@sysid/sandbox-runtime-improved 0.0.43-sysid.6 → 0.0.49-sysid.1

package/dist/sandbox/linux-sandbox-utils.js

@@ -8,7 +8,7 @@ import { tmpdir } from 'node:os';
 import path, { join } from 'node:path';
 import { ripGrep } from '../utils/ripgrep.js';
 import { generateProxyEnvVars, normalizePathForSandbox, normalizeCaseForComparison, isSymlinkOutsideBoundary, DANGEROUS_FILES, getDangerousDirectories, } from './sandbox-utils.js';
-import { generateSeccompFilter, cleanupSeccompFilter, getPreGeneratedBpfPath, getApplySeccompBinaryPath, } from './generate-seccomp-filter.js';
+import { getApplySeccompBinaryPath } from './generate-seccomp-filter.js';
 /** Default max depth for searching dangerous files */
 const DEFAULT_MANDATORY_DENY_SEARCH_DEPTH = 3;
 /**
@@ -199,31 +199,27 @@ async function linuxGetMandatoryDenyPaths(ripgrepConfig = { command: 'rg' }, max
     }
     return [...new Set(denyPaths)];
 }
-// Track generated seccomp filters for cleanup on process exit
-const generatedSeccompFilters = new Set();
 // Track mount points created by bwrap for non-existent deny paths.
 // When bwrap does --ro-bind /dev/null /nonexistent/path, it creates an empty
 // file on the host as a mount point. These persist after bwrap exits and must
 // be cleaned up explicitly.
 const bwrapMountPoints = new Set();
+// Number of wrapped commands that have been generated but whose cleanup has
+// not yet run. cleanupBwrapMountPoints() defers file deletion while this is
+// positive, because deleting a mount point file on the host while another
+// bwrap instance is still running detaches that instance's bind mount and
+// the deny rule stops applying inside it.
+let activeSandboxCount = 0;
 let exitHandlerRegistered = false;
 /**
- * Register cleanup handler for generated seccomp filters and bwrap mount points
+ * Register cleanup handler for bwrap mount points
  */
 function registerExitCleanupHandler() {
     if (exitHandlerRegistered) {
         return;
     }
     process.on('exit', () => {
-        for (const filterPath of generatedSeccompFilters) {
-            try {
-                cleanupSeccompFilter(filterPath);
-            }
-            catch {
-                // Ignore cleanup errors during exit
-            }
-        }
-        cleanupBwrapMountPoints();
+        cleanupBwrapMountPoints({ force: true });
     });
     exitHandlerRegistered = true;
 }
@@ -238,10 +234,29 @@ function registerExitCleanupHandler() {
  * ghost dotfiles (e.g. .bashrc, .gitconfig) from appearing in the working
  * directory. It is also called automatically on process exit as a safety net.
  *
- * Safe to call at any time — it only removes files that were tracked during
- * generateFilesystemArgs() and skips any that no longer exist.
+ * Each call decrements the active-sandbox counter that was incremented by
+ * wrapCommandWithSandboxLinux(). File deletion is deferred until the counter
+ * reaches zero. Deleting a mount point file on the host while another bwrap
+ * instance is still running detaches that instance's bind mount (the dentry
+ * is unhashed, so path lookup no longer finds the mount) and the deny rule
+ * stops applying inside that sandbox.
+ *
+ * Pass `{ force: true }` to delete unconditionally — used by the process-exit
+ * handler and reset() where deferral is not meaningful.
  */
-export function cleanupBwrapMountPoints() {
+export function cleanupBwrapMountPoints(opts) {
+    if (!opts?.force) {
+        if (activeSandboxCount > 0) {
+            activeSandboxCount--;
+        }
+        if (activeSandboxCount > 0) {
+            logForDebugging(`[Sandbox Linux] Deferring mount point cleanup — ${activeSandboxCount} sandbox(es) still active`);
+            return;
+        }
+    }
+    else {
+        activeSandboxCount = 0;
+    }
     for (const mountPoint of bwrapMountPoints) {
         try {
             // Only remove if it's still the empty file/directory bwrap created.
@@ -271,11 +286,14 @@ export function cleanupBwrapMountPoints() {
  * Get detailed status of Linux sandbox dependencies
  */
 export function getLinuxDependencyStatus(seccompConfig) {
+    // argv0 mode: apply-seccomp is compiled into the caller's binary — skip
+    // the on-disk lookup and trust that applyPath resolves inside bwrap.
     return {
         hasBwrap: whichSync('bwrap') !== null,
         hasSocat: whichSync('socat') !== null,
-        hasSeccompBpf: getPreGeneratedBpfPath(seccompConfig?.bpfPath) !== null,
-        hasSeccompApply: getApplySeccompBinaryPath(seccompConfig?.applyPath) !== null,
+        hasSeccompApply: seccompConfig?.argv0
+            ? true
+            : getApplySeccompBinaryPath(seccompConfig?.applyPath) !== null,
     };
 }
 /**
@@ -288,9 +306,8 @@ export function checkLinuxDependencies(seccompConfig) {
         errors.push('bubblewrap (bwrap) not installed');
     if (whichSync('socat') === null)
         errors.push('socat not installed');
-    const hasBpf = getPreGeneratedBpfPath(seccompConfig?.bpfPath) !== null;
-    const hasApply = getApplySeccompBinaryPath(seccompConfig?.applyPath) !== null;
-    if (!hasBpf || !hasApply) {
+    if (!seccompConfig?.argv0 &&
+        getApplySeccompBinaryPath(seccompConfig?.applyPath) === null) {
         warnings.push('seccomp not available - unix socket access not restricted');
     }
     return { warnings, errors };
@@ -424,11 +441,32 @@ export async function initializeLinuxNetworkBridge(httpProxyPort, socksProxyPort
         socksProxyPort,
     };
 }
+/**
+ * Resolve how to invoke apply-seccomp: either a standalone binary path, or a
+ * multicall-binary prefix that dispatches on the ARGV0 env var.
+ *
+ * Returns a shell-ready string ending in a trailing space — callers append
+ * shellquote.quote([shell, '-c', cmd]). Returns undefined when seccomp is
+ * unavailable (no argv0, no binary found).
+ *
+ * When argv0 is set, applyPath is used verbatim (no existence check); the
+ * caller is responsible for ensuring it resolves inside the bwrap namespace.
+ */
+function resolveApplySeccompPrefix(applyPath, argv0) {
+    if (argv0) {
+        if (!applyPath) {
+            throw new Error('seccompConfig.argv0 requires seccompConfig.applyPath');
+        }
+        return `ARGV0=${shellquote.quote([argv0])} ${shellquote.quote([applyPath])} `;
+    }
+    const binary = getApplySeccompBinaryPath(applyPath);
+    return binary ? `${shellquote.quote([binary])} ` : undefined;
+}
 /**
  * Build the command that runs inside the sandbox.
  * Sets up HTTP proxy on port 3128 and SOCKS proxy on port 1080
  */
-function buildSandboxCommand(httpSocketPath, socksSocketPath, userCommand, seccompFilterPath, shell, applySeccompPath) {
+function buildSandboxCommand(httpSocketPath, socksSocketPath, userCommand, applySeccompPrefix, shell) {
     // Default to bash for backward compatibility
     const shellPath = shell || 'bash';
     const socatCommands = [
@@ -436,36 +474,13 @@ function buildSandboxCommand(httpSocketPath, socksSocketPath, userCommand, secco
         `socat TCP-LISTEN:1080,fork,reuseaddr UNIX-CONNECT:${socksSocketPath} >/dev/null 2>&1 &`,
         'trap "kill %1 %2 2>/dev/null; exit" EXIT',
     ];
-    // If seccomp filter is provided, use apply-seccomp to apply it
-    if (seccompFilterPath) {
-        // apply-seccomp approach:
-        // 1. Outer bwrap/bash: starts socat processes (can use Unix sockets)
-        // 2. apply-seccomp: applies seccomp filter and execs user command
-        // 3. User command runs with seccomp active (Unix sockets blocked)
-        //
-        // apply-seccomp is a simple C program that:
-        // - Sets PR_SET_NO_NEW_PRIVS
-        // - Applies the seccomp BPF filter via prctl(PR_SET_SECCOMP)
-        // - Execs the user command
-        //
-        // This is simpler and more portable than nested bwrap, with no FD redirects needed.
