dist/cjs/ProcessSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessSandbox.d.ts","sourceRoot":"","sources":["../../src/ProcessSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAQH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAA;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IAClC,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChD,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IACzD,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC1C,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC/C,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAA;IACjE;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACzF;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACtE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7B;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,4CAA4C,CAAA;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,aAEoC,CAAA;AAE9F;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,UAAU,MAAM,CAAC,QAAQ,EACzB,WAAW,MAAM,EACjB,SAAS,MAAM,EACf,QAAQ,MAAM,KACb,aAMD,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC7C,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAOD;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,MAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAwB,KAAG,IAqD/F,CAAA;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,GACjB,SAAS,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,WAAW,CAAC,EAC/C,WAAW,IAAI,KACd,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,aA+ClD,CAAA;AAmED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,aAAa,IAAI,EAAE,YAAW,IAAa,KAAG,IAM5E,CAAA;AAwGD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,IAAI,GACf,SAAS,OAAO,EAChB,UAAU;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxF,WAAW,IAAI,KACd,IAAI,GAAG,aAsFT,CAAA;AAsBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,GACtB,aAAa,IAAI,EACjB,UAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAwB,EAC5E,WAAU,MAAyB,KAClC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcjC,CAAA;AAuFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,QAAQ,GACnB,SAAS,MAAM,EACf,YAAY,MAAM,GAAG,SAAS,EAC9B,SAAS,aAAa,CAAC,MAAM,CAAC,EAC9B,eAAe,MAAM,EACrB,WAAW,IAAI,KACd;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAyBnE,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GACrB,aAAa,IAAI,EACjB,MAAM,aAAa,CAAC,MAAM,CAAC,EAC3B,YAAW,IAAa,EACxB,aAAa,MAAM,GAAG,SAAS,KAC9B,aAAa,CAAC,MAAM,CAoFtB,CAAA;AAmBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,GAAI,aAAa,IAAI,EAAE,YAAW,IAAa,KAAG,MAyGtE,CAAA;AAgBD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,GACjB,aAAa,IAAI,EACjB,MAAM,aAAa,CAAC,MAAM,CAAC,EAC3B,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,YAAW,IAAa,EACxB,gBAAe,MAAmC,KACjD,aAAa,CAAC,MAAM,CAmCtB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,IAAI,GACf,aAAa,IAAI,EACjB,MAAM,aAAa,CAAC,MAAM,CAAC,EAC3B,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,YAAW,IAAa,KACvB;IACD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAehC,CAAA;AA8BD;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,GAAI,aAAa,IAAI,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAsCnE,CAAA"}