pi-codex-auto-review 0.1.0

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-decode.js

@@ -0,0 +1,138 @@
+/**
+ * Decoding support for encoded credential formats (`decode` on a
+ * `credentials.files` entry). Currently JWT only.
+ *
+ * Pure helpers: the default extraction pattern for finding JWT candidates
+ * in a file, the verification predicate that confirms a candidate actually
+ * is a JWT before it gets masked, and the minting of a JWT-shaped fake to
+ * stand in for the real token inside the sandbox.
+ */
+import { SENTINEL_PREFIX } from './credential-sentinel.js';
+/**
+ * Default `extract` pattern for `decode: "jwt"` entries.
+ *
+ * A JWT's first segment is the base64url encoding of a JSON header that
+ * starts `{"` (it always declares `alg`/`typ`), and base64url of `{"` is
+ * `eyJ` — so every JWT starts with `eyJ`. Capture group 1 is the whole
+ * three-segment token. The pattern over-matches (any eyJ-prefixed
+ * base64url triple); {@link verifyJwt} filters the false positives.
+ */
+export const JWT_DEFAULT_EXTRACT_PATTERN = '(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)';
+/** Parse a base64url segment as JSON, or undefined if either step fails. */
+function decodeSegment(segment) {
+    try {
+        return JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * True when `candidate` is structurally a JWT: three dot-separated
+ * segments, the first two base64url-decoding to JSON, and the header
+ * (segment 1) declaring an `alg` property.
+ *
+ * Used to filter extraction candidates before masking — a regex match
+ * that fails this check (e.g. a random base64 blob the default pattern
+ * over-matched) is left untouched rather than masked.
+ */
+export function verifyJwt(candidate) {
+    const parts = candidate.split('.');
+    if (parts.length !== 3)
+        return false;
+    const header = decodeSegment(parts[0]);
+    if (typeof header !== 'object' || header === null || !('alg' in header)) {
+        return false;
+    }
+    return decodeSegment(parts[1]) !== undefined;
+}
+/**
+ * Fixed far-future `exp` claim for fake JWTs (2286-11-20). A constant, not
+ * an offset from now, so the fake is fully deterministic given the uuid.
+ */
+const FAKE_JWT_EXP = 9999999999;
+/** Fixed signature filler: base64url("srt-fake"). Never a valid signature. */
+const FAKE_JWT_SIGNATURE = 'c3J0LWZha2U';
+function base64url(s) {
+    return Buffer.from(s, 'utf8').toString('base64url');
+}
+/**
+ * Mint a structurally valid fake JWT carrying the sentinel identity
+ * `fake_value_<uuid>` in its `sub` claim. Deterministic given `uuid`.
+ *
+ * The fake is parseable by client-side JWT handling (three segments, JSON
+ * header/payload, far-future `exp`), so a tool inside the sandbox that
+ * inspects the token before sending it doesn't break. The header says
+ * `alg: HS256` — NOT `alg: none` — deliberately: misconfigured validators
+ * accept `alg: none` tokens as valid, whereas an HS256 header forces every
+ * validator to attempt signature verification and reject the garbage
+ * signature. So if the fake ever reaches a verifier unswapped (e.g. sent
+ * to a non-injectHosts destination, the designed fail-closed pass-through),
+ * it is cryptographically rejected.
+ */
+export function mintFakeJwt(uuid) {
+    const header = base64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+    const payload = base64url(JSON.stringify({ sub: SENTINEL_PREFIX + uuid, exp: FAKE_JWT_EXP }));
+    return `${header}.${payload}.${FAKE_JWT_SIGNATURE}`;
+}
+/**
+ * Claim-level masking for a verified JWT: replace each named top-level
+ * payload claim that is present with a string value by a caller-provided
+ * sentinel, and rebuild the token around the modified payload.
+ *
+ * The rebuilt token is `header.payload'.signature-filler`:
+ *
+ * - **Header**: the original base64url segment is reused verbatim, so the
+ *   token still advertises the real `alg`/`typ`/`kid` and client-side
+ *   header inspection sees exactly what it would outside the sandbox.
+ * - **Payload**: the decoded object with the named claims swapped for
+ *   sentinels, re-encoded with `JSON.stringify`. Key order and whitespace
+ *   inside the payload segment may differ from the original encoding —
+ *   irrelevant to any JSON consumer, and the segment bytes change anyway
+ *   because a claim value changed.
