@sysid/sandbox-runtime-improved 0.0.51-sysid.1 → 0.0.54-sysid.1

package/dist/sandbox/windows-sandbox-utils.js

@@ -0,0 +1,433 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { logForDebugging } from '../utils/debug.js';
+import { generateProxyEnvVars } from './sandbox-utils.js';
+/**
+ * Windows sandbox backend.
+ *
+ * Network isolation is enforced by `srt-win.exe` — a Rust helper that
+ * manages a local discriminator group, a machine-wide WFP filter set
+ * keyed on that group's SID, and an `exec` subcommand that spawns the
+ * target under a restricted token (group flipped deny-only) inside a
+ * hardened job. The sandboxed child reaches the host only via the JS
+ * http/socks proxies, which `srt-win exec` points at via env vars.
+ *
+ * This module is a thin wrapper around the `srt-win` CLI; all status
+ * comes from live enumeration (group via `LookupAccountNameW` +
+ * token-membership check; WFP via providerData-tag enumeration under
+ * the configured sublayer). There is no marker file.
+ *
+ * Filesystem restrictions are NOT enforced on Windows yet.
+ */
+// ────────────────────────────────────────────────────────────────────
+// Types
+// ────────────────────────────────────────────────────────────────────
+export const DEFAULT_WINDOWS_GROUP_NAME = 'sandbox-runtime-net';
+export const DEFAULT_WINDOWS_PROXY_PORT_RANGE = [
+    60080, 60089,
+];
+// ────────────────────────────────────────────────────────────────────
+// Binary resolution
+// ────────────────────────────────────────────────────────────────────
+function repoRoot() {
+    // src/sandbox/windows-sandbox-utils.ts → repo root (compiled: dist/sandbox/…)
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, '..', '..');
+}
+/**
+ * Locate `srt-win.exe`. Resolution order:
+ *   1. `SRT_WIN_PATH` env var (CI sets this to the freshly-built binary).
+ *   2. `<repo>/vendor/srt-win/target/release/srt-win.exe` (local cargo build).
+ *   3. `<repo>/dist/vendor/srt-win/target/release/srt-win.exe`
+ *      (post-`npm run build` shape, when running from compiled output).
+ *
+ * Resolution via the optional `@anthropic-ai/sandbox-runtime-win32-*`
+ * platform packages is added separately.
+ *
+ * @throws if none exist.
+ */
+export function getSrtWinPath() {
+    const envPath = process.env.SRT_WIN_PATH;
+    if (envPath && fs.existsSync(envPath)) {
+        return envPath;
+    }
+    const root = repoRoot();
+    const candidates = [
+        path.join(root, 'vendor', 'srt-win', 'target', 'release', 'srt-win.exe'),
+        path.join(root, 'dist', 'vendor', 'srt-win', 'target', 'release', 'srt-win.exe'),
+    ];
+    for (const c of candidates) {
+        if (fs.existsSync(c))
+            return c;
+    }
+    throw new Error(`srt-win.exe not found. Set SRT_WIN_PATH or build with ` +
+        `\`cargo build --release --manifest-path vendor/srt-win/Cargo.toml\`. ` +
+        `Looked in: ${[envPath, ...candidates].filter(Boolean).join(', ')}`);
+}
+// ────────────────────────────────────────────────────────────────────
+// Internal: spawn helpers
+// ────────────────────────────────────────────────────────────────────
+function groupRefArgs(ref) {
+    if (ref.groupSid)
+        return ['--group-sid', ref.groupSid];
+    return ['--name', ref.groupName ?? DEFAULT_WINDOWS_GROUP_NAME];
+}
+function runSrtWin(args) {
+    const exe = getSrtWinPath();
+    const r = spawnSync(exe, args, { encoding: 'utf8', timeout: 15000 });
+    if (r.error) {
+        throw new Error(`srt-win ${args[0]}: spawn failed: ${r.error.message}`);
+    }
+    return {
+        status: r.status,
+        stdout: (r.stdout ?? '').trim(),
+        stderr: (r.stderr ?? '').trim(),
+    };
+}
+function runSrtWinJson(args) {
+    const r = runSrtWin(args);
+    if (r.status !== 0) {
+        throw new Error(`srt-win ${args.join(' ')} exited ${r.status}: ${r.stderr || r.stdout}`);
+    }
+    // Status subcommands print exactly one line of JSON to stdout. stderr
+    // may carry `srt-win:` diagnostics — ignore it for parsing.
