@agent-vm/openclaw-agent-vm-plugin 0.0.92 → 0.0.93

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ControllerRequestPolicy, ControllerRequestPolicyOperation, ControllerRequestPolicyTransportError, ControllerRequestPolicyTransportErrorCode, EndToolVmActiveUseRequest, FetchControllerWithPolicyOptions, HeartbeatToolVmActiveUseRequest, HeartbeatToolVmActiveUseResponse, StartToolVmActiveUseRequest, StartToolVmActiveUseResponse, ToolVmLeasePeek, ToolVmSshLease, drainControllerResponseBody, fetchControllerWithPolicy } from "@agent-vm/gateway-interface";
+import { AgentChannelProviderHealthDetails, AgentChannelProviderHealthKind, AgentVmHealthEvent, ControllerRequestPolicy, ControllerRequestPolicyOperation, ControllerRequestPolicyTransportError, ControllerRequestPolicyTransportErrorCode, EndToolVmActiveUseRequest, FetchControllerWithPolicyOptions, HeartbeatToolVmActiveUseRequest, HeartbeatToolVmActiveUseResponse, StartToolVmActiveUseRequest, StartToolVmActiveUseResponse, ToolVmLeasePeek, ToolVmSshLease, drainControllerResponseBody, fetchControllerWithPolicy } from "@agent-vm/gateway-interface";
 
 //#region src/controller-lease-client.d.ts
 type JsonValue = boolean | null | number | string | {
@@ -432,6 +432,21 @@ declare const plugin: {
   }): void;
 };
 //#endregion
+//#region src/provider-health/agent-channel-provider-health.d.ts
+type AgentChannelProviderHealthEvent = Extract<AgentVmHealthEvent, {
+  readonly kind: 'agent-channel-provider-health';
+}>;
+interface BuildAgentChannelProviderHealthEventOptions {
+  readonly channelProviderId: string;
+  readonly details?: AgentChannelProviderHealthDetails | undefined;
+  readonly health: AgentChannelProviderHealthKind;
+  readonly observedAtMs: number;
+  readonly transitionStartedAtMs?: number | undefined;
+  readonly unhealthySinceMs?: number | undefined;
+  readonly zoneId: string;
+}
+declare function buildAgentChannelProviderHealthEvent(options: BuildAgentChannelProviderHealthEventOptions): AgentChannelProviderHealthEvent;
+//#endregion
 //#region src/openclaw-runtime-status.d.ts
 interface OpenClawRuntimeRequirementFinding {
   readonly hint: string;
@@ -451,5 +466,5 @@ declare function buildOpenClawRuntimeStatusReport(options: {
 //#region src/index.d.ts
 declare const OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME = "@agent-vm/openclaw-agent-vm-plugin";
 //#endregion
-export { ControllerLeaseRequestError, ControllerLeaseRequestErrorKind, type ControllerRequestPolicy, type ControllerRequestPolicyOperation, ControllerRequestPolicyTransportError, type ControllerRequestPolicyTransportErrorCode, type CreateBackendDependencies, type FetchControllerWithPolicyOptions, JsonValue, LeaseClient, OPENCLAW_DEFAULT_AGENT_ID, OPENCLAW_GONDOLIN_LEASE_SCOPE_GUIDANCE, OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME, OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS, OPENCLAW_SSH_SESSION_SCRATCH_ROOT, OpenClawAgentIdError, type OpenClawFsBridgeLeaseContext, OpenClawGondolinAgentConfig, OpenClawGondolinLeaseRequest, OpenClawGondolinLeaseSandboxSnapshot, OpenClawGondolinSandboxRequirement, OpenClawGondolinSandboxRequirementKey, OpenClawGondolinSandboxSnapshot, OpenClawRuntimeStatusReport, type OpenClawSandboxBackendHandle, type OpenClawSandboxFsBridge, ResolvedGondolinPluginConfig, type SshHelpers, buildOpenClawRuntimeStatusReport, createBackendDeps, createGatewayControlLinkMonitor, createGondolinSandboxBackendFactory, createGondolinSandboxBackendManager, createLeaseClient, plugin as default, drainControllerResponseBody, effectiveOpenClawGondolinSandboxValue, fetchControllerWithPolicy, findOpenClawGondolinSandboxMismatch, formatOpenClawGondolinRequirementFieldPath, formatOpenClawGondolinRequirementFindingId, formatOpenClawGondolinRequirementHint, isOpenClawAgentId, isOpenClawAgentSessionKey, normalizeOpenClawAgentId, resolveGondolinPluginConfig, resolveOpenClawAgentIdFromSessionKey, snapshotOpenClawGondolinSandboxConfig };
+export { BuildAgentChannelProviderHealthEventOptions, ControllerLeaseRequestError, ControllerLeaseRequestErrorKind, type ControllerRequestPolicy, type ControllerRequestPolicyOperation, ControllerRequestPolicyTransportError, type ControllerRequestPolicyTransportErrorCode, type CreateBackendDependencies, type FetchControllerWithPolicyOptions, JsonValue, LeaseClient, OPENCLAW_DEFAULT_AGENT_ID, OPENCLAW_GONDOLIN_LEASE_SCOPE_GUIDANCE, OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME, OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS, OPENCLAW_SSH_SESSION_SCRATCH_ROOT, OpenClawAgentIdError, type OpenClawFsBridgeLeaseContext, OpenClawGondolinAgentConfig, OpenClawGondolinLeaseRequest, OpenClawGondolinLeaseSandboxSnapshot, OpenClawGondolinSandboxRequirement, OpenClawGondolinSandboxRequirementKey, OpenClawGondolinSandboxSnapshot, OpenClawRuntimeStatusReport, type OpenClawSandboxBackendHandle, type OpenClawSandboxFsBridge, ResolvedGondolinPluginConfig, type SshHelpers, buildAgentChannelProviderHealthEvent, buildOpenClawRuntimeStatusReport, createBackendDeps, createGatewayControlLinkMonitor, createGondolinSandboxBackendFactory, createGondolinSandboxBackendManager, createLeaseClient, plugin as default, drainControllerResponseBody, effectiveOpenClawGondolinSandboxValue, fetchControllerWithPolicy, findOpenClawGondolinSandboxMismatch, formatOpenClawGondolinRequirementFieldPath, formatOpenClawGondolinRequirementFindingId, formatOpenClawGondolinRequirementHint, isOpenClawAgentId, isOpenClawAgentSessionKey, normalizeOpenClawAgentId, resolveGondolinPluginConfig, resolveOpenClawAgentIdFromSessionKey, snapshotOpenClawGondolinSandboxConfig };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/controller-lease-client.ts","../src/openclaw-gondolin-contract.ts","../src/sandbox-backend/sandbox-backend-contract.ts","../src/sandbox-backend/sandbox-backend-handle-factory.ts","../src/sandbox-backend/sandbox-backend-manager.ts","../src/gondolin-plugin-config.ts","../src/gateway-control-link-monitor.ts","../src/openclaw-sandbox-sdk-contract.ts","../src/openclaw-backend-dependencies.ts","../src/openclaw-plugin-registration.ts","../src/openclaw-runtime-status.ts","../src/index.ts"],"mappings":";;;KAsBY,SAAA;EAAA,UAKG,GAAA,WAAc,SAAA;AAAA,aACjB,SAAA;AAAA,UAEK,2BAAA;EAAA,SACP,QAAA;IAAA,SACC,IAAA;IAAA,SACA,EAAA;IAAA,SACA,EAAA;EAAA;EAAA,SAED,QAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGO,oCAAA;EAAA,SACP,OAAA;EAAA,SACA,IAAA;EAAA,SACA,KAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAGO,4BAAA;EAAA,SACP,OAAA;EAAA,SACA,iBAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,UAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGO,WAAA;EAEhB,YAAA,CAAa,OAAA,UAAiB,KAAA,UAAe,OAAA,EAAS,yBAAA,GAA4B,OAAA;EAClF,kBAAA,CACC,OAAA,UACA,KAAA,UACA,OAAA,EAAS,+BAAA,GACP,OAAA,CAAQ,gCAAA;EACX,SAAA,CAAU,OAAA,WAAkB,OAAA,CAAQ,eAAA;EACpC,4BAAA,EAA8B,MAAA,EAAQ,2BAAA,GAA8B,OAAA;EACpE,YAAA,CAAa,OAAA,UAAiB,OAAA;IAAA,SAAqB,KAAA;EAAA,IAAoB,OAAA;EACvE,UAAA,CAAW,OAAA,WAAkB,OAAA,CAAQ,cAAA;EACrC,YAAA,CAAa,OAAA,EAAS,4BAAA,GAA+B,OAAA,CAAQ,cAAA;EAC7D,cAAA,CACC,OAAA,UACA,OAAA,EAAS,2BAAA,GACP,OAAA,CAAQ,4BAAA;AAAA;AAAA,KAGA,+BAAA;AAAA,cAEC,2BAAA,SAAoC,KAAA;EAAA,SACvC,QAAA;EAAA,SACA,IAAA,EAAM,+BAAA;EAAA,SACN,YAAA,EAAc,SAAA;EAAA,SACd,MAAA;cAEG,OAAA;IAAA,SACF,QAAA;IAAA,SACA,OAAA;IAAA,SACA,YAAA,EAAc,SAAA;IAAA,SACd,MAAA;EAAA;AAAA;AAAA,iBA0IK,iBAAA,CAAkB,OAAA;EAAA,SACxB,aAAA;EAAA,SACA,SAAA,IAAa,KAAA,WAAgB,GAAA,GAAM,OAAA,EAAS,IAAA,GAAO,WAAA,KAAgB,OAAA,CAAQ,QAAA;EAAA,SAC3E,aAAA,GAAgB,uBAAA;AAAA,IACtB,WAAA;;;cCpOS,yBAAA;AAAA,cAEA,sCAAA;EAAA;;;;;;;;;;;;cAOA,sCAAA;AAAA,KAGD,kCAAA,WACH,sCAAA;AAAA,KAEG,qCAAA,GAAwC,kCAAA;AAAA,UAEnC,+BAAA;EAAA,SACP,OAAA;EAAA,SACA,IAAA;EAAA,SACA,KAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAGO,2BAAA;EAAA,SACP,EAAA;EAAA,SACA,OAAA,GAAU,+BAAA;EAAA,SACV,SAAA;AAAA;AAAA,cAGG,oBAAA,SAA6B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAMG,iBAAA,CAAkB,KAAA;AAAA,iBAIlB,qCAAA,CACf,QAAA,EAAU,2BAAA,EACV,WAAA,EAAa,2BAAA,EACb,GAAA,EAAK,qCAAA;AAAA,iBAKU,0CAAA,CACf,KAAA,UACA,GAAA,EAAK,qCAAA;AAAA,iBAKU,0CAAA,CAA2C,OAAA;EAAA,SACjD,SAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAKM,qCAAA,CAAsC,OAAA;EAAA,SAC5C,aAAA;EAAA,SACA,SAAA;EAAA,SACA,EAAA;AAAA;AAAA,iBAOM,wBAAA,CAAyB,KAAA;AAAA,iBAWzB,oCAAA,CAAqC,UAAA;AAAA,iBAUrC,yBAAA,CAA0B,UAAA;AAAA,iBAK1B,qCAAA,CAAsC,GAAA,EAAK,+BAAA;EAAA,SACjD,OAAA;EAAA,SACA,IAAA;EAAA,SACA,KAAA;EAAA,SACA,eAAA;AAAA;AAAA,iBAUM,mCAAA,CACf,OAAA,EAAS,+BAAA,GACP,kCAAA;;;UClHc,4BAAA;EAAA,SACP,uBAAA;EAAA,SACA,kBAAA;EAAA,SACA,oBAAA,GAAuB,MAAA;IAAA,SACtB,YAAA;IAAA,SACA,IAAA;IAAA,SACA,MAAA;IAAA,SACA,MAAA,GAAS,WAAA;IAAA,SACT,KAAA,GAAQ,MAAA;EAAA,MACZ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;AAAA;AAAA,UAIF,uBAAA;EAChB,MAAA,CAAO,MAAA;IAAA,SACG,GAAA;IAAA,SACA,QAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