+ * - **Signature**: the fixed filler from {@link mintFakeJwt}, NOT the real
+ *   signature. For RS/ES algorithms signature verification needs only the
+ *   public key, so shipping the real signature over a modified payload
+ *   would hand the sandbox an offline brute-force oracle for a low-entropy
+ *   masked claim (guess the claim, re-encode, verify). The filler also
+ *   keeps the fake a non-credential end to end, consistent with the
+ *   garbage-signature rationale in {@link mintFakeJwt}.
+ *
+ * Claims that are absent from the payload, or present with a non-string
+ * value, are skipped (the caller logs them). Returns `null` — without
+ * invoking `sentinelFor` — when no named claim matched, or when the
+ * payload does not decode to a JSON object; the caller routes that
+ * through its no-match policy.
+ *
+ * Pure on `token`/`claims`; the callback may close over a registry.
+ */
+export function maskJwtClaims(token, claims, sentinelFor) {
+    const [headerSeg, payloadSeg] = token.split('.');
+    const payload = decodeSegment(payloadSeg ?? '');
+    // verifyJwt only guarantees the payload is JSON — it could still be a
+    // scalar or array, which has no claims to mask.
+    if (typeof payload !== 'object' || payload === null || Array.isArray(payload))
+        return null;
+    const record = payload;
+    // Collect matches before minting any sentinel, so a null return never
+    // leaves an orphaned registration behind in the caller's registry.
+    const matched = [];
+    for (const claim of claims) {
+        const value = record[claim];
+        if (typeof value === 'string')
+            matched.push([claim, value]);
+    }
+    if (matched.length === 0)
+        return null;
+    const claimSentinels = new Map();
+    for (const [claim, value] of matched) {
+        const sentinel = sentinelFor(claim, value);
+        record[claim] = sentinel;
+        claimSentinels.set(claim, sentinel);
+    }
+    return {
+        fakeToken: `${headerSeg}.${base64url(JSON.stringify(record))}.${FAKE_JWT_SIGNATURE}`,
+        claimSentinels,
+    };
+}
+//# sourceMappingURL=credential-decode.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-decode.js","sourceRoot":"","sources":["../../src/sandbox/credential-decode.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,uDAAuD,CAAA;AAEzD,4EAA4E;AAC5E,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB;IACzC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,SAAS,CAAA;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAAG,UAAU,CAAA;AAE/B,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAExC,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,SAAS,CACvB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CACnE,CAAA;IACD,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,kBAAkB,EAAE,CAAA;AACrD,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,MAAyB,EACzB,WAAyD;IAEzD,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IAC/C,sEAAsE;IACtE,gDAAgD;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3E,OAAO,IAAI,CAAA;IACb,MAAM,MAAM,GAAG,OAAkC,CAAA;IAEjD,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,OAAO,GAA0C,EAAE,CAAA;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAErC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAA;IAChD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAA;QACxB,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACrC,CAAC;IACD,OAAO;QACL,SAAS,EAAE,GAAG,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,kBAAkB,EAAE;QACpF,cAAc;KACf,CAAA;AACH,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-extract.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Structured credential extraction, shared by file masking
+ * (credential-mask-files.ts) and env-var masking (credential-mask-env.ts).
+ *
+ * `extract` is a regex whose capture group 1 picks the credential value(s)
+ * out of a larger text (a config file, a connection-string env var). Only
+ * the captured span(s) are replaced with sentinels; the rest of the text is
+ * preserved byte-for-byte so parsers still succeed inside the sandbox.
+ */
+/**
+ * Result of {@link extractAndSubstitute}: the content with each matched
+ * capture-group-1 span replaced by `sentinelFor(capture, i)`, plus the
+ * distinct captured values in first-seen (index) order.
+ */
+export interface ExtractResult {
+    fakeContent: string;
+    captures: string[];
+}
+/** Options for {@link extractAndSubstitute}. */
+export interface ExtractOptions {
+    /**
+     * If true, verbatim occurrences of each captured value *outside* the
+     * regex-matched spans are also replaced with that capture's sentinel —
+     * for a secret repeated where the regex does not reach (e.g. pasted
+     * into a comment). The scan matches raw substrings: a short or common
+     * captured value may corrupt unrelated content that happens to contain
+     * it, so this option is intended for long, high-entropy secrets.