+    try {
+        return JSON.parse(r.stdout);
+    }
+    catch (e) {
+        throw new Error(`srt-win ${args.join(' ')}: unparseable JSON output ` +
+            `${JSON.stringify(r.stdout)}: ${e.message}`);
+    }
+}
+// ────────────────────────────────────────────────────────────────────
+// Status / install API
+// ────────────────────────────────────────────────────────────────────
+/**
+ * Query the discriminator group's state in SAM and in the current
+ * process's `TokenGroups`. `ready` means the group exists AND is
+ * enabled in the caller's token (i.e. the logout/login dance has
+ * happened). `created-not-on-token` means the install step ran but
+ * a fresh logon is needed before {@link initialize} can succeed.
+ */
+export function getWindowsGroupStatus(ref) {
+    return runSrtWinJson(['group', 'status', ...groupRefArgs(ref)]);
+}
+/**
+ * Query the WFP filter set under the given sublayer. `installed` means
+ * srt-win-tagged `permit-group` AND `block` filters are both present
+ * under that sublayer. Detection is **tag-based** (providerData JSON);
+ * filters installed by other tooling without the tag are not counted.
+ */
+export function getWindowsWfpStatus(opts = {}) {
+    const args = ['wfp', 'status'];
+    if (opts.sublayerGuid)
+        args.push('--sublayer-guid', opts.sublayerGuid);
+    const raw = runSrtWinJson(args);
+    return {
+        state: raw.state,
+        filters: raw.filters,
+        ...(raw.port_range && { portRange: raw.port_range }),
+    };
+}
+/**
+ * One-shot install: creates the discriminator group, adds the
+ * current user (or `userSid`), and installs the machine-wide WFP
+ * filter set — all in a single self-elevating process (one UAC
+ * prompt). Idempotent.
+ *
+ * Network for the calling user is **not disrupted** before the
+ * required logout: while the group is absent from the token, WFP
+ * filter-0 (PERMIT non-members) matches and traffic flows normally.
+ * After log-out/log-in, the group is enabled in the token and
+ * filter-1 (PERMIT group-enabled) takes over for the broker; only
+ * `srt-win exec` children (group flipped deny-only) fall through to
+ * the loopback/BLOCK filters.
+ *
+ * Returns the post-call group + WFP state. If the user cancels the
+ * UAC prompt this returns `{cancelled: true, …}` rather than
+ * throwing — cancellation is a user choice, not an error.
+ *
+ * @throws on group/WFP creation failure, or if filters already
+ *   exist under `sublayerGuid` with different configuration and
+ *   `force` is not set.
