@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.64-sysid.1

package/dist/sandbox/sandbox-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAgEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;;;;;;;GAQG;AACH,QAAA,MAAM,oBAAoB,oEAOtB,CAAA;AAcJ;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;EAMrC,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;EAKvC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASlC,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoH9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;EAqBjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAsC9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiFrC,CAAA;AAGF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACjE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAiEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;;;;;;;;GASG;AACH,QAAA,MAAM,oBAAoB,6BAA2B,CAAA;AAiDrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0BAA0B;;;;IAerC;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;;;;;;;;;;;EAgCH,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;EAcvC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;QAnFlC;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwFM,CAAA;AAEX;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkJ9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAgCjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;;EAW7B,CAAA;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6C9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAzarC;;;;;;;;;;;;;;;;;eAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmnBD,CAAA;AAGJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACjE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}

package/dist/sandbox/sandbox-config.js

@@ -4,6 +4,7 @@
  */
 import { isAbsolute } from 'node:path';
 import { z } from 'zod';
+import { isInjectHostCoveredByAllowedDomains } from './domain-pattern.js';
 /**
  * Schema for domain patterns (e.g., "example.com", "*.npmjs.org")
  * Validates that domain patterns are safe and don't include overly broad wildcards
@@ -92,17 +93,12 @@ const ParentProxyConfigSchema = z.object({
  *
  * - `deny` — the sandboxed process cannot read the file / does not see the
  *   environment variable.
- * - `mask` — reserved for credential masking; rejected until masking ships.
- *
- * Additional modes (e.g. a working `mask`) will be added in future releases.
+ * - `mask` — the sandboxed process sees a per-session sentinel value; the
+ *   host proxy substitutes sentinel→real on egress to `injectHosts`.
+ *   For files this is whole-file masking (Linux only; degrades to `deny`
+ *   on macOS — see {@link CredentialFileConfigSchema}).
  */
-const credentialModeSchema = z
-    .enum(['deny', 'mask'])
-    .refine(mode => mode !== 'mask', {
-    message: 'Credential mode "mask" is not supported yet. Use "deny" to block the ' +
-        'credential inside the sandbox, or omit the entry to leave it ' +
-        'unrestricted; masking will be added in a future release.',
-});
+const credentialModeSchema = z.enum(['deny', 'mask']);
 /**
  * Schema for an environment variable name. Restricted to POSIX identifiers so
  * the name can never be parsed as a flag by `env -u` (macOS) or bwrap
@@ -111,13 +107,124 @@ const credentialModeSchema = z
 const envVarNameSchema = z
     .string()
     .regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores');
+/**
+ * Schema for the optional structured-extraction regex on a masked file.
+ *
+ * Validates that the string compiles as a JavaScript RegExp and declares at
+ * least one capturing group — capture group 1 is the contract for "the
+ * credential value to mask". A pattern with zero groups would silently mask
+ * nothing useful, so it is rejected at config time rather than at runtime.
+ *
+ * Group count is determined by appending `|` (alternation with empty) and
+ * matching the empty string: the result array length is `1 + groupCount`,
+ * which counts capturing groups (including named ones) and ignores
+ * non-capturing `(?:…)`.
+ */
+const extractPatternSchema = z.string().superRefine((val, ctx) => {
+    let re;
+    try {
+        re = new RegExp(val);
+    }
+    catch (err) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `extract is not a valid regular expression: ${err.message}`,
+        });
+        return;
+    }
+    const groupCount = new RegExp(re.source + '|').exec('').length - 1;
+    if (groupCount < 1) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'extract must contain at least one capturing group — group 1 is ' +
+                'the credential value to mask (e.g. "token:\\s*(\\S+)").',
+        });
+    }
+});
 /**
  * Schema for a single credential file/directory entry.
+ *
+ * `mode: "mask"` without `extract` is **whole-file** masking: the entire
+ * file content is replaced inside the sandbox with one sentinel string,
+ * and the proxy substitutes that sentinel back to the real bytes on egress.
+ * This works for files whose content *is* the credential (a token file, a
+ * single-line secret).
+ *
+ * `mode: "mask"` with `extract` is **structured** masking: the regex is
+ * applied globally to the real file, capture group 1 of each match is a
+ * credential value, and only those captured spans are replaced with
+ * sentinels — the rest of the file is preserved byte-for-byte. This lets a
+ * tool that parses the file (`.netrc`, JSON/YAML configs) still succeed
+ * inside the sandbox while the credential values are protected. If the
+ * pattern matches nothing, behaviour is governed by `onExtractNoMatch`
+ * (default `"warn"` — the file is left readable as-is and a stderr
+ * warning is emitted).
