pi-codex-auto-review 0.1.2 → 0.1.4

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/request-filter.d.ts

@@ -1,83 +0,0 @@
-/**
- * Request-level filter hook for the forward proxy.
- *
- * Library consumers supply a `filterRequest` callback via
- * `network.filterRequest`. It receives the parsed HTTP request (web-standard
- * `Request`) and returns a decision. Applies to plain HTTP through the proxy
- * and, when `tlsTerminate` is configured, to terminated HTTPS. The proxy
- * enforces the decision; the library does not bless any matching DSL.
- */
-import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
-import { Readable } from 'node:stream';
-export type RequestDecision = {
-    action: 'allow' | 'deny';
-    /**
-     * Human-readable reason. For denials this is surfaced to the sandboxed
-     * client in the response body so the agent can tell a policy block from a
-     * network failure.
-     */
-    reason?: string;
-};
-/**
- * Called once per HTTP request that the proxy parses.
- *
- * - `request` is a web-standard `Request`: method, URL, headers, and a lazy
- *   `request.body` stream (one branch of a tee — reading it does not consume
- *   the bytes that get forwarded upstream). `request.signal` aborts when the
- *   client disconnects.
- * - **Throwing or rejecting denies the request.** This is the failure
- *   contract for a security boundary: a buggy policy fails closed.
- */
-export type FilterRequestCallback = (request: Request) => Promise<RequestDecision>;
-/**
- * Mutate the headers that will be sent upstream, in place.
- *
- * Runs after the allow/deny decision and hop-by-hop stripping, immediately
- * before the upstream request is built. `destHost` is the canonical
- * destination host (the CONNECT target on the TLS-terminated path, or the
- * absolute-URI host on the plain-HTTP path, after canonicalizeHost — the
- * spelling the allowlist evaluated) — never the client-supplied Host
- * header, which is spoofable.
- */
-export type MutateForwardedHeaders = (headers: IncomingHttpHeaders, destHost: string) => void;
-export declare const BODYLESS_METHODS: Set<string>;
-/**
- * User-facing reason when a filterRequest denial doesn't supply one. This
- * text reaches the sandboxed client (403 body) and the model
- * (<sandbox_violations>), so it names the policy, not the internal hook.
- */
-export declare const DEFAULT_DENY_REASON = "denied by sandbox policy";
-/**
- * Build a `Request`, run the callback, and if denied write the 403 response
- * and return `null`. On allow, returns the body stream the caller must pipe
- * upstream — this is the original `IncomingMessage` when no tee was needed
- * (GET/HEAD/OPTIONS), or the upstream-side branch of the tee otherwise.
- * Callers must pipe the returned stream (not `req`) to the outbound request.
- *
- * For methods that carry a body, `req` is converted to a web stream and
- * `tee()`'d: one branch goes to the callback's `Request.body`, the other is
- * returned for the caller to forward. If the callback never reads its
- * branch, we cancel it after the decision so the tee does not buffer the
- * entire upload.
- */
-export declare function decideAndRespond(filterRequest: FilterRequestCallback, req: IncomingMessage, res: ServerResponse, url: string, signal: AbortSignal, onDeny?: (method: string, url: string, reason: string) => void): Promise<Readable | null>;
-/**
- * The proxy's standard policy-denial response as raw bytes, for paths that
- * answer on a bare socket (CONNECT): 403 with an `X-Proxy-Error` tag and
- * the reason as the body.
- */
-export declare function rawDenied(reason: string, tag?: string): string;
-/**
- * Write the proxy's standard policy-denial response: 403 with the reason
- * in the body, so the sandboxed client can tell a policy block from a
- * network failure. Shared by filterRequest denials and other in-proxy
- * policy decisions (e.g. SigV4 shapes that cannot be re-signed).
- */
-export declare function respondDenied(res: ServerResponse, reason: string, tag?: string): void;
-/**
- * Answer a failed upstream leg: a resolved-address refusal is a policy
- * denial (403 with the reason); anything else is a 502, or a bare destroy
- * once headers are out.
- */
-export declare function respondUpstreamError(res: ServerResponse, err: Error): void;
-//# sourceMappingURL=request-filter.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/request-filter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-filter.d.ts","sourceRoot":"","sources":["../../src/sandbox/request-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,cAAc,EACf,MAAM,WAAW,CAAA;AAClB,OAAO,EAAe,QAAQ,EAAE,MAAM,aAAa,CAAA;AAInD,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,eAAe,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,KACb,IAAI,CAAA;AAET,eAAO,MAAM,gBAAgB,aAAsC,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,6BAA6B,CAAA;AAgB7D;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,qBAAqB,EACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAC7D,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuG1B;AAQD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAmB,GAAG,MAAM,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,GAAG,SAAmB,GACrB,IAAI,CAWN;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAS1E"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/request-filter.js

@@ -1,212 +0,0 @@
-/**
- * Request-level filter hook for the forward proxy.
