@openclaw/openshell-sandbox 2026.9.2 → 2026.9.4

package/node_modules/@openclaw/fs-safe/dist/pinned-operation.js

@@ -0,0 +1,35 @@
+import { FsSafeError } from "./errors.js";
+export function validatePinnedOperationPayload(payload) {
+    if (typeof payload.relativePath === "string") {
+        validatePinnedRelativePath(payload.relativePath);
+    }
+    if (typeof payload.relativeParentPath === "string") {
+        validatePinnedRelativePath(payload.relativeParentPath);
+    }
+    if (typeof payload.from === "string") {
+        validatePinnedRelativePath(payload.from);
+    }
+    if (typeof payload.to === "string") {
+        validatePinnedRelativePath(payload.to);
+    }
+}
+function validatePinnedRelativePath(relativePath) {
+    if (relativePath.length === 0 || relativePath === ".") {
+        return;
+    }
+    if (relativePath.includes("\0")) {
+        throw new FsSafeError("invalid-path", "relative path contains a NUL byte");
+    }
+    if (relativePath.startsWith("/") ||
+        relativePath.startsWith("//") ||
+        relativePath === ".." ||
+        relativePath.startsWith("../") ||
+        relativePath.startsWith("..\\")) {
+        throw new FsSafeError("invalid-path", "relative path must not escape root");
+    }
+    for (const segment of relativePath.split("/")) {
+        if (segment === "..") {
+            throw new FsSafeError("invalid-path", "relative path must not contain '..'");
+        }
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/pinned-write.d.ts

@@ -0,0 +1,36 @@
+import type { Readable } from "node:stream";
+import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
+import type { FileIdentityStat } from "./file-identity.js";
+export type PinnedWriteInput = {
+    kind: "buffer";
+    data: string | Buffer;
+    encoding?: BufferEncoding;
+} | {
+    kind: "stream";
+    stream: Readable;
+};
+export type RenameIdentityPolicy = "strict" | "verify-content-with-lock";
+export type PublishedWriteIdentity = Readonly<{
+    dev: bigint;
+    ino: bigint;
+}>;
+export type PinnedWriteParams = {
+    rootPath: string;
+    relativeParentPath: string;
+    basename: string;
+    mkdir: boolean;
+    mode: number;
+    sync?: boolean;
+    overwrite?: boolean;
+    maxBytes?: number;
+    input: PinnedWriteInput;
+    rootIdentity?: FileIdentityStat;
+    onRenameIdentityMismatch?: "verify-content";
+    verifyPublished?: (fd: number, identity: PublishedWriteIdentity, parentGuard: AnyAsyncDirectoryGuard) => Promise<void>;
+};
+export declare function runPinnedWriteHelper(params: PinnedWriteParams): Promise<FileIdentityStat>;
+export declare function runPinnedWriteWithRenamePolicy(params: PinnedWriteParams & {
+    targetPath: string;
+    renameIdentity?: RenameIdentityPolicy;
+}): Promise<FileIdentityStat>;
+//# sourceMappingURL=pinned-write.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/pinned-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAA4F,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAG7J,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAY3D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAsDzC,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC;IAE5C,eAAe,CAAC,EAAE,CAChB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,sBAAsB,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}

package/node_modules/@openclaw/fs-safe/dist/pinned-write.js

@@ -0,0 +1,252 @@
+import { syncFileBestEffort } from "./file-sync.js";
+import { randomUUID } from "node:crypto";
+import fsSync, {} from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { normalizeMaxBytes } from "./byte-budget.js";
+import { createAsyncDirectoryGuard, createNearestExistingDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { syncDirectoryBestEffort } from "./directory-durability.js";
+import { sameFileIdentity, sha256Hex } from "./file-identity.js";
+import { withAsyncDirectoryGuards } from "./guarded-mutation.js";
+import { mkdirPathComponentsWithGuards } from "./guarded-mkdir.js";
+import { runPinnedWriteNative } from "./native-pinned-write.js";
+import { getNativeBinding } from "./native.js";
+import { validatePinnedOperationPayload } from "./pinned-operation.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { cleanupPinnedFilePath } from "./replace-file-temp-owner.js";
+import { withSidecarLock } from "./sidecar-lock.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+function byteLength(input, encoding) {
+    return typeof input === "string"
+        ? Buffer.byteLength(input, encoding ?? "utf8")
+        : input.byteLength;
+}
+function assertSafeBasename(basename) {
+    if (!basename ||
+        basename === "." ||
+        basename === ".." ||
+        basename.includes("/") ||
+        basename.includes("\0")) {
+        throw new FsSafeError("invalid-path", "invalid target path");
+    }
+}
+function assertWithinMaxBytes(bytes, maxBytes) {
+    if (maxBytes !== undefined && bytes > maxBytes) {
+        throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
+    }
+}
+async function writeStreamToHandle(stream, handle, maxBytes) {
+    let bytes = 0;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.byteLength;
+        assertWithinMaxBytes(bytes, maxBytes);
+        let offset = 0;
+        while (offset < buffer.byteLength) {
+            const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset);
+            if (bytesWritten <= 0) {
+                throw new FsSafeError("helper-failed", "fallback stream write made no progress");
+            }
+            offset += bytesWritten;
+        }
+    }
+}
+export async function runPinnedWriteHelper(params) {
+    const normalizedParams = { ...params, maxBytes: normalizeMaxBytes(params.maxBytes) };
+    assertSafeBasename(params.basename);
+    validatePinnedOperationPayload({
+        relativeParentPath: params.relativeParentPath,
+    });
+    // The explicit compatibility policy uses the guarded Node fallback, where
+    // content verification can replace the strict post-rename inode check.
+    if (normalizedParams.onRenameIdentityMismatch === "verify-content") {
+        return await runPinnedWriteFallback(normalizedParams);
+    }
+    const native = getNativeBinding();
+    if (native) {
+        return await runPinnedWriteNative(native, normalizedParams);
+    }
+    return await runPinnedWriteFallback(normalizedParams);
+}
+export async function runPinnedWriteWithRenamePolicy(params) {
+    const { targetPath, renameIdentity, ...writeParams } = params;
+    if (renameIdentity !== "verify-content-with-lock") {
+        return await runPinnedWriteHelper(writeParams);
+    }
+    const relativeTargetPath = writeParams.relativeParentPath
+        ? `${writeParams.relativeParentPath}/${writeParams.basename}`
+        : writeParams.basename;
+    const lockPath = path.join(writeParams.rootPath, `.fs-safe-write-${sha256Hex(relativeTargetPath)}.lock`);
+    return await withSidecarLock(writeParams.rootPath, {
+        managerKey: `fs-safe.write:${targetPath}`,
+        lockPath,
+        staleMs: 30_000,
+        timeoutMs: 5_000,
+        payload: () => ({ pid: process.pid, createdAt: new Date().toISOString() }),
+        retry: { retries: 5, minTimeout: 100, maxTimeout: 2_000, factor: 2 },
+    }, async () => await runPinnedWriteHelper({
+        ...writeParams,
+        onRenameIdentityMismatch: "verify-content",
+    }));
+}
+async function runPinnedWriteFallback(params) {
+    const exactRoot = typeof params.rootIdentity?.dev === "bigint" && typeof params.rootIdentity.ino === "bigint"
+        ? { dev: params.rootIdentity.dev, ino: params.rootIdentity.ino } : undefined;
+    if (exactRoot)
+        await inspectDirectoryIdentity(params.rootPath, exactRoot);
+    const guardOptions = { bigint: exactRoot !== undefined };
+    let parentPath = params.relativeParentPath
+        ? path.join(params.rootPath, ...params.relativeParentPath.split("/"))
+        : params.rootPath;
+    if (params.mkdir) {
+        // mkdirPathComponentsWithGuards may resolve the final component through
+        // an in-root symlink (e.g. a skill-bank layout). Use its returned real
+        // path for the subsequent guard and target path so we don't re-check the
+        // original, possibly-symlinked, lexical path and reject it outright.
+        parentPath = await mkdirPathComponentsWithGuards({
+            rootReal: params.rootPath,
+            targetPath: parentPath,
+            beforeComponent: async (componentPath) => await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("mkdir", componentPath),
+        });
+    }
+    const parentGuard = params.mkdir
+        ? await createAsyncDirectoryGuard(parentPath, guardOptions)
+        : await createNearestExistingDirectoryGuard(params.rootPath, parentPath, guardOptions);
+    const targetPath = path.join(parentPath, params.basename);
+    if (params.overwrite === false) {
+        const handle = await withAsyncDirectoryGuards([parentGuard], async () => await fs.open(targetPath, fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL, params.mode), {
+            onPostGuardFailure: async (openedHandle) => {
+                // The parent failed verification, so targetPath may now resolve
+                // somewhere else. Close the fd, but do not clean up by path.
+                await openedHandle.close().catch(() => undefined);
+            },
+        });
+        let created = true;
+        let createdIdentity;
+        try {
+            const verificationIdentity = fsSync.fstatSync(handle.fd, { bigint: true });
+            createdIdentity = verificationIdentity;
+            if (params.input.kind === "buffer") {
+                assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
+                if (typeof params.input.data === "string") {
+                    await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
+                }
+                else {
+                    await handle.writeFile(params.input.data);
+                }
+            }
+            else {
+                await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
+            }
+            // Content writes may clear set-ID bits; finalize them through the owned fd.
+            await handle.chmod(params.mode);
+            if (params.sync !== false)
+                await syncFileBestEffort(handle);
+            const stat = fsSync.fstatSync(handle.fd);
+            if (params.sync !== false)
+                await syncDirectoryBestEffort(parentPath);
+            // Publication is complete. A failed outer check must not remove its target.
+            created = false;
+            await params.verifyPublished?.(handle.fd, verificationIdentity, parentGuard);
+            return { dev: stat.dev, ino: stat.ino };
+        }
+        finally {
+            try {
+                if (created) {
+                    await cleanupPinnedFilePath({ pathname: targetPath, handle, identity: createdIdentity, parentGuard });
+                }
+            }
+            finally {
+                await handle.close().catch(() => undefined);
+            }
+        }
+    }
+    // Private staging must not consume the destination basename's filename budget.
+    const tempPath = path.join(parentPath, `.fs-safe-${randomUUID()}.tmp`);
+    const tempFlags = fsSync.constants.O_WRONLY |
+        fsSync.constants.O_CREAT |
+        fsSync.constants.O_EXCL |
+        (process.platform !== "win32" && "O_NOFOLLOW" in fsSync.constants
+            ? fsSync.constants.O_NOFOLLOW
+            : 0);
+    let handle;
+    let tempStat;
+    let tempIdentity;
+    let readHandle;
+    let renamed = false;
+    try {
+        handle = await fs.open(tempPath, tempFlags, params.mode);
+        let verificationIdentity = fsSync.fstatSync(handle.fd, { bigint: true });
+        tempIdentity = verificationIdentity;
+        if (params.input.kind === "buffer") {
+            assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
+            if (typeof params.input.data === "string") {
+                await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
+            }
+            else {
+                await handle.writeFile(params.input.data);
+            }
+        }
+        else {
+            await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
+        }
+        tempStat = fsSync.fstatSync(handle.fd);
+        const tempPathStat = fsSync.lstatSync(tempPath);
+        if (tempPathStat.isSymbolicLink() || !sameFileIdentity(tempPathStat, tempStat)) {
+            throw new FsSafeError("path-mismatch", "fallback temp path changed during write");
+        }
+        const expectedTempStat = tempStat;
+        await handle.chmod(params.mode);
+        if (params.sync !== false)
+            await syncFileBestEffort(handle);
+        let verifiedIdentity = expectedTempStat;
+        await withAsyncDirectoryGuards([parentGuard], async () => {
+            await fs.rename(tempPath, targetPath);
+            renamed = true;
+            await getFsSafeTestHooks()?.afterPinnedWriteFallbackRename?.(targetPath);
+            if (params.sync !== false)
+                await syncDirectoryBestEffort(parentPath);
+            const targetStat = fsSync.lstatSync(targetPath);
+            if (targetStat.isSymbolicLink()) {
+                throw new FsSafeError("path-mismatch", "fallback target changed during write");
+            }
+            if (!sameFileIdentity(targetStat, expectedTempStat)) {
+                // On filesystems like rclone FUSE, rename(2) can give the destination a
+                // different inode from the source temp fd even with zero concurrency. The
+                // caller must ensure mutual exclusion before passing "verify-content";
+                // fall back to a content hash for this rename-boundary check only.
+                if (params.onRenameIdentityMismatch !== "verify-content") {
+                    throw new FsSafeError("path-mismatch", "fallback target changed during write");
+                }
+                if (params.input.kind !== "buffer") {
+                    throw new FsSafeError("path-mismatch", "fallback target changed during write");
+                }
+                const expectedHash = sha256Hex(params.input.data, params.input.encoding);
+                readHandle = await fs.open(targetPath, resolveReadOpenFlags());
+                const readHandleStat = fsSync.fstatSync(readHandle.fd, { bigint: true });
+                const actualHash = sha256Hex(await readHandle.readFile());
+                if (actualHash !== expectedHash) {
+                    throw new FsSafeError("path-mismatch", "fallback target changed during write");
+                }
+                // The content-verified destination, not the old temp inode, is now pinned.
+                verificationIdentity = readHandleStat;
+                // Preserve the helper's legacy numeric return facts, not the private proof.
+                verifiedIdentity = { dev: Number(readHandleStat.dev), ino: Number(readHandleStat.ino) };
+            }
+        });
+        await params.verifyPublished?.((readHandle ?? handle).fd, verificationIdentity, parentGuard);
+        return { dev: verifiedIdentity.dev, ino: verifiedIdentity.ino };
+    }
+    finally {
+        try {
+            if (!renamed && handle) {
+                await cleanupPinnedFilePath({ pathname: tempPath, handle, identity: tempIdentity, parentGuard });
+            }
+        }
+        finally {
+            await readHandle?.close().catch(() => undefined);
+            await handle?.close().catch(() => undefined);
+        }
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/private-directory.d.ts

@@ -0,0 +1,5 @@
+export type CreatePrivateDirectoryOptions = {
+    platform?: NodeJS.Platform;
+};
+export declare function createPrivateDirectory(targetPath: string, options?: CreatePrivateDirectoryOptions): Promise<void>;
+//# sourceMappingURL=private-directory.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/private-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-directory.d.ts","sourceRoot":"","sources":["../src/private-directory.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/node_modules/@openclaw/fs-safe/dist/private-directory.js

@@ -0,0 +1,14 @@
+import { FsSafeError } from "./errors.js";
+import { getNativeBinding } from "./native.js";
+export async function createPrivateDirectory(targetPath, options) {
+    const platform = options?.platform ?? process.platform;
+    if (platform !== "win32") {
+        throw new FsSafeError("helper-unavailable", "private-directory creation is supported only on Windows");
+    }
+    const native = getNativeBinding();
+    if (!native) {
+        throw new FsSafeError("helper-unavailable", "private Windows directory creation requires the matching optional native platform package; " +
+            "install @openclaw/fs-safe with optional dependencies enabled on a supported platform and use FS_SAFE_NATIVE_MODE=auto or require");
+    }
+    native.createPrivateDirectory(targetPath);
+}

package/node_modules/@openclaw/fs-safe/dist/private-temp-workspace.d.ts

@@ -0,0 +1,45 @@
+import { type FileStore, type FileStoreSync } from "./file-store.js";
+import { type TempPathIdentityReceipt } from "./temp-cleanup.js";
+import { type TempWorkspaceCleanupResult, type TempWorkspaceCleanupSafety } from "./temp-workspace-owner.js";
+export type { TempWorkspaceCleanupResult, TempWorkspaceCleanupSafety, } from "./temp-workspace-owner.js";
+export type TempWorkspaceOptions = {
+    rootDir: string;
+    prefix: string;
+    dirMode?: number;
+    mode?: number;
+    cleanupSafety?: TempWorkspaceCleanupSafety;
+};
+export type TempWorkspace = {
+    dir: string;
+    identity: TempPathIdentityReceipt;
+    store: FileStore;
+    path(fileName: string): string;
+    write(fileName: string, data: string | Uint8Array): Promise<string>;
+    writeText(fileName: string, data: string): Promise<string>;
+    writeJson(fileName: string, data: unknown, options?: {
+        trailingNewline?: boolean;
+    }): Promise<string>;
+    copyIn(fileName: string, sourcePath: string): Promise<string>;
+    read(fileName: string): Promise<Buffer>;
+    cleanup(): Promise<TempWorkspaceCleanupResult>;
+    [Symbol.asyncDispose](): Promise<void>;
+};
+export type TempWorkspaceSync = {
+    dir: string;
+    identity: TempPathIdentityReceipt;
+    store: FileStoreSync;
+    path(fileName: string): string;
+    write(fileName: string, data: string | Uint8Array): string;
+    writeText(fileName: string, data: string): string;
+    writeJson(fileName: string, data: unknown, options?: {
+        trailingNewline?: boolean;
+    }): string;
+    read(fileName: string): Buffer;
+    cleanup(): TempWorkspaceCleanupResult;
+    [Symbol.dispose](): void;
+};
+export declare function tempWorkspace(options: TempWorkspaceOptions): Promise<TempWorkspace>;
+export declare function withTempWorkspace<T>(options: TempWorkspaceOptions, run: (workspace: TempWorkspace) => Promise<T>): Promise<T>;
+export declare function tempWorkspaceSync(options: TempWorkspaceOptions): TempWorkspaceSync;
+export declare function withTempWorkspaceSync<T>(options: TempWorkspaceOptions, run: (workspace: TempWorkspaceSync) => T): T;
+//# sourceMappingURL=private-temp-workspace.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/private-temp-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-temp-workspace.d.ts","sourceRoot":"","sources":["../src/private-temp-workspace.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,IAAI,0BAA0B,CAAC;IACtC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AAuKF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,iBAAiB,CAgGnB;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,GACvC,CAAC,CAUH"}