pi-codex-auto-review 0.1.2 → 0.1.3

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mitm-ca.js

@@ -1,443 +0,0 @@
-/**
- * MITM CA loader/generator for the in-process TLS-terminating proxy.
- *
- * The CA is supplied via `network.tlsTerminate.{caCertPath,caKeyPath}` (see
- * sandbox-config.ts). If both paths are omitted, SRT generates an ephemeral
- * RSA-2048 self-signed CA into a temp directory; the cert path is what the
- * trust env vars point at. The caller is responsible for cleaning up via
- * `disposeMitmCA()` (SandboxManager.reset() does this).
- */
-import forge from 'node-forge';
-import { sign as cryptoSign, X509Certificate } from 'node:crypto';
-import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
-import { rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { rootCertificates } from 'node:tls';
-import { logForDebugging } from '../utils/debug.js';
-const { asn1, pki, md, random, util } = forge;
-// node-forge exports pki.getTBSCertificate at runtime; @types/node-forge omits it.
-const getTBSCertificate = pki.getTBSCertificate;
-/**
- * Matches one PEM CERTIFICATE block. Used to extract just the certificates
- * out of files listed in tlsTerminate.extraCaCertPaths before they are
- * copied into the (world-readable) trust bundle.
- */
-const PEM_CERT_BLOCK = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
-/** Origin-form path the HTTP proxy answers with `crlDer`. */
-export const CRL_PATH = '/srt.crl';
-/**
- * Return the CA's Subject Key Identifier as raw bytes for use as an
- * authorityKeyIdentifier.keyIdentifier (leaf certs and the CRL both need it).
- *
- * node-forge stores a cert's subjectKeyIdentifier extension value as a *hex
- * string* (both for in-memory certs and certs parsed from PEM), but expects
- * AKI's keyIdentifier as *raw bytes* — passing the hex through verbatim
- * encodes the ASCII hex chars as the key id and the chain fails to verify.
- * If the CA has no SKI extension (e.g. a v1 user-supplied CA), derive the
- * RFC 5280 method-1 value from its public key.
- */
-export function caSubjectKeyId(caCert) {
-    const ext = caCert.getExtension('subjectKeyIdentifier');
-    return ext?.subjectKeyIdentifier
-        ? util.hexToBytes(ext.subjectKeyIdentifier)
-        : caCert.generateSubjectKeyIdentifier().getBytes();
-}
-/**
- * Drop-in replacement for `cert.sign(key, md.sha256.create())` that computes
- * the RSASSA-PKCS1-v1_5 / SHA-256 signature via Node's native `crypto.sign()`
- * instead of node-forge's pure-JS RSA.
- *
- * node-forge routes RSA *keypair generation* to native `crypto` when available,
- * but its `PrivateKey.sign()` is always pure JS, which is slow enough to matter
- * because `generateEphemeralCA()` runs on the cold path of every process that
- * constructs a SandboxManager. RSASSA-PKCS1-v1_5 is deterministic, so native
- * `crypto.sign()` yields identical bytes.
- */
-export function signCertificateNative(cert, keyPem) {
-    const oid = pki.oids.sha256WithRSAEncryption;
-    cert.siginfo.algorithmOid = oid;
-    cert.signatureOid = oid;
-    cert.tbsCertificate = getTBSCertificate(cert);
-    const tbsDer = asn1.toDer(cert.tbsCertificate).getBytes();
-    cert.signature = rsaSha256SignNative(tbsDer, keyPem);
-    // Match cert.sign()'s side effect so callers that read cert.md see the same
-    // populated digest a forge-signed cert would carry.
-    cert.md = md.sha256.create();
-    cert.md.update(tbsDer);
-}
-/**
- * RSASSA-PKCS1-v1_5 / SHA-256 sign of a forge binary-string `der` with the
- * PEM-encoded RSA private key `keyPem`, returning the signature as a forge
- * binary string. Native equivalent of `forgeKey.sign(sha256Digest)`.
- */
-export function rsaSha256SignNative(der, keyPem) {
-    return cryptoSign('sha256', Buffer.from(der, 'binary'), keyPem).toString('binary');
-}
-/**
- * Create a MitmCA. If `caCertPath`/`caKeyPath` are provided, load from disk
- * (throws if either file is missing, unreadable, not PEM, fails to parse, or
- * the key is not RSA). If both are omitted, generate an ephemeral CA into a
- * fresh temp directory.