+ *
+ * `maskDuplicates: true` (only meaningful with `extract`) additionally
+ * replaces every verbatim occurrence of each captured value *outside* the
+ * regex-matched spans — for a secret repeated where the regex does not
+ * reach (e.g. pasted into a comment). The scan is raw substring matching,
+ * so a short or common captured value may also hit unrelated content that
+ * happens to contain it; intended for long, high-entropy secrets.
+ *
+ * On macOS, SBPL cannot redirect reads, so `mode: "mask"` (with or without
+ * `extract`) currently degrades to `mode: "deny"` (the file is unreadable
+ * inside the sandbox).
  */
 export const CredentialFileConfigSchema = z.object({
     path: filesystemPathSchema.describe('Path to a credential file or directory. Supports the same path forms as ' +
         'filesystem.denyRead (absolute paths and ~ expansion).'),
     mode: credentialModeSchema.describe('Access mode for this path'),
+    extract: extractPatternSchema
+        .optional()
+        .describe('Optional regex for structured masking. Applied globally; capture ' +
+        'group 1 of each match is masked, the rest of the file is preserved. ' +
+        'If the pattern matches nothing, behaviour is governed by ' +
+        'onExtractNoMatch (default "warn"). Only meaningful when mode is ' +
+        '"mask"; accepted but ignored for "deny".'),
+    /**
+     * What to do when `extract` matches nothing in the file at runtime.
+     *
+     * - `"warn"` (default): emit a stderr warning and leave the file
+     *   readable as-is inside the sandbox (fail-open). A non-matching
+     *   pattern is treated as a config error to surface and fix, not a
+     *   reason to break a tool that needs the file when the credential is
+     *   legitimately absent.
+     * - `"deny"`: degrade the entry to `mode: "deny"` so the file is
+     *   unreadable inside the sandbox (fail-closed). The operator declared
+     *   this file as containing a credential; if the regex cannot find it,
+     *   block access rather than expose it.
+     * - `"error"`: throw at wrap time so nothing runs until the operator
+     *   fixes the regex.
+     *
+     * Only meaningful when `mode` is `"mask"` and `extract` is set;
+     * accepted but ignored otherwise.
+     */
+    onExtractNoMatch: z
+        .enum(['warn', 'deny', 'error'])
+        .optional()
+        .describe('What to do when extract matches nothing: "warn" (default — stderr ' +
+        'warning, file left readable), "deny" (degrade to mode "deny" — ' +
+        'file unreadable), or "error" (throw at wrap time). Only meaningful ' +
+        'with mode "mask" and extract set.'),
+    maskDuplicates: z
+        .boolean()
+        .optional()
+        .describe('If true, verbatim occurrences of each captured credential value ' +
+        'outside the regex-matched spans are also replaced with the ' +
+        'corresponding sentinel — for a secret repeated where the regex ' +
+        'does not reach (e.g. in a comment). Matches raw substrings: short ' +
+        'or common credential values may corrupt unrelated content, so ' +
+        'this is intended for long, high-entropy secrets. Defaults to ' +
+        'false. Only meaningful with mode "mask" and extract; accepted ' +
+        'but ignored otherwise.'),
+    injectHosts: z
+        .array(domainPatternSchema)
+        .optional()
+        .describe('Optional narrowing of where the proxy substitutes this credential. ' +
+        'If unset, defaults to network.allowedDomains — the credential is ' +
+        'injected at every reachable host. Only meaningful when mode is ' +
+        '"mask"; accepted but ignored for "deny".'),
 });
 /**
  * Schema for a single credential environment variable entry.
@@ -125,6 +232,13 @@ export const CredentialFileConfigSchema = z.object({
 export const CredentialEnvVarConfigSchema = z.object({
     name: envVarNameSchema.describe('Environment variable name'),
     mode: credentialModeSchema.describe('Access mode for this environment variable'),
+    injectHosts: z
+        .array(domainPatternSchema)
+        .optional()
+        .describe('Optional narrowing of where the proxy substitutes this credential. ' +
+        'If unset, defaults to network.allowedDomains — the credential is ' +
+        'injected at every reachable host. Only meaningful when mode is ' +
+        '"mask"; accepted but ignored for "deny".'),
 });
 /**
  * Credentials configuration schema for validation.
@@ -139,7 +253,8 @@ export const CredentialEnvVarConfigSchema = z.object({
  * Only the sources declared here are affected; the section applies no
  * implicit restrictions beyond them.
