@within-7/minto 0.1.6 → 0.2.0

package/dist/services/sandbox/networkProxy.js

@@ -0,0 +1,293 @@
+class NetworkProxy {
+  policy;
+  violations = [];
+  pendingDomains = /* @__PURE__ */ new Set();
+  approvedDomains = /* @__PURE__ */ new Set();
+  deniedDomains = /* @__PURE__ */ new Set();
+  constructor(policy) {
+    this.policy = policy;
+    for (const domain of policy.allowedDomains) {
+      this.approvedDomains.add(domain.toLowerCase());
+    }
+  }
+  /**
+   * Update the network policy
+   */
+  updatePolicy(policy) {
+    this.policy = { ...this.policy, ...policy };
+    if (policy.allowedDomains) {
+      this.approvedDomains.clear();
+      for (const domain of policy.allowedDomains) {
+        this.approvedDomains.add(domain.toLowerCase());
+      }
+    }
+  }
+  /**
+   * Check if network access to a domain is allowed
+   */
+  checkAccess(request) {
+    const domain = request.domain.toLowerCase();
+    if (this.policy.blockAll) {
+      const violation2 = this.createViolation(
+        "network_blocked",
+        `Network access is blocked: attempted connection to ${domain}`,
+        domain
+      );
+      this.violations.push(violation2);
+      return { allowed: false, violation: violation2, domain };
+    }
+    if (this.deniedDomains.has(domain)) {
+      const violation2 = this.createViolation(
+        "network_domain_denied",
+        `Network access denied: ${domain} was previously rejected`,
+        domain
+      );
+      this.violations.push(violation2);
+      return { allowed: false, violation: violation2, domain };
+    }
+    if (this.isDomainApproved(domain)) {
+      return { allowed: true, domain };
+    }
+    if (this.policy.promptForNewDomains) {
+      this.pendingDomains.add(domain);
+      return {
+        allowed: false,
+        promptRequired: true,
+        domain
+      };
+    }
+    const violation = this.createViolation(
+      "network_domain_denied",
+      `Network access denied: ${domain} is not in the allowed list`,
+      domain
+    );
+    this.violations.push(violation);
+    return { allowed: false, violation, domain };
+  }
+  /**
+   * Analyze a command for network operations
+   */
+  analyzeCommand(command) {
+    const networkRequests = [];
+    const violations = [];
+    const urlPatterns = [
+      // HTTP/HTTPS URLs
+      /https?:\/\/([^\/\s:]+)(?::\d+)?/gi,
+      // curl/wget commands
+      /(?:curl|wget)\s+(?:[^\s]*\s+)*["']?(https?:\/\/)?([^\/\s"':]+)/gi,
+      // SSH/SCP commands
+      /(?:ssh|scp)\s+(?:[^\s]*\s+)*(?:\w+@)?([^:\s\/]+)/gi,
+      // git remote URLs
+      /git(?:@|:\/\/)([^:\/\s]+)/gi,
+      // npm registry
+      /registry\.npmjs\.org/gi,
+      // Package install commands that might download
+      /(?:npm|yarn|pnpm|bun)\s+(?:install|add|i)\s+/gi,
+      /pip\s+install\s+/gi
+    ];
+    for (const pattern of urlPatterns) {
+      const matches = command.matchAll(pattern);
+      for (const match of matches) {
+        let domain = match[1] || match[2] || match[0];
+        domain = domain.replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/:.*$/, "").toLowerCase();
+        if (domain && this.isValidDomain(domain)) {
+          const protocol = this.detectProtocol(command, domain);
+          networkRequests.push({
+            domain,
+            protocol,
+            requestType: "outbound"
+          });
+        }
+      }
+    }
+    if (this.commandImpliesNetwork(command)) {
