@sysid/sandbox-runtime-improved 0.0.43-sysid.6 → 0.0.45-sysid.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -5
- package/dist/sandbox/linux-sandbox-utils.d.ts +17 -6
- package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/linux-sandbox-utils.js +109 -16
- package/dist/sandbox/linux-sandbox-utils.js.map +1 -1
- package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/macos-sandbox-utils.js +9 -0
- package/dist/sandbox/macos-sandbox-utils.js.map +1 -1
- package/dist/sandbox/sandbox-manager.d.ts.map +1 -1
- package/dist/sandbox/sandbox-manager.js +3 -2
- package/dist/sandbox/sandbox-manager.js.map +1 -1
- package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/arm64/unix-block.bpf +0 -0
- package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/x64/unix-block.bpf +0 -0
- package/dist/vendor/seccomp-src/apply-seccomp.c +231 -44
- package/dist/vendor/seccomp-src/seccomp-unix-block.c +50 -3
- package/package.json +2 -2
- package/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/vendor/seccomp/arm64/unix-block.bpf +0 -0
- package/vendor/seccomp/x64/apply-seccomp +0 -0
- package/vendor/seccomp/x64/unix-block.bpf +0 -0
- package/vendor/seccomp-src/apply-seccomp.c +231 -44
- package/vendor/seccomp-src/seccomp-unix-block.c +50 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAQxB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE5B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAQ7B,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,IAAI,MAAwC,CAAA;AAC5C,IAAI,eAAqE,CAAA;AACzE,IAAI,gBAA+C,CAAA;AACnD,IAAI,cAAqD,CAAA;AACzD,IAAI,qBAAqE,CAAA;AACzE,IAAI,iBAAiB,GAAG,KAAK,CAAA;AAC7B,IAAI,kBAA4C,CAAA;AAChD,IAAI,WAA4C,CAAA;AAChD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAA;AAEzD,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,SAAS,eAAe;IACtB,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChB,eAAe,CAAC,qCAAqC,CAAC,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACJ,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACvC,iBAAiB,GAAG,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,qEAAqE;IACrE,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACrD,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,CAAA;IACrC,CAAC;IAED,wCAAwC;IACxC,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,IAAY,EACZ,kBAAuC;IAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,eAAe,CAAC,8CAA8C,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,2EAA2E;IAC3E,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,eAAe,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;YACzE,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;IAEpD,6BAA6B;IAC7B,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,oBAAoB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,0BAA0B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,oBAAoB,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;YACvD,eAAe,CAAC,2BAA2B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,eAAe,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,eAAe,CAAC,yCAAyC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,iBAAiB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC/C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,iCAAiC,KAAK,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAA;IAExD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,QAAQ,IAAI,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAC/D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,kBAAuC;IAEvC,eAAe,GAAG,qBAAqB,CAAC;QACtC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,iBAAiB;QACjB,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAA;QAE9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAChC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,eAAe,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACpE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACzD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,kBAAuC;IAEvC,gBAAgB,GAAG,sBAAsB,CAAC;QACxC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0CAA0C;YAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QAED,gBAAgB;aACb,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC;aACtB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE;YACrB,gBAAgB,EAAE,KAAK,EAAE,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC;aACD,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,KAAK,UAAU,UAAU,CACvB,aAAmC,EACnC,kBAAuC,EACvC,gBAAgB,GAAG,KAAK;IAExB,iCAAiC;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,qBAAqB,CAAA;QAC3B,OAAM;IACR,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,aAAa,CAAA;IAEtB,wEAAwE;IACxE,6EAA6E;IAC7E,WAAW,GAAG,kBAAkB,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACnE,IAAI,WAAW,EAAE,CAAC;QAChB,eAAe,CACb,iCAAiC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG;YAChE,SAAS,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAC7C,CAAA;IACH,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,mBAAmB,EAAE,CAAA;IAErB,qBAAqB;IACrB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAChC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,gBAAgB,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAClD,kBAAkB,GAAG,2BAA2B,CAC9C,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAC9D,MAAM,CAAC,gBAAgB,CACxB,CAAA;QACD,eAAe,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,uCAAuC;IACvC,eAAe,EAAE,CAAA;IAEjB,oCAAoC;IACpC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,oDAAoD;YACpD,IAAI,aAAqB,CAAA;YACzB,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC/C,iDAAiD;gBACjD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;gBAC5C,eAAe,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,aAAa,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,cAAsB,CAAA;YAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAChD,kDAAkD;gBAClD,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;gBAC9C,eAAe,CAAC,sCAAsC,cAAc,EAAE,CAAC,CAAA;YACzE,CAAC;iBAAM,CAAC;gBACN,0BAA0B;gBAC1B,cAAc,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,CAAA;YAClE,CAAC;YAED,8CAA8C;YAC9C,IAAI,WAAkD,CAAA;YACtD,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC9B,WAAW,GAAG,MAAM,4BAA4B,CAC9C,aAAa,EACb,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAA8B;gBACzC,aAAa;gBACb,cAAc;gBACd,WAAW;aACZ,CAAA;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,eAAe,CAAC,oCAAoC,CAAC,CAAA;YACrD,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wDAAwD;YACxD,qBAAqB,GAAG,SAAS,CAAA;YACjC,cAAc,GAAG,SAAS,CAAA;YAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChB,eAAe,CAAC,2CAA2C,CAAC,EAAE,EAAE;oBAC9D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,qBAAqB,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,kCAAkC;QAClC,OAAO,aAAa,EAAE,KAAK,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAG1B;IACC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,kFAAkF;IAClF,MAAM,SAAS,GAAG,aAAa,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACvE,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,OAAO,aAAa,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