@within-7/minto 0.4.2 → 0.4.3

package/dist/services/sandbox/networkProxy.js

@@ -1,293 +0,0 @@
-class NetworkProxy {
-  policy;
-  violations = [];
-  pendingDomains = /* @__PURE__ */ new Set();
-  approvedDomains = /* @__PURE__ */ new Set();
-  deniedDomains = /* @__PURE__ */ new Set();
-  constructor(policy) {
-    this.policy = policy;
-    for (const domain of policy.allowedDomains) {
-      this.approvedDomains.add(domain.toLowerCase());
-    }
-  }
-  /**
-   * Update the network policy
-   */
-  updatePolicy(policy) {
-    this.policy = { ...this.policy, ...policy };
-    if (policy.allowedDomains) {
-      this.approvedDomains.clear();
-      for (const domain of policy.allowedDomains) {
-        this.approvedDomains.add(domain.toLowerCase());
-      }
-    }
-  }
-  /**
-   * Check if network access to a domain is allowed
-   */
-  checkAccess(request) {
-    const domain = request.domain.toLowerCase();
-    if (this.policy.blockAll) {
-      const violation2 = this.createViolation(
-        "network_blocked",
-        `Network access is blocked: attempted connection to ${domain}`,
-        domain
-      );
-      this.violations.push(violation2);
-      return { allowed: false, violation: violation2, domain };
-    }
-    if (this.deniedDomains.has(domain)) {
-      const violation2 = this.createViolation(
-        "network_domain_denied",
-        `Network access denied: ${domain} was previously rejected`,
-        domain
-      );
-      this.violations.push(violation2);
-      return { allowed: false, violation: violation2, domain };
-    }
-    if (this.isDomainApproved(domain)) {
-      return { allowed: true, domain };
-    }
-    if (this.policy.promptForNewDomains) {
-      this.pendingDomains.add(domain);
-      return {
-        allowed: false,
-        promptRequired: true,
-        domain
-      };
-    }
-    const violation = this.createViolation(
-      "network_domain_denied",
-      `Network access denied: ${domain} is not in the allowed list`,
-      domain
-    );
-    this.violations.push(violation);
-    return { allowed: false, violation, domain };
-  }
-  /**
-   * Analyze a command for network operations
-   */
-  analyzeCommand(command) {
-    const networkRequests = [];
-    const violations = [];
-    const urlPatterns = [
-      // HTTP/HTTPS URLs
-      /https?:\/\/([^\/\s:]+)(?::\d+)?/gi,
-      // curl/wget commands
-      /(?:curl|wget)\s+(?:[^\s]*\s+)*["']?(https?:\/\/)?([^\/\s"':]+)/gi,
-      // SSH/SCP commands
-      /(?:ssh|scp)\s+(?:[^\s]*\s+)*(?:\w+@)?([^:\s\/]+)/gi,
-      // git remote URLs
-      /git(?:@|:\/\/)([^:\/\s]+)/gi,
-      // npm registry
-      /registry\.npmjs\.org/gi,
-      // Package install commands that might download
-      /(?:npm|yarn|pnpm|bun)\s+(?:install|add|i)\s+/gi,
-      /pip\s+install\s+/gi
-    ];
-    for (const pattern of urlPatterns) {
-      const matches = command.matchAll(pattern);
-      for (const match of matches) {
-        let domain = match[1] || match[2] || match[0];
-        domain = domain.replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/:.*$/, "").toLowerCase();
-        if (domain && this.isValidDomain(domain)) {
-          const protocol = this.detectProtocol(command, domain);
-          networkRequests.push({
-            domain,
-            protocol,
-            requestType: "outbound"
-          });
-        }
-      }
-    }
-    if (this.commandImpliesNetwork(command)) {