  */
-export const CredentialsConfigSchema = z.object({
+export const CredentialsConfigSchema = z
+    .object({
     files: z
         .array(CredentialFileConfigSchema)
         .optional()
@@ -148,7 +263,17 @@ export const CredentialsConfigSchema = z.object({
         .array(CredentialEnvVarConfigSchema)
         .optional()
         .describe('Environment variables to protect'),
-});
+    allowPlaintextInject: z
+        .boolean()
+        .optional()
+        .describe('Allow sentinel→real substitution on the plain-HTTP proxy path. ' +
+        'Defaults to false: without TLS termination the upstream identity ' +
+        'is unverified and the credential travels in cleartext. Set only ' +
+        'for trusted-network test fixtures.'),
+})
+    // Reject unknown keys so a stale `credentials.injectHosts` (the removed
+    // block-level default) fails loudly instead of being silently stripped.
+    .strict();
 /**
  * Network configuration schema for validation
  */
@@ -226,6 +351,32 @@ export const NetworkConfigSchema = z.object({
             .min(1)
             .optional()
             .describe('Path to the PEM-encoded private key for caCertPath.'),
+        excludeDomains: z
+            .array(domainPatternSchema)
+            .optional()
+            .describe('Domain patterns (same syntax as allowedDomains) whose HTTPS ' +
+            'connections are NOT terminated. Matching CONNECTs are opaque ' +
+            'byte tunnels: still subject to the allow/deny domain lists, ' +
+            'but the sandboxed client completes its own TLS handshake with ' +
+            'the upstream, so filterRequest and credential injection do not ' +
+            'apply to their HTTPS traffic (plain-HTTP requests to the same ' +
+            'hosts keep the normal request pipeline). Use for hosts the ' +
+            'proxy must not re-originate: ' +
+            'mTLS upstreams (only the client holds the client certificate) ' +
+            'and clients that pin the upstream certificate and would reject ' +
+            'the MITM CA. Hosts still need to be reachable via ' +
+            'allowedDomains; this list only changes how they are tunnelled.'),
+        extraCaCertPaths: z
+            .array(z.string().min(1))
+            .optional()
+            .describe('Paths to PEM CA certificate files appended to the trust bundle ' +
+            'the sandboxed child is pointed at, after the MITM CA and the ' +
+            "host's regular roots. Use for site-local roots (e.g. an " +
+            'internal mTLS CA) presented by excluded/passthrough hosts, so ' +
+            'the child can verify them itself. Only the CERTIFICATE blocks ' +
+            'of each file are copied; files that are missing, unreadable, ' +
+            'or contain no PEM CERTIFICATE block are skipped (with a debug ' +
+            'log), so paths that exist on only some hosts are safe to list.'),
     })
         .refine(o => !o.caCertPath === !o.caKeyPath, {
         message: 'caCertPath and caKeyPath must be provided together',
@@ -243,6 +394,15 @@ export const NetworkConfigSchema = z.object({
  * Filesystem configuration schema for validation
  */
 export const FilesystemConfigSchema = z.object({
+    disabled: z
+        .boolean()
+        .optional()
+        .describe('Disable all filesystem policy enforcement. When true, no read or write rules are emitted: ' +
+        'denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write ' +
+        'protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, ' +
+        '.claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process ' +
+        'is trusted with full host filesystem access. Network and credential-env restrictions ' +
+        'still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs.'),
     denyRead: z.array(filesystemPathSchema).describe('Paths denied for reading'),
     allowRead: z
         .array(filesystemPathSchema)
@@ -281,41 +441,75 @@ export const RipgrepConfigSchema = z.object({
         .optional()
         .describe('Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])'),
 });
+/**
+ * Configuration for locating/invoking the `srt-win` helper (Windows
+ * only). An embedder that links `srt-win`'s CLI into its own
+ * multicall binary points `path` at that binary; spawns then pass
+ * `--srt-win` as `argv[1]` (see `SRT_WIN_DISPATCH_ARG1` in
+ * `windows-sandbox-utils.ts` / `srt_win::SRT_WIN_DISPATCH_ARG1`) so
+ * the embedder's dispatcher can route to `srt_win::run_from_args`.
+ * Windows cannot reliably preserve a spoofed `argv[0]` across
+ * `CreateProcessWithLogonW` / `ShellExecuteExW(runas)`, so dispatch
+ * keys on `argv[1]`, not on `argv[0]` like
+ * {@link SeccompConfigSchema} does on Linux.
