@agent-relay/sandbox 0.1.2 → 0.1.3

package/dist/agentcore/config.d.ts

@@ -0,0 +1,156 @@
+/**
+ * SDK-free configuration for the AWS Bedrock AgentCore Code Interpreter adapter.
+ *
+ * Nothing in this module imports `@aws-sdk/client-bedrock-agentcore` or
+ * `@aws-sdk/client-bedrock-agentcore-control`. Consumers can construct and
+ * type-check a configuration without either optional peer dependency
+ * installed.
+ */
+/**
+ * Credentials for the AgentCore control- and data-plane APIs.
+ *
+ * AWS auth is not a single token, and this adapter never falls back to
+ * ambient process state implicitly. A caller gets exactly one of two
+ * explicit choices:
+ *
+ *  - `static`: long-lived IAM user keys, or STS/SSO temporary credentials
+ *    (add `sessionToken` for the latter).
+ *  - `default-chain`: explicit opt-in to the AWS SDK's own credential
+ *    resolution (env vars, shared config file, EC2/ECS/Lambda role, SSO
+ *    cache, etc). This is the standard way to run under an assumed IAM role,
+ *    and it is common enough in AWS-native deployments that refusing it
+ *    outright would be dogmatic — but the adapter never *defaults* to it.
+ *    The caller names it, exactly like every other field here.
+ */
+export type AgentCoreCredentials = {
+    type: "static";
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Required for STS/SSO temporary credentials; omitted for IAM user keys. */
+    sessionToken?: string;
+} | {
+    type: "default-chain";
+};
+/**
+ * Network mode for an owned code interpreter.
+ *
+ * `VPC` is the only mode reachable without an explicit, named opt-in to a
+ * riskier mode. This is deliberate: public research disclosed in March 2026
+ * (BeyondTrust Phantom Labs, corroborated by Unit 42 and the Cloud Security
+ * Alliance) showed that AgentCore's `SANDBOX` network mode still permits
+ * outbound DNS A/AAAA queries even though it blocks general internet
+ * traffic, and that this residual DNS path is enough to build a full
+ * covert command-and-control and data-exfiltration channel out of a
+ * "sandboxed" code interpreter. AWS's own guidance in response was not a
+ * platform-level fix but a documentation update recommending `VPC` mode
+ * plus Route 53 Resolver DNS Firewall for customers who need real
+ * isolation. This adapter encodes that recommendation as the type-level
+ * default: constructing a runtime with `network` omitted, or with `mode`
+ * omitted inside it, resolves to `VPC` and requires `vpc` details, because
+ * there is no safe subnet/security-group default to invent. Reaching
+ * `SANDBOX` (or `PUBLIC`) requires spelling out `mode` explicitly, and doing
+ * so logs a warning that names the hazard.
+ */
+export type AgentCoreNetworkConfig = {
+    mode?: "VPC";
+    vpc: AgentCoreVpcConfig;
+} | {
+    mode: "SANDBOX";
+} | {
+    mode: "PUBLIC";
+};
+export interface AgentCoreVpcConfig {
+    /** At least one subnet the code interpreter's ENIs are placed in. */
+    subnetIds: readonly string[];
+    /** At least one security group applied to those ENIs. */
+    securityGroupIds: readonly string[];
+    /**
+     * Require traffic to Amazon S3 to stay on the service's VPC endpoint
+     * rather than transiting the public internet. Defaults to the provider's
+     * own default when omitted (not asserted here, since that default is not
+     * independently verified).
+     */
+    requireServiceS3Endpoint?: boolean;
+}
+/**
+ * Identifies which code interpreter *environment* a session runs against.
+ *
+ *  - `system`: the AWS-managed default environment (`aws.codeinterpreter.v1`).
+ *    It accepts no execution role and no network configuration of its own —
+ *    those are exclusively properties of a *custom* code interpreter — so
+ *    this adapter's VPC-default and sandbox-mode-warning logic does not
+ *    apply to it. Use it only for workloads with no S3/network requirements.