- *
- * Library consumers supply a `filterRequest` callback via
- * `network.filterRequest`. It receives the parsed HTTP request (web-standard
- * `Request`) and returns a decision. Applies to plain HTTP through the proxy
- * and, when `tlsTerminate` is configured, to terminated HTTPS. The proxy
- * enforces the decision; the library does not bless any matching DSL.
- */
-import { PassThrough, Readable } from 'node:stream';
-import { logForDebugging } from '../utils/debug.js';
-import { isResolvedAddressDenied } from './resolved-address-guard.js';
-export const BODYLESS_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
-/**
- * User-facing reason when a filterRequest denial doesn't supply one. This
- * text reaches the sandboxed client (403 body) and the model
- * (<sandbox_violations>), so it names the policy, not the internal hook.
- */
-export const DEFAULT_DENY_REASON = 'denied by sandbox policy';
-/**
- * Destroy a denied client's request only after the 403 has flushed —
- * destroying the shared socket in the same tick can RST the response
- * away (observed on Node; the unread request body makes close send RST).
- */
-function destroyAfterResponse(req, res) {
-    if (res.writableFinished || res.destroyed) {
-        req.destroy();
-        return;
-    }
-    res.once('finish', () => req.destroy());
-    res.once('close', () => req.destroy());
-}
-/**
- * Build a `Request`, run the callback, and if denied write the 403 response
- * and return `null`. On allow, returns the body stream the caller must pipe
- * upstream — this is the original `IncomingMessage` when no tee was needed
- * (GET/HEAD/OPTIONS), or the upstream-side branch of the tee otherwise.
- * Callers must pipe the returned stream (not `req`) to the outbound request.
- *
- * For methods that carry a body, `req` is converted to a web stream and
- * `tee()`'d: one branch goes to the callback's `Request.body`, the other is
- * returned for the caller to forward. If the callback never reads its
- * branch, we cancel it after the decision so the tee does not buffer the
- * entire upload.
- */
-export async function decideAndRespond(filterRequest, req, res, url, signal, onDeny) {
-    const method = req.method ?? 'GET';
-    let forCallback;
-    let forUpstream = req;
-    // Gate on a declared body, not just the method: a GET/HEAD/OPTIONS with
-    // Content-Length or Transfer-Encoding is legal HTTP and its body must go
-    // through the tee like any other — skipping it here would hide the body
-    // from filterRequest AND (with transfer-encoding stripped as hop-by-hop)
-    // let its decoded bytes be written raw after a complete-framed bodyless
-    // request upstream: a request-smuggling primitive.
-    // Truthiness, not presence: an empty Content-Length/Transfer-Encoding
-    // value declares nothing and must not trigger teeing or re-framing.
-    const declaresBody = Boolean(req.headers['content-length'] || req.headers['transfer-encoding']);
-    const bodylessMethod = BODYLESS_METHODS.has(method);
-    if (!bodylessMethod || declaresBody) {
-        // Never hand toWeb a stream that can error: when its source errors,
-        // the toWeb/tee/fromWeb bridge leaks the error as internal promise
-        // rejections (and, under Bun, uncaught exceptions) that no userland
-        // listener can catch. A client abort mid-body becomes a clean EOF on
-        // the shim instead, and the abort is propagated by destroying the
-        // upstream branch directly — a truncated body must never be forwarded
-        // framed as complete (chunked framing would otherwise emit a valid
-        // terminator; on the SigV4 path a truncated buffer would be signed).
-        // The shim's own error listener covers the tee cancelling it while
-        // the client is still piping.
-        const shim = new PassThrough();
-        shim.on('error', () => { });
-        req.pipe(shim);
-        const web = Readable.toWeb(shim);
-        const [a, b] = web.tee();
-        forCallback = a;
-        forUpstream = Readable.fromWeb(b);
-        const upstreamBranch = forUpstream;
-        // The caller only wires its own 'error' handler after this function
-        // resolves; a client abort during the filterRequest await must not
-        // land on a listener-less stream.
-        upstreamBranch.on('error', () => { });
-        req.on('error', err => {
-            shim.end();
-            upstreamBranch.destroy(err);
-        });
-    }
-    let webReq;
-    try {
-        // Fetch-spec Requests reject a body on GET/HEAD (Node throws; Bun is
-        // lenient) — a GET with a declared body is still teed above so the
-        // upstream leg stays framed, but the callback sees a bodyless Request.