+     */
+    maskDuplicates?: boolean;
+}
+/**
+ * Apply `pattern` globally to `content` and return `content` with each
+ * matched capture-group-1 span replaced by `sentinelFor(capture, i)`,
+ * where `i` is the zero-based index of the distinct captured value in
+ * first-seen order.
+ *
+ * Offset-based: the regex `d` flag exposes capture-group offsets, so the
+ * output is built by slicing between spans and splicing the sentinel in
+ * at the exact `[start, end)` of group 1. By default only the
+ * regex-matched span is replaced — a captured value that coincidentally
+ * appears elsewhere in the content (outside any match) is left intact. No
+ * placeholder pass, no substring-ordering concern.
+ *
+ * With `maskDuplicates` (see {@link ExtractOptions}), an indexOf scan
+ * additionally collects every verbatim occurrence of each captured value
+ * elsewhere in the content. All spans are computed against the ORIGINAL
+ * content — never the partially substituted output — so an inserted
+ * sentinel can never be re-matched and corrupted, even when a captured
+ * value is a substring of the sentinel literal. Regex-match spans win
+ * over verbatim ones, and verbatim scans run longest-capture-first so a
+ * shorter capture that is a substring of a longer one cannot claim part
+ * of the longer secret's occurrence. A capture the callback declined to
+ * mask (returned unchanged — the decode-verification gate) is excluded
+ * from the verbatim scan.
+ *
+ * Returns `null` when the pattern matches nothing — the caller routes
+ * that per the entry's `onExtractNoMatch` option (warn / deny / error).
+ *
+ * Throws when a match has no group-1 capture. The schema already rejects
+ * patterns with zero groups, so this only fires when group 1 is optional
+ * and absent for some match (e.g. `"token: (\\S+)?"`); accepting that
+ * would silently mask nothing for that occurrence.
+ *
+ * Pure on `content`/`pattern`; the callback may close over a registry.
+ */
+export declare function extractAndSubstitute(content: string, pattern: string, sentinelFor: (capture: string, index: number) => string, options?: ExtractOptions): ExtractResult | null;
+//# sourceMappingURL=credential-extract.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-extract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-extract.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAWD,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,EACvD,OAAO,GAAE,cAAmB,GAC3B,aAAa,GAAG,IAAI,CAuEtB"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-extract.js

@@ -0,0 +1,113 @@
+/**
+ * Structured credential extraction, shared by file masking
+ * (credential-mask-files.ts) and env-var masking (credential-mask-env.ts).
+ *
+ * `extract` is a regex whose capture group 1 picks the credential value(s)
+ * out of a larger text (a config file, a connection-string env var). Only
+ * the captured span(s) are replaced with sentinels; the rest of the text is
+ * preserved byte-for-byte so parsers still succeed inside the sandbox.
+ */
+/**
+ * Apply `pattern` globally to `content` and return `content` with each
+ * matched capture-group-1 span replaced by `sentinelFor(capture, i)`,
+ * where `i` is the zero-based index of the distinct captured value in
+ * first-seen order.
+ *
+ * Offset-based: the regex `d` flag exposes capture-group offsets, so the
+ * output is built by slicing between spans and splicing the sentinel in
+ * at the exact `[start, end)` of group 1. By default only the
+ * regex-matched span is replaced — a captured value that coincidentally
+ * appears elsewhere in the content (outside any match) is left intact. No
+ * placeholder pass, no substring-ordering concern.
+ *
+ * With `maskDuplicates` (see {@link ExtractOptions}), an indexOf scan
+ * additionally collects every verbatim occurrence of each captured value
+ * elsewhere in the content. All spans are computed against the ORIGINAL
+ * content — never the partially substituted output — so an inserted
+ * sentinel can never be re-matched and corrupted, even when a captured
+ * value is a substring of the sentinel literal. Regex-match spans win
+ * over verbatim ones, and verbatim scans run longest-capture-first so a
+ * shorter capture that is a substring of a longer one cannot claim part
+ * of the longer secret's occurrence. A capture the callback declined to
+ * mask (returned unchanged — the decode-verification gate) is excluded
+ * from the verbatim scan.
+ *
+ * Returns `null` when the pattern matches nothing — the caller routes
+ * that per the entry's `onExtractNoMatch` option (warn / deny / error).
+ *
+ * Throws when a match has no group-1 capture. The schema already rejects
+ * patterns with zero groups, so this only fires when group 1 is optional
+ * and absent for some match (e.g. `"token: (\\S+)?"`); accepting that
+ * would silently mask nothing for that occurrence.