+ *  - `owned`: a custom code interpreter this runtime creates (once, lazily,
+ *    cached for the life of the runtime instance) and every session it
+ *    starts runs against. This is the path that carries `network` and
+ *    `executionRoleArn`, and the one this adapter is built around.
+ */
+export type AgentCoreInterpreterSource = {
+    type: "system";
+} | {
+    type: "owned";
+    /**
+     * Deterministic name for the owned code interpreter. Fixed rather than
+     * randomly suffixed so a fresh process can rediscover and reuse the
+     * same environment (via `GetCodeInterpreter`) instead of creating a new
+     * one on every restart — AgentCore names must be unique per account and
+     * match `[a-zA-Z][a-zA-Z0-9_]{0,47}`.
+     */
+    name: string;
+    description?: string;
+    /**
+     * IAM role the code interpreter assumes to reach AWS services from
+     * inside a session — required for the S3 large-file path (uploads over
+     * the 100 MB inline limit, up to 5 GB) documented at
+     * https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-s3-integration.html.
+     * The adapter does not create this role: provisioning it (trust policy
+     * for `bedrock-agentcore.amazonaws.com`, `s3:GetObject`/`s3:PutObject`
+     * scoped to the target bucket/prefix) is the caller's or operator's
+     * responsibility, same as `namePrefix` is for other providers' identity
+     * scoping.
+     */
+    executionRoleArn?: string;
+    network: AgentCoreNetworkConfig;
+    tags?: Readonly<Record<string, string>>;
+};
+export interface AgentCoreRuntimeOptions {
+    credentials: AgentCoreCredentials;
+    region: string;
+    interpreter: AgentCoreInterpreterSource;
+    /**
+     * Home directory sessions boot into. Required because no default is
+     * correct for every language runtime the code interpreter selects.
+     */
+    defaultHomeDir: string;
+    /**
+     * Wall-clock lifetime of a session in seconds. AgentCore defaults to 900
+     * (15 minutes) and caps at 28,800 (8 hours) when omitted. Set explicitly
+     * per `launch()` via `LaunchOptions.createTimeoutSeconds`, which takes
+     * precedence when supplied.
+     */
+    sessionTimeoutSeconds?: number;
+    /**
+     * Default environment variables inherited by every command. AgentCore has
+     * no native per-command env parameter (see `runtime.ts`), so these are
+     * applied by shell-prefixing each invocation.
+     */
+    env?: Readonly<Record<string, string>>;
+    /** Fallback per-request deadline for operations without a specific one. */
+    requestTimeoutMs?: number;
+    /** Total deadline for creating (or discovering) the owned code interpreter. */
+    createInterpreterTimeoutMs?: number;
+    /** Total deadline for starting a session. */
+    launchTimeoutMs?: number;
+    /** Total deadline for a lookup (`GetCodeInterpreterSession`). */
+    lookupTimeoutMs?: number;
+    /** Default total deadline for a command when the caller supplies none. */
+    execTimeoutMs?: number;
+    /** Total deadline for a single file upload or download. */
+    fileTimeoutMs?: number;
+    /** Total deadline for stopping a session (destroy). */
+    destroyTimeoutMs?: number;
+}
+export declare function isStaticCredentials(credentials: AgentCoreCredentials): credentials is Extract<AgentCoreCredentials, {
+    type: "static";
+}>;
+//# sourceMappingURL=config.d.ts.map

package/dist/agentcore/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/agentcore/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,CAAC,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IACE,IAAI,EAAE,OAAO,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,sBAAsB,CAAC;IAChC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzC,CAAC;AAEN,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,oBAAoB,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,0BAA0B,CAAC;IACxC;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IASvC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,oBAAoB,GAChC,WAAW,IAAI,OAAO,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAElE"}

package/dist/agentcore/config.js

@@ -0,0 +1,12 @@
+/**
+ * SDK-free configuration for the AWS Bedrock AgentCore Code Interpreter adapter.