+ */
+export const SrtWinConfigSchema = z.object({
+    path: z
+        .string()
+        .min(1)
+        .optional()
+        .describe('Path to the srt-win binary. When unset, getSrtWinPath() resolves ' +
+        'the packaged vendor/srt-win/<arch>/srt-win.exe. When set, the ' +
+        'binary is spawned with the `--srt-win` argv[1] sentinel so a ' +
+        "multicall dispatcher can route to srt-win's CLI."),
+});
 /**
  * Windows-specific configuration schema. See
  * `windows-sandbox-utils.ts` for the install flow these settings
  * must agree with.
+ *
+ * Canonical: `sublayerGuid`; the `wfpSublayerGuid` alias is resolved
+ * at read sites (`sublayerGuid ?? wfpSublayerGuid`) rather than via
+ * `.transform()` so this stays a plain `ZodObject` for consumers that
+ * `.extend()`/`.shape` it.
  */
 export const WindowsConfigSchema = z.object({
-    groupName: z
+    sandboxUser: z
         .string()
         .min(1)
-        .default('sandbox-runtime-net')
-        .describe('Discriminator group name. Must match the group created at install ' +
-        'time. Ignored if groupSid is set.'),
-    groupSid: z
-        .string()
-        .regex(/^S-1-/, 'must be an S-1-… SID string')
+        .max(20, 'Windows local usernames are limited to 20 characters')
         .optional()
-        .describe('Discriminator group SID. Overrides groupName lookup — use for ' +
-        'domain groups or where name resolution is unreliable.'),
-    wfpSublayerGuid: z
+        .describe('Name for the dedicated sandbox user account that `srt-win install` ' +
+        'creates and the sandboxed child runs as. Default: `srt-sandbox`. ' +
+        'Install refuses if an account by this name already exists and ' +
+        'srt-win did not create it (it will not rotate the password of an ' +
+        'account it does not own). Must match what `srt-win install ' +
+        '--sandbox-user` was run with.'),
+    sublayerGuid: z
         .string()
         .uuid()
         .optional()
         .describe('WFP sublayer GUID under which the filters were installed. Omit to ' +
         'use the srt-win compile-time default. Set this when filters were ' +
         'installed by enterprise tooling under a custom sublayer.'),
+    wfpSublayerGuid: z
+        .string()
+        .uuid()
+        .optional()
+        .describe('Deprecated alias for sublayerGuid.'),
     proxyPortRange: z
         .tuple([z.number().int().min(1), z.number().int().max(65535)])
         .refine(([lo, hi]) => lo <= hi && hi - lo <= 64, {
         message: 'low must be ≤ high and range width ≤ 64',
     })
         .optional()
-        .describe('Inclusive [low, high] port range the JS http/socks proxies bind ' +
-        'inside. MUST match the range passed to `srt-win wfp install ' +
+        .describe('Inclusive [low, high] port range the JS mux proxy listeners bind ' +
+        'inside. MUST match the range passed to `srt-win install ' +
         '--proxy-port-range` (default 60080–60089) — the WFP loopback ' +
         'permit only covers ports in that range.'),
+    srtWin: SrtWinConfigSchema.optional().describe('How to locate/invoke the srt-win helper binary. Omit to resolve the ' +
+        'packaged vendor binary; set when embedding srt-win into a multicall ' +
+        'binary.'),
 });
 /**
  * Seccomp configuration schema (Linux only)
@@ -335,7 +529,8 @@ export const SeccompConfigSchema = z.object({
 /**
  * Main configuration schema for Sandbox Runtime validation
  */
-export const SandboxRuntimeConfigSchema = z.object({
+export const SandboxRuntimeConfigSchema = z
+    .object({
     network: NetworkConfigSchema.describe('Network restrictions configuration'),
     filesystem: FilesystemConfigSchema.describe('Filesystem restrictions configuration'),
     credentials: CredentialsConfigSchema.optional().describe('Credential handling configuration. Only the explicitly declared files ' +
@@ -391,6 +586,127 @@ export const SandboxRuntimeConfigSchema = z.object({
         .optional()
         .describe('Linux only: absolute path to the socat binary. ' +
         'When set, this path is used directly instead of resolving "socat" via PATH.'),
-    windows: WindowsConfigSchema.optional().describe('Windows-specific settings (group, WFP sublayer, proxy port range).'),
+    windows: WindowsConfigSchema.optional().describe('Windows-specific settings (WFP sublayer, proxy port range).'),
+})
+    .superRefine((cfg, ctx) => {
+    const creds = cfg.credentials;
+    if (!creds)
+        return;
+    // Every per-entry injectHosts pattern must be reachable via
+    // allowedDomains — semantic (wildcard-aware) coverage, not literal
+    // string membership, so `injectHosts: ['api.github.com']` is accepted
+    // when `allowedDomains: ['*.github.com']`.