-        const callbackBody = forCallback && !bodylessMethod
-            ? { body: forCallback, duplex: 'half' }
-            : {};
-        webReq = new Request(url, {
-            method,
-            headers: incomingHeaders(req),
-            signal,
-            ...callbackBody,
-        });
-    }
-    catch (err) {
-        // Malformed URL/headers from the client — deny rather than crash.
-        const reason = `malformed request: ${err.message}`;
-        onDeny?.(method, url, reason);
-        deny(res, { action: 'deny', reason });
-        forCallback?.cancel().catch(() => { });
-        forUpstream.destroy();
-        // The shim breaks the old fromWeb→tee→toWeb cancel cascade that used
-        // to destroy req; without this a denied client keeps uploading into a
-        // stalled pipe and holds the connection open.
-        if (forUpstream !== req)
-            destroyAfterResponse(req, res);
-        return null;
-    }
-    let decision;
-    try {
-        decision = await filterRequest(webReq);
-    }
-    catch (err) {
-        decision = {
-            action: 'deny',
-            reason: `sandbox policy check failed: ${err.message}`,
-        };
-    }
-    // If the callback didn't read its branch, cancel it so tee() stops
-    // buffering bytes nobody will consume. If it did, the tee already buffered
-    // whatever was read; the upstream branch sees the same bytes.
-    if (forCallback && !webReq.bodyUsed) {
-        // cancel() rejects with the stream's stored error if it already
-        // failed; that rejection must not escape.
-        forCallback.cancel().catch(() => { });
-    }
-    if (decision.action === 'allow') {
-        logForDebugging(`[request-filter] allow ${method} ${url}`);
-        return forUpstream;
-    }
-    onDeny?.(method, url, decision.reason ?? DEFAULT_DENY_REASON);
-    deny(res, decision);
-    forUpstream.destroy();
-    if (forUpstream !== req)
-        destroyAfterResponse(req, res);
-    return null;
-}
-function deny(res, decision) {
-    respondDenied(res, decision.reason ?? DEFAULT_DENY_REASON);
-}
-const DEFAULT_DENY_TAG = 'blocked-by-sandbox-runtime';
-/**
- * The proxy's standard policy-denial response as raw bytes, for paths that
- * answer on a bare socket (CONNECT): 403 with an `X-Proxy-Error` tag and
- * the reason as the body.
- */
-export function rawDenied(reason, tag = DEFAULT_DENY_TAG) {
-    return ('HTTP/1.1 403 Forbidden\r\n' +
-        'Content-Type: text/plain\r\n' +
-        `X-Proxy-Error: ${tag}\r\n` +
-        '\r\n' +
-        reason);
-}
-/**
- * Write the proxy's standard policy-denial response: 403 with the reason
- * in the body, so the sandboxed client can tell a policy block from a
- * network failure. Shared by filterRequest denials and other in-proxy
- * policy decisions (e.g. SigV4 shapes that cannot be re-signed).
- */
-export function respondDenied(res, reason, tag = DEFAULT_DENY_TAG) {
-    logForDebugging(`[proxy] deny: ${reason}`);
-    if (res.headersSent || res.destroyed) {
-        res.destroy();
-        return;
-    }
-    res.writeHead(403, {
-        'Content-Type': 'text/plain',
-        'X-Proxy-Error': tag,
-    });
-    res.end(reason + '\n');
-}
-/**
- * Answer a failed upstream leg: a resolved-address refusal is a policy
- * denial (403 with the reason); anything else is a 502, or a bare destroy
- * once headers are out.
