@homeflare/alchemy 0.25.1 → 0.26.0

package/dist/launchd/sudo-guard-mode.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The mode/owner and read-back half of sudo-guard.ts, split out to keep that file under the
+ * house's 250-line cap. `assertPlainPath` (path chain) stays there; this is "is the mode/owner
+ * safe, and can the deploying user read the result back" — re-exported from sudo-guard.ts so
+ * nothing importing from there has to know this file exists.
+ */
+import type { HostRunner, WriteOptions } from './runner.ts';
+/**
+ * ⛔ A ROOT-OWNED FILE UNDER A PREFIX IS ROOT'S TO CHANGE, AND ONLY ROOT'S (decided 2026-09-21).
+ *   Group- or world-writable, anyone in that class rewrites a file root installed — a daemon's
+ *   config, a script a LaunchDaemon runs as root — which is root by another name. Setuid or setgid,
+ *   it runs as root (or its group) for whoever executes it. install(1) would apply either, as root.
+ * ★ Root-owned is an omitted owner (the runner installs as root under a prefix) or uid 0. A file
+ *   handed to another user is that user's to change; the sticky bit changes nothing on a file.
+ * 🔴 MEASURED (adversarial review, 2026-09-23, round 1): "handed to another user" checked only
+ *   `uid`, never `gid`. `{ uid: 501, gid: 0, mode: 0o2775 }` — a setgid file owned by an
+ *   unprivileged uid but GROUPED to root — passed untouched, because a non-zero uid alone skipped
+ *   every check below. Fixed by also treating `gid: 0` as root-adjacent.
+ * 🔴 MEASURED (adversarial review, round 2, same day): the round-1 fix still missed an OMITTED
+ *   `gid`. `remote-file-plan.ts`'s `identity()` returns no `gid` key at all when a `RemoteFile`
+ *   declares no `group`, so `{ uid: 501, mode: 0o2775 }` reaches this check with `gid: undefined`
+ *   — neither `0` nor genuinely someone else's. `sudo-write.ts` then omits `-g` from `install`
+ *   entirely, and GNU `install`, run as root via `sudo -n`, defaults an omitted `-g` to the
+ *   INVOKING PROCESS's group — root's own — whenever the destination directory is not itself
+ *   setgid (which none of this runner's declared prefixes are, measured in linux-host-measured.md).
+ *   The file lands exactly as `{ uid: 501, gid: 0, mode: 0o2775 }` — the identical escalation the
+ *   round-1 fix closed, reached by OMISSION instead of an explicit `group: 0`. So "root-adjacent"
+ *   now also means an omitted `gid`: only a file with a genuinely non-root, EXPLICITLY GIVEN owner
+ *   AND group is someone else's alone to make setuid/setgid or writable — an omission is never
+ *   read as a safe default on either side, uid or gid.
+ */
+export declare const modeProblem: (options: WriteOptions) => string | undefined;
+/**
+ * POSIX read permission for one uid: owner class, else group class, else other. `undefined` when
+ * only group membership could decide and the groups are unknown.
+ * ⚠️ EXACTLY ONE CLASS APPLIES. A group member gets the group bits even when the other bits are
+ *   wider (`0604` hides a file from its group), so "other can read" is not enough on its own.
+ */
+export declare const canRead: (file: {
+    readonly uid: number;
+    readonly gid: number;
+    readonly mode: number;
+}, uid: number, groups: readonly number[] | undefined) => boolean | undefined;
+/**
+ * ⛔ REFUSE A FILE THE DEPLOYING USER COULD NOT READ BACK, before writing it. Both providers read
+ *   every write back to verify it (host-file-lifecycle.ts, job-lifecycle.ts) and read it again at
+ *   every plan, as the deploying user; this runner elevates writes, never reads. A root-only
+ *   `0600` would be installed, then fail the read-back with EACCES and stay on disk with no state,
+ *   so every later plan would fail too.
+ * ★ An omitted owner is root (under a prefix the runner writes as root). An omitted group is the
+ *   parent directory's, which is the group a new file gets on macOS.
+ * ⚠️ Unknown groups never refuse: the read-back after the write stays the final judge.
+ */
+export declare const assertReadableBack: (base: HostRunner, path: string, options: WriteOptions, groups: readonly number[] | undefined) => Promise<void>;
+/**
+ * The deploying user's groups, from `id -G`; `undefined` when that fails.
+ * ⚠️ NOT process.getgroups(). MEASURED 2026-09-21 on macOS 27.2: getgroups() returned 16 groups
+ *   where `id -G` returned 18, because macOS caps a process's own list at 16. A group past the
+ *   16th would read as "not a member" and refuse a file the user can in fact read.
+ */
+export declare const operatorGroups: (base: HostRunner) => Promise<readonly number[] | undefined>;
+//# sourceMappingURL=sudo-guard-mode.d.ts.map

