@b4run/sandbox 0.8.28

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Brian Love
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,42 @@
+# @b4run/sandbox
+
+Docker and Kubernetes sandbox providers for isolated B4.run workspace execution.
+
+**Use this when:** You need to isolate workspace filesystem and shell execution from the B4.run host process.
+
+## Install
+
+```bash
+pnpm add @b4run/sandbox
+```
+
+## Example
+
+```ts
+import { dockerSandbox } from "@b4run/sandbox"
+import { fakeSandbox } from "@b4run/sandbox/testing"
+
+const provider = dockerSandbox({ image: "node:24-slim" })
+const testProvider = fakeSandbox()
+```
+
+## Runtime and stability
+
+- `@b4run/sandbox` is a node-only, supported application surface.
+- `@b4run/sandbox/testing` is a node-only, supported testing surface.
+
+A sandbox narrows where workspace operations run; applications still own image hardening, credentials, network policy, and resource limits.
+
+## Related
+
+- [Sandbox API reference](https://b4.run/docs/api/sandbox) — Docker, Kubernetes, and testing provider contracts.
+- [Execution Sandbox guide](https://b4.run/docs/sandbox) — application setup and security boundaries.
+- [`@b4run/workspace`](https://www.npmjs.com/package/@b4run/workspace) — the filesystem and shell contracts sandbox providers implement.
+
+## Maturity and support
+
+B4.run is pre-1.0, and its public surface can change. All publishable B4.run packages release together as a fixed group; review the [`@b4run/sandbox` changelog](https://github.com/cacheplane/b4run/blob/main/packages/sandbox/CHANGELOG.md) and [upgrading guide](https://b4.run/docs/upgrading) before upgrading. For support, use [GitHub Discussions](https://github.com/cacheplane/b4run/discussions); report defects in [GitHub Issues](https://github.com/cacheplane/b4run/issues).
+
+## License
+
+MIT. See the [repository license](https://github.com/cacheplane/b4run/blob/main/LICENSE).

package/dist/docker/docker-cli.d.ts

@@ -0,0 +1,23 @@
+export interface SpawnResult {
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly exitCode: number;
+}
+export type Spawner = (args: readonly string[], opts?: {
+    readonly stdin?: string;
+    readonly signal?: AbortSignal;
+}) => Promise<SpawnResult>;
+export interface Docker {
+    run(args: readonly string[], opts?: {
+        readonly signal?: AbortSignal;
+    }): Promise<SpawnResult>;
+    exec(container: string, command: readonly string[], opts?: {
+        readonly stdin?: string;
+        readonly signal?: AbortSignal;
+    }): Promise<SpawnResult>;
+}
+/** Thin docker-CLI wrapper. `spawn` is injectable so unit tests need no daemon. */
+export declare function createDocker(deps?: {
+    readonly spawn?: Spawner;
+}): Docker;
+//# sourceMappingURL=docker-cli.d.ts.map

package/dist/docker/docker-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-cli.d.ts","sourceRoot":"","sources":["../../src/docker/docker-cli.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAC9D,OAAO,CAAC,WAAW,CAAC,CAAA;AAsBzB,MAAM,WAAW,MAAM;IACrB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5F,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAChE,OAAO,CAAC,WAAW,CAAC,CAAA;CACxB;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAM5E"}

package/dist/docker/docker-cli.js

@@ -0,0 +1,29 @@
+import { spawn } from "node:child_process";
+const defaultSpawn = (args, opts) => new Promise((resolve, reject) => {
+    const child = spawn("docker", [...args], {
+        stdio: ["pipe", "pipe", "pipe"],
+        ...(opts?.signal ? { signal: opts.signal } : {}),
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (c) => {
+        stdout += String(c);
+    });
+    child.stderr.on("data", (c) => {
+        stderr += String(c);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve({ stdout, stderr, exitCode: code ?? 1 }));
+    if (opts?.stdin !== undefined)
+        child.stdin.end(opts.stdin);
+    else
+        child.stdin.end();
+});
+/** Thin docker-CLI wrapper. `spawn` is injectable so unit tests need no daemon. */
+export function createDocker(deps = {}) {
+    const sp = deps.spawn ?? defaultSpawn;
+    return {
+        run: (args, opts) => sp(args, opts),
+        exec: (container, command, opts) => sp(["exec", "-i", container, ...command], opts),
+    };
+}