+    const allowed = cfg.network.allowedDomains;
+    const checkSubset = (hosts, path) => {
+        for (const [i, host] of hosts.entries()) {
+            if (!isInjectHostCoveredByAllowedDomains(host, allowed)) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: [...path, i],
+                    message: `injectHosts entry "${host}" is not reachable via ` +
+                        `network.allowedDomains — add "${host}" (or a covering ` +
+                        `wildcard) to allowedDomains, or remove it from injectHosts.`,
+                });
+            }
+        }
+    };
+    // Per-credential checks. Substitution is gated per sentinel; an entry
+    // with no injectHosts defaults to network.allowedDomains (every
+    // reachable host), so absence is fine. An *explicit* empty list is
+    // rejected — "mask but never inject" is self-contradictory and almost
+    // certainly a config mistake. Applies to both env vars and files.
+    let hasMasked = false;
+    const checkMaskedEntry = (entry, path) => {
+        if (entry.injectHosts) {
+            checkSubset(entry.injectHosts, [...path, 'injectHosts']);
+        }
+        if (entry.mode !== 'mask')
+            return;
+        hasMasked = true;
+        // Credential substitution only runs on the TLS-terminated path, so a
+        // host covered by tlsTerminate.excludeDomains can never receive the
+        // real value — the upstream sees the placeholder. Reject the
+        // spellings that are *entirely* self-contradictory:
+        //   - an explicit injectHosts entry whose every concrete host is
+        //     excluded (isInjectHostCoveredByAllowedDomains is the generic
+        //     "pattern fully covered by pattern list" predicate);
+        //   - no injectHosts (= every allowedDomain) while excludeDomains
+        //     covers all of allowedDomains, i.e. injection could never
+        //     happen anywhere.
+        // A *partial* overlap is legitimate (excluded hosts simply don't get
+        // the credential) and is reported at runtime instead.
+        const exclude = cfg.network.tlsTerminate?.excludeDomains;
+        if (exclude?.length) {
+            if (entry.injectHosts) {
+                for (const [i, host] of entry.injectHosts.entries()) {
+                    if (isInjectHostCoveredByAllowedDomains(host, exclude)) {
+                        ctx.addIssue({
+                            code: z.ZodIssueCode.custom,
+                            path: [...path, 'injectHosts', i],
+                            message: `injectHosts entry "${host}" is entirely covered by ` +
+                                `network.tlsTerminate.excludeDomains. Credential ` +
+                                `injection only runs on TLS-terminated connections, so ` +
+                                `this host would receive the placeholder instead of the ` +
+                                `credential. Remove it from one of the two lists.`,
+                        });
+                    }
+                }
+            }
+            else if (allowed.length > 0 &&
+                allowed.every(p => isInjectHostCoveredByAllowedDomains(p, exclude))) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path,
+                    message: `This masked credential has no injectHosts, so it defaults ` +
+                        `to network.allowedDomains — but ` +
+                        `network.tlsTerminate.excludeDomains covers every allowed ` +
+                        `domain, so it could never be injected anywhere. Credential ` +
+                        `injection only runs on TLS-terminated connections.`,
+                });
+            }
+        }
+        if (entry.injectHosts !== undefined && entry.injectHosts.length === 0) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path,
+                message: `injectHosts is explicitly empty — the credential would be ` +
+                    `masked but never injected. Omit injectHosts to default to ` +
+                    `network.allowedDomains, or list the intended hosts.`,
+            });
+        }
+    };
+    for (const [idx, v] of (creds.envVars ?? []).entries()) {
+        checkMaskedEntry(v, ['credentials', 'envVars', idx]);
+    }
+    for (const [idx, f] of (creds.files ?? []).entries()) {
+        checkMaskedEntry(f, ['credentials', 'files', idx]);
+        // Whole-file masking replaces one file's bytes with one sentinel;
+        // a directory has no single content to mask. The hard check is at
+        // runtime (stat after path normalization) — this catches the obvious
+        // syntactic case (trailing slash) early with a clearer error.
+        if (f.mode === 'mask' && f.path.endsWith('/')) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['credentials', 'files', idx, 'path'],
+                message: `Credential mode "mask" applies to a single file, not a ` +
+                    `directory. Use mode "deny" for "${f.path}", or point at the ` +
+                    `credential file inside it.`,
+            });
+        }
+    }
+    // Masked credentials require the TLS-terminated proxy path so the real
+    // value is only sent to a cert-verified upstream. allowPlaintextInject
+    // is the explicit escape hatch.