- */
-export function respondUpstreamError(res, err) {
-    if (isResolvedAddressDenied(err)) {
-        respondDenied(res, err.message);
-    }
-    else if (!res.headersSent) {
-        res.writeHead(502, { 'Content-Type': 'text/plain' });
-        res.end('Bad Gateway');
-    }
-    else {
-        res.destroy();
-    }
-}
-function incomingHeaders(req) {
-    const h = new Headers();
-    for (const [k, v] of Object.entries(req.headers)) {
-        if (v === undefined)
-            continue;
-        if (Array.isArray(v)) {
-            for (const vv of v)
-                h.append(k, vv);
-        }
-        else {
-            h.append(k, v);
-        }
-    }
-    return h;
-}
-//# sourceMappingURL=request-filter.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/request-filter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-filter.js","sourceRoot":"","sources":["../../src/sandbox/request-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAyCrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAA;AAE7D;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAoB,EAAE,GAAmB;IACrE,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,OAAO,EAAE,CAAA;QACb,OAAM;IACR,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACvC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAoC,EACpC,GAAoB,EACpB,GAAmB,EACnB,GAAW,EACX,MAAmB,EACnB,MAA8D;IAE9D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;IAClC,IAAI,WAAmD,CAAA;IACvD,IAAI,WAAW,GAAa,GAAG,CAAA;IAC/B,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,mDAAmD;IACnD,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAClE,CAAA;IACD,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,CAAC,cAAc,IAAI,YAAY,EAAE,CAAC;QACpC,oEAAoE;QACpE,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,8BAA8B;QAC9B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAA;QAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAA+B,CAAA;QAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,CAAA;QACxB,WAAW,GAAG,CAAC,CAAA;QACf,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,cAAc,GAAG,WAAW,CAAA;QAClC,oEAAoE;QACpE,mEAAmE;QACnE,kCAAkC;QAClC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACpB,IAAI,CAAC,GAAG,EAAE,CAAA;YACV,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,YAAY,GAChB,WAAW,IAAI,CAAC,cAAc;YAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAe,EAAE;YAChD,CAAC,CAAC,EAAE,CAAA;QACR,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACxB,MAAM;YACN,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC;YAC7B,MAAM;YACN,GAAG,YAAY;SAChB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,MAAM,MAAM,GAAG,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAA;QAC7D,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAC7B,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACrC,WAAW,CAAC,OAAO,EAAE,CAAA;QACrB,qEAAqE;QACrE,sEAAsE;QACtE,8CAA8C;QAC9C,IAAI,WAAW,KAAK,GAAG;YAAE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG;YACT,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gCAAiC,GAAa,CAAC,OAAO,EAAE;SACjE,CAAA;IACH,CAAC;IAED,mEAAmE;IACnE,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,gEAAgE;QAChE,0CAA0C;QAC1C,WAAW,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,eAAe,CAAC,0BAA0B,MAAM,IAAI,GAAG,EAAE,CAAC,CAAA;QAC1D,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAA;IAC7D,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnB,WAAW,CAAC,OAAO,EAAE,CAAA;IACrB,IAAI,WAAW,KAAK,GAAG;QAAE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACvD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,QAAyB;IAC1D,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,GAAG,GAAG,gBAAgB;IAC9D,OAAO,CACL,4BAA4B;QAC5B,8BAA8B;QAC9B,kBAAkB,GAAG,MAAM;QAC3B,MAAM;QACN,MAAM,CACP,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAmB,EACnB,MAAc,EACd,GAAG,GAAG,gBAAgB;IAEtB,eAAe,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAA;IAC1C,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,EAAE,CAAA;QACb,OAAM;IACR,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,YAAY;QAC5B,eAAe,EAAE,GAAG;KACrB,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB,EAAE,GAAU;IAClE,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;SAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,EAAE,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAA;IACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAQ;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,EAAE,IAAI,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/resolved-address-guard.d.ts

@@ -1,76 +0,0 @@
-/**
- * Resolved-address guard for hostname destinations.
- *
- * The domain allowlist decides by name, but whoever controls a permitted
- * name's DNS records (or any label under a permitted wildcard) decides what
- * that name resolves to. Without a check on the resolved address, an
- * allow-listed name can be pointed at the loopback interface, a link-local
- * address, or address space the embedder considers private, and the proxy
- * will dial it. This module wraps `dns.lookup` so a direct dial resolves
- * once, drops denied addresses, and connects to a surviving one — the
- * address that passed the check is the address dialed, with no second
- * resolution in between.
- *
- * Scope: hostnames only. An IP literal on the allowlist is an explicit
- * choice and is never re-judged here; conversely, a name may resolve to a
- * denied address only when that address (and port) is itself allow-listed,
- * so reaching it by name grants nothing the literal entry did not — and an
- * IP literal on the deny list is refused by name too, allowlist or not. The
- * reserved loopback names (`localhost` and anything under `.localhost`,
- * RFC 6761) resolve to loopback — that is what allow-listing them asks for —
- * or to an allow-listed literal, and to nothing else. Connections routed
- * through a parent proxy or a MITM socket are not resolved locally at all;
- * that hop resolves the name and is responsible for its own address policy.
- */
-import type { LookupAddress, LookupAllOptions } from 'node:dns';
-import type { LookupFunction } from 'node:net';
-/** Unicast addresses currently assigned to this host's network interfaces. */
-export declare function localInterfaceAddresses(): string[];
-export declare class ResolvedAddressDeniedError extends Error {
-    readonly hostname: string;
-    readonly reason: string;
-    readonly addresses: readonly string[];
-    readonly code = "ERR_SRT_RESOLVED_ADDRESS_DENIED";
-    /**
-     * @param reason parenthetical for the violation line and the client, e.g.