-      const impliedDomains = this.getImpliedDomains(command);
-      for (const domain of impliedDomains) {
-        if (!networkRequests.find((r) => r.domain === domain)) {
-          networkRequests.push({
-            domain,
-            protocol: "https",
-            requestType: "outbound"
-          });
-        }
-      }
-    }
-    for (const request of networkRequests) {
-      const result = this.checkAccess(request);
-      if (!result.allowed && result.violation) {
-        violations.push({
-          ...result.violation,
-          command
-        });
-      }
-    }
-    return { networkRequests, violations };
-  }
-  /**
-   * Approve a pending domain
-   */
-  approveDomain(domain) {
-    const lowerDomain = domain.toLowerCase();
-    this.approvedDomains.add(lowerDomain);
-    this.pendingDomains.delete(lowerDomain);
-    this.deniedDomains.delete(lowerDomain);
-  }
-  /**
-   * Deny a pending domain
-   */
-  denyDomain(domain) {
-    const lowerDomain = domain.toLowerCase();
-    this.deniedDomains.add(lowerDomain);
-    this.pendingDomains.delete(lowerDomain);
-    this.approvedDomains.delete(lowerDomain);
-  }
-  /**
-   * Get pending domains that need approval
-   */
-  getPendingDomains() {
-    return [...this.pendingDomains];
-  }
-  /**
-   * Get all approved domains
-   */
-  getApprovedDomains() {
-    return [...this.approvedDomains];
-  }
-  /**
-   * Get all denied domains
-   */
-  getDeniedDomains() {
-    return [...this.deniedDomains];
-  }
-  /**
-   * Get all recorded violations
-   */
-  getViolations() {
-    return [...this.violations];
-  }
-  /**
-   * Clear violation history
-   */
-  clearViolations() {
-    this.violations = [];
-  }
-  /**
-   * Check if a domain is approved (supports wildcards)
-   */
-  isDomainApproved(domain) {
-    if (this.approvedDomains.has(domain)) {
-      return true;
-    }
-    for (const approved of this.approvedDomains) {
-      if (approved.startsWith("*.")) {
-        const suffix = approved.slice(2);
-        if (domain.endsWith(suffix) || domain === suffix.slice(1)) {
-          return true;
-        }
-      }
-      if (domain.endsWith(`.${approved}`)) {
-        return true;
-      }
-    }
-    return false;
-  }
-  /**
-   * Validate a domain format
-   */
-  isValidDomain(domain) {
-    if (!domain || domain.length < 3) return false;
-    const domainRegex = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
-    return domainRegex.test(domain);
-  }
-  /**
-   * Detect protocol from command context
-   */
-  detectProtocol(command, domain) {
-    if (command.includes("ssh") || command.includes("scp")) {
-      return "ssh";
-    }
-    if (command.includes("git@") || command.includes("git://")) {
-      return "git";
-    }
-    if (command.includes("https://")) {
-      return "https";
-    }
-    if (command.includes("http://")) {
-      return "http";
-    }
-    return "https";
-  }
-  /**
-   * Check if a command implies network access
-   */
-  commandImpliesNetwork(command) {
-    const networkCommands = [
-      /\bnpm\s+(install|i|add|update|publish)\b/,
-      /\byarn\s+(add|upgrade|publish)\b/,
-      /\bpnpm\s+(add|update|publish)\b/,
-      /\bbun\s+(add|update|install)\b/,
-      /\bpip\s+install\b/,
-      /\bcargo\s+(install|update|publish)\b/,
-      /\bgo\s+(get|install)\b/,
-      /\bgem\s+install\b/,
-      /\bcomposer\s+(install|require|update)\b/,
-      /\bcurl\b/,
-      /\bwget\b/,
