@sysid/sandbox-runtime-improved 0.0.55-sysid.1 → 0.0.61-sysid.1

package/dist/sandbox/sandbox-config.js

@@ -4,6 +4,7 @@
  */
 import { isAbsolute } from 'node:path';
 import { z } from 'zod';
+import { isInjectHostCoveredByAllowedDomains } from './domain-pattern.js';
 /**
  * Schema for domain patterns (e.g., "example.com", "*.npmjs.org")
  * Validates that domain patterns are safe and don't include overly broad wildcards
@@ -87,6 +88,100 @@ const ParentProxyConfigSchema = z.object({
         .describe('Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). ' +
         'Matching destinations connect directly instead of via the parent proxy.'),
 });
+/**
+ * Schema for the access mode of a declared credential source.
+ *
+ * - `deny` — the sandboxed process cannot read the file / does not see the
+ *   environment variable.
+ * - `mask` — the sandboxed process sees a per-session sentinel value; the
+ *   host proxy substitutes sentinel→real on egress to `injectHosts`.
+ *   For files this is whole-file masking (Linux only; degrades to `deny`
+ *   on macOS — see {@link CredentialFileConfigSchema}).
+ */
+const credentialModeSchema = z.enum(['deny', 'mask']);
+/**
+ * Schema for an environment variable name. Restricted to POSIX identifiers so
+ * the name can never be parsed as a flag by `env -u` (macOS) or bwrap
+ * `--unsetenv` (Linux).
+ */
+const envVarNameSchema = z
+    .string()
+    .regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores');
+/**
+ * Schema for a single credential file/directory entry.
+ *
+ * `mode: "mask"` is **whole-file** masking: the entire file content is
+ * replaced inside the sandbox with one sentinel string, and the proxy
+ * substitutes that sentinel back to the real bytes on egress. This works
+ * for files whose content *is* the credential (a token file, a single-line
+ * secret). It does **not** work for structured files a tool parses
+ * (`.netrc`, JSON/YAML configs) — the tool will fail to parse the sentinel.
+ * For those, prefer env-var masking where the tool supports it, or
+ * `mode: "deny"`. Format-aware extraction is a possible future extension.
+ *
+ * On macOS, SBPL cannot redirect reads, so `mode: "mask"` currently
+ * degrades to `mode: "deny"` (the file is unreadable inside the sandbox).
+ */
+export const CredentialFileConfigSchema = z.object({
+    path: filesystemPathSchema.describe('Path to a credential file or directory. Supports the same path forms as ' +
+        'filesystem.denyRead (absolute paths and ~ expansion).'),
+    mode: credentialModeSchema.describe('Access mode for this path'),
+    injectHosts: z
+        .array(domainPatternSchema)
+        .optional()
+        .describe('Optional narrowing of where the proxy substitutes this credential. ' +
+        'If unset, defaults to network.allowedDomains — the credential is ' +
+        'injected at every reachable host. Only meaningful when mode is ' +
+        '"mask"; accepted but ignored for "deny".'),
+});
+/**
+ * Schema for a single credential environment variable entry.
+ */
+export const CredentialEnvVarConfigSchema = z.object({
+    name: envVarNameSchema.describe('Environment variable name'),
+    mode: credentialModeSchema.describe('Access mode for this environment variable'),
+    injectHosts: z
+        .array(domainPatternSchema)
+        .optional()
+        .describe('Optional narrowing of where the proxy substitutes this credential. ' +
+        'If unset, defaults to network.allowedDomains — the credential is ' +
+        'injected at every reachable host. Only meaningful when mode is ' +
+        '"mask"; accepted but ignored for "deny".'),
+});
+/**
+ * Credentials configuration schema for validation.
+ *
+ * Declares credential sources (files and environment variables) with a
+ * per-source mode:
+ * - `deny` blocks the source inside the sandbox (file reads are denied via the
+ *   filesystem read-deny mechanism, env vars are unset in the child).
+ *
+ * Additional modes (e.g. `mask`) will be added in future releases.
+ *
+ * Only the sources declared here are affected; the section applies no
+ * implicit restrictions beyond them.