+ *
+ * Nothing in this module imports `@aws-sdk/client-bedrock-agentcore` or
+ * `@aws-sdk/client-bedrock-agentcore-control`. Consumers can construct and
+ * type-check a configuration without either optional peer dependency
+ * installed.
+ */
+export function isStaticCredentials(credentials) {
+    return credentials.type === "static";
+}
+//# sourceMappingURL=config.js.map

package/dist/agentcore/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/agentcore/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2JH,MAAM,UAAU,mBAAmB,CACjC,WAAiC;IAEjC,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC;AACvC,CAAC"}

package/dist/agentcore/internal/sdk.d.ts

@@ -0,0 +1,181 @@
+import type { AgentCoreCredentials } from "../config.js";
+/**
+ * The vendor SDK boundary.
+ *
+ * This is the only module in the package that imports
+ * `@aws-sdk/client-bedrock-agentcore` or
+ * `@aws-sdk/client-bedrock-agentcore-control`, and both imports are dynamic
+ * so the dependency stays genuinely optional. Everything above this file
+ * talks to the structural `*Like` interfaces below, which is what makes the
+ * adapter testable without either SDK installed and pinnable to one version.
+ *
+ * AWS splits this surface across two services on purpose: the control plane
+ * (`bedrock-agentcore-control`) manages the code interpreter *resource*
+ * (create/get/delete/list), and the data plane (`bedrock-agentcore`) manages
+ * *sessions* against that resource (start/get/stop/list/invoke). This
+ * module keeps that split rather than flattening it, because the two planes
+ * have different quotas, different endpoints, and — relevant to the
+ * idle-billing question this adapter exists partly to answer — different
+ * billing meters.
+ */
+export type AgentCoreInterpreterStatus = "CREATING" | "CREATE_FAILED" | "READY" | "DELETING" | "DELETE_FAILED" | "DELETED" | (string & {});
+/** Per `GetCodeInterpreterSession`'s documented `Valid Values`. */
+export type AgentCoreSessionStatus = "READY" | "TERMINATED" | (string & {});
+export type AgentCoreNetworkMode = "VPC" | "SANDBOX" | "PUBLIC";
+export interface AgentCoreVpcConfigParams {
+    subnets: string[];
+    securityGroups: string[];
+    requireServiceS3Endpoint?: boolean;
+}
+export interface AgentCoreNetworkConfigParams {
+    networkMode: AgentCoreNetworkMode;
+    vpcConfig?: AgentCoreVpcConfigParams;
+}
+export interface AgentCoreCreateInterpreterParams {
+    name: string;
+    description?: string;
+    executionRoleArn?: string;
+    networkConfiguration: AgentCoreNetworkConfigParams;
+    tags?: Record<string, string>;
+    clientToken?: string;
+    abortSignal?: AbortSignal;
+}
+export interface AgentCoreCreateInterpreterResult {
+    codeInterpreterArn: string;
+    codeInterpreterId: string;
+    createdAt?: Date;
+    status: AgentCoreInterpreterStatus;
+}
+export interface AgentCoreGetInterpreterResult {
+    codeInterpreterId: string;
+    codeInterpreterArn?: string;
+    status: AgentCoreInterpreterStatus;
+    executionRoleArn?: string;
+    networkConfiguration?: AgentCoreNetworkConfigParams;
+    createdAt?: Date;
+    lastUpdatedAt?: Date;
+}
+export interface AgentCoreControlApiLike {
+    createCodeInterpreter(params: AgentCoreCreateInterpreterParams): Promise<AgentCoreCreateInterpreterResult>;
+    getCodeInterpreter(params: {
+        codeInterpreterId: string;
+        abortSignal?: AbortSignal;
+    }): Promise<AgentCoreGetInterpreterResult>;
+    deleteCodeInterpreter(params: {
+        codeInterpreterId: string;
+        clientToken?: string;
+        abortSignal?: AbortSignal;
+    }): Promise<{