+ *
+ * Pure on `content`/`pattern`; the callback may close over a registry.
+ */
+export function extractAndSubstitute(content, pattern, sentinelFor, options = {}) {
+    // The schema validates `pattern` compiles; `g` makes matchAll iterate
+    // every occurrence and `d` populates `m.indices` with group offsets.
+    const re = new RegExp(pattern, 'gd');
+    const indexByCapture = new Map();
+    // First sentinel returned per capture — reused for verbatim spans so
+    // the duplicate pass never re-invokes the callback.
+    const sentinelByCapture = new Map();
+    const spans = [];
+    for (const m of content.matchAll(re)) {
+        const cap = m[1];
+        if (cap === undefined) {
+            throw new Error(`extract pattern /${pattern}/ matched at offset ${m.index} but ` +
+                `capture group 1 is undefined — group 1 must capture the ` +
+                `credential value on every match.`);
+        }
+        // Empty captures are skipped: a zero-width span has nothing to mask.
+        if (cap.length === 0)
+            continue;
+        let i = indexByCapture.get(cap);
+        if (i === undefined)
+            indexByCapture.set(cap, (i = indexByCapture.size));
+        const [start, end] = m.indices[1];
+        const sentinel = sentinelFor(cap, i);
+        if (!sentinelByCapture.has(cap))
+            sentinelByCapture.set(cap, sentinel);
+        spans.push({ start, end, sentinel });
+    }
+    if (indexByCapture.size === 0)
+        return null;
+    if (options.maskDuplicates) {
+        // Longest capture first: a shorter capture that is a substring of a
+        // longer one would otherwise claim part of the longer secret's
+        // occurrence and leave the remainder exposed.
+        const byLength = [...indexByCapture.keys()].sort((a, b) => b.length - a.length);
+        for (const cap of byLength) {
+            const sentinel = sentinelByCapture.get(cap);
+            // The callback declines masking by returning the capture itself
+            // (decode verification failed). Replacing a value with itself is a
+            // no-op, and its spans must not block other captures' duplicates —
+            // skip declined captures entirely.
+            if (sentinel === cap)
+                continue;
+            for (let start = content.indexOf(cap); start !== -1; start = content.indexOf(cap, start + 1)) {
+                const end = start + cap.length;
+                // Spans already collected (regex matches, then earlier — longer —
+                // captures' verbatim occurrences) win over this occurrence.
+                if (spans.some(s => start < s.end && s.start < end))
+                    continue;
+                spans.push({ start, end, sentinel });
+            }
+        }
+        spans.sort((a, b) => a.start - b.start);
+    }
+    // Spans are non-overlapping and sorted by offset (matchAll yields
+    // matches in order; the verbatim pass re-sorts), so a single
+    // slice-and-concat pass over the original content is sound.
+    let out = '';
+    let pos = 0;
+    for (const s of spans) {
+        out += content.slice(pos, s.start) + s.sentinel;
+        pos = s.end;
+    }
+    return {
+        fakeContent: out + content.slice(pos),
+        captures: [...indexByCapture.keys()],
+    };
+}
+//# sourceMappingURL=credential-extract.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-extract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-extract.js","sourceRoot":"","sources":["../../src/sandbox/credential-extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyCH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAe,EACf,WAAuD,EACvD,UAA0B,EAAE;IAE5B,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAA;IAChD,qEAAqE;IACrE,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnD,MAAM,KAAK,GAAsB,EAAE,CAAA;IACnC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAuC,EAAE,CAAC;QAC3E,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAChB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,uBAAuB,CAAC,CAAC,KAAK,OAAO;gBAC9D,0DAA0D;gBAC1D,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,qEAAqE;QACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC9B,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACrE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,oEAAoE;QACpE,+DAA+D;QAC/D,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAC9B,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;YAC5C,gEAAgE;YAChE,mEAAmE;YACnE,mEAAmE;YACnE,mCAAmC;YACnC,IAAI,QAAQ,KAAK,GAAG;gBAAE,SAAQ;YAC9B,KACE,IAAI,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAChC,KAAK,KAAK,CAAC,CAAC,EACZ,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EACvC,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAA;gBAC9B,kEAAkE;gBAClE,4DAA4D;gBAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC;oBAAE,SAAQ;gBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IACzC,CAAC;IAED,kEAAkE;IAClE,6DAA6D;IAC7D,4DAA4D;IAC5D,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC/C,GAAG,GAAG,CAAC,CAAC,GAAG,CAAA;IACb,CAAC;IACD,OAAO;QACL,WAAW,EAAE,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;QACrC,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;KACrC,CAAA;AACH,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-env.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Credential env-var masking.