package/dist/docker/docker-exec.d.ts

@@ -0,0 +1,12 @@
+import type { ExecBackend } from "@b4run/workspace";
+import type { Docker } from "./docker-cli.js";
+import { type DockerPidExhaustionRecovery } from "./docker-pid-exhaustion.js";
+interface DockerExecOptions {
+    readonly timeoutMs?: number;
+    readonly runWithExecLease?: <T>(operation: () => Promise<T>) => Promise<T>;
+    readonly pidExhaustionRecovery?: DockerPidExhaustionRecovery;
+}
+/** ExecBackend that runs commands inside a docker container via `docker exec sh -c`. */
+export declare function dockerExec(docker: Docker, container: string, opts?: DockerExecOptions): ExecBackend;
+export {};
+//# sourceMappingURL=docker-exec.d.ts.map

package/dist/docker/docker-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-exec.d.ts","sourceRoot":"","sources":["../../src/docker/docker-exec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAkB,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,4BAA4B,CAAA;AAEnC,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1E,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;CAC7D;AAMD,wFAAwF;AACxF,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,iBAAsB,GAC3B,WAAW,CA0Eb"}

package/dist/docker/docker-exec.js

@@ -0,0 +1,74 @@
+import { randomUUID } from "node:crypto";
+import { isDockerExecAdmissionPidExhaustion, } from "./docker-pid-exhaustion.js";
+function shellQuote(s) {
+    return `'${s.replaceAll("'", `'\\''`)}'`;
+}
+/** ExecBackend that runs commands inside a docker container via `docker exec sh -c`. */
+export function dockerExec(docker, container, opts = {}) {
+    return {
+        async runCommand(args, ctx) {
+            const envPrefix = args.env
+                ? Object.entries(args.env)
+                    .map(([k, v]) => {
+                    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) {
+                        throw new Error(`Invalid environment variable name ${JSON.stringify(k)}: keys must match /^[A-Za-z_][A-Za-z0-9_]*$/`);
+                    }
+                    return `${k}=${shellQuote(v)} `;
+                })
+                    .join("")
+                : "";
+            const cwd = args.cwd ?? ctx.workspaceRoot;
+            const cdPrefix = cwd ? `cd ${shellQuote(cwd)} && ` : "";
+            const full = `${envPrefix}${cdPrefix}${args.command}`;
+            const startedMarker = `__B4_EXEC_STARTED_${randomUUID()}__`;
+            const startedPrefix = `${startedMarker}\n`;
+            const shArgs = ["sh", "-c", `printf '%s\\n' ${shellQuote(startedMarker)}; ${full}`];
+            // `timeout` has second granularity, so round up to the enforced ceiling and
+            // report THAT (not the raw ms) — otherwise `timeoutMs: 500` reports "500ms"
+            // while the process actually gets a full 1s.
+            const timeoutSecs = opts.timeoutMs !== undefined ? Math.ceil(opts.timeoutMs / 1000) : undefined;
+            const argv = timeoutSecs !== undefined ? ["timeout", `${timeoutSecs}s`, ...shArgs] : shArgs;
+            const attempt = async () => {
+                const result = await docker.exec(container, argv, { signal: ctx.signal });
+                const started = result.stdout.startsWith(startedPrefix);
+                return {
+                    result: started
+                        ? { ...result, stdout: result.stdout.slice(startedPrefix.length) }
+                        : result,
+                    started,
+                };
+            };
+            const executeWithLease = (operation) => opts.runWithExecLease !== undefined ? opts.runWithExecLease(operation) : operation();
+            let recoveryToken;
+            const firstAttempt = await executeWithLease(async () => {
+                // Token capture and Docker admission share one lease. A queued command
+                // therefore records the generation of the keeper it actually enters,
+                // not the generation that existed before an earlier recovery.
+                recoveryToken = opts.pidExhaustionRecovery?.captureToken();
+                return attempt();
+            });
+            let r = firstAttempt.result;
+            const isConfiguredTimeout = timeoutSecs !== undefined && r.exitCode === 124;
+            if (opts.pidExhaustionRecovery !== undefined &&
+                recoveryToken !== undefined &&
+                !isConfiguredTimeout &&
+                !firstAttempt.started &&
+                isDockerExecAdmissionPidExhaustion(r)) {
+                const recovered = await opts.pidExhaustionRecovery.recoverAndRetry(recoveryToken, 
+                // Recovery owns the exclusive lifecycle lease, so its retry must run
+                // directly rather than attempting to acquire a nested shared lease.
+                async () => (await attempt()).result);
+                if (recovered !== undefined)
+                    r = recovered;
+            }
+            if (timeoutSecs !== undefined && r.exitCode === 124) {
+                return {
+                    stdout: r.stdout,
+                    stderr: `${r.stderr}${r.stderr ? "\n" : ""}Command timed out after ${timeoutSecs}s (resources.timeoutMs: ${opts.timeoutMs}ms).`,
+                    exitCode: 124,
+                };
+            }
+            return { stdout: r.stdout, stderr: r.stderr, exitCode: r.exitCode };
+        },
+    };
+}