package/dist/launchd/sudo-guard-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo-guard-mode.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-guard-mode.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,WAAW,YAAa,YAAY,KAAG,MAAM,GAAG,SAY5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,OACtE,MAAM,UACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,GAAG,SASZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SACvB,UAAU,QACV,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,UAAU,KAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5F,CAAC"}

package/dist/launchd/sudo-guard.d.ts

@@ -21,6 +21,7 @@
  *   in that window.
  */
 import type { HostRunner, WriteOptions } from './runner.ts';
+export { assertReadableBack, canRead, modeProblem, operatorGroups } from './sudo-guard-mode.ts';
 /** The directories strictly between `prefix` and the file at `path`. */
 export declare const betweenDirs: (prefix: string, path: string) => string[];
 /** The directories strictly above `prefix`: `/`, then each one down to the prefix's parent. */
@@ -36,48 +37,10 @@ export type Expect = 'file' | 'file-or-absent';
  * prefix and `path`, and anything but a file at it.
  */
 export declare const assertPlainPath: (base: HostRunner, prefix: string, path: string, expect: Expect) => Promise<'file' | 'absent'>;
-/**
- * ⛔ A ROOT-OWNED FILE UNDER A PREFIX IS ROOT'S TO CHANGE, AND ONLY ROOT'S (decided 2026-09-21).
- *   Group- or world-writable, anyone in that class rewrites a file root installed — a daemon's
- *   config, a script a LaunchDaemon runs as root — which is root by another name. Setuid or setgid,
- *   it runs as root (or its group) for whoever executes it. install(1) would apply either, as root.
- * ★ Root-owned is an omitted owner (the runner installs as root under a prefix) or uid 0. A file
- *   handed to another user is that user's to change; the sticky bit changes nothing on a file.
- */
-export declare const modeProblem: (options: WriteOptions) => string | undefined;
 /**
  * Every check a write under `prefix` meets before anything is staged or run as root: the mode, the
  * path (assertPlainPath) and the read-back (assertReadableBack). ★ Reads only, as the deploying
  *   user — so sudoRunner's `checkWrite` runs it at PLAN time too, and a plan still never calls sudo.
  */
 export declare const assertInstallable: (base: HostRunner, prefix: string, path: string, options: WriteOptions, groups: readonly number[] | undefined) => Promise<void>;
-/**
- * POSIX read permission for one uid: owner class, else group class, else other. `undefined` when
- * only group membership could decide and the groups are unknown.
- * ⚠️ EXACTLY ONE CLASS APPLIES. A group member gets the group bits even when the other bits are
- *   wider (`0604` hides a file from its group), so "other can read" is not enough on its own.
- */
-export declare const canRead: (file: {
-    readonly uid: number;
-    readonly gid: number;
-    readonly mode: number;
-}, uid: number, groups: readonly number[] | undefined) => boolean | undefined;
-/**
- * ⛔ REFUSE A FILE THE DEPLOYING USER COULD NOT READ BACK, before writing it. Both providers read
- *   every write back to verify it (host-file-lifecycle.ts, job-lifecycle.ts) and read it again at
- *   every plan, as the deploying user; this runner elevates writes, never reads. A root-only
- *   `0600` would be installed, then fail the read-back with EACCES and stay on disk with no state,
- *   so every later plan would fail too.
- * ★ An omitted owner is root (under a prefix the runner writes as root). An omitted group is the
- *   parent directory's, which is the group a new file gets on macOS.
- * ⚠️ Unknown groups never refuse: the read-back after the write stays the final judge.
- */
-export declare const assertReadableBack: (base: HostRunner, path: string, options: WriteOptions, groups: readonly number[] | undefined) => Promise<void>;
-/**
- * The deploying user's groups, from `id -G`; `undefined` when that fails.
- * ⚠️ NOT process.getgroups(). MEASURED 2026-09-21 on macOS 27.2: getgroups() returned 16 groups
- *   where `id -G` returned 18, because macOS caps a process's own list at 16. A group past the
- *   16th would read as "not a member" and refuse a file the user can in fact read.
- */
-export declare const operatorGroups: (base: HostRunner) => Promise<readonly number[] | undefined>;
 //# sourceMappingURL=sudo-guard.d.ts.map