+        status: AgentCoreInterpreterStatus;
+    }>;
+    listCodeInterpreters(params: {
+        maxResults?: number;
+        nextToken?: string;
+        abortSignal?: AbortSignal;
+    }): Promise<{
+        items: Array<{
+            codeInterpreterId: string;
+            name?: string;
+            status?: AgentCoreInterpreterStatus;
+        }>;
+        nextToken?: string;
+    }>;
+}
+export interface AgentCoreStartSessionParams {
+    codeInterpreterIdentifier: string;
+    name?: string;
+    sessionTimeoutSeconds?: number;
+    clientToken?: string;
+    abortSignal?: AbortSignal;
+}
+export interface AgentCoreStartSessionResult {
+    codeInterpreterIdentifier: string;
+    sessionId: string;
+    createdAt?: Date;
+}
+export interface AgentCoreGetSessionResult {
+    codeInterpreterIdentifier: string;
+    sessionId: string;
+    name?: string;
+    status: AgentCoreSessionStatus;
+    sessionTimeoutSeconds?: number;
+    createdAt?: Date;
+}
+export interface AgentCoreInvokeContentItem {
+    type: string;
+    text?: string;
+}
+/**
+ * Result of one `InvokeCodeInterpreter` call.
+ *
+ * `structuredContent` is populated for `executeCode`/`executeCommand`
+ * (`stdout`/`stderr`/`exitCode`/`executionTime`, per the AWS Strands/
+ * LangChain integration examples); other actions (`writeFiles`,
+ * `listFiles`) report only `content`/`isError`.
+ */
+export interface AgentCoreInvokeResult {
+    /**
+     * Optional in the vendor type (`CodeInterpreterResult.isError?: boolean`),
+     * not just here — an absent value means "not reported", and callers treat
+     * it as falsy rather than assuming success.
+     */
+    isError?: boolean;
+    content: AgentCoreInvokeContentItem[];
+    structuredContent?: {
+        stdout?: string;
+        stderr?: string;
+        exitCode?: number;
+        executionTime?: number;
+    };
+}
+export interface AgentCoreInvokeParams {
+    codeInterpreterIdentifier: string;
+    sessionId: string;
+    /** Tool/action name: `executeCommand`, `executeCode`, `writeFiles`, `listFiles`, ... */
+    name: string;
+    arguments: Record<string, unknown>;
+    abortSignal?: AbortSignal;
+}
+export interface AgentCoreDataApiLike {
+    startSession(params: AgentCoreStartSessionParams): Promise<AgentCoreStartSessionResult>;
+    getSession(params: {
+        codeInterpreterIdentifier: string;
+        sessionId: string;
+        abortSignal?: AbortSignal;
+    }): Promise<AgentCoreGetSessionResult>;
+    stopSession(params: {
+        codeInterpreterIdentifier: string;
+        sessionId: string;
+        abortSignal?: AbortSignal;
+    }): Promise<void>;
+    invoke(params: AgentCoreInvokeParams): Promise<AgentCoreInvokeResult>;
+}
+export interface AgentCoreApi {
+    control: AgentCoreControlApiLike;
+    data: AgentCoreDataApiLike;
+}
+export type AgentCoreApiFactory = () => Promise<AgentCoreApi> | AgentCoreApi;
+/**
+ * True when the provider reports the named resource (interpreter or
+ * session) as absent.
+ *
+ * Delete verification needs to tell "gone" apart from "the lookup failed";
+ * treating a transport error as absence is how a leaked resource gets
+ * reported as cleaned up.
+ */
+export declare function isAgentCoreNotFoundError(error: unknown): boolean;
+/**
+ * The official clients, bound to injected credentials and region.
+ *
+ * Credentials are resolved exactly once here, from the explicit
+ * `AgentCoreCredentials` union — never from ambient environment variables —
+ * except when the caller has explicitly opted into `{ type: "default-chain" }`,
+ * in which case the AWS SDK's own resolution is exactly what was asked for.