- *
- * Pure factory: no module-level state. The caller (SandboxManager) owns the
- * returned object and its lifetime.
- */
-export function createMitmCA(opts) {
-    if (opts.caCertPem && opts.caKeyPem) {
-        const v = validateCaPair(opts.caCertPem, opts.caKeyPem);
-        if (!v.ok)
-            throw new Error(`tlsTerminate: CA PEM pair: ${v.reason}`);
-        return buildMitmCA(opts.caCertPem, opts.caKeyPem, v.cert, v.key, {
-            certPath: opts.caCertPath ?? '',
-            keyPath: opts.caKeyPath ?? '',
-            extraCaCertPaths: opts.extraCaCertPaths,
-        });
-    }
-    if (opts.caCertPath && opts.caKeyPath) {
-        return loadCA(opts.caCertPath, opts.caKeyPath, opts.extraCaCertPaths);
-    }
-    if (opts.caCertPath || opts.caKeyPath) {
-        throw new Error('tlsTerminate: caCertPath and caKeyPath must be provided together');
-    }
-    return generateEphemeralCA(opts.extraCaCertPaths);
-}
-/**
- * Remove the SRT-owned temp directories for this CA: the trust-bundle dir
- * always, and the cert/key dir too when SRT generated the CA (for an
- * ephemeral CA they are the same directory). User-supplied CA files are
- * left alone.
- */
-export async function disposeMitmCA(ca) {
-    const dirs = new Set([dirname(ca.trustBundlePath)]);
-    if (ca.ephemeral)
-        dirs.add(dirname(ca.certPath));
-    for (const dir of dirs) {
-        try {
-            await rm(dir, { recursive: true, force: true });
-        }
-        catch (err) {
-            logForDebugging(`[mitm-ca] cleanup failed: ${err.message}`, {
-                level: 'warn',
-            });
-        }
-    }
-}
-/**
- * Write the child-facing trust bundle into `dir` and return its path: the
- * MITM CA first, then the roots the host would normally trust, so HTTPS
- * clients in the sandbox accept proxy-minted leaves AND can still verify the
- * real certificate of any host SRT tunnels opaquely instead of terminating
- * (tlsTerminate.excludeDomains). Bundling Node's root store is best-effort
- * compatibility — a tool with its own CA file config is unaffected. Extra
- * roots from tlsTerminate.extraCaCertPaths go last, with the same append
- * semantics as NODE_EXTRA_CA_CERTS.
- */
-function writeTrustBundle(dir, caCertPem, extraCaCertPaths) {
-    const parts = [caCertPem.trim(), ...rootCertificates];
-    // Honour extra roots the parent process trusts (e.g. a corporate CA).
-    const extra = process.env.NODE_EXTRA_CA_CERTS;
-    if (extra) {
-        try {
-            parts.push(readFileSync(extra, 'utf8').trim());
-        }
-        catch {
-            // Missing/unreadable NODE_EXTRA_CA_CERTS: ignore, same as Node does.
-        }
-    }
-    // Honour site-local roots from config (tlsTerminate.extraCaCertPaths),
-    // e.g. an internal mTLS CA presented by excluded/passthrough hosts. Paths
-    // may exist on only some hosts, so a missing file is skipped, not fatal —
-    // but log it, or a typo'd path is undiagnosable.
-    for (const extraPath of extraCaCertPaths ?? []) {
-        let raw;
-        try {
-            raw = readFileSync(extraPath, 'utf8');
-        }
-        catch (err) {
-            const code = err.code ?? String(err);
-            logForDebugging(`[mitm-ca] extraCaCertPaths: cannot read ${extraPath} (${code}); ` +
-                `skipping`, { level: 'warn' });
-            continue;
-        }
-        // Append only the CERTIFICATE blocks. The bundle is world-readable
-        // (0o644) and handed to the sandboxed child, so anything else the file
-        // carries (e.g. the key of a combined cert+key PEM) must not be copied.
-        const certs = raw.match(PEM_CERT_BLOCK);
-        if (!certs) {
-            logForDebugging(`[mitm-ca] extraCaCertPaths: ${extraPath} has no PEM CERTIFICATE ` +
-                `block; skipping`, { level: 'warn' });
-            continue;
-        }
-        parts.push(...certs);
-    }
-    const path = join(dir, 'trust-bundle.crt');
-    writeFileSync(path, parts.join('\n') + '\n', { mode: 0o644 });
-    return path;
-}
-/**
- * Build a DER-encoded X.509 v2 CRL, signed by `key`, listing zero revoked
- * certificates. `nextUpdate` is the CA's `notAfter` (or now+1d if the CA is
- * already expired) so a single per-session CRL stays fresh for the CA's
- * lifetime.