;EACJ,QAAA,CAAS,MAAA;IAAA,SACC,GAAA;IAAA,SACA,QAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA,CAAQ,MAAA;EACZ,MAAA,CAAO,MAAA;IAAA,SACG,GAAA;IAAA,SACA,QAAA;IAAA,SACA,KAAA;IAAA,SACA,SAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;EACJ,MAAA,CAAO,MAAA;IAAA,SACG,GAAA;IAAA,SACA,IAAA;IAAA,SACA,MAAA,GAAS,WAAA;IAAA,SACT,EAAA;EAAA,IACN,OAAA;EACJ,WAAA,CAAY,MAAA;IAAA,SAAmB,GAAA;IAAA,SAAuB,QAAA;EAAA;IAAA,SAC5C,aAAA;IAAA,SACA,YAAA;EAAA;EAEV,IAAA,CAAK,MAAA;IAAA,SACK,GAAA;IAAA,SACA,QAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;IAAA,SACM,OAAA;IAAA,SACA,IAAA;IAAA,SACA,IAAA;EAAA;EAEV,SAAA,CAAU,MAAA;IAAA,SACA,GAAA;IAAA,SACA,IAAA,EAAM,MAAA;IAAA,SACN,QAAA,GAAW,cAAA;IAAA,SACX,QAAA;IAAA,SACA,KAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;AAAA;AAAA,UAGY,yBAAA;EAAA,SACP,aAAA,GAAgB,MAAA;IAAA,SACf,OAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,GAAA,EAAK,cAAA;IAAA,SACL,MAAA;IAAA,SACA,OAAA;EAAA,MACJ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,aAAA;IAAA,SACA,SAAA;EAAA;EAAA,SAED,qBAAA,IACR,YAAA,EAAc,4BAAA,MACT,MAAA;IAAA,SAAmB,OAAA;EAAA,MAAuB,uBAAA;EAAA,SACvC,iBAAA,IAAqB,OAAA;IAAA,SAAoB,aAAA;EAAA,MAA4B,WAAA;EAAA,SACrE,oBAAA,GAAuB,MAAA;IAAA,SACtB,YAAA;IAAA,SACA,MAAA;IAAA,SACA,MAAA,GAAS,WAAA;IAAA,SACT,GAAA,EAAK,cAAA;IAAA,SACL,KAAA,GAAQ,MAAA;EAAA,MACZ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;AAAA;AAAA,UAIF,4BAAA;EAAA,SACP,WAAA;EAAA,SACA,eAAA;EAAA,SACA,cAAA,IAAkB,MAAA;IAAA,SAAmB,OAAA;EAAA,MAAuB,uBAAA;EAAA,SAC5D,GAAA,GAAM,MAAA;EAAA,SACN,EAAA;EAAA,SACA,SAAA;EAAA,SACA,YAAA;EAAA,SACA,OAAA;EACT,aAAA,CAAc,MAAA;IAAA,SACJ,OAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,MAAA;IAAA,SACA,OAAA;EAAA,IACN,OAAA;IAAA,SACM,IAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,aAAA;IAAA,SACA,SAAA;EAAA;EAAA,SAED,YAAA,IAAgB,MAAA;IAAA,SACf,QAAA;IAAA,SACA,MAAA;IAAA,SACA,QAAA;IAAA,SACA,KAAA;EAAA,MACJ,OAAA;EACN,eAAA,CAAgB,MAAA;IAAA,SAAmB,MAAA;EAAA,IAAmB,OAAA;IAAA,SAC5C,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;AAAA;;;iBC8GH,mCAAA,CACf,OAAA;EAAA,SACU,aAAA;EAAA,SACA,mCAAA;EAAA,SACA,6BAAA,SAAsC,2BAAA;EAAA,SACtC,6BAAA,SAAsC,MAAA;EAAA,SACtC,wBAAA;EAAA,SACA,SAAA;EAAA,SACA,MAAA;AAAA,GAEV,YAAA,EAAc,yBAAA,IACX,MAAA;EAAA,SACM,iBAAA;EAAA,SACA,GAAA,EAAK,+BAAA;IAAA,SACJ,MAAA;MAAA,SACC,GAAA,GAAM,MAAA;IAAA;EAAA;EAAA,SAKR,QAAA;EAAA,SACA,UAAA;EAAA,SACA,YAAA;AAAA,MACJ,OAAA,CAAQ,4BAAA;;;iBChQE,mCAAA,CACf,OAAA;EAAA,SACU,aAAA;EAAA,SACA,MAAA;AAAA,GAEV,YAAA,EAAc,yBAAA;EAEd,eAAA,GAAkB,MAAA;IAAA,SACR,KAAA;MAAA,SAAkB,aAAA;IAAA;EAAA,MACtB,OAAA;IAAA,SAAmB,gBAAA;IAAA,SAAoC,OAAA;EAAA;EAC7D,aAAA,GAAgB,MAAA;IAAA,SAAmB,KAAA;MAAA,SAAkB,aAAA;IAAA;EAAA,MAA8B,OAAA;AAAA;;;UCbnE,4BAAA;EAAA,SACP,aAAA;EAAA,SACA,yBAAA;IAAA,SACC,cAAA;IAAA,SACA,OAAA;IAAA,SACA,aAAA;EAAA;EAAA,SAED,SAAA;EAAA,SACA,YAAA;EAAA,SACA,eAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAOM,2BAAA,CACf,MAAA,EAAQ,MAAA,oBACN,4BAAA;;;UCZc,yBAAA;EAChB,uBAAA;EACA,kBAAA;EACA,KAAA;EACA,IAAA;EACA,IAAA,IAAQ,OAAA;AAAA;AAAA,UAGQ,sCAAA;EAAA,SACP,cAAA;EAAA,SACA,gBAAA,IAAoB,KAAA,EAAO,MAAA,CAAO,OAAA;EAAA,SAClC,aAAA;EAAA,SACA,SAAA,IAAa,KAAA,WAAgB,GAAA,GAAM,OAAA,EAAS,IAAA,GAAO,WAAA,KAAgB,OAAA,CAAQ,QAAA;EAAA,SAC3E,aAAA;EAAA,SACA,GAAA;EAAA,SACA,cAAA,IACR,QAAA,eAAuB,OAAA,QACvB,OAAA,aACI,MAAA,CAAO,OAAA;EAAA,SACH,QAAA,IAAY,OAAA;EAAA,SACZ,MAAA;AAAA;AAAA,iBAoBM,+BAAA,CACf,OAAA,EAAS,sCAAA,GACP,yBAAA;;;UCjDc,iBAAA;EAAA,SACP,OAAA;EAAA,SACA,UAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,UAAA;EAAA,SACP,sBAAA,GAAyB,MAAA;IAAA,SACxB,OAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,OAAA;EAAA;EAAA,SAED,kBAAA,GAAqB,IAAA;EAAA,SACrB,mBAAA,GAAsB,MAAA;IAAA,SACrB,aAAA;IAAA,SACA,OAAA,EAAS,iBAAA;IAAA,SACT,GAAA;EAAA;EAAA,SAED,gCAAA,GAAmC,MAAA;IAAA,SAClC,OAAA;MAAA,SACC,uBAAA;MAAA,SACA,kBAAA;MAAA,SACA,oBAAA,GAAuB,WAAA;QAAA,SACtB,YAAA;QAAA,SACA,IAAA;QAAA,SACA,MAAA;QAAA,SACA,MAAA,GAAS,WAAA;QAAA,SACT,KAAA,GAAQ,MAAA;MAAA,MACZ,OAAA;QAAA,SACI,IAAA;QAAA,SACA,MAAA,EAAQ,MAAA;QAAA,SACR,MAAA,EAAQ,MAAA;MAAA;IAAA;IAAA,SAGV,OAAA;EAAA,MANK,uBAAA;EAAA,SAQN,mCAAA,GAAsC,QAAA;IAAA,SACrC,OAAA;IAAA,SACA,YAAA;IAAA,SACA,qBAAA;IAAA,SACA,MAAA;IAAA,SACA,cAAA;IAAA,SACA,aAAA;EAAA,MACJ,OAAA,CAAQ,iBAAA;EAAA,SACL,wBAAA,IAA4B,OAAA,EAAS,iBAAA,KAAsB,OAAA;EAAA,SAC3D,oBAAA,GAAuB,MAAA;IAAA,SACtB,YAAA;IAAA,SACA,aAAA;IAAA,SACA,OAAA,EAAS,iBAAA;IAAA,SACT,MAAA,GAAS,WAAA;IAAA,SACT,KAAA,GAAQ,MAAA;EAAA,MACZ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;EAAA,SAET,eAAA,GAAkB,GAAA,EAAK,MAAA,CAAO,UAAA;IAAA,SAC7B,OAAA,EAAS,MAAA;EAAA;AAAA;AAAA,UAIH,wBAAA;EAAA,SACP,WAAA;EAAA,SACA,OAAA,GAAU,UAAA,UAAoB,MAAA,cAAoB,OAAA,CAAQ,kBAAA;EAAA,SAC1D,IAAA;EAAA,SACA,UAAA,EAAY,MAAA;AAAA;AAAA,UAGL,+BAAA;EAAA,SACP,IAAA;EAAA,SACA,KAAA;EAAA,SACA,QAAA;AAAA;AAAA,UAGO,kBAAA;EAAA,SACP,OAAA;EAAA,SACA,OAAA;AAAA;AAAA,UAGO,2BAAA;EAAA,SACP,YAAA,IACR,IAAA,EAAM,wBAAA,EACN,OAAA,GAAU,+BAAA;AAAA;;;cC3EC,iCAAA;AAAA,iBAEG,iBAAA,CAAkB,GAAA,EAAK,UAAA;EAAA,SAC7B,aAAA,EAAe,yBAAA;EAAA,SACf,qBAAA,GACR,YAAA,EAAc,4BAAA,MACT,MAAA;IAAA,SAAmB,OAAA;EAAA,MAAuB,uBAAA;EAAA,SACvC,oBAAA,EAAsB,yBAAA;AAAA;;;cCc1B,MAAA;;;;;aAMK,MAAA,GAAS,MAAA;IAAA,SACT,YAAA,EAAc,MAAA;IAAA,SACd,YAAA,GAAe,2BAAA;IAAA,SACf,gBAAA;IAAA,SACA,OAAA;MAAA,SACC,MAAA;QAAA,SACC,OAAA,SAAgB,MAAA;MAAA;IAAA;EAAA;AAAA;;;UCvBZ,iCAAA;EAAA,SACP,IAAA;EAAA,SACA,EAAA;EAAA,SACA,EAAA;AAAA;AAAA,UAGO,6BAAA;EAAA,SACP,QAAA,WAAmB,iCAAA;EAAA,SACnB,QAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAsDM,gCAAA,CAAiC,OAAA;EAAA,SACvC,MAAA,EAAQ,MAAA;EAAA,SACR,MAAA;AAAA,IACN,6BAAA;;;cCzES,qCAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/controller-lease-client.ts","../src/openclaw-gondolin-contract.ts","../src/sandbox-backend/sandbox-backend-contract.ts","../src/sandbox-backend/sandbox-backend-handle-factory.ts","../src/sandbox-backend/sandbox-backend-manager.ts","../src/gondolin-plugin-config.ts","../src/gateway-control-link-monitor.ts","../src/openclaw-sandbox-sdk-contract.ts","../src/openclaw-backend-dependencies.ts","../src/openclaw-plugin-registration.ts","../src/provider-health/agent-channel-provider-health.ts","../src/openclaw-runtime-status.ts","../src/index.ts"],"mappings":";;;KAsBY,SAAA;EAAA,UAKG,GAAA,WAAc,SAAA;AAAA,aACjB,SAAA;AAAA,UAEK,2BAAA;EAAA,SACP,QAAA;IAAA,SACC,IAAA;IAAA,SACA,EAAA;IAAA,SACA,EAAA;EAAA;EAAA,SAED,QAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGO,oCAAA;EAAA,SACP,OAAA;EAAA,SACA,IAAA;EAAA,SACA,KAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAGO,4BAAA;EAAA,SACP,OAAA;EAAA,SACA,iBAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,UAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGO,WAAA;EAEhB,YAAA,CAAa,OAAA,UAAiB,KAAA,UAAe,OAAA,EAAS,yBAAA,GAA4B,OAAA;EAClF,kBAAA,CACC,OAAA,UACA,KAAA,UACA,OAAA,EAAS,+BAAA,GACP,OAAA,CAAQ,gCAAA;EACX,SAAA,CAAU,OAAA,WAAkB,OAAA,CAAQ,eAAA;EACpC,4BAAA,EAA8B,MAAA,EAAQ,2BAAA,GAA8B,OAAA;EACpE,YAAA,CAAa,OAAA,UAAiB,OAAA;IAAA,SAAqB,KAAA;EAAA,IAAoB,OAAA;EACvE,UAAA,CAAW,OAAA,WAAkB,OAAA,CAAQ,cAAA;EACrC,YAAA,CAAa,OAAA,EAAS,4BAAA,GAA+B,OAAA,CAAQ,cAAA;EAC7D,cAAA,CACC,OAAA,UACA,OAAA,EAAS,2BAAA,GACP,OAAA,CAAQ,4BAAA;AAAA;AAAA,KAGA,+BAAA;AAAA,cAEC,2BAAA,SAAoC,KAAA;EAAA,SACvC,QAAA;EAAA,SACA,IAAA,EAAM,+BAAA;EAAA,SACN,YAAA,EAAc,SAAA;EAAA,SACd,MAAA;cAEG,OAAA;IAAA,SACF,QAAA;IAAA,SACA,OAAA;IAAA,SACA,YAAA,EAAc,SAAA;IAAA,SACd,MAAA;EAAA;AAAA;AAAA,iBA0IK,iBAAA,CAAkB,OAAA;EAAA,SACxB,aAAA;EAAA,SACA,SAAA,IAAa,KAAA,WAAgB,GAAA,GAAM,OAAA,EAAS,IAAA,GAAO,WAAA,KAAgB,OAAA,CAAQ,QAAA;EAAA,SAC3E,aAAA,GAAgB,uBAAA;AAAA,IACtB,WAAA;;;cCpOS,yBAAA;AAAA,cAEA,sCAAA;EAAA;;;;;;;;;;;;cAOA,sCAAA;AAAA,KAGD,kCAAA,WACH,sCAAA;AAAA,KAEG,qCAAA,GAAwC,kCAAA;AAAA,UAEnC,+BAAA;EAAA,SACP,OAAA;EAAA,SACA,IAAA;EAAA,SACA,KAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAGO,2BAAA;EAAA,SACP,EAAA;EAAA,SACA,OAAA,GAAU,+BAAA;EAAA,SACV,SAAA;AAAA;AAAA,cAGG,oBAAA,SAA6B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAMG,iBAAA,CAAkB,KAAA;AAAA,iBAIlB,qCAAA,CACf,QAAA,EAAU,2BAAA,EACV,WAAA,EAAa,2BAAA,EACb,GAAA,EAAK,qCAAA;AAAA,iBAKU,0CAAA,CACf,KAAA,UACA,GAAA,EAAK,qCAAA;AAAA,iBAKU,0CAAA,CAA2C,OAAA;EAAA,SACjD,SAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAKM,qCAAA,CAAsC,OAAA;EAAA,SAC5C,aAAA;EAAA,SACA,SAAA;EAAA,SACA,EAAA;AAAA;AAAA,iBAOM,wBAAA,CAAyB,KAAA;AAAA,iBAWzB,oCAAA,CAAqC,UAAA;AAAA,iBAUrC,yBAAA,CAA0B,UAAA;AAAA,iBAK1B,qCAAA,CAAsC,GAAA,EAAK,+BAAA;EAAA,SACjD,OAAA;EAAA,SACA,IAAA;EAAA,SACA,KAAA;EAAA,SACA,eAAA;AAAA;AAAA,iBAUM,mCAAA,CACf,OAAA,EAAS,+BAAA,GACP,kCAAA;;;UClHc,4BAAA;EAAA,SACP,uBAAA;EAAA,SACA,kBAAA;EAAA,SACA,oBAAA,GAAuB,MAAA;IAAA,SACtB,YAAA;IAAA,SACA,IAAA;IAAA,SACA,MAAA;IAAA,SACA,MAAA,GAAS,WAAA;IAAA,SACT,KAAA,GAAQ,MAAA;EAAA,MACZ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;AAAA;AAAA,UAIF,uBAAA;EAChB,MAAA,CAAO,MAAA;IAAA,SACG,GAAA;IAAA,SACA,QAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;EACJ,QAAA,CAAS,MAAA;IAAA,SACC,GAAA;IAAA,SACA,QAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA,CAAQ,MAAA;EACZ,MAAA,CAAO,MAAA;IAAA,SACG,GAAA;IAAA,SACA,QAAA;IAAA,SACA,KAAA