-        const applySeccompBinary = getApplySeccompBinaryPath(applySeccompPath);
-        if (!applySeccompBinary) {
-            throw new Error('apply-seccomp binary not found. This should have been caught earlier. ' +
-                'Ensure vendor/seccomp/{x64,arm64}/apply-seccomp binaries are included in the package.');
-        }
-        const applySeccompCmd = shellquote.quote([
-            applySeccompBinary,
-            seccompFilterPath,
-            shellPath,
-            '-c',
-            userCommand,
-        ]);
+    // apply-seccomp runs after socat so socat can still create Unix sockets.
+    if (applySeccompPrefix) {
+        const applySeccompCmd = applySeccompPrefix + shellquote.quote([shellPath, '-c', userCommand]);
         const innerScript = [...socatCommands, applySeccompCmd].join('\n');
         return `${shellPath} -c ${shellquote.quote([innerScript])}`;
     }
     else {
-        // No seccomp filter - run user command directly
         const innerScript = [
             ...socatCommands,
             `eval ${shellquote.quote([userCommand])}`,
@@ -479,12 +494,16 @@ function buildSandboxCommand(httpSocketPath, socksSocketPath, userCommand, secco
 async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = { command: 'rg' }, mandatoryDenySearchDepth = DEFAULT_MANDATORY_DENY_SEARCH_DEPTH, allowGitConfig = false, abortSignal) {
     const args = [];
     // fs already imported
+    // Collect normalized allowed write paths. Populated in the writeConfig
+    // block, read again in the denyRead loop to re-bind writes under tmpfs.
+    const allowedWritePaths = [];
+    // denyWrite binds are buffered and emitted after denyRead processing so that
+    // a denyRead tmpfs over an ancestor directory doesn't wipe them out.
+    const denyWriteArgs = [];
     // Determine initial root mount based on write restrictions
     if (writeConfig) {
         // Write restrictions: Start with read-only root, then allow writes to specific paths
         args.push('--ro-bind', '/', '/');
-        // Collect normalized allowed write paths for later checking
-        const allowedWritePaths = [];
         // Allow writes to specific paths
         for (const pathPattern of writeConfig.allowOnly || []) {
             const normalizedPath = normalizePathForSandbox(pathPattern);
@@ -526,8 +545,16 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
             ...(writeConfig.denyWithinAllow || []),
             ...(await linuxGetMandatoryDenyPaths(ripgrepConfig, mandatoryDenySearchDepth, allowGitConfig, abortSignal)),
         ];
+        // Dedup post-normalization: entries like ['~/.foo', '/home/user/.foo']
+        // converge to the same path here. A duplicate --ro-bind /dev/null <dest>
+        // hits a char device on the second pass and bwrap's ensure_file() falls
+        // through to creat() on a read-only mount.
+        const seenDenyWrite = new Set();
         for (const pathPattern of denyPaths) {
             const normalizedPath = normalizePathForSandbox(pathPattern);
+            if (seenDenyWrite.has(normalizedPath))
+                continue;
+            seenDenyWrite.add(normalizedPath);
             // Skip /dev/* paths since --dev /dev already handles them
             if (normalizedPath.startsWith('/dev/')) {
                 continue;
@@ -538,7 +565,7 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
             // symlink and creates real .claude/settings.json with malicious hooks.
             const symlinkInPath = findSymlinkInPath(normalizedPath, allowedWritePaths);
             if (symlinkInPath) {
-                args.push('--ro-bind', '/dev/null', symlinkInPath);
+                denyWriteArgs.push('--ro-bind', '/dev/null', symlinkInPath);
                 logForDebugging(`[Sandbox Linux] Mounted /dev/null at symlink ${symlinkInPath} to prevent symlink replacement attack`);
                 continue;
             }
@@ -576,13 +603,13 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
                     // which breaks tools that expect to traverse it as a directory.
                     if (firstNonExistent !== normalizedPath) {
                         const emptyDir = fs.mkdtempSync(path.join(tmpdir(), 'claude-empty-'));
-                        args.push('--ro-bind', emptyDir, firstNonExistent);
+                        denyWriteArgs.push('--ro-bind', emptyDir, firstNonExistent);
                         bwrapMountPoints.add(firstNonExistent);
                         registerExitCleanupHandler();
                         logForDebugging(`[Sandbox Linux] Mounted empty dir at ${firstNonExistent} to block creation of ${normalizedPath}`);
                     }
                     else {
-                        args.push('--ro-bind', '/dev/null', firstNonExistent);
+                        denyWriteArgs.push('--ro-bind', '/dev/null', firstNonExistent);
                         bwrapMountPoints.add(firstNonExistent);
                         registerExitCleanupHandler();
                         logForDebugging(`[Sandbox Linux] Mounted /dev/null at ${firstNonExistent} to block creation of ${normalizedPath}`);
@@ -598,7 +625,7 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
             const isWithinAllowedPath = allowedWritePaths.some(allowedPath => normalizedPath.startsWith(allowedPath + '/') ||
                 normalizedPath === allowedPath);
             if (isWithinAllowedPath) {
-                args.push('--ro-bind', normalizedPath, normalizedPath);
+                denyWriteArgs.push('--ro-bind', normalizedPath, normalizedPath);
             }
             else {
                 logForDebugging(`[Sandbox Linux] Skipping deny path not within allowed paths: ${normalizedPath}`);
@@ -609,34 +636,75 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
         // No write restrictions: Allow all writes
         args.push('--bind', '/', '/');
     }
+    // denyWriteArgs is emitted after the denyRead loop below.
     // Handle read restrictions by mounting tmpfs over denied paths
-    const readDenyPaths = [...(readConfig?.denyOnly || [])];
+    const readDenyPaths = [];
     const readAllowPaths = (readConfig?.allowWithinDeny || []).map(p => normalizePathForSandbox(p));
+    // Files masked by --ro-bind /dev/null below. Used to filter denyWriteArgs so
+    // that --ro-bind <host> <host> doesn't undo the mask.
+    const maskedFiles = new Set();
+    // --tmpfs / would wipe all prior mounts (ro-bind /, write binds, deny binds).
+    // Expand a root deny into its direct children so the existing per-dir tmpfs
+    // + re-bind logic applies. Skip /proc and /dev: they're remounted by the
+    // caller after this function returns. Skip /sys: kernel interface, tmpfs
+    // over it breaks tooling and the host /sys is already read-only via ro-bind.
+    const rootSkip = new Set(['proc', 'dev', 'sys']);
+    for (const p of readConfig?.denyOnly || []) {
+        if (normalizePathForSandbox(p) === '/') {
+            for (const child of fs.readdirSync('/')) {
+                if (!rootSkip.has(child))
+                    readDenyPaths.push('/' + child);
+            }
+        }
+        else {
+            readDenyPaths.push(p);
+        }
+    }
     // Always hide /etc/ssh/ssh_config.d to avoid permission issues with OrbStack
     // SSH is very strict about config file permissions and ownership, and they can
     // appear wrong inside the sandbox causing "Bad owner or permissions" errors
     if (fs.existsSync('/etc/ssh/ssh_config.d')) {
         readDenyPaths.push('/etc/ssh/ssh_config.d');
     }
-    for (const pathPattern of readDenyPaths) {
-        const normalizedPath = normalizePathForSandbox(pathPattern);
+    // Normalize then sort shallow-first so tmpfs over ancestor dirs lands before
+    // /dev/null masks on descendant files. Otherwise a file-deny listed before
+    // a dir-deny in denyRead gets wiped when the ancestor tmpfs is applied.