IAC9C,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,oCAAoC,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CAC9E,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,8CAA8C,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CACxF,CAAA;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,eAAe,EAAE,UAAU;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IACnE,CAAC;IAED,0FAA0F;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;SAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,yFAAyF;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;SAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,UAAU,CAAC,CAAA;IAE5D,OAAO;QACL,SAAS;QACT,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAEhD,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAA;AAC7C,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAA;AAC3C,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,gBAAgB,CAAA;AACjC,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,MAAM,EAAE,yBAAyB,CAAA;AAC1C,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO,MAAM,EAAE,4BAA4B,CAAA;AAC7C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,MAAM,EAAE,wBAAwB,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK,CAAA;AACpD,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,MAAM,EAAE,eAAe,CAAA;AAChC,CAAC;AAED,SAAS,gBAAgB;IAGvB,OAAO,MAAM,EAAE,OAAO,CAAA;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,cAAc,EAAE,aAAa,CAAA;AACtC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,cAAc,CAAA;AACvC,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,cAAc,EAAE,WAAW,EAAE,cAAc,CAAA;AACpD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,cAAc,EAAE,WAAW,EAAE,eAAe,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,cAAc,KAAK,SAAS,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,QAAiB,EACjB,YAA4C,EAC5C,WAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAE9B,2EAA2E;IAC3E,iEAAiE;IACjE,0EAA0E;IAC1E,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,gCAAgC;IAChC,MAAM,eAAe,GAAG,CAAC,KAAe,EAAY,EAAE,CACpD,KAAK;SACF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE;QACV,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,eAAe,CACb,mDAAmD,CAAC,EAAE,CACvD,CAAA;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACN,MAAM,cAAc,GAAG,eAAe,CACpC,YAAY,EAAE,UAAU,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5E,CAAA;IACD,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,cAAc,CAAC;QACzD,eAAe,EAAE,eAAe,CAC9B,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAC1E;KACF,CAAA;IACD,MAAM,WAAW,GACf,YAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAA;IACzE,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,gBAAgB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAChB,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAAA;IAC3E,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,iBAAiB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,iBAAiB;KACnC,CAAA;IAED,yFAAyF;IACzF,sCAAsC;IACtC,uFAAuF;IACvF,oFAAoF;IACpF,sFAAsF;IACtF,MAAM,gBAAgB,GACpB,YAAY,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS;QACnD,MAAM,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS,CAAA;IAE/C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;IAEhD,+DAA+D;IAC/D,kEAAkE;IAClE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;IAE1C,mEAAmE;IACnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,4BAA4B,EAAE,CAAA;IACtC,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAA;IAE3D,4EAA4E;IAC5E,MAAM,mBAAmB,GACvB,YAAY,EAAE,mBAAmB,IAAI,MAAM,EAAE,mBAAmB,CAAA;IAElE,uEAAuE;IACvE,MAAM,eAAe,GACnB,YAAY,EAAE,eAAe,IAAI,MAAM,EAAE,eAAe,CAAA;IAE1D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,2EAA2E;YAC3E,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,+EAA+E;gBAC/E,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC7D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,UAAU;gBACV,WAAW;gBACX,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,iBAAiB,EAAE,oBAAoB,EAAE;gBACzC,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,QAAQ;gBACR,mBAAmB;gBACnB,eAAe;gBACf,cAAc,EAAE,iBAAiB,EAAE;gBACnC,4BAA4B,EAAE,+BAA+B,EAAE;gBAC/D,QAAQ;aACT,CAAC,CAAA;QAEJ,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,gFAAgF;gBAChF,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,sBAAsB,EAAE;oBAC1B,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iBAAiB;oBAChC,CAAC,CAAC,uBAAuB,EAAE;oBAC3B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,iBAAiB;oBAC9B,CAAC,CAAC,cAAc,EAAE,aAAa;oBAC/B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,cAAc,EAAE,cAAc;oBAChC,CAAC,CAAC,SAAS;gBACb,UAAU;gBACV,WAAW;gBACX,yBAAyB,EAAE,4BAA4B,EAAE;gBACzD,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,QAAQ;gBACR,aAAa,EAAE,gBAAgB,EAAE;gBACjC,wBAAwB,EAAE,2BAA2B,EAAE;gBACvD,cAAc,EAAE,iBAAiB,EAAE;gBACnC,aAAa,EAAE,gBAAgB,EAAE;gBACjC,WAAW;aACZ,CAAC,CAAA;QAEJ;YACE,oGAAoG;YACpG,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,EAAE,CAClE,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,SAA+B;IACnD,2CAA2C;IAC3C,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,0BAA0B;IAC1B,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/D,eAAe,CAAC,+BAA+B,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,uBAAuB,EAAE,CAAA;AAC3B,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,2CAA2C;IAC3C,mBAAmB,EAAE,CAAA;IAErB,mBAAmB;IACnB,IAAI,kBAAkB,EAAE,CAAC;QACvB,kBAAkB,EAAE,CAAA;QACpB,kBAAkB,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,EACJ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,GAAG,cAAc,CAAC,WAAW,CAAA;QAE9B,yCAAyC;QACzC,MAAM,YAAY,GAAoB,EAAE,CAAA;QAExC,2CAA2C;QAC3C,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC9C,eAAe,CAAC,qCAAqC,CAAC,CAAA;gBAEtD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBAClC,eAAe,CAAC,4BAA4B,CAAC,CAAA;wBAC7C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;4BAC9B,eAAe,CAAC,2CAA2C,EAAE;gCAC3D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;oCAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCAChD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;wBACnD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC/C,eAAe,CAAC,sCAAsC,CAAC,CAAA;gBAEvD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBACnC,eAAe,CAAC,6BAA6B,CAAC,CAAA;wBAC9C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;4BAC/B,eAAe,CAAC,4CAA4C,EAAE;gCAC5D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;oCAC3B,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCACjD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;wBACpD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE/B,mBAAmB;QACnB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC1C,eAAe,CAAC,wBAAwB,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;oBACnD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;oBACpD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,eAAe,CAAA,CAAC,8CAA8C;QAC7E,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACnB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;oBACxD,eAAe,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