+ */
+export function installWindowsSandbox(opts = {}) {
+    const args = ['install', ...groupRefArgs(opts)];
+    if (opts.userSid)
+        args.push('--user-sid', opts.userSid);
+    if (opts.sublayerGuid)
+        args.push('--sublayer-guid', opts.sublayerGuid);
+    if (opts.proxyPortRange) {
+        args.push('--proxy-port-range', `${opts.proxyPortRange[0]}-${opts.proxyPortRange[1]}`);
+    }
+    if (opts.force)
+        args.push('--force');
+    const r = runSrtWin(args);
+    logForDebugging(`[Sandbox Windows] install exit=${r.status}: ${r.stderr || r.stdout}`);
+    // srt-win install exit-code contract:
+    //   0  ok
+    //   10 user cancelled UAC elevation
+    //   11 group create failed
+    //   12 WFP install failed
+    //   13 already installed with different config (use --force)
+    //   1  other error (stderr has detail)
+    const out = r.stderr || r.stdout;
+    switch (r.status) {
+        case 0:
+            break;
+        case 10:
+            return {
+                group: getWindowsGroupStatus(opts),
+                wfp: getWindowsWfpStatus({ sublayerGuid: opts.sublayerGuid }),
+                cancelled: true,
+            };
+        case 11:
+            throw new Error(`srt-win install: group create failed: ${out}`);
+        case 12:
+            throw new Error(`srt-win install: WFP filter install failed: ${out}`);
+        case 13:
+            throw new Error(`srt-win install: filters already exist under this sublayer with ` +
+                `different configuration (group SID or port range). ` +
+                `Pass {force: true} to replace, or pick a different sublayerGuid. ` +
+                `Output: ${out}`);
+        default:
+            throw new Error(`srt-win install failed (exit ${r.status}): ${out}`);
+    }
+    return {
+        group: getWindowsGroupStatus(opts),
+        wfp: getWindowsWfpStatus({ sublayerGuid: opts.sublayerGuid }),
+    };
+}
+/**
+ * Remove the WFP filter set under `sublayerGuid` (one UAC prompt).
+ * Idempotent.
+ *
+ * **Does NOT delete the discriminator group** — group membership is
+ * persistent user state and removing it would force every user to
+ * re-do the logout dance on the next install. Call
+ * {@link deleteWindowsGroup} explicitly if you want full teardown.
+ *
+ * @returns `{cancelled: true}` if the user dismissed UAC.
+ */
+export function uninstallWindowsSandbox(opts = {}) {
+    const args = ['uninstall'];
+    if (opts.sublayerGuid)
+        args.push('--sublayer-guid', opts.sublayerGuid);
+    const r = runSrtWin(args);
+    logForDebugging(`[Sandbox Windows] uninstall exit=${r.status}: ${r.stderr || r.stdout}`);
+    if (r.status === 10)
+        return { cancelled: true };
+    if (r.status !== 0) {
+        throw new Error(`srt-win uninstall failed (exit ${r.status}): ${r.stderr || r.stdout}`);
+    }
+    return {};
+}
+/**
+ * Delete the discriminator group. Separate from
+ * {@link uninstallWindowsSandbox} so that uninstall→reinstall
+ * doesn't force a fresh logout for every member. **Requires
+ * elevation.** Idempotent (no-op if the group doesn't exist).
+ */
+export function deleteWindowsGroup(ref) {
+    const r = runSrtWin(['group', 'delete', ...groupRefArgs(ref)]);
+    if (r.status !== 0) {
+        throw new Error(`srt-win group delete failed (exit ${r.status}). ` +
+            `Requires elevation. Output: ${r.stderr || r.stdout}`);
+    }
+    logForDebugging(`[Sandbox Windows] group delete: ${r.stderr || r.stdout}`);
+}
+/**
+ * Granular primitive: create the discriminator group and add the
+ * current user (or `userSid`). Most callers should use
+ * {@link installWindowsSandbox} instead; this exists for
+ * enterprise/CI flows that manage group and WFP separately.
+ * **Requires elevation.** Idempotent.
+ */
+export function createWindowsGroup(ref) {
+    const args = ['group', 'create', ...groupRefArgs(ref)];
+    if (ref.userSid)
+        args.push('--user-sid', ref.userSid);
+    const r = runSrtWin(args);
+    if (r.status !== 0) {
+        throw new Error(`srt-win group create failed (exit ${r.status}). ` +
+            `This requires elevation — run as administrator. ` +
+            `Output: ${r.stderr || r.stdout}`);
+    }
+    logForDebugging(`[Sandbox Windows] group create: ${r.stderr || r.stdout}`);
+}
+/**
+ * Granular primitive: install the machine-wide WFP filter set
+ * under `sublayerGuid` keyed on the group SID. Most callers should
+ * use {@link installWindowsSandbox} instead; this exists for
+ * enterprise/CI flows that manage group and WFP separately.
