@bo-agent/sandbox-windows-acl 0.0.1

package/lib/ffi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ffi.js","sourceRoot":"","sources":["../src/ffi.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAA;AAOrC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAmC;IAC3D,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAK,KAAgB,KAAK,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoC;IAClE,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,OAAQ,MAAiB,KAAK,mBAAmB,IAAK,MAAiB,KAAK,CAAC,EAAE,CAAA;AACjF,CAAC;AAoGD,MAAM,KAAK,GAAQ,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AACxC,MAAM,MAAM,GAAQ,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAExC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;IACvD,EAAE,EAAE,QAAQ;IACZ,UAAU,EAAE,OAAO;IACnB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,OAAO;IAChB,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,aAAa,EAAE,QAAQ;IACvB,aAAa,EAAE,QAAQ;IACvB,eAAe,EAAE,QAAQ;IACzB,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;IACnC,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,KAAK;CACjB,CAAC,CAAA;AAEF,2GAA2G;AAC3G,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE;IACrE,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,QAAQ;IACrB,UAAU,EAAE,QAAQ;CACrB,CAAC,CAAA;AAEF,gHAAgH;AAChH,IAAI,YAAY,CAAC,IAAI,KAAK,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,CAAC,IAAI,uBAAuB,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAA;AAClI,CAAC;AACD,IAAI,mBAAmB,CAAC,IAAI,KAAK,GAAG,CAAC,wBAAwB,EAAE,CAAC;IAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,mBAAmB,CAAC,IAAI,uBAAuB,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAA;AACvJ,CAAC;AACD,oBAAoB;AAEpB;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC5C,OAAO,KAAkB,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/C,OAAO,KAAkB,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,KAAa;IACzD,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe;IACvC,MAAM,KAAK,GAAY,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAChD,IAAI,SAAS,CAAC,KAAqC,CAAC;QAAE,OAAO,IAAI,CAAA;IACjE,OAAO,KAAkB,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,MAAM,KAAK,GAAY,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACnD,OAAO,KAAe,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAc;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,KAAkB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc;IACxD,MAAM,KAAK,GAAY,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1D,IAAI,SAAS,CAAC,KAAqC,CAAC;QAAE,OAAO,IAAI,CAAA;IACjE,OAAO,KAAkB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAY,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,KAAe,CAAA;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAY,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC1D,OAAO,KAAe,CAAA;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAY,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC1D,OAAO,KAAe,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,UAAkB,EAAE,KAAgB,EAAE,WAAmB;IAClG,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IACvD,IAAI,YAAY,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IAChD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;IACxD,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,GAAG,GAAG,CAAC,uBAAuB;QAAE,OAAO,KAAK,CAAA;IACrF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;IACjH,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,KAAK,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC3H,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IACnD,OAAO,KAAkB,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAsB,EAAE,MAAwB;IAChF,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAA;IAC1D,OAAO,KAAkB,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAsB;IACtD,MAAM,KAAK,GAAY,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;IACrE,OAAO,KAA0B,CAAA;AACnC,CAAC;AAED,IAAI,MAAiC,CAAA;AAErC,SAAS,QAAQ;IACf,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAE3C,0EAA0E;IAC1E,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,GAAkC,EAAE,IAAY,EAAE,MAAoB,EAAE,IAAyB,EAAW,EAAE,CAC1H,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C,MAAM,GAAG;QACP,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9E,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtF,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC1D,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzH,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QACtD,sBAAsB,EAAE,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1F,kBAAkB,EAAE,IAAI,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/G,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QACxD,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACnE,mBAAmB,EAAE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3H,mBAAmB,EAAE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClG,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnJ,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAChG,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChI,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5I,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzE,gEAAgE;QAChE,gDAAgD;QAChD,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClH,0EAA0E;QAC1E,uEAAuE;QACvE,+DAA+D;QAC/D,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvG,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjG,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClF,oBAAoB,EAAE,IAAI,CAAC,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChG,oBAAoB,EAAE,IAAI,CAAC,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE;YAClE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;YACtE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;SAChE,CAAC;QACF,uBAAuB,EAAE,IAAI,CAAC,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7F,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACrG,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1J,mBAAmB,EAAE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvF,kBAAkB,EAAE,IAAI,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjG,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/D,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7E,uBAAuB,EAAE,IAAI,CAAC,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1G,wBAAwB,EAAE,IAAI,CAAC,QAAQ,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3F,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9E,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrF,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;KACjC,CAAA;IAC7B,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK;IACnB,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,QAAQ,EAAE,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAkB,EAAE,SAAiB;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAC/B,GAAG,CAAC,0BAA0B,GAAG,GAAG,CAAC,6BAA6B,EAClE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CACpD,CAAA;IACD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAC1D,IAAI,MAAM,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACrD,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,yBAAyB,EAAE,YAAY,MAAM,qBAAqB,MAAM,CAAC,MAAM,GAAG,CAAC,mCAAmC,CAAC,CAAA;IAClK,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAkB,EAAE,IAAY,EAAE,MAAe;IAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;IACpC,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,GAAkB,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAe;IAC7F,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAA;AAC5E,CAAC"}

package/lib/grant.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Server-side write-grant materialization. The sandbox seam holds one
+ * standing workspace grant per workspace and one revocable temp grant per
+ * live session/workspace pair. Workspace identities survive by deterministic
+ * derivation and their standing ACE; temp identities derive from random
+ * private paths and are deliberately new after a restart.
+ *
+ * Fail-closed: `add` throws on any grant failure and the caller disposes the
+ * instance (revoking every path granted so far); `dispose` revokes every
+ * standing grant and reports every cleanup failure.
+ * @module @bo-agent/sandbox-windows-acl/grant
+ */
+import type { Win32Bindings } from './ffi.ts';
+/**
+ * One write SID's provider-lifetime grant materialization: the parsed SID
+ * pointer plus every directory whose DACL currently carries its ACE.
+ * Workspace paths are added STANDING (their ACEs are the cross-session reuse
+ * cache and outlive the grant — dispose() skips revoking them, or the next
+ * provision would re-propagate the whole tree); temp paths are revocable
+ * (dispose() revokes them — an inheritable ACE must not outlive its
+ * session's temp directory). Create with {@link AclWriteGrant.create};
+ * dispose revokes the revocable paths and frees the SID.
+ */
+export declare class AclWriteGrant {
+    /** The write SID in SDDL string form. */
+    readonly writeSid: string;
+    private readonly api;
+    private readonly sidPtr;
+    private readonly revocablePaths;
+    private readonly standingPaths;
+    private constructor();
+    /**
+     * Parse the SID string and open the binding table (lazily, once per
+     * server). Fail-closed: any failure throws — nothing is granted yet.
+     * @param writeSid - the workspace (`S-1-4-x-y`) or temp (`S-1-4-x-y-1`) capability SID string.
+     * @param api - optional already-resolved bindings (tests).
+     * @returns the ready grant (no ACEs yet).
+     */
+    static create(writeSid: string, api?: Win32Bindings): AclWriteGrant;
+    /**
+     * Grant the write ACE on one directory (idempotent: an already-standing
+     * exact ACE skips the eager full-tree re-propagation — see
+     * {@link grantWrite}) and record the path for {@link dispose} unless it is
+     * standing. The path is recorded BEFORE the grant: a post-apply throw (a
+     * LocalFree failure after SetNamedSecurityInfoW succeeded) must still
+     * revoke it, and revoking an ungranted path is a no-op merge. Callers
+     * treat a throw as a failed materialization and dispose the instance to
+     * revoke the paths granted so far.
+     * @param path - the directory whose DACL gains the grant.
+     * @param standing - the ACE outlives this grant (the workspace reuse
+     *   cache; dispose() skips revoking it). Default false (revoked on
+     *   dispose — the temp-directory lifecycle).