+    const normalizedDenyPaths = readDenyPaths
+        .map(p => normalizePathForSandbox(p))
+        .sort((a, b) => a.split('/').length - b.split('/').length);
+    for (const normalizedPath of normalizedDenyPaths) {
         if (!fs.existsSync(normalizedPath)) {
             logForDebugging(`[Sandbox Linux] Skipping non-existent read deny path: ${normalizedPath}`);
             continue;
         }
+        const denySep = normalizedPath === '/' ? '/' : normalizedPath + '/';
         const readDenyStat = fs.statSync(normalizedPath);
         if (readDenyStat.isDirectory()) {
             args.push('--tmpfs', normalizedPath);
+            // tmpfs wiped any earlier write binds under this path — restore them.
+            for (const writePath of allowedWritePaths) {
+                if (writePath.startsWith(denySep) || writePath === normalizedPath) {
+                    args.push('--bind', writePath, writePath);
+                    logForDebugging(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${writePath}`);
+                }
+            }
             // Re-allow specific paths within the denied directory (allowRead overrides denyRead).
             // After mounting tmpfs over the denied dir, bind back the allowed subdirectories
             // so they are readable again.
             for (const allowPath of readAllowPaths) {
-                if (allowPath.startsWith(normalizedPath + '/') ||
-                    allowPath === normalizedPath) {
+                if (allowPath.startsWith(denySep) || allowPath === normalizedPath) {
                     if (!fs.existsSync(allowPath)) {
                         logForDebugging(`[Sandbox Linux] Skipping non-existent read allow path: ${allowPath}`);
                         continue;
                     }
+                    // Skip only if a write path was re-bound just above AND covers
+                    // allowPath. A write path that's an ancestor of the deny dir isn't
+                    // re-bound (it wasn't wiped), so allowPath under it still needs
+                    // its own ro-bind here.
+                    if (allowedWritePaths.some(w => (w.startsWith(denySep) || w === normalizedPath) &&
+                        (allowPath === w || allowPath.startsWith(w + '/')))) {
+                        continue;
+                    }
                     // Bind the allowed path back over the tmpfs so it's readable
                     args.push('--ro-bind', allowPath, allowPath);
                     logForDebugging(`[Sandbox Linux] Re-allowed read access within denied region: ${allowPath}`);
@@ -644,17 +712,30 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
             }
         }
         else {
-            // For files, check if this specific file is re-allowed
-            const isReAllowed = readAllowPaths.some(allowPath => normalizedPath === allowPath ||
-                normalizedPath.startsWith(allowPath + '/'));
-            if (isReAllowed) {
+            // For files, only an exact allowRead match overrides the deny. A
+            // directory allowRead does not un-deny a file specifically listed in
+            // denyRead — otherwise denyRead: ['.env'] + allowRead: ['.'] silently
+            // drops the .env deny.
+            if (readAllowPaths.includes(normalizedPath)) {
                 logForDebugging(`[Sandbox Linux] Skipping read deny for re-allowed path: ${normalizedPath}`);
                 continue;
             }
             // For files, bind /dev/null instead of tmpfs
             args.push('--ro-bind', '/dev/null', normalizedPath);
+            maskedFiles.add(normalizedPath);
         }
     }
+    // Emitting denyWrite last means these ro-binds layer on top of any write
+    // paths the denyRead loop just re-bound. Before this ordering, tmpfs over
+    // an ancestor of cwd would wipe the .git/hooks protection. But skip any
+    // dest already masked by denyRead — --ro-bind <host> <host> for denyWrite
+    // would undo --ro-bind /dev/null <host> from denyRead, which landed first.
+    for (let i = 0; i < denyWriteArgs.length; i += 3) {
+        const dest = denyWriteArgs[i + 2];
+        if (maskedFiles.has(dest))
+            continue;
+        args.push(denyWriteArgs[i], denyWriteArgs[i + 1], dest);
+    }
     return args;
 }
 /**
@@ -670,10 +751,12 @@ async function generateFilesystemArgs(readConfig, writeConfig, ripgrepConfig = {
  *   - Filesystem restrictions are applied (read-only mounts, bind mounts, etc.)
  *   - Socat processes start and connect to Unix socket bridges (can use socket(AF_UNIX, ...))
  *
- * Stage 2: apply-seccomp - Seccomp filter application (ONLY seccomp)
- *   - apply-seccomp binary applies seccomp filter via prctl(PR_SET_SECCOMP)
- *   - Sets PR_SET_NO_NEW_PRIVS to allow seccomp without root
+ * Stage 2: apply-seccomp - Nested PID namespace + seccomp filter
+ *   - apply-seccomp creates a nested user+PID+mount namespace and remounts /proc
+ *   - Inside, apply-seccomp becomes PID 1 (non-dumpable init/reaper)
+ *   - Forks, sets PR_SET_NO_NEW_PRIVS, applies seccomp via prctl(PR_SET_SECCOMP)
  *   - Execs user command with seccomp active (cannot create new Unix sockets)
+ *   - User command cannot see or ptrace bwrap/bash/socat (separate PID namespace)
  *
  * This solves the conflict between:
  * - Security: Blocking arbitrary Unix socket creation in user commands
@@ -716,33 +799,27 @@ export async function wrapCommandWithSandboxLinux(params) {
         !hasWriteRestrictions) {
         return command;
     }
+    // Mark this sandbox invocation as active. cleanupBwrapMountPoints() will
+    // defer file deletion until this (and every other concurrent) invocation
+    // has been cleaned up. The matching decrement happens in
+    // cleanupBwrapMountPoints(), which the caller must invoke after the
+    // spawned command exits. If wrapping fails below, the catch block
+    // decrements so the count does not leak.
+    activeSandboxCount++;
     const bwrapArgs = ['--new-session', '--die-with-parent'];
-    let seccompFilterPath = undefined;
+    let applySeccompPrefix;
     try {
         // ========== SECCOMP FILTER (Unix Socket Blocking) ==========
-        // Use bwrap's --seccomp flag to apply BPF filter that blocks Unix socket creation
-        //
-        // NOTE: Seccomp filtering is only enabled when allowAllUnixSockets is false
-        // (when true, Unix sockets are allowed)
+        // apply-seccomp wraps the workload and applies the baked-in BPF filter
+        // that blocks socket(AF_UNIX, ...). Skipped when allowAllUnixSockets is true.