+ * **Requires elevation.** Idempotent — re-running replaces any
+ * existing srt-win-tagged filters under that sublayer.
+ */
+export function createWindowsWfp(ref) {
+    const args = ['wfp', 'install', ...groupRefArgs(ref)];
+    if (ref.sublayerGuid)
+        args.push('--sublayer-guid', ref.sublayerGuid);
+    if (ref.proxyPortRange) {
+        args.push('--proxy-port-range', `${ref.proxyPortRange[0]}-${ref.proxyPortRange[1]}`);
+    }
+    const r = runSrtWin(args);
+    if (r.status !== 0) {
+        throw new Error(`srt-win wfp install failed (exit ${r.status}). ` +
+            `This requires elevation — run as administrator. ` +
+            `Output: ${r.stderr || r.stdout}`);
+    }
+    logForDebugging(`[Sandbox Windows] wfp install: ${r.stderr || r.stdout}`);
+}
+// ────────────────────────────────────────────────────────────────────
+// Wrap
+// ────────────────────────────────────────────────────────────────────
+/**
+ * Build the spawn descriptor for running `command` inside the Windows
+ * sandbox: an `argv` array plus the `env` to spawn it with.
+ *
+ * Caller MUST spawn the result with `{shell: false}` — that is the
+ * security boundary that keeps untrusted bytes off the host's shell
+ * (the inner `cmd.exe /c` runs INSIDE the sandbox; see
+ * `vendor/srt-win/src/launch.rs` `build_cmdline` for the passthrough
+ * rationale) — AND with the returned `env`.
+ *
+ * Proxy configuration is single-sourced by {@link generateProxyEnvVars}
+ * (the same canonical builder used on macOS/Linux). `srt-win exec`
+ * takes no `--http-proxy` / `--socks-proxy` flags and synthesizes no
+ * proxy env; it forwards its own environment to the sandboxed child
+ * verbatim. So the full proxy set is merged over the broker's
+ * environment here and the child inherits it through the spawn.
+ */
+export function wrapCommandWithSandboxWindows(p) {
+    const exe = getSrtWinPath();
+    const argv = [exe, 'exec', ...groupRefArgs(p.group)];
+    argv.push('--');
+    const systemRoot = process.env.SystemRoot ?? 'C:\\Windows';
+    const shell = (p.binShell ?? 'cmd').toLowerCase();
+    if (shell === 'pwsh' || shell.includes('powershell')) {
+        const psExe = shell === 'pwsh'
+            ? 'pwsh.exe'
+            : path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+        argv.push(psExe, '-NoProfile', '-Command', p.command);
+    }
+    else {
+        // cmd /d (no AutoRun) /s (strip first+last quote of post-/c by
+        // position) /c (run-then-exit). The `command` string lands as a
+        // single argv element; srt-win's build_cmdline wraps it in one
+        // outer "…" pair for /s to consume. See launch.rs.
+        argv.push(path.join(systemRoot, 'System32', 'cmd.exe'), '/d', '/s', '/c', p.command);
+    }
+    // Generated proxy vars override any inherited ones so the child
+    // always routes through this sandbox's proxies.
+    const generated = envListToObject(generateProxyEnvVars(p.httpProxyPort, p.socksProxyPort));
+    // TMPDIR is a POSIX path meant for the macOS/Linux FS sandbox — it
+    // serves no purpose on Windows and breaks msys2 tools (mktemp etc.).
+    delete generated.TMPDIR;
+    const env = { ...process.env, ...generated };
+    return { argv, env };
+}
+/**
+ * Parse a list of `KEY=VALUE` strings (as produced by
+ * {@link generateProxyEnvVars}) into an object. Splits on the FIRST
+ * `=` only, so values containing `=` survive intact.