- *
- * node-forge has no CRL builder, so this hand-assembles the RFC 5280 §5.1
- * `CertificateList` from asn1 primitives — the same approach the library
- * uses internally for certificates. Carries the two extensions RFC 5280
- * §5.2 says conforming issuers MUST include: `authorityKeyIdentifier`
- * (matching the CA's SKI) and `cRLNumber`.
- */
-export function generateEmptyCrl(cert, keyPem) {
-    const SHA256_RSA = pki.oids.sha256WithRSAEncryption;
-    const sigAlg = () => seq([
-        asn1.create(C.UNIVERSAL, T.OID, false, asn1.oidToDer(SHA256_RSA).getBytes()),
-        asn1.create(C.UNIVERSAL, T.NULL, false, ''),
-    ]);
-    // extnValue is the DER of the extension's own ASN.1, wrapped in an
-    // OCTET STRING at the Extension level.
-    const ext = (oid, value) => seq([
-        asn1.create(C.UNIVERSAL, T.OID, false, asn1.oidToDer(oid).getBytes()),
-        asn1.create(C.UNIVERSAL, T.OCTETSTRING, false, asn1.toDer(value).getBytes()),
-    ]);
-    const crlExtensions = asn1.create(C.CONTEXT_SPECIFIC, 0, true, [
-        seq([
-            // authorityKeyIdentifier ::= SEQUENCE { [0] KeyIdentifier }
-            ext(pki.oids.authorityKeyIdentifier, seq([asn1.create(C.CONTEXT_SPECIFIC, 0, false, caSubjectKeyId(cert))])),
-            // cRLNumber ::= INTEGER — one CRL per CA per session, so a fixed 1.
-            ext('2.5.29.20', asn1.create(C.UNIVERSAL, T.INTEGER, false, '\x01')),
-        ]),
-    ]);
-    const now = new Date();
-    const caEnd = cert.validity.notAfter;
-    const nextUpdate = caEnd > now ? caEnd : daysFromNow(1);
-    const tbsCertList = seq([
-        // version v2 == INTEGER 1 (required when crlExtensions is present)
-        asn1.create(C.UNIVERSAL, T.INTEGER, false, '\x01'),
-        sigAlg(),
-        // Issuer Name: RFC 5280 §5.1.2.3 requires this match the CA subject
-        // byte-for-byte. node-forge normalises DN attributes on parse (its
-        // certificateFromPem re-encodes via distinguishedNameToAsn1 too, so the
-        // "original" DER isn't recoverable via the library), which means a
-        // user-supplied CA whose subject uses e.g. multi-valued RDNs or a
-        // non-canonical string type could produce a differently-encoded issuer
-        // here. Schannel matches on AKI keyid (present above) not issuer DN, and
-        // the ephemeral CA is generated by the same encoder, so this holds in
-        // practice; noted for completeness.
-        pki.distinguishedNameToAsn1(cert.subject),
-        asn1Time(now),
-        asn1Time(nextUpdate),
-        // revokedCertificates: OMITTED. RFC 5280: "When there are no revoked
-        // certificates, the revoked certificates list MUST be absent."
-        crlExtensions,
-    ]);
-    const sig = rsaSha256SignNative(asn1.toDer(tbsCertList).getBytes(), keyPem);
-    const crl = seq([
-        tbsCertList,
-        sigAlg(),
-        // BIT STRING: leading 0x00 = zero unused bits.
-        asn1.create(C.UNIVERSAL, T.BITSTRING, false, '\x00' + sig),
-    ]);
-    return Buffer.from(asn1.toDer(crl).getBytes(), 'binary');
-}
-const C = asn1.Class;
-const T = asn1.Type;
-function seq(v) {
-    return asn1.create(C.UNIVERSAL, T.SEQUENCE, true, v);
-}
-/** UTCTime for years <2050, GeneralizedTime otherwise (RFC 5280 §4.1.2.5). */
-function asn1Time(d) {
-    return d.getUTCFullYear() < 2050
-        ? asn1.create(C.UNIVERSAL, T.UTCTIME, false, asn1.dateToUtcTime(d))
-        : asn1.create(C.UNIVERSAL, T.GENERALIZEDTIME, false, asn1.dateToGeneralizedTime(d));
-}
-function loadCA(certPath, keyPath, extraCaCertPaths) {
-    const certPem = readPem(certPath, 'CERTIFICATE', 'tlsTerminate.caCertPath');
-    const keyPem = readPem(keyPath, 'PRIVATE KEY', 'tlsTerminate.caKeyPath');
-    const v = validateCaPair(certPem, keyPem);
-    if (!v.ok) {
-        throw new Error(`tlsTerminate: CA at ${certPath}: ${v.reason}`);
-    }
-    logForDebugging(`[mitm-ca] loaded CA from ${certPath}`);
-    return buildMitmCA(certPem, keyPem, v.cert, v.key, {
-        certPath,
-        keyPath,
-        extraCaCertPaths,
-    });
-}
-/**
- * Assemble a {@link MitmCA} from an already-parsed cert+key. Shared by
- * `loadCA` (explicit paths), `generateEphemeralCA`, and the Windows
- * persistent-CA path so trust-bundle/CRL/cache setup lives in one place.
- * `certPath`/`keyPath` are recorded verbatim; the trust bundle goes to a
- * fresh mkdtemp so it's always disposable.
- */
-function buildMitmCA(certPem, keyPem, cert, key, opts) {
-    const bundleDir = mkdtempSync(join(tmpdir(), 'srt-ca-'));
-    return {
-        certPath: opts.certPath,
-        keyPath: opts.keyPath,
-        trustBundlePath: writeTrustBundle(bundleDir, certPem, opts.extraCaCertPaths),
-        certPem,
-        keyPem,
-        cert,
-        key,
-        leafCerts: new Map(),
-        secureContexts: new Map(),
-        crlDer: generateEmptyCrl(cert, keyPem),
-        ephemeral: opts.ephemeral ?? false,
-    };
-}
-/**
- * Generate a self-signed RSA-2048 CA certificate + private key as PEM
- * strings. Pure — no filesystem side effects; the caller decides where (and
- * whether) to persist. This is the primitive under both the ephemeral
- * per-process CA and the Windows persistent CA
- * (`ensurePersistentWindowsCa`).
- *
- * @param opts.cn subject/issuer commonName. Default
- *   `'sandbox-runtime ephemeral CA'`.
- * @param opts.validityDays certificate `notAfter` in days from now.
- *   Default 825 (the CA/B Forum limit for publicly-trusted leaves; not
- *   binding on a private CA, but a reasonable rotation horizon).
- */
-export function generateCa(opts = {}) {
-    const keys = pki.rsa.generateKeyPair(2048);
-    const cert = pki.createCertificate();
-    cert.publicKey = keys.publicKey;
-    cert.serialNumber = randomSerial();
-    cert.validity.notBefore = daysFromNow(-1);
-    cert.validity.notAfter = daysFromNow(opts.validityDays ?? 825);
-    const subject = [
-        { name: 'commonName', value: opts.cn ?? 'sandbox-runtime ephemeral CA' },
-        { name: 'organizationName', value: 'sandbox-runtime' },
-    ];
-    cert.setSubject(subject);
-    cert.setIssuer(subject);
-    cert.setExtensions([
-        { name: 'basicConstraints', cA: true, critical: true },
-        {
-            name: 'keyUsage',
-            critical: true,
-            keyCertSign: true,
-            cRLSign: true,
-            digitalSignature: true,
-        },
-        { name: 'subjectKeyIdentifier' },
-    ]);
-    const keyPem = pki.privateKeyToPem(keys.privateKey);
-    signCertificateNative(cert, keyPem);
-    return {
-        certPem: pki.certificateToPem(cert),
-        keyPem,
-        cert,
-        key: keys.privateKey,
-    };
-}
-/**
- * SHA-1 thumbprint of `certPem` as uppercase hex with no separators —
- * the format `srt-win user status` reports (`ca_cert_thumb`) and
- * PowerShell's `Cert:\…\Thumbprint` uses. Throws if `certPem` is not a
- * parseable X.509 certificate.
- */
-export function certThumbprint(certPem) {
-    return new X509Certificate(certPem).fingerprint
-        .replace(/:/g, '')
-        .toUpperCase();
-}
-/**
- * Check that `certPem` + `keyPem` are a usable RSA CA pair: both parse, the
- * key is RSA (node-forge signs with nothing else), the private key's
- * modulus matches the certificate's public key (i.e. this key actually
- * signs for this cert), and `notBefore` is not in the future — a CA
- * minted while the system clock was ahead and later NTP-corrected would
- * otherwise be permanently not-yet-valid with nothing to trigger a
- * regenerate. Returns the cert's thumbprint and `notAfter` on success so
- * a caller can decide expiry policy without a second parse.