+    if (hasMasked &&
+        cfg.network.tlsTerminate === undefined &&
+        !creds.allowPlaintextInject) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['credentials'],
+            message: 'Credential masking requires network.tlsTerminate so substitution ' +
+                'runs only over a verified TLS connection. Enable tlsTerminate, or ' +
+                'set credentials.allowPlaintextInject to opt out (not recommended).',
+        });
+    }
 });
 //# sourceMappingURL=sandbox-config.js.map

package/dist/sandbox/sandbox-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE;IAC/B,OAAO,EACL,uEAAuE;QACvE,+DAA+D;QAC/D,0DAA0D;CAC7D,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CACJ,0BAA0B,EAC1B,oHAAoH,CACrH,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CACjC,0EAA0E;QACxE,uDAAuD,CAC1D;IACD,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;CACjE,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC5D,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CACjC,2CAA2C,CAC5C;CACF,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,0BAA0B,CAAC;SACjC,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,QAAQ,EAAE;SACV,QAAQ,CAAC,kCAAkC,CAAC;CAChD,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;SACrD,QAAQ,CACP,wFAAwF,CACzF;IACH,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,yKAAyK,CAC1K;IACH,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,qBAAqB,CAAC;SAC9B,QAAQ,CACP,oEAAoE;QAClE,mCAAmC,CACtC;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC7C,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,uDAAuD,CAC1D;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,0DAA0D,CAC7D;IACH,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/C,OAAO,EAAE,yCAAyC;KACnD,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,yCAAyC,CAC5C;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,wEAAwE;QACtE,2CAA2C,CAC9C;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,8FAA8F;QAC9F,wFAAwF;QACxF,iBAAiB,CACpB;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,oEAAoE,CACrE;CACF,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.js","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAA;AAEzE;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE;IACJ,uCAAuC;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEpC,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,uEAAuE;QACvE,yDAAyD;QACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uEAAuE;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC,EACD;IACE,OAAO,EACL,2LAA2L;CAC9L,CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;KAC9B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC9B,OAAO,EAAE,8BAA8B;CACxC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC5E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uFAAuF,CACxF;CACJ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,4EAA4E,CAC7E;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,yEAAyE,CAC5E;CACJ,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CACJ,0BAA0B,EAC1B,oHAAoH,CACrH,CAAA;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC/D,IAAI,EAAU,CAAA;IACd,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,8CAA+C,GAAa,CAAC,OAAO,EAAE;SAChF,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC,MAAM,GAAG,CAAC,CAAA;IACnE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,iEAAiE;gBACjE,yDAAyD;SAC5D,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CACjC,0EAA0E;QACxE,uDAAuD,CAC1D;IACD,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAChE,OAAO,EAAE,oBAAoB;SAC1B,QAAQ,EAAE;SACV,QAAQ,CACP,mEAAmE;QACjE,sEAAsE;QACtE,2DAA2D;QAC3D,kEAAkE;QAClE,0CAA0C,CAC7C;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,EAAE,CAAC;SAChB,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;SAC/B,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,iEAAiE;QACjE,qEAAqE;QACrE,mCAAmC,CACtC;IACH,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE;QAChE,6DAA6D;QAC7D,iEAAiE;QACjE,oEAAoE;QACpE,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,wBAAwB,CAC3B;IACH,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,0CAA0C,CAC7C;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC5D,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CACjC,2CAA2C,CAC5C;IACD,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,0CAA0C,CAC7C;CACJ,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,0BAA0B,CAAC;SACjC,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,QAAQ,EAAE;SACV,QAAQ,CAAC,kCAAkC,CAAC;IAC/C,oBAAoB,EAAE,CAAC;SACpB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iEAAiE;QAC/D,mEAAmE;QACnE,kEAAkE;QAClE,oCAAoC,CACvC;CACJ,CAAC;IACF,wEAAwE;IACxE,wEAAwE;KACvE,MAAM,EAAE,CAAA;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,mBAAmB,CAAC;SAC1B,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;SACrD,QAAQ,CACP,wFAAwF,CACzF;IACH,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,yKAAyK,CAC1K;IACH,gBAAgB,EAAE,CAAC;SAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