-      /\bgit\s+(clone|fetch|pull|push)\b/
-    ];
-    return networkCommands.some((pattern) => pattern.test(command));
-  }
-  /**
-   * Get implied domains for package manager commands
-   */
-  getImpliedDomains(command) {
-    const domains = [];
-    if (/\bnpm\b/.test(command)) {
-      domains.push("registry.npmjs.org");
-    }
-    if (/\byarn\b/.test(command)) {
-      domains.push("registry.yarnpkg.com", "registry.npmjs.org");
-    }
-    if (/\bpnpm\b/.test(command)) {
-      domains.push("registry.npmjs.org");
-    }
-    if (/\bbun\b/.test(command)) {
-      domains.push("registry.npmjs.org");
-    }
-    if (/\bpip\b/.test(command)) {
-      domains.push("pypi.org", "files.pythonhosted.org");
-    }
-    if (/\bcargo\b/.test(command)) {
-      domains.push("crates.io", "static.crates.io");
-    }
-    if (/\bgo\s+(get|install)\b/.test(command)) {
-      domains.push("proxy.golang.org", "sum.golang.org");
-    }
-    if (/\bgem\b/.test(command)) {
-      domains.push("rubygems.org");
-    }
-    if (/\bcomposer\b/.test(command)) {
-      domains.push("packagist.org", "repo.packagist.org");
-    }
-    if (/\bgit\s+(clone|fetch|pull|push)\b/.test(command)) {
-      domains.push("github.com", "gitlab.com", "bitbucket.org");
-    }
-    return domains;
-  }
-  /**
-   * Create a violation record
-   */
-  createViolation(type, details, domain) {
-    return {
-      type,
-      timestamp: Date.now(),
-      command: "",
-      details,
-      domain
-    };
-  }
-}
-export {
-  NetworkProxy
-};
-//# sourceMappingURL=networkProxy.js.map

package/dist/services/sandbox/networkProxy.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/services/sandbox/networkProxy.ts"],
-  "sourcesContent": ["/**\n * Network Proxy Service\n *\n * Validates and controls network access for sandboxed commands.\n * Provides domain-based access control and logging.\n */\n\nimport type { NetworkPolicy, SandboxViolation } from './types'\n\n/**\n * Result of a network access check\n */\nexport interface NetworkCheckResult {\n  allowed: boolean\n  violation?: SandboxViolation\n  promptRequired?: boolean\n  domain?: string\n}\n\n/**\n * Network access request\n */\nexport interface NetworkAccessRequest {\n  domain: string\n  protocol?: 'http' | 'https' | 'ssh' | 'git' | 'other'\n  port?: number\n  requestType?: 'outbound' | 'inbound'\n}\n\n/**\n * Network Proxy Controller\n */\nexport class NetworkProxy {\n  private policy: NetworkPolicy\n  private violations: SandboxViolation[] = []\n  private pendingDomains: Set<string> = new Set()\n  private approvedDomains: Set<string> = new Set()\n  private deniedDomains: Set<string> = new Set()\n\n  constructor(policy: NetworkPolicy) {\n    this.policy = policy\n    // Initialize approved domains from policy\n    for (const domain of policy.allowedDomains) {\n      this.approvedDomains.add(domain.toLowerCase())\n    }\n  }\n\n  /**\n   * Update the network policy\n   */\n  updatePolicy(policy: Partial<NetworkPolicy>): void {\n    this.policy = { ...this.policy, ...policy }\n    if (policy.allowedDomains) {\n      this.approvedDomains.clear()\n      for (const domain of policy.allowedDomains) {\n        this.approvedDomains.add(domain.toLowerCase())\n      }\n    }\n  }\n\n  /**\n   * Check if network access to a domain is allowed\n   */\n  checkAccess(request: NetworkAccessRequest): NetworkCheckResult {\n    const domain = request.domain.toLowerCase()\n\n    // Check if all network