+ *
+ * Each vendor result is assigned **through** the structural type above
+ * rather than cast, so a signature change in the vendor SDK breaks the build
+ * here, in the one file that owns the boundary, instead of surfacing later
+ * as a runtime failure against a live session.
+ */
+export declare function createOfficialAgentCoreApi(credentials: AgentCoreCredentials, region: string): Promise<AgentCoreApi>;
+//# sourceMappingURL=sdk.d.ts.map

package/dist/agentcore/internal/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../src/agentcore/internal/sdk.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,MAAM,0BAA0B,GAClC,UAAU,GACV,eAAe,GACf,OAAO,GACP,UAAU,GACV,eAAe,GACf,SAAS,GACT,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,mEAAmE;AACnE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,oBAAoB,CAAC;IAClC,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC;AAID,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,4BAA4B,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAgC;IAC/C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,EAAE,0BAA0B,CAAC;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,0BAA0B,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACpD,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,qBAAqB,CACnB,MAAM,EAAE,gCAAgC,GACvC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC7C,kBAAkB,CAAC,MAAM,EAAE;QACzB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC3C,qBAAqB,CAAC,MAAM,EAAE;QAC5B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,CAAC,MAAM,EAAE;QAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GAAG,OAAO,CAAC;QACV,KAAK,EAAE,KAAK,CAAC;YAAE,iBAAiB,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,0BAA0B,CAAA;SAAE,CAAC,CAAC;QAChG,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAID,MAAM,WAAW,2BAA2B;IAC1C,yBAAyB,EAAE,MAAM,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,yBAAyB,EAAE,MAAM,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,yBAAyB,EAAE,MAAM,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,sBAAsB,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACtC,iBAAiB,CAAC,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,yBAAyB,EAAE,MAAM,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,CACV,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,UAAU,CAAC,MAAM,EAAE;QACjB,yBAAyB,EAAE,MAAM,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,WAAW,CAAC,MAAM,EAAE;QAClB,yBAAyB,EAAE,MAAM,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,uBAAuB,CAAC;IACjC,IAAI,EAAE,oBAAoB,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;AAE7E;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAiLvB"}

package/dist/agentcore/internal/sdk.js

@@ -0,0 +1,223 @@
+/**
+ * True when the provider reports the named resource (interpreter or
+ * session) as absent.
+ *
+ * Delete verification needs to tell "gone" apart from "the lookup failed";
+ * treating a transport error as absence is how a leaked resource gets
+ * reported as cleaned up.
+ */
+export function isAgentCoreNotFoundError(error) {
+    if (!error || typeof error !== "object") {
+        return false;
+    }
+    const name = error.name;
+    if (name === "ResourceNotFoundException") {
+        return true;
+    }
+    const status = error.$metadata
+        ?.httpStatusCode;
+    return status === 404;
+}
+/**
+ * The official clients, bound to injected credentials and region.
+ *
+ * Credentials are resolved exactly once here, from the explicit
+ * `AgentCoreCredentials` union — never from ambient environment variables —
+ * except when the caller has explicitly opted into `{ type: "default-chain" }`,
+ * in which case the AWS SDK's own resolution is exactly what was asked for.
+ *
+ * Each vendor result is assigned **through** the structural type above
+ * rather than cast, so a signature change in the vendor SDK breaks the build
+ * here, in the one file that owns the boundary, instead of surfacing later
+ * as a runtime failure against a live session.