-     *   `resolved to a loopback address` — the class, never the address, which
-     *   the sandboxed client should not learn from a refusal.
-     * @param addresses the refused addresses, for operator logs.
-     */
-    constructor(hostname: string, reason: string, addresses: readonly string[]);
-}
-export declare function isResolvedAddressDenied(err: unknown): err is ResolvedAddressDeniedError;
-export type Resolver = (hostname: string, options: LookupAllOptions, callback: (err: NodeJS.ErrnoException | null, addresses: LookupAddress[]) => void) => void;
-/**
- * The guard reads the same three lists the name filter does, in the same
- * order of precedence: an IP literal in `deniedDomains` is refused however
- * it is reached; an IP literal in `allowedDomains` (with its `:port`) is
- * what a name MAY resolve to even though the address is otherwise denied —
- * so a name reaches nothing the literal entry does not already permit; and
- * `deniedResolvedAddresses` extends the built-in denied set.
- */
-export interface ResolvedAddressGuardOptions {
-    allowedDomains?: readonly string[];
-    deniedDomains?: readonly string[];
-    /** IPs / CIDRs denied in addition to the built-in {@link DENIED_CLASSES} and this host's own addresses. */
-    deniedResolvedAddresses?: readonly string[];
-    /** Name resolver; defaults to `dns.lookup`. Test seam. */
-    resolve?: Resolver;
-    /** This host's interface addresses; defaults to {@link localInterfaceAddresses}, read per lookup. Test seam. */
-    localAddresses?: () => readonly string[];
-}
-export interface ResolvedAddressGuard {
-    /**
-     * Whether a connection to `hostname:port` may use resolved `address`.
-     * Always true when `hostname` is itself an IP literal.
-     */
-    permits(hostname: string, address: string, port: number): boolean;
-    /**
-     * `lookup` for a `net.connect` to `port` (see `dialDirect`): resolves via
-     * the configured resolver, removes addresses `permits` rejects, and fails
-     * with {@link ResolvedAddressDeniedError} when none remain.
-     */
-    lookupFor(port: number): LookupFunction;
-}
-export declare function createResolvedAddressGuard(opts?: ResolvedAddressGuardOptions): ResolvedAddressGuard;
-//# sourceMappingURL=resolved-address-guard.d.ts.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/resolved-address-guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolved-address-guard.d.ts","sourceRoot":"","sources":["../../src/sandbox/resolved-address-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AA2D9C,8EAA8E;AAC9E,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAYlD;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IASjD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE;IAVvC,QAAQ,CAAC,IAAI,qCAAoC;IACjD;;;;;OAKG;gBAEQ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,MAAM,EAAE;CAKxC;AAED,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,0BAA0B,CAEnC;AAED,MAAM,MAAM,QAAQ,GAAG,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,CACR,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EACjC,SAAS,EAAE,aAAa,EAAE,KACvB,IAAI,KACN,IAAI,CAAA;AAKT;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,2GAA2G;IAC3G,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,0DAA0D;IAC1D,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,gHAAgH;IAChH,cAAc,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACjE;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;CACxC;AA6BD,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,2BAAgC,GACrC,oBAAoB,CA4GtB"}

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/resolved-address-guard.js

@@ -1,221 +0,0 @@
-/**
- * Resolved-address guard for hostname destinations.
- *
- * The domain allowlist decides by name, but whoever controls a permitted
- * name's DNS records (or any label under a permitted wildcard) decides what
- * that name resolves to. Without a check on the resolved address, an
- * allow-listed name can be pointed at the loopback interface, a link-local
- * address, or address space the embedder considers private, and the proxy
- * will dial it. This module wraps `dns.lookup` so a direct dial resolves
- * once, drops denied addresses, and connects to a surviving one — the
- * address that passed the check is the address dialed, with no second
- * resolution in between.
- *
- * Scope: hostnames only. An IP literal on the allowlist is an explicit
- * choice and is never re-judged here; conversely, a name may resolve to a
- * denied address only when that address (and port) is itself allow-listed,
- * so reaching it by name grants nothing the literal entry did not — and an
- * IP literal on the deny list is refused by name too, allowlist or not. The
- * reserved loopback names (`localhost` and anything under `.localhost`,
- * RFC 6761) resolve to loopback — that is what allow-listing them asks for —
- * or to an allow-listed literal, and to nothing else. Connections routed
- * through a parent proxy or a MITM socket are not resolved locally at all;
- * that hop resolves the name and is responsible for its own address policy.