package/dist/docker/docker-filesystem.d.ts

@@ -0,0 +1,11 @@
+import type { FilesystemBackend } from "@b4run/workspace";
+import type { Docker } from "./docker-cli.js";
+import { type DockerPidExhaustionRecovery } from "./docker-pid-exhaustion.js";
+interface DockerFilesystemOptions {
+    readonly runWithExecLease?: <T>(operation: () => Promise<T>) => Promise<T>;
+    readonly pidExhaustionRecovery?: DockerPidExhaustionRecovery;
+}
+/** FilesystemBackend whose ops run inside a docker container via `docker exec`. */
+export declare function dockerFilesystem(docker: Docker, container: string, opts?: DockerFilesystemOptions): FilesystemBackend;
+export {};
+//# sourceMappingURL=docker-filesystem.d.ts.map

package/dist/docker/docker-filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-filesystem.d.ts","sourceRoot":"","sources":["../../src/docker/docker-filesystem.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EACL,KAAK,2BAA2B,EAGjC,MAAM,4BAA4B,CAAA;AAEnC,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1E,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;CAC7D;AAMD,mFAAmF;AACnF,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,uBAA4B,GACjC,iBAAiB,CAqFnB"}

package/dist/docker/docker-filesystem.js

@@ -0,0 +1,87 @@
+import { randomUUID } from "node:crypto";
+import { isDockerExecAdmissionPidExhaustion, isStartedShellPidExhaustion, } from "./docker-pid-exhaustion.js";
+function q(s) {
+    return `'${s.replaceAll("'", `'\\''`)}'`;
+}
+/** FilesystemBackend whose ops run inside a docker container via `docker exec`. */
+export function dockerFilesystem(docker, container, opts = {}) {
+    const run = async (cmd, ctx, stdin) => {
+        const startedMarker = `__B4_FILESYSTEM_STARTED_${randomUUID()}__`;
+        const startedPrefix = `${startedMarker}\n`;
+        const attempt = async () => {
+            const result = await docker.exec(container, ["sh", "-c", `printf '%s\\n' ${q(startedMarker)}; ${cmd}`], {
+                ...(stdin !== undefined ? { stdin } : {}),
+                signal: ctx.signal,
+            });
+            const started = result.stdout.startsWith(startedPrefix);
+            return {
+                result: started ? { ...result, stdout: result.stdout.slice(startedPrefix.length) } : result,
+                started,
+            };
+        };
+        const executeWithLease = (operation) => opts.runWithExecLease !== undefined ? opts.runWithExecLease(operation) : operation();
+        let recoveryToken;
+        const firstAttempt = await executeWithLease(async () => {
+            recoveryToken = opts.pidExhaustionRecovery?.captureToken();
+            return attempt();
+        });
+        let result = firstAttempt.result;
+        if (opts.pidExhaustionRecovery !== undefined &&
+            recoveryToken !== undefined &&
+            (firstAttempt.started
+                ? isStartedShellPidExhaustion(result)
+                : isDockerExecAdmissionPidExhaustion(result))) {
+            const recovered = await opts.pidExhaustionRecovery.recoverAndRetry(recoveryToken, async () => (await attempt()).result);
+            if (recovered !== undefined)
+                result = recovered;
+        }
+        return result;
+    };
+    return {
+        async readFile(path, ctx, opts) {
+            const r = await run(`cat ${q(path)}`, ctx);
+            if (r.exitCode !== 0)
+                throw new Error(`readFile failed: ${r.stderr.trim()}`);
+            const max = opts?.maxBytes;
+            if (max !== undefined && Number.isFinite(max) && Buffer.byteLength(r.stdout) > max) {
+                throw new Error(`readFile ${path}: content exceeds maxBytes (${max}).`);
+            }
+            return r.stdout;
+        },
+        async writeFile(path, content, ctx) {
+            const r = await run(`mkdir -p "$(dirname ${q(path)})" && cat > ${q(path)}`, ctx, content);
+            if (r.exitCode !== 0)
+                throw new Error(`writeFile failed: ${r.stderr.trim()}`);
+            return { bytesWritten: Buffer.byteLength(content) };
+        },
+        async listDir(path, ctx) {
+            const r = await run(`ls -1 ${q(path)}`, ctx);
+            if (r.exitCode !== 0)
+                throw new Error(`listDir failed: ${r.stderr.trim()}`);
+            return r.stdout
+                .split("\n")
+                .map((l) => l.trim())
+                .filter(Boolean);
+        },
+        async realPath(path, ctx) {
+            const r = await run(`realpath -m ${q(path)}`, ctx);
+            return r.exitCode === 0 ? r.stdout.trim() : path;
+        },
+        async statFile(path, ctx) {
+            const r = await run(`stat -c '%s %Y' ${q(path)}`, ctx);
+            if (r.exitCode !== 0)
+                throw new Error(`statFile failed: ${r.stderr.trim()}`);
+            const [size, mtime] = r.stdout.trim().split(" ");
+            return { size: Number(size), mtimeMs: Number(mtime) * 1000 };
+        },
+        async removeFile(path, ctx) {
+            await run(`rm -f ${q(path)}`, ctx);
+        },
+        async touchFile(path, ctx) {
+            await run(`touch ${q(path)}`, ctx);
+        },
+        async mkdir(path, ctx) {
+            await run(`mkdir -p ${q(path)}`, ctx);
+        },
+    };
+}