;IAAA,SACA,SAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;EACJ,MAAA,CAAO,MAAA;IAAA,SACG,GAAA;IAAA,SACA,IAAA;IAAA,SACA,MAAA,GAAS,WAAA;IAAA,SACT,EAAA;EAAA,IACN,OAAA;EACJ,WAAA,CAAY,MAAA;IAAA,SAAmB,GAAA;IAAA,SAAuB,QAAA;EAAA;IAAA,SAC5C,aAAA;IAAA,SACA,YAAA;EAAA;EAEV,IAAA,CAAK,MAAA;IAAA,SACK,GAAA;IAAA,SACA,QAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;IAAA,SACM,OAAA;IAAA,SACA,IAAA;IAAA,SACA,IAAA;EAAA;EAEV,SAAA,CAAU,MAAA;IAAA,SACA,GAAA;IAAA,SACA,IAAA,EAAM,MAAA;IAAA,SACN,QAAA,GAAW,cAAA;IAAA,SACX,QAAA;IAAA,SACA,KAAA;IAAA,SACA,MAAA,GAAS,WAAA;EAAA,IACf,OAAA;AAAA;AAAA,UAGY,yBAAA;EAAA,SACP,aAAA,GAAgB,MAAA;IAAA,SACf,OAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,GAAA,EAAK,cAAA;IAAA,SACL,MAAA;IAAA,SACA,OAAA;EAAA,MACJ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,aAAA;IAAA,SACA,SAAA;EAAA;EAAA,SAED,qBAAA,IACR,YAAA,EAAc,4BAAA,MACT,MAAA;IAAA,SAAmB,OAAA;EAAA,MAAuB,uBAAA;EAAA,SACvC,iBAAA,IAAqB,OAAA;IAAA,SAAoB,aAAA;EAAA,MAA4B,WAAA;EAAA,SACrE,oBAAA,GAAuB,MAAA;IAAA,SACtB,YAAA;IAAA,SACA,MAAA;IAAA,SACA,MAAA,GAAS,WAAA;IAAA,SACT,GAAA,EAAK,cAAA;IAAA,SACL,KAAA,GAAQ,MAAA;EAAA,MACZ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;AAAA;AAAA,UAIF,4BAAA;EAAA,SACP,WAAA;EAAA,SACA,eAAA;EAAA,SACA,cAAA,IAAkB,MAAA;IAAA,SAAmB,OAAA;EAAA,MAAuB,uBAAA;EAAA,SAC5D,GAAA,GAAM,MAAA;EAAA,SACN,EAAA;EAAA,SACA,SAAA;EAAA,SACA,YAAA;EAAA,SACA,OAAA;EACT,aAAA,CAAc,MAAA;IAAA,SACJ,OAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,MAAA;IAAA,SACA,OAAA;EAAA,IACN,OAAA;IAAA,SACM,IAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,aAAA;IAAA,SACA,SAAA;EAAA;EAAA,SAED,YAAA,IAAgB,MAAA;IAAA,SACf,QAAA;IAAA,SACA,MAAA;IAAA,SACA,QAAA;IAAA,SACA,KAAA;EAAA,MACJ,OAAA;EACN,eAAA,CAAgB,MAAA;IAAA,SAAmB,MAAA;EAAA,IAAmB,OAAA;IAAA,SAC5C,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;AAAA;;;iBC8GH,mCAAA,CACf,OAAA;EAAA,SACU,aAAA;EAAA,SACA,mCAAA;EAAA,SACA,6BAAA,SAAsC,2BAAA;EAAA,SACtC,6BAAA,SAAsC,MAAA;EAAA,SACtC,wBAAA;EAAA,SACA,SAAA;EAAA,SACA,MAAA;AAAA,GAEV,YAAA,EAAc,yBAAA,IACX,MAAA;EAAA,SACM,iBAAA;EAAA,SACA,GAAA,EAAK,+BAAA;IAAA,SACJ,MAAA;MAAA,SACC,GAAA,GAAM,MAAA;IAAA;EAAA;EAAA,SAKR,QAAA;EAAA,SACA,UAAA;EAAA,SACA,YAAA;AAAA,MACJ,OAAA,CAAQ,4BAAA;;;iBChQE,mCAAA,CACf,OAAA;EAAA,SACU,aAAA;EAAA,SACA,MAAA;AAAA,GAEV,YAAA,EAAc,yBAAA;EAEd,eAAA,GAAkB,MAAA;IAAA,SACR,KAAA;MAAA,SAAkB,aAAA;IAAA;EAAA,MACtB,OAAA;IAAA,SAAmB,gBAAA;IAAA,SAAoC,OAAA;EAAA;EAC7D,aAAA,GAAgB,MAAA;IAAA,SAAmB,KAAA;MAAA,SAAkB,aAAA;IAAA;EAAA,MAA8B,OAAA;AAAA;;;UCbnE,4BAAA;EAAA,SACP,aAAA;EAAA,SACA,yBAAA;IAAA,SACC,cAAA;IAAA,SACA,OAAA;IAAA,SACA,aAAA;EAAA;EAAA,SAED,SAAA;EAAA,SACA,YAAA;EAAA,SACA,eAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAOM,2BAAA,CACf,MAAA,EAAQ,MAAA,oBACN,4BAAA;;;UCZc,yBAAA;EAChB,uBAAA;EACA,kBAAA;EACA,KAAA;EACA,IAAA;EACA,IAAA,IAAQ,OAAA;AAAA;AAAA,UAGQ,sCAAA;EAAA,SACP,cAAA;EAAA,SACA,gBAAA,IAAoB,KAAA,EAAO,MAAA,CAAO,OAAA;EAAA,SAClC,aAAA;EAAA,SACA,SAAA,IAAa,KAAA,WAAgB,GAAA,GAAM,OAAA,EAAS,IAAA,GAAO,WAAA,KAAgB,OAAA,CAAQ,QAAA;EAAA,SAC3E,aAAA;EAAA,SACA,GAAA;EAAA,SACA,cAAA,IACR,QAAA,eAAuB,OAAA,QACvB,OAAA,aACI,MAAA,CAAO,OAAA;EAAA,SACH,QAAA,IAAY,OAAA;EAAA,SACZ,MAAA;AAAA;AAAA,iBAoBM,+BAAA,CACf,OAAA,EAAS,sCAAA,GACP,yBAAA;;;UCjDc,iBAAA;EAAA,SACP,OAAA;EAAA,SACA,UAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,UAAA;EAAA,SACP,sBAAA,GAAyB,MAAA;IAAA,SACxB,OAAA;IAAA,SACA,GAAA,EAAK,MAAA;IAAA,SACL,OAAA;EAAA;EAAA,SAED,kBAAA,GAAqB,IAAA;EAAA,SACrB,mBAAA,GAAsB,MAAA;IAAA,SACrB,aAAA;IAAA,SACA,OAAA,EAAS,iBAAA;IAAA,SACT,GAAA;EAAA;EAAA,SAED,gCAAA,GAAmC,MAAA;IAAA,SAClC,OAAA;MAAA,SACC,uBAAA;MAAA,SACA,kBAAA;MAAA,SACA,oBAAA,GAAuB,WAAA;QAAA,SACtB,YAAA;QAAA,SACA,IAAA;QAAA,SACA,MAAA;QAAA,SACA,MAAA,GAAS,WAAA;QAAA,SACT,KAAA,GAAQ,MAAA;MAAA,MACZ,OAAA;QAAA,SACI,IAAA;QAAA,SACA,MAAA,EAAQ,MAAA;QAAA,SACR,MAAA,EAAQ,MAAA;MAAA;IAAA;IAAA,SAGV,OAAA;EAAA,MANK,uBAAA;EAAA,SAQN,mCAAA,GAAsC,QAAA;IAAA,SACrC,OAAA;IAAA,SACA,YAAA;IAAA,SACA,qBAAA;IAAA,SACA,MAAA;IAAA,SACA,cAAA;IAAA,SACA,aAAA;EAAA,MACJ,OAAA,CAAQ,iBAAA;EAAA,SACL,wBAAA,IAA4B,OAAA,EAAS,iBAAA,KAAsB,OAAA;EAAA,SAC3D,oBAAA,GAAuB,MAAA;IAAA,SACtB,YAAA;IAAA,SACA,aAAA;IAAA,SACA,OAAA,EAAS,iBAAA;IAAA,SACT,MAAA,GAAS,WAAA;IAAA,SACT,KAAA,GAAQ,MAAA;EAAA,MACZ,OAAA;IAAA,SACI,IAAA;IAAA,SACA,MAAA,EAAQ,MAAA;IAAA,SACR,MAAA,EAAQ,MAAA;EAAA;EAAA,SAET,eAAA,GAAkB,GAAA,EAAK,MAAA,CAAO,UAAA;IAAA,SAC7B,OAAA,EAAS,MAAA;EAAA;AAAA;AAAA,UAIH,wBAAA;EAAA,SACP,WAAA;EAAA,SACA,OAAA,GAAU,UAAA,UAAoB,MAAA,cAAoB,OAAA,CAAQ,kBAAA;EAAA,SAC1D,IAAA;EAAA,SACA,UAAA,EAAY,MAAA;AAAA;AAAA,UAGL,+BAAA;EAAA,SACP,IAAA;EAAA,SACA,KAAA;EAAA,SACA,QAAA;AAAA;AAAA,UAGO,kBAAA;EAAA,SACP,OAAA;EAAA,SACA,OAAA;AAAA;AAAA,UAGO,2BAAA;EAAA,SACP,YAAA,IACR,IAAA,EAAM,wBAAA,EACN,OAAA,GAAU,+BAAA;AAAA;;;cC3EC,iCAAA;AAAA,iBAEG,iBAAA,CAAkB,GAAA,EAAK,UAAA;EAAA,SAC7B,aAAA,EAAe,yBAAA;EAAA,SACf,qBAAA,GACR,YAAA,EAAc,4BAAA,MACT,MAAA;IAAA,SAAmB,OAAA;EAAA,MAAuB,uBAAA;EAAA,SACvC,oBAAA,EAAsB,yBAAA;AAAA;;;cCc1B,MAAA;;;;;aAMK,MAAA,GAAS,MAAA;IAAA,SACT,YAAA,EAAc,MAAA;IAAA,SACd,YAAA,GAAe,2BAAA;IAAA,SACf,gBAAA;IAAA,SACA,OAAA;MAAA,SACC,MAAA;QAAA,SACC,OAAA,SAAgB,MAAA;MAAA;IAAA;EAAA;AAAA;;;KChCxB,+BAAA,GAAkC,OAAA,CACtC,kBAAA;EAAA,SACW,IAAA;AAAA;AAAA,UAGK,2CAAA;EAAA,SACP,iBAAA;EAAA,SACA,OAAA,GAAU,iCAAA;EAAA,SACV,MAAA,EAAQ,8BAAA;EAAA,SACR,YAAA;EAAA,SACA,qBAAA;EAAA,SACA,gBAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAGM,oCAAA,CACf,OAAA,EAAS,2CAAA,GACP,+BAAA;;;UCRc,iCAAA;EAAA,SACP,IAAA;EAAA,SACA,EAAA;EAAA,SACA,EAAA;AAAA;AAAA,UAGO,6BAAA;EAAA,SACP,QAAA,WAAmB,iCAAA;EAAA,SACnB,QAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAsDM,gCAAA,CAAiC,OAAA;EAAA,SACvC,MAAA,EAAQ,MAAA;EAAA,SACR,MAAA;AAAA,IACN,6BAAA;;;cCxES,qCAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import path from "node:path/posix";
-import { ControllerRequestPolicyTransportError, OPENCLAW_STATE_SANDBOXES_VM_ROOT, TOOL_VM_SCRATCH_GUEST_ROOT, TOOL_VM_WORKSPACE_GUEST_ROOT, createToolVmActiveUseHandle, drainControllerResponseBody, fetchControllerWithPolicy, gatewayControlLinkHealthPins, isToolVmLeasePeek, isToolVmSshLease, translateRuntimePath } from "@agent-vm/gateway-interface";
+import { ControllerRequestPolicyTransportError, OPENCLAW_STATE_SANDBOXES_VM_ROOT, TOOL_VM_SCRATCH_GUEST_ROOT, TOOL_VM_WORKSPACE_GUEST_ROOT, createToolVmActiveUseHandle, drainControllerResponseBody, fetchControllerWithPolicy, gatewayControlLinkHealthPins, isAgentVmHealthEvent, isToolVmLeasePeek, isToolVmSshLease, translateRuntimePath } from "@agent-vm/gateway-interface";
 import { z } from "zod";
 //#region src/controller-lease-client.ts
 var ControllerLeaseRequestError = class extends Error {
@@ -1508,9 +1508,38 @@ const plugin = {
 	}
 };
 //#endregion
+//#region src/provider-health/agent-channel-provider-health.ts
+function buildAgentChannelProviderHealthEvent(options) {
+	const event = {
+		channelProviderId: options.channelProviderId,
+		...options.details === void 0 ? {} : { details: options.details },
+		health: options.health,
+		kind: "agent-channel-provider-health",
+		observedAtMs: options.observedAtMs,
+		result: resultForChannelProviderHealth(options.health),
+		...options.transitionStartedAtMs === void 0 ? {} : { transitionStartedAtMs: options.transitionStartedAtMs },
+		...options.unhealthySinceMs === void 0 ? {} : { unhealthySinceMs: options.unhealthySinceMs },
+		zoneId: options.zoneId
+	};
+	if (!isAgentVmHealthEvent(event)) throw new Error("Channel-provider health event requires whitelisted and redacted channel-provider health details.");
+	return event;
+}
+function resultForChannelProviderHealth(health) {
+	switch (health) {
+		case "healthy":
+		case "transitioning": return "ok";
+		case "unhealthy-recoverable":
+		case "unhealthy-unrecoverable": return "failed";
+	}
+	return assertNeverAgentChannelProviderHealth(health);
+}
+function assertNeverAgentChannelProviderHealth(health) {
+	throw new Error(`Unhandled agent channel provider health: ${String(health)}`);
+}
+//#endregion
 //#region src/index.ts
 const OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME = "@agent-vm/openclaw-agent-vm-plugin";
 //#endregion
-export { ControllerLeaseRequestError, ControllerRequestPolicyTransportError, OPENCLAW_DEFAULT_AGENT_ID, OPENCLAW_GONDOLIN_LEASE_SCOPE_GUIDANCE, OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME, OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS, OPENCLAW_SSH_SESSION_SCRATCH_ROOT, OpenClawAgentIdError, buildOpenClawRuntimeStatusReport, createBackendDeps, createGatewayControlLinkMonitor, createGondolinSandboxBackendFactory, createGondolinSandboxBackendManager, createLeaseClient, plugin as default, drainControllerResponseBody, effectiveOpenClawGondolinSandboxValue, fetchControllerWithPolicy, findOpenClawGondolinSandboxMismatch, formatOpenClawGondolinRequirementFieldPath, formatOpenClawGondolinRequirementFindingId, formatOpenClawGondolinRequirementHint, isOpenClawAgentId, isOpenClawAgentSessionKey, normalizeOpenClawAgentId, resolveGondolinPluginConfig, resolveOpenClawAgentIdFromSessionKey, snapshotOpenClawGondolinSandboxConfig };