,EAAE;wBACnE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACjE,eAAe,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAAE;gBACpE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAEhC,mBAAmB;IACnB,eAAe,GAAG,SAAS,CAAA;IAC3B,gBAAgB,GAAG,SAAS,CAAA;IAC5B,cAAc,GAAG,SAAS,CAAA;IAC1B,qBAAqB,GAAG,SAAS,CAAA;IACjC,WAAW,GAAG,SAAS,CAAA;AACzB,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,SAAS,IAAI,GAAG,GAAG,sBAAsB,GAAG,GAAG,CAAA;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,SAAS,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG,CAAA;IACnC,CAAC;IACD,SAAS,IAAI,uBAAuB,CAAA;IAEpC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,4DAA4D;IAC5D,oDAAoD;IACpD,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAa,EAAE,CAAA;IAEjC,2CAA2C;IAC3C,uFAAuF;IACvF,MAAM,QAAQ,GAAG;QACf,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;QAC/B,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;KAC/B,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,qFAAqF;QACrF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAE9D,2EAA2E;QAC3E,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAA;AACrB,CAAC;AAiDD,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,UAAU;IACV,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,2BAA2B;IAC3B,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,4BAA4B;IAC5B,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,4BAA4B;IAC5B,eAAe;IACf,mBAAmB;IACnB,KAAK;IACL,wBAAwB;IACxB,iCAAiC;IACjC,2BAA2B;IAC3B,SAAS;IACT,YAAY;CACJ,CAAA"}
|
|
1
|
+
{"version":3,"file":"sandbox-manager.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAQxB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE5B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAQ7B,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,IAAI,MAAwC,CAAA;AAC5C,IAAI,eAAqE,CAAA;AACzE,IAAI,gBAA+C,CAAA;AACnD,IAAI,cAAqD,CAAA;AACzD,IAAI,qBAAqE,CAAA;AACzE,IAAI,iBAAiB,GAAG,KAAK,CAAA;AAC7B,IAAI,kBAA4C,CAAA;AAChD,IAAI,WAA4C,CAAA;AAChD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAA;AAEzD,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E,SAAS,eAAe;IACtB,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAM;IACR,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChB,eAAe,CAAC,qCAAqC,CAAC,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACJ,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACtC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACvC,iBAAiB,GAAG,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,qEAAqE;IACrE,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACrD,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,CAAA;IACrC,CAAC;IAED,wCAAwC;IACxC,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,IAAY,EACZ,kBAAuC;IAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,eAAe,CAAC,8CAA8C,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,2EAA2E;IAC3E,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,eAAe,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;YACzE,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;IAEpD,6BAA6B;IAC7B,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,oBAAoB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,0BAA0B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1D,IAAI,oBAAoB,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;YACvD,eAAe,CAAC,2BAA2B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,eAAe,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,eAAe,CAAC,yCAAyC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,iBAAiB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;YAC/C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,iCAAiC,KAAK,EAAE,EAAE;YACxD,KAAK,EAAE,OAAO;SACf,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAA;IAExD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,eAAe,CAAC,QAAQ,IAAI,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAC/D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,kBAAuC;IAEvC,eAAe,GAAG,qBAAqB,CAAC;QACtC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,iBAAiB;QACjB,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAA;QAE9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAChC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,eAAe,CAAC,qCAAqC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACpE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;YACzD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,kBAAuC;IAEvC,gBAAgB,GAAG,sBAAsB,CAAC;QACxC,MAAM,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CACrC,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACtD,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0CAA0C;YAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QAED,gBAAgB;aACb,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC;aACtB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE;YACrB,gBAAgB,EAAE,KAAK,EAAE,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC;aACD,KAAK,CAAC,MAAM,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,KAAK,UAAU,UAAU,CACvB,aAAmC,EACnC,kBAAuC,EACvC,gBAAgB,GAAG,KAAK;IAExB,iCAAiC;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,qBAAqB,CAAA;QAC3B,OAAM;IACR,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,aAAa,CAAA;IAEtB,wEAAwE;IACxE,6EAA6E;IAC7E,WAAW,GAAG,kBAAkB,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACnE,IAAI,WAAW,EAAE,CAAC;QAChB,eAAe,CACb,iCAAiC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG;YAChE,SAAS,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAC7C,CAAA;IACH,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,mBAAmB,EAAE,CAAA;IAErB,qBAAqB;IACrB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAChC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,gBAAgB,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAClD,kBAAkB,GAAG,2BAA2B,CAC9C,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAC9D,MAAM,CAAC,gBAAgB,CACxB,CAAA;QACD,eAAe,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,uCAAuC;IACvC,eAAe,EAAE,CAAA;IAEjB,oCAAoC;IACpC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC;YACH,oDAAoD;YACpD,IAAI,aAAqB,CAAA;YACzB,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC/C,iDAAiD;gBACjD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;gBAC5C,eAAe,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,aAAa,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,cAAsB,CAAA;YAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAChD,kDAAkD;gBAClD,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;gBAC9C,eAAe,CAAC,sCAAsC,cAAc,EAAE,CAAC,CAAA;YACzE,CAAC;iBAAM,CAAC;gBACN,0BAA0B;gBAC1B,cAAc,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,CAAA;YAClE,CAAC;YAED,8CAA8C;YAC9C,IAAI,WAAkD,CAAA;YACtD,IAAI,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC9B,WAAW,GAAG,MAAM,4BAA4B,CAC9C,aAAa,EACb,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAA8B;gBACzC,aAAa;gBACb,cAAc;gBACd,WAAW;aACZ,CAAA;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,eAAe,CAAC,oCAAoC,CAAC,CAAA;YACrD,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wDAAwD;YACxD,qBAAqB,GAAG,SAAS,CAAA;YACjC,cAAc,GAAG,SAAS,CAAA;YAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChB,eAAe,CAAC,2CAA2C,CAAC,EAAE,EAAE;oBAC9D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,qBAAqB,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,kCAAkC;QAClC,OAAO,aAAa,EAAE,KAAK,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,CAAA;AAC7B,CAAC;AAED,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAG1B;IACC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,kFAAkF;IAClF,MAAM,SAAS,GAAG,aAAa,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACvE,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,OAAO,aAAa,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IAC9C,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,oCAAoC,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CAC9E,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,eAAe,CACb,8CAA8C,CAAC,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,CACxF,CAAA;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,eAAe,EAAE,UAAU;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IACnE,CAAC;IAED,0FAA0F;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;SAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,yFAAyF;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;SAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,UAAU,CAAC,CAAA;IAE5D,OAAO;QACL,SAAS;QACT,eAAe,EAAE,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAA;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAEhD,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAA;AAC7C,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAA;AAC3C,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,EAAE,gBAAgB,CAAA;AACjC,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,MAAM,EAAE,yBAAyB,CAAA;AAC1C,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO,MAAM,EAAE,4BAA4B,CAAA;AAC7C,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,MAAM,EAAE,wBAAwB,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,EAAE,UAAU,EAAE,cAAc,IAAI,KAAK,CAAA;AACpD,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,MAAM,EAAE,eAAe,CAAA;AAChC,CAAC;AAED,SAAS,gBAAgB;IAGvB,OAAO,MAAM,EAAE,OAAO,CAAA;AACxB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,cAAc,EAAE,aAAa,CAAA;AACtC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,cAAc,CAAA;AACvC,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,cAAc,EAAE,WAAW,EAAE,cAAc,CAAA;AACpD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,cAAc,EAAE,WAAW,EAAE,eAAe,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,cAAc,KAAK,SAAS,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,QAAiB,EACjB,YAA4C,EAC5C,WAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAE9B,2EAA2E;IAC3E,iEAAiE;IACjE,0EAA0E;IAC1E,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,gCAAgC;IAChC,MAAM,eAAe,GAAG,CAAC,KAAe,EAAY,EAAE,CACpD,KAAK;SACF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE;QACV,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,eAAe,CACb,mDAAmD,CAAC,EAAE,CACvD,CAAA;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACN,MAAM,cAAc,GAAG,eAAe,CACpC,YAAY,EAAE,UAAU,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5E,CAAA;IACD,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,CAAC,GAAG,oBAAoB,EAAE,EAAE,GAAG,cAAc,CAAC;QACzD,eAAe,EAAE,eAAe,CAC9B,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAC1E;KACF,CAAA;IACD,MAAM,WAAW,GACf,YAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAA;IACzE,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,gBAAgB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAChB,YAAY,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,IAAI,EAAE,CAAA;IAC3E,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,iBAAiB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,iBAAiB;KACnC,CAAA;IAED,yFAAyF;IACzF,sCAAsC;IACtC,uFAAuF;IACvF,oFAAoF;IACpF,sFAAsF;IACtF,MAAM,gBAAgB,GACpB,YAAY,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS;QACnD,MAAM,EAAE,OAAO,EAAE,cAAc,KAAK,SAAS,CAAA;IAE/C,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;IAEhD,+DAA+D;IAC/D,kEAAkE;IAClE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;IAE1C,mEAAmE;IACnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,4BAA4B,EAAE,CAAA;IACtC,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAA;IAE3D,4EAA4E;IAC5E,MAAM,mBAAmB,GACvB,YAAY,EAAE,mBAAmB,IAAI,MAAM,EAAE,mBAAmB,CAAA;IAElE,uEAAuE;IACvE,MAAM,eAAe,GACnB,YAAY,EAAE,eAAe,IAAI,MAAM,EAAE,eAAe,CAAA;IAE1D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,2EAA2E;YAC3E,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,+EAA+E;gBAC/E,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC7D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,UAAU;gBACV,WAAW;gBACX,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,iBAAiB,EAAE,oBAAoB,EAAE;gBACzC,gBAAgB,EAAE,mBAAmB,EAAE;gBACvC,QAAQ;gBACR,mBAAmB;gBACnB,eAAe;gBACf,cAAc,EAAE,iBAAiB,EAAE;gBACnC,4BAA4B,EAAE,+BAA+B,EAAE;gBAC/D,QAAQ;aACT,CAAC,CAAA;QAEJ,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;gBACjC,OAAO;gBACP,uBAAuB;gBACvB,gFAAgF;gBAChF,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,sBAAsB,EAAE;oBAC1B,CAAC,CAAC,SAAS;gBACb,eAAe,EAAE,iBAAiB;oBAChC,CAAC,CAAC,uBAAuB,EAAE;oBAC3B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,iBAAiB;oBAC9B,CAAC,CAAC,cAAc,EAAE,aAAa;oBAC/B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,iBAAiB;oBAC/B,CAAC,CAAC,cAAc,EAAE,cAAc;oBAChC,CAAC,CAAC,SAAS;gBACb,UAAU;gBACV,WAAW;gBACX,yBAAyB,EAAE,4BAA4B,EAAE;gBACzD,mBAAmB,EAAE,sBAAsB,EAAE;gBAC7C,QAAQ;gBACR,aAAa,EAAE,gBAAgB,EAAE;gBACjC,wBAAwB,EAAE,2BAA2B,EAAE;gBACvD,cAAc,EAAE,iBAAiB,EAAE;gBACnC,aAAa,EAAE,gBAAgB,EAAE;gBACjC,WAAW;aACZ,CAAC,CAAA;QAEJ;YACE,oGAAoG;YACpG,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,EAAE,CAClE,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,SAA+B;IACnD,2CAA2C;IAC3C,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,0BAA0B;IAC1B,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/D,eAAe,CAAC,+BAA+B,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,uBAAuB,EAAE,CAAA;AAC3B,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,2DAA2D;IAC3D,8DAA8D;IAC9D,uBAAuB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAExC,mBAAmB;IACnB,IAAI,kBAAkB,EAAE,CAAC;QACvB,kBAAkB,EAAE,CAAA;QACpB,kBAAkB,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,EACJ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,GAAG,cAAc,CAAC,WAAW,CAAA;QAE9B,yCAAyC;QACzC,MAAM,YAAY,GAAoB,EAAE,CAAA;QAExC,2CAA2C;QAC3C,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC9C,eAAe,CAAC,qCAAqC,CAAC,CAAA;gBAEtD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBAClC,eAAe,CAAC,4BAA4B,CAAC,CAAA;wBAC7C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;4BAC9B,eAAe,CAAC,2CAA2C,EAAE;gCAC3D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;oCAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCAChD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;wBACnD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAC/C,eAAe,CAAC,sCAAsC,CAAC,CAAA;gBAEvD,2BAA2B;gBAC3B,YAAY,CAAC,IAAI,CACf,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;oBAC1B,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;wBACnC,eAAe,CAAC,6BAA6B,CAAC,CAAA;wBAC9C,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC,CAAA;oBACF,0BAA0B;oBAC1B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;4BAC/B,eAAe,CAAC,4CAA4C,EAAE;gCAC5D,KAAK,EAAE,MAAM;6BACd,CAAC,CAAA;4BACF,IAAI,CAAC;gCACH,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;oCAC3B,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gCACjD,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,CAAA;oBACX,CAAC,EAAE,IAAI,CAAC,CAAA;gBACV,CAAC,CAAC,CACH,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpD,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;wBACpD,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE/B,mBAAmB;QACnB,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC1C,eAAe,CAAC,wBAAwB,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE;oBACnD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAe,CAAC,yBAAyB,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE;oBACpD,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAAoB,EAAE,CAAA;IAEzC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,eAAe,CAAA,CAAC,8CAA8C;QAC7E,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACnB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;oBACxD,eAAe,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,EAAE;wBACnE,KAAK,EAAE,OAAO;qBACf,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACjE,eAAe,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAAE;gBACpE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAEhC,mBAAmB;IACnB,eAAe,GAAG,SAAS,CAAA;IAC3B,gBAAgB,GAAG,SAAS,CAAA;IAC5B,cAAc,GAAG,SAAS,CAAA;IAC1B,qBAAqB,GAAG,SAAS,CAAA;IACjC,WAAW,GAAG,SAAS,CAAA;AACzB,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,SAAS,GAAG,MAAM,CAAA;IACtB,SAAS,IAAI,GAAG,GAAG,sBAAsB,GAAG,GAAG,CAAA;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,SAAS,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG,CAAA;IACnC,CAAC;IACD,SAAS,IAAI,uBAAuB,CAAA;IAEpC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,4DAA4D;IAC5D,oDAAoD;IACpD,IAAI,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAa,EAAE,CAAA;IAEjC,2CAA2C;IAC3C,uFAAuF;IACvF,MAAM,QAAQ,GAAG;QACf,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;QAC/B,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS;KAC/B,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,qFAAqF;QACrF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAE9D,2EAA2E;QAC3E,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAA;AACrB,CAAC;AAiDD,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,UAAU;IACV,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,2BAA2B;IAC3B,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,4BAA4B;IAC5B,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,4BAA4B;IAC5B,eAAe;IACf,mBAAmB;IACnB,KAAK;IACL,wBAAwB;IACxB,iCAAiC;IACjC,2BAA2B;IAC3B,SAAS;IACT,YAAY;CACJ,CAAA"}
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
@@ -1,39 +1,149 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* apply-seccomp.c - Apply seccomp BPF filter
|
|
2
|
+
* apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
|
|
3
3
|
*
|
|
4
4
|
* Usage: apply-seccomp <filter.bpf> <command> [args...]
|
|
5
5
|
*
|
|
6
|
-
* This program reads a pre-compiled BPF filter from a file,
|
|
7
|
-
*
|
|
6
|
+
* This program reads a pre-compiled BPF filter from a file, isolates the
|
|
7
|
+
* target command in a nested user+PID+mount namespace so it cannot see or
|
|
8
|
+
* ptrace any process that lacks the filter, applies the filter with
|
|
9
|
+
* prctl(PR_SET_SECCOMP), and execs the command.
|
|
8
10
|
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
11
|
+
* Process layout inside the outer bwrap sandbox:
|
|
12
|
+
*
|
|
13
|
+
* bwrap init (PID 1) <- outer PID ns, no seccomp
|
|
14
|
+
* \_ bash / socat ... <- outer PID ns, no seccomp
|
|
15
|
+
* \_ apply-seccomp [outer] <- outer PID ns, waits for inner init
|
|
16
|
+
* ================================================= PID ns boundary
|
|
17
|
+
* \_ apply-seccomp [inner init] <- inner PID 1, PR_SET_DUMPABLE=0
|
|
18
|
+
* \_ user command <- inner PID 2, seccomp applied
|
|
19
|
+
*
|
|
20
|
+
* From the user command's point of view /proc contains only its own process
|
|
21
|
+
* tree. The bwrap init, bash wrapper, and socat helpers are not addressable,
|
|
22
|
+
* so they cannot be ptraced or patched via /proc/N/mem even on systems with
|
|
23
|
+
* kernel.yama.ptrace_scope=0. The inner init (PID 1) sets PR_SET_DUMPABLE=0
|
|
24
|
+
* so it cannot be ptraced either.
|
|
25
|
+
*
|
|
26
|
+
* Any failure to set up the nested namespaces aborts with a non-zero exit
|
|
27
|
+
* status; we never fall back to running the command without isolation.
|
|
12
28
|
*
|
|
13
29
|
* Compile: gcc -static -O2 -o apply-seccomp apply-seccomp.c
|
|
14
30
|
*/
|
|
15
31
|
|
|
32
|
+
#define _GNU_SOURCE
|
|
16
33
|
#include <stdio.h>
|
|
17
34
|
#include <stdlib.h>
|
|
35
|
+
#include <stdarg.h>
|
|
18
36
|
#include <string.h>
|
|
19
37
|
#include <unistd.h>
|
|
20
38
|
#include <fcntl.h>
|
|
39
|
+
#include <errno.h>
|
|
40
|
+
#include <sched.h>
|
|
41
|
+
#include <signal.h>
|
|
21
42
|
#include <sys/prctl.h>
|
|
43
|
+
#include <sys/wait.h>
|
|
44
|
+
#include <sys/mount.h>
|
|
22
45
|
#include <linux/seccomp.h>
|
|
23
46
|
#include <linux/filter.h>
|
|
24
|
-
#include <errno.h>
|
|
25
47
|
|
|
26
48
|
#ifndef PR_SET_NO_NEW_PRIVS
|
|
27
49
|
#define PR_SET_NO_NEW_PRIVS 38
|
|
28
50
|
#endif
|
|
29
51
|
|
|
52
|
+
#ifndef PR_CAP_AMBIENT
|
|
53
|
+
#define PR_CAP_AMBIENT 47
|
|
54
|
+
#define PR_CAP_AMBIENT_CLEAR_ALL 4
|
|
55
|
+
#endif
|
|
56
|
+
|
|
30
57
|
#ifndef SECCOMP_MODE_FILTER
|
|
31
58
|
#define SECCOMP_MODE_FILTER 2
|
|
32
59
|
#endif
|
|
33
60
|
|
|
34
|
-
#define MAX_FILTER_SIZE 4096
|
|
61
|
+
#define MAX_FILTER_SIZE 4096
|
|
62
|
+
|
|
63
|
+
static void die(const char *msg) {
|
|
64
|
+
perror(msg);
|
|
65
|
+
_exit(1);
|
|
66
|
+
}
|
|
67
|
+
|
|
68
|
+
static int write_file(const char *path, const char *fmt, ...) {
|
|
69
|
+
char buf[256];
|
|
70
|
+
va_list ap;
|
|
71
|
+
va_start(ap, fmt);
|
|
72
|
+
int len = vsnprintf(buf, sizeof(buf), fmt, ap);
|
|
73
|
+
va_end(ap);
|
|
74
|
+
if (len < 0 || (size_t)len >= sizeof(buf)) {
|
|
75
|
+
errno = EOVERFLOW;
|
|
76
|
+
return -1;
|
|
77
|
+
}
|
|
78
|
+
|
|
79
|
+
int fd = open(path, O_WRONLY);
|
|
80
|
+
if (fd < 0) {
|
|
81
|
+
return -1;
|
|
82
|
+
}
|
|
83
|
+
ssize_t r = write(fd, buf, (size_t)len);
|
|
84
|
+
int saved = errno;
|
|
85
|
+
close(fd);
|
|
86
|
+
if (r != len) {
|
|
87
|
+
errno = (r < 0) ? saved : EIO;
|
|
88
|
+
return -1;
|
|
89
|
+
}
|
|
90
|
+
return 0;
|
|
91
|
+
}
|
|
92
|
+
|
|
93
|
+
/* PID the current process forwards signals to. Used by both the outer stub
|
|
94
|
+
* (forwards to inner init) and the inner init (forwards to the worker).