package/dist/docker/docker-pid-exhaustion.d.ts

@@ -0,0 +1,8 @@
+import type { SpawnResult } from "./docker-cli.js";
+export interface DockerPidExhaustionRecovery {
+    readonly captureToken: () => unknown;
+    readonly recoverAndRetry: (token: unknown, retry: () => Promise<SpawnResult>) => Promise<SpawnResult | undefined>;
+}
+export declare function isDockerExecAdmissionPidExhaustion(result: SpawnResult): boolean;
+export declare function isStartedShellPidExhaustion(result: SpawnResult): boolean;
+//# sourceMappingURL=docker-pid-exhaustion.d.ts.map

package/dist/docker/docker-pid-exhaustion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-pid-exhaustion.d.ts","sourceRoot":"","sources":["../../src/docker/docker-pid-exhaustion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAElD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,CACxB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,KAC9B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;CACtC;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAU/E;AA0BD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAOxE"}

package/dist/docker/docker-pid-exhaustion.js

@@ -0,0 +1,39 @@
+export function isDockerExecAdmissionPidExhaustion(result) {
+    if (result.exitCode === 0)
+        return false;
+    const output = `${result.stdout}\n${result.stderr}`;
+    return (output.includes("OCI runtime exec failed") &&
+        (output.includes("Resource temporarily unavailable") ||
+            output.includes("read init-p: connection reset by peer") ||
+            (output.includes("unable to start container process") &&
+                output.includes("procReady not received"))));
+}
+function isShellForkFailure(line) {
+    const prefix = "sh: ";
+    if (!line.startsWith(prefix))
+        return false;
+    let detail = line.slice(prefix.length);
+    const separator = detail.indexOf(": ");
+    if (separator > 0) {
+        const possibleLineNumber = detail.slice(0, separator);
+        if ([...possibleLineNumber].every((character) => character >= "0" && character <= "9")) {
+            detail = detail.slice(separator + 2);
+        }
+    }
+    const normalized = detail.toLowerCase();
+    return (normalized === "cannot fork" ||
+        normalized === "can't fork" ||
+        normalized === "cannot fork: resource temporarily unavailable" ||
+        normalized === "can't fork: resource temporarily unavailable" ||
+        normalized === "fork: resource temporarily unavailable" ||
+        normalized === "fork: retry: resource temporarily unavailable");
+}
+export function isStartedShellPidExhaustion(result) {
+    if (result.exitCode === 0)
+        return false;
+    const diagnostics = result.stderr
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    return diagnostics.length > 0 && diagnostics.every(isShellForkFailure);
+}

package/dist/docker/docker-sandbox.d.ts

@@ -0,0 +1,20 @@
+import type { SandboxProvider } from "@b4run/workspace";
+import { type Docker } from "./docker-cli.js";
+export interface DockerSandboxOptions {
+    /** Container image for the sandbox (must include a POSIX shell). */
+    readonly image: string;
+    /** Injected for tests; defaults to the real docker CLI. */
+    readonly docker?: Docker;
+}
+/**
+ * Docker reference SandboxProvider. Per thread: a persistent container
+ * `b4-sbx-<threadId>` (sleep infinity) with a named volume mounted at
+ * /workspace. acquire() reuses only a keeper owned by this provider lifecycle
+ * with a matching persisted identity; otherwise it replaces the keeper while
+ * preserving the volume. release() removes the container but KEEPS the volume;
+ * destroy() removes both. Network: deny → --network none (exact); allow →
+ * bridge (denylist is best-effort and NOT enforced here — see the spec's
+ * honest-scope note). Host env is never inherited; only policy.env is passed.
+ */
+export declare function dockerSandbox(opts: DockerSandboxOptions): SandboxProvider;
+//# sourceMappingURL=docker-sandbox.d.ts.map

package/dist/docker/docker-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-sandbox.d.ts","sourceRoot":"","sources":["../../src/docker/docker-sandbox.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAgC,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAErF,OAAO,EAAgB,KAAK,MAAM,EAAoB,MAAM,iBAAiB,CAAA;AAU7E,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAyED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,eAAe,CA6QzE"}