+export { ControllerLeaseRequestError, ControllerRequestPolicyTransportError, OPENCLAW_DEFAULT_AGENT_ID, OPENCLAW_GONDOLIN_LEASE_SCOPE_GUIDANCE, OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME, OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS, OPENCLAW_SSH_SESSION_SCRATCH_ROOT, OpenClawAgentIdError, buildAgentChannelProviderHealthEvent, buildOpenClawRuntimeStatusReport, createBackendDeps, createGatewayControlLinkMonitor, createGondolinSandboxBackendFactory, createGondolinSandboxBackendManager, createLeaseClient, plugin as default, drainControllerResponseBody, effectiveOpenClawGondolinSandboxValue, fetchControllerWithPolicy, findOpenClawGondolinSandboxMismatch, formatOpenClawGondolinRequirementFieldPath, formatOpenClawGondolinRequirementFindingId, formatOpenClawGondolinRequirementHint, isOpenClawAgentId, isOpenClawAgentSessionKey, normalizeOpenClawAgentId, resolveGondolinPluginConfig, resolveOpenClawAgentIdFromSessionKey, snapshotOpenClawGondolinSandboxConfig };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["formatUnknownError","formatUnknownError","defaultWriteLog","isObjectRecord"],"sources":["../src/controller-lease-client.ts","../src/openclaw-gondolin-contract.ts","../src/sandbox-backend/openclaw-agent-workspace-source.ts","../src/sandbox-backend/openclaw-tool-vm-path-mapping.ts","../src/sandbox-backend/sandbox-shell-script.ts","../src/sandbox-backend/tool-vm-ssh-operation-guard.ts","../src/sandbox-backend/sandbox-backend-handle-factory.ts","../src/sandbox-backend/sandbox-backend-manager.ts","../src/gondolin-plugin-config.ts","../src/gateway-control-link-monitor.ts","../src/openclaw-backend-dependencies.ts","../src/openclaw-runtime-status.ts","../src/openclaw-sandbox-sdk-contract.ts","../src/zone-git-tool.ts","../src/openclaw-plugin-registration.ts","../src/index.ts"],"sourcesContent":["import {\n\tisToolVmLeasePeek,\n\tisToolVmSshLease,\n\ttype ToolVmLeasePeek,\n\ttype ToolVmSshLease,\n} from '@agent-vm/gateway-interface';\nimport type {\n\tEndToolVmActiveUseRequest,\n\tHeartbeatToolVmActiveUseRequest,\n\tHeartbeatToolVmActiveUseResponse,\n\tStartToolVmActiveUseRequest,\n\tStartToolVmActiveUseResponse,\n} from '@agent-vm/gateway-interface';\nimport { z } from 'zod';\n\nimport {\n\tdrainControllerResponseBody,\n\tfetchControllerWithPolicy,\n\ttype ControllerRequestPolicy,\n\ttype ControllerRequestPolicyOperation,\n} from './controller-request-policy.js';\n\nexport type JsonValue =\n\t| boolean\n\t| null\n\t| number\n\t| string\n\t| { readonly [key: string]: JsonValue }\n\t| readonly JsonValue[];\n\nexport interface OpenClawRuntimeStatusReport {\n\treadonly findings: readonly {\n\t\treadonly hint: string;\n\t\treadonly id: string;\n\t\treadonly ok: boolean;\n\t}[];\n\treadonly pluginId: 'gondolin';\n\treadonly zoneId: string;\n}\n\nexport interface OpenClawGondolinLeaseSandboxSnapshot {\n\treadonly backend: unknown;\n\treadonly mode: unknown;\n\treadonly scope: unknown;\n\treadonly workspaceAccess: unknown;\n}\n\nexport interface OpenClawGondolinLeaseRequest {\n\treadonly agentId: string;\n\treadonly agentWorkspaceDir: string;\n\treadonly idleTtlMs?: number;\n\treadonly profileId: string;\n\treadonly sessionKey: string;\n\treadonly workMountDir: string;\n\treadonly zoneId: string;\n}\n\nexport interface LeaseClient {\n\t// Cached handles use renewLease; read-only runtime probes use peekLease.\n\tendActiveUse(leaseId: string, useId: string, request: EndToolVmActiveUseRequest): Promise<void>;\n\theartbeatActiveUse(\n\t\tleaseId: string,\n\t\tuseId: string,\n\t\trequest: HeartbeatToolVmActiveUseRequest,\n\t): Promise<HeartbeatToolVmActiveUseResponse>;\n\tpeekLease(leaseId: string): Promise<ToolVmLeasePeek>;\n\tpublishOpenClawRuntimeStatus?(report: OpenClawRuntimeStatusReport): Promise<void>;\n\treleaseLease(leaseId: string, options?: { readonly force?: boolean }): Promise<void>;\n\trenewLease(leaseId: string): Promise<ToolVmSshLease>;\n\trequestLease(request: OpenClawGondolinLeaseRequest): Promise<ToolVmSshLease>;\n\tstartActiveUse(\n\t\tleaseId: string,\n\t\trequest: StartToolVmActiveUseRequest,\n\t): Promise<StartToolVmActiveUseResponse>;\n}\n\nexport type ControllerLeaseRequestErrorKind = 'client-error' | 'server-error';\n\nexport class ControllerLeaseRequestError extends Error {\n\treadonly bodyText: string;\n\treadonly kind: ControllerLeaseRequestErrorKind;\n\treadonly responseBody: JsonValue | undefined;\n\treadonly status: number;\n\n\tconstructor(options: {\n\t\treadonly bodyText: string;\n\t\treadonly context: string;\n\t\treadonly responseBody: JsonValue | undefined;\n\t\treadonly status: number;\n\t}) {\n\t\tconst kind: ControllerLeaseRequestErrorKind =\n\t\t\toptions.status >= 400 && options.status < 500 ? 'client-error' : 'server-error';\n\t\tsuper(\n\t\t\t`${options.context} returned HTTP ${String(options.status)} (${kind})${formatStructuredErrorSuffix(\n\t\t\t\toptions.responseBody,\n\t\t\t)}`,\n\t\t);\n\t\tthis.bodyText = options.bodyText;\n\t\tthis.kind = kind;\n\t\tthis.responseBody = options.responseBody;\n\t\tthis.status = options.status;\n\t}\n}\n\nconst structuredControllerErrorSchema = z.object({\n\tguidance: z.string().trim().min(1).optional(),\n\tmessage: z.string().trim().min(1).optional(),\n});\n\nfunction isJsonObjectRecord(value: unknown): value is { readonly [key: string]: JsonValue } {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t!Array.isArray(value) &&\n\t\tObject.values(value).every(isJsonValue)\n\t);\n}\n\nfunction isJsonValue(value: unknown): value is JsonValue {\n\tif (\n\t\tvalue === null ||\n\t\ttypeof value === 'string' ||\n\t\ttypeof value === 'boolean' ||\n\t\ttypeof value === 'number'\n\t) {\n\t\treturn true;\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.every(isJsonValue);\n\t}\n\treturn isJsonObjectRecord(value);\n}\n\nconst jsonValueSchema = z.custom<JsonValue>(isJsonValue);\n\nfunction objectValue(value: unknown): object | undefined {\n\treturn typeof value === 'object' && value !== null ? value : undefined;\n}\n\nfunction formatStructuredErrorSuffix(responseBody: JsonValue | undefined): string {\n\tconst parsedError = structuredControllerErrorSchema.safeParse(responseBody);\n\tif (!parsedError.success) {\n\t\treturn '';\n\t}\n\tconst { guidance, message } = parsedError.data;\n\tconst parts = [message, guidance ? `Guidance: ${guidance}` : undefined].filter(\n\t\t(part): part is string => part !== undefined,\n\t);\n\treturn parts.length > 0 ? `: ${parts.join(' ')}` : '';\n}\n\nfunction isStartActiveUseResponse(value: unknown): value is StartToolVmActiveUseResponse {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'expiresAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'heartbeatAfterMs') === 'number' &&\n\t\ttypeof Reflect.get(record, 'useId') === 'string'\n\t);\n}\n\nfunction isHeartbeatActiveUseResponse(value: unknown): value is HeartbeatToolVmActiveUseResponse {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'expiresAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'heartbeatAfterMs') === 'number'\n\t);\n}\n\nfunction formatUnknownError(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction writeLeaseClientLog(message: string): void {\n\tprocess.stderr.write(`[openclaw-agent-vm-plugin] ${message}\\n`);\n}\n\nfunction parseJsonBody(bodyText: string, context: string): JsonValue | undefined {\n\ttry {\n\t\tconst parsedJson: unknown = JSON.parse(bodyText);\n\t\tconst parsedBody = jsonValueSchema.safeParse(parsedJson);\n\t\treturn parsedBody.success ? parsedBody.data : undefined;\n\t} catch (error) {\n\t\twriteLeaseClientLog(`${context} returned a non-JSON error body: ${formatUnknownError(error)}`);\n\t\treturn undefined;\n\t}\n}\n\nasync function readErrorBody(\n\tresponse: Response,\n\tcontext: string,\n): Promise<{\n\treadonly bodyText: string;\n\treadonly responseBody: JsonValue | undefined;\n}> {\n\tconst bodyText = await response.text().catch(() => '(unreadable)');\n\treturn {\n\t\tbodyText,\n\t\tresponseBody: bodyText === '(unreadable)' ? undefined : parseJsonBody(bodyText, context),\n\t};\n}\n\nasync function readJsonResponse<TValue>(\n\tresponse: Response,\n\tcontext: string,\n\tisExpectedResponse: (value: unknown) => value is TValue,\n): Promise<TValue> {\n\tif (!response.ok) {\n\t\tconst errorBody = await readErrorBody(response, context);\n\t\tthrow new ControllerLeaseRequestError({\n\t\t\tbodyText: errorBody.bodyText,\n\t\t\tcontext,\n\t\t\tresponseBody: errorBody.responseBody,\n\t\t\tstatus: response.status,\n\t\t});\n\t}\n\tconst payload = await response.json();\n\tif (!isExpectedResponse(payload)) {\n\t\tthrow new TypeError(\n\t\t\t`${context} returned an invalid response: ${JSON.stringify(payload).slice(0, 200)}`,\n\t\t);\n\t}\n\treturn payload;\n}\n\nexport function createLeaseClient(options: {\n\treadonly controllerUrl: string;\n\treadonly fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\treadonly requestPolicy?: ControllerRequestPolicy | undefined;\n}): LeaseClient {\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\tconst baseUrl = options.controllerUrl.replace(/\\/$/u, '');\n\tconst fetchController = async (optionsForRequest: {\n\t\treadonly init?: RequestInit | undefined;\n\t\treadonly input: string | URL | Request;\n\t\treadonly operation: ControllerRequestPolicyOperation;\n\t}): Promise<Response> =>\n\t\tawait fetchControllerWithPolicy({\n\t\t\tfetchImpl,\n\t\t\tinput: optionsForRequest.input,\n\t\t\toperation: optionsForRequest.operation,\n\t\t\t...