+ *
+ * For a `credentials.envVars` entry with `mode: "mask"`, srt reads the real
+ * value from the host environment, registers one or more sentinels in the
+ * {@link SentinelRegistry}, and sets the variable to the fake value inside
+ * the sandbox (bwrap `--setenv` on Linux, the env preamble on macOS). The
+ * proxy substitutes sentinel→real on egress to the entry's injectHosts.
+ *
+ * Without `extract`, masking is **whole-value**: one sentinel replaces the
+ * entire value. With `extract`, masking is **structured**: a regex picks
+ * out the credential span(s) and only those are replaced, so a tool that
+ * parses the value (e.g. a `DATABASE_URL` connection string) still sees
+ * valid syntax. See {@link extractAndSubstitute} and
+ * {@link CredentialEnvVarConfigSchema}.
+ */
+import type { CredentialEnvVarConfig } from './sandbox-config.js';
+import type { SentinelRegistry } from './credential-sentinel.js';
+/** Result of {@link buildMaskedEnvVars}. */
+export interface MaskedEnvBuildResult {
+    /** NAME → fake value to set inside the sandbox. */
+    setEnvVars: Record<string, string>;
+    /**
+     * Names of `mode: "mask"` entries that degraded to unset at runtime —
+     * populated when `extract` matches nothing and the entry's
+     * `onExtractNoMatch` is `"deny"`. Callers union these into the
+     * unset-env set so the credential value is withheld rather than
+     * exposed (the env analog of a file degrading to `mode: "deny"`).
+     */
+    degradeToUnsetNames: string[];
+}
+/**
+ * For each `mode: "mask"` env-var entry: read the real value from `env`,
+ * build the fake value (whole-value or structured per `extract`), register
+ * sentinels in `registry`, and return the set-env map plus any entries
+ * that degraded to unset.
+ *
+ * Whole-value mode (no `extract`): one sentinel keyed on the bare variable
+ * name whose real value is the entire env value; the fake value *is* the
+ * sentinel.
+ *
+ * Structured mode (`extract` set): one sentinel per distinct captured
+ * value, keyed `env:<NAME>#<i>`; the fake value is the real value with
+ * each captured span replaced by its sentinel. If the regex matches
+ * nothing, the entry's `onExtractNoMatch` decides:
+ * - `"warn"` (default): skip the entry with a loud stderr warning —
+ *   fail-open, the variable passes through with its real value;
+ * - `"deny"`: push the name to `degradeToUnsetNames` — fail-closed, the
+ *   variable is unset inside the sandbox;
+ * - `"error"`: throw, so nothing runs until the regex is fixed.
+ *
+ * Decoded mode (`decode: "jwt"`): the whole value is verified as a JWT
+ * and replaced by a JWT-shaped fake registered as a caller-minted
+ * sentinel; with `maskClaims`, each named top-level payload claim present
+ * with a string value gets its own sentinel (keyed `env:<NAME>#<claim>`)
+ * and the token is rebuilt around the modified payload — BOTH the whole
+ * rebuilt token and each claim sentinel are registered under the same
+ * injectHosts. A value that does not verify — or, with `maskClaims`,
+ * verifies but has no named claim present as a string — fails open with a
+ * loud stderr warning.
+ *
+ * A masked variable with no value in `env` is skipped — there is nothing
+ * to protect, and emitting an unset (or set) var would change tool
+ * behaviour (presence checks would flip).
+ *
+ * `mode: "deny"` entries are ignored here; the caller handles them
+ * directly (they need no registry or host environment access).
+ */
+export declare function buildMaskedEnvVars(envVars: readonly CredentialEnvVarConfig[], allowedDomains: readonly string[], registry: SentinelRegistry, env?: Record<string, string | undefined>): MaskedEnvBuildResult;
+//# sourceMappingURL=credential-mask-env.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mask-env.d.ts","sourceRoot":"","sources":["../../src/sandbox/credential-mask-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAUhE,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,sBAAsB,EAAE,EAC1C,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,oBAAoB,CA2ItB"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-env.js

@@ -0,0 +1,171 @@
+/**
+ * Credential env-var masking.