+ */
+export async function createOfficialAgentCoreApi(credentials, region) {
+    const [{ BedrockAgentCoreControlClient, CreateCodeInterpreterCommand, GetCodeInterpreterCommand, DeleteCodeInterpreterCommand, ListCodeInterpretersCommand }, { BedrockAgentCoreClient, StartCodeInterpreterSessionCommand, GetCodeInterpreterSessionCommand, StopCodeInterpreterSessionCommand, InvokeCodeInterpreterCommand }] = await Promise.all([
+        import("@aws-sdk/client-bedrock-agentcore-control"),
+        import("@aws-sdk/client-bedrock-agentcore"),
+    ]);
+    const clientConfig = {
+        region,
+        ...(credentials.type === "static"
+            ? {
+                credentials: {
+                    accessKeyId: credentials.accessKeyId,
+                    secretAccessKey: credentials.secretAccessKey,
+                    ...(credentials.sessionToken
+                        ? { sessionToken: credentials.sessionToken }
+                        : {}),
+                },
+            }
+            : {}),
+    };
+    const controlClient = new BedrockAgentCoreControlClient(clientConfig);
+    const dataClient = new BedrockAgentCoreClient(clientConfig);
+    const control = {
+        createCodeInterpreter: async (params) => {
+            const res = await controlClient.send(new CreateCodeInterpreterCommand({
+                name: params.name,
+                ...(params.description ? { description: params.description } : {}),
+                ...(params.executionRoleArn
+                    ? { executionRoleArn: params.executionRoleArn }
+                    : {}),
+                networkConfiguration: params.networkConfiguration,
+                ...(params.tags ? { tags: params.tags } : {}),
+                ...(params.clientToken ? { clientToken: params.clientToken } : {}),
+            }), { abortSignal: params.abortSignal });
+            if (!res.codeInterpreterId || !res.status) {
+                throw new Error("AgentCore CreateCodeInterpreter response is missing required fields");
+            }
+            const checked = {
+                codeInterpreterArn: res.codeInterpreterArn ?? "",
+                codeInterpreterId: res.codeInterpreterId,
+                ...(res.createdAt ? { createdAt: new Date(res.createdAt) } : {}),
+                status: res.status,
+            };
+            return checked;
+        },
+        getCodeInterpreter: async (params) => {
+            const res = await controlClient.send(new GetCodeInterpreterCommand({ codeInterpreterId: params.codeInterpreterId }), { abortSignal: params.abortSignal });
+            if (!res.codeInterpreterId || !res.status) {
+                throw new Error("AgentCore GetCodeInterpreter response is missing required fields");
+            }
+            const checked = {
+                codeInterpreterId: res.codeInterpreterId,
+                ...(res.codeInterpreterArn ? { codeInterpreterArn: res.codeInterpreterArn } : {}),
+                status: res.status,
+                ...(res.executionRoleArn ? { executionRoleArn: res.executionRoleArn } : {}),
+                ...(res.networkConfiguration
+                    ? { networkConfiguration: res.networkConfiguration }
+                    : {}),
+                ...(res.createdAt ? { createdAt: new Date(res.createdAt) } : {}),
+                ...(res.lastUpdatedAt ? { lastUpdatedAt: new Date(res.lastUpdatedAt) } : {}),
+            };
+            return checked;
+        },
+        deleteCodeInterpreter: async (params) => {
+            const res = await controlClient.send(new DeleteCodeInterpreterCommand({
+                codeInterpreterId: params.codeInterpreterId,
+                ...(params.clientToken ? { clientToken: params.clientToken } : {}),
+            }), { abortSignal: params.abortSignal });
+            return { status: res.status ?? "DELETING" };
+        },
+        listCodeInterpreters: async (params) => {
+            const res = await controlClient.send(new ListCodeInterpretersCommand({
+                ...(params.maxResults ? { maxResults: params.maxResults } : {}),
+                ...(params.nextToken ? { nextToken: params.nextToken } : {}),
+            }), { abortSignal: params.abortSignal });
+            const summaries = res.codeInterpreterSummaries ?? [];
+            return {
+                items: summaries.map((item) => ({
+                    codeInterpreterId: item.codeInterpreterId ?? "",
+                    ...(item.name ? { name: item.name } : {}),
+                    ...(item.status ? { status: item.status } : {}),