         if (!allowAllUnixSockets) {
-            seccompFilterPath =
-                generateSeccompFilter(seccompConfig?.bpfPath) ?? undefined;
-            const applySeccompBinary = getApplySeccompBinaryPath(seccompConfig?.applyPath);
-            if (!seccompFilterPath || !applySeccompBinary) {
-                // Seccomp binaries not found - warn but continue without unix socket blocking
-                logForDebugging('[Sandbox Linux] Seccomp binaries not available - unix socket blocking disabled. ' +
+            applySeccompPrefix = resolveApplySeccompPrefix(seccompConfig?.applyPath, seccompConfig?.argv0);
+            if (!applySeccompPrefix) {
+                logForDebugging('[Sandbox Linux] apply-seccomp binary not available - unix socket blocking disabled. ' +
                     'Install @anthropic-ai/sandbox-runtime globally for full protection.', { level: 'warn' });
-                // Clear the filter path so we don't try to use it
-                seccompFilterPath = undefined;
             }
             else {
-                // Track filter for cleanup and register exit handler
-                // Only track runtime-generated filters (not pre-generated ones from vendor/)
-                if (!seccompFilterPath.includes('/vendor/seccomp/')) {
-                    generatedSeccompFilters.add(seccompFilterPath);
-                    registerExitCleanupHandler();
-                }
-                logForDebugging('[Sandbox Linux] Generated seccomp BPF filter for Unix socket blocking');
+                logForDebugging('[Sandbox Linux] Applying seccomp filter for Unix socket blocking');
             }
         }
         else {
@@ -808,6 +885,22 @@ export async function wrapCommandWithSandboxLinux(params) {
             // Mount fresh /proc if PID namespace is isolated (secure mode)
             bwrapArgs.push('--proc', '/proc');
         }
+        else {
+            // --unshare-user: bwrap only auto-adds this when EUID != 0. In an
+            // unprivileged container (Docker's default: EUID=0 without
+            // CAP_SYS_ADMIN), bwrap assumes it has caps, tries direct clone,
+            // and EPERMs. Force the userns path so bwrap starts at all.
+            //
+            // --bind /proc /proc: apply-seccomp's nested-userns path writes
+            // /proc/self/setgroups and uid_map. Without --proc above, the
+            // --ro-bind / / leaves /proc read-only and those writes EROFS.
+            bwrapArgs.push('--unshare-user', '--bind', '/proc', '/proc');
+        }
+        // apply-seccomp obtains CAP_SYS_ADMIN for its nested PID+mount unshare
+        // by creating a nested user namespace. This requires the host to permit
+        // capability-bearing unprivileged user namespaces (the same requirement
+        // bwrap itself has when not installed setuid). See README for the
+        // Ubuntu 24.04 sysctl if AppArmor restricts this.
         // ========== COMMAND ==========
         // Use the user's shell (zsh, bash, etc.) to ensure aliases/snapshots work
         // Resolve the full path to the shell binary since bwrap doesn't use $PATH
@@ -817,58 +910,37 @@ export async function wrapCommandWithSandboxLinux(params) {
             throw new Error(`Shell '${shellName}' not found in PATH`);
         }
         bwrapArgs.push('--', shell, '-c');
-        // If we have network restrictions, use the network bridge setup with apply-seccomp for seccomp
-        // Otherwise, just run the command directly with apply-seccomp if needed
+        // With network restrictions, route the command through buildSandboxCommand
+        // so socat starts before seccomp is applied. Otherwise invoke apply-seccomp
+        // directly if we have a binary.
         if (needsNetworkRestriction && httpSocketPath && socksSocketPath) {
-            // Pass seccomp filter to buildSandboxCommand for apply-seccomp application
-            // This allows socat to start before seccomp is applied
-            const sandboxCommand = buildSandboxCommand(httpSocketPath, socksSocketPath, command, seccompFilterPath, shell, seccompConfig?.applyPath);
+            const sandboxCommand = buildSandboxCommand(httpSocketPath, socksSocketPath, command, applySeccompPrefix, shell);
             bwrapArgs.push(sandboxCommand);
         }
-        else if (seccompFilterPath) {
-            // No network restrictions but we have seccomp - use apply-seccomp directly
-            // apply-seccomp is a simple C program that applies the seccomp filter and execs the command
-            const applySeccompBinary = getApplySeccompBinaryPath(seccompConfig?.applyPath);
-            if (!applySeccompBinary) {
-                throw new Error('apply-seccomp binary not found. This should have been caught earlier. ' +
-                    'Ensure vendor/seccomp/{x64,arm64}/apply-seccomp binaries are included in the package.');
-            }
-            const applySeccompCmd = shellquote.quote([
-                applySeccompBinary,
-                seccompFilterPath,
-                shell,
-                '-c',
-                command,
-            ]);
+        else if (applySeccompPrefix) {
+            const applySeccompCmd = applySeccompPrefix + shellquote.quote([shell, '-c', command]);
             bwrapArgs.push(applySeccompCmd);
         }
         else {
             bwrapArgs.push(command);
         }
-        // Build the outer bwrap command
         const wrappedCommand = shellquote.quote(['bwrap', ...bwrapArgs]);
         const restrictions = [];
         if (needsNetworkRestriction)
             restrictions.push('network');
         if (hasReadRestrictions || hasWriteRestrictions)
             restrictions.push('filesystem');
-        if (seccompFilterPath)
+        if (applySeccompPrefix)
             restrictions.push('seccomp(unix-block)');
         logForDebugging(`[Sandbox Linux] Wrapped command with bwrap (${restrictions.join(', ')} restrictions)`);
         return wrappedCommand;
     }
     catch (error) {
-        // Clean up seccomp filter on error
-        if (seccompFilterPath && !seccompFilterPath.includes('/vendor/seccomp/')) {
-            generatedSeccompFilters.delete(seccompFilterPath);
-            try {
-                cleanupSeccompFilter(seccompFilterPath);
-            }
-            catch (cleanupError) {
-                logForDebugging(`[Sandbox Linux] Failed to clean up seccomp filter on error: ${cleanupError}`, { level: 'error' });
-            }
+        // Undo the activeSandboxCount increment — the caller won't call
+        // cleanupBwrapMountPoints() for a wrap that threw.
+        if (activeSandboxCount > 0) {
+            activeSandboxCount--;
         }
-        // Re-throw the original error
         throw error;
     }
 }

package/dist/sandbox/linux-sandbox-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"linux-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,eAAe,EACf,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAK3B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAA;AAkCrC,sDAAsD;AACtD,MAAM,mCAAmC,GAAG,CAAC,CAAA;AAE7C;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,iBAA2B;IAE3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAE9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACpC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,WAAW,CACrE,CAAA;gBACD,IAAI,mBAAmB,EAAE,CAAC;oBACxB,OAAO,QAAQ,CAAA;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;YAC7C,MAAK;QACP,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;YACrC,MAAK;QACP,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B,CAAC,UAAkB;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,UAAU,CAAA,CAAC,2CAA2C;AAC/D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,WAAmB,mCAAmC,EACtD,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,sDAAsD;IACtD,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAA;IACvD,MAAM,oBAAoB,GAAG,uBAAuB,EAAE,CAAA;IAEtD,uEAAuE;IACvE,MAAM,SAAS,GAAG;QAChB,yBAAyB;QACzB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,+BAA+B;QAC/B,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;KACvD,CAAA;IAED,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,+BAA+B;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,CAAC;QACH,iBAAiB,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,wCAAwC;QACxC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;QAE/C,mEAAmE;QACnE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACrC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,2CAA2C;IAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAE7C,mDAAmD;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC7C,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CACrB;YACE,SAAS;YACT,UAAU;YACV,aAAa;YACb,MAAM,CAAC,QAAQ,CAAC;YAChB,GAAG,SAAS;YACZ,IAAI;YACJ,qBAAqB;SACtB,EACD,GAAG,EACH,MAAM,EACN,aAAa,CACd,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE7C,8DAA8D;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CACjC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,iBAAiB,CACzD,CAAA;YACD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,6DAA6D;gBAC7D,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;wBACjC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;oBAC5C,CAAC;yBAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBACzC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChE,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAK;YACP,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,uBAAuB,GAAgB,IAAI,GAAG,EAAE,CAAA;AAEtD,mEAAmE;AACnE,6EAA6E;AAC7E,8EAA8E;AAC9E,4BAA4B;AAC5B,MAAM,gBAAgB,GAAgB,IAAI,GAAG,EAAE,CAAA;AAE/C,IAAI,qBAAqB,GAAG,KAAK,CAAA;AAEjC;;GAEG;AACH,SAAS,0BAA0B;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAM;IACR,CAAC;IAED,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,UAAU,IAAI,uBAAuB,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,oBAAoB,CAAC,UAAU,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;QACD,uBAAuB,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,qBAAqB,GAAG,IAAI,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB;IACrC,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,oEAAoE;YACpE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;YACpC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBACzB,eAAe,CACb,wDAAwD,UAAU,EAAE,CACrE,CAAA;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,kDAAkD;gBAClD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;gBAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;oBACxB,eAAe,CACb,uDAAuD,UAAU,EAAE,CACpE,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,KAAK,EAAE,CAAA;AAC1B,CAAC;AAoBD;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,aAGxC;IACC,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,aAAa,EAAE,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI;QACtE,eAAe,EACb,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI;KAC/D,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAGtC;IACC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QAC7B,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACjD,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAEnE,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACtE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI,CAAA;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,QAAQ,OAAO,CAAC,CAAA;IACrE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,QAAQ,OAAO,CAAC,CAAA;IAEvE,oBAAoB;IACpB,MAAM,aAAa,GAAG;QACpB,eAAe,cAAc,iBAAiB;QAC9C,iBAAiB,aAAa,8CAA8C;KAC7E,CAAA;IAED,eAAe,CAAC,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEzE,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE;QACtD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QAClC,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC5C,eAAe,CACb,wCAAwC,IAAI,YAAY,MAAM,EAAE,EAChE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,qBAAqB;IACrB,MAAM,cAAc,GAAG;QACrB,eAAe,eAAe,iBAAiB;QAC/C,iBAAiB,cAAc,8CAA8C;KAC9E,CAAA;IAED,eAAe,CAAC,gCAAgC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE3E,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE;QACxD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;QAC5B,uBAAuB;QACvB,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IAED,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACnC,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IACF,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC7C,eAAe,CACb,yCAAyC,IAAI,YAAY,MAAM,EAAE,EACjE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,oCAAoC;IACpC,MAAM,WAAW,GAAG,CAAC,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IACE,CAAC,iBAAiB,CAAC,GAAG;YACtB,iBAAiB,CAAC,MAAM;YACxB,CAAC,kBAAkB,CAAC,GAAG;YACvB,kBAAkB,CAAC,MAAM,EACzB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,sBAAsB;YACtB,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpE,eAAe,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBAC9D,MAAK;YACP,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,mCAAmC,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE;gBACnE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;YAC1B,0BAA0B;YAC1B,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,WAAW,WAAW,CAChE,CAAA;QACH,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,aAAa;QACb,cAAc;KACf,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,cAAsB,EACtB,eAAuB,EACvB,WAAmB,EACnB,iBAAqC,EACrC,KAAc,EACd,gBAAyB;IAEzB,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,CAAA;IACjC,MAAM,aAAa,GAAG;QACpB,qDAAqD,cAAc,oBAAoB;QACvF,qDAAqD,eAAe,oBAAoB;QACxF,0CAA0C;KAC3C,CAAA;IAED,+DAA+D;IAC/D,IAAI,iBAAiB,EAAE,CAAC;QACtB,0BAA0B;QAC1B,qEAAqE;QACrE,kEAAkE;QAClE,kEAAkE;QAClE,EAAE;QACF,4CAA4C;QAC5C,6BAA6B;QAC7B,6DAA6D;QAC7D,2BAA2B;QAC3B,EAAE;QACF,oFAAoF;QACpF,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAA;QACtE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,uFAAuF,CAC1F,CAAA;QACH,CAAC;QAED,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;YACvC,kBAAkB;YAClB,iBAAiB;YACjB,SAAS;YACT,IAAI;YACJ,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,CAAC,GAAG,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;SAAM,CAAC;QACN,gDAAgD;QAChD,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,QAAQ,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;SAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,UAA+C,EAC/C,WAAiD,EACjD,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,2BAAmC,mCAAmC,EACtE,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,sBAAsB;IAEtB,2DAA2D;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,qFAAqF;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAEhC,4DAA4D;QAC5D,MAAM,iBAAiB,GAAa,EAAE,CAAA;QAEtC,iCAAiC;QACjC,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE3D,eAAe,CACb,0CAA0C,WAAW,OAAO,cAAc,EAAE,CAC7E,CAAA;YAED,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,uCAAuC,cAAc,EAAE,CAAC,CAAA;gBACxE,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,eAAe,CACb,qDAAqD,cAAc,EAAE,CACtE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,kEAAkE;YAClE,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;gBACpD,qEAAqE;gBACrE,uEAAuE;gBACvE,gEAAgE;gBAChE,MAAM,uBAAuB,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;gBAClE,IACE,YAAY,KAAK,uBAAuB;oBACxC,wBAAwB,CAAC,cAAc,EAAE,YAAY,CAAC,EACtD,CAAC;oBACD,eAAe,CACb,mFAAmF,WAAW,OAAO,YAAY,EAAE,CACpH,CAAA;oBACD,SAAQ;gBACV,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,eAAe,CACb,mEAAmE,cAAc,EAAE,CACpF,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACnD,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACxC,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG;YAChB,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,0BAA0B,CAClC,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAC;SACH,CAAA;QAED,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE3D,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,SAAQ;YACV,CAAC;YAED,yEAAyE;YACzE,gEAAgE;YAChE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,aAAa,GAAG,iBAAiB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;YAC1E,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;gBAClD,eAAe,CACb,gDAAgD,aAAa,wCAAwC,CACtG,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,yEAAyE;YACzE,uDAAuD;YACvD,EAAE;YACF,yEAAyE;YACzE,qEAAqE;YACrE,uCAAuC;YACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,oEAAoE;gBACpE,kEAAkE;gBAClE,oEAAoE;gBACpE,sCAAsC;gBACtC,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,CAAC;oBACpC,eAAe,CACb,6FAA6F,cAAc,EAAE,CAC9G,CAAA;oBACD,SAAQ;gBACV,CAAC;gBAED,+CAA+C;gBAC/C,IAAI,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;gBAC/C,OAAO,YAAY,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5D,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC3C,CAAC;gBAED,yEAAyE;gBACzE,4DAA4D;gBAC5D,MAAM,2BAA2B,GAAG,iBAAiB,CAAC,IAAI,CACxD,WAAW,CAAC,EAAE,CACZ,YAAY,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;oBAC1C,YAAY,KAAK,WAAW;oBAC5B,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAC/C,CAAA;gBAED,IAAI,2BAA2B,EAAE,CAAC;oBAChC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAA;oBAEtE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