approval-md 0.2.0 → 0.3.0

package/dist/src/core/sandbox.js

@@ -125,6 +125,77 @@ export const SANDBOX_STATES = [
 ];
 /** The default: nothing allowed, nothing denied beyond the network. */
 export const DENY_ALL_EGRESS = { loopback: false, denyRead: [] };
+/**
+ * What a process must be able to read to exist, regardless of the jail.
+ *
+ * Deliberately a fixed compiled-in list rather than anything a caller supplies:
+ * a jail whose runtime set could be widened by the party under oversight is not
+ * a jail (SPEC.md §11.1, self-reported fields never reduce scrutiny).
+ *
+ * - `/usr/lib`, `/usr/share`, `/System`, `/Library` — dyld, the shared cache,
+ *   ICU data and the frameworks every Mach-O binary links. A profile without
+ *   them kills the process before `main`, which reads as the command failing
+ *   rather than as the sandbox working.
+ * - `/private/var/db/dyld` and `/var/db/dyld` — the dyld shared cache, which
+ *   moved out of `/usr/lib` and is opened by name.
+ * - `/dev` — `/dev/null`, `/dev/urandom`, `/dev/dtracehelper`, the tty.
+ * - `/bin`, `/usr/bin`, `/sbin`, `/usr/sbin`, `/opt/homebrew`, `/usr/local` —
+ *   the interpreters and tools a build shells out to. The node binary's own
+ *   realpath is added separately by {@link runtimeReadRoots}, because a Node
+ *   installed by a version manager lives under the user's home and none of
+ *   these covers it.
+ * - `/etc`, `/private/etc` — `resolv.conf`, `passwd`, the locale tables.
+ *
+ * `node_modules` is NOT here, and that is a stated limit rather than an
+ * oversight: a repository's dependencies live inside the repository, so they
+ * are covered by the gate root being a read root. A project whose dependencies
+ * sit OUTSIDE the root (a pnpm store elsewhere, a linked package) must name
+ * that directory in `read_scope.roots`, which is exactly the widening that key
+ * exists for. docs/sandboxed-exec.md says so beside the survey.
+ *
+ * **The temp roots are not here either**, and that one is load-bearing. They
+ * reach the profile through the CALLER — `resolveReadRoots` puts the session
+ * scratchpad and the system temp root in the effective read scope, so
+ * `approval run` and `approval sandbox` open them and build tooling keeps
+ * working — and a caller that passes narrower roots gets a narrower jail. A
+ * temp root compiled in here would have been a widening no operator could turn
+ * off and no test could demonstrate a denial against, which is how it was
+ * found.
+ */
+export const RUNTIME_READ_PATHS = [
+    "/usr/lib",
+    "/usr/share",
+    "/System",
+    "/Library",
+    "/private/var/db/dyld",
+    "/var/db/dyld",
+    "/dev",
+    "/bin",
+    "/sbin",
+    "/usr/bin",
+    "/usr/sbin",
+    "/usr/local",
+    "/opt/homebrew",
+    "/etc",
+    "/private/etc",
+];
+/**
+ * The runtime set plus this process's own interpreter.
+ *
+ * `process.execPath` is resolved because a version manager's `node` is usually
+ * a symlink, and a `subpath` rule matches what the KERNEL resolves rather than
+ * what the profile was handed (the lesson APRV-193's design lane paid for).
+ */
+function runtimeReadRoots() {
+    const roots = [...RUNTIME_READ_PATHS];
+    try {
+        roots.push(dirname(realpathSync(process.execPath)));
+    }
+    catch {
+        // A process that cannot resolve its own binary is one the jail cannot help.
+    }
+    return roots;
+}
 // ---------------------------------------------------------------------------
 // The credential material
 // ---------------------------------------------------------------------------
@@ -293,6 +364,39 @@ export function seatbeltProfile(allowance) {
     if (allowance.loopback) {
         lines.push(";; Carve-out: a suite that starts its own localhost server. A real widening.", '(allow network-outbound (remote ip "localhost:*"))');
     }
+    // APRV-347, the read jail. Emitted between the egress rules and the
+    // credential denials, and the ORDER is the policy: SBPL takes the last
+    // matching rule, so the roots open the filesystem and `denyRead` closes the
+    // credential material inside them afterwards. An empty (or absent)
+    // `allowRead` emits nothing at all, which is why a profile built without it
+    // is byte-identical to the profile this function produced before this task.
+    const allowRead = allowance.allowRead ?? [];
+    if (allowRead.length > 0) {
+        lines.push(";; APRV-347: the read jail. Deny-default, then the roots and the fixed", ";; runtime set a process needs to start at all.", "(deny file-read*)");
+        const seen = new Set();
+        for (const path of [...allowRead, ...runtimeReadRoots()]) {
+            const resolved = resolveForProfile(path);
+            if (seen.has(resolved))
+                continue;
+            seen.add(resolved);
+            lines.push(`(allow file-read* (subpath ${sbplString(resolved)}))`);
+        }
+        // The ROOT DIRECTORY needs `file-read*`, not metadata, and this was
+        // measured rather than reasoned: with every other directory a process needs
+        // opened by subpath and `/` allowed for metadata only, `/usr/bin/true`
+        // dies with SIGABRT before `main`. `/` alone, as a literal: it opens the
+        // top-level directory listing and no file in it.