+      const impliedDomains = this.getImpliedDomains(command);
+      for (const domain of impliedDomains) {
+        if (!networkRequests.find((r) => r.domain === domain)) {
+          networkRequests.push({
+            domain,
+            protocol: "https",
+            requestType: "outbound"
+          });
+        }
+      }
+    }
+    for (const request of networkRequests) {
+      const result = this.checkAccess(request);
+      if (!result.allowed && result.violation) {
+        violations.push({
+          ...result.violation,
+          command
+        });
+      }
+    }
+    return { networkRequests, violations };
+  }
+  /**
+   * Approve a pending domain
+   */
+  approveDomain(domain) {
+    const lowerDomain = domain.toLowerCase();
+    this.approvedDomains.add(lowerDomain);
+    this.pendingDomains.delete(lowerDomain);
+    this.deniedDomains.delete(lowerDomain);
+  }
+  /**
+   * Deny a pending domain
+   */
+  denyDomain(domain) {
+    const lowerDomain = domain.toLowerCase();
+    this.deniedDomains.add(lowerDomain);
+    this.pendingDomains.delete(lowerDomain);
+    this.approvedDomains.delete(lowerDomain);
+  }
+  /**
+   * Get pending domains that need approval
+   */
+  getPendingDomains() {
+    return [...this.pendingDomains];
+  }
+  /**
+   * Get all approved domains
+   */
+  getApprovedDomains() {
+    return [...this.approvedDomains];
+  }
+  /**
+   * Get all denied domains
+   */
+  getDeniedDomains() {
+    return [...this.deniedDomains];
+  }
+  /**
+   * Get all recorded violations
+   */
+  getViolations() {
+    return [...this.violations];
+  }
+  /**
+   * Clear violation history
+   */
+  clearViolations() {
+    this.violations = [];
+  }
+  /**
+   * Check if a domain is approved (supports wildcards)
+   */
+  isDomainApproved(domain) {
+    if (this.approvedDomains.has(domain)) {
+      return true;
+    }
+    for (const approved of this.approvedDomains) {
+      if (approved.startsWith("*.")) {
+        const suffix = approved.slice(2);
+        if (domain.endsWith(suffix) || domain === suffix.slice(1)) {
+          return true;
+        }
+      }
+      if (domain.endsWith(`.${approved}`)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Validate a domain format
+   */
+  isValidDomain(domain) {
+    if (!domain || domain.length < 3) return false;
+    const domainRegex = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
+    return domainRegex.test(domain);
+  }
+  /**
+   * Detect protocol from command context
+   */
+  detectProtocol(command, domain) {
+    if (command.includes("ssh") || command.includes("scp")) {
+      return "ssh";
+    }
+    if (command.includes("git@") || command.includes("git://")) {
+      return "git";
+    }
+    if (command.includes("https://")) {
+      return "https";
+    }
+    if (command.includes("http://")) {
+      return "http";
+    }
+    return "https";
+  }
+  /**
+   * Check if a command implies network access
+   */
+  commandImpliesNetwork(command) {
+    const networkCommands = [
+      /\bnpm\s+(install|i|add|update|publish)\b/,
+      /\byarn\s+(add|upgrade|publish)\b/,
+      /\bpnpm\s+(add|update|publish)\b/,
+      /\bbun\s+(add|update|install)\b/,
+      /\bpip\s+install\b/,
+      /\bcargo\s+(install|update|publish)\b/,
+      /\bgo\s+(get|install)\b/,
+      /\bgem\s+install\b/,
+      /\bcomposer\s+(install|require|update)\b/,
+      /\bcurl\b/,
+      /\bwget\b/,