- */
-import { lookup as dnsLookup } from 'node:dns';
-import { BlockList, isIP } from 'node:net';
-import { networkInterfaces } from 'node:os';
-import { logForDebugging } from '../utils/debug.js';
-import { ipLiteralRules } from './domain-pattern.js';
-import { addRange, addressInSet, embeddedIPv4, isLoopbackAddress, isLoopbackName, LOOPBACK_RANGES, } from './address.js';
-/**
- * Cloud instance-metadata / platform endpoints that live outside link-local
- * space, so `169.254.0.0/16` / `fe80::/10` do not cover them. Single
- * addresses (or a provider-reserved block), so nothing else is caught.
- */
-const CLOUD_METADATA_ADDRESSES = [
-    '100.100.100.200', // Alibaba Cloud
-    '168.63.129.16', // Azure WireServer / host agent endpoint
-    '192.0.0.192', // Oracle Cloud Infrastructure Classic
-    'fd00:ec2::/32', // AWS IPv6 service block: IMDS ::254, EKS Pod Identity ::23, DNS, NTP
-    'fd20:ce::254', // Google Cloud, IPv6-only instances
-    'fd00:c1::a9fe:a9fe', // Oracle Cloud Infrastructure IPv6
-    'fd00:42::42', // Scaleway IPv6
-    'fd00:a9fe:a9fe::1', // Akamai / Linode IPv6
-    'fd00:100::100:200', // Alibaba Cloud IPv6
-];
-/**
- * Destinations an allow-listed hostname may not resolve to, grouped by the
- * class a refusal reports. Addresses assigned to this host's own interfaces
- * are denied too (see {@link localInterfaceAddresses}), since a service
- * bound to 0.0.0.0 answers on those exactly as on loopback. Private-use
- * ranges (RFC 1918, ULA, CGNAT) are deliberately absent: allow-listing an
- * intranet hostname is legitimate, so those are opt-in via
- * `network.deniedResolvedAddresses`. IPv4 rules also bind the IPv6 forms
- * that carry an IPv4 address (see `embeddedIPv4`).
- */
-const DENIED_CLASSES = [
-    ['a loopback address', LOOPBACK_RANGES],
-    ['an unspecified address', ['0.0.0.0/8', '::']], // connects to the local host on common stacks
-    ['a link-local address', ['169.254.0.0/16', 'fe80::/10']], // incl. most instance-metadata endpoints
-    ['a multicast address', ['224.0.0.0/4', 'ff00::/8']],
-    ['the broadcast address', ['255.255.255.255']],
-    ['a cloud metadata address', CLOUD_METADATA_ADDRESSES],
-];
-/** Refusal classes in priority order, so a multi-address reason reads the same however the resolver ordered its answer. */
-const REASON_ORDER = [
-    'a deny-listed address',
-    ...DENIED_CLASSES.map(([why]) => why),
-    'a listed address',
-    "one of this host's addresses",
-    'a non-loopback address',
-    'an unparsable address',
-];
-/** Unicast addresses currently assigned to this host's network interfaces. */
-export function localInterfaceAddresses() {
-    let byInterface;
-    try {
-        byInterface = networkInterfaces();
-    }
-    catch {
-        // Interface enumeration is unavailable in some restricted environments;
-        // the fixed denied set still applies.
-        return [];
-    }
-    return Object.values(byInterface)
-        .flat()
-        .flatMap(i => (i ? [i.address] : []));
-}
-export class ResolvedAddressDeniedError extends Error {
-    /**
-     * @param reason parenthetical for the violation line and the client, e.g.
-     *   `resolved to a loopback address` — the class, never the address, which
-     *   the sandboxed client should not learn from a refusal.
-     * @param addresses the refused addresses, for operator logs.