+     */
+    add(path: string, standing?: boolean): void;
+    /** Every directory currently carrying the grant, in grant order. */
+    get paths(): readonly string[];
+    /** Revoke every revocable grant (standing ACEs stay) and free the SID; reports every cleanup failure. */
+    dispose(): void;
+}
+//# sourceMappingURL=grant.d.ts.map

package/lib/grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../src/grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAa,aAAa,EAAE,MAAM,UAAU,CAAA;AAExD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAe;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAe;IAE7C,OAAO;IAMP;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,aAAa,GAAG,aAAa;IAWnE;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,UAAQ,GAAG,IAAI;IAKzC,oEAAoE;IACpE,IAAI,KAAK,IAAI,SAAS,MAAM,EAAE,CAE7B;IAED,yGAAyG;IACzG,OAAO,IAAI,IAAI;CAmBhB"}

package/lib/grant.js

@@ -0,0 +1,102 @@
+/**
+ * Server-side write-grant materialization. The sandbox seam holds one
+ * standing workspace grant per workspace and one revocable temp grant per
+ * live session/workspace pair. Workspace identities survive by deterministic
+ * derivation and their standing ACE; temp identities derive from random
+ * private paths and are deliberately new after a restart.
+ *
+ * Fail-closed: `add` throws on any grant failure and the caller disposes the
+ * instance (revoking every path granted so far); `dispose` revokes every
+ * standing grant and reports every cleanup failure.
+ * @module @bo-agent/sandbox-windows-acl/grant
+ */
+import { grantWrite, revokeWrite } from "./acl.js";
+import { allocPtrSlot, decodePtr, isNullPtr, throwLastError, win32Sync } from "./ffi.js";
+/**
+ * One write SID's provider-lifetime grant materialization: the parsed SID
+ * pointer plus every directory whose DACL currently carries its ACE.
+ * Workspace paths are added STANDING (their ACEs are the cross-session reuse
+ * cache and outlive the grant — dispose() skips revoking them, or the next
+ * provision would re-propagate the whole tree); temp paths are revocable
+ * (dispose() revokes them — an inheritable ACE must not outlive its
+ * session's temp directory). Create with {@link AclWriteGrant.create};
+ * dispose revokes the revocable paths and frees the SID.
+ */
+export class AclWriteGrant {
+    /** The write SID in SDDL string form. */
+    writeSid;
+    api;
+    sidPtr;
+    revocablePaths = [];
+    standingPaths = [];
+    constructor(api, sidPtr, writeSid) {
+        this.api = api;
+        this.sidPtr = sidPtr;
+        this.writeSid = writeSid;
+    }
+    /**
+     * Parse the SID string and open the binding table (lazily, once per
+     * server). Fail-closed: any failure throws — nothing is granted yet.
+     * @param writeSid - the workspace (`S-1-4-x-y`) or temp (`S-1-4-x-y-1`) capability SID string.
+     * @param api - optional already-resolved bindings (tests).
+     * @returns the ready grant (no ACEs yet).
+     */
+    static create(writeSid, api) {
+        const bindings = api ?? win32Sync();
+        const sidSlot = allocPtrSlot();
+        if (bindings.convertStringSidToSidW(writeSid, sidSlot) === 0) {
+            throwLastError(bindings, 'ConvertStringSidToSidW', writeSid);
+        }
+        const sidPtr = decodePtr(sidSlot);
+        if (sidPtr === null)
+            throwLastError(bindings, 'ConvertStringSidToSidW', `null SID for ${writeSid}`);
+        return new AclWriteGrant(bindings, sidPtr, writeSid);
+    }
+    /**
+     * Grant the write ACE on one directory (idempotent: an already-standing
+     * exact ACE skips the eager full-tree re-propagation — see
+     * {@link grantWrite}) and record the path for {@link dispose} unless it is
+     * standing. The path is recorded BEFORE the grant: a post-apply throw (a
+     * LocalFree failure after SetNamedSecurityInfoW succeeded) must still
+     * revoke it, and revoking an ungranted path is a no-op merge. Callers
+     * treat a throw as a failed materialization and dispose the instance to
+     * revoke the paths granted so far.