|
|
95
|
+
* PID 1 ignores signals it has no handler for, so the inner init MUST install
|
|
96
|
+
* these or SIGTERM from the outside is silently dropped. */
|
|
97
|
+
static volatile pid_t forward_target = -1;
|
|
98
|
+
|
|
99
|
+
static void forward_signal(int sig) {
|
|
100
|
+
if (forward_target > 0) {
|
|
101
|
+
kill(forward_target, sig);
|
|
102
|
+
}
|
|
103
|
+
}
|
|
104
|
+
|
|
105
|
+
static void install_forwarders(pid_t target) {
|
|
106
|
+
forward_target = target;
|
|
107
|
+
struct sigaction sa = { .sa_handler = forward_signal };
|
|
108
|
+
sigemptyset(&sa.sa_mask);
|
|
109
|
+
sigaction(SIGTERM, &sa, NULL);
|
|
110
|
+
sigaction(SIGINT, &sa, NULL);
|
|
111
|
+
sigaction(SIGHUP, &sa, NULL);
|
|
112
|
+
sigaction(SIGQUIT, &sa, NULL);
|
|
113
|
+
sigaction(SIGUSR1, &sa, NULL);
|
|
114
|
+
sigaction(SIGUSR2, &sa, NULL);
|
|
115
|
+
}
|
|
116
|
+
|
|
117
|
+
/*
|
|
118
|
+
* Wait for `main_child`, reaping any other children that exit first.
|
|
119
|
+
* Returns as soon as `main_child` terminates — the caller then _exit()s,
|
|
120
|
+
* which as PID 1 tears down the namespace and SIGKILLs any stragglers.
|
|
121
|
+
* Returns an exit(3)-style status: exit code, or 128+signal.
|
|
122
|
+
*/
|
|
123
|
+
static int reap_until(pid_t main_child) {
|
|
124
|
+
int status = 0;
|
|
125
|
+
for (;;) {
|
|
126
|
+
pid_t r = waitpid(-1, &status, 0);
|
|
127
|
+
if (r < 0) {
|
|
128
|
+
if (errno == EINTR) {
|
|
129
|
+
continue;
|
|
130
|
+
}
|
|
131
|
+
return 1; /* ECHILD without seeing main_child — shouldn't happen. */
|
|
132
|
+
}
|
|
133
|
+
if (r == main_child) {
|
|
134
|
+
if (WIFEXITED(status)) {
|
|
135
|
+
return WEXITSTATUS(status);
|
|
136
|
+
}
|
|
137
|
+
if (WIFSIGNALED(status)) {
|
|
138
|
+
return 128 + WTERMSIG(status);
|
|
139
|
+
}
|
|
140
|
+
return 1;
|
|
141
|
+
}
|
|
142
|
+
/* Reaped an orphan that died before main_child; keep waiting. */
|
|
143
|
+
}
|
|
144
|
+
}
|
|
35
145
|
|
|
36
|
-
int main(int argc, char *argv[]
|
|
146
|
+
int main(int argc, char *argv[]) {
|
|
37
147
|
if (argc < 3) {
|
|
38
148
|
fprintf(stderr, "Usage: %s <filter.bpf> <command> [args...]\n", argv[0]);
|
|
39
149
|
return 1;
|
|
@@ -42,57 +152,134 @@ int main(int argc, char *argv[], char *envp[]) {
|
|
|
42
152
|
const char *filter_path = argv[1];
|
|
43
153
|
char **command_argv = &argv[2];
|
|
44
154
|
|
|
45
|
-
|
|
155
|
+
/* ---- Load the BPF filter up front so we fail before any namespace work. ---- */
|
|
46
156
|
int fd = open(filter_path, O_RDONLY);
|
|
47
157
|
if (fd < 0) {
|
|
48
|
-
|
|
49
|
-
return 1;
|
|
158
|
+
die("apply-seccomp: open(filter)");
|
|
50
159
|
}
|
|
51
|
-
|
|
52
|
-
// Read filter into memory
|
|
53
|
-
unsigned char filter_bytes[MAX_FILTER_SIZE];
|
|
160
|
+
static unsigned char filter_bytes[MAX_FILTER_SIZE];
|
|
54
161
|
ssize_t filter_size = read(fd, filter_bytes, MAX_FILTER_SIZE);
|
|
55
162
|
close(fd);
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
perror("Failed to read BPF filter");
|
|
163
|
+
if (filter_size <= 0 || filter_size % 8 != 0) {
|
|
164
|
+
fprintf(stderr, "apply-seccomp: invalid BPF filter (size=%zd)\n", filter_size);
|
|
59
165
|
return 1;
|
|
60
166
|
}
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
167
|
+
struct sock_fprog prog = {
|
|
168
|
+
.len = (unsigned short)(filter_size / 8),
|
|
169
|
+
.filter = (struct sock_filter *)filter_bytes,
|
|
170
|
+
};
|
|
171
|
+
|
|
172
|
+
/* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
|
|
173
|
+
*
|
|
174
|
+
* Two paths to get CAP_SYS_ADMIN for the unshare:
|
|
175
|
+
* (a) The caller (bwrap) kept CAP_SYS_ADMIN in this user namespace via
|
|
176
|
+
* --cap-add. Just unshare directly.