-     */
-    constructor(hostname, reason, addresses) {
-        super(`Connection to ${hostname} blocked: ${reason}`);
-        this.hostname = hostname;
-        this.reason = reason;
-        this.addresses = addresses;
-        this.code = 'ERR_SRT_RESOLVED_ADDRESS_DENIED';
-        this.name = 'ResolvedAddressDeniedError';
-    }
-}
-export function isResolvedAddressDenied(err) {
-    return err instanceof ResolvedAddressDeniedError;
-}
-function buildRuleSet(rules) {
-    const set = { anyPort: new BlockList(), byPort: new Map() };
-    for (const rule of rules) {
-        const { range, port } = typeof rule === 'string' ? { range: rule, port: undefined } : rule;
-        let list = port === undefined ? set.anyPort : set.byPort.get(port);
-        if (!list)
-            set.byPort.set(port, (list = new BlockList()));
-        if (!addRange(list, range)) {
-            throw new Error(`Invalid IP address or CIDR range: ${JSON.stringify(range)}`);
-        }
-    }
-    return set;
-}
-function inRuleSet(set, address, port) {
-    const forPort = set.byPort.get(port);
-    return (addressInSet(set.anyPort, address) ||
-        (forPort !== undefined && addressInSet(forPort, address)));
-}
-export function createResolvedAddressGuard(opts = {}) {
-    const refused = buildRuleSet(ipLiteralRules(opts.deniedDomains ?? []));
-    const allowed = buildRuleSet(ipLiteralRules(opts.allowedDomains ?? []));
-    const denied = [
-        ...DENIED_CLASSES.map(([why, ranges]) => [why, buildRuleSet(ranges)]),
-        ['a listed address', buildRuleSet(opts.deniedResolvedAddresses ?? [])],
-    ];
-    const resolve = opts.resolve ?? dnsLookup;
-    /** This host's addresses right now; a malformed entry from the seam is skipped. */
-    const localSet = () => {
-        const list = new BlockList();
-        for (const a of (opts.localAddresses ?? localInterfaceAddresses)()) {
-            addRange(list, a);
-        }
-        return list;
-    };
-    /** Why `hostname:port` may not use resolved `address`, or undefined if it may. */
-    const denial = (hostname, address, port, local) => {
-        if (isIP(hostname))
-            return undefined;
-        if (!isIP(address))
-            return 'an unparsable address';
-        // A NAT64 / 6to4 / IPv4-compatible answer is delivered to the IPv4
-        // address it carries, so every deny is applied to that address too. The
-        // carried form only ADDS denials: it never earns an allow-list carve-out
-        // (that would let `::1`, whose IPv4-compatible form is `0.0.0.1`, ride a
-        // carve-out for `0.0.0.1`) and does not stand in for the address in the
-        // localhost rule. An IPv4-mapped answer needs no decode here — BlockList
-        // matches it against the IPv4 rules in either spelling.
-        const v4 = embeddedIPv4(address);
-        const denies = (set) => inRuleSet(set, address, port) ||
-            (v4 !== undefined && inRuleSet(set, v4, port));
-        if (denies(refused))
-            return 'a deny-listed address';
-        if (inRuleSet(allowed, address, port))
-            return undefined;
-        if (isLoopbackName(hostname)) {
-            return isLoopbackAddress(address) ? undefined : 'a non-loopback address';
-        }
-        const why = denied.find(([, set]) => denies(set))?.[0];
-        if (why)
-            return why;
-        if (addressInSet(local, address) ||
-            (v4 !== undefined && addressInSet(local, v4)))
-            return "one of this host's addresses";
-        return undefined;
-    };
-    const lookupFor = (port) => (hostname, options, callback) => {
-        resolve(hostname, { ...options, all: true }, (err, addresses) => {
-            if (err) {
-                callback(err, []);
-                return;
-            }
-            const local = localSet();
-            const kept = [];
-            const dropped = [];
-            const whys = new Set();
-            for (const a of addresses) {
-                const why = denial(hostname, a.address, port, local);
-                if (why === undefined)
-                    kept.push(a);
-                else {
-                    dropped.push(a.address);
-                    whys.add(why);
-                }
-            }
-            // Order the classes by the built-in priority, not by the order the
-            // resolver happened to return the addresses, so the reason (which
-            // `ignoreViolations` matches by substring) is stable.
-            const classes = REASON_ORDER.filter(w => whys.has(w));
-            if (dropped.length) {
-                logForDebugging(`Denied address(es) for ${hostname}:${port}: ${dropped.join(', ')} (${classes.join('; ')})`);
-            }
-            const first = kept[0];
-            if (!first) {
-                // An empty answer without an error is possible from some resolvers.
