@openclaw/fs-safe 0.12.0 → 0.13.0

package/dist/temp-workspace-descriptor.js

@@ -0,0 +1,363 @@
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import { nodeDirectorySearchOnlyFlags } from "./directory-mode-node.js";
+import { assertOwnedDirectory } from "./directory-mode-owner.js";
+import { FsSafeError } from "./errors.js";
+import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { assertTempWorkspaceChildState, childHasRequestedMode, validateAdmittedTempWorkspaceChild, } from "./temp-workspace-child-admission.js";
+import { inspectTempWorkspaceDescriptorIdentitySync, inspectTempWorkspaceDirectoryIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-identity.js";
+function assertRetainedChildDirectory(stat) {
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new FsSafeError("not-file", "temp workspace child must be a real directory");
+    }
+}
+function closeAfterAdmissionFailure(fd, error, message) {
+    try {
+        fsSync.closeSync(fd);
+    }
+    catch (closeError) {
+        throw new AggregateError([error, closeError], message);
+    }
+    throw error;
+}
+function openReadableDirectory(pathname) {
+    assertNoWindowsPathAlias(pathname, "filesystem");
+    const operationPath = pathForWindowsFilesystem(pathname);
+    const flags = fsSync.constants.O_DIRECTORY | fsSync.constants.O_NOFOLLOW |
+        fsSync.constants.O_NONBLOCK;
+    return fsSync.openSync(operationPath, fsSync.constants.O_RDONLY | flags);
+}
+function openRetainedDirectory(pathname) {
+    try {
+        return { fd: openReadableDirectory(pathname), access: "read", proc: false };
+    }
+    catch (error) {
+        if (error.code !== "EACCES")
+            throw error;
+        const route = nodeDirectorySearchOnlyFlags();
+        if (!route)
+            throw error;
+        const flags = fsSync.constants.O_DIRECTORY | fsSync.constants.O_NOFOLLOW |
+            fsSync.constants.O_NONBLOCK;
+        return {
+            fd: fsSync.openSync(pathname, route.flags | flags),
+            access: "search",
+            proc: route.proc,
+        };
+    }
+}
+function chmodDescriptor(fd, mode) {
+    return new Promise((resolve, reject) => {
+        fsSync.fchmod(fd, mode, (error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
+export function openTempWorkspaceCleanupParent(root, admission) {
+    assertNoWindowsPathAlias(root, "filesystem");
+    const admittedRoot = admission.dir;
+    assertNoWindowsPathAlias(admittedRoot, "filesystem");
+    const pathname = resolvePathPreservingWindowsRoot(root);
+    assertNoWindowsPathAlias(pathname, "filesystem");
+    if (pathname !== resolvePathPreservingWindowsRoot(admittedRoot)) {
+        throw new FsSafeError("path-mismatch", "temp workspace cleanup parent differs from admitted root");
+    }
+    const opened = openRetainedDirectory(pathname);
+    const { fd } = opened;
+    try {
+        // Existing canonical roots deliberately retain this descriptor
+        // provisionally. Its exact association is completed at the native probe
+        // (when present) and again with the full pre-mutation ancestry admission.
+        // Guarded alias/missing-component routes retain their historical eager
+        // association through the admission implementation.
+        admission.retainCleanupParent(fd);
+        return {
+            fd,
+            access: opened.access,
+            receipt: Object.freeze({
+                path: pathname,
+                realPath: admission.realPath,
+                identity: admission.identity,
+            }),
+        };
+    }
+    catch (error) {
+        closeAfterAdmissionFailure(fd, error, "temp workspace cleanup parent admission and close failed");
+    }
+}
+/** Owns the child descriptor until final admission transfers it to cleanup. */
+export class TempWorkspaceRetainedChild {
+    #dir;
+    #identity;
+    #numericIdentity;
+    #access;
+    #fd;
+    #modeLease = false;
+    #proc;
+    #transferAuthorized = false;
+    #initialReceipt;
+    constructor(dir, identity, descriptor, initialReceipt) {
+        if (typeof identity.dev !== "bigint" || typeof identity.ino !== "bigint") {
+            throw new FsSafeError("path-mismatch", "temp workspace child identity is incomplete");
+        }
+        this.#dir = dir;
+        this.#identity = Object.freeze({ dev: identity.dev, ino: identity.ino });
+        this.#numericIdentity = TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY
+            ? projectTempWorkspaceNumericIdentity(this.#identity)
+            : undefined;
+        this.#access = descriptor.access;
+        this.#proc = descriptor.proc;
+        // Opening without following the final component pins the child, but does
+        // not admit it. Until final descriptor + name validation succeeds this
+        // handle may only be inspected, mode-validated, replaced, or closed.
+        this.#fd = descriptor.fd;
+        this.#initialReceipt = initialReceipt;
+    }
+    static retain(dir, identity) {
+        if (typeof identity.dev !== "bigint" || typeof identity.ino !== "bigint") {
+            throw new FsSafeError("path-mismatch", "temp workspace child identity is incomplete");
+        }
+        const descriptor = openRetainedDirectory(dir);
+        try {
+            return new TempWorkspaceRetainedChild(dir, identity, descriptor);
+        }
+        catch (error) {
+            closeAfterAdmissionFailure(descriptor.fd, error, "temp workspace child admission and close failed");
+        }
+    }
+    static retainCreated(dir) {
+        const descriptor = openRetainedDirectory(dir);
+        try {
+            // Only this immediate post-create route installs a receipt. Freezing the
+            // exact fd result keeps its identity and complete mode immutable while
+            // the synchronous caller validates it and decides whether to correct.
+            const stat = fsSync.fstatSync(descriptor.fd, { bigint: true });
+            Object.freeze(stat);
+            const receipt = Object.freeze({ stat });
+            return {
+                retained: new TempWorkspaceRetainedChild(dir, stat, descriptor, receipt),
+                stat,
+            };
+        }
+        catch (error) {
+            closeAfterAdmissionFailure(descriptor.fd, error, "temp workspace created child admission and close failed");
+        }
+    }
+    discardInitialReceipt() {
+        this.#initialReceipt = undefined;
+    }
+    #consumeInitialReceipt() {
+        const receipt = this.#initialReceipt;
+        // Clear first so validation failures, procfs checks, and later admission
+        // can never reuse the creation observation.
+        this.#initialReceipt = undefined;
+        return receipt?.stat;
+    }
+    finalizeAdmission(ownerUid, mode) {
+        this.#assertModeLeaseReleased();
+        this.discardInitialReceipt();
+        if (this.#fd === undefined) {
+            throw new FsSafeError("path-mismatch", "temp workspace child descriptor is unavailable");
+        }
+        // A failed revalidation must never leave an earlier receipt transferable.
+        this.#transferAuthorized = false;
+        const current = inspectTempWorkspaceDescriptorIdentitySync(this.#fd, this.#identity, this.#numericIdentity);
+        validateAdmittedTempWorkspaceChild(current, ownerUid, mode);
+        const named = inspectTempWorkspaceDirectoryIdentitySync(this.#dir, this.#identity, this.#numericIdentity);
+        validateAdmittedTempWorkspaceChild(named, ownerUid, mode);
+        this.#transferAuthorized = true;
+        return named;
+    }
+    #assertModeLeaseReleased() {
+        if (this.#modeLease) {
+            throw new FsSafeError("path-mismatch", "temp workspace child mode operation is active");
+        }
+    }
+    #inspectModeTarget(fd, ownerUid, initial) {
+        const descriptor = initial ?? inspectTempWorkspaceDescriptorIdentitySync(fd, this.#identity, this.#numericIdentity);
+        assertTempWorkspaceChildState(descriptor, ownerUid);
+        const named = inspectTempWorkspaceDirectoryIdentitySync(this.#dir, this.#identity, this.#numericIdentity);
+        assertTempWorkspaceChildState(named, ownerUid);
+        return descriptor;
+    }
+    async #assertProcAuthority(fd, ownerUid) {
+        if ((await fs.statfs("/proc/self/fd", { bigint: true })).type !== 0x9fa0n) {
+            throw new FsSafeError("path-mismatch", "directory mode requires a trusted procfs fd namespace");
+        }
+        const procPath = `/proc/self/fd/${fd}`;
+        const opened = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), this.#identity);
+        const followed = inspectFileIdentitySync(() => fsSync.statSync(procPath, { bigint: true }), this.#identity);
+        assertOwnedDirectory(opened, followed);
+        assertTempWorkspaceChildState(opened, ownerUid);
+        assertTempWorkspaceChildState(followed, ownerUid);
+    }
+    #assertProcAuthoritySync(fd, ownerUid) {
+        if (fsSync.statfsSync("/proc/self/fd", { bigint: true }).type !== 0x9fa0n) {
+            throw new FsSafeError("path-mismatch", "directory mode requires a trusted procfs fd namespace");
+        }
+        const procPath = `/proc/self/fd/${fd}`;
+        const opened = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), this.#identity);
+        const followed = inspectFileIdentitySync(() => fsSync.statSync(procPath, { bigint: true }), this.#identity);
+        assertOwnedDirectory(opened, followed);
+        assertTempWorkspaceChildState(opened, ownerUid);
+        assertTempWorkspaceChildState(followed, ownerUid);
+    }
+    async initializeMode(mode, ownerUid, assertParent) {
+        this.#assertModeLeaseReleased();
+        this.discardInitialReceipt();
+        if (this.#fd === undefined) {
+            throw new FsSafeError("path-mismatch", "temp workspace child descriptor is unavailable");
+        }
+        const fd = this.#fd;
+        this.#transferAuthorized = false;
+        this.#modeLease = true;
+        try {
+            assertParent();
+            let current = this.#inspectModeTarget(fd, ownerUid);
+            assertParent();
+            if (childHasRequestedMode(current, mode))
+                return;
+            if (this.#proc) {
+                await this.#assertProcAuthority(fd, ownerUid);
+                // statfs is awaited. Rebind both names and the retained descriptor
+                // after that turn before dispatching the procfs descriptor chmod.
+                assertParent();
+                current = this.#inspectModeTarget(fd, ownerUid);
+                assertParent();
+                if (childHasRequestedMode(current, mode))
+                    return;
+                await fs.chmod(`/proc/self/fd/${fd}`, mode & 0o7777);
+                await this.#assertProcAuthority(fd, ownerUid);
+            }
+            else {
+                await chmodDescriptor(fd, mode & 0o7777);
+            }
+        }
+        finally {
+            // The lease outlives every queued fd operation, including failures, so
+            // transfer or factory cleanup can never close a still-active descriptor.
+            this.#modeLease = false;
+        }
+    }
+    initializeModeSync(mode, ownerUid, assertParent) {
+        this.#assertModeLeaseReleased();
+        if (this.#fd === undefined) {
+            throw new FsSafeError("path-mismatch", "temp workspace child descriptor is unavailable");
+        }
+        const fd = this.#fd;
+        this.#transferAuthorized = false;
+        this.#modeLease = true;
+        try {
+            const current = this.#inspectModeTarget(fd, ownerUid, this.#consumeInitialReceipt());
+            assertParent();
+            if (childHasRequestedMode(current, mode))
+                return;
+            if (this.#proc) {
+                this.#assertProcAuthoritySync(fd, ownerUid);
+                fsSync.chmodSync(`/proc/self/fd/${fd}`, mode & 0o7777);
+                this.#assertProcAuthoritySync(fd, ownerUid);
+            }
+            else {
+                fsSync.fchmodSync(fd, mode & 0o7777);
+            }
+        }
+        finally {
+            this.#modeLease = false;
+        }
+    }
+    get canEnumerate() {
+        return this.#access === "read";
+    }
+    ensureReadable() {
+        this.#assertModeLeaseReleased();
+        this.discardInitialReceipt();
+        if (this.canEnumerate)
+            return true;
+        if (this.#fd === undefined) {
+            throw new FsSafeError("path-mismatch", "temp workspace child descriptor is unavailable");
+        }
+        // Opening or validating a replacement crosses a new pathname boundary.
+        // Even failure must revoke any earlier final-admission receipt.
+        this.#transferAuthorized = false;
+        let fd;
+        try {
+            fd = openReadableDirectory(this.#dir);
+        }
+        catch (error) {
+            if (error.code === "EACCES")
+                return false;
+            throw error;
+        }
+        try {
+            const openedStat = inspectTempWorkspaceDescriptorIdentitySync(fd, this.#identity, this.#numericIdentity);
+            assertRetainedChildDirectory(openedStat);
+        }
+        catch (error) {
+            closeAfterAdmissionFailure(fd, error, "temp workspace readable child admission and close failed");
+        }
+        // A failed close leaves descriptor ownership indeterminate. Relinquish the
+        // old descriptor before closing it so factory cleanup never retries that fd.
+        const previous = this.#fd;
+        this.#fd = undefined;
+        try {
+            fsSync.closeSync(previous);
+        }
+        catch (error) {
+            // The readable replacement has not been installed. Give it exactly one
+            // close attempt and leave neither indeterminate descriptor owned here.
+            try {
+                fsSync.closeSync(fd);
+            }
+            catch (closeError) {
+                throw new AggregateError([error, closeError], "temp workspace child descriptor replacement close failed");
+            }
+            throw error;
+        }
+        this.#fd = fd;
+        this.#access = "read";
+        this.#proc = false;
+        return true;
+    }
+    transfer(retainDescriptor) {
+        this.#assertModeLeaseReleased();
+        this.discardInitialReceipt();
+        if (this.#fd === undefined) {
+            throw new FsSafeError("path-mismatch", "temp workspace child descriptor is unavailable");
+        }
+        if (!this.#transferAuthorized) {
+            throw new FsSafeError("path-mismatch", "temp workspace child has not completed final admission");
+        }
+        const fd = this.#fd;
+        this.#fd = undefined;
+        if (retainDescriptor && !this.canEnumerate) {
+            try {
+                fsSync.closeSync(fd);
+            }
+            catch (closeError) {
+                throw new AggregateError([
+                    new FsSafeError("helper-unavailable", "temp workspace cleanup requires a readable child descriptor"),
+                    closeError,
+                ], "temp workspace child descriptor rejection and close failed");
+            }
+            throw new FsSafeError("helper-unavailable", "temp workspace cleanup requires a readable child descriptor");
+        }
+        if (!retainDescriptor) {
+            fsSync.closeSync(fd);
+            return { dir: this.#dir, identity: this.#identity, directory: undefined };
+        }
+        return { dir: this.#dir, identity: this.#identity, directory: { fd } };
+    }
+    close() {
+        this.#assertModeLeaseReleased();
+        this.discardInitialReceipt();
+        if (this.#fd === undefined)
+            return;
+        const fd = this.#fd;
+        this.#fd = undefined;
+        fsSync.closeSync(fd);
+    }
+}

package/dist/temp-workspace-identity.d.ts

@@ -0,0 +1,15 @@
+import { type BigIntStats, type Stats } from "node:fs";
+export type TempWorkspaceIdentity = Readonly<{
+    dev: bigint;
+    ino: bigint;
+}>;
+export type TempWorkspaceNumericIdentity = Readonly<{
+    dev: number;
+    ino: number;
+}>;
+export type TempWorkspaceIdentityStat = BigIntStats | Stats;
+export declare const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY: boolean;
+export declare function projectTempWorkspaceNumericIdentity(identity: TempWorkspaceIdentity): TempWorkspaceNumericIdentity | undefined;
+export declare function inspectTempWorkspaceDescriptorIdentitySync(fd: number, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
+export declare function inspectTempWorkspaceDirectoryIdentitySync(dir: string, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
+//# sourceMappingURL=temp-workspace-identity.d.ts.map

package/dist/temp-workspace-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-workspace-identity.d.ts","sourceRoot":"","sources":["../src/temp-workspace-identity.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAM/D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC3E,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,WAAW,GAAG,KAAK,CAAC;AAE5D,eAAO,MAAM,sCAAsC,SACY,CAAC;AAEhE,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,qBAAqB,GAC9B,4BAA4B,GAAG,SAAS,CAU1C;AAqBD,wBAAgB,0CAA0C,CACxD,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,4BAA4B,GAAG,SAAS,GAChD,yBAAyB,CAO3B;AAED,wBAAgB,yCAAyC,CACvD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,4BAA4B,GAAG,SAAS,GAChD,yBAAyB,CAQ3B"}

package/dist/temp-workspace-identity.js

@@ -0,0 +1,41 @@
+import fsSync, {} from "node:fs";
+import { observeDirectoryIdentitySync } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { recordFileObservationFailure } from "./file-observation.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+export const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY = process.platform === "linux" || process.platform === "darwin";
+export function projectTempWorkspaceNumericIdentity(identity) {
+    const dev = Number(identity.dev);
+    const ino = Number(identity.ino);
+    if (!Number.isSafeInteger(dev) || dev < 0 || BigInt(dev) !== identity.dev ||
+        !Number.isSafeInteger(ino) || ino < 0 || BigInt(ino) !== identity.ino) {
+        return undefined;
+    }
+    return Object.freeze({ dev, ino });
+}
+function identityMismatch() {
+    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
+    recordFileObservationFailure(error, "identity");
+    throw error;
+}
+function inspectNumericIdentity(current, expected) {
+    if (!Number.isSafeInteger(current.dev) || current.dev < 0 || current.dev !== expected.dev ||
+        !Number.isSafeInteger(current.ino) || current.ino < 0 || current.ino !== expected.ino) {
+        identityMismatch();
+    }
+    return current;
+}
+export function inspectTempWorkspaceDescriptorIdentitySync(fd, expected, numeric) {
+    // A malformed or mismatched numeric observation is definite and never
+    // retried. Unsafe receipts and other platforms retain exact replay.
+    if (TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY && numeric) {
+        return inspectNumericIdentity(fsSync.fstatSync(fd), numeric);
+    }
+    return inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), expected);
+}
+export function inspectTempWorkspaceDirectoryIdentitySync(dir, expected, numeric) {
+    if (TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY && numeric) {
+        return inspectNumericIdentity(observeDirectoryIdentitySync(dir), numeric);
+    }
+    return inspectFileIdentitySync(() => observeDirectoryIdentitySync(dir, { bigint: true }), expected);
+}

package/dist/temp-workspace-owner.d.ts

@@ -1,23 +1,24 @@
-import { type FileIdentityStat } from "./file-identity.js";
 import { type NativeBinding } from "./native.js";
-import { openStagedDirectory } from "./staged-directory.js";
+import type { TempWorkspaceRootAdmission } from "./temp-workspace-admission.js";
+import { TempWorkspaceRetainedChild, type RetainedDirectory } from "./temp-workspace-descriptor.js";
 export type TempWorkspaceCleanupResult = "removed" | "missing" | "identity-mismatch" | "indeterminate";
 export type TempWorkspaceCleanupSafety = "compatible" | "require-bounded";
-type RetainedDirectory = ReturnType<typeof openStagedDirectory>;
 export declare class TempWorkspaceCleanupCapability {
     #private;
     readonly binding: NativeBinding | undefined;
     readonly parent: RetainedDirectory | undefined;
-    constructor(root: string, safety: TempWorkspaceCleanupSafety);
+    constructor(root: string, safety: TempWorkspaceCleanupSafety, admission: TempWorkspaceRootAdmission, dirMode: number);
     get canRemoveOwnedTree(): boolean;
+    prepareChildCreation(): void;
+    admitChildDescriptor(canEnumerate: boolean): boolean;
     assertCurrent(): void;
+    assertAncestryCurrent(): void;
     close(): void;
 }
 export declare class TempWorkspaceCleanupOwner {
     #private;
-    constructor(dir: string, identity: FileIdentityStat, capability: TempWorkspaceCleanupCapability);
+    constructor(retained: TempWorkspaceRetainedChild, capability: TempWorkspaceCleanupCapability, retainDescriptor: boolean);
     cleanup(): Promise<TempWorkspaceCleanupResult>;
     cleanupSync(): TempWorkspaceCleanupResult;
 }
-export {};
 //# sourceMappingURL=temp-workspace-owner.d.ts.map

package/dist/temp-workspace-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"temp-workspace-owner.d.ts","sourceRoot":"","sources":["../src/temp-workspace-owner.ts"],"names":[],"mappings":"AAMA,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAgC,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG1F,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,SAAS,GAAG,mBAAmB,GAAG,eAAe,CAAC;AACvG,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAE1E,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAoBhE,qBAAa,8BAA8B;;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAI/C,YAAY,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAiC3D;IAED,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,aAAa,IAAI,IAAI,CASpB;IAED,KAAK,IAAI,IAAI,CAIZ;CACF;AAED,qBAAa,yBAAyB;;IAWpC,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,8BAA8B,EAe9F;IAuLD,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAM7C;IAED,WAAW,IAAI,0BAA0B,CAexC;CACF"}
+{"version":3,"file":"temp-workspace-owner.d.ts","sourceRoot":"","sources":["../src/temp-workspace-owner.ts"],"names":[],"mappings":"AAOA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAEL,0BAA0B,EAE1B,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AAGxC,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,SAAS,GAAG,mBAAmB,GAAG,eAAe,CAAC;AACvG,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAsB1E,qBAAa,8BAA8B;;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAM/C,YACE,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,0BAA0B,EAClC,SAAS,EAAE,0BAA0B,EACrC,OAAO,EAAE,MAAM,EAuEhB;IAED,IAAI,kBAAkB,IAAI,OAAO,CAGhC;IAED,oBAAoB,IAAI,IAAI,CAiB3B;IAUD,oBAAoB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAenD;IAED,aAAa,IAAI,IAAI,CAEpB;IAED,qBAAqB,IAAI,IAAI,CAE5B;IAED,KAAK,IAAI,IAAI,CAIZ;CACF;AAED,qBAAa,yBAAyB;;IAWpC,YACE,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,8BAA8B,EAC1C,gBAAgB,EAAE,OAAO,EAO1B;IAkLD,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAM7C;IAED,WAAW,IAAI,0BAA0B,CAexC;CACF"}