access is blocked\n    if (this.policy.blockAll) {\n      const violation = this.createViolation(\n        'network_blocked',\n        `Network access is blocked: attempted connection to ${domain}`,\n        domain,\n      )\n      this.violations.push(violation)\n      return { allowed: false, violation, domain }\n    }\n\n    // Check if domain was previously denied\n    if (this.deniedDomains.has(domain)) {\n      const violation = this.createViolation(\n        'network_domain_denied',\n        `Network access denied: ${domain} was previously rejected`,\n        domain,\n      )\n      this.violations.push(violation)\n      return { allowed: false, violation, domain }\n    }\n\n    // Check if domain is in approved list\n    if (this.isDomainApproved(domain)) {\n      return { allowed: true, domain }\n    }\n\n    // Check if we should prompt for new domains\n    if (this.policy.promptForNewDomains) {\n      this.pendingDomains.add(domain)\n      return {\n        allowed: false,\n        promptRequired: true,\n        domain,\n      }\n    }\n\n    // Default deny\n    const violation = this.createViolation(\n      'network_domain_denied',\n      `Network access denied: ${domain} is not in the allowed list`,\n      domain,\n    )\n    this.violations.push(violation)\n    return { allowed: false, violation, domain }\n  }\n\n  /**\n   * Analyze a command for network operations\n   */\n  analyzeCommand(command: string): {\n    networkRequests: NetworkAccessRequest[]\n    violations: SandboxViolation[]\n  } {\n    const networkRequests: NetworkAccessRequest[] = []\n    const violations: SandboxViolation[] = []\n\n    // Extract URLs and domains from command\n    const urlPatterns = [\n      // HTTP/HTTPS URLs\n      /https?:\\/\\/([^\\/\\s:]+)(?::\\d+)?/gi,\n      // curl/wget commands\n      /(?:curl|wget)\\s+(?:[^\\s]*\\s+)*[\"']?(https?:\\/\\/)?([^\\/\\s\"':]+)/gi,\n      // SSH/SCP commands\n      /(?:ssh|scp)\\s+(?:[^\\s]*\\s+)*(?:\\w+@)?([^:\\s\\/]+)/gi,\n      // git remote URLs\n      /git(?:@|:\\/\\/)([^:\\/\\s]+)/gi,\n      // npm registry\n      /registry\\.npmjs\\.org/gi,\n      // Package install commands that might download\n      /(?:npm|yarn|pnpm|bun)\\s+(?:install|add|i)\\s+/gi,\n      /pip\\s+install\\s+/gi,\n    ]\n\n    for (const pattern of urlPatterns) {\n      const matches = command.matchAll(pattern)\n      for (const match of matches) {\n        let domain = match[1] || match[2] || match[0]\n        // Clean up the domain\n        domain = domain\n          .replace(/^https?:\\/\\//, '')\n          .replace(/\\/.*$/, '')\n          .replace(/:.*$/, '')\n          .toLowerCase()\n\n        if (domain && this.isValidDomain(domain)) {\n          const protocol = this.detectProtocol(command, domain)\n          networkRequests.push({\n            domain,\n            protocol,\n            requestType: 'outbound',\n          })\n        }\n      }\n    }\n\n    // Check for package manager commands that imply network access\n    if (this.commandImpliesNetwork(command)) {\n      // Add common package registries\n      const impliedDomains = this.getImpliedDomains(command)\n      for (const domain of impliedDomains) {\n        if (!networkRequests.find(r => r.domain === domain)) {\n          networkRequests.push({\n            domain,\n            protocol: 'https',\n            requestType: 'outbound',\n          })\n        }\n      }\n    }\n\n    // Validate all network