,gEAAgE;oBAChE,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;wBACxC,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CACrC,CAAA;wBACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;wBAClD,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;wBACtC,0BAA0B,EAAE,CAAA;wBAC5B,eAAe,CACb,wCAAwC,gBAAgB,yBAAyB,cAAc,EAAE,CAClG,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAA;wBACrD,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;wBACtC,0BAA0B,EAAE,CAAA;wBAC5B,eAAe,CACb,wCAAwC,gBAAgB,yBAAyB,cAAc,EAAE,CAClG,CAAA;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,eAAe,CACb,6EAA6E,cAAc,EAAE,CAC9F,CAAA;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;gBAC5C,cAAc,KAAK,WAAW,CACjC,CAAA;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACxD,CAAC;iBAAM,CAAC;gBACN,eAAe,CACb,gEAAgE,cAAc,EAAE,CACjF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,+DAA+D;IAC/D,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACjE,uBAAuB,CAAC,CAAC,CAAC,CAC3B,CAAA;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,aAAa,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;QAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,eAAe,CACb,yDAAyD,cAAc,EAAE,CAC1E,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;YAEpC,sFAAsF;YACtF,iFAAiF;YACjF,8BAA8B;YAC9B,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;gBACvC,IACE,SAAS,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC;oBAC1C,SAAS,KAAK,cAAc,EAC5B,CAAC;oBACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC9B,eAAe,CACb,0DAA0D,SAAS,EAAE,CACtE,CAAA;wBACD,SAAQ;oBACV,CAAC;oBACD,6DAA6D;oBAC7D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;oBAC5C,eAAe,CACb,gEAAgE,SAAS,EAAE,CAC5E,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CACrC,SAAS,CAAC,EAAE,CACV,cAAc,KAAK,SAAS;gBAC5B,cAAc,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,CAC7C,CAAA;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,eAAe,CACb,2DAA2D,cAAc,EAAE,CAC5E,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,6CAA6C;YAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA0B;IAE1B,MAAM,EACJ,OAAO,EACP,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,yBAAyB,EACzB,mBAAmB,EACnB,QAAQ,EACR,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EACjC,wBAAwB,GAAG,mCAAmC,EAC9D,cAAc,GAAG,KAAK,EACtB,aAAa,EACb,WAAW,GACZ,GAAG,MAAM,CAAA;IAEV,6CAA6C;IAC7C,6DAA6D;IAC7D,4FAA4F;IAC5F,MAAM,mBAAmB,GAAG,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACxE,MAAM,oBAAoB,GAAG,WAAW,KAAK,SAAS,CAAA;IAEtD,kCAAkC;IAClC,IACE,CAAC,uBAAuB;QACxB,CAAC,mBAAmB;QACpB,CAAC,oBAAoB,EACrB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,SAAS,GAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IAClE,IAAI,iBAAiB,GAAuB,SAAS,CAAA;IAErD,IAAI,CAAC;QACH,8DAA8D;QAC9D,kFAAkF;QAClF,EAAE;QACF,4EAA4E;QAC5E,wCAAwC;QACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,iBAAiB;gBACf,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,SAAS,CAAA;YAC5D,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,aAAa,EAAE,SAAS,CACzB,CAAA;YAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC9C,8EAA8E;gBAC9E,eAAe,CACb,kFAAkF;oBAChF,qEAAqE,EACvE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,kDAAkD;gBAClD,iBAAiB,GAAG,SAAS,CAAA;YAC/B,CAAC;iBAAM,CAAC;gBACN,qDAAqD;gBACrD,6EAA6E;gBAC7E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACpD,uBAAuB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;oBAC9C,0BAA0B,EAAE,CAAA;gBAC9B,CAAC;gBAED,eAAe,CACb,uEAAuE,CACxE,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,eAAe,CACb,0EAA0E,CAC3E,CAAA;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,uBAAuB,EAAE,CAAC;YAC5B,6DAA6D;YAC7D,wEAAwE;YACxE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAE/B,qEAAqE;YACrE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;gBACtC,6DAA6D;gBAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,IAAI;wBAC5D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CACb,6CAA6C,eAAe,IAAI;wBAC9D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBAED,qCAAqC;gBACrC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;gBACxD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,CAAC,CAAA;gBAE1D,kCAAkC;gBAClC,yEAAyE;gBACzE,4EAA4E;gBAC5E,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,EAAE,8BAA8B;gBACpC,IAAI,CACL,CAAA;gBACD,SAAS,CAAC,IAAI,CACZ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBAChC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;oBACpC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBACjC,CAAC,CAAC,CACH,CAAA;gBAED,uEAAuE;gBACvE,iEAAiE;gBACjE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,kCAAkC,EAClC,MAAM,CAAC,aAAa,CAAC,CACtB,CAAA;gBACH,CAAC;gBACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,mCAAmC,EACnC,MAAM,CAAC,cAAc,CAAC,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,sFAAsF;QACxF,CAAC;QAED,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,UAAU,EACV,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAA;QACD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAEzB,mBAAmB;QACnB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAE/B,gDAAgD;QAChD,6EAA6E;QAC7E,kEAAkE;QAClE,wEAAwE;QACxE,qGAAqG;QACrG,mGAAmG;QACnG,4DAA4D;QAC5D,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC/B,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACnC,CAAC;QAED,gCAAgC;QAChC,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,SAAS,GAAG,QAAQ,IAAI,MAAM,CAAA;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,qBAAqB,CAAC,CAAA;QAC3D,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAEjC,+FAA+F;QAC/F,wEAAwE;QACxE,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACjE,2EAA2E;YAC3E,uDAAuD;YACvD,MAAM,cAAc,GAAG,mBAAmB,CACxC,cAAc,EACd,eAAe,EACf,OAAO,EACP,iBAAiB,EACjB,KAAK,EACL,aAAa,EAAE,SAAS,CACzB,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAChC,CAAC;aAAM,IAAI,iBAAiB,EAAE,CAAC;YAC7B,2EAA2E;YAC3E,4FAA4F;YAC5F,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,aAAa,EAAE,SAAS,CACzB,CAAA;YACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,wEAAwE;oBACtE,uFAAuF,CAC1F,CAAA;YACH,CAAC;YAED,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;gBACvC,kBAAkB;gBAClB,iBAAiB;gBACjB,KAAK;gBACL,IAAI;gBACJ,OAAO;aACR,CAAC,CAAA;YACF,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;QAEhE,MAAM,YAAY,GAAG,EAAE,CAAA;QACvB,IAAI,uBAAuB;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzD,IAAI,mBAAmB,IAAI,oBAAoB;YAC7C,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,IAAI,iBAAiB;YAAE,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAE/D,eAAe,CACb,+CAA+C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACvF,CAAA;QAED,OAAO,cAAc,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mCAAmC;QACnC,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzE,uBAAuB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;YACjD,IAAI,CAAC;gBACH,oBAAoB,CAAC,iBAAiB,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,eAAe,CACb,+DAA+D,YAAY,EAAE,EAC7E,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACH,CAAC;QACH,CAAC;QACD,8BAA8B;QAC9B,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"linux-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,eAAe,EACf,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAK3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AAmCxE,sDAAsD;AACtD,MAAM,mCAAmC,GAAG,CAAC,CAAA;AAE7C;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,iBAA2B;IAE3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAE9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACpC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,wDAAwD;gBACxD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,WAAW,CACrE,CAAA;gBACD,IAAI,mBAAmB,EAAE,CAAC;oBACxB,OAAO,QAAQ,CAAA;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;YAC7C,MAAK;QACP,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;YACrC,MAAK;QACP,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B,CAAC,UAAkB;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,WAAW,GAAG,EAAE,CAAA;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ,CAAC,+BAA+B;QACnD,MAAM,QAAQ,GAAG,WAAW,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAA;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,WAAW,GAAG,QAAQ,CAAA;IACxB,CAAC;IAED,OAAO,UAAU,CAAA,CAAC,2CAA2C;AAC/D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,WAAmB,mCAAmC,EACtD,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,sDAAsD;IACtD,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAA;IACvD,MAAM,oBAAoB,GAAG,uBAAuB,EAAE,CAAA;IAEtD,uEAAuE;IACvE,MAAM,SAAS,GAAG;QAChB,yBAAyB;QACzB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,+BAA