(optionsForRequest.init === undefined ? {} : { init: optionsForRequest.init }),\n\t\t\t...(options.requestPolicy === undefined ? {} : { policy: options.requestPolicy }),\n\t\t});\n\n\tconst renewLease = async (leaseId: string): Promise<ToolVmSshLease> => {\n\t\tconst response = await fetchController({\n\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/renew`,\n\t\t\tinit: {\n\t\t\t\tmethod: 'POST',\n\t\t\t},\n\t\t\toperation: 'lease-renew',\n\t\t});\n\t\treturn await readJsonResponse(response, 'Controller lease renew API', isToolVmSshLease);\n\t};\n\n\treturn {\n\t\tendActiveUse: async (\n\t\t\tleaseId: string,\n\t\t\tuseId: string,\n\t\t\trequest: EndToolVmActiveUseRequest,\n\t\t): Promise<void> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/uses/${encodeURIComponent(useId)}`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(request),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'DELETE',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-use-end',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tconst errorBody = await readErrorBody(response, 'Controller active-use end API');\n\t\t\t\tthrow new ControllerLeaseRequestError({\n\t\t\t\t\tbodyText: errorBody.bodyText,\n\t\t\t\t\tcontext: 'Controller active-use end API',\n\t\t\t\t\tresponseBody: errorBody.responseBody,\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t});\n\t\t\t}\n\t\t\tawait drainControllerResponseBody(response);\n\t\t},\n\t\theartbeatActiveUse: async (\n\t\t\tleaseId: string,\n\t\t\tuseId: string,\n\t\t\trequest: HeartbeatToolVmActiveUseRequest,\n\t\t): Promise<HeartbeatToolVmActiveUseResponse> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/uses/${encodeURIComponent(useId)}/heartbeat`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(request),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-heartbeat',\n\t\t\t});\n\t\t\treturn await readJsonResponse(\n\t\t\t\tresponse,\n\t\t\t\t'Controller active-use heartbeat API',\n\t\t\t\tisHeartbeatActiveUseResponse,\n\t\t\t);\n\t\t},\n\t\trenewLease,\n\t\tpeekLease: async (leaseId: string): Promise<ToolVmLeasePeek> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/peek`,\n\t\t\t\toperation: 'lease-peek',\n\t\t\t});\n\t\t\treturn await readJsonResponse(response, 'Controller lease peek API', isToolVmLeasePeek);\n\t\t},\n\t\tpublishOpenClawRuntimeStatus: async (report): Promise<void> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/zones/${encodeURIComponent(report.zoneId)}/openclaw-runtime-status`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(report),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'openclaw-runtime-status',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tconst errorBody = await readErrorBody(response, 'Controller OpenClaw runtime status API');\n\t\t\t\tthrow new ControllerLeaseRequestError({\n\t\t\t\t\tbodyText: errorBody.bodyText,\n\t\t\t\t\tcontext: 'Controller OpenClaw runtime status API',\n\t\t\t\t\tresponseBody: errorBody.responseBody,\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t});\n\t\t\t}\n\t\t\tawait drainControllerResponseBody(response);\n\t\t},\n\t\treleaseLease: async (\n\t\t\tleaseId: string,\n\t\t\treleaseOptions: { readonly force?: boolean } = {},\n\t\t): Promise<void> => {\n\t\t\tconst releaseUrl = new URL(`${baseUrl}/lease/${encodeURIComponent(leaseId)}`);\n\t\t\tif (releaseOptions.force === true) {\n\t\t\t\treleaseUrl.searchParams.set('force', 'true');\n\t\t\t}\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: releaseUrl.toString(),\n\t\t\t\tinit: {\n\t\t\t\t\tmethod: 'DELETE',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-release',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tconst errorBody = await readErrorBody(response, 'Controller lease release API');\n\t\t\t\tthrow new ControllerLeaseRequestError({\n\t\t\t\t\tbodyText: errorBody.bodyText,\n\t\t\t\t\tcontext: 'Controller lease release API',\n\t\t\t\t\tresponseBody: errorBody.responseBody,\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t});\n\t\t\t}\n\t\t\tawait drainControllerResponseBody(response);\n\t\t},\n\t\trequestLease: async (request): Promise<ToolVmSshLease> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tagentId: request.agentId,\n\t\t\t\t\t\tagentWorkspaceDir: request.agentWorkspaceDir,\n\t\t\t\t\t\t...(request.idleTtlMs !== undefined ? { idleTtlMs: request.idleTtlMs } : {}),\n\t\t\t\t\t\tprofileId: request.profileId,\n\t\t\t\t\t\tsessionKey: request.sessionKey,\n\t\t\t\t\t\tworkMountDir: request.workMountDir,\n\t\t\t\t\t\tzoneId: request.zoneId,\n\t\t\t\t\t}),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-create',\n\t\t\t});\n\t\t\treturn await readJsonResponse(response, 'Controller lease API', isToolVmSshLease);\n\t\t},\n\t\tstartActiveUse: async (\n\t\t\tleaseId: string,\n\t\t\trequest: StartToolVmActiveUseRequest,\n\t\t): Promise<StartToolVmActiveUseResponse> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/uses`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(request),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-use-start',\n\t\t\t});\n\t\t\treturn await readJsonResponse(\n\t\t\t\tresponse,\n\t\t\t\t'Controller active-use start API',\n\t\t\t\tisStartActiveUseResponse,\n\t\t\t);\n\t\t},\n\t};\n}\n","const agentIdPattern = /^[a-z0-9][a-z0-9_-]{0,63}$/iu;\n\nexport const OPENCLAW_DEFAULT_AGENT_ID = 'main';\n\nexport const OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS = [\n\t{ expectedValue: 'gondolin', key: 'backend' },\n\t{ expectedValue: 'all', key: 'mode' },\n\t{ expectedValue: 'agent', key: 'scope' },\n\t{ expectedValue: 'rw', key: 'workspaceAccess' },\n] as const;\n\nexport const OPENCLAW_GONDOLIN_LEASE_SCOPE_GUIDANCE =\n\t'Managed OpenClaw/Gondolin leases are agent-scoped. The plugin derives agentId from sessionKey and does not send OpenClaw scope keys to the controller.';\n\nexport type OpenClawGondolinSandboxRequirement =\n\t(typeof OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS)[number];\n\nexport type OpenClawGondolinSandboxRequirementKey = OpenClawGondolinSandboxRequirement['key'];\n\nexport interface OpenClawGondolinSandboxSnapshot {\n\treadonly backend?: unknown;\n\treadonly mode?: unknown;\n\treadonly scope?: unknown;\n\treadonly workspaceAccess?: unknown;\n}\n\nexport interface OpenClawGondolinAgentConfig {\n\treadonly id?: unknown;\n\treadonly sandbox?: OpenClawGondolinSandboxSnapshot;\n\treadonly workspace?: unknown;\n}\n\nexport class OpenClawAgentIdError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = 'OpenClawAgentIdError';\n\t}\n}\n\nexport function isOpenClawAgentId(value: string): boolean {\n\treturn agentIdPattern.test(value.trim());\n}\n\nexport function effectiveOpenClawGondolinSandboxValue(\n\tdefaults: OpenClawGondolinAgentConfig,\n\tagentConfig: OpenClawGondolinAgentConfig,\n\tkey: OpenClawGondolinSandboxRequirementKey,\n): unknown {\n\treturn agentConfig.sandbox?.[key] ?? defaults.sandbox?.[key];\n}\n\nexport function formatOpenClawGondolinRequirementFieldPath(\n\tlabel: string,\n\tkey: OpenClawGondolinSandboxRequirementKey,\n): string {\n\treturn `agents.${label}.sandbox.${key}`;\n}\n\nexport function formatOpenClawGondolinRequirementFindingId(options: {\n\treadonly fieldPath: string;\n\treadonly label: string;\n\treadonly zoneId: string;\n}): string {\n\treturn `openclaw-tool-vm-${options.fieldPath.replace(/[.[\\]]/gu, '-')}-${options.zoneId}-${options.label}`;\n}\n\nexport function formatOpenClawGondolinRequirementHint(options: {\n\treadonly expectedValue: string;\n\treadonly fieldPath: string;\n\treadonly ok: boolean;\n}): string {\n\treturn options.ok\n\t\t? `${options.fieldPath}=${options.expectedValue}`\n\t\t: `Set ${options.fieldPath} to \"${options.expectedValue}\" for OpenClaw Tool VM mediation.`;\n}\n\nexport function normalizeOpenClawAgentId(value: string | undefined | null): string {\n\tconst trimmed = (value ?? '').trim().toLowerCase();\n\tif (trimmed === '') {\n\t\treturn OPENCLAW_DEFAULT_AGENT_ID;\n\t}\n\tif (!isOpenClawAgentId(trimmed)) {\n\t\tthrow new OpenClawAgentIdError(`Invalid OpenClaw agentId '${value}'.