+                })),
+                ...(res.nextToken ? { nextToken: res.nextToken } : {}),
+            };
+        },
+    };
+    const data = {
+        startSession: async (params) => {
+            const res = await dataClient.send(new StartCodeInterpreterSessionCommand({
+                codeInterpreterIdentifier: params.codeInterpreterIdentifier,
+                ...(params.name ? { name: params.name } : {}),
+                ...(params.sessionTimeoutSeconds
+                    ? { sessionTimeoutSeconds: params.sessionTimeoutSeconds }
+                    : {}),
+                ...(params.clientToken ? { clientToken: params.clientToken } : {}),
+            }), { abortSignal: params.abortSignal });
+            if (!res.sessionId || !res.codeInterpreterIdentifier) {
+                throw new Error("AgentCore StartCodeInterpreterSession response is missing required fields");
+            }
+            const checked = {
+                codeInterpreterIdentifier: res.codeInterpreterIdentifier,
+                sessionId: res.sessionId,
+                ...(res.createdAt ? { createdAt: new Date(res.createdAt) } : {}),
+            };
+            return checked;
+        },
+        getSession: async (params) => {
+            const res = await dataClient.send(new GetCodeInterpreterSessionCommand({
+                codeInterpreterIdentifier: params.codeInterpreterIdentifier,
+                sessionId: params.sessionId,
+            }), { abortSignal: params.abortSignal });
+            if (!res.sessionId || !res.codeInterpreterIdentifier || !res.status) {
+                throw new Error("AgentCore GetCodeInterpreterSession response is missing required fields");
+            }
+            const checked = {
+                codeInterpreterIdentifier: res.codeInterpreterIdentifier,
+                sessionId: res.sessionId,
+                ...(res.name ? { name: res.name } : {}),
+                status: res.status,
+                ...(res.sessionTimeoutSeconds
+                    ? { sessionTimeoutSeconds: res.sessionTimeoutSeconds }
+                    : {}),
+                ...(res.createdAt ? { createdAt: new Date(res.createdAt) } : {}),
+            };
+            return checked;
+        },
+        stopSession: async (params) => {
+            await dataClient.send(new StopCodeInterpreterSessionCommand({
+                codeInterpreterIdentifier: params.codeInterpreterIdentifier,
+                sessionId: params.sessionId,
+            }), { abortSignal: params.abortSignal });
+        },
+        invoke: async (params) => {
+            const res = await dataClient.send(new InvokeCodeInterpreterCommand({
+                codeInterpreterIdentifier: params.codeInterpreterIdentifier,
+                sessionId: params.sessionId,
+                // `ToolName` is a closed enum in the vendor types (no `(string &
+                // {})` escape hatch), but `AgentCoreInvokeParams.name` stays a
+                // plain `string` on this side of the boundary so fakes in tests
+                // aren't forced to import the vendor enum. The cast lives here,
+                // at the one place that constructs the vendor command.
+                name: params.name,
+                arguments: params.arguments,
+            }), { abortSignal: params.abortSignal });
+            return collectInvokeStream(res.stream);
+        },
+    };
+    return { control, data };
+}
+/**
+ * `InvokeCodeInterpreter` returns an AWS SDK event stream whose events are a
+ * discriminated union: a success `result` member, or one of several
+ * exception members (`accessDeniedException`, `conflictException`,
+ * `internalServerException`, `resourceNotFoundException`,
+ * `serviceQuotaExceededException`, `throttlingException`,
+ * `validationException`). The AWS SDK is expected to throw these as
+ * rejected promises rather than deliver them as stream data, but the vendor
+ * type models them as reachable stream events regardless — this drains the
+ * whole stream (so the underlying HTTP/2 stream is not left half-read),
+ * surfaces any exception member it finds explicitly rather than silently
+ * skipping it, and keeps the last `result` event otherwise, which is where
+ * a multi-chunk response's final `structuredContent` lands.
+ */
+async function collectInvokeStream(
+// Typed loosely and inspected defensively on purpose: the vendor union
+// (`CodeInterpreterStreamOutput`) has no index signature, and this
+// function's job is precisely to duck-type across its members without
+// depending on which one showed up.