+ *
+ * For a `credentials.envVars` entry with `mode: "mask"`, srt reads the real
+ * value from the host environment, registers one or more sentinels in the
+ * {@link SentinelRegistry}, and sets the variable to the fake value inside
+ * the sandbox (bwrap `--setenv` on Linux, the env preamble on macOS). The
+ * proxy substitutes sentinel→real on egress to the entry's injectHosts.
+ *
+ * Without `extract`, masking is **whole-value**: one sentinel replaces the
+ * entire value. With `extract`, masking is **structured**: a regex picks
+ * out the credential span(s) and only those are replaced, so a tool that
+ * parses the value (e.g. a `DATABASE_URL` connection string) still sees
+ * valid syntax. See {@link extractAndSubstitute} and
+ * {@link CredentialEnvVarConfigSchema}.
+ */
+import { randomUUID } from 'node:crypto';
+import { logForDebugging } from '../utils/debug.js';
+import { maskJwtClaims, mintFakeJwt, verifyJwt } from './credential-decode.js';
+import { extractAndSubstitute } from './credential-extract.js';
+/**
+ * Sentinel-registry key prefix for structured (extract) env-var captures.
+ * Whole-value env masking keys on the bare variable name; extract captures
+ * key on `env:<NAME>#<i>` so the two forms — and masked files, which use
+ * `file:<path>` — can never collide (env var names cannot contain `:`).
+ */
+const ENV_EXTRACT_KEY_PREFIX = 'env:';
+/**
+ * For each `mode: "mask"` env-var entry: read the real value from `env`,
+ * build the fake value (whole-value or structured per `extract`), register
+ * sentinels in `registry`, and return the set-env map plus any entries
+ * that degraded to unset.
+ *
+ * Whole-value mode (no `extract`): one sentinel keyed on the bare variable
+ * name whose real value is the entire env value; the fake value *is* the
+ * sentinel.
+ *
+ * Structured mode (`extract` set): one sentinel per distinct captured
+ * value, keyed `env:<NAME>#<i>`; the fake value is the real value with
+ * each captured span replaced by its sentinel. If the regex matches
+ * nothing, the entry's `onExtractNoMatch` decides:
+ * - `"warn"` (default): skip the entry with a loud stderr warning —
+ *   fail-open, the variable passes through with its real value;
+ * - `"deny"`: push the name to `degradeToUnsetNames` — fail-closed, the
+ *   variable is unset inside the sandbox;
+ * - `"error"`: throw, so nothing runs until the regex is fixed.
+ *
+ * Decoded mode (`decode: "jwt"`): the whole value is verified as a JWT
+ * and replaced by a JWT-shaped fake registered as a caller-minted
+ * sentinel; with `maskClaims`, each named top-level payload claim present
+ * with a string value gets its own sentinel (keyed `env:<NAME>#<claim>`)
+ * and the token is rebuilt around the modified payload — BOTH the whole
+ * rebuilt token and each claim sentinel are registered under the same
+ * injectHosts. A value that does not verify — or, with `maskClaims`,
+ * verifies but has no named claim present as a string — fails open with a
+ * loud stderr warning.
+ *
+ * A masked variable with no value in `env` is skipped — there is nothing
+ * to protect, and emitting an unset (or set) var would change tool
+ * behaviour (presence checks would flip).
+ *
+ * `mode: "deny"` entries are ignored here; the caller handles them
+ * directly (they need no registry or host environment access).
+ */
+export function buildMaskedEnvVars(envVars, allowedDomains, registry, env = process.env) {
+    const setEnvVars = {};
+    const degradeToUnsetNames = [];
+    for (const v of envVars) {
+        if (v.mode !== 'mask')
+            continue;
+        const real = env[v.name];
+        if (real === undefined)
+            continue;
+        // Effective injectHosts: per-entry narrows; if unset, default to
+        // every reachable host (network.allowedDomains). injectHosts is an
+        // *optional narrowing*, not a required allowlist. Trade-off: a
+        // masked credential with no injectHosts is injectable at every host
+        // the sandbox can reach — narrow it explicitly when the credential
+        // should only go to a subset.
+        const injectHosts = v.injectHosts ?? allowedDomains;
+        if (v.decode === 'jwt') {
+            if (!verifyJwt(real)) {
+                // Nothing was masked — the operator declared the value a JWT but
+                // it isn't one. Fail open with a loud warning (parallel to the
+                // extract onExtractNoMatch "warn" default).