`);\n\t}\n\treturn trimmed;\n}\n\nexport function resolveOpenClawAgentIdFromSessionKey(sessionKey: string): string {\n\tconst parts = sessionKey.trim().split(':');\n\tif (parts[0] !== 'agent' || !parts[1] || !isOpenClawAgentId(parts[1])) {\n\t\tthrow new OpenClawAgentIdError(\n\t\t\t`OpenClaw sessionKey '${sessionKey}' must be agent-shaped and include a valid agentId.`,\n\t\t);\n\t}\n\treturn normalizeOpenClawAgentId(parts[1]);\n}\n\nexport function isOpenClawAgentSessionKey(sessionKey: string): boolean {\n\tconst parts = sessionKey.trim().split(':');\n\treturn parts[0] === 'agent' && parts[1] !== undefined && isOpenClawAgentId(parts[1]);\n}\n\nexport function snapshotOpenClawGondolinSandboxConfig(cfg: OpenClawGondolinSandboxSnapshot): {\n\treadonly backend: unknown;\n\treadonly mode: unknown;\n\treadonly scope: unknown;\n\treadonly workspaceAccess: unknown;\n} {\n\treturn {\n\t\tbackend: cfg.backend,\n\t\tmode: cfg.mode,\n\t\tscope: cfg.scope,\n\t\tworkspaceAccess: cfg.workspaceAccess,\n\t};\n}\n\nexport function findOpenClawGondolinSandboxMismatch(\n\tsandbox: OpenClawGondolinSandboxSnapshot,\n): OpenClawGondolinSandboxRequirement | undefined {\n\treturn OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS.find(\n\t\t(requirement) => sandbox[requirement.key] !== requirement.expectedValue,\n\t);\n}\n","import path from 'node:path/posix';\n\nimport {\n\tOPENCLAW_STATE_SANDBOXES_VM_ROOT,\n\tTOOL_VM_SCRATCH_GUEST_ROOT,\n\tTOOL_VM_WORKSPACE_GUEST_ROOT,\n} from '@agent-vm/gateway-interface';\n\nimport { normalizeOpenClawAgentId } from '../openclaw-gondolin-contract.js';\n\nexport interface OpenClawAgentWorkspaceConfig {\n\treadonly agents?: {\n\t\treadonly defaults?: {\n\t\t\treadonly workspace?: unknown;\n\t\t};\n\t\treadonly list?: readonly unknown[];\n\t};\n}\n\nexport type OpenClawAgentWorkspaceSourceKind =\n\t| 'configured-agent-workspace'\n\t| 'default-agent-workspace'\n\t| 'default-workspace-child'\n\t| 'sdk-agent-workspace'\n\t| 'state-workspace-child';\n\nexport interface OpenClawAgentWorkspaceSource {\n\treadonly kind: OpenClawAgentWorkspaceSourceKind;\n\treadonly sourceDir: string;\n}\n\nexport class OpenClawAgentWorkspaceSourceError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = 'OpenClawAgentWorkspaceSourceError';\n\t}\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction normalizeAbsolutePosixPath(inputPath: string): string {\n\tconst segments = inputPath.split('/').filter((segment) => segment !== '' && segment !== '.');\n\treturn `/${segments.join('/')}`;\n}\n\nfunction containsParentTraversal(inputPath: string): boolean {\n\treturn inputPath.split(/\\/+/u).includes('..');\n}\n\nfunction pathIsInsideOrEqual(inputPath: string, rootPath: string): boolean {\n\treturn inputPath === rootPath || inputPath.startsWith(`${rootPath}/`);\n}\n\nfunction isRuntimePathLeak(inputPath: string, defaultWorkspaceDir: string | undefined): boolean {\n\tconst normalized = normalizeAbsolutePosixPath(inputPath);\n\tconst normalizedDefaultWorkspace =\n\t\tdefaultWorkspaceDir === undefined\n\t\t\t? undefined\n\t\t\t: normalizeAbsolutePosixPath(resolveUserPathLikeOpenClaw(defaultWorkspaceDir));\n\tconst implicitWorkspaceFamilyRoot =\n\t\tnormalizedDefaultWorkspace === undefined\n\t\t\t? undefined\n\t\t\t: normalizedDefaultWorkspace.replace(/(?:-[^/]+)?$/u, '');\n\treturn (\n\t\tnormalized === TOOL_VM_WORKSPACE_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_WORKSPACE_GUEST_ROOT}/`) ||\n\t\tnormalized === TOOL_VM_SCRATCH_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_SCRATCH_GUEST_ROOT}/`) ||\n\t\tnormalized === OPENCLAW_STATE_SANDBOXES_VM_ROOT ||\n\t\tnormalized.startsWith(`${OPENCLAW_STATE_SANDBOXES_VM_ROOT}/`) ||\n\t\t(normalizedDefaultWorkspace !== undefined &&\n\t\t\t(pathIsInsideOrEqual(normalized, normalizedDefaultWorkspace) ||\n\t\t\t\tnormalized.startsWith(`${normalizedDefaultWorkspace}-`))) ||\n\t\t(implicitWorkspaceFamilyRoot !== undefined &&\n\t\t\t(pathIsInsideOrEqual(normalized, implicitWorkspaceFamilyRoot) ||\n\t\t\t\tnormalized.startsWith(`${implicitWorkspaceFamilyRoot}-`)))\n\t);\n}\n\nfunction resolveUserPathLikeOpenClaw(inputPath: string): string {\n\tconst trimmedPath = inputPath.trim();\n\tconst homeDirectory = process.env.HOME?.trim();\n\tif (trimmedPath === '~' && homeDirectory) {\n\t\treturn homeDirectory;\n\t}\n\tif (trimmedPath.startsWith('~/') && homeDirectory) {\n\t\treturn path.resolve(path.join(homeDirectory, trimmedPath.slice(2)));\n\t}\n\treturn path.resolve(trimmedPath);\n}\n\nfunction assertCanonicalSourcePath(inputPath: string, context: string): string {\n\tconst trimmedPath = inputPath.trim();\n\tif (trimmedPath === '' || containsParentTraversal(trimmedPath)) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must be a non-empty path without parent traversal.`,\n\t\t);\n\t}\n\tif (!trimmedPath.startsWith('/') && !trimmedPath.startsWith('~')) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must be an absolute or home-relative path.`,\n\t\t);\n\t}\n\tconst resolvedPath = resolveUserPathLikeOpenClaw(trimmedPath);\n\tconst normalized = normalizeAbsolutePosixPath(resolvedPath);\n\tif (\n\t\tnormalized === '/' ||\n\t\tnormalized === TOOL_VM_WORKSPACE_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_WORKSPACE_GUEST_ROOT}/`) ||\n\t\tnormalized === TOOL_VM_SCRATCH_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_SCRATCH_GUEST_ROOT}/`)\n\t) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must resolve to an OpenClaw/Gondolin source path, not Tool VM guest path '${normalized}'.`,\n\t\t);\n\t}\n\tif (\n\t\tnormalized === OPENCLAW_STATE_SANDBOXES_VM_ROOT ||\n\t\tnormalized.startsWith(`${OPENCLAW_STATE_SANDBOXES_VM_ROOT}/`)\n\t) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must resolve to a stable agent workspace path, not transient OpenClaw sandbox path '${normalized}'.`,\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction assertLeaseBackedSourcePath(\n\tinputPath: string,\n\tcontext: string,\n\tdefaultWorkspaceDir: string | undefined,\n): string {\n\tconst normalized = assertCanonicalSourcePath(inputPath, context);\n\tif (isRuntimePathLeak(normalized, defaultWorkspaceDir)) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must resolve to a controller lease-backed OpenClaw/Gondolin source path, not OpenClaw runtime fallback path '${normalized}'.`,\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction readWorkspace(value: unknown): string | undefined {\n\treturn typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;\n}\n\nfunction readAgentId(value: unknown): string {\n\treturn normalizeOpenClawAgentId(typeof value === 'string' ? value : undefined);\n}\n\nfunction agentEntries(\n\tconfig: OpenClawAgentWorkspaceConfig | undefined,\n): readonly Record<string, unknown>[] {\n\treturn config?.agents?.list?.filter(isRecord) ?? [];\n}\n\nfunction findAgentEntry(\n\tconfig: OpenClawAgentWorkspaceConfig | undefined,\n\tagentId: string,\n): Record<string, unknown> | undefined {\n\treturn agentEntries(config).find((entry) => readAgentId(entry.id) === agentId);\n}\n\nfunction resolveDefaultAgentId(config: OpenClawAgentWorkspaceConfig | undefined): string {\n\tconst entries = agentEntries(config);\n\tconst defaultEntry = entries.find((entry) => entry.default === true);\n\tconst fallbackEntry = defaultEntry ?? entries[0];\n\treturn readAgentId(fallbackEntry?.id);\n}\n\nexport function resolveOpenClawAgentWorkspaceSource(options: {\n\treadonly agentId: string;\n\treadonly defaultWorkspaceDir: string | undefined;\n\treadonly openClawConfig: OpenClawAgentWorkspaceConfig | undefined;\n\treadonly paramsAgentWorkspaceDir: string;\n\treadonly stateDir: string | undefined;\n}): OpenClawAgentWorkspaceSource {\n\tconst agentId = normalizeOpenClawAgentId(options.agentId);\n\tconst agentEntry = findAgentEntry(options.openClawConfig, agentId);\n\tconst agentWorkspace = readWorkspace(agentEntry?.workspace);\n\tif (agentWorkspace !== undefined) {\n\t\treturn {\n\t\t\tkind: 'configured-agent-workspace',\n\t\t\tsourceDir: assertLeaseBackedSourcePath(\n\t\t\t\tagentWorkspace,\n\t\t\t\t`agents.list workspace for '${agentId}'`,\n\t\t\t\toptions.defaultWorkspaceDir,\n\t\t\t),\n\t\t};\n\t}\n\n\tconst defaultsWorkspace = readWorkspace(options.openClawConfig?.agents?.defaults?.workspace);\n\tif (defaultsWorkspace !== undefined) {\n\t\tconst defaultsRoot = assertLeaseBackedSourcePath(\n\t\t\tdefaultsWorkspace,\n\t\t\t'agents.defaults.workspace',\n\t\t\toptions.defaultWorkspaceDir,\n\t\t);\n\t\tconst defaultAgentId = resolveDefaultAgentId(options.openClawConfig);\n\t\treturn {\n\t\t\tkind: agentId === defaultAgentId ? 