+     * @param path - the directory whose DACL gains the grant.
+     * @param standing - the ACE outlives this grant (the workspace reuse
+     *   cache; dispose() skips revoking it). Default false (revoked on
+     *   dispose — the temp-directory lifecycle).
+     */
+    add(path, standing = false) {
+        ;
+        (standing ? this.standingPaths : this.revocablePaths).push(path);
+        grantWrite(this.api, path, this.sidPtr);
+    }
+    /** Every directory currently carrying the grant, in grant order. */
+    get paths() {
+        return [...this.standingPaths, ...this.revocablePaths];
+    }
+    /** Revoke every revocable grant (standing ACEs stay) and free the SID; reports every cleanup failure. */
+    dispose() {
+        const failures = [];
+        for (const path of this.revocablePaths) {
+            try {
+                revokeWrite(this.api, path, this.sidPtr);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        try {
+            const freed = this.api.localFree(this.sidPtr);
+            if (!isNullPtr(freed))
+                throwLastError(this.api, 'LocalFree', 'write SID');
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (failures.length > 0) {
+            throw new AggregateError(failures, `AclWriteGrant dispose completed with ${failures.length} cleanup failure(s)`);
+        }
+    }
+}
+//# sourceMappingURL=grant.js.map

package/lib/grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.js","sourceRoot":"","sources":["../src/grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAGxF;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAa;IACxB,yCAAyC;IAChC,QAAQ,CAAQ;IACR,GAAG,CAAe;IAClB,MAAM,CAAW;IACjB,cAAc,GAAa,EAAE,CAAA;IAC7B,aAAa,GAAa,EAAE,CAAA;IAE7C,YAAoB,GAAkB,EAAE,MAAiB,EAAE,QAAgB;QACzE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,CAAC,QAAgB,EAAE,GAAmB;QACjD,MAAM,QAAQ,GAAG,GAAG,IAAI,SAAS,EAAE,CAAA;QACnC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAA;QAC9B,IAAI,QAAQ,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,cAAc,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI;YAAE,cAAc,CAAC,QAAQ,EAAE,wBAAwB,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAA;QACnG,OAAO,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IACtD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,IAAY,EAAE,QAAQ,GAAG,KAAK;QAChC,CAAC;QAAA,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IAED,oEAAoE;IACpE,IAAI,KAAK;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;IACxD,CAAC;IAED,yGAAyG;IACzG,OAAO;QACL,MAAM,QAAQ,GAAc,EAAE,CAAA;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,wCAAwC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAA;QAClH,CAAC;IACH,CAAC;CACF"}

package/lib/index.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Windows ACL write-restriction sandbox backend for the DeepSeek Harness
+ * sandbox seam. Mirrors the mechanism of github.com/huoyaoyuan/
+ * windows-acl-restrict-poc @ 10e4dfb (the fixed revision): a WRITE_RESTRICTED
+ * token whose restricting SIDs include distinct workspace and temp write
+ * SIDs that this sandbox adds to their owning directories' DACLs — the
+ * intersection check then allows writes exactly where either capability has
+ * a Write ACE, and nowhere else those SIDs are concerned (the check ALSO
+ * inherits the ambient write ACEs of the other restricting SIDs — the
+ * keep-alive group logon SID + Everyone; Authenticated Users, INTERACTIVE,
+ * and LOCAL are absent from both lists — see the seam's dual-list contract
+ * in `packages/sandbox/sandbox-local` and the package README's Modes section
+ * for the complete boundary). The write SID is the per-WORKSPACE identity
+ * ({@link workspaceWriteSid}): deterministic from the canonical workspace
+ * path, so the workspace-root ACE materializes once per workspace per
+ * machine and every later provision hits the exact-ACE skip — the
+ * grant-reuse story the per-session random SID paid a full tree propagation
+ * per session for. Each private temp directory instead receives its own SID,
+ * so sibling sessions sharing a workspace cannot enter one another's temp
+ * trees. Unlike the POC, every API failure throws with the API
+ * name and exact Win32 code; a child is NEVER spawned unrestricted.