+      /\bgit\s+(clone|fetch|pull|push)\b/
+    ];
+    return networkCommands.some((pattern) => pattern.test(command));
+  }
+  /**
+   * Get implied domains for package manager commands
+   */
+  getImpliedDomains(command) {
+    const domains = [];
+    if (/\bnpm\b/.test(command)) {
+      domains.push("registry.npmjs.org");
+    }
+    if (/\byarn\b/.test(command)) {
+      domains.push("registry.yarnpkg.com", "registry.npmjs.org");
+    }
+    if (/\bpnpm\b/.test(command)) {
+      domains.push("registry.npmjs.org");
+    }
+    if (/\bbun\b/.test(command)) {
+      domains.push("registry.npmjs.org");
+    }
+    if (/\bpip\b/.test(command)) {
+      domains.push("pypi.org", "files.pythonhosted.org");
+    }
+    if (/\bcargo\b/.test(command)) {
+      domains.push("crates.io", "static.crates.io");
+    }
+    if (/\bgo\s+(get|install)\b/.test(command)) {
+      domains.push("proxy.golang.org", "sum.golang.org");
+    }
+    if (/\bgem\b/.test(command)) {
+      domains.push("rubygems.org");
+    }
+    if (/\bcomposer\b/.test(command)) {
+      domains.push("packagist.org", "repo.packagist.org");
+    }
+    if (/\bgit\s+(clone|fetch|pull|push)\b/.test(command)) {
+      domains.push("github.com", "gitlab.com", "bitbucket.org");
+    }
+    return domains;
+  }
+  /**
+   * Create a violation record
+   */
+  createViolation(type, details, domain) {
+    return {
+      type,
+      timestamp: Date.now(),
+      command: "",
+      details,
+      domain
+    };
+  }
+}
+export {
+  NetworkProxy
+};
+//# sourceMappingURL=networkProxy.js.map

package/dist/services/sandbox/networkProxy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/services/sandbox/networkProxy.ts"],
+  "sourcesContent": ["/**\n * Network Proxy Service\n *\n * Validates and controls network access for sandboxed commands.\n * Provides domain-based access control and logging.\n */\n\nimport type { NetworkPolicy, SandboxViolation } from './types'\n\n/**\n * Result of a network access check\n */\nexport interface NetworkCheckResult {\n  allowed: boolean\n  violation?: SandboxViolation\n  promptRequired?: boolean\n  domain?: string\n}\n\n/**\n * Network access request\n */\nexport interface NetworkAccessRequest {\n  domain: string\n  protocol?: 'http' | 'https' | 'ssh' | 'git' | 'other'\n  port?: number\n  requestType?: 'outbound' | 'inbound'\n}\n\n/**\n * Network Proxy Controller\n */\nexport class NetworkProxy {\n  private policy: NetworkPolicy\n  private violations: SandboxViolation[] = []\n  private pendingDomains: Set<string> = new Set()\n  private approvedDomains: Set<string> = new Set()\n  private deniedDomains: Set<string> = new Set()\n\n  constructor(policy: NetworkPolicy) {\n    this.policy = policy\n    // Initialize approved domains from policy\n    for (const domain of policy.allowedDomains) {\n      this.approvedDomains.add(domain.toLowerCase())\n    }\n  }\n\n  /**\n   * Update the network policy\n   */\n  updatePolicy(policy: Partial<NetworkPolicy>): void {\n    this.policy = { ...this.policy, ...policy }\n    if (policy.allowedDomains) {\n      this.approvedDomains.clear()\n      for (const domain of policy.allowedDomains) {\n        this.approvedDomains.add(domain.toLowerCase())\n      }\n    }\n  }\n\n  /**\n   * Check if network access to a domain is allowed\n   */\n  checkAccess(request: NetworkAccessRequest): NetworkCheckResult {\n    const domain = request.domain.toLowerCase()\n\n    // Check if all network access