+ */
+function envListToObject(list) {
+    const out = {};
+    for (const entry of list) {
+        const eq = entry.indexOf('=');
+        if (eq === -1)
+            continue;
+        out[entry.slice(0, eq)] = entry.slice(eq + 1);
+    }
+    return out;
+}
+// ────────────────────────────────────────────────────────────────────
+// Dependency / readiness check
+// ────────────────────────────────────────────────────────────────────
+/**
+ * Install instructions, surfaced verbatim in error messages.
+ * Tailored to the observed group state: if the install already
+ * ran (`created-not-on-token`), only the logout is missing.
+ */
+export function windowsInstallInstructions(ref, sublayerGuid, groupState) {
+    if (groupState === 'created-not-on-token') {
+        return (`The discriminator group exists but is not yet in this session's ` +
+            `token. LOG OUT and back in to pick up the new group membership ` +
+            `(it enters TokenGroups at logon). Network is not disrupted ` +
+            `meanwhile — WFP filter-0 PERMITs traffic while the group is absent ` +
+            `from your token.`);
+    }
+    const g = ref.groupSid
+        ? `--group-sid ${ref.groupSid}`
+        : `--name ${ref.groupName ?? DEFAULT_WINDOWS_GROUP_NAME}`;
+    const sl = sublayerGuid ? ` --sublayer-guid ${sublayerGuid}` : '';
+    return (`Windows sandbox needs a one-time install (one UAC prompt):\n` +
+        `  npx sandbox-runtime windows-install\n` +
+        `  — or call installWindowsSandbox(), or run ` +
+        `\`srt-win.exe install ${g}${sl}\` directly —\n` +
+        `then LOG OUT and back in (the group SID enters TokenGroups at logon).\n` +
+        `Network is not disrupted before the logout: while the group is absent ` +
+        `from your token, WFP filter-0 PERMITs all traffic.`);
+}
+/**
+ * Check the Windows backend is ready to sandbox. Errors block
+ * `initialize()`; warnings are informational.
+ */
+export function checkWindowsDependencies(ref, sublayerGuid) {
+    const errors = [];
+    const warnings = [];
+    // 1. Binary present.
+    let exe;
+    try {
+        exe = getSrtWinPath();
+    }
+    catch (e) {
+        return { errors: [e.message], warnings };
+    }
+    logForDebugging(`[Sandbox Windows] using srt-win at ${exe}`);
+    // 2. Group ready (exists AND enabled in the caller's token).
+    let gs;
+    try {
+        gs = getWindowsGroupStatus(ref);
+    }
+    catch (e) {
+        errors.push(`srt-win group status failed: ${e.message}`);
+        return { errors, warnings };
+    }
+    if (gs.state !== 'ready') {
+        errors.push(`Discriminator group is ${gs.state}` +
+            (gs.sid ? ` (sid=${gs.sid})` : '') +
+            `. ` +
+            windowsInstallInstructions(ref, sublayerGuid, gs.state));
+    }
+    if (gs.warning)
+        warnings.push(gs.warning);
+    // 3. WFP filters installed under the sublayer.
+    let ws;
+    try {
+        ws = getWindowsWfpStatus({ sublayerGuid });
+    }
+    catch (e) {
+        errors.push(`srt-win wfp status failed: ${e.message}`);
+        return { errors, warnings };
+    }
+    if (ws.state !== 'installed') {
+        // If the group is also not-ready, the group-state error above
+        // already gave the right instruction; don't repeat. Only
+        // surface a separate WFP error when group IS ready (i.e.
+        // someone uninstalled filters but kept the group).