package/dist/launchd/sudo-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sudo-guard.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAOtE,wEAAwE;AACxE,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,EAMhE,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,MAAM,EAGhD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAuB/C;;;GAGG;AACH,eAAO,MAAM,eAAe,SACpB,UAAU,UACR,MAAM,QACR,MAAM,UACJ,MAAM,KACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CA6C3B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YAAa,YAAY,KAAG,MAAM,GAAG,SAO5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SACtB,UAAU,UACR,MAAM,QACR,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,OACtE,MAAM,UACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,GAAG,SASZ,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,SACvB,UAAU,QACV,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,UAAU,KAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5F,CAAC"}
+{"version":3,"file":"sudo-guard.d.ts","sourceRoot":"","sources":["../../src/launchd/sudo-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAY,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKtE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKhG,wEAAwE;AACxE,eAAO,MAAM,WAAW,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,EAMhE,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,MAAM,EAGhD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAuB/C;;;GAGG;AACH,eAAO,MAAM,eAAe,SACpB,UAAU,UACR,MAAM,QACR,MAAM,UACJ,MAAM,KACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CA6C3B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SACtB,UAAU,UACR,MAAM,QACR,MAAM,WACH,YAAY,UACb,SAAS,MAAM,EAAE,GAAG,SAAS,KACpC,OAAO,CAAC,IAAI,CAWd,CAAC"}

package/dist/linux/fake-sudo-root.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The "as root" half of fake-sudo.ts: what each allowlisted program does against the SAME
+ * in-memory host `fake-linux-host.ts` builds, once `/usr/bin/sudo` has decided to run it.
+ *
+ * ⛔ TEST-ONLY, like fake-linux-host.ts: no provider imports it, it is not on the barrel.
+ * ★ CHOWN AND MKDIR ARE HANDLED HERE, NOT BY DELEGATING TO `fake.runner.exec()` — the fake's own
+ *   `chown` refuses when its FIXED `root` flag is false (which it is: the base host models an
+ *   unprivileged operator), and `mkdir`/`chmod`/`rmdir` do not check ownership at all. Only a
+ *   handler that writes `fake.dirs` / `fake.modes` / `fake.files` directly proves the runner's
+ *   OWN allowlist and guard are what gate root, not a permission check the fake happens to have.
+ * ★ INSTALL AND MV READ AND WRITE `fake.files` DIRECTLY TOO, because the staged file the operator
+ *   wrote (via `stageRemote`'s ordinary `writeFileAtomic`) already lives there — there is no
+ *   separate "staged bytes" side-channel to model, unlike the Mac fake's local temp files.
+ */
+import type { ExecResult } from '../launchd/runner.ts';
+import type { fakeLinuxHost } from './fake-linux-host.ts';
+type Fake = ReturnType<typeof fakeLinuxHost>;
+/** What a test can force `sudo`'s next `mv` / `rm` to answer instead of actually running it. */
+export type RootState = {
+    mvFailure?: ExecResult;
+    rmFailure?: ExecResult;
+};
+/** Everything `/usr/bin/sudo -n --` may run, dispatched as root against the same fake host. */
+export declare const asRoot: (fake: Fake, argv: readonly string[], state?: RootState) => Promise<ExecResult>;
+export {};
+//# sourceMappingURL=fake-sudo-root.d.ts.map

package/dist/linux/fake-sudo-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-sudo-root.d.ts","sourceRoot":"","sources":["../../src/linux/fake-sudo-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,KAAK,IAAI,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AAE7C,gGAAgG;AAChG,MAAM,MAAM,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,UAAU,CAAC;IAAC,SAAS,CAAC,EAAE,UAAU,CAAA;CAAE,CAAC;AAyH3E,+FAA+F;AAC/F,eAAO,MAAM,MAAM,SACX,IAAI,QACJ,SAAS,MAAM,EAAE,UAChB,SAAS,KACf,OAAO,CAAC,UAAU,CASpB,CAAC"}

package/dist/linux/fake-sudo.d.ts

@@ -0,0 +1,56 @@
+/**
+ * sshSudoRunner over fake-linux-host.ts, for the tests beside it: the operator is uid 1000 and
+ * unprivileged, and `/usr/bin/sudo` is a tiny interpreter (fake-sudo-root.ts) that runs the
+ * allowlisted programs against the SAME in-memory host, as root. No test anywhere runs ssh or a
+ * real sudo.
+ *
+ * ⛔ TEST-ONLY, like fake-linux-host.ts: no provider imports it, it is not on the barrel.
+ * ★ `ls -ldn` AND `mktemp -d` ARE MODELLED HERE, AS THE OPERATOR — sudo-guard.ts's chain read and
+ *   sudo-stage.ts's staging both run unprivileged, so both need a host that answers them without
+ *   sudo. `ls` reads through `fake.runner.stat()` (already correct for declared dirs, their
+ *   implied root-owned ancestors, and files) and formats one `ls -ldn`-shaped line per path;
+ *   `mktemp -d` registers a fresh 0700 directory the operator owns.
+ * ★ SUDO REFUSES A CALL THAT WAS NOT LOGGED FIRST, so every test holds the runner to "logged
+ *   before it runs", exactly as the Mac fake does.
+ */
+import type { FileStat, HostRunner } from '../launchd/runner.ts';
+import { SUDO_SAYS } from '../launchd/fake-sudo.ts';
+import { type RootState } from './fake-sudo-root.ts';
+export { SUDO_SAYS } from '../launchd/fake-sudo.ts';
+export declare const OPERATOR = 1000;
+export declare const PREFIXES: string[];
+/**
+ * `extraDirs` adds more directories to the fake filesystem (a pre-existing tree outside every
+ * prefix, say); it never changes the runner's OWN prefixes, which stay `PREFIXES` throughout.
+ * `acl` is the set of directory paths a test wants to carry the `+` (POSIX ACL) flag.
+ */
+export declare const fakeSudoHost: (extraDirs?: Record<string, number>, acl?: ReadonlySet<string>) => {
+    base: HostRunner;
+    fake: {
+        calls: string[][];
+        dirs: Map<string, number>;
+        expectUnit: (path: string) => void;
+        files: Map<string, {
+            bytes: Uint8Array;
+            mode: number;
+            uid: number;
+            gid: number;
+            kind: FileStat['kind'];
+        }>;
+        modes: Map<string, {
+            mode: number;
+            uid: number;
+            gid: number;
+        }>;
+        placeUnit: (path: string, text: string, state?: Partial<import("./fake-systemd.ts").UnitState>) => void;
+        runner: HostRunner;
+        units: Map<string, import("./fake-systemd.ts").UnitState>;
+    };
+    logs: string[];
+    privileged: () => string[][];
+    runner: HostRunner;
+    state: RootState & {
+        sudo: 'ok' | keyof typeof SUDO_SAYS;
+    };
+};
+//# sourceMappingURL=fake-sudo.d.ts.map

package/dist/linux/fake-sudo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-sudo.d.ts","sourceRoot":"","sources":["../../src/linux/fake-sudo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAc,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,qBAAqB,CAAC;AAK7D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,QAAQ,UAA4C,CAAC;AAyBlE;;;;GAIG;AACH,eAAO,MAAM,YAAY,eACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAC5B,WAAW,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;cAUS,IAAI,GAAG,MAAM,OAAO,SAAS;;CAyE/D,CAAC"}

package/dist/linux/index.d.ts

@@ -19,6 +19,8 @@ export type { RemoteFileAttributes, RemoteFileProps } from './remote-file-form.t
 export { RemoteFile, RemoteFileProvider } from './remote-file.ts';
 export type { SshRunnerOptions } from './ssh-runner.ts';
 export { sshRunner } from './ssh-runner.ts';
+export type { SshSudoRunnerOptions } from './sudo-runner.ts';
+export { sshSudoRunner } from './sudo-runner.ts';
 export type { ExecResult, FileStat, HostRunner, HostUser, WriteOptions, } from '../launchd/runner.ts';
 export { HostRunnerService, canActAsRoot, hostRunnerLayer } from '../launchd/runner.ts';
 export type { SystemdUnitAttributes, SystemdUnitProps, UnitSection } from './unit-form.ts';

package/dist/linux/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/linux/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EACV,UAAU,EACV,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,YAAY,GACb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACxF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/linux/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EACV,UAAU,EACV,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,YAAY,GACb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACxF,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC"}