'default-agent-workspace' : 'default-workspace-child',\n\t\t\tsourceDir: agentId === defaultAgentId ? defaultsRoot : path.join(defaultsRoot, agentId),\n\t\t};\n\t}\n\n\tif (!isRuntimePathLeak(options.paramsAgentWorkspaceDir, options.defaultWorkspaceDir)) {\n\t\treturn {\n\t\t\tkind: 'sdk-agent-workspace',\n\t\t\tsourceDir: assertCanonicalSourcePath(\n\t\t\t\toptions.paramsAgentWorkspaceDir,\n\t\t\t\t'OpenClaw backend agentWorkspaceDir',\n\t\t\t),\n\t\t};\n\t}\n\n\tconst stateRoot =\n\t\toptions.stateDir === undefined\n\t\t\t? undefined\n\t\t\t: assertCanonicalSourcePath(options.stateDir, 'OpenClaw stateDir');\n\tif (stateRoot === undefined) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`OpenClaw provided agentWorkspaceDir '${options.paramsAgentWorkspaceDir}' for agent '${agentId}', which is a runtime path. Provide an OpenClaw stateDir provider or configure agents.list[].workspace.`,\n\t\t);\n\t}\n\n\tconst defaultAgentId = resolveDefaultAgentId(options.openClawConfig);\n\tif (agentId === defaultAgentId) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`OpenClaw provided agentWorkspaceDir '${options.paramsAgentWorkspaceDir}' for default agent '${agentId}', but OpenClaw's implicit default workspace is not controller lease backed; configure agents.list[].workspace or agents.defaults.workspace for managed Gondolin agents.`,\n\t\t);\n\t}\n\treturn {\n\t\tkind: 'state-workspace-child',\n\t\tsourceDir: path.join(stateRoot, `workspace-${agentId}`),\n\t};\n}\n","import {\n\tOPENCLAW_STATE_SANDBOXES_VM_ROOT,\n\tTOOL_VM_SCRATCH_GUEST_ROOT,\n\tTOOL_VM_WORKSPACE_GUEST_ROOT,\n\ttranslateRuntimePath,\n\ttype RuntimePathMapping,\n\ttype RuntimePathTranslation,\n\ttype RuntimePathTranslationError,\n} from '@agent-vm/gateway-interface';\n\nexport type OpenClawToolVmPathIntentKind =\n\t| 'host-workspace-root'\n\t| 'host-workspace-subpath'\n\t| 'openclaw-sandbox-path'\n\t| 'workspace-root'\n\t| 'workspace-subpath'\n\t| 'scratch-root'\n\t| 'scratch-subpath';\n\nexport interface OpenClawToolVmPathIntentResolution {\n\treadonly effectiveGuestCwd: string;\n\treadonly hostEquivalentPath?: string;\n\treadonly kind: OpenClawToolVmPathIntentKind;\n\treadonly leaseWorkMountDir: string;\n}\n\nexport type OpenClawToolVmPathIntentResult =\n\t| {\n\t\t\treadonly ok: true;\n\t\t\treadonly value: OpenClawToolVmPathIntentResolution;\n\t  }\n\t| {\n\t\t\treadonly ok: false;\n\t\t\treadonly error: RuntimePathTranslationError;\n\t  };\n\nexport class OpenClawToolVmPathIntentError extends Error {\n\treadonly details: RuntimePathTranslationError;\n\n\tconstructor(details: RuntimePathTranslationError) {\n\t\tsuper(`${details.message} ${details.retryGuidance}`);\n\t\tthis.name = 'OpenClawToolVmPathIntentError';\n\t\tthis.details = details;\n\t}\n}\n\nfunction pathContainsParentTraversal(inputPath: string): boolean {\n\treturn inputPath.split(/\\/+/u).includes('..');\n}\n\nfunction normalizedAbsolutePath(inputPath: string): string {\n\tconst rawSegments = inputPath.split('/').filter((segment) => segment !== '' && segment !== '.');\n\treturn `/${rawSegments.join('/')}`;\n}\n\nfunction invalidAgentWorkspaceRootError(agentWorkspaceDir: string): RuntimePathTranslationError {\n\treturn {\n\t\tallowedPathForms: [],\n\t\tcode: 'invalid-runtime-root',\n\t\tinputPath: agentWorkspaceDir,\n\t\tmappingId: 'openclaw-tool-vm',\n\t\tmessage: `OpenClaw agentWorkspaceDir '${agentWorkspaceDir}' must be an absolute non-root path without parent traversal.`,\n\t\tpurpose: 'executionCwd',\n\t\tretryGuidance:\n\t\t\t'Retry with OpenClaw agentWorkspaceDir set to the resolved host RealFS workspace for the requested agent.',\n\t};\n}\n\nfunction validateAgentWorkspaceDir(\n\tagentWorkspaceDir: string,\n): RuntimePathTranslationError | undefined {\n\tif (\n\t\tagentWorkspaceDir.trim() === '' ||\n\t\t!agentWorkspaceDir.startsWith('/') ||\n\t\tnormalizedAbsolutePath(agentWorkspaceDir) === '/' ||\n\t\tpathContainsParentTraversal(agentWorkspaceDir)\n\t) {\n\t\treturn invalidAgentWorkspaceRootError(agentWorkspaceDir);\n\t}\n\treturn undefined;\n}\n\nfunction createOpenClawToolVmPathMapping(options: {\n\treadonly agentWorkspaceDir: string;\n}): RuntimePathMapping {\n\treturn {\n\t\tid: 'openclaw-tool-vm',\n\t\troots: [\n\t\t\t{\n\t\t\t\tid: 'agent-workspace',\n\t\t\t\tbacking: {\n\t\t\t\t\tkind: 'host-realfs',\n\t\t\t\t\tdurability: 'durable',\n\t\t\t\t\tbackup: 'included',\n\t\t\t\t},\n\t\t\t\tcapabilities: {\n\t\t\t\t\texecutionCwd: true,\n\t\t\t\t\tleaseMount: true,\n\t\t\t\t},\n\t\t\t\tlocations: {\n\t\t\t\t\t'openclaw-gateway': options.agentWorkspaceDir,\n\t\t\t\t\t'tool-vm-guest': TOOL_VM_WORKSPACE_GUEST_ROOT,\n\t\t\t\t},\n\t\t\t\trootPathAllowed: true,\n\t\t\t\tguidanceLabel: 'agent workspace',\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: 'tool-vm-scratch',\n\t\t\t\tbacking: {\n\t\t\t\t\tkind: 'guest-rootfs-cow',\n\t\t\t\t\tdurability: 'vm-lifetime',\n\t\t\t\t},\n\t\t\t\tcapabilities: {\n\t\t\t\t\texecutionCwd: true,\n\t\t\t\t\tleaseMount: false,\n\t\t\t\t},\n\t\t\t\tlocations: {\n\t\t\t\t\t'tool-vm-guest': TOOL_VM_SCRATCH_GUEST_ROOT,\n\t\t\t\t},\n\t\t\t\trootPathAllowed: true,\n\t\t\t\tguidanceLabel: 'Tool VM scratch',\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: 'openclaw-sandboxes',\n\t\t\t\tbacking: {\n\t\t\t\t\tkind: 'host-realfs',\n\t\t\t\t\tdurability: 'durable',\n\t\t\t\t\tbackup: 'included',\n\t\t\t\t},\n\t\t\t\tcapabilities: {\n\t\t\t\t\texecutionCwd: true,\n\t\t\t\t\tleaseMount: true,\n\t\t\t\t},\n\t\t\t\tlocations: {\n\t\t\t\t\t'openclaw-gateway': OPENCLAW_STATE_SANDBOXES_VM_ROOT,\n\t\t\t\t},\n\t\t\t\trootPathAllowed: false,\n\t\t\t\tguidanceLabel: 'OpenClaw sandbox work directory',\n\t\t\t},\n\t\t],\n\t};\n}\n\nfunction resolveOpenClawSandboxPathIntent(translation: RuntimePathTranslation): {\n\treadonly effectiveGuestCwd: string;\n\treadonly leaseWorkMountDir: string;\n} {\n\tconst [sandboxChild, ...guestCwdSegments] = translation.relativePath.split('/');\n\tconst leaseWorkMountDir =\n\t\tsandboxChild === undefined || sandboxChild === ''\n\t\t\t? translation.outputPath\n\t\t\t: `${OPENCLAW_STATE_SANDBOXES_VM_ROOT}/${sandboxChild}`;\n\tconst effectiveGuestCwd =\n\t\tguestCwdSegments.length === 0\n\t\t\t? TOOL_VM_WORKSPACE_GUEST_ROOT\n\t\t\t: `${TOOL_VM_WORKSPACE_GUEST_ROOT}/${guestCwdSegments.join('/')}`;\n\treturn {\n\t\teffectiveGuestCwd,\n\t\tleaseWorkMountDir,\n\t};\n}\n\nfunction kindForTranslation(translation: RuntimePathTranslation): OpenClawToolVmPathIntentKind {\n\tconst isRoot = translation.relativePath === '';\n\tif (translation.rootId === 'tool-vm-scratch') {\n\t\treturn isRoot ? 'scratch-root' : 'scratch-subpath';\n\t}\n\tif (translation.rootId === 'openclaw-sandboxes') {\n\t\treturn 'openclaw-sandbox-path';\n\t}\n\tif (translation.inputNamespace === 'openclaw-gateway') {\n\t\treturn isRoot ? 'host-workspace-root' : 'host-workspace-subpath';\n\t}\n\treturn isRoot ? 'workspace-root' : 'workspace-subpath';\n}\n\nfunction leaseRootForTranslation(translation: RuntimePathTranslation): string {\n\treturn translation.relativePath === ''\n\t\t? translation.outputPath\n\t\t: translation.outputPath.slice(0, -(translation.relativePath.length + 1));\n}\n\nexport function resolveOpenClawToolVmPathIntent(options: {\n\treadonly agentWorkspaceDir: string;\n\treadonly equivalentAgentWorkspaceDirs?: readonly string[];\n\treadonly inputPath: string;\n}): OpenClawToolVmPathIntentResult {\n\tconst agentWorkspaceDirError = validateAgentWorkspaceDir(options.agentWorkspaceDir);\n\tif (agentWorkspaceDirError !== undefined) {\n\t\treturn {\n\t\t\terror: agentWorkspaceDirError,\n\t\t\tok: false,\n\t\t};\n\t}\n\tconst mappings = [\n\t\tcreateOpenClawToolVmPathMapping({\n\t\t\tagentWorkspaceDir: options.agentWorkspaceDir,\n\t\t}),\n\t\t...(options.equivalentAgentWorkspaceDirs ?? []).map((equivalentAgentWorkspaceDir) =>\n\t\t\tcreateOpenClawToolVmPathMapping({\n\t\t\t\tagentWorkspaceDir: equivalentAgentWorkspaceDir,\n\t\t\t}),\n\t\t),\n\t];\n\tconst invalidEquivalentRoot = (options.equivalentAgentWorkspaceDirs ?? [])\n\t\t.map((equivalentAgentWorkspaceDir) => validateAgentWorkspaceDir(equivalentAgentWorkspaceDir))\n\t\t.find((error) => error !== undefined);\n\tif (invalidEquivalentRoot !