|
|
177
|
+
* (b) We don't have the cap. Create a nested user namespace to get it,
|
|
178
|
+
* map uid/gid, then unshare. This also works when apply-seccomp is
|
|
179
|
+
* run standalone outside bwrap.
|
|
180
|
+
*
|
|
181
|
+
* Path (a) is tried first. If the caller didn't give us the cap, the
|
|
182
|
+
* kernel returns EPERM and we fall through to (b). Path (b) can itself
|
|
183
|
+
* fail on hosts where unprivileged user namespaces are gated by an LSM
|
|
184
|
+
* (Ubuntu 24.04's AppArmor restriction, for example) — the unshare
|
|
185
|
+
* succeeds but the new namespace grants no capabilities, so the setgroups
|
|
186
|
+
* write fails. In that case we abort: the caller must supply CAP_SYS_ADMIN.
|
|
187
|
+
*/
|
|
188
|
+
if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
|
|
189
|
+
if (errno != EPERM) {
|
|
190
|
+
die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS)");
|
|
191
|
+
}
|
|
192
|
+
|
|
193
|
+
uid_t uid = geteuid();
|
|
194
|
+
gid_t gid = getegid();
|
|
195
|
+
|
|
196
|
+
if (unshare(CLONE_NEWUSER) < 0) {
|
|
197
|
+
die("apply-seccomp: unshare(CLONE_NEWUSER)");
|
|
198
|
+
}
|
|
199
|
+
if (write_file("/proc/self/setgroups", "deny") < 0) {
|
|
200
|
+
die("apply-seccomp: write /proc/self/setgroups "
|
|
201
|
+
"(nested userns is capability-restricted; "
|
|
202
|
+
"caller must provide CAP_SYS_ADMIN)");
|
|
203
|
+
}
|
|
204
|
+
if (write_file("/proc/self/uid_map", "%u %u 1\n", uid, uid) < 0) {
|
|
205
|
+
die("apply-seccomp: write /proc/self/uid_map");
|
|
206
|
+
}
|
|
207
|
+
if (write_file("/proc/self/gid_map", "%u %u 1\n", gid, gid) < 0) {
|
|
208
|
+
die("apply-seccomp: write /proc/self/gid_map");
|
|
209
|
+
}
|
|
210
|
+
if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
|
|
211
|
+
die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS) after userns");
|
|
212
|
+
}
|
|
64
213
|
}
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
214
|
+
|
|
215
|
+
pid_t child = fork();
|
|
216
|
+
if (child < 0) {
|
|
217
|
+
die("apply-seccomp: fork");
|
|
68
218
|
}
|
|
69
219
|
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
220
|
+
if (child > 0) {
|
|
221
|
+
/* Outer stub: still in bwrap's PID namespace. Forward signals and
|
|
222
|
+
* wait so the caller sees the real exit status. */
|
|
223
|
+
install_forwarders(child);
|
|
73
224
|
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
225
|
+
int status;
|
|
226
|
+
for (;;) {
|
|
227
|
+
pid_t r = waitpid(child, &status, 0);
|
|
228
|
+
if (r < 0 && errno == EINTR) continue;
|
|
229
|
+
if (r < 0) die("apply-seccomp: waitpid");
|
|
230
|
+
break;
|
|
231
|
+
}
|
|
232
|
+
if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
|
|
233
|
+
return WIFEXITED(status) ? WEXITSTATUS(status) : 1;
|
|
234
|
+
}
|
|
79
235
|
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
236
|
+
/* ================================================================
|
|
237
|
+
* Inner init — PID 1 in the nested PID namespace.
|
|
238
|
+
* ================================================================ */
|
|
239
|
+
|
|
240
|
+
/* Block ptrace and /proc/1/mem writes against this process. */
|
|
241
|
+
if (prctl(PR_SET_DUMPABLE, 0) < 0) {
|
|
242
|
+
die("apply-seccomp: prctl(PR_SET_DUMPABLE)");
|
|
84
243
|
}
|
|
85
244
|
|
|
86
|
-
|
|
87
|
-
if (
|
|
88
|
-
|
|
89
|
-
|
|
245
|
+
/* Don't let our /proc mount propagate anywhere. */
|
|
246
|
+
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
|
|
247
|
+
die("apply-seccomp: mount(MS_PRIVATE)");
|
|
248
|
+
}
|
|
249
|
+
if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0) {
|
|
250
|
+
die("apply-seccomp: mount(/proc)");
|
|
90
251
|
}
|
|
91
252
|
|
|
92
|
-
|
|
93
|
-
|
|
253
|
+
/* bwrap --cap-add places CAP_SYS_ADMIN in the ambient set so it survives
|
|
254
|
+
* exec. Clear it now that the mount is done; combined with
|
|
255
|
+
* PR_SET_NO_NEW_PRIVS, the worker's execve drops to zero capabilities. */
|
|
256
|
+
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) < 0) {
|
|
257
|
+
die("apply-seccomp: prctl(PR_CAP_AMBIENT_CLEAR_ALL)");
|
|
258
|
+
}
|
|
259
|
+
|
|
260
|
+
/* Fork the real workload so PID 1 can stay as a non-dumpable reaper. */
|
|
261
|
+
pid_t worker = fork();
|
|
262
|
+
if (worker < 0) {
|
|
263
|
+
die("apply-seccomp: fork(worker)");
|
|
264
|
+
}
|
|
265
|
+
|
|
266
|
+
if (worker > 0) {
|
|
267
|
+
/* Inner init: reap everything, exit with the worker's status.
|
|
268
|
+
* When PID 1 exits the kernel tears down the whole namespace.