+B;QAC/B,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;KACvD,CAAA;IAED,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,+BAA+B;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,CAAC;QACH,iBAAiB,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,wCAAwC;QACxC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;QAE/C,mEAAmE;QACnE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACrC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,2CAA2C;IAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAE7C,mDAAmD;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC7C,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CACrB;YACE,SAAS;YACT,UAAU;YACV,aAAa;YACb,MAAM,CAAC,QAAQ,CAAC;YAChB,GAAG,SAAS;YACZ,IAAI;YACJ,qBAAqB;SACtB,EACD,GAAG,EACH,MAAM,EACN,aAAa,CACd,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE7C,8DAA8D;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CACjC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,iBAAiB,CACzD,CAAA;YACD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,6DAA6D;gBAC7D,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;wBACjC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;oBAC5C,CAAC;yBAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBACzC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;oBAC7C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChE,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAA;gBACf,MAAK;YACP,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,mEAAmE;AACnE,6EAA6E;AAC7E,8EAA8E;AAC9E,4BAA4B;AAC5B,MAAM,gBAAgB,GAAgB,IAAI,GAAG,EAAE,CAAA;AAE/C,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,0CAA0C;AAC1C,IAAI,kBAAkB,GAAG,CAAC,CAAA;AAE1B,IAAI,qBAAqB,GAAG,KAAK,CAAA;AAEjC;;GAEG;AACH,SAAS,0BAA0B;IACjC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAM;IACR,CAAC;IAED,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,uBAAuB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,qBAAqB,GAAG,IAAI,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA0B;IAChE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAC3B,kBAAkB,EAAE,CAAA;QACtB,CAAC;QACD,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAC3B,eAAe,CACb,mDAAmD,kBAAkB,2BAA2B,CACjG,CAAA;YACD,OAAM;QACR,CAAC;IACH,CAAC;SAAM,CAAC;QACN,kBAAkB,GAAG,CAAC,CAAA;IACxB,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,oEAAoE;YACpE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;YACpC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBACzB,eAAe,CACb,wDAAwD,UAAU,EAAE,CACrE,CAAA;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,kDAAkD;gBAClD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;gBAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;oBACxB,eAAe,CACb,uDAAuD,UAAU,EAAE,CACpE,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,KAAK,EAAE,CAAA;AAC1B,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAA6B;IAE7B,wEAAwE;IACxE,qEAAqE;IACrE,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QACrC,eAAe,EAAE,aAAa,EAAE,KAAK;YACnC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI;KACjE,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAA6B;IAE7B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QAC7B,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACjD,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAEnE,IACE,CAAC,aAAa,EAAE,KAAK;QACrB,yBAAyB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,IAAI,EAC5D,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,QAAQ,OAAO,CAAC,CAAA;IACrE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,QAAQ,OAAO,CAAC,CAAA;IAEvE,oBAAoB;IACpB,MAAM,aAAa,GAAG;QACpB,eAAe,cAAc,iBAAiB;QAC9C,iBAAiB,aAAa,8CAA8C;KAC7E,CAAA;IAED,eAAe,CAAC,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEzE,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE;QACtD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QAClC,eAAe,CAAC,8BAA8B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC5C,eAAe,CACb,wCAAwC,IAAI,YAAY,MAAM,EAAE,EAChE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,qBAAqB;IACrB,MAAM,cAAc,GAAG;QACrB,eAAe,eAAe,iBAAiB;QAC/C,iBAAiB,cAAc,8CAA8C;KAC9E,CAAA;IAED,eAAe,CAAC,gCAAgC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE3E,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE;QACxD,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;QAC5B,uBAAuB;QACvB,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IAED,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACnC,eAAe,CAAC,+BAA+B,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IACF,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC7C,eAAe,CACb,yCAAyC,IAAI,YAAY,MAAM,EAAE,EACjE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CACzC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,oCAAoC;IACpC,MAAM,WAAW,GAAG,CAAC,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IACE,CAAC,iBAAiB,CAAC,GAAG;YACtB,iBAAiB,CAAC,MAAM;YACxB,CAAC,kBAAkB,CAAC,GAAG;YACvB,kBAAkB,CAAC,MAAM,EACzB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,sBAAsB;YACtB,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpE,eAAe,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBAC9D,MAAK;YACP,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,mCAAmC,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE;gBACnE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;YAC1B,0BAA0B;YAC1B,IAAI,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,WAAW,WAAW,CAChE,CAAA;QACH,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,aAAa;QACb,cAAc;KACf,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAChC,SAA6B,EAC7B,KAAyB;IAEzB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,OAAO,SAAS,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAA;IAC/E,CAAC;IACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACnD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,cAAsB,EACtB,eAAuB,EACvB,WAAmB,EACnB,kBAAsC,EACtC,KAAc;IAEd,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,CAAA;IACjC,MAAM,aAAa,GAAG;QACpB,qDAAqD,cAAc,oBAAoB;QACvF,qDAAqD,eAAe,oBAAoB;QACxF,0CAA0C;KAC3C,CAAA;IAED,yEAAyE;IACzE,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,eAAe,GACnB,kBAAkB,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;QACvE,MAAM,WAAW,GAAG,CAAC,GAAG,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,QAAQ,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;SAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,OAAO,GAAG,SAAS,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,UAA+C,EAC/C,WAAiD,EACjD,gBAAsD,EAAE,OAAO,EAAE,IAAI,EAAE,EACvE,2BAAmC,mCAAmC,EACtE,cAAc,GAAG,KAAK,EACtB,WAAyB;IAEzB,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,sBAAsB;IAEtB,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,aAAa,GAAa,EAAE,CAAA;IAElC,2DAA2D;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,qFAAqF;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAEhC,iCAAiC;QACjC,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAE3D,eAAe,CACb,0CAA0C,WAAW,OAAO,cAAc,EAAE,CAC7E,CAAA;YAED,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,uCAAuC,cAAc,EAAE,CAAC,CAAA;gBACxE,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,eAAe,CACb,qDAAqD,cAAc,EAAE,CACtE,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,kEAAkE;YAClE,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;gBACpD,qEAAqE;gBACrE,uEAAuE;gBACvE,gEAAgE;gBAChE,MAAM,uBAAuB,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;gBAClE,IACE,YAAY,KAAK,uBAAuB;oBACxC,wBAAwB,CAAC,cAAc,EAAE,YAAY,CAAC,EACtD,CAAC;oBACD,eAAe,CACb,mFAAmF,WAAW,OAAO,YAAY,EAAE,CACpH,CAAA;oBACD,SAAQ;gBACV,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,eAAe,CACb,mEAAmE,cAAc,EAAE,CACpF,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACnD,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACxC,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG;YAChB,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,0BAA0B,CAClC,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAC;SACH,CAAA;QAED,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,2CAA2C;QAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;YAC3D,IAAI,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC;gBAAE,SAAQ;YAC/C,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAEjC,0DAA0D;YAC1D,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,SAAQ;YACV,CAAC;YAED,yEAAyE;YACzE,gEAAgE;YAChE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,aAAa,GAAG,iBAAiB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;YAC1E,IAAI,aAAa,EAAE,CAAC;gBAClB,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;gBAC3D,eAAe,CACb,gDAAgD,aAAa,wCAAwC,CACtG,CAAA;