- *
- * Does not throw — a persistence layer that finds an unreadable/mismatched
- * pair on disk treats `{ok: false}` as "regenerate", not a hard error.
- */
-export function validateCaPair(certPem, keyPem) {
-    let cert;
-    let key;
-    try {
-        cert = pki.certificateFromPem(certPem);
-        key = pki.privateKeyFromPem(keyPem);
-    }
-    catch (err) {
-        return { ok: false, reason: `parse: ${err.message}` };
-    }
-    if (!('n' in key) || !('d' in key)) {
-        return { ok: false, reason: 'key is not RSA' };
-    }
-    if (cert.validity.notBefore.getTime() > Date.now()) {
-        return {
-            ok: false,
-            reason: `notBefore ${cert.validity.notBefore.toISOString()} is in the future (clock skew?)`,
-        };
-    }
-    const pub = cert.publicKey;
-    if (!('n' in pub) || pub.n.compareTo(key.n)) {
-        return { ok: false, reason: 'key does not match certificate public key' };
-    }
-    let thumbprint;
-    try {
-        thumbprint = certThumbprint(certPem);
-    }
-    catch (err) {
-        return { ok: false, reason: `thumbprint: ${err.message}` };
-    }
-    return {
-        ok: true,
-        thumbprint,
-        notAfter: cert.validity.notAfter,
-        cert,
-        key: key,
-    };
-}
-function generateEphemeralCA(extraCaCertPaths) {
-    const { certPem, keyPem, cert, key } = generateCa();
-    // Write to disk so trust env vars (NODE_EXTRA_CA_CERTS etc.) can point at
-    // a real path. mkdtemp gives us an unguessable per-process directory.
-    const dir = mkdtempSync(join(tmpdir(), 'srt-ca-'));
-    const certPath = join(dir, 'ca.crt');
-    const keyPath = join(dir, 'ca.key');
-    writeFileSync(certPath, certPem, { mode: 0o644 });
-    writeFileSync(keyPath, keyPem, { mode: 0o600 });
-    logForDebugging(`[mitm-ca] generated ephemeral CA at ${certPath}`);
-    return buildMitmCA(certPem, keyPem, cert, key, {
-        certPath,
-        keyPath,
-        extraCaCertPaths,
-        ephemeral: true,
-    });
-}
-function readPem(path, label, field) {
-    let pem;
-    try {
-        pem = readFileSync(path, 'utf8');
-    }
-    catch (err) {
-        const code = err.code ?? String(err);
-        throw new Error(`${field}: cannot read ${path} (${code})`);
-    }
-    // Accept either the exact label or a prefixed variant (e.g. "RSA PRIVATE KEY",
-    // "EC PRIVATE KEY") for the key case.
-    if (!new RegExp(`-----BEGIN [A-Z ]*${label}-----`).test(pem)) {
-        throw new Error(`${field}: ${path} is not a PEM ${label}`);
-    }
-    return pem;
-}
-export function randomSerial() {
-    // 16 random bytes, high bit cleared so the DER INTEGER stays positive.