requests\n    for (const request of networkRequests) {\n      const result = this.checkAccess(request)\n      if (!result.allowed && result.violation) {\n        violations.push({\n          ...result.violation,\n          command,\n        })\n      }\n    }\n\n    return { networkRequests, violations }\n  }\n\n  /**\n   * Approve a pending domain\n   */\n  approveDomain(domain: string): void {\n    const lowerDomain = domain.toLowerCase()\n    this.approvedDomains.add(lowerDomain)\n    this.pendingDomains.delete(lowerDomain)\n    this.deniedDomains.delete(lowerDomain)\n  }\n\n  /**\n   * Deny a pending domain\n   */\n  denyDomain(domain: string): void {\n    const lowerDomain = domain.toLowerCase()\n    this.deniedDomains.add(lowerDomain)\n    this.pendingDomains.delete(lowerDomain)\n    this.approvedDomains.delete(lowerDomain)\n  }\n\n  /**\n   * Get pending domains that need approval\n   */\n  getPendingDomains(): string[] {\n    return [...this.pendingDomains]\n  }\n\n  /**\n   * Get all approved domains\n   */\n  getApprovedDomains(): string[] {\n    return [...this.approvedDomains]\n  }\n\n  /**\n   * Get all denied domains\n   */\n  getDeniedDomains(): string[] {\n    return [...this.deniedDomains]\n  }\n\n  /**\n   * Get all recorded violations\n   */\n  getViolations(): SandboxViolation[] {\n    return [...this.violations]\n  }\n\n  /**\n   * Clear violation history\n   */\n  clearViolations(): void {\n    this.violations = []\n  }\n\n  /**\n   * Check if a domain is approved (supports wildcards)\n   */\n  private isDomainApproved(domain: string): boolean {\n    // Direct match\n    if (this.approvedDomains.has(domain)) {\n      return true\n    }\n\n    // Check for wildcard matches\n    for (const approved of this.approvedDomains) {\n      if (approved.startsWith('*.')) {\n        const suffix = approved.slice(2)\n        if (domain.endsWith(suffix) || domain === suffix.slice(1)) {\n          return true\n        }\n      }\n      // Check if domain is a subdomain of approved\n      if (domain.endsWith(`.${approved}`)) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Validate a domain format\n   */\n  private isValidDomain(domain: string): boolean {\n    if (!domain || domain.length < 3) return false\n    // Basic domain validation\n    const domainRegex =\n      /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i\n    return domainRegex.test(domain)\n  }\n\n  /**\n   * Detect protocol from command context\n   */\n  private detectProtocol(\n    command: string,\n    domain: string,\n  ): NetworkAccessRequest['protocol'] {\n    if (command.includes('ssh') || command.includes('scp')) {\n      return 'ssh'\n    }\n    if (command.includes('git@') || command.includes('git://')) {\n      return 'git'\n    }\n    if (command.includes('https://')) {\n      return 'https'\n    }\n    if (command.includes('http://')) {\n      return 'http'\n    }\n    return 'https' // Default to https\n  }\n\n  /**\n   * Check if a command implies network access\n   */\n  private commandImpliesNetwork(command: string): boolean {\n    const networkCommands = [\n      /\\bnpm\\s+(install|i|add|update|publish)\\b/,\n      /\\byarn\\s+(add|upgrade|publish)\\b/,\n      /\\bpnpm\\s+(add|update|publish)\\b/,\n      /\\bbun\\s+(add|update|install)\\b/,\n      /\\bpip\\s+install\\b/,\n      /\\bcargo\\s+(install|update|publish)\\b/,\n      /\\bgo\\s+(get|install)\\b/,\n      /\\bgem\\s+install\\b/,\n      /\\bcomposer\\s+(install|require|update)\\b/,\n      /\\bcurl\\b/,\n      /\\bwget\\b/,\n      /\\bgit\\s+(clone|fetch|pull|push)\\b/,\n    ]\n\n    return networkCommands.some(pattern => pattern.test(command))\n  }\n\n  /**\n   * Get implied domains for package manager commands\n   */\n  private getImpliedDomains(command: string): string[] {\n    const domains: string[] = []\n\n    if (/\\bnpm\\b/.test(command)) {\n      domains.push('registry.npmjs.org')\n    }\n    if (/\\byarn\\b/.test(command)) {\n      domains.push('registry.yarnpkg.com', 'registry.npmjs.org')\n    }\n    if (/\\bpnpm\\b/.test(command)) {\n      domains.push('registry.npmjs.org')\n    }\n    if (/\\bbun\\b/.test(command)) {\n      domains.push('registry.npmjs.org')\n    }\n    if (/\\bpip\\b/.test(command)) {\n      domains.push('pypi.org', 'files.pythonhosted.org')\n    }\n    if (/\\bcargo\\b/.test(command)) {\n      domains.push('crates.io', 'static.crates.io')\n    }\n    if (/\\bgo\\s+(get|install)\\b/.test(command)) {\n      domains.push('proxy.golang.org', 'sum.golang.org')\n    }\n    if (/\\bgem\\b/.test(command)) {\n      domains.push('rubygems.org')\n    }\n    if (/\\bcomposer\\b/.test(command)) {\n      domains.push('packagist.org', 'repo.packagist.org')\n    }\n    if (/\\bgit\\s+(clone|fetch|pull|push)\\b/.test(command)) {\n      domains.push('github.com', 'gitlab.com', 'bitbucket.org')\n    }\n\n    return domains\n  }\n\n  /**\n   * Create a violation record\n   */\n  private createViolation(\n    type: SandboxViolation['type'],\n    details: string,\n    domain: string,\n  ): SandboxViolation {\n    return {\n      type,\n      timestamp: Date.now(),\n      command: '',\n      details,\n      domain,\n    }\n  }\n}\n"],
-  "mappings": "AAgCO,MAAM,aAAa;AAAA,EAChB;AAAA,EACA,aAAiC,CAAC;AAAA,EAClC,iBAA8B,oBAAI,IAAI;AAAA,EACtC,kBAA+B,oBAAI,IAAI;AAAA,EACvC,gBAA6B,oBAAI,IAAI;AAAA,EAE7C,YAAY,QAAuB;AACjC,SAAK,SAAS;AAEd,eAAW,UAAU,OAAO,gBAAgB;AAC1C,WAAK,gBAAgB,IAAI,OAAO,YAAY,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAAsC;AACjD,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO;AAC1C,QAAI,OAAO,gBAAgB;AACzB,WAAK,gBAAgB,MAAM;AAC3B,iBAAW,UAAU,OAAO,gBAAgB;AAC1C,aAAK,gBAAgB,IAAI,OAAO,YAAY,CAAC;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,SAAmD;AAC7D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAG1C,QAAI,KAAK,OAAO,UAAU;AACxB,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,sDAAsD,MAAM;AAAA,QAC5D;AAAA,MACF;AACA,WAAK,WAAW,KAAKA,UAAS;AAC9B,aAAO,EAAE,SAAS,OAAO,WAAAA,YAAW,OAAO;AAAA,IAC7C;AAGA,QAAI,KAAK,cAAc,IAAI,MAAM,GAAG;AAClC,YAAMA,aAAY,KAAK;AAAA,QACrB;AAAA,QACA,0BAA0B,MAAM;AAAA,QAChC;AAAA,MACF;AACA,WAAK,WAAW,KAAKA,UAAS;AAC9B,aAAO,EAAE,SAAS,OAAO,WAAAA,YAAW,OAAO;AAAA,IAC7C;AAGA,QAAI,KAAK,iBAAiB,MAAM,GAAG;AACjC,aAAO,EAAE,SAAS,MAAM,OAAO;AAAA,IACjC;AAGA,QAAI,KAAK,OAAO,qBAAqB;AACnC,WAAK,eAAe,IAAI,MAAM;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,KAAK;AAAA,MACrB;AAAA,MACA,0BAA0B,MAAM;AAAA,MAChC;AAAA,IACF;AACA,SAAK,WAAW,KAAK,SAAS;AAC9B,WAAO,EAAE,SAAS,OAAO,WAAW,OAAO;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,SAGb;AACA,UAAM,kBAA0C,CAAC;AACjD,UAAM,aAAiC,CAAC;AAGxC,UAAM,cAAc;AAAA;AAAA,MAElB;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AAEA,eAAW,WAAW,aAAa;AACjC,YAAM,UAAU,QAAQ,SAAS,OAAO;AACxC,iBAAW,SAAS,SAAS;AAC3B,YAAI,SAAS,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,MAAM,CAAC;AAE5C,iBAAS,OACN,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,SAAS,EAAE,EACnB,QAAQ,QAAQ,EAAE,