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,yEAAyE;YACzE,uDAAuD;YACvD,EAAE;YACF,yEAAyE;YACzE,qEAAqE;YACrE,uCAAuC;YACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,oEAAoE;gBACpE,kEAAkE;gBAClE,oEAAoE;gBACpE,sCAAsC;gBACtC,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,CAAC;oBACpC,eAAe,CACb,6FAA6F,cAAc,EAAE,CAC9G,CAAA;oBACD,SAAQ;gBACV,CAAC;gBAED,+CAA+C;gBAC/C,IAAI,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;gBAC/C,OAAO,YAAY,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5D,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC3C,CAAC;gBAED,yEAAyE;gBACzE,4DAA4D;gBAC5D,MAAM,2BAA2B,GAAG,iBAAiB,CAAC,IAAI,CACxD,WAAW,CAAC,EAAE,CACZ,YAAY,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;oBAC1C,YAAY,KAAK,WAAW;oBAC5B,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAC/C,CAAA;gBAED,IAAI,2BAA2B,EAAE,CAAC;oBAChC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAA;oBAEtE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,gEAAgE;oBAChE,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;wBACxC,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CACrC,CAAA;wBACD,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;wBAC3D,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;wBACtC,0BAA0B,EAAE,CAAA;wBAC5B,eAAe,CACb,wCAAwC,gBAAgB,yBAAyB,cAAc,EAAE,CAClG,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAA;wBAC9D,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;wBACtC,0BAA0B,EAAE,CAAA;wBAC5B,eAAe,CACb,wCAAwC,gBAAgB,yBAAyB,cAAc,EAAE,CAClG,CAAA;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,eAAe,CACb,6EAA6E,cAAc,EAAE,CAC9F,CAAA;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,CAChD,WAAW,CAAC,EAAE,CACZ,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC;gBAC5C,cAAc,KAAK,WAAW,CACjC,CAAA;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;iBAAM,CAAC;gBACN,eAAe,CACb,gEAAgE,cAAc,EAAE,CACjF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IACD,0DAA0D;IAE1D,+DAA+D;IAC/D,MAAM,aAAa,GAAa,EAAE,CAAA;IAClC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACjE,uBAAuB,CAAC,CAAC,CAAC,CAC3B,CAAA;IACD,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,uBAAuB,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,aAAa,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IAC7C,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,aAAa;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;SACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;IAE5D,KAAK,MAAM,cAAc,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,eAAe,CACb,yDAAyD,cAAc,EAAE,CAC1E,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,GAAG,GAAG,CAAA;QACnE,MAAM,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;YAEpC,sEAAsE;YACtE,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;gBAC1C,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;oBAClE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;oBACzC,eAAe,CACb,gEAAgE,SAAS,EAAE,CAC5E,CAAA;gBACH,CAAC;YACH,CAAC;YAED,sFAAsF;YACtF,iFAAiF;YACjF,8BAA8B;YAC9B,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;gBACvC,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;oBAClE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC9B,eAAe,CACb,0DAA0D,SAAS,EAAE,CACtE,CAAA;wBACD,SAAQ;oBACV,CAAC;oBACD,+DAA+D;oBAC/D,mEAAmE;oBACnE,gEAAgE;oBAChE,wBAAwB;oBACxB,IACE,iBAAiB,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC;wBAC/C,CAAC,SAAS,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CACrD,EACD,CAAC;wBACD,SAAQ;oBACV,CAAC;oBACD,6DAA6D;oBAC7D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;oBAC5C,eAAe,CACb,gEAAgE,SAAS,EAAE,CAC5E,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,qEAAqE;YACrE,sEAAsE;YACtE,uBAAuB;YACvB,IAAI,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5C,eAAe,CACb,2DAA2D,cAAc,EAAE,CAC5E,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,6CAA6C;YAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;YACnD,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;QAClC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QACnC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAE,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,IAAI,CAAC,CAAA;IAC3D,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA0B;IAE1B,MAAM,EACJ,OAAO,EACP,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,yBAAyB,EACzB,mBAAmB,EACnB,QAAQ,EACR,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EACjC,wBAAwB,GAAG,mCAAmC,EAC9D,cAAc,GAAG,KAAK,EACtB,aAAa,EACb,WAAW,GACZ,GAAG,MAAM,CAAA;IAEV,6CAA6C;IAC7C,6DAA6D;IAC7D,4FAA4F;IAC5F,MAAM,mBAAmB,GAAG,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACxE,MAAM,oBAAoB,GAAG,WAAW,KAAK,SAAS,CAAA;IAEtD,kCAAkC;IAClC,IACE,CAAC,uBAAuB;QACxB,CAAC,mBAAmB;QACpB,CAAC,oBAAoB,EACrB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,yDAAyD;IACzD,oEAAoE;IACpE,kEAAkE;IAClE,yCAAyC;IACzC,kBAAkB,EAAE,CAAA;IAEpB,MAAM,SAAS,GAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IAClE,IAAI,kBAAsC,CAAA;IAE1C,IAAI,CAAC;QACH,8DAA8D;QAC9D,uEAAuE;QACvE,8EAA8E;QAC9E,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,kBAAkB,GAAG,yBAAyB,CAC5C,aAAa,EAAE,SAAS,EACxB,aAAa,EAAE,KAAK,CACrB,CAAA;YAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,eAAe,CACb,sFAAsF;oBACpF,qEAAqE,EACvE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,eAAe,CACb,kEAAkE,CACnE,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,eAAe,CACb,0EAA0E,CAC3E,CAAA;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,uBAAuB,EAAE,CAAC;YAC5B,6DAA6D;YAC7D,wEAAwE;YACxE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAE/B,qEAAqE;YACrE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;gBACtC,6DAA6D;gBAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,IAAI;wBAC5D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CACb,6CAA6C,eAAe,IAAI;wBAC9D,mEAAmE,CACtE,CAAA;gBACH,CAAC;gBAED,qCAAqC;gBACrC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;gBACxD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,CAAC,CAAA;gBAE1D,kCAAkC;gBAClC,yEAAyE;gBACzE,4EAA4E;gBAC5E,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,EAAE,8BAA8B;gBACpC,IAAI,CACL,CAAA;gBACD,SAAS,CAAC,IAAI,CACZ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBAChC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;oBACpC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBACjC,CAAC,CAAC,CACH,CAAA;gBAED,uEAAuE;gBACvE,iEAAiE;gBACjE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,kCAAkC,EAClC,MAAM,CAAC,aAAa,CAAC,CACtB,CAAA;gBACH,CAAC;gBACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,SAAS,CAAC,IAAI,CACZ,UAAU,EACV,mCAAmC,EACnC,MAAM,CAAC,cAAc,CAAC,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,sFAAsF;QACxF,CAAC;QAED,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,UAAU,EACV,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,WAAW,CACZ,CAAA;QACD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAEzB,mBAAmB;QACnB,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAE/B,gDAAgD;QAChD,6EAA6E;QAC7E,kEAAkE;QAClE,wEAAwE;QACxE,qGAAqG;QACrG,mGAAmG;QACnG,4DAA4D;QAC5D,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC/B,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,2DAA2D;YAC3D,iEAAiE;YACjE,4DAA4D;YAC5D,EAAE;YACF,gEAAgE;YAChE,8DAA8D;YAC9D,+DAA+D;YAC/D,SAAS,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9D,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,kEAAkE;QAClE,kDAAkD;QAElD,gCAAgC;QAChC,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,SAAS,GAAG,QAAQ,IAAI,MAAM,CAAA;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,qBAAqB,CAAC,CAAA;QAC3D,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAEjC,2EAA2E;QAC3E,4EAA4E;QAC5E,gCAAgC;QAChC,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACjE,MAAM,cAAc,GAAG,mBAAmB,CACxC,cAAc,EACd,eAAe,EACf,OAAO,EACP,kBAAkB,EAClB,KAAK,CACN,CAAA;YACD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAChC,CAAC;aAAM,IAAI,kBAAkB,EAAE,CAAC;YAC9B,MAAM,eAAe,GACnB,kBAAkB,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;YAC/D,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;QAEhE,MAAM,YAAY,GAAG,EAAE,CAAA;QACvB,IAAI,uBAAuB;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzD,IAAI,mBAAmB,IAAI,oBAAoB;YAC7C,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,IAAI,kBAAkB;YAAE,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAEhE,eAAe,CACb,+CAA+C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACvF,CAAA;QAED,OAAO,cAAc,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,mDAAmD;QACnD,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAC3B,kBAAkB,EAAE,CAAA;QACtB,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}