-    const bytes = random.getBytesSync(16);
-    const hex = util.bytesToHex(bytes);
-    const firstNibble = parseInt(hex[0], 16) & 0x7;
-    return firstNibble.toString(16) + hex.slice(1);
-}
-export function daysFromNow(days) {
-    const d = new Date();
-    d.setDate(d.getDate() + days);
-    return d;
-}
-//# sourceMappingURL=mitm-ca.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mitm-ca.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mitm-ca.js","sourceRoot":"","sources":["../../src/sandbox/mitm-ca.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAClE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAsB,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;AAE7C,mFAAmF;AACnF,MAAM,iBAAiB,GACrB,GAGD,CAAC,iBAAiB,CAAA;AAEnB;;;;GAIG;AACH,MAAM,cAAc,GAClB,+DAA+D,CAAA;AAqDjE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAA;AAElC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,MAA6B;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAEzC,CAAA;IACb,OAAO,GAAG,EAAE,oBAAoB;QAC9B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,MAAc;IAEd,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAA;IAC5C,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,GAAG,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;IACvB,IAAI,CAAC,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAA;IACzD,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpD,4EAA4E;IAC5E,oDAAoD;IACpD,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAc;IAC7D,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CACtE,QAAQ,CACT,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAa5B;IACC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QACpE,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE;YAC/D,QAAQ,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAA;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,EAAE,CAAC,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,EAAE;gBACrE,KAAK,EAAE,MAAM;aACd,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,GAAW,EACX,SAAiB,EACjB,gBAA2B;IAE3B,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,gBAAgB,CAAC,CAAA;IACrD,sEAAsE;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;IAC7C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,iDAAiD;IACjD,KAAK,MAAM,SAAS,IAAI,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,eAAe,CACb,2CAA2C,SAAS,KAAK,IAAI,KAAK;gBAChE,UAAU,EACZ,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;YACD,SAAQ;QACV,CAAC;QACD,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,eAAe,CACb,+BAA+B,SAAS,0BAA0B;gBAChE,iBAAiB,EACnB,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;YACD,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;IACtB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAC1C,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA2B,EAC3B,MAAc;IAEd,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAA;IACnD,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,GAAG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,GAAG,EACL,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CACrC;QACD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;KAC5C,CAAC,CAAA;IAEJ,mEAAmE;IACnE,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAsB,EAAE,EAAE,CAClD,GAAG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,CACT,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,WAAW,EACb,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAC7B;KACF,CAAC,CAAA;IACJ,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE;QAC7D,GAAG,CAAC;YACF,4DAA4D;YAC5D,GAAG,CACD,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAC/B,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACvE;YACD,oEAAoE;YACpE,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SACrE,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACpC,MAAM,UAAU,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAEvD,MAAM,WAAW,GAAG,GAAG,CAAC;QACtB,mEAAmE;QACnE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;QAClD,MAAM,EAAE;QACR,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,mEAAmE;QACnE,kEAAkE;QAClE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,oCAAoC;QACpC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC;QACb,QAAQ,CAAC,UAAU,CAAC;QACpB,qEAAqE;QACrE,+DAA+D;QAC/D,aAAa;KACd,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3E,MAAM,GAAG,GAAG,GAAG,CAAC;QACd,WAAW;QACX,MAAM,EAAE;QACR,+CAA+C;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC;KAC3D,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAA;AACpB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAA;AACnB,SAAS,GAAG,CAAC,CAAoB;IAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACtD,CAAC;AACD,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,CAAO;IACvB,OAAO,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI;QAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,IAAI,CAAC,MAAM,CACT,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,eAAe,EACjB,KAAK,EACL,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAC9B,CAAA;AACP,CAAC;AAED,SAAS,MAAM,CACb,QAAgB,EAChB,OAAe,EACf,gBAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,wBAAwB,CAAC,CAAA;IACxE,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,eAAe,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAA;IACvD,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE;QACjD,QAAQ;QACR,OAAO;QACP,gBAAgB;KACjB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,OAAe,EACf,MAAc,EACd,IAA2B,EAC3B,GAA6B,EAC7B,IAKC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;IACxD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,gBAAgB,CAC/B,SAAS,EACT,OAAO,EACP,IAAI,CAAC,gBAAgB,CACtB;QACD,OAAO;QACP,MAAM;QACN,IAAI;QACJ,GAAG;QACH,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,MAAM,EAAE,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC;QACtC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;KACnC,CAAA;AACH,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CACxB,OAA+C,EAAE;IAEjD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAA;IACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG;QACd,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B,EAAE;QACxE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,EAAE;KACvD,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACxB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACvB,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACtD;YACE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,IAAI;SACvB;QACD,EAAE,IAAI,EAAE,sBAAsB,EAAE;KACjC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACnD,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACnC,MAAM;QACN,IAAI;QACJ,GAAG,EAAE,IAAI,CAAC,UAAU;KACrB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW;SAC5C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,WAAW,EAAE,CAAA;AAClB,CAAC;AAeD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,MAAc;IAEd,IAAI,IAA2B,CAAA;IAC/B,IAAI,GAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;QACtC,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAW,GAAa,CAAC,OAAO,EAAE,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,iCAAiC;SAC5F,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAoC,CAAA;IACrD,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAE,GAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAA;IAC3E,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAgB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAA;IACvE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,IAAI;QACJ,GAAG,EAAE,GAA+B;KACrC,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,gBAA2B;IACtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,CAAA;IACnD,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACjD,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/C,eAAe,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAA;IAClE,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7C,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa;IACzD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,IAAI,KAAK,IAAI,GAAG,CAAC,CAAA;IAC5D,CAAC;IACD,+EAA+E;IAC/E,sCAAsC;IACtC,IAAI,CAAC,IAAI,MAAM,CAAC,qBAAqB,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,IAAI,iBAAiB,KAAK,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,uEAAuE;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAA;IAC/C,OAAO,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAA;IACpB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAA;AACV,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mitm-leaf.d.ts

@@ -1,28 +0,0 @@
-/**
- * Per-host leaf certificate minter for the in-process TLS-terminating proxy.