+ *
+ * Known boundaries (inherent to restricted tokens, not this port):
+ *  - writes are restricted; reads, network, and process visibility are NOT
+ *    (WRITE_RESTRICTED intersects only write accesses);
+ *  - console isolation is unavailable — children share the host console
+ *    (CREATE_NO_WINDOW / CREATE_NEW_CONSOLE children die with
+ *    STATUS_DLL_INIT_FAILED under the restriction);
+ *  - the private temp directory and every writable directory must be owned by the
+ *    caller (owner-implicit WRITE_DAC);
+ *  - grants are standing ACE mutations on real directories. WORKSPACE grants
+ *    are deliberately never revoked — the ACE is the cross-session reuse
+ *    cache (revoking would force the next session to re-propagate the whole
+ *    tree). TEMP grants are revocable: dispose() removes them so a standing
+ *    inheritable ACE never outlives its session's temp directory. The
+ *    ambient temp root is never granted implicitly. With `manageDacls: false`
+ *    the CALLER owns the DACLs (the sandbox seam's grant reuse):
+ *    init()/dispose() skip grant/revoke entirely and the caller must not
+ *    revoke under live children.
+ * @module @bo-agent/sandbox-windows-acl
+ */
+export { quoteArg } from './spawn.ts';
+export { AclWriteGrant } from './grant.ts';
+export { assertTempRootOutsideWorkspace } from './path-boundary.ts';
+export { tempWriteSid, workspaceWriteSid } from './workspace-sid.ts';
+export { Win32Error } from './errors.ts';
+/** Construction options: the workspace/temp allowlists and their distinct SID identities. */
+export interface AclSandboxOptions {
+    /** Directories the confined child may write into (must exist and be caller-owned). */
+    writableDirs: readonly string[];
+    /**
+     * Existing private temp directory to grant. Workspace-write callers must
+     * pass it explicitly or pass null to disable temp writes; the ambient temp
+     * root is never an implicit grant. Read-only accepts only null/undefined.
+     */
+    tempDir?: string | null;
+    /**
+     * The write SID forming the workspace-write allowlist: REQUIRED under
+     * workspace-write, ignored (and must be absent) under read-only. Callers
+     * derive it from the workspace via {@link workspaceWriteSid} — the identity
+     * is per workspace, not per sandbox instance, so the workspace-root ACE
+     * outlives every instance and later provisions hit the exact-ACE skip.
+     */
+    writeSid?: string;
+    /**
+     * The private temp directory's write SID. Required whenever
+     * workspace-write grants a temp directory, absent otherwise. It must be
+     * distinct from {@link writeSid}, so sibling sessions sharing a workspace
+     * cannot use the standing workspace capability in one another's temp tree.
+     */
+    tempWriteSid?: string;
+    /**
+     * The file-effect mode this instance confines under — selects the
+     * restricted token's restricting-SID list (I for read-only, J for
+     * workspace-write) and MUST match the grant shape: read-only pairs with
+     * zero grants. The runner validates the argv-borne mode string at its
+     * boundary; this typed seam trusts the union.
+     */
+    mode: 'read-only' | 'workspace-write';
+    /**
+     * Whether this instance owns its DACL grants (default true). False means
+     * the CALLER has already materialized the ACEs (the sandbox seam's
+     * workspace/temp capability lifecycle): init()/dispose() skip grant/revoke entirely —
+     * the caller holds the grants for its own lifetime and revokes them.
+     */
+    manageDacls?: boolean;
+}
+/** Per-spawn options: the program, its argv/cwd, and the stdio shape. */
+export interface AclSandboxSpawnOptions {
+    /** Program to run (resolved via PATH search when unqualified, like CreateProcess). */
+    command: string;
+    /** Arguments, quoted per CommandLineToArgvW rules. */
+    args?: readonly string[];
+    /** Working directory; defaults to the caller's cwd. */
+    cwd?: string;
+    /**
+     * 'pipe' (default): capture stdout/stderr via anonymous pipes.
