@openclaw/openshell-sandbox 2026.9.2 → 2026.9.3

package/node_modules/@openclaw/fs-safe/dist/publish-file.js

@@ -0,0 +1,366 @@
+import { createHash } from "node:crypto";
+import fsSync, {} from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { pinDirectory, } from "./directory-durability.js";
+import { FsSafeError } from "./errors.js";
+import { hashFileHandle } from "./file-hash.js";
+import { sameFileIdentity, sameFileIdentityForCleanup, } from "./file-identity.js";
+import { syncFileBestEffortSync } from "./file-sync.js";
+import { getNativeBinding, requireNativeBinding } from "./native.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { directorySyncFailure, publicationFailure, rememberCreatedTarget, } from "./publish-file-failure.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+const HARDLINK_FALLBACK_CODES = new Set([
+    "EPERM",
+    "EXDEV",
+    "ENOTSUP",
+    "EOPNOTSUPP",
+    "ENOSYS",
+]);
+const NATIVE_COPY_FALLBACK_CODES = new Set([
+    "EINVAL",
+    "ENOSYS",
+    "ENOTSUP",
+    "EOPNOTSUPP",
+    "EPERM",
+    "EXDEV",
+]);
+export function isHardlinkFallbackError(error) {
+    return HARDLINK_FALLBACK_CODES.has(error?.code ?? "");
+}
+function sourceOpenFlags() {
+    return resolveReadOpenFlags();
+}
+function directoryOpenFlags() {
+    return (fsSync.constants.O_RDONLY |
+        (typeof fsSync.constants.O_DIRECTORY === "number" ? fsSync.constants.O_DIRECTORY : 0));
+}
+async function openNativeParent(filePath) {
+    const parentPath = path.dirname(filePath);
+    const handle = await fs.open(parentPath, directoryOpenFlags());
+    try {
+        const pathname = await fs.lstat(parentPath, { bigint: true });
+        const opened = await handle.stat({ bigint: true });
+        if (pathname.isSymbolicLink() || !sameFileIdentity(pathname, opened)) {
+            throw new FsSafeError("path-mismatch", "publication parent changed while opening");
+        }
+        return { basename: path.basename(filePath), handle };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function assertPinnedSourceCurrent(params) {
+    // Windows file indexes can exceed Number.MAX_SAFE_INTEGER, so publication
+    // fences must compare bigint stats instead of rounded numeric identities.
+    const opened = await params.handle.stat({ bigint: true });
+    const current = await fs.lstat(params.sourcePath, { bigint: true });
+    if (!opened.isFile() ||
+        current.isSymbolicLink() ||
+        !current.isFile() ||
+        !sameFileIdentity(opened, params.identity) ||
+        !sameFileIdentity(current, opened)) {
+        throw new FsSafeError("path-mismatch", "publication source changed during operation");
+    }
+}
+async function copyPinnedSource(params) {
+    if (params.native && params.targetNativeParent) {
+        for (const method of ["clone", "copy-file-range"]) {
+            let nativeFd;
+            try {
+                if (method === "clone") {
+                    nativeFd = params.native.cloneFileExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
+                }
+                else {
+                    const copied = await params.native.copyFileRangeExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
+                    if (copied.errorCode) {
+                        throw Object.assign(new Error(copied.errorMessage ?? "native copy failed"), {
+                            code: copied.errorCode,
+                        });
+                    }
+                    nativeFd = copied.fd;
+                }
+            }
+            catch (error) {
+                if (NATIVE_COPY_FALLBACK_CODES.has(error.code ?? "")) {
+                    continue;
+                }
+                throw error;
+            }
+            let target;
+            let createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
+            rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
+            try {
+                fsSync.fchmodSync(nativeFd, 0o600);
+                createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
+                await getFsSafeTestHooks()?.afterPublishTargetCreated?.("exclusive-copy", params.targetPath, createdIdentity);
+                const identity = await fs.lstat(params.targetPath, { bigint: true });
+                target = await fs.open(params.targetPath, sourceOpenFlags());
+                const opened = await target.stat({ bigint: true });
+                if (identity.isSymbolicLink() ||
+                    !identity.isFile() ||
+                    !sameFileIdentity(createdIdentity, identity) ||
+                    !sameFileIdentity(createdIdentity, opened)) {
+                    throw new FsSafeError("path-mismatch", "native publication target changed after copy");
+                }
+                const hashed = await hashFileHandle(target, params.native);
+                fsSync.closeSync(nativeFd);
+                nativeFd = undefined;
+                return {
+                    handle: target,
+                    exactIdentity: opened,
+                    digest: hashed.digest,
+                    bytes: hashed.bytes,
+                };
+            }
+            catch (error) {
+                await target?.close().catch(() => undefined);
+                throw error;
+            }
+            finally {
+                if (nativeFd !== undefined)
+                    fsSync.closeSync(nativeFd);
+            }
+        }
+    }
+    const target = await fs.open(params.targetPath, "wx+", 0o600);
+    const createdIdentity = await target.stat({ bigint: true });
+    rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
+    try {
+        await target.chmod(0o600);
+        const exactIdentity = await target.stat({ bigint: true });
+        await getFsSafeTestHooks()?.afterPublishTargetCreated?.("exclusive-copy", params.targetPath, exactIdentity);
+        const hash = createHash("sha256");
+        const buffer = Buffer.allocUnsafe(64 * 1024);
+        let position = 0;
+        while (true) {
+            const { bytesRead } = await params.source.read(buffer, 0, buffer.length, position);
+            if (bytesRead === 0) {
+                break;
+            }
+            hash.update(buffer.subarray(0, bytesRead));
+            let written = 0;
+            while (written < bytesRead) {
+                const result = await target.write(buffer, written, bytesRead - written, position + written);
+                if (result.bytesWritten <= 0) {
+                    throw new FsSafeError("helper-failed", "exclusive publication copy made no progress");
+                }
+                written += result.bytesWritten;
+            }
+            position += bytesRead;
+        }
+        await target.sync();
+        return { handle: target, exactIdentity, digest: hash.digest("hex"), bytes: position };
+    }
+    catch (error) {
+        await target.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function removeCreatedTargetIfUnchanged(targetPath, identity) {
+    if (!identity) {
+        return "unknown";
+    }
+    try {
+        const current = await fs.lstat(targetPath, { bigint: true });
+        if (!current.isSymbolicLink() && sameFileIdentityForCleanup(current, identity)) {
+            await fs.rm(targetPath);
+            return "removed";
+        }
+        return "preserved";
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? "removed" : "unknown";
+    }
+}
+async function syncPublishedParent(params) {
+    params.failure.phase = "directory-sync";
+    try {
+        await getFsSafeTestHooks()?.beforePublishDirectorySync?.(params.method, params.targetPath, params.failure.targetIdentity);
+        // PinnedDirectory.sync() revalidates descriptor/path identity immediately
+        // before and after fsync; keep that check inside the shared sync boundary.
+        return await params.parent.sync();
+    }
+    catch (error) {
+        params.failure.directorySync = directorySyncFailure(error);
+        throw error;
+    }
+}
+export async function publishFileExclusive(params) {
+    const sourcePath = path.resolve(params.sourcePath);
+    const targetPath = path.resolve(params.targetPath);
+    const parentPath = path.dirname(targetPath);
+    if (params.parentReceipt && path.resolve(params.parentReceipt.path) !== parentPath) {
+        throw new FsSafeError("path-mismatch", "publication parent receipt does not match target parent");
+    }
+    const sourcePathStat = await fs.lstat(sourcePath);
+    if (sourcePathStat.isSymbolicLink() || !sourcePathStat.isFile()) {
+        throw new FsSafeError("not-file", "publication source must be a regular file");
+    }
+    const source = await fs.open(sourcePath, sourceOpenFlags());
+    let parent;
+    let sourceNativeParent;
+    let targetNativeParent;
+    const failure = {
+        phase: params.strategy === "rename-noreplace" ? "rename-create" : "hardlink-create",
+        targetCreated: false,
+        preserveTarget: false,
+    };
+    try {
+        parent = await pinDirectory(params.parentReceipt ?? parentPath, {
+            label: "publication parent",
+        });
+        const sourceIdentity = await source.stat();
+        const sourceExactIdentity = await source.stat({ bigint: true });
+        const sourcePathExactIdentity = await fs.lstat(sourcePath, { bigint: true });
+        if (sourcePathExactIdentity.isSymbolicLink() ||
+            !sourcePathExactIdentity.isFile() ||
+            !sameFileIdentity(sourcePathExactIdentity, sourceExactIdentity) ||
+            (params.expectedSourceIdentity &&
+                !sameFileIdentity(params.expectedSourceIdentity, typeof params.expectedSourceIdentity.dev === "bigint" ||
+                    typeof params.expectedSourceIdentity.ino === "bigint"
+                    ? sourceExactIdentity
+                    : sourceIdentity))) {
+            throw new FsSafeError("path-mismatch", "publication source identity did not match");
+        }
+        await parent.assertCurrent();
+        await assertPinnedSourceCurrent({ sourcePath, handle: source, identity: sourceExactIdentity });
+        const native = params.strategy === "rename-noreplace"
+            ? requireNativeBinding()
+            : getNativeBinding();
+        if (native) {
+            sourceNativeParent = await openNativeParent(sourcePath);
+            targetNativeParent = await openNativeParent(targetPath);
+        }
+        if (params.strategy === "rename-noreplace") {
+            const binding = requireNativeBinding();
+            binding.renameNoReplace(sourceNativeParent.handle.fd, sourceNativeParent.basename, targetNativeParent.handle.fd, targetNativeParent.basename);
+            rememberCreatedTarget(failure, sourceExactIdentity, "rename-verify");
+            // A failed post-rename fence must not delete the only remaining name.
+            failure.preserveTarget = true;
+            await getFsSafeTestHooks()?.afterPublishTargetCreated?.("rename-noreplace", targetPath, sourceExactIdentity);
+            const targetExactIdentity = await fs.lstat(targetPath, { bigint: true });
+            if (targetExactIdentity.isSymbolicLink() ||
+                !targetExactIdentity.isFile() ||
+                !sameFileIdentity(targetExactIdentity, sourceExactIdentity)) {
+                throw new FsSafeError("path-mismatch", "no-replace publication target changed");
+            }
+            try {
+                await fs.lstat(sourcePath);
+                throw new FsSafeError("path-mismatch", "no-replace publication source still exists");
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    throw error;
+                }
+            }
+            syncFileBestEffortSync(sourceNativeParent.handle.fd);
+            const targetIdentity = await fs.lstat(targetPath);
+            return {
+                method: "rename-noreplace",
+                identity: targetIdentity,
+                directorySync: await syncPublishedParent({
+                    parent,
+                    failure,
+                    method: "rename-noreplace",
+                    targetPath,
+                }),
+            };
+        }
+        try {
+            if (native) {
+                native.linkBeneath(sourceNativeParent.handle.fd, sourceNativeParent.basename, targetNativeParent.handle.fd, targetNativeParent.basename);
+            }
+            else {
+                await fs.link(sourcePath, targetPath);
+            }
+            rememberCreatedTarget(failure, sourceExactIdentity, "hardlink-verify");
+            await getFsSafeTestHooks()?.afterPublishTargetCreated?.("hardlink", targetPath, sourceExactIdentity);
+            const targetExactIdentity = await fs.lstat(targetPath, { bigint: true });
+            if (targetExactIdentity.isSymbolicLink() ||
+                !targetExactIdentity.isFile() ||
+                !sameFileIdentity(targetExactIdentity, sourceExactIdentity)) {
+                throw new FsSafeError("path-mismatch", "hardlink publication target changed");
+            }
+            await assertPinnedSourceCurrent({ sourcePath, handle: source, identity: sourceExactIdentity });
+            const targetIdentity = await fs.lstat(targetPath);
+            return {
+                method: "hardlink",
+                identity: targetIdentity,
+                directorySync: await syncPublishedParent({
+                    parent,
+                    failure,
+                    method: "hardlink",
+                    targetPath,
+                }),
+            };
+        }
+        catch (error) {
+            if (failure.targetCreated ||
+                !isHardlinkFallbackError(error) ||
+                params.strategy === "link-required") {
+                throw error;
+            }
+        }
+        failure.phase = "copy-create";
+        let target;
+        let targetIdentity;
+        try {
+            const copied = await copyPinnedSource({
+                source,
+                targetPath,
+                native,
+                targetNativeParent,
+                failure,
+            });
+            target = copied.handle;
+            targetIdentity = await target.stat();
+            const targetPathStat = await fs.lstat(targetPath);
+            const targetPathExactStat = await fs.lstat(targetPath, { bigint: true });
+            const copiedBack = await hashFileHandle(target, native);
+            const sourceAfter = await hashFileHandle(source, native);
+            if (targetPathStat.isSymbolicLink() ||
+                targetPathExactStat.isSymbolicLink() ||
+                !sameFileIdentity(targetPathExactStat, copied.exactIdentity) ||
+                copiedBack.bytes !== copied.bytes ||
+                copiedBack.digest !== copied.digest ||
+                sourceAfter.bytes !== copied.bytes ||
+                sourceAfter.digest !== copied.digest) {
+                throw new FsSafeError("path-mismatch", "exclusive publication copy failed content fencing");
+            }
+            await assertPinnedSourceCurrent({ sourcePath, handle: source, identity: sourceExactIdentity });
+            const directorySync = await syncPublishedParent({
+                parent,
+                failure,
+                method: "exclusive-copy",
+                targetPath,
+            });
+            return { method: "exclusive-copy", identity: targetPathStat, directorySync };
+        }
+        catch (error) {
+            await target?.close().catch(() => undefined);
+            target = undefined;
+            throw error;
+        }
+        finally {
+            await target?.close().catch(() => undefined);
+        }
+    }
+    catch (error) {
+        if (!failure.targetCreated)
+            throw error;
+        const preserveSyncFailure = failure.phase === "directory-sync" && params.onSyncFailure === "preserve";
+        const cleanup = failure.preserveTarget || preserveSyncFailure
+            ? "preserved"
+            : await removeCreatedTargetIfUnchanged(targetPath, failure.targetCleanupIdentity);
+        throw publicationFailure(error, failure, cleanup);
+    }
+    finally {
+        await sourceNativeParent?.handle.close().catch(() => undefined);
+        await targetNativeParent?.handle.close().catch(() => undefined);
+        await source.close().catch(() => undefined);
+        await parent?.close().catch(() => undefined);
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/read-open-flags.d.ts

@@ -0,0 +1,8 @@
+import fs from "node:fs";
+type ReadOpenFlagConstants = Pick<typeof fs.constants, "O_RDONLY"> & Partial<Pick<typeof fs.constants, "O_NOFOLLOW" | "O_NONBLOCK">>;
+export declare function resolveReadOpenFlags(options?: {
+    constants?: ReadOpenFlagConstants;
+    followSymlinks?: boolean;
+}): number;
+export {};
+//# sourceMappingURL=read-open-flags.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/read-open-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-open-flags.d.ts","sourceRoot":"","sources":["../src/read-open-flags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,KAAK,qBAAqB,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC;AAElE,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,MAAM,CAaT"}

package/node_modules/@openclaw/fs-safe/dist/read-open-flags.js

@@ -0,0 +1,13 @@
+import fs from "node:fs";
+export function resolveReadOpenFlags(options) {
+    const constants = options?.constants ?? fs.constants;
+    const noFollow = process.platform !== "win32" &&
+        options?.followSymlinks !== true &&
+        typeof constants.O_NOFOLLOW === "number"
+        ? constants.O_NOFOLLOW
+        : 0;
+    const nonBlocking = process.platform !== "win32" && typeof constants.O_NONBLOCK === "number"
+        ? constants.O_NONBLOCK
+        : 0;
+    return constants.O_RDONLY | noFollow | nonBlocking;
+}