,eAAe,EAAE,CAAC;SACf,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACf,GAAG,CAAC,EAAE;QACJ,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,EACD;QACE,OAAO,EACL,sGAAsG;KACzG,CACF,CACF;SACA,QAAQ,EAAE;SACV,QAAQ,CACP,qPAAqP,CACtP;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,6MAA6M,CAC9M;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,KAAK,CAAC;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+MAA+M,CAChN;IACH,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClD,oJAAoJ,CACrJ;IACD,aAAa,EAAE,CAAC;SACb,MAAM,CAAwB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,kEAAkE;YAClE,iEAAiE;YACjE,6DAA6D;YAC7D,UAAU,CACb;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;QAClE,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,mBAAmB,CAAC;aAC1B,QAAQ,EAAE;aACV,QAAQ,CACP,8DAA8D;YAC5D,+DAA+D;YAC/D,8DAA8D;YAC9D,gEAAgE;YAChE,iEAAiE;YACjE,gEAAgE;YAChE,6DAA6D;YAC7D,+BAA+B;YAC/B,gEAAgE;YAChE,iEAAiE;YACjE,oDAAoD;YACpD,gEAAgE,CACnE;QACH,gBAAgB,EAAE,CAAC;aAChB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACxB,QAAQ,EAAE;aACV,QAAQ,CACP,iEAAiE;YAC/D,+DAA+D;YAC/D,0DAA0D;YAC1D,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE,CACnE;KACJ,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,oDAAoD;KAC9D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,4DAA4D;QAC1D,qEAAqE;QACrE,qDAAqD,CACxD;IACH,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,sEAAsE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,oBAAoB,CACvB;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,4FAA4F;QAC1F,wFAAwF;QACxF,kFAAkF;QAClF,yFAAyF;QACzF,uFAAuF;QACvF,8EAA8E,CACjF;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,oFAAoF;QAClF,mFAAmF,CACtF;IACH,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,2BAA2B,CAAC;IACxC,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACvC,QAAQ,CACP,qGAAqG,CACtG,CAAA;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,mEAAmE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,kDAAkD,CACrD;CACJ,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,EAAE,sDAAsD,CAAC;SAC/D,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,6DAA6D;QAC7D,+BAA+B,CAClC;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,0DAA0D,CAC7D;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,oCAAoC,CAAC;IACjD,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/C,OAAO,EAAE,yCAAyC;KACnD,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CACP,mEAAmE;QACjE,0DAA0D;QAC1D,+DAA+D;QAC/D,yCAAyC,CAC5C;IACH,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5C,sEAAsE;QACpE,sEAAsE;QACtE,SAAS,CACZ;CACF,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC7E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,oEAAoE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE,CACtE;CACJ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CACzC,uCAAuC,CACxC;IACD,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtD,wEAAwE;QACtE,2CAA2C,CAC9C;IACD,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChE,yDAAyD,CAC1D;IACD,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,8FAA8F,CACjG;IACH,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,8FAA8F;QAC9F,wFAAwF;QACxF,iBAAiB,CACpB;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2DAA2D,CAC5D;IACD,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,+EAA+E;QAC7E,+DAA+D,CAClE;IACH,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC;SACnB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iFAAiF;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,iEAAiE,CACpE;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,2CAA2C,CAC5C;IACD,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,8DAA8D;QAC5D,6EAA6E,CAChF;IACH,SAAS,EAAE,gBAAgB;SACxB,QAAQ,EAAE;SACV,QAAQ,CACP,iDAAiD;QAC/C,6EAA6E,CAChF;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,6DAA6D,CAC9D;CACF,CAAC;KACD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAA;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAM;IAElB,4DAA4D;IAC5D,mEAAmE;IACnE,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAA;IAC1C,MAAM,WAAW,GAAG,CAClB,KAAwB,EACxB,IAAyB,EACzB,EAAE;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,mCAAmC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;oBAClB,OAAO,EACL,sBAAsB,IAAI,yBAAyB;wBACnD,iCAAiC,IAAI,mBAAmB;wBACxD,6DAA6D;iBAChE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,sEAAsE;IACtE,gEAAgE;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,MAAM,gBAAgB,GAAG,CACvB,KAA+C,EAC/C,IAAyB,EACzB,EAAE;QACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAM;QACjC,SAAS,GAAG,IAAI,CAAA;QAChB,qEAAqE;QACrE,oEAAoE;QACpE,6DAA6D;QAC7D,oDAAoD;QACpD,iEAAiE;QACjE,mEAAmE;QACnE,0DAA0D;QAC1D,kEAAkE;QAClE,+DAA+D;QAC/D,uBAAuB;QACvB,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAA;QACxD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;oBACpD,IAAI,mCAAmC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,QAAQ,CAAC;4BACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;4BAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;4BACjC,OAAO,EACL,sBAAsB,IAAI,2BAA2B;gCACrD,kDAAkD;gCAClD,wDAAwD;gCACxD,yDAAyD;gCACzD,kDAAkD;yBACrD,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IACL,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EACnE,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI;oBACJ,OAAO,EACL,4DAA4D;wBAC5D,kCAAkC;wBAClC,2DAA2D;wBAC3D,6DAA6D;wBAC7D,oDAAoD;iBACvD,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI;gBACJ,OAAO,EACL,4DAA4D;oBAC5D,4DAA4D;oBAC5D,qDAAqD;aACxD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,gBAAgB,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,gBAAgB,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;gBAC3C,OAAO,EACL,yDAAyD;oBACzD,mCAAmC,CAAC,CAAC,IAAI,qBAAqB;oBAC9D,4BAA4B;aAC/B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,gCAAgC;IAChC,IACE,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;QACtC,CAAC,KAAK,CAAC,oBAAoB,EAC3B,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mEAAmE;gBACnE,oEAAoE;gBACpE,oEAAoE;SACvE,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/sandbox/sandbox-manager.d.ts

@@ -1,3 +1,5 @@
+import { SentinelRegistry } from './credential-sentinel.js';
+import { MaskedFileStore } from './credential-mask-files.js';
 import { type MitmCA } from './mitm-ca.js';
 import type { SandboxRuntimeConfig } from './sandbox-config.js';
 import type { SandboxAskCallback, FsReadRestrictionConfig, FsWriteRestrictionConfig, NetworkRestrictionConfig } from './sandbox-schemas.js';
@@ -29,7 +31,7 @@ export interface ISandboxManager {
     getLinuxSocksSocketPath(): string | undefined;
     waitForNetworkInitialization(): Promise<boolean>;
     wrapWithSandbox(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal): Promise<string>;
-    wrapWithSandboxArgv(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal): Promise<{
+    wrapWithSandboxArgv(command: string, binShell?: string, customConfig?: Partial<SandboxRuntimeConfig>, abortSignal?: AbortSignal, cwd?: string): Promise<{
         argv: string[];
         env: NodeJS.ProcessEnv;
     }>;
@@ -38,6 +40,8 @@ export interface ISandboxManager {
     getLinuxGlobPatternWarnings(): string[];
     getConfig(): SandboxRuntimeConfig | undefined;
     getMitmCA(): MitmCA | undefined;
+    getSentinelRegistry(): SentinelRegistry;
+    getMaskedFileStore(): MaskedFileStore;
     updateConfig(newConfig: SandboxRuntimeConfig): void;
     cleanupAfterCommand(): void;
     reset(): Promise<void>;

package/dist/sandbox/sandbox-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAMvE,OAAO,KAAK,EAEV,oBAAoB,EAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,kBAAkB,EAElB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAmBjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA+wCpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;KAAE,CAAC,CAAA;IACtD,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA6BnB,CAAA"}
+{"version":3,"file":"sandbox-manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-manager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EACL,eAAe,EAEhB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAIL,KAAK,MAAM,EACZ,MAAM,cAAc,CAAA;AAMrB,OAAO,KAAK,EAEV,oBAAoB,EAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,kBAAkB,EAElB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAgCjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA0yDpE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CACR,aAAa,EAAE,oBAAoB,EACnC,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,gBAAgB,CAAC,EAAE,OAAO,GACzB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,mBAAmB,IAAI,OAAO,CAAA;IAC9B,mBAAmB,IAAI,OAAO,CAAA;IAC9B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAChB,GAAG,sBAAsB,CAAA;IAC1B,eAAe,IAAI,uBAAuB,CAAA;IAC1C,gBAAgB,IAAI,wBAAwB,CAAA;IAC5C,2BAA2B,IAAI,wBAAwB,CAAA;IACvD,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,oBAAoB,IAAI,OAAO,GAAG,SAAS,CAAA;IAC3C,kBAAkB,IAAI,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1C,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAA;IAC3D,4BAA4B,IAAI,OAAO,GAAG,SAAS,CAAA;IACnD,YAAY,IAAI,MAAM,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAAA;IACvC,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC5C,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAAA;IAC7C,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAC5C,WAAW,CAAC,EAAE,WAAW,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;KAAE,CAAC,CAAA;IACtD,wBAAwB,IAAI,qBAAqB,CAAA;IACjD,iCAAiC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1E,2BAA2B,IAAI,MAAM,EAAE,CAAA;IACvC,SAAS,IAAI,oBAAoB,GAAG,SAAS,CAAA;IAC7C,SAAS,IAAI,MAAM,GAAG,SAAS,CAAA;IAC/B,mBAAmB,IAAI,gBAAgB,CAAA;IACvC,kBAAkB,IAAI,eAAe,CAAA;IACrC,YAAY,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACnD,mBAAmB,IAAI,IAAI,CAAA;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAMD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,eA+BnB,CAAA"}