|
|
269
|
+
* PID 1 drops signals without handlers, so install forwarders. */
|
|
270
|
+
install_forwarders(worker);
|
|
271
|
+
_exit(reap_until(worker));
|
|
272
|
+
}
|
|
94
273
|
|
|
95
|
-
|
|
96
|
-
|
|
274
|
+
/* ---- Worker (inner PID 2): apply seccomp and exec. ---- */
|
|
275
|
+
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
|
|
276
|
+
die("apply-seccomp: prctl(PR_SET_NO_NEW_PRIVS)");
|
|
277
|
+
}
|
|
278
|
+
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
|
|
279
|
+
die("apply-seccomp: prctl(PR_SET_SECCOMP)");
|
|
280
|
+
}
|
|
281
|
+
|
|
282
|
+
execvp(command_argv[0], command_argv);
|
|
283
|
+
die("apply-seccomp: execvp");
|
|
97
284
|
return 1;
|
|
98
285
|
}
|
|
@@ -27,7 +27,11 @@
|
|
|
27
27
|
* gcc -o seccomp-unix-block seccomp-unix-block.c -lseccomp
|
|
28
28
|
*
|
|
29
29
|
* Usage:
|
|
30
|
-
* ./seccomp-unix-block <output-file>
|
|
30
|
+
* ./seccomp-unix-block <output-file> [arch]
|
|
31
|
+
*
|
|
32
|
+
* If arch is given (x86_64 or aarch64), the filter is generated for that
|
|
33
|
+
* architecture instead of the native one. Lets a single-arch builder emit
|
|
34
|
+
* filters for both x64 and arm64.
|
|
31
35
|
*
|
|
32
36
|
* Dependencies:
|
|
33
37
|
* - libseccomp (libseccomp-dev package on Debian/Ubuntu)
|
|
@@ -48,12 +52,13 @@ int main(int argc, char *argv[]) {
|
|
|
48
52
|
scmp_filter_ctx ctx;
|
|
49
53
|
int rc;
|
|
50
54
|
|
|
51
|
-
if (argc
|
|
52
|
-
fprintf(stderr, "Usage: %s <output-file
|
|
55
|
+
if (argc < 2 || argc > 3) {
|
|
56
|
+
fprintf(stderr, "Usage: %s <output-file> [x86_64|aarch64]\n", argv[0]);
|
|
53
57
|
return 1;
|
|
54
58
|
}
|
|
55
59
|
|
|
56
60
|
const char *output_file = argv[1];
|
|
61
|
+
const char *arch_name = (argc == 3) ? argv[2] : NULL;
|
|
57
62
|
|
|
58
63
|
/* Create seccomp context with default action ALLOW */
|
|
59
64
|
ctx = seccomp_init(SCMP_ACT_ALLOW);
|
|
@@ -62,6 +67,28 @@ int main(int argc, char *argv[]) {
|
|
|
62
67
|
return 1;
|
|
63
68
|
}
|
|
64
69
|
|
|
70
|
+
if (arch_name != NULL) {
|
|
71
|
+
uint32_t target;
|
|
72
|
+
if (strcmp(arch_name, "x86_64") == 0) {
|
|
73
|
+
target = SCMP_ARCH_X86_64;
|
|
74
|
+
} else if (strcmp(arch_name, "aarch64") == 0) {
|
|
75
|
+
target = SCMP_ARCH_AARCH64;
|
|
76
|
+
} else {
|
|
77
|
+
fprintf(stderr, "Error: Unsupported arch '%s'\n", arch_name);
|
|
78
|
+
seccomp_release(ctx);
|
|
79
|
+
return 1;
|
|
80
|
+
}
|
|
81
|
+
if (target != seccomp_arch_native()) {
|
|
82
|
+
rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
|
|
83
|
+
if (rc == 0) rc = seccomp_arch_add(ctx, target);
|
|
84
|
+
if (rc < 0) {
|
|
85
|
+
fprintf(stderr, "Error: Failed to set target arch: %s\n", strerror(-rc));
|
|
86
|
+
seccomp_release(ctx);
|
|
87
|
+
return 1;
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
}
|
|
91
|
+
|
|
65
92
|
/* Add rule to block socket(AF_UNIX, ...) */
|
|
66
93
|
/* socket() syscall signature: int socket(int domain, int type, int protocol) */
|
|
67
94
|
/* arg0 = domain (AF_UNIX = 1) */
|
|
@@ -77,6 +104,26 @@ int main(int argc, char *argv[]) {
|
|
|
77
104
|
return 1;
|
|
78
105
|
}
|
|
79
106
|
|
|
107
|
+
/* Block io_uring entirely. IORING_OP_SOCKET (Linux 5.19+) creates sockets
|
|
108
|
+
* in kernel context without going through the socket() syscall, bypassing
|
|
109
|
+
* the rule above. seccomp cannot inspect io_uring SQEs (they live in a
|
|
110
|
+
* shared-memory ring), so the only safe option is to deny ring creation
|
|
111
|
+
* and use. Blocking all three syscalls also covers the case of an
|
|
112
|
+
* inherited ring fd. */
|
|
113
|
+
int io_uring_calls[] = {
|
|
114
|
+
SCMP_SYS(io_uring_setup),
|
|
115
|
+
SCMP_SYS(io_uring_enter),
|
|
116
|
+
SCMP_SYS(io_uring_register),
|
|
117
|
+
};
|
|
118
|
+
for (size_t i = 0; i < sizeof(io_uring_calls) / sizeof(io_uring_calls[0]); i++) {
|
|
119
|
+
rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), io_uring_calls[i], 0);
|
|
120
|
+
if (rc < 0) {
|
|
121
|
+
fprintf(stderr, "Error: Failed to add io_uring rule: %s\n", strerror(-rc));
|
|
122
|
+
seccomp_release(ctx);
|
|
123
|
+
return 1;
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
|
|
80
127
|
/* Export the filter to a file */
|
|
81
128
|
int fd = open(output_file, O_CREAT | O_WRONLY | O_TRUNC, 0600);
|
|
82
129
|
if (fd < 0) {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sysid/sandbox-runtime-improved",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.45-sysid.2",
|
|
4
4
|
"description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
"clean": "rm -rf dist",
|
|
19
19
|
"test": "bun test",
|
|
20
20
|
"test:unit": "bun test test/config-validation.test.ts test/sandbox/seccomp-filter.test.ts",
|
|
21
|
-
"test:integration": "bun test test/sandbox/integration.test.ts",
|
|
21
|
+
"test:integration": "bun test test/sandbox/integration.test.ts test/sandbox/allow-read.test.ts test/sandbox/wrap-with-sandbox.test.ts",
|
|
22
22
|
"typecheck": "tsc --noEmit",
|
|
23
23
|
"lint": "eslint 'src/**/*.ts' --fix --cache --cache-location=node_modules/.cache/.eslintcache",
|
|
24
24
|
"lint:check": "eslint 'src/**/*.ts' --cache --cache-location=node_modules/.cache/.eslintcache",
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|