== undefined) {\n\t\treturn {\n\t\t\terror: invalidEquivalentRoot,\n\t\t\tok: false,\n\t\t};\n\t}\n\tconst mapping = createOpenClawToolVmPathMapping({\n\t\tagentWorkspaceDir: options.agentWorkspaceDir,\n\t});\n\tconst sandboxTranslation = translateRuntimePath({\n\t\tinputPath: options.inputPath,\n\t\tmapping,\n\t\tpurpose: 'executionCwd',\n\t\tsourceNamespace: 'openclaw-gateway',\n\t\ttargetNamespace: 'openclaw-gateway',\n\t});\n\tif (sandboxTranslation.ok && sandboxTranslation.value.rootId === 'openclaw-sandboxes') {\n\t\tconst sandboxPathIntent = resolveOpenClawSandboxPathIntent(sandboxTranslation.value);\n\t\treturn {\n\t\t\tok: true,\n\t\t\tvalue: {\n\t\t\t\teffectiveGuestCwd: sandboxPathIntent.effectiveGuestCwd,\n\t\t\t\thostEquivalentPath: sandboxTranslation.value.outputPath,\n\t\t\t\tkind: kindForTranslation(sandboxTranslation.value),\n\t\t\t\tleaseWorkMountDir: sandboxPathIntent.leaseWorkMountDir,\n\t\t\t},\n\t\t};\n\t}\n\tconst translationResults = mappings.map((candidateMapping) =>\n\t\ttranslateRuntimePath({\n\t\t\tinputPath: options.inputPath,\n\t\t\tmapping: candidateMapping,\n\t\t\tpurpose: 'executionCwd',\n\t\t\ttargetNamespace: 'tool-vm-guest',\n\t\t}),\n\t);\n\tconst translation = translationResults.find((candidateTranslation) => candidateTranslation.ok);\n\tif (translation === undefined) {\n\t\tconst primaryTranslation = translationResults[0];\n\t\tif (primaryTranslation === undefined || primaryTranslation.ok) {\n\t\t\treturn {\n\t\t\t\terror: invalidAgentWorkspaceRootError(options.agentWorkspaceDir),\n\t\t\t\tok: false,\n\t\t\t};\n\t\t}\n\t\treturn primaryTranslation;\n\t}\n\tconst hostEquivalentTranslation = translateRuntimePath({\n\t\tinputPath: options.inputPath,\n\t\tmapping,\n\t\tpurpose: 'executionCwd',\n\t\ttargetNamespace: 'openclaw-gateway',\n\t});\n\treturn {\n\t\tok: true,\n\t\tvalue: {\n\t\t\teffectiveGuestCwd: translation.value.outputPath,\n\t\t\t...(hostEquivalentTranslation.ok\n\t\t\t\t? { hostEquivalentPath: hostEquivalentTranslation.value.outputPath }\n\t\t\t\t: {}),\n\t\t\tkind: kindForTranslation(translation.value),\n\t\t\tleaseWorkMountDir:\n\t\t\t\thostEquivalentTranslation.ok && hostEquivalentTranslation.value.rootId !== 'tool-vm-scratch'\n\t\t\t\t\t? leaseRootForTranslation(hostEquivalentTranslation.value)\n\t\t\t\t\t: options.agentWorkspaceDir,\n\t\t},\n\t};\n}\n\nexport function assertOpenClawToolVmPathIntent(options: {\n\treadonly agentWorkspaceDir: string;\n\treadonly equivalentAgentWorkspaceDirs?: readonly string[];\n\treadonly inputPath: string;\n}): OpenClawToolVmPathIntentResolution {\n\tconst result = resolveOpenClawToolVmPathIntent(options);\n\tif (!result.ok) {\n\t\tthrow new OpenClawToolVmPathIntentError(result.error);\n\t}\n\treturn result.value;\n}\n","export function buildShellScriptWithArgs(script: string, args?: readonly string[]): string {\n\tif (!args || args.length === 0) {\n\t\treturn script;\n\t}\n\n\tconst escapedArgs = args.map((arg) => `'${arg.replace(/'/g, \"'\\\\''\")}'`).join(' ');\n\treturn `set -- ${escapedArgs}; ${script}`;\n}\n","import type {\n\tAgentVmHealthEvent,\n\tToolVmActiveUseOperationReport,\n\tToolVmSshHealthOperation,\n\tToolVmSshFailureKind,\n} from '@agent-vm/gateway-interface';\n\nexport class ToolVmSshOperationStaleError extends Error {\n\toverride readonly cause: unknown;\n\treadonly reason: ToolVmSshFailureKind;\n\n\tconstructor(options: {\n\t\treadonly cause: unknown;\n\t\treadonly message: string;\n\t\treadonly reason: ToolVmSshFailureKind;\n\t}) {\n\t\tsuper(options.message);\n\t\tthis.cause = options.cause;\n\t\tthis.reason = options.reason;\n\t}\n}\n\nexport interface ToolVmSshOperationGuardOptions<TResult> {\n\treadonly clearTimeoutImpl?: typeof clearTimeout | undefined;\n\treadonly healthEvent?: {\n\t\treadonly agentId: string;\n\t\treadonly leaseId: string;\n\t\treadonly operation: ToolVmSshHealthOperation;\n\t\treadonly publish: (event: AgentVmHealthEvent) => Promise<void>;\n\t\treadonly zoneId: string;\n\t};\n\treadonly now?: (() => number) | undefined;\n\treadonly operation: (signal: AbortSignal) => Promise<TResult>;\n\treadonly operationName: string;\n\treadonly report: (report: ToolVmActiveUseOperationReport) => void;\n\treadonly setTimeoutImpl?: typeof setTimeout | undefined;\n\treadonly timeoutMs: number;\n\treadonly writeLog?: (message: string) => void;\n}\n\nfunction formatUnknownError(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction defaultWriteLog(message: string): void {\n\tprocess.stderr.write(`[tool-vm-ssh-operation-guard] ${message}\\n`);\n}\n\nasync function publishHealthEvent(options: {\n\treadonly elapsedMs: number;\n\treadonly errorCode?: string | undefined;\n\treadonly guardOptions: Pick<ToolVmSshOperationGuardOptions<unknown>, 'healthEvent' | 'writeLog'>;\n\treadonly observedAtMs: number;\n\treadonly result: 'failed' | 'ok';\n}): Promise<void> {\n\tif (!options.guardOptions.healthEvent) {\n\t\treturn;\n\t}\n\tconst event = {\n\t\tagentId: options.guardOptions.healthEvent.agentId,\n\t\telapsedMs: options.elapsedMs,\n\t\t...(options.errorCode === undefined ? {} : { errorCode: options.errorCode }),\n\t\tkind: 'tool-vm-ssh',\n\t\tleaseId: options.guardOptions.healthEvent.leaseId,\n\t\tobservedAtMs: options.observedAtMs,\n\t\toperation: options.guardOptions.healthEvent.operation,\n\t\tresult: options.result,\n\t\tzoneId: options.guardOptions.healthEvent.zoneId,\n\t} satisfies AgentVmHealthEvent;\n\ttry {\n\t\tawait options.guardOptions.healthEvent.publish(event);\n\t} catch (error) {\n\t\t(options.guardOptions.writeLog ?? defaultWriteLog)(\n\t\t\t`tool-vm-ssh health publish failed operation=${options.guardOptions.healthEvent.operation} elapsedMs=${String(options.elapsedMs)} error=${formatUnknownError(error)}`,\n\t\t);\n\t}\n}\n\nexport async function runToolVmSshOperationWithGuard<TResult>(\n\toptions: ToolVmSshOperationGuardOptions<TResult>,\n): Promise<TResult> {\n\tconst now = options.now ?? Date.now;\n\tconst setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;\n\tconst clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;\n\tconst abortController = new AbortController();\n\tconst startedAtMs = now();\n\tlet timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n\n\toptions.report({\n\t\tobservedAtMs: now(),\n\t\tphase: 'running',\n\t});\n\n\tconst timeoutPromise = new Promise<never>((_resolve, reject) => {\n\t\ttimeoutHandle = setTimeoutImpl(() => {\n\t\t\tabortController.abort();\n\t\t\treject(\n\t\t\t\tnew ToolVmSshOperationStaleError({\n\t\t\t\t\tcause: undefined,\n\t\t\t\t\tmessage: `${options.operationName} exceeded ${String(options.timeoutMs)}ms.`,\n\t\t\t\t\treason: 'ssh-command-timed-out',\n\t\t\t\t}),\n\t\t\t);\n\t\t}, options.timeoutMs);\n\t});\n\n\ttry {\n\t\tconst result = await Promise.race([options.operation(abortController.signal), timeoutPromise]);\n\t\toptions.report({\n\t\t\tobservedAtMs: now(),\n\t\t\tphase: 'completed',\n\t\t\tssh: { probeSucceeded: true },\n\t\t});\n\t\tconst observedAtMs = now();\n\t\tvoid publishHealthEvent({\n\t\t\telapsedMs: observedAtMs - startedAtMs,\n\t\t\tguardOptions: options,\n\t\t\tobservedAtMs,\n\t\t\tresult: 'ok',\n\t\t});\n\t\treturn result;\n\t} catch (error) {\n\t\tconst staleError =\n\t\t\terror instanceof ToolVmSshOperationStaleError\n\t\t\t\t? error\n\t\t\t\t: new ToolVmSshOperationStaleError({\n\t\t\t\t\t\tcause: error,\n\t\t\t\t\t\tmessage: formatUnknownError(error),\n\t\t\t\t\t\treason: 'ssh-command-failed',\n\t\t\t\t\t});\n\t\toptions.report({\n\t\t\tobservedAtMs: now(),\n\t\t\tphase: 'failed',\n\t\t\tssh: {\n\t\t\t\tfailure: {\n\t\t\t\t\tkind: staleError.reason,\n\t\t\t\t\tmessage: staleError.message,\n\t\t\t\t},\n\t\t\t},\n\t\t});\n\t\tconst observedAtMs = now();\n\t\tvoid publishHealthEvent({\n\t\t\telapsedMs: observedAtMs - startedAtMs,\n\t\t\terrorCode: staleError.reason,\n\t\t\tguardOptions: options,\n\t\t\tobservedAtMs,\n\t\t\tresult: 'failed',\n\t\t});\n\t\tthrow staleError;\n\t} finally {\n\t\tif (timeoutHandle !== undefined) {\n\t\t\tclearTimeoutImpl(timeoutHandle);\n\t\t}\n\t}\n}\n","import path from 'node:path/posix';\n\nimport {\n\ttype AgentVmHealthEvent,\n\tcreateToolVmActiveUseHandle,\n\ttype EndToolVmActiveUseRequest,\n\ttype HeartbeatToolVmActiveUseResponse,\n\ttype StartToolVmActiveUseRequest,\n\ttype StartToolVmActiveUseResponse,\n\ttype ToolVmActiveUseCorrelation,\n\ttype ToolVmActiveUseHandle,\n\ttype ToolVmActiveUseOutcome,\n\ttype ToolVmSshFailureKind,\n\tisToolVmSshLease,\n} from '@agent-vm/gateway-interface';\n\nimport {\n\tControllerLeaseRequestError,\n\tcreateLeaseClient,\n\ttype LeaseClient,\n\ttype OpenClawRuntimeStatusReport,\n} from '../controller-lease-client.js';\nimport { fetchControllerWithPolicy } from '../controller-request-policy.js';\nimport {\n\tfindOpenClawGondolinSandboxMismatch,\n\tresolveOpenClawAgentIdFromSessionKey,\n\ttype OpenClawGondolinSandboxSnapshot,\n} from '../openclaw-gondolin-contract.js';\nimport { resolveOpenClawAgentWorkspaceSource } from './openclaw-agent-workspace-source.js';\nimport { assertOpenClawToolVmPathIntent } from './openclaw-tool-vm-path-mapping.js';\nimport {\n\ttype CachedAgentLeaseEntry,\n\ttype CreateBackendDependencies,\n\ttype OpenClawFsBridgeLeaseContext,\n\ttype OpenClawSandboxBackendHandle,\n} from './sandbox-backend-contract.js';\nimