botmux 3.5.0 → 3.5.2

package/dist/adapters/backend/sandbox.d.ts

@@ -1,105 +1,9 @@
-/**
- * Mount an overlayfs: reads fall through to `lower` (real, zero copy); writes
- * copy-up into `upper` (the landable changeset). `work` is overlayfs scratch on
- * the same fs as `upper`. Returns true iff `mount` exited 0.
- */
-export declare function mountOverlay(opts: {
-    lower: string;
-    upper: string;
-    work: string;
-    merged: string;
-}): boolean;
-/** True iff `path` is currently a mountpoint (host-side overlay still mounted).
- *  Read mountinfo instead of stat'ing the path: a broken recursive FUSE mount can
- *  leave any path-based `mountpoint` probe blocked in uninterruptible I/O. */
-export declare function isMounted(path: string): boolean;
-/** Unmount an overlay merged dir. Best-effort: lazy detach if a normal unmount
- *  fails because a still-draining bwrap child holds the FUSE mount busy. */
-export declare function unmountOverlay(merged: string): void;
-export interface SandboxPlan {
-    /** In-sandbox path the project is bound at — equals the original workingDir the
-     *  CLI was given, so the CLI's existing path args resolve. Also the child's chdir. */
-    projectMount: string;
-    /** Host path of the merged project overlay (reads=real lower, writes=upper). */
-    projectMerged: string;
-    /** In-sandbox path the home overlay is bound at — equals the real home path so
-     *  every CLI's hardcoded `~/.<cli>` resolves there. */
-    home: string;
-    /** Host path of the merged home overlay. */
-    homeMerged: string;
-    /** Daemon-mediated `botmux send` outbox — bound LAST so it wins over any mask. */
-    outbox: string;
-    /** Trusted worker-side MCP socket directory. The sandbox sees only this
-     * session's socket at a fixed path under its private /run tmpfs. */
-    mcpGatewaySocket?: {
-        hostDir: string;
-        sandboxDir: string;
-    };
-    /** Per-bot privacy masks: directories blanked with an empty tmpfs. */
-    hideDirs: string[];
-    /** Per-bot privacy masks: files blanked with a read-only empty placeholder. */
-    hideFiles: {
-        path: string;
-        empty: string;
-    }[];
-    /** CLI auth/login paths kept REAL + writable (bound rw over the isolated home so
-     *  the CLI's token refresh / login persists — unlike project edits which are
-     *  isolated). Resolved + existence-filtered by prepareSandbox. */
-    authReal?: string[];
-    /** Runtime-generated roots that the CLI must see but must not mutate. Trusted
-     *  (daemon-produced, e.g. skill plugin dirs) — bound AFTER the privacy masks so
-     *  a broad hideDir can't break skill delivery. */
-    readonlyRoots?: string[];
-    /** Sensitive files inside readonlyRoots that must stay hidden. Applied after
-     * the readonly bind so that re-exposing a plugin runtime cannot reveal its
-     * install-time MCP descriptor. */
-    postReadonlyHideDirs?: string[];
-    postReadonlyHideFiles?: {
-        path: string;
-        empty: string;
-    }[];
-    /** Daemon-generated private roots re-bound writable AFTER credential masks.
-     * Used for the current bot's isolated CLI home only; never accepts user
-     * config. */
-    trustedWritableRoots?: string[];
-    /** Crown-jewel masks emitted after trusted writable carve-outs. */
-    finalHideDirs?: string[];
-    finalHideFiles?: {
-        path: string;
-        empty: string;
-    }[];
-    /** User-configured read-only inputs (per-bot sandboxReadonlyPaths). Bound BEFORE
-     *  the privacy masks so hidePaths always win over them — an entry overlapping a
-     *  masked path must never re-expose the real content. */
-    userReadonlyRoots?: string[];
-    /** Keep network egress. File-only scope ⇒ default true (npm/pip/git work). */
-    net?: boolean;
-}
-/**
- * Build the bwrap argv prefix. Final spawn becomes:
- *   bwrap <these args> -- <cliBin> <cliArgs...>
- *
- * Mount order matters (later mounts win): the whole real fs read-only first, then
- * the home + project merged overlays bind over it (so writes there are isolated),
- * then user readonly inputs, then privacy masks blank specific paths (masks bind
- * after user readonly roots so an overlapping readonly entry can never re-expose
- * masked content), then trusted runtime roots, then the outbox binds LAST so it
- * stays writable even if a mask covers a parent dir.
- */
-export declare function buildSandboxArgs(plan: SandboxPlan): string[];
-/**
- * Build the lightweight bwrap wrapper used when full overlay sandboxing is off.
- * The host filesystem, including BOTMUX_HOME itself, remains live/read-write.
- * Device credentials and their arbitrary future sidecars live below a dedicated
- * authority directory which is replaced wholesale with a private tmpfs. The
- * few legacy/root authority files are masked individually with read-only
- * /dev/null mounts. This preserves root-level atomic writes, newly created
- * plugin/skill/run directories, symlinks, and live config replacement.
- */
+import { type FsPolicy } from '../cli/fs-policy.js';
+/** Lightweight bwrap used when only the one-way device credential boundary is
+ * required and the full file sandbox is off. */
 export declare function buildCredentialOnlySandboxArgs(input: {
     hideDirectories: string[];
     hideFiles: string[];
-    /** Worker-owned marker/profile roots that must remain immutable to the CLI. */
     readonlyPaths?: string[];
     workingDir: string;
     cliBin: string;
@@ -118,13 +22,7 @@ export type HostCredentialIsolationMechanismProbe = {
     mechanism: null;
     reason: string;
 };
-/** Host-side pre-enrollment probe. It accepts no child/session environment or
- * adapter input, performs no writes/installation, and therefore can safely run
- * before the fixed marker is created. Enrollment uses this to refuse enabling
- * device credentials on a host where future workers could not confine them. */
 export declare function probeHostCredentialIsolationMechanism(): HostCredentialIsolationMechanismProbe;
-/** Probe/install the one lightweight Linux dependency. Kept separate so the
- * worker can make the mandatory gate decision before any local CLI is spawned. */
 export declare function credentialOnlySandboxAvailable(): boolean;
 export declare function prepareCredentialOnlySandbox(input: {
     hideDirectories: string[];
@@ -134,71 +32,73 @@ export declare function prepareCredentialOnlySandbox(input: {
     cliBin: string;
     cliArgs: string[];
 }): CredentialOnlySandboxSpawn | null;
-/**
- * After `buildSandboxArgs` masks `/run` with a fresh tmpfs, any executable whose
- * resolved path lives UNDER `/run` (the common case: fnm/nvm/volta expose the
- * active toolchain's bin dir as a per-session symlink farm under
- * `/run/user/<uid>/fnm_multishells/<hash>/bin`, and `which codex` / the daemon's
- * own `process.execPath` for node land there) would VANISH inside the sandbox →
- * bwrap `execvp` fails → the CLI exits instantly → Botmux's crash-loop guard
- * trips after 4 retries. This re-exposes each such bin dir read-only at its real
- * path so the binary (and the node interpreter its `#!/usr/bin/env node` shebang
- * needs, which lives in the same fnm bin dir) survive the tmpfs.
- *
- * The caller feeds in EVERY path that will be exec'd inside the sandbox, not just
- * the direct bwrap target: the cliBin, the daemon's own node (process.execPath),
- * AND each adapter-declared SECOND-STAGE executable (CliAdapter.sandboxExtraExecPaths)
- * — e.g. the codex-app adapter's resolved `codex` (its resolvedBin is the daemon
- * node running the runner, which spawns the real codex later for the app-server,
- * so without this the codex path would still be masked). We deliberately do NOT
- * scan raw cliArgs: a path arg like `--cwd /run/user/<uid>/proj` would re-bind its
- * PARENT `/run/user/<uid>`, shadowing the project overlay mounted there and
- * exposing sibling files / IPC sockets — re-exposing must be limited to declared
- * executables.
- *
- * Pure: returns the `--ro-bind-try <dir> <dir>` args (deduped, `/run/`-subpaths
- * only — NEVER `/run` itself, which would clobber the tmpfs and the relay shim
- * mounted at /run/sbxbin). `-try` so a stale/racing path can't fail the spawn.
- * Returns [] for binaries already outside /run (system node, npm/pnpm globals) —
- * non-fnm users are unaffected.
- */
+/** Re-expose trusted executable directories hidden below the fresh /run tmpfs. */
 export declare function reexposeRunBinArgs(binPaths: (string | undefined)[]): string[];
-/** bwrap cannot bind-mount over a symlink mount destination. Some hosts expose
- *  $HOME through a symlink, so bind overlays — and set the child HOME env — at
- *  canonical targets so the mount point always exists and $HOME resolves even
- *  when the symlink's parent is masked inside the sandbox. */
-export declare function resolveSandboxMountPath(p: string): string;
-export interface SandboxOverlayPaths {
-    sessionRoot: string;
-    runtimeRoot: string;
-    projectMerged: string;
-    homeMerged: string;
-    legacyProjectMerged: string;
-    legacyHomeMerged: string;
-}
-/** Host-side overlay mountpoints must not live below HOME, because HOME is the
- *  lower layer of the home overlay. The old layout did exactly that and allowed
- *  fuse-overlayfs to recursively expose its own mountpoint. Keep the legacy
- *  paths here only so upgrades can tear down pre-fix sessions safely. */
-export declare function sandboxOverlayPaths(dataDir: string, sessionId: string): SandboxOverlayPaths;
+/** Is the file sandbox globally forced for this daemon? The real per-bot
+ *  BotConfig.sandbox flag is decided by the caller. */
+export declare function sandboxEnabled(): boolean;
 /**
- * Resolve user-configured sandboxReadonlyPaths: tilde-expand, drop non-existent
- * entries, and REJECT entries that (after resolving symlinks + normalizing) are
- * equal to or an ancestor of an overlay root (home / projectMount) — those would
- * shadow the entire write-isolated overlay with the real read-only tree,
- * silently breaking write isolation. The overlap check runs on the CANONICAL
- * path so a symlink (`/tmp/ref -> /repo`) or a non-normalized string (`/repo/`,
- * `/repo/../repo`) can't alias past the guard. Entries strictly UNDER an overlay
- * root stay allowed: that's the documented "reference material, read-only,
- * excluded from /land" use case. Returns the tilde-expanded original paths (the
- * docs promise "mounted at the same path"); bwrap resolves any symlink source.
- * Exported for tests.
+ * Whether a LOCAL sandbox engine applies to this backend at all. riff has NO
+ * local CLI process to wrap (execution happens in riff's own remote sandbox);
+ * without this bypass the worker's fail-safe "backend not sandboxable" hard
+ * error would brick every sandbox-enabled bot the moment it switches to riff.
+ * Platform is no longer a factor — fs-policy sandboxes darwin AND linux.
  */
-export declare function resolveUserReadonlyRoots(paths: readonly string[] | undefined, home: string, projectMount: string): string[];
-/** Is file-sandbox enabled for this session? Spike gate = env; the real
- *  per-bot BotConfig.sandbox flag is decided by the caller. */
-export declare function sandboxEnabled(): boolean;
-export interface SandboxSpawn {
+export declare function localSandboxApplies(backendType: string): boolean;
+interface MaskMountEntry {
+    path: string;
+    kind: 'dir' | 'file';
+    /** Host device + inode captured right after WE created the mountpoint. The
+     *  delete-time identity check: only remove if lstat still reports these. */
+    dev: number;
+    ino: number;
+}
+/** Atomically persist the created-mountpoint manifest (0600). Returns false on
+ *  failure so the caller can FAIL CLOSED (roll back + abort spawn) rather than
+ *  start a session whose pre-created host mountpoints could later leak. */
+declare function writeMaskManifest(sessionRoot: string, created: MaskMountEntry[]): boolean;
+/** Reclaim a list of created-mountpoint entries (the IN-MEMORY truth). Runs on
+ *  ALL teardown paths — normal close reads the entries back from the manifest,
+ *  spawn-failure rollback passes the in-memory accumulator directly (the
+ *  manifest may never have been written). Fail-safe & NON-RECURSIVE:
+ *  - rejects any entry whose path is non-absolute, contains `..`, or is a
+ *    symlink on disk (a swapped entry can't trick us into deleting elsewhere);
+ *  - IDENTITY-BINDS: removes only when the on-disk (dev, ino) still matches what
+ *    WE recorded at creation — so a tampered manifest pointing at a pre-existing
+ *    victim, or a path whose empty object was replaced after we created ours,
+ *    is left untouched;
+ *  - a dir is removed with `rmdir` only (throws ENOTEMPTY if the host/a
+ *    concurrent process wrote into it → content preserved, never rm -rf);
+ *  - a file is `unlink`ed only when it is a regular, zero-byte file.
+ *  Entries are processed in order; the caller records them deepest-first so a
+ *  child is removed before its now-empty parent. */
+declare function reclaimMaskEntries(entries: unknown): void;
+/** Reclaim the empty deny-mask mountpoints recorded in the persisted manifest,
+ *  then (implicitly) the manifest goes with the sessionRoot. Used by the NORMAL
+ *  teardown paths (close, reattach-close, stale sweep) — where the manifest was
+ *  written successfully. Spawn-failure rollback does NOT use this (it can't
+ *  trust a manifest that may never have been written); it passes the in-memory
+ *  accumulator to reclaimMaskEntries directly. MUST run BEFORE removing
+ *  sessionRoot (which holds the manifest). */
+declare function reclaimMaskMounts(sessionRoot: string): void;
+/** Create a mask mountpoint on the host (all missing ancestors too), pushing
+ *  EACH level we actually create — deepest first — into the caller-owned
+ *  `sink` accumulator IMMEDIATELY (before attempting the next level), each with
+ *  its (dev, ino). This is what lets rollback reclaim partially-created chains:
+ *  if a deeper level throws (e.g. ENAMETOOLONG on the leaf), every ancestor we
+ *  already made is already in `sink` for the caller's rollback. `kind` applies
+ *  to the leaf; ancestors are always dirs. No-op when the leaf already exists
+ *  (a pre-existing host path is never our cleanup target). Throws on failure so
+ *  the caller can fail closed — with `sink` holding whatever succeeded. */
+declare function createMaskMount(leaf: string, kind: 'dir' | 'file', sink: MaskMountEntry[]): void;
+export declare const __testOnly_maskMounts: {
+    MASK_MANIFEST_NAME: string;
+    createMaskMount: typeof createMaskMount;
+    writeMaskManifest: typeof writeMaskManifest;
+    reclaimMaskMounts: typeof reclaimMaskMounts;
+    reclaimMaskEntries: typeof reclaimMaskEntries;
+};
+export interface DirectSandboxSpawn {
     /** Replace the CLI binary with this (always 'bwrap'). */
     bin: string;
     /** bwrap args + '--' + original (bin, ...args). */
@@ -207,140 +107,59 @@ export interface SandboxSpawn {
     env: Record<string, string>;
     /** Outbox dir the daemon watcher must service. */
     outbox: string;
-    /** Project overlay UPPER dir — THE LANDABLE CHANGESET (used by sandbox-land). */
-    workDir: string;
-    /** HOME overlay UPPER dir (/var/tmp/botmux-sbx/<sid>/home-upper). When the
-     *  project mount equals HOME, the project overlay is the single winning
-     *  layer and this directory is intentionally unused. */
-    homeUpper: string;
-    /** Unmount the overlays + remove the per-session sandbox tree. */
+    /** Remove the per-session sandbox tree (plain rm — no mounts exist). */
     cleanup: () => void;
 }
-/** The host path where a sandboxed session actually writes a Claude-family
- *  data dir. Usually this is the HOME overlay upper. If the project mount is
- *  HOME (or otherwise contains the data dir), the later project overlay is the
- *  winning mount and the data lands in proj-upper instead.
- *
- *  The home overlay is bound (and $HOME set) at the CANONICAL home, so copy-ups
- *  land relative to that root. Compute the in-home relative path robustly whether
- *  realDataDir arrives in symlink or canonical form: adapters build it from the
- *  raw homedir() (so the raw base cancels cleanly in the common case), but a
- *  canonicalized dataDir under a symlink home would otherwise escape via `..`.
- *  Data roots outside both HOME and the project are returned unchanged because
- *  neither overlay owns them (Claude read isolation normally relocates those
- *  roots into BOT_HOME before spawn). */
-export declare function sandboxedClaudeDataDir(sessionId: string, realDataDir: string, context?: {
-    sourceWorkingDir?: string;
-    dataDir?: string;
-}): string;
-/** Credential roots that must never be readable inside the file sandbox.
- * Relay mode is the only credentialed send path; otherwise an agent could
- * unset BOTMUX_SEND_RELAY and execute an absolute botmux binary against the
- * real bots.json/send-cred files exposed by the HOME overlay lowerdir. */
-export declare function sandboxCredentialHidePaths(home: string, botmuxHome?: string): string[];
-/**
- * Whether the LOCAL bwrap file sandbox applies to this spawn at all.
- * - macOS enforces `sandbox: true` via the Seatbelt write-sandbox instead.
- * - riff has NO local CLI process to wrap (execution happens in riff's own
- *   remote sandbox); without this bypass the worker's fail-safe "backend not
- *   sandboxable" hard error would brick every sandbox-enabled bot the moment
- *   it switches to riff (the dashboard agent switch does not clear `sandbox`).
- */
-export declare function localSandboxApplies(platform: NodeJS.Platform, backendType: string): boolean;
 /**
- * Build the sandboxed spawn for a CLI session, or return null when sandboxing
- * is off / unsupported / a required overlay mount fails (fail-safe = the worker
- * treats null as a hard error and does NOT silently run unsandboxed).
+ * Build the bwrap DIRECT-mode spawn for a CLI session, or return null when the
+ * runtime deps are unavailable / setup fails (fail-safe: the worker treats
+ * null as a hard error and never silently runs unsandboxed).
  *
- * Layout under <dataDir>/sandboxes/<sessionId>/: outbox, shimbin, and the
- * landable proj-upper. When the project contains dataDir (notably cwd=HOME),
- * proj-upper is a symlink to scratch under /var/tmp/botmux-sbx/<sessionId>/ so
- * overlay upper/work never sit inside their own lower. Host-only merged
- * mountpoints and the HOME overlay upper/work also live under that runtime root.
+ * Layout under <dataDir>/sandboxes/<sessionId>/: outbox, shimbin, empties.
+ * No overlays, no upper/work dirs — writes inside readWrite zones hit the
+ * real filesystem directly.
  */
-export declare function prepareSandbox(opts: {
-    /** Whether the sandbox is on for THIS session (per-bot BotConfig.sandbox OR
-     *  the BOTMUX_SANDBOX env force). Decided by the caller — prepareSandbox does
-     *  NOT re-read the env, so the dashboard per-bot toggle actually takes effect. */
-    enabled: boolean;
-    cliId: string;
+export declare function prepareDirectSandbox(opts: {
     sessionId: string;
-    sourceWorkingDir: string;
     dataDir: string;
+    /** Compile-ready policy (canonical + existence-filtered by the worker). */
+    policy: FsPolicy;
+    /** Child chdir (the canonical project working dir). */
+    chdir: string;
+    /** Canonical $HOME to set for the child. */
+    home: string;
     cliBin: string;
     cliArgs: string[];
-    /** Per-bot privacy masks (opt-in, no defaults). Paths existing as dirs are
-     *  blanked with a tmpfs; files with an empty read-only placeholder. */
-    hidePaths?: string[];
-    /** This CLI's auth/login paths (CliAdapter.authPaths) to keep real+writable so
-     *  token refresh / login persists. `~` expanded; missing paths skipped. */
-    authPaths?: readonly string[];
-    /** Adapter-declared SECOND-STAGE executables (CliAdapter.sandboxExtraExecPaths)
-     *  spawned inside the sandbox beyond cliBin — re-exposed if under /run. ONLY
-     *  executable paths (never cwd/path args). undefined → none. */
-    extraExecPaths?: readonly string[];
-    /** Runtime-generated roots that should be visible read-only inside bwrap.
-     *  Trusted (daemon-produced) — bound after the privacy masks. */
-    readonlyRoots?: readonly string[];
-    /** Sensitive descendants of readonlyRoots that are re-masked after those
-     * roots are mounted. */
-    postReadonlyHidePaths?: readonly string[];
-    /** Absolute Botmux command paths already written into a CLI's MCP config.
-     * When a target lives below the masked BOTMUX_HOME, bind the trusted relay
-     * shim at that exact path so an absolute MCP command remains executable. */
+    /** Absolute Botmux command paths already persisted in CLI MCP configs.
+     * Bind the worker-generated relay shim at those exact paths so a stale or
+     * tampered host wrapper cannot replace the trusted gateway entry. */
     trustedBotmuxCommandPaths?: readonly string[];
-    /** Daemon-derived private roots to re-open writable after mandatory masks. */
-    trustedWritablePaths?: readonly string[];
-    /** Credential paths to re-mask after trusted writable carve-outs. */
-    finalHidePaths?: readonly string[];
-    /** User-configured extra read-only inputs (per-bot sandboxReadonlyPaths).
-     *  Bound before the privacy masks (masks win) and rejected when they would
-     *  shadow the home/project overlay roots. */
-    userReadonlyPaths?: readonly string[];
-    /** Keep network egress. Defaults to true for backwards compatibility. */
-    net?: boolean;
     /** Worker-owned Unix socket for the credential-bearing MCP Gateway. */
     mcpGatewaySocketPath?: string;
-}): SandboxSpawn | null;
+}): DirectSandboxSpawn | null;
 /**
- * Re-attach the daemon/worker side to an ALREADY-spawned sandbox session WITHOUT
- * touching the overlays. Used on daemon-restart reattach to a persistent
- * (tmux/herdr/zellij) pane whose bwrap'd CLI is still alive: the CLI is bound to
- * its own namespace-pinned overlay, so we must NOT unmount/remount (that would
- * leave a duplicate host-side mount the CLI isn't using). We only need the outbox
- * path back so the watcher can keep servicing the live CLI's `botmux send`, plus
- * the workDir (upper changeset for landing) and a cleanup that tears the residue
- * down at close/exit. Returns null if the session has no sandbox tree on disk
- * (never sandboxed). Linux-only, mirrors prepareSandbox's layout.
+ * Re-attach the daemon/worker side to an ALREADY-spawned sandbox session (a
+ * live bwrap'd CLI surviving in a tmux/herdr/zellij pane across a daemon
+ * restart). Only the outbox path is needed back so the watcher keeps servicing
+ * the live CLI's `botmux send`, plus a cleanup that removes the tree at
+ * close/exit. Returns null if the session has no sandbox tree on disk (never
+ * sandboxed). Linux-only, mirrors prepareDirectSandbox's layout.
  */
 export declare function attachSandboxOutbox(opts: {
     sessionId: string;
     dataDir: string;
 }): {
     outbox: string;
-    workDir: string;
     cleanup: () => void;
 } | null;
 /**
- * Reclaim leaked sandbox residue.
- *
- * Two classes of leak are reclaimed:
- *  1. NON-ACTIVE orphans — sid not in `activeSessionIds`: the session is gone, so
- *     any leftover mount/dir is pure residue (the original startup-sweep case,
- *     guarding against a daemon crash/kill that skipped killCli()).
- *  2. ACTIVE-but-DEAD — sid IS in `activeSessionIds`, yet NEITHER of its merged
- *     overlays is still mounted. This closes the blind spot where a sandboxed
- *     worker was SIGKILL'd (straggler reaper) or crashed: the session stays
- *     status='active' on disk, so the old "skip if active" rule would let the
- *     leaked upper/work dirs survive across restarts indefinitely. We only GC an
- *     active sid when its mounts are ALREADY gone — we NEVER tear down a live
- *     mount (a CLI persisting in a tmux/herdr/zellij pane is still bound to it),
- *     so a genuinely-live persistent session keeps its changeset.
- *
- * Safe to call repeatedly: wire once at daemon bootstrap AND on a periodic timer
- * (the SIGKILL/straggler path can't run worker-side killCli(), so a startup-only
- * sweep would let a crashed-active session's mount survive for the whole next
- * daemon lifetime — one daemon per bot can run for days).
+ * Reclaim leaked per-session sandbox trees (outbox/shim/empties of sessions
+ * that no longer exist) — plain directory residue in the direct model, no
+ * mounts. Guards: never touch an ACTIVE session's tree (it may be suspended,
+ * intending to resume — its outbox must survive) and never touch a tree
+ * referenced by a live process (a reattached pane whose session record was
+ * lost). Safe to call repeatedly: wired at daemon bootstrap AND on a periodic
+ * timer.
  */
 export declare function sweepOrphanSandboxes(dataDir: string, activeSessionIds: Set<string>): void;
 export interface RelayRequest {
@@ -425,4 +244,5 @@ export declare function startOutboxWatcher(outbox: string, baseEnv: NodeJS.Proce
     };
     cliPath?: string;
 }): () => void;
+export {};
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/adapters/backend/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/sandbox.ts"],"names":[],"mappings":"AA0CA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAqB1G;AAOD;;8EAE8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAc/C;AAED;4EAC4E;AAC5E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CASnD;AAqCD,MAAM,WAAW,WAAW;IAC1B;0FACsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB;2DACuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf;wEACoE;IACpE,gBAAgB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C;;sEAEkE;IAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;sDAEkD;IAClD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;sCAEkC;IAClC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D;;iBAEa;IACb,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD;;6DAEyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAkD5D;AAUD;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,MAAM,EAAE,CAuCX;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,MAAM,qCAAqC,GAC7C;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA4C1D;;;+EAG+E;AAC/E,wBAAgB,qCAAqC,IAAI,qCAAqC,CAiB7F;AAED;kFACkF;AAClF,wBAAgB,8BAA8B,IAAI,OAAO,CAMxD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,0BAA0B,GAAG,IAAI,CAQpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAU7E;AAoDD;;;8DAG8D;AAC9D,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;yEAGyE;AACzE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAW3F;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GACvE,MAAM,EAAE,CAaV;AAcD;+DAC+D;AAC/D,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB;;4DAEwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;yCAYyC;AACzC,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,MAAM,CAkCR;AAED;;;0EAG0E;AAC1E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,SAAwB,GAAG,MAAM,EAAE,CAWrG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAE3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC;;sFAEkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;2EACuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;oEAEgE;IAChE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;qEACiE;IACjE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;4BACwB;IACxB,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;gFAE4E;IAC5E,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,qEAAqE;IACrE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;iDAE6C;IAC7C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yEAAyE;IACzE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,YAAY,GAAG,IAAI,CAmUtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CAkBjJ;AAgCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAqCzF;AAOD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0F1H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,mBAAmB,CAAC,EAAE,MAAM,GAC3B,MAAM,CAAC,UAAU,CAcnB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ;;yEAEqE;IACrE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KACvC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACnE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CACb,GACL,MAAM,IAAI,CAmIZ"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/sandbox.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AA2CpE;gDACgD;AAChD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,MAAM,EAAE,CAkCX;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,MAAM,qCAAqC,GAC7C;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAqC1D,wBAAgB,qCAAqC,IAAI,qCAAqC,CAiB7F;AAED,wBAAgB,8BAA8B,IAAI,OAAO,CAMxD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,0BAA0B,GAAG,IAAI,CAQpC;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAU7E;AAiBD;uDACuD;AACvD,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEhE;AA0BD,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB;gFAC4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;2EAE2E;AAC3E,iBAAS,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CAQlF;AAED;;;;;;;;;;;;;;oDAcoD;AACpD,iBAAS,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqBlD;AAED;;;;;;8CAM8C;AAC9C,iBAAS,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAOpD;AAcD;;;;;;;;2EAQ2E;AAC3E,iBAAS,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,CAyBzF;AAKD,eAAO,MAAM,qBAAqB;;;;;;CAMjC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,QAAQ,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;yEAEqE;IACrE,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,kBAAkB,GAAG,IAAI,CA2K5B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CAehI;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAsBzF;AASD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0F1H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,mBAAmB,CAAC,EAAE,MAAM,GAC3B,MAAM,CAAC,UAAU,CAcnB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ;;yEAEqE;IACrE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KACvC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACnE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CACb,GACL,MAAM,IAAI,CAmIZ"}