is blocked\n    if (this.policy.blockAll) {\n      const violation = this.createViolation(\n        'network_blocked',\n        `Network access is blocked: attempted connection to ${domain}`,\n        domain,\n      )\n      this.violations.push(violation)\n      return { allowed: false, violation, domain }\n    }\n\n    // Check if domain was previously denied\n    if (this.deniedDomains.has(domain)) {\n      const violation = this.createViolation(\n        'network_domain_denied',\n        `Network access denied: ${domain} was previously rejected`,\n        domain,\n      )\n      this.violations.push(violation)\n      return { allowed: false, violation, domain }\n    }\n\n    // Check if domain is in approved list\n    if (this.isDomainApproved(domain)) {\n      return { allowed: true, domain }\n    }\n\n    // Check if we should prompt for new domains\n    if (this.policy.promptForNewDomains) {\n      this.pendingDomains.add(domain)\n      return {\n        allowed: false,\n        promptRequired: true,\n        domain,\n      }\n    }\n\n    // Default deny\n    const violation = this.createViolation(\n      'network_domain_denied',\n      `Network access denied: ${domain} is not in the allowed list`,\n      domain,\n    )\n    this.violations.push(violation)\n    return { allowed: false, violation, domain }\n  }\n\n  /**\n   * Analyze a command for network operations\n   */\n  analyzeCommand(command: string): {\n    networkRequests: NetworkAccessRequest[]\n    violations: SandboxViolation[]\n  } {\n    const networkRequests: NetworkAccessRequest[] = []\n    const violations: SandboxViolation[] = []\n\n    // Extract URLs and domains from command\n    const urlPatterns = [\n      // HTTP/HTTPS URLs\n      /https?:\\/\\/([^\\/\\s:]+)(?::\\d+)?/gi,\n      // curl/wget commands\n      /(?:curl|wget)\\s+(?:[^\\s]*\\s+)*[\"']?(https?:\\/\\/)?([^\\/\\s\"':]+)/gi,\n      // SSH/SCP commands\n      /(?:ssh|scp)\\s+(?:[^\\s]*\\s+)*(?:\\w+@)?([^:\\s\\/]+)/gi,\n      // git remote URLs\n      /git(?:@|:\\/\\/)([^:\\/\\s]+)/gi,\n      // npm registry\n      /registry\\.npmjs\\.org/gi,\n      // Package install commands that might download\n      /(?:npm|yarn|pnpm|bun)\\s+(?:install|add|i)\\s+/gi,\n      /pip\\s+install\\s+/gi,\n    ]\n\n    for (const pattern of urlPatterns) {\n      const matches = command.matchAll(pattern)\n      for (const match of matches) {\n        let domain = match[1] || match[2] || match[0]\n        // Clean up the domain\n        domain = domain\n          .replace(/^https?:\\/\\//, '')\n          .replace(/\\/.*$/, '')\n          .replace(/:.*$/, '')\n          .toLowerCase()\n\n        if (domain && this.isValidDomain(domain)) {\n          const protocol = this.detectProtocol(command, domain)\n          networkRequests.push({\n            domain,\n            protocol,\n            requestType: 'outbound',\n          })\n        }\n      }\n    }\n\n    // Check for package manager commands that imply network access\n    if (this.commandImpliesNetwork(command)) {\n      // Add common package registries\n      const impliedDomains = this.getImpliedDomains(command)\n      for (const domain of impliedDomains) {\n        if (!networkRequests.find(r => r.domain === domain)) {\n          networkRequests.push({\n            domain,\n            protocol: 'https',\n            requestType: 'outbound',\n          })\n        }\n      }\n    }\n\n    // Validate all network