-                const none = dropped.length
-                    ? new ResolvedAddressDeniedError(hostname, `resolved to ${classes.join(' / ')}`, dropped)
-                    : Object.assign(new Error(`getaddrinfo ENOTFOUND ${hostname}`), {
-                        code: 'ENOTFOUND',
-                    });
-                callback(none, []);
-                return;
-            }
-            if (options.all)
-                callback(null, kept);
-            else
-                callback(null, first.address, first.family);
-        });
-    };
-    return {
-        permits: (hostname, address, port) => denial(hostname, address, port, localSet()) === undefined,
-        lookupFor,
-    };
-}
-//# sourceMappingURL=resolved-address-guard.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/resolved-address-guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolved-address-guard.js","sourceRoot":"","sources":["../../src/sandbox/resolved-address-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAA;AAErB;;;;GAIG;AACH,MAAM,wBAAwB,GAAsB;IAClD,iBAAiB,EAAE,gBAAgB;IACnC,eAAe,EAAE,yCAAyC;IAC1D,aAAa,EAAE,sCAAsC;IACrD,eAAe,EAAE,sEAAsE;IACvF,cAAc,EAAE,oCAAoC;IACpD,oBAAoB,EAAE,mCAAmC;IACzD,aAAa,EAAE,gBAAgB;IAC/B,mBAAmB,EAAE,uBAAuB;IAC5C,mBAAmB,EAAE,qBAAqB;CAC3C,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAwD;IAC1E,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACvC,CAAC,wBAAwB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,8CAA8C;IAC/F,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,EAAE,yCAAyC;IACpG,CAAC,qBAAqB,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC,uBAAuB,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC,0BAA0B,EAAE,wBAAwB,CAAC;CACvD,CAAA;AAED,2HAA2H;AAC3H,MAAM,YAAY,GAAsB;IACtC,uBAAuB;IACvB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IACrC,kBAAkB;IAClB,8BAA8B;IAC9B,wBAAwB;IACxB,uBAAuB;CACxB,CAAA;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB;IACrC,IAAI,WAAiD,CAAA;IACrD,IAAI,CAAC;QACH,WAAW,GAAG,iBAAiB,EAAE,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sCAAsC;QACtC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC9B,IAAI,EAAE;SACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAEnD;;;;;OAKG;IACH,YACW,QAAgB,EAChB,MAAc,EACd,SAA4B;QAErC,KAAK,CAAC,iBAAiB,QAAQ,aAAa,MAAM,EAAE,CAAC,CAAA;QAJ5C,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAmB;QAV9B,SAAI,GAAG,iCAAiC,CAAA;QAa/C,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAY;IAEZ,OAAO,GAAG,YAAY,0BAA0B,CAAA;AAClD,CAAC;AAkDD,SAAS,YAAY,CAAC,KAA6B;IACjD,MAAM,GAAG,GAAY,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;IACpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GACnB,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACpE,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAClE,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAK,EAAE,CAAC,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,OAAe,EAAE,IAAY;IAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACpC,OAAO,CACL,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;QAClC,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAC1D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAoC,EAAE;IAEtC,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAA;IACvE,MAAM,MAAM,GAAsC;QAChD,GAAG,cAAc,CAAC,GAAG,CACnB,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAU,CACxD;QACD,CAAC,kBAAkB,EAAE,YAAY,CAAC,IAAI,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;KACvE,CAAA;IACD,MAAM,OAAO,GAAa,IAAI,CAAC,OAAO,IAAI,SAAS,CAAA;IACnD,mFAAmF;IACnF,MAAM,QAAQ,GAAG,GAAc,EAAE;QAC/B,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAA;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC,EAAE,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACnB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,kFAAkF;IAClF,MAAM,MAAM,GAAG,CACb,QAAgB,EAChB,OAAe,EACf,IAAY,EACZ,KAAgB,EACI,EAAE;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,uBAAuB,CAAA;QAClD,mEAAmE;QACnE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,EAAE,CAC9B,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC;YAC7B,CAAC,EAAE,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAA;QAChD,IAAI,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,uBAAuB,CAAA;QACnD,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QACvD,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAA;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACtD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;QACnB,IACE,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC;YAC5B,CAAC,EAAE,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAE7C,OAAO,8BAA8B,CAAA;QACvC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,SAAS,GACb,CAAC,IAAY,EAAkB,EAAE,CACjC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC9B,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAC9D,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;gBACjB,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;YACxB,MAAM,IAAI,GAAoB,EAAE,CAAA;YAChC,MAAM,OAAO,GAAa,EAAE,CAAA;YAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;gBACpD,IAAI,GAAG,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;qBAC9B,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;oBACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACf,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACrD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,eAAe,CACb,0BAA0B,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5F,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACrB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,oEAAoE;gBACpE,MAAM,IAAI,GAA0B,OAAO,CAAC,MAAM;oBAChD,CAAC,CAAC,IAAI,0BAA0B,CAC5B,QAAQ,EACR,eAAe,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EACpC,OAAO,CACR;oBACH,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,EAAE;wBAC5D,IAAI,EAAE,WAAW;qBAClB,CAAC,CAAA;gBACN,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAClB,OAAM;YACR,CAAC;YACD,IAAI,OAAO,CAAC,GAAG;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;;gBAChC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACnC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,SAAS;QAC3D,SAAS;KACV,CAAA;AACH,CAAC"}