+        if (gs.state === 'ready') {
+            errors.push(`WFP filters not installed under sublayer ` +
+                `${sublayerGuid ?? '(default)'}. ` +
+                windowsInstallInstructions(ref, sublayerGuid, 'absent'));
+        }
+    }
+    else if (ws.portRange) {
+        logForDebugging(`[Sandbox Windows] WFP installed: ${ws.filters} filters, ` +
+            `proxy port range ${ws.portRange[0]}-${ws.portRange[1]}`);
+    }
+    return { errors, warnings };
+}
+//# sourceMappingURL=windows-sandbox-utils.js.map

package/dist/sandbox/windows-sandbox-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-sandbox-utils.js","sourceRoot":"","sources":["../../src/sandbox/windows-sandbox-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGzD;;;;;;;;;;;;;;;;GAgBG;AAEH,uEAAuE;AACvE,QAAQ;AACR,uEAAuE;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAA8B;IACzE,KAAK,EAAE,KAAK;CACb,CAAA;AAgDD,uEAAuE;AACvE,oBAAoB;AACpB,uEAAuE;AAEvE,SAAS,QAAQ;IACf,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACxC,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;QACxE,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,SAAS,EACT,aAAa,CACd;KACF,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,uEAAuE;QACvE,cAAc,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,0BAA0B;AAC1B,uEAAuE;AAEvE,SAAS,YAAY,CAAC,GAAoB;IACxC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAA;AAChE,CAAC;AAQD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAM,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAChC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAI,IAAc;IACtC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,4DAA4D;IAC5D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAM,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B;YACnD,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CACzD,CAAA;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,uBAAuB;AACvB,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB;IAEpB,OAAO,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,aAAa,CAItB,IAAI,CAAC,CAAA;IACR,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACtD,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,kCAAkC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACtE,CAAA;IAED,sCAAsC;IACtC,UAAU;IACV,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,6DAA6D;IAC7D,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAA;IAChC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC;YACJ,MAAK;QACP,KAAK,EAAE;YACL,OAAO;gBACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;QACjE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QACvE,KAAK,EAAE;YACL,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,qDAAqD;gBACrD,mEAAmE;gBACnE,WAAW,GAAG,EAAE,CACnB,CAAA;QACH;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkC,EAAE;IAG1E,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1B,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACtE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,eAAe,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxE,CAAA;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,+BAA+B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,CAAC,MAAM,KAAK;YAChD,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,mCAAmC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAGC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,oBAAoB,EACpB,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CACpD,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,oCAAoC,CAAC,CAAC,MAAM,KAAK;YAC/C,kDAAkD;YAClD,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CACpC,CAAA;IACH,CAAC;IACD,eAAe,CAAC,kCAAkC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED,uEAAuE;AACvE,OAAO;AACP,uEAAuE;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAAC,CAAuB;IAInE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEf,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAA;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACjD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GACT,KAAK,KAAK,MAAM;YACd,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,CAAA;QACP,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,OAAO,CACV,CAAA;IACH,CAAC;IAED,gEAAgE;IAChE,gDAAgD;IAChD,MAAM,SAAS,GAAG,eAAe,CAC/B,oBAAoB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,cAAc,CAAC,CACxD,CAAA;IACD,mEAAmE;IACnE,qEAAqE;IACrE,OAAO,SAAS,CAAC,MAAM,CAAA;IACvB,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAA;IAC/D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uEAAuE;AACvE,+BAA+B;AAC/B,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,YAAgC,EAChC,UAA8B;IAE9B,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,CACL,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,qEAAqE;YACrE,kBAAkB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ;QACpB,CAAC,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE;QAC/B,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,OAAO,CACL,8DAA8D;QAC9D,yCAAyC;QACzC,8CAA8C;QAC9C,yBAAyB,CAAC,GAAG,EAAE,iBAAiB;QAChD,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD,CACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,YAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,qBAAqB;IACrB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrD,CAAC;IACD,eAAe,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAE5D,6DAA6D;IAC7D,IAAI,EAA4B,CAAA;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0BAA0B,EAAE,CAAC,KAAK,EAAE;YAClC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI;YACJ,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IAEzC,+CAA+C;IAC/C,IAAI,EAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,EAAE,GAAG,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,yDAAyD;QACzD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CACT,2CAA2C;gBACzC,GAAG,YAAY,IAAI,WAAW,IAAI;gBAClC,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe,CACb,oCAAoC,EAAE,CAAC,OAAO,YAAY;YACxD,oBAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}