+        lines.push('(allow file-read* (literal "/"))');
+        // `file-read-metadata` on every other ancestor of every allowed root:
+        // resolving a path means stat-ing each directory on the way down, and a
+        // jail that denied that would refuse `/Users/x/dev/muse` for lack of
+        // `/Users`. Metadata leaks a directory's existence, never its contents.
+        for (const ancestor of ancestorsOf([...seen])) {
+            if (ancestor === "/")
+                continue;
+            lines.push(`(allow file-read-metadata (literal ${sbplString(ancestor)}))`);
+        }
+    }
     for (const path of allowance.denyRead) {
         const resolved = resolveForProfile(path);
         // `literal` for a file, `subpath` for a directory. Both are emitted for a
@@ -312,8 +416,91 @@ export function seatbeltProfile(allowance) {
         if (!file)
             lines.push(`(deny file-read* (subpath ${sbplString(resolved)}))`);
     }
+    if (allowance.writeAllow !== undefined) {
+        lines.push(";; APRV-325.3: write confinement. Deny-DEFAULT for this rule family only,", ";; so a path nobody thought of is denied rather than forgotten.", "(deny file-write*)", ";; /dev is process I/O, not filesystem state. Denying it kills a shell", ";; before it can do anything, for the reason a bare network-outbound deny does.", '(allow file-write* (subpath "/dev"))');
+        for (const path of allowance.writeAllow) {
+            lines.push(`(allow file-write* (subpath ${sbplString(resolveForProfile(path))}))`);
+        }
+    }
     return `${lines.join("\n")}\n`;
 }
+/**
+ * The read jail, plus the directories the command being run lives in (APRV-347).
+ *
+ * You cannot run a program you may not read. `sandbox-exec` execs the RESOLVED
+ * path, so a `node` or `npm` installed outside the compiled-in runtime set — a
+ * version manager under `~`, a `.local/bin` shim — fails `execvp` with
+ * `Operation not permitted` and exits 71, which reads as the command failing
+ * rather than as the jail working.
+ *
+ * Two directories are opened: the resolved executable's own, and its PARENT.
+ * The parent is what makes a toolchain work rather than merely start: an
+ * interpreter's entry point lives at `<prefix>/bin/<name>` and the library it
+ * immediately requires lives at `<prefix>/lib` or beside it, so opening only
+ * `bin` gets a process that launches and cannot find itself. `npm` resolves to
+ * `…/lib/node_modules/npm/bin/npm-cli.js`, whose parent is the npm package, and
+ * that is the shape this rule is for.
+ *
+ * It is NOT a widening a caller chooses: it is derived from the argv this
+ * function was already given, and it does nothing at all when no jail was
+ * asked for. Anything a command needs BEYOND its own install prefix — a
+ * dependency store elsewhere, a linked package — is the operator's
+ * `read_scope.roots` to declare.
+ */
+function withExecutableRoots(allowance, command) {
+    const jail = allowance.allowRead ?? [];
+    if (jail.length === 0)
+        return allowance;
+    let real = command;
+    try {
+        real = realpathSync(command);
+    }
+    catch {
+        // Not resolvable: the caller already handles a command that is not there.
+    }
+    const own = dirname(real);
+    // `dirname(command)` as well as `dirname(real)`: a PATH entry is usually a
+    // directory of symlinks (`~/.local/bin/npm` -> a version manager's tree), and
+    // traversing the link needs the link's own directory open, not just the
+    // target's. Leaving it out fails `execvp` before the program starts.
+    const roots = [own, dirname(command)];
+    // The prefix, behind a DEPTH FLOOR. `dirname("/bin")` is `/`, and a root of
+    // `/` would open the entire filesystem — a jail that opened everything and
+    // reported nothing, which is the worst failure this file can have. Two
+    // segments, the same floor the hook applies to a scratch root and for the
+    // same reason: a value derived from somewhere else must not be able to name
+    // the root of the disk.
+    const prefix = dirname(own);
+    if (prefix.split("/").filter((segment) => segment.length > 0).length >= 2) {
+        roots.push(prefix);
+    }
+    return { ...allowance, allowRead: [...jail, ...roots] };
+}
+/**
+ * Every proper ancestor directory of these paths, sorted and de-duplicated.
+ *
+ * `subpath` opens a subtree; it says nothing about the directories ABOVE it,
+ * and opening `/Users/carter/dev/muse` is useless if the process may not stat
+ * `/Users`, `/Users/carter` and `/Users/carter/dev` on the way down. Metadata
+ * only: the names of the intermediate directories leak, their contents do not.