+                const msg = `[sandbox-runtime] WARNING: credentials.envVars entry ` +
+                    `"${v.name}" has decode "jwt" but its value did not verify ` +
+                    `as a JWT. The variable is left UNPROTECTED (real value ` +
+                    `visible as-is inside the sandbox). Fix the config or remove ` +
+                    `the entry.`;
+                console.warn(msg);
+                logForDebugging(msg, { level: 'warn' });
+                continue;
+            }
+            if (v.maskClaims?.length) {
+                // Claim-level masking: sentinels go INSIDE the payload; the
+                // rebuilt fake token is itself registered as a sentinel for the
+                // whole real token, so both the bearer path (token sent
+                // verbatim) and the extracted-claim path substitute on egress.
+                const masked = maskJwtClaims(real, v.maskClaims, (claim, value) => registry.register(`${ENV_EXTRACT_KEY_PREFIX}${v.name}#${claim}`, value, injectHosts));
+                if (masked === null) {
+                    // A verified JWT none of whose named claims are present as
+                    // strings: nothing was masked — same fail-open posture as a
+                    // value that does not verify.
+                    const msg = `[sandbox-runtime] WARNING: credentials.envVars entry ` +
+                        `"${v.name}" has maskClaims ` +
+                        `${JSON.stringify(v.maskClaims)} but none is present as a ` +
+                        `string claim in its JWT value. The variable is left ` +
+                        `UNPROTECTED (real value visible as-is inside the sandbox). ` +
+                        `Fix the config or remove the entry.`;
+                    console.warn(msg);
+                    logForDebugging(msg, { level: 'warn' });
+                    continue;
+                }
+                const skipped = v.maskClaims.filter(c => !masked.claimSentinels.has(c));
+                if (skipped.length > 0) {
+                    logForDebugging(`[credential-mask] env var "${v.name}": maskClaims ` +
+                        `${JSON.stringify(skipped)} absent or non-string in the ` +
+                        `JWT — skipped.`);
+                }
+                setEnvVars[v.name] = registry.registerWithSentinel(`${ENV_EXTRACT_KEY_PREFIX}${v.name}`, masked.fakeToken, real, injectHosts);
+                continue;
+            }
+            // JWT-shaped fake so token-parsing tools inside the sandbox keep
+            // working; the proxy swaps the whole fake token on egress. Keyed
+            // env:<NAME> — caller-minted keys stay disjoint from the file:
+            // namespace and from plain masked env vars.
+            setEnvVars[v.name] = registry.registerWithSentinel(`${ENV_EXTRACT_KEY_PREFIX}${v.name}`, mintFakeJwt(randomUUID()), real, injectHosts);
+            continue;
+        }
+        if (v.extract === undefined) {
+            // Whole-value: one sentinel for the entire value.
+            setEnvVars[v.name] = registry.register(v.name, real, injectHosts);
+            continue;
+        }
+        const extracted = extractAndSubstitute(real, v.extract, (cap, i) => registry.register(`${ENV_EXTRACT_KEY_PREFIX}${v.name}#${i}`, cap, injectHosts));
+        if (extracted === null) {
+            const onNoMatch = v.onExtractNoMatch ?? 'warn';
+            if (onNoMatch === 'error') {
+                throw new Error(`credentials.envVars entry "${v.name}": extract pattern ` +
+                    `"${v.extract}" matched nothing (onExtractNoMatch: "error"). ` +
+                    `Fix the regex, change to "warn"/"deny", or remove the entry.`);
+            }
+            if (onNoMatch === 'deny') {
+                // Fail-closed: the operator declared this variable as containing
+                // a credential. Masking can't apply — degrade to unset so the
+                // sandboxed process cannot read the credential at all.
+                logForDebugging(`[credential-mask] extract pattern /${v.extract}/ matched ` +
+                    `nothing in the value of ${v.name} — unsetting the variable.`, { level: 'warn' });
+                degradeToUnsetNames.push(v.name);
+                continue;
+            }
+            // 'warn' (default): fail-open. A non-matching pattern is a config
+            // error to surface, not a reason to break a tool that needs the
+            // variable. Skip the entry — the variable is inherited with its
+            // real value — and warn loudly on stderr so the operator fixes
+            // the regex.
+            const msg = `[sandbox-runtime] WARNING: credentials.envVars entry ` +
+                `"${v.name}" has extract pattern "${v.extract}" that matched ` +
+                `nothing in the variable's value. The variable is left ` +
+                `UNPROTECTED (visible as-is inside the sandbox). Fix the regex, ` +
+                `set onExtractNoMatch to "deny" or "error", or remove the entry.`;
+            console.warn(msg);
+            logForDebugging(msg, { level: 'warn' });
+            continue;
+        }
+        setEnvVars[v.name] = extracted.fakeContent;
+    }
+    return { setEnvVars, degradeToUnsetNames };
+}
+//# sourceMappingURL=credential-mask-env.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/credential-mask-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mask-env.js","sourceRoot":"","sources":["../../src/sandbox/credential-mask-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAI9D;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAA;AAgBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA0C,EAC1C,cAAiC,EACjC,QAA0B,EAC1B,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,MAAM,mBAAmB,GAAa,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAEhC,iEAAiE;QACjE,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,mEAAmE;QACnE,8BAA8B;QAC9B,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,CAAA;QAEnD,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,+DAA+D;gBAC/D,4CAA4C;gBAC5C,MAAM,GAAG,GACP,uDAAuD;oBACvD,IAAI,CAAC,CAAC,IAAI,kDAAkD;oBAC5D,yDAAyD;oBACzD,8DAA8D;oBAC9D,YAAY,CAAA;gBACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBACvC,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBACzB,4DAA4D;gBAC5D,gEAAgE;gBAChE,wDAAwD;gBACxD,+DAA+D;gBAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAChE,QAAQ,CAAC,QAAQ,CACf,GAAG,sBAAsB,GAAG,CAAC,CAAC,IAAI,IAAI,KAAK,EAAE,EAC7C,KAAK,EACL,WAAW,CACZ,CACF,CAAA;gBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,2DAA2D;oBAC3D,4DAA4D;oBAC5D,8BAA8B;oBAC9B,MAAM,GAAG,GACP,uDAAuD;wBACvD,IAAI,CAAC,CAAC,IAAI,mBAAmB;wBAC7B,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,4BAA4B;wBAC3D,sDAAsD;wBACtD,6DAA6D;wBAC7D,qCAAqC,CAAA;oBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;oBACvC,SAAQ;gBACV,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;gBACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,eAAe,CACb,8BAA8B,CAAC,CAAC,IAAI,gBAAgB;wBAClD,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+BAA+B;wBACzD,gBAAgB,CACnB,CAAA;gBACH,CAAC;gBACD,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,oBAAoB,CAChD,GAAG,sBAAsB,GAAG,CAAC,CAAC,IAAI,EAAE,EACpC,MAAM,CAAC,SAAS,EAChB,IAAI,EACJ,WAAW,CACZ,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,4CAA4C;YAC5C,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,oBAAoB,CAChD,GAAG,sBAAsB,GAAG,CAAC,CAAC,IAAI,EAAE,EACpC,WAAW,CAAC,UAAU,EAAE,CAAC,EACzB,IAAI,EACJ,WAAW,CACZ,CAAA;YACD,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5B,kDAAkD;YAClD,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;YACjE,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACjE,QAAQ,CAAC,QAAQ,CACf,GAAG,sBAAsB,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,EACzC,GAAG,EACH,WAAW,CACZ,CACF,CAAA;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAA;YAC9C,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,8BAA8B,CAAC,CAAC,IAAI,qBAAqB;oBACvD,IAAI,CAAC,CAAC,OAAO,iDAAiD;oBAC9D,8DAA8D,CACjE,CAAA;YACH,CAAC;YACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,iEAAiE;gBACjE,8DAA8D;gBAC9D,uDAAuD;gBACvD,eAAe,CACb,sCAAsC,CAAC,CAAC,OAAO,YAAY;oBACzD,2BAA2B,CAAC,CAAC,IAAI,4BAA4B,EAC/D,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;gBAChC,SAAQ;YACV,CAAC;YACD,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,aAAa;YACb,MAAM,GAAG,GACP,uDAAuD;gBACvD,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,OAAO,iBAAiB;gBAC9D,wDAAwD;gBACxD,iEAAiE;gBACjE,iEAAiE,CAAA;YACnE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,eAAe,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACvC,SAAQ;QACV,CAAC;QACD,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,WAAW,CAAA;IAC5C,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAA;AAC5C,CAAC"}