+stream) {
+    let last;
+    if (stream) {
+        for await (const raw of stream) {
+            const event = raw;
+            if (event.result) {
+                last = event.result;
+                continue;
+            }
+            const exceptionKey = Object.keys(event).find((key) => key !== "$unknown" && event[key] !== undefined);
+            if (exceptionKey) {
+                const detail = event[exceptionKey];
+                throw new Error(`AgentCore InvokeCodeInterpreter stream reported ${exceptionKey}: `
+                    + `${detail?.message ?? "(no message)"}`);
+            }
+        }
+    }
+    if (!last) {
+        throw new Error("AgentCore InvokeCodeInterpreter returned no result event");
+    }
+    return last;
+}
+//# sourceMappingURL=sdk.js.map

package/dist/agentcore/internal/sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../../../src/agentcore/internal/sdk.ts"],"names":[],"mappings":"AA4LA;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAI,KAAsD,CAAC,SAAS;QAC9E,EAAE,cAAc,CAAC;IACnB,OAAO,MAAM,KAAK,GAAG,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAiC,EACjC,MAAc;IAEd,MAAM,CAAC,EAAE,6BAA6B,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,EAAE,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,gCAAgC,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,CAAC,GAC9T,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,2CAA2C,CAAC;QACnD,MAAM,CAAC,mCAAmC,CAAC;KAC5C,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG;QACnB,MAAM;QACN,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;YAC/B,CAAC,CAAC;gBACE,WAAW,EAAE;oBACX,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,GAAG,CAAC,WAAW,CAAC,YAAY;wBAC1B,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAE5D,MAAM,OAAO,GAA4B;QACvC,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAClC,IAAI,4BAA4B,CAAC;gBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,gBAAgB;oBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,OAAO,GAAqC;gBAChD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;gBAChD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAClC,IAAI,yBAAyB,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAC9E,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,OAAO,GAAkC;gBAC7C,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,GAAG,CAAC,oBAAoB;oBAC1B,CAAC,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,oBAAoD,EAAE;oBACpF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAClC,IAAI,4BAA4B,CAAC;gBAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,CAAC;QACD,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAClC,IAAI,2BAA2B,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;YACF,MAAM,SAAS,GACb,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;YACrC,OAAO;gBACL,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC9B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,EAAE;oBAC/C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,MAAM,IAAI,GAAyB;QACjC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAC/B,IAAI,kCAAkC,CAAC;gBACrC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;gBAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,qBAAqB;oBAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;oBACzD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,OAAO,GAAgC;gBAC3C,yBAAyB,EAAE,GAAG,CAAC,yBAAyB;gBACxD,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAC/B,IAAI,gCAAgC,CAAC;gBACnC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;gBAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,OAAO,GAA8B;gBACzC,yBAAyB,EAAE,GAAG,CAAC,yBAAyB;gBACxD,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,qBAAqB;oBAC3B,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,EAAE;oBACtD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,UAAU,CAAC,IAAI,CACnB,IAAI,iCAAiC,CAAC;gBACpC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;gBAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAC/B,IAAI,4BAA4B,CAAC;gBAC/B,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;gBAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iEAAiE;gBACjE,+DAA+D;gBAC/D,gEAAgE;gBAChE,gEAAgE;gBAChE,uDAAuD;gBACvD,IAAI,EAAE,MAAM,CAAC,IAA6E;gBAC1F,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CACpC,CAAC;YACF,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB;AAChC,uEAAuE;AACvE,mEAAmE;AACnE,sEAAsE;AACtE,oCAAoC;AACpC,MAA0C;IAE1C,IAAI,IAAuC,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,GAA8B,CAAC;YAC7C,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,GAAG,KAAK,CAAC,MAA+B,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CACxD,CAAC;YACF,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAqC,CAAC;gBACvE,MAAM,IAAI,KAAK,CACb,mDAAmD,YAAY,IAAI;sBAC/D,GAAG,MAAM,EAAE,OAAO,IAAI,cAAc,EAAE,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}