+ */
+function ancestorsOf(paths) {
+    const out = new Set();
+    for (const path of paths) {
+        let at = dirname(path);
+        for (let depth = 0; depth < 64; depth += 1) {
+            if (at === "/" || at === "." || at === "")
+                break;
+            out.add(at);
+            const up = dirname(at);
+            if (up === at)
+                break;
+            at = up;
+        }
+    }
+    out.add("/");
+    return [...out].sort();
+}
 /**
  * A path as an SBPL string literal.
  *
@@ -377,7 +564,9 @@ export function wrapForSandbox(mechanism, command, args, allowance = DENY_ALL_EG
     }
     const dir = mkdtempSync(join(realTmpdir(), "approval-sandbox-"));
     const profile = join(dir, "egress-denied.sb");
-    writeFileSync(profile, seatbeltProfile(allowance), { mode: 0o600 });
+    writeFileSync(profile, seatbeltProfile(withExecutableRoots(allowance, command)), {
+        mode: 0o600,
+    });
     return {
         command: SANDBOX_EXEC,
         args: [...profileFlags(profile), command, ...args],

package/dist/src/core/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,cAAc,CAAU,CAAC;AAG5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kDAAkD;IAClD,eAAe;IACf,+EAA+E;IAC/E,WAAW;IACX;;;;OAIG;IACH,gBAAgB;IAChB;;;;OAIG;IACH,aAAa;CACL,CAAC;AA6CX,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAElF,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAO/D,kFAAkF;AAClF,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,4DAA4D;AAC5D,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,SAAkB;IACrD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,OAAsB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC,GAAG,qBAAqB,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,WAAW,CAChB,0DAA0D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iDAAiD,EACnI,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,GAAG,YAAY,aAAa,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,EAAE;YAClF,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,WAAW,CAAC,uDAAuD,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,IAAI,MAAM,GAA4B,IAAI,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAO,GAAkB,EAAE;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC;IAC7E,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,MAAM,KAAK,GAAG;QACZ,aAAa;QACb,kFAAkF;QAClF,iBAAiB;QACjB,yBAAyB;QACzB,6EAA6E;QAC7E,wEAAwE;QACxE,wCAAwC;KACzC,CAAC;IACF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YACH,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,GAAG,CAAC,SAAS,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnE,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACjG,IAAI,gBAAgB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,6EAA6E;QAC7E,4EAA4E;QAC5E,wCAAwC;QACxC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA2B,EAC3B,OAAe,EACf,IAAuB,EACvB,SAAS,GAAoB,eAAe;IAE5C,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QACjC,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC9C,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAClD,OAAO,EAAE,GAAG;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,cAAc,CAAU,CAAC;AAG5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kDAAkD;IAClD,eAAe;IACf,+EAA+E;IAC/E,WAAW;IACX;;;;OAIG;IACH,gBAAgB;IAChB;;;;OAIG;IACH,aAAa;CACL,CAAC;AAwFX,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,YAAY;IACZ,SAAS;IACT,UAAU;IACV,sBAAsB;IACtB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,cAAc;CACf,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAO/D,kFAAkF;AAClF,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,4DAA4D;AAC5D,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,SAAkB;IACrD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,OAAsB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC,GAAG,qBAAqB,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,WAAW,CAChB,0DAA0D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iDAAiD,EACnI,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,GAAG,YAAY,aAAa,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,EAAE;YAClF,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,WAAW,CAAC,uDAAuD,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,IAAI,MAAM,GAA4B,IAAI,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAO,GAAkB,EAAE;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC;IAC7E,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,MAAM,KAAK,GAAG;QACZ,aAAa;QACb,kFAAkF;QAClF,iBAAiB;QACjB,yBAAyB;QACzB,6EAA6E;QAC7E,wEAAwE;QACxE,wCAAwC;KACzC,CAAC;IACF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,wEAAwE,EACxE,iDAAiD,EACjD,mBAAmB,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,8BAA8B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,iDAAiD;QACjD,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC/C,sEAAsE;QACtE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9C,IAAI,QAAQ,KAAK,GAAG;gBAAE,SAAS;YAC/B,KAAK,CAAC,IAAI,CAAC,sCAAsC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YACH,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,GAAG,CAAC,SAAS,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,2EAA2E,EAC3E,iEAAiE,EACjE,oBAAoB,EACpB,wEAAwE,EACxE,iFAAiF,EACjF,sCAAsC,CACvC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,+BAA+B,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,mBAAmB,CAAC,SAA0B,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAwB;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM;YACjD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM;YACrB,EAAE,GAAG,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnE,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACjG,IAAI,gBAAgB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,6EAA6E;QAC7E,4EAA4E;QAC5E,wCAAwC;QACxC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA2B,EAC3B,OAAe,EACf,IAAuB,EACvB,SAAS,GAAoB,eAAe;IAE5C,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QACjC,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC9C,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE;QAC/E,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAClD,OAAO,EAAE,GAAG;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC;AAC1C,CAAC"}