+ */
+export const CredentialsConfigSchema = z
+    .object({
+    files: z
+        .array(CredentialFileConfigSchema)
+        .optional()
+        .describe('Credential files or directories to protect'),
+    envVars: z
+        .array(CredentialEnvVarConfigSchema)
+        .optional()
+        .describe('Environment variables to protect'),
+    allowPlaintextInject: z
+        .boolean()
+        .optional()
+        .describe('Allow sentinel→real substitution on the plain-HTTP proxy path. ' +
+        'Defaults to false: without TLS termination the upstream identity ' +
+        'is unverified and the credential travels in cleartext. Set only ' +
+        'for trusted-network test fixtures.'),
+})
+    // Reject unknown keys so a stale `credentials.injectHosts` (the removed
+    // block-level default) fails loudly instead of being silently stripped.
+    .strict();
 /**
  * Network configuration schema for validation
  */
@@ -164,6 +259,21 @@ export const NetworkConfigSchema = z.object({
             .min(1)
             .optional()
             .describe('Path to the PEM-encoded private key for caCertPath.'),
+        excludeDomains: z
+            .array(domainPatternSchema)
+            .optional()
+            .describe('Domain patterns (same syntax as allowedDomains) whose HTTPS ' +
+            'connections are NOT terminated. Matching CONNECTs are opaque ' +
+            'byte tunnels: still subject to the allow/deny domain lists, ' +
+            'but the sandboxed client completes its own TLS handshake with ' +
+            'the upstream, so filterRequest and credential injection do not ' +
+            'apply to their HTTPS traffic (plain-HTTP requests to the same ' +
+            'hosts keep the normal request pipeline). Use for hosts the ' +
+            'proxy must not re-originate: ' +
+            'mTLS upstreams (only the client holds the client certificate) ' +
+            'and clients that pin the upstream certificate and would reject ' +
+            'the MITM CA. Hosts still need to be reachable via ' +
+            'allowedDomains; this list only changes how they are tunnelled.'),
     })
         .refine(o => !o.caCertPath === !o.caKeyPath, {
         message: 'caCertPath and caKeyPath must be provided together',
@@ -181,6 +291,15 @@ export const NetworkConfigSchema = z.object({
  * Filesystem configuration schema for validation
  */
 export const FilesystemConfigSchema = z.object({
+    disabled: z
+        .boolean()
+        .optional()
+        .describe('Disable all filesystem policy enforcement. When true, no read or write rules are emitted: ' +
+        'denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write ' +
+        'protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, ' +
+        '.claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process ' +
+        'is trusted with full host filesystem access. Network and credential-env restrictions ' +
+        'still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs.'),
     denyRead: z.array(filesystemPathSchema).describe('Paths denied for reading'),
     allowRead: z
         .array(filesystemPathSchema)
@@ -244,6 +363,14 @@ export const WindowsConfigSchema = z.object({
         .describe('WFP sublayer GUID under which the filters were installed. Omit to ' +
         'use the srt-win compile-time default. Set this when filters were ' +
         'installed by enterprise tooling under a custom sublayer.'),
+    asSandboxUser: z
+        .boolean()
+        .default(false)
+        .describe('Run sandboxed commands as the dedicated `srt-sandbox` local user ' +
+        '(two-hop launch via CreateProcessWithLogonW) instead of the ' +
+        'same-user deny-only-group token. Requires `srt-win install` to ' +
+        'have provisioned the user. Opt-in while the separate-user path ' +
+        'stabilises; the same-user path is unchanged when false.'),
     proxyPortRange: z
         .tuple([z.number().int().min(1), z.number().int().max(65535)])
         .refine(([lo, hi]) => lo <= hi && hi - lo <= 64, {
@@ -273,9 +400,12 @@ export const SeccompConfigSchema = z.object({
 /**
  * Main configuration schema for Sandbox Runtime validation
  */
-export const SandboxRuntimeConfigSchema = z.object({
+export const SandboxRuntimeConfigSchema = z
+    .object({
     network: NetworkConfigSchema.describe('Network restrictions configuration'),
     filesystem: FilesystemConfigSchema.describe('Filesystem restrictions configuration'),
+    credentials: CredentialsConfigSchema.optional().describe('Credential handling configuration. Only the explicitly declared files ' +
+        'and environment variables are restricted.'),
     ignoreViolations: IgnoreViolationsConfigSchema.optional().describe('Optional configuration for ignoring specific violations'),
     enableWeakerNestedSandbox: z
         .boolean()
@@ -328,5 +458,126 @@ export const SandboxRuntimeConfigSchema = z.object({
         .describe('Linux only: absolute path to the socat binary. ' +
         'When set, this path is used directly instead of resolving "socat" via PATH.'),
     windows: WindowsConfigSchema.optional().describe('Windows-specific settings (group, WFP sublayer, proxy port range).'),
+})
+    .superRefine((cfg, ctx) => {
+    const creds = cfg.credentials;
+    if (!creds)
+        return;
+    // Every per-entry injectHosts pattern must be reachable via
+    // allowedDomains — semantic (wildcard-aware) coverage, not literal
+    // string membership, so `injectHosts: ['api.github.com']` is accepted
+    // when `allowedDomains: ['*.github.com']`.
+    const allowed = cfg.network.allowedDomains;
+    const checkSubset = (hosts, path) => {
+        for (const [i, host] of hosts.entries()) {
+            if (!isInjectHostCoveredByAllowedDomains(host, allowed)) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: [...path, i],
+                    message: `injectHosts entry "${host}" is not reachable via ` +
+                        `network.allowedDomains — add "${host}" (or a covering ` +
+                        `wildcard) to allowedDomains, or remove it from injectHosts.`,
+                });
+            }
+        }
+    };
+    // Per-credential checks. Substitution is gated per sentinel; an entry
+    // with no injectHosts defaults to network.allowedDomains (every
+    // reachable host), so absence is fine. An *explicit* empty list is
+    // rejected — "mask but never inject" is self-contradictory and almost
+    // certainly a config mistake. Applies to both env vars and files.
+    let hasMasked = false;
+    const checkMaskedEntry = (entry, path) => {
+        if (entry.injectHosts) {
+            checkSubset(entry.injectHosts, [...path, 'injectHosts']);
+        }
+        if (entry.mode !== 'mask')
+            return;
+        hasMasked = true;
+        // Credential substitution only runs on the TLS-terminated path, so a
+        // host covered by tlsTerminate.excludeDomains can never receive the
+        // real value — the upstream sees the placeholder. Reject the
+        // spellings that are *entirely* self-contradictory:
+        //   - an explicit injectHosts entry whose every concrete host is
+        //     excluded (isInjectHostCoveredByAllowedDomains is the generic
+        //     "pattern fully covered by pattern list" predicate);
+        //   - no injectHosts (= every allowedDomain) while excludeDomains
+        //     covers all of allowedDomains, i.e. injection could never
+        //     happen anywhere.
+        // A *partial* overlap is legitimate (excluded hosts simply don't get
+        // the credential) and is reported at runtime instead.
+        const exclude = cfg.network.tlsTerminate?.excludeDomains;
+        if (exclude?.length) {
+            if (entry.injectHosts) {
+                for (const [i, host] of entry.injectHosts.entries()) {
+                    if (isInjectHostCoveredByAllowedDomains(host, exclude)) {
+                        ctx.addIssue({
+                            code: z.ZodIssueCode.custom,
+                            path: [...path, 'injectHosts', i],
+                            message: `injectHosts entry "${host}" is entirely covered by ` +
+                                `network.tlsTerminate.excludeDomains. Credential ` +
+                                `injection only runs on TLS-terminated connections, so ` +
+                                `this host would receive the placeholder instead of the ` +
+                                `credential. Remove it from one of the two lists.`,
+                        });
+                    }
+                }
+            }
+            else if (allowed.length > 0 &&
+                allowed.every(p => isInjectHostCoveredByAllowedDomains(p, exclude))) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path,
+                    message: `This masked credential has no injectHosts, so it defaults ` +
+                        `to network.allowedDomains — but ` +
+                        `network.tlsTerminate.excludeDomains covers every allowed ` +
+                        `domain, so it could never be injected anywhere. Credential ` +
+                        `injection only runs on TLS-terminated connections.`,
+                });
+            }
+        }
+        if (entry.injectHosts !== undefined && entry.injectHosts.length === 0) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path,
+                message: `injectHosts is explicitly empty — the credential would be ` +
+                    `masked but never injected. Omit injectHosts to default to ` +
+                    `network.allowedDomains, or list the intended hosts.`,
+            });
+        }
+    };
+    for (const [idx, v] of (creds.envVars ?? []).entries()) {
+        checkMaskedEntry(v, ['credentials', 'envVars', idx]);
+    }
+    for (const [idx, f] of (creds.files ?? []).entries()) {
+        checkMaskedEntry(f, ['credentials', 'files', idx]);
+        // Whole-file masking replaces one file's bytes with one sentinel;
+        // a directory has no single content to mask. The hard check is at
+        // runtime (stat after path normalization) — this catches the obvious
+        // syntactic case (trailing slash) early with a clearer error.