- *
- * Given a MitmCA (see mitm-ca.ts), mints a leaf certificate for a specific
- * hostname on first use and caches it for the lifetime of that CA instance.
- * The leaf is signed by the CA and carries SAN=DNS:<host> (or IP:<addr>),
- * so a client that trusts the CA will accept it for that host.
- */
-import { type SecureContext } from 'node:tls';
-import { type MitmCA } from './mitm-ca.js';
-export type LeafCert = {
-    /** Leaf cert PEM followed by the CA cert PEM (full chain). */
-    certPem: string;
-    /** Leaf private key PEM. */
-    keyPem: string;
-};
-/**
- * Mint (or return cached) an RSA-2048 leaf cert for `hostname`, signed by `ca`.
- * The cache lives on `ca.leafCerts`.
- */
-export declare function mintLeafCert(ca: MitmCA, hostname: string): LeafCert;
-/**
- * Mint-or-cache a Node TLS SecureContext for `hostname`. Intended as the
- * SNICallback target in the terminating proxy. The cache lives on
- * `ca.secureContexts`.
- */
-export declare function secureContextFor(ca: MitmCA, hostname: string): SecureContext;
-//# sourceMappingURL=mitm-leaf.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mitm-leaf.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mitm-leaf.d.ts","sourceRoot":"","sources":["../../src/sandbox/mitm-leaf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAA;AAElE,OAAO,EAKL,KAAK,MAAM,EACZ,MAAM,cAAc,CAAA;AAIrB,MAAM,MAAM,QAAQ,GAAG;IACrB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAA;IACf,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAyDnE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,CAO5E"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mitm-leaf.js

@@ -1,114 +0,0 @@
-/**
- * Per-host leaf certificate minter for the in-process TLS-terminating proxy.
- *
- * Given a MitmCA (see mitm-ca.ts), mints a leaf certificate for a specific
- * hostname on first use and caches it for the lifetime of that CA instance.
- * The leaf is signed by the CA and carries SAN=DNS:<host> (or IP:<addr>),
- * so a client that trusts the CA will accept it for that host.
- */
-import forge from 'node-forge';
-import { isIP } from 'node:net';
-import { createSecureContext } from 'node:tls';
-import { logForDebugging } from '../utils/debug.js';
-import { caSubjectKeyId, daysFromNow, randomSerial, signCertificateNative, } from './mitm-ca.js';
-const { pki } = forge;
-/**
- * Mint (or return cached) an RSA-2048 leaf cert for `hostname`, signed by `ca`.
- * The cache lives on `ca.leafCerts`.
- */
-export function mintLeafCert(ca, hostname) {
-    const cached = ca.leafCerts.get(hostname);
-    if (cached)
-        return cached;
-    const keys = pki.rsa.generateKeyPair(2048);
-    const cert = pki.createCertificate();
-    cert.publicKey = keys.publicKey;
-    cert.serialNumber = randomSerial();
-    const notBefore = daysFromNow(-1);
-    cert.validity.notBefore = notBefore;
-    cert.validity.notAfter = clampValidity(ca.cert, notBefore);
-    cert.setSubject([{ name: 'commonName', value: hostname }]);
-    cert.setIssuer(ca.cert.subject.attributes);
-    cert.setExtensions([
-        { name: 'basicConstraints', cA: false, critical: true },
-        {
-            name: 'keyUsage',
-            critical: true,
-            digitalSignature: true,
-            keyEncipherment: true,
-        },
-        { name: 'extKeyUsage', serverAuth: true },
-        { name: 'subjectAltName', altNames: [sanFor(hostname)] },
-        { name: 'subjectKeyIdentifier' },
-        // Python ≥3.13 enables ssl.VERIFY_X509_STRICT by default, which enforces
-        // RFC 5280's "AKI MUST be present on non-self-signed certs". curl/Go/Node
-        // don't enforce this, but requests/urllib3/httpx/google-auth all reject
-        // a leaf without AKI under 3.13. See caSubjectKeyId() in mitm-ca.ts for
-        // why we can't just pass the CA's stored SKI value through.
-        { name: 'authorityKeyIdentifier', keyIdentifier: caSubjectKeyId(ca.cert) },
-        // Schannel (Windows System32 curl, git's default backend, cargo) checks
-        // revocation on the LEAF and hard-fails CRYPT_E_NO_REVOCATION_CHECK when
-        // there's no CDP to consult. Point it at the empty CRL the proxy serves
-        // on 127.0.0.1 (see MitmCA.crlDer / http-proxy.ts) so the check resolves
-        // to "not revoked" instead of "unknown". node-forge encodes CDP with the
-        // same {altNames} shape as SAN; type 6 = uniformResourceIdentifier.
-        // OpenSSL-backed clients don't check CRLs by default, so a leaf minted
-        // before the port is bound (crlUrl unset) works everywhere except
-        // Schannel-with-revocation.
-        ...(ca.crlUrl
-            ? [
-                {
-                    name: 'cRLDistributionPoints',
-                    altNames: [{ type: 6, value: ca.crlUrl }],
-                },
-            ]
-            : []),
-    ]);
-    signCertificateNative(cert, ca.keyPem);
-    const leaf = {
-        certPem: pki.certificateToPem(cert) + ca.certPem,
-        keyPem: pki.privateKeyToPem(keys.privateKey),
-    };
-    ca.leafCerts.set(hostname, leaf);
-    logForDebugging(`[mitm-leaf] minted RSA leaf for ${hostname}`);
-    return leaf;
-}
-/**
- * Mint-or-cache a Node TLS SecureContext for `hostname`. Intended as the
- * SNICallback target in the terminating proxy. The cache lives on
- * `ca.secureContexts`.
- */
-export function secureContextFor(ca, hostname) {
-    const cached = ca.secureContexts.get(hostname);
-    if (cached)
-        return cached;
-    const { certPem, keyPem } = mintLeafCert(ca, hostname);
-    const ctx = createSecureContext({ cert: certPem, key: keyPem });
-    ca.secureContexts.set(hostname, ctx);
-    return ctx;
-}
-function sanFor(hostname) {
-    // RFC 5280 GeneralName tags: 2 = dNSName, 7 = iPAddress.
-    return isIP(hostname) !== 0
-        ? { type: 7, ip: hostname }
-        : { type: 2, value: hostname };
-}
-/**
- * Leaf validity capped at min(CA notAfter, notBefore+99d).
- *
- * 99d sits below every TLS cert validity ceiling we care about: the current
- * (2026-03) CA/B baseline of 200d, the next step-down to 100d in 2027-03, the
- * historical 398d public cap, and the macOS ~825d ceiling that trips
- * errSecCertificateIsNotStandardsCompliant on user-installed roots. Leaves are
- * re-minted per session, so we don't need the headroom.
- *
- * Anchored at notBefore — not now — because notBefore is backdated by 1 day,
- * so `now+Nd` would produce an (N+1)-day span and lose a day of margin.
- */
-function clampValidity(caCert, notBefore) {
-    const caEnd = caCert.validity.notAfter;
-    const max = new Date(notBefore);
-    max.setDate(max.getDate() + 99);
-    return caEnd < max ? new Date(caEnd) : max;
-}
-//# sourceMappingURL=mitm-leaf.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/mitm-leaf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mitm-leaf.js","sourceRoot":"","sources":["../../src/sandbox/mitm-leaf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,UAAU,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,qBAAqB,GAEtB,MAAM,cAAc,CAAA;AAErB,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;AASrB;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,QAAgB;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAA;IACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,EAAE,CAAA;IAClC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;IACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvD;YACE,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,IAAI;SACtB;QACD,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE;QACxD,EAAE,IAAI,EAAE,sBAAsB,EAAE;QAChC,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,4DAA4D;QAC5D,EAAE,IAAI,EAAE,wBAAwB,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,4BAA4B;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM;YACX,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IACF,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IAEtC,MAAM,IAAI,GAAa;QACrB,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO;QAChD,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;KAC7C,CAAA;IACD,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAChC,eAAe,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,QAAgB;IAC3D,MAAM,MAAM,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACpC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB;IAK9B,yDAAyD;IACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,MAA6B,EAAE,SAAe;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/B,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAC5C,CAAC"}