requests\n    for (const request of networkRequests) {\n      const result = this.checkAccess(request)\n      if (!result.allowed && result.violation) {\n        violations.push({\n          ...result.violation,\n          command,\n        })\n      }\n    }\n\n    return { networkRequests, violations }\n  }\n\n  /**\n   * Approve a pending domain\n   */\n  approveDomain(domain: string): void {\n    const lowerDomain = domain.toLowerCase()\n    this.approvedDomains.add(lowerDomain)\n    this.pendingDomains.delete(lowerDomain)\n    this.deniedDomains.delete(lowerDomain)\n  }\n\n  /**\n   * Deny a pending domain\n   */\n  denyDomain(domain: string): void {\n    const lowerDomain = domain.toLowerCase()\n    this.deniedDomains.add(lowerDomain)\n    this.pendingDomains.delete(lowerDomain)\n    this.approvedDomains.delete(lowerDomain)\n  }\n\n  /**\n   * Get pending domains that need approval\n   */\n  getPendingDomains(): string[] {\n    return [...this.pendingDomains]\n  }\n\n  /**\n   * Get all approved domains\n   */\n  getApprovedDomains(): string[] {\n    return [...this.approvedDomains]\n  }\n\n  /**\n   * Get all denied domains\n   */\n  getDeniedDomains(): string[] {\n    return [...this.deniedDomains]\n  }\n\n  /**\n   * Get all recorded violations\n   */\n  getViolations(): SandboxViolation[] {\n    return [...this.violations]\n  }\n\n  /**\n   * Clear violation history\n   */\n  clearViolations(): void {\n    this.violations = []\n  }\n\n  /**\n   * Check if a domain is approved (supports wildcards)\n   */\n  private isDomainApproved(domain: string): boolean {\n    // Direct match\n    if (this.approvedDomains.has(domain)) {\n      return true\n    }\n\n    // Check for wildcard matches\n    for (const approved of this.approvedDomains) {\n      if (approved.startsWith('*.')) {\n        const suffix = approved.slice(2)\n        if (domain.endsWith(suffix) || domain === suffix.slice(1)) {\n          return true\n        }\n      }\n      // Check if domain is a subdomain of approved\n      if (domain.endsWith(`.${approved}`)) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Validate a domain format\n   */\n  private isValidDomain(domain: string): boolean {\n    if (!domain || domain.length < 3) return false\n    // Basic domain validation\n    const domainRegex =\n      /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i\n    return domainRegex.test(domain)\n  }\n\n  /**\n   * Detect protocol from command context\n   */\n  private detectProtocol(\n    command: string,\n    domain: string,\n  ): NetworkAccessRequest['protocol'] {\n    if (command.includes('ssh') || command.includes('scp')) {\n      return 'ssh'\n    }\n    if (command.includes('git@') || command.includes('git://')) {\n      return 'git'\n    }\n    if (command.includes('https://')) {\n      return 'https'\n    }\n    if (command.includes('http://')) {\n      return 'http'\n    }\n    return 'https' // Default to https\n  }\n\n  /**\n   * Check if a command implies network access\n   */\n  private commandImpliesNetwork(command: string): boolean {\n    const networkCommands = [\n      /\\bnpm\\s+(install|i|add|update|publish)\\b/,\n      /\\byarn\\s+(add|upgrade|publish)\\b/,\n      /\\bpnpm\\s+(add|update|publish)\\b/,\n      /\\bbun\\s+(add|update|install)\\b/,\n      /\\bpip\\s+install\\b/,\n      /\\bcargo\\s+(install|update|publish)\\b/,\n      /\\bgo\\s+(get|install)\\b/,\n      /\\bgem\\s+install\\b/,\n      /\\bcomposer\\s+(install|require|update)\\b/,\n      /\\bcurl\\b/,\n      /\\bwget\\b/,\n      /\\bgit\\s+(clone|fetch|pull|push)\\b/,\n    ]\n\n    return networkCommands.some(pattern => pattern.test(command))\n  }\n\n  /**\n   * Get implied domains for package manager commands\n   */\n  private getImpliedDomains(command: string): string[] {\n    const domains: string[] = []\n\n    if (/\\bnpm\\b/.test(command)) {\n      domains.push('registry.npmjs.org')\n    }\n    if (/\\byarn\\b/.test(command)) {\n      domains.push('registry.yarnpkg.com', 'registry.npmjs.org')\n    }\n    if (/\\bpnpm\\b/.test(command)) {\n      domains.push('registry.npmjs.org')\n    }\n    if (/\\bbun\\b/.test(command)) {\n      domains.push('registry.npmjs.org')\n    }\n    if (/\\bpip\\b/.test(command)) {\n      domains.push('pypi.org', 'files.pythonhosted.org')\n    }\n    if (/\\bcargo\\b/.test(command)) {\n      domains.push('crates.io', 'static.crates.io')\n    }\n    if (/\\bgo\\s+(get|install)\\b/.test(command)) {\n      domains.push('proxy.golang.org', 'sum.golang.org')\n    }\n    if (/\\bgem\\b/.test(command)) {\n      domains.push('rubygems.org')\n    }\n    if (/\\bcomposer\\b/.test(command)) {\n      domains.push('packagist.org', 'repo.packagist.org')\n    }\n    if (/\\bgit\\s+(clone|fetch|pull|push)\\b/.test(command)) {\n      domains.push('github.com', 'gitlab.com', 'bitbucket.org')\n    }\n\n    return domains\n  }\n\n  /**\n   * Create a violation record\n   */\n  private createViolation(\n    type: SandboxViolation['type'],\n    details: string,\n    domain: string,\n  ): SandboxViolation {\n    return {\n      type,\n      timestamp: Date.now(),\n      command: '',\n      details,\n      domain,\n    }\n  }\n}\n"],
+  "mappings": "AAgCO,MAAM,aAAa;AAAA,EAChB;AAAA,EACA,aAAiC,CAAC;AAAA,EAClC,iBAA8B,oBAAI,IAAI;AAAA,EACtC,kBAA+B,oBAAI,IAAI;AAAA,EACvC,gBAA6B,oBAAI,IAAI;AAAA,EAE7C,YAAY,QAAuB;AACjC,SAAK,SAAS;AAEd,eAAW,UAAU,OAAO,gBAAgB;AAC1C,WAAK,gBAAgB,IAAI,OAAO,YAAY,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAAsC;AACjD,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO;AAC1C,QAAI,OAAO,gBAAgB;AACzB,WAAK,gBAAgB,MAAM;AAC3B,iBAAW,UAAU,OAAO,gBAAgB;AAC1C,aAAK,gBAAgB,IAAI,OAAO,YAAY,CAAC;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,SAAmD;AAC7D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAG1C,QAAI,KAAK,OAAO,UAAU;AACxB,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,sDAAsD,MAAM;AAAA,QAC5D;AAAA,MACF;AACA,WAAK,WAAW,KAAKA,UAAS;AAC9B,aAAO,EAAE,SAAS,OAAO,WAAAA,YAAW,OAAO;AAAA,IAC7C;AAGA,QAAI,KAAK,cAAc,IAAI,MAAM,GAAG;AAClC,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,0BAA0B,MAAM;AAAA,QAChC;AAAA,MACF;AACA,WAAK,WAAW,KAAKA,UAAS;AAC9B,aAAO,EAAE,SAAS,OAAO,WAAAA,YAAW,OAAO;AAAA,IAC7C;AAGA,QAAI,KAAK,iBAAiB,MAAM,GAAG;AACjC,aAAO,EAAE,SAAS,MAAM,OAAO;AAAA,IACjC;AAGA,QAAI,KAAK,OAAO,qBAAqB;AACnC,WAAK,eAAe,IAAI,MAAM;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,KAAK;AAAA,MACrB;AAAA,MACA,0BAA0B,MAAM;AAAA,MAChC;AAAA,IACF;AACA,SAAK,WAAW,KAAK,SAAS;AAC9B,WAAO,EAAE,SAAS,OAAO,WAAW,OAAO;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,SAGb;AACA,UAAM,kBAA0C,CAAC;AACjD,UAAM,aAAiC,CAAC;AAGxC,UAAM,cAAc;AAAA;AAAA,MAElB;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAEA,eAAW,WAAW,aAAa;AACjC,YAAM,UAAU,QAAQ,SAAS,OAAO;AACxC,iBAAW,SAAS,SAAS;AAC3B,YAAI,SAAS,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,MAAM,CAAC;AAE5C,iBAAS,OACN,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,SAAS,EAAE,EACnB,QAAQ,QAAQ,EAAE,EAClB,YAAY;AAEf,YAAI,UAAU,KAAK,cAAc,MAAM,GAAG;AACxC,gBAAM,WAAW,KAAK,eAAe,SAAS,MAAM;AACpD,0BAAgB,KAAK;AAAA,YACnB;AAAA,YACA;AAAA,YACA,aAAa;AAAA,UACf,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,QAAI,KAAK,sBAAsB,OAAO,GAAG;AAEvC,YAAM,iBAAiB,KAAK,kBAAkB,OAAO;AACrD,iBAAW,UAAU,gBAAgB;AACnC,YAAI,CAAC,gBAAgB,KAAK,OAAK,EAAE,WAAW,MAAM,GAAG;AACnD,0BAAgB,KAAK;AAAA,YACnB;AAAA,YACA,UAAU;AAAA,YACV,aAAa;AAAA,UACf,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,eAAW,WAAW,iBAAiB;AACrC,YAAM,SAAS,KAAK,YAAY,OAAO;AACvC,UAAI,CAAC,OAAO,WAAW,OAAO,WAAW;AACvC,mBAAW,KAAK;AAAA,UACd,GAAG,OAAO;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO,EAAE,iBAAiB,WAAW;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc,QAAsB;AAClC,UAAM,cAAc,OAAO,YAAY;AACvC,SAAK,gBAAgB,IAAI,WAAW;AACpC,SAAK,eAAe,OAAO,WAAW;AACtC,SAAK,cAAc,OAAO,WAAW;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,QAAsB;AAC/B,UAAM,cAAc,OAAO,YAAY;AACvC,SAAK,cAAc,IAAI,WAAW;AAClC,SAAK,eAAe,OAAO,WAAW;AACtC,SAAK,gBAAgB,OAAO,WAAW;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,oBAA8B;AAC5B,WAAO,CAAC,GAAG,KAAK,cAAc;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,qBAA+B;AAC7B,WAAO,CAAC,GAAG,KAAK,eAAe;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,mBAA6B;AAC3B,WAAO,CAAC,GAAG,KAAK,aAAa;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAoC;AAClC,WAAO,CAAC,GAAG,KAAK,UAAU;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAwB;AACtB,SAAK,aAAa,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAiB,QAAyB;AAEhD,QAAI,KAAK,gBAAgB,IAAI,MAAM,GAAG;AACpC,aAAO;AAAA,IACT;AAGA,eAAW,YAAY,KAAK,iBAAiB;AAC3C,UAAI,SAAS,WAAW,IAAI,GAAG;AAC7B,cAAM,SAAS,SAAS,MAAM,CAAC;AAC/B,YAAI,OAAO,SAAS,MAAM,KAAK,WAAW,OAAO,MAAM,CAAC,GAAG;AACzD,iBAAO;AAAA,QACT;AAAA,MACF;AAEA,UAAI,OAAO,SAAS,IAAI,QAAQ,EAAE,GAAG;AACnC,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,QAAyB;AAC7C,QAAI,CAAC,UAAU,OAAO,SAAS,EAAG,QAAO;AAEzC,UAAM,cACJ;AACF,WAAO,YAAY,KAAK,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKQ,eACN,SACA,QACkC;AAClC,QAAI,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,GAAG;AACtD,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAS,MAAM,KAAK,QAAQ,SAAS,QAAQ,GAAG;AAC1D,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAS,UAAU,GAAG;AAChC,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAS,SAAS,GAAG;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAAsB,SAA0B;AACtD,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO,gBAAgB,KAAK,aAAW,QAAQ,KAAK,OAAO,CAAC;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,SAA2B;AACnD,UAAM,UAAoB,CAAC;AAE3B,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,oBAAoB;AAAA,IACnC;AACA,QAAI,WAAW,KAAK,OAAO,GAAG;AAC5B,cAAQ,KAAK,wBAAwB,oBAAoB;AAAA,IAC3D;AACA,QAAI,WAAW,KAAK,OAAO,GAAG;AAC5B,cAAQ,KAAK,oBAAoB;AAAA,IACnC;AACA,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,oBAAoB;AAAA,IACnC;AACA,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,YAAY,wBAAwB;AAAA,IACnD;AACA,QAAI,YAAY,KAAK,OAAO,GAAG;AAC7B,cAAQ,KAAK,aAAa,kBAAkB;AAAA,IAC9C;AACA,QAAI,yBAAyB,KAAK,OAAO,GAAG;AAC1C,cAAQ,KAAK,oBAAoB,gBAAgB;AAAA,IACnD;AACA,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,cAAc;AAAA,IAC7B;AACA,QAAI,eAAe,KAAK,OAAO,GAAG;AAChC,cAAQ,KAAK,iBAAiB,oBAAoB;AAAA,IACpD;AACA,QAAI,oCAAoC,KAAK,OAAO,GAAG;AACrD,cAAQ,KAAK,cAAc,cAAc,eAAe;AAAA,IAC1D;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,gBACN,MACA,SACA,QACkB;AAClB,WAAO;AAAA,MACL;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["violation"]
+}