+        if (f.mode === 'mask' && f.path.endsWith('/')) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['credentials', 'files', idx, 'path'],
+                message: `Credential mode "mask" applies to a single file, not a ` +
+                    `directory. Use mode "deny" for "${f.path}", or point at the ` +
+                    `credential file inside it.`,
+            });
+        }
+    }
+    // Masked credentials require the TLS-terminated proxy path so the real
+    // value is only sent to a cert-verified upstream. allowPlaintextInject
+    // is the explicit escape hatch.
+    if (hasMasked &&
+        cfg.network.tlsTerminate === undefined &&
+        !creds.allowPlaintextInject) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['credentials'],
+            message: 'Credential masking requires network.tlsTerminate so substitution ' +
+                'runs only over a verified TLS connection. Enable tlsTerminate, or ' +
+                'set credentials.allowPlaintextInject to opt out (not recommended).',
+        });
+    }
 });
 //# sourceMappingURL=sandbox-config.js.map

package/dist/sandbox/sandbox-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;SACrD,QAAQ,CACP,wFAAwF,CACzF;IACH,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,yKAAyK,CAC1K;IACH,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,qBAAqB,CAAC;SAC9B,QAAQ,CACP,oEAAoE;QAClE,mCAAmC,CACtC;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC7C,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,uDAAuD,CAC1D;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,0DAA0D,CAC7D;IACH,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/C,OAAO,EAAE,yCAAyC;KACnD,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,yCAAyC,CAC5C;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,8FAA8F;QAC9F,wFAAwF;QACxF,iBAAiB,CACpB;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,oEAAoE,CACrE;CACF,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAA;AAEzE;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CACJ,0BAA0B,EAC1B,oHAAoH,CACrH,CAAA;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CACjC,0EAA0E;QACxE,uDAAuD,CAC1D;IACD,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAChE,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,0CAA0C,CAC7C;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC5D,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CACjC,2CAA2C,CAC5C;IACD,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,0CAA0C,CAC7C;CACJ,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,0BAA0B,CAAC;SACjC,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,QAAQ,EAAE;SACV,QAAQ,CAAC,kCAAkC,CAAC;IAC/C,oBAAoB,EAAE,CAAC;SACpB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iEAAiE;QAC/D,mEAAmE;QACnE,kEAAkE;QAClE,oCAAoC,CACvC;CACJ,CAAC;IACF,wEAAwE;IACxE,wEAAwE;KACvE,MAAM,EAAE,CAAA;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;SACrD,QAAQ,CACP,wFAAwF,CACzF;IACH,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,yKAAyK,CAC1K;IACH,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;QAClE,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,mBAAmB,CAAC;aAC1B,QAAQ,EAAE;aACV,QAAQ,CACP,8DAA8D;YAC5D,+DAA+D;YAC/D,8DAA8D;YAC9D,gEAAgE;YAChE,iEAAiE;YACjE,gEAAgE;YAChE,6DAA6D;YAC7D,+BAA+B;YAC/B,gEAAgE;YAChE,iEAAiE;YACjE,oDAAoD;YACpD,gEAAgE,CACnE;KACJ,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,4FAA4F;QAC1F,wFAAwF;QACxF,kFAAkF;QAClF,yFAAyF;QACzF,uFAAuF;QACvF,8EAA8E,CACjF;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,qBAAqB,CAAC;SAC9B,QAAQ,CACP,oEAAoE;QAClE,mCAAmC,CACtC;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC7C,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,uDAAuD,CAC1D;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,0DAA0D,CAC7D;IACH,aAAa,EAAE,CAAC;SACb,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,mEAAmE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,yDAAyD,CAC5D;IACH,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/C,OAAO,EAAE,yCAAyC;KACnD,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,yCAAyC,CAC5C;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,wEAAwE;QACtE,2CAA2C,CAC9C;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,8FAA8F;QAC9F,wFAAwF;QACxF,iBAAiB,CACpB;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,oEAAoE,CACrE;CACF,CAAC;KACD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAA;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAM;IAElB,4DAA4D;IAC5D,mEAAmE;IACnE,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAA;IAC1C,MAAM,WAAW,GAAG,CAClB,KAAwB,EACxB,IAAyB,EACzB,EAAE;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,mCAAmC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;oBAClB,OAAO,EACL,sBAAsB,IAAI,yBAAyB;wBACnD,iCAAiC,IAAI,mBAAmB;wBACxD,6DAA6D;iBAChE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,sEAAsE;IACtE,gEAAgE;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,MAAM,gBAAgB,GAAG,CACvB,KAA+C,EAC/C,IAAyB,EACzB,EAAE;QACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAM;QACjC,SAAS,GAAG,IAAI,CAAA;QAChB,qEAAqE;QACrE,oEAAoE;QACpE,6DAA6D;QAC7D,oDAAoD;QACpD,iEAAiE;QACjE,mEAAmE;QACnE,0DAA0D;QAC1D,kEAAkE;QAClE,+DAA+D;QAC/D,uBAAuB;QACvB,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAA;QACxD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;oBACpD,IAAI,mCAAmC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,QAAQ,CAAC;4BACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;4BAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;4BACjC,OAAO,EACL,sBAAsB,IAAI,2BAA2B;gCACrD,kDAAkD;gCAClD,wDAAwD;gCACxD,yDAAyD;gCACzD,kDAAkD;yBACrD,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IACL,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EACnE,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI;oBACJ,OAAO,EACL,4DAA4D;wBAC5D,kCAAkC;wBAClC,2DAA2D;wBAC3D,6DAA6D;wBAC7D,oDAAoD;iBACvD,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI;gBACJ,OAAO,EACL,4DAA4D;oBAC5D,4DAA4D;oBAC5D,qDAAqD;aACxD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,gBAAgB,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,gBAAgB,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;gBAC3C,OAAO,EACL,yDAAyD;oBACzD,mCAAmC,CAAC,CAAC,IAAI,qBAAqB;oBAC9D,4BAA4B;aAC/B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,gCAAgC;IAChC,IACE,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;QACtC,CAAC,KAAK,CAAC,oBAAoB,EAC3B,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mEAAmE;gBACnE,oEAAoE;gBACpE,oEAAoE;SACvE,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/sandbox/sandbox-manager.d.ts

@@ -1,3 +1,5 @@
+import { SentinelRegistry } from './credential-sentinel.js';
+import { MaskedFileStore } from './credential-mask-files.js';
 import { type MitmCA } from './mitm-ca.js';
 import type { SandboxRuntimeConfig } from './sandbox-config.js';
 import type { SandboxAskCallback, FsReadRestrictionConfig, FsWriteRestrictionConfig, NetworkRestrictionConfig } from './sandbox-schemas.js';
@@ -38,6 +40,8 @@ export interface ISandboxManager {
     getLinuxGlobPatternWarnings(): string[];
     getConfig(): SandboxRuntimeConfig | undefined;
     getMitmCA(): MitmCA | undefined;
+    getSentinelRegistry(): SentinelRegistry;
+    getMaskedFileStore(): MaskedFileStore;
     updateConfig(newConfig: SandboxRuntimeConfig): void;
     cleanupAfterCommand(): void;
     reset(): Promise<void>;

package/dist/sandbox/sandbox-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAMvE,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAmBjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA4tCpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;KAAE,CAAC,CAAA;IACtD,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA6BnB,CAAA"}
+{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EACL,eAAe,EAEhB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAMvE,OAAO,KAAK,EAEV,oBAAoB,EAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,kBAAkB,EAElB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AA4BjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAsuDpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;KAAE,CAAC,CAAA;IACtD,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,mBAAmB,IAAI,gBAAgB,CAAA;IACvC,kBAAkB,IAAI,eAAe,CAAA;IACrC,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA+BnB,CAAA"}