package/node_modules/@openclaw/fs-safe/dist/read-opened-file.d.ts

@@ -0,0 +1,21 @@
+import type { Stats } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import type { ContainmentGuarantee } from "./containment.js";
+export type ReadResult = {
+    buffer: Buffer;
+    containment: ContainmentGuarantee;
+    realPath: string;
+    stat: Stats;
+};
+type OpenedFile = {
+    handle: FileHandle;
+    containment: ContainmentGuarantee;
+    realPath: string;
+    stat: Stats;
+};
+export declare function readOpenedFileSafely(params: {
+    opened: OpenedFile;
+    maxBytes?: number;
+}): Promise<ReadResult>;
+export {};
+//# sourceMappingURL=read-opened-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/read-opened-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-opened-file.d.ts","sourceRoot":"","sources":["../src/read-opened-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,KAAK,UAAU,GAAG;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBtB"}

package/node_modules/@openclaw/fs-safe/dist/read-opened-file.js

@@ -0,0 +1,18 @@
+import { normalizeMaxBytes } from "./byte-budget.js";
+import { readFileHandleBounded } from "./bounded-read.js";
+import { FsSafeError } from "./errors.js";
+export async function readOpenedFileSafely(params) {
+    const maxBytes = normalizeMaxBytes(params.maxBytes);
+    if (maxBytes !== undefined && params.opened.stat.size > maxBytes) {
+        throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got ${params.opened.stat.size})`);
+    }
+    const buffer = maxBytes === undefined
+        ? await params.opened.handle.readFile()
+        : await readFileHandleBounded(params.opened.handle, maxBytes);
+    return {
+        buffer,
+        containment: params.opened.containment,
+        realPath: params.opened.realPath,
+        stat: params.opened.stat,
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/regular-file.d.ts

@@ -0,0 +1,38 @@
+import type { Stats } from "node:fs";
+import fsSync from "node:fs";
+export type RegularFileStatResult = {
+    missing: true;
+} | {
+    missing: false;
+    stat: Stats;
+};
+type RegularFileAppendFlagConstants = Pick<typeof fsSync.constants, "O_APPEND" | "O_CREAT" | "O_WRONLY"> & Partial<Pick<typeof fsSync.constants, "O_NOFOLLOW" | "O_NONBLOCK">>;
+export type AppendRegularFileOptions = {
+    filePath: string;
+    content: string | Uint8Array;
+    encoding?: BufferEncoding;
+    maxFileBytes?: number;
+    mode?: number;
+    rejectSymlinkParents?: boolean;
+};
+export declare function resolveRegularFileAppendFlags(constants?: RegularFileAppendFlagConstants): number;
+export declare function statRegularFile(filePath: string): Promise<RegularFileStatResult>;
+export declare function statRegularFileSync(filePath: string): RegularFileStatResult;
+export declare function readRegularFile(params: {
+    filePath: string;
+    maxBytes?: number;
+}): Promise<{
+    buffer: Buffer;
+    stat: Stats;
+}>;
+export declare function readRegularFileSync(params: {
+    filePath: string;
+    maxBytes?: number;
+}): {
+    buffer: Buffer;
+    stat: Stats;
+};
+export declare function appendRegularFile(options: AppendRegularFileOptions): Promise<void>;
+export declare function appendRegularFileSync(options: AppendRegularFileOptions): void;
+export {};
+//# sourceMappingURL=regular-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/regular-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,MAAM,MAAM,SAAS,CAAC;AAmB7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC;AAEtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CASR;AAaD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CA6D3C;AA2DD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CAoCA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAgF7E"}