EAClB,YAAY;AAEf,YAAI,UAAU,KAAK,cAAc,MAAM,GAAG;AACxC,gBAAM,WAAW,KAAK,eAAe,SAAS,MAAM;AACpD,0BAAgB,KAAK;AAAA,YACnB;AAAA,YACA;AAAA,YACA,aAAa;AAAA,UACf,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,QAAI,KAAK,sBAAsB,OAAO,GAAG;AAEvC,YAAM,iBAAiB,KAAK,kBAAkB,OAAO;AACrD,iBAAW,UAAU,gBAAgB;AACnC,YAAI,CAAC,gBAAgB,KAAK,OAAK,EAAE,WAAW,MAAM,GAAG;AACnD,0BAAgB,KAAK;AAAA,YACnB;AAAA,YACA,UAAU;AAAA,YACV,aAAa;AAAA,UACf,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,eAAW,WAAW,iBAAiB;AACrC,YAAM,SAAS,KAAK,YAAY,OAAO;AACvC,UAAI,CAAC,OAAO,WAAW,OAAO,WAAW;AACvC,mBAAW,KAAK;AAAA,UACd,GAAG,OAAO;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO,EAAE,iBAAiB,WAAW;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc,QAAsB;AAClC,UAAM,cAAc,OAAO,YAAY;AACvC,SAAK,gBAAgB,IAAI,WAAW;AACpC,SAAK,eAAe,OAAO,WAAW;AACtC,SAAK,cAAc,OAAO,WAAW;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,QAAsB;AAC/B,UAAM,cAAc,OAAO,YAAY;AACvC,SAAK,cAAc,IAAI,WAAW;AAClC,SAAK,eAAe,OAAO,WAAW;AACtC,SAAK,gBAAgB,OAAO,WAAW;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,oBAA8B;AAC5B,WAAO,CAAC,GAAG,KAAK,cAAc;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,qBAA+B;AAC7B,WAAO,CAAC,GAAG,KAAK,eAAe;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,mBAA6B;AAC3B,WAAO,CAAC,GAAG,KAAK,aAAa;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAoC;AAClC,WAAO,CAAC,GAAG,KAAK,UAAU;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAwB;AACtB,SAAK,aAAa,CAAC;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAiB,QAAyB;AAEhD,QAAI,KAAK,gBAAgB,IAAI,MAAM,GAAG;AACpC,aAAO;AAAA,IACT;AAGA,eAAW,YAAY,KAAK,iBAAiB;AAC3C,UAAI,SAAS,WAAW,IAAI,GAAG;AAC7B,cAAM,SAAS,SAAS,MAAM,CAAC;AAC/B,YAAI,OAAO,SAAS,MAAM,KAAK,WAAW,OAAO,MAAM,CAAC,GAAG;AACzD,iBAAO;AAAA,QACT;AAAA,MACF;AAEA,UAAI,OAAO,SAAS,IAAI,QAAQ,EAAE,GAAG;AACnC,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,QAAyB;AAC7C,QAAI,CAAC,UAAU,OAAO,SAAS,EAAG,QAAO;AAEzC,UAAM,cACJ;AACF,WAAO,YAAY,KAAK,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKQ,eACN,SACA,QACkC;AAClC,QAAI,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,GAAG;AACtD,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAS,MAAM,KAAK,QAAQ,SAAS,QAAQ,GAAG;AAC1D,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAS,UAAU,GAAG;AAChC,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAS,SAAS,GAAG;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAAsB,SAA0B;AACtD,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO,gBAAgB,KAAK,aAAW,QAAQ,KAAK,OAAO,CAAC;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,SAA2B;AACnD,UAAM,UAAoB,CAAC;AAE3B,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,oBAAoB;AAAA,IACnC;AACA,QAAI,WAAW,KAAK,OAAO,GAAG;AAC5B,cAAQ,KAAK,wBAAwB,oBAAoB;AAAA,IAC3D;AACA,QAAI,WAAW,KAAK,OAAO,GAAG;AAC5B,cAAQ,KAAK,oBAAoB;AAAA,IACnC;AACA,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,oBAAoB;AAAA,IACnC;AACA,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,YAAY,wBAAwB;AAAA,IACnD;AACA,QAAI,YAAY,KAAK,OAAO,GAAG;AAC7B,cAAQ,KAAK,aAAa,kBAAkB;AAAA,IAC9C;AACA,QAAI,yBAAyB,KAAK,OAAO,GAAG;AAC1C,cAAQ,KAAK,oBAAoB,gBAAgB;AAAA,IACnD;AACA,QAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,cAAQ,KAAK,cAAc;AAAA,IAC7B;AACA,QAAI,eAAe,KAAK,OAAO,GAAG;AAChC,cAAQ,KAAK,iBAAiB,oBAAoB;AAAA,IACpD;AACA,QAAI,oCAAoC,KAAK,OAAO,GAAG;AACrD,cAAQ,KAAK,cAAc,cAAc,eAAe;AAAA,IAC1D;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,gBACN,MACA,SACA,QACkB;AAClB,WAAO;AAAA,MACL;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
-  "names": ["violation"]
-}