+     * 'inherit': the child inherits the caller's stdio directly (runner usage —
+     * bytes flow straight through), always wrapped in a kill-on-close job so the
+     * child dies with the caller; stdout/stderr in the result are empty.
+     */
+    stdio?: 'pipe' | 'inherit';
+}
+/** A settled confined child: captured stdio and the exit code. */
+export interface AclSandboxChildResult {
+    stdout: Buffer;
+    stderr: Buffer;
+    exitCode: number;
+}
+/** A running confined child: its pid and a settlement promise. */
+export interface AclSandboxChild {
+    /** Child process id. */
+    pid: number;
+    /** Resolve stdout/stderr and the exit code once the child exits. */
+    wait(): Promise<AclSandboxChildResult>;
+}
+/**
+ * One write-restricted sandbox instance: token + write-SID grants + spawn.
+ * `init()` is fail-closed — any Win32 failure revokes the revocable (temp)
+ * grants and throws; `dispose()` revokes the temp grants, leaves the
+ * standing workspace ACEs in place (the cross-instance reuse cache), frees
+ * every allocation, and reports every cleanup failure. With
+ * `manageDacls: false` the caller owns the grants (the sandbox seam's grant
+ * reuse): init() applies none and dispose() revokes none.
+ */
+export declare class AclSandbox {
+    /** Absolute writable directories (constructor-validated). */
+    readonly writableDirs: string[];
+    /** The workspace SID string whose ACEs form the workspace allowlist. */
+    readonly writeSid: string | undefined;
+    /** The private temp directory's write SID (workspace-write with temp only). */
+    readonly tempWriteSid: string | undefined;
+    /** The file-effect mode — the restricted token's restricting-SID list selection. */
+    readonly mode: 'read-only' | 'workspace-write';
+    private readonly tempDirOption;
+    private readonly manageDacls;
+    private tempDirResolved;
+    private api;
+    private token;
+    private writeSidPtr;
+    private tempWriteSidPtr;
+    /** The well-known/logon SID allocations init() makes; freed by dispose() alongside the write SIDs. */
+    private sidAllocations;
+    private grantedPaths;
+    constructor(options: AclSandboxOptions);
+    /** Resolved temp directory (available after init; null when temp grants are disabled). */
+    get tempDir(): string | null | undefined;
+    /** Create the restricted token and apply the capability-SID grants. Idempotent-unsafe: once per instance. */
+    init(): Promise<void>;
+    /**
+     * Spawn a process under the restricted token. Fails closed: throws on every
+     * Win32 failure; the child is never created unrestricted. With
+     * `stdio: 'inherit'` the child shares the caller's stdio directly and is
+     * placed in a kill-on-close job (dies with the caller). Call dispose() only
+     * after all children have exited — revoking grants under a live child
+     * removes its remaining write allowance.
+     * @param options - the program, argv/cwd, and stdio shape.
+     * @returns the running child.
+     */
+    spawn(options: AclSandboxSpawnOptions): AclSandboxChild;
+    /**
+     * Revoke the revocable (temp) grants, free the SID, close the token; the
+     * standing workspace ACEs stay (the reuse cache). Reports every cleanup
+     * failure.
+     */
+    dispose(): void;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAcH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,oEAAoE;IACpE,IAAI,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;CACvC;AAkBD;;;;;;;;GAQG;AACH,qBAAa,UAAU;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAA;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAAA;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,GAAG,CAA2B;IACtC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAuB;IAC9C,sGAAsG;IACtG,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,YAAY,CAAiD;gBAEzD,OAAO,EAAE,iBAAiB;IAoCtC,0FAA0F;IAC1F,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS,CAEvC;IAED,6GAA6G;IACvG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuH3B;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe;IAwCvD;;;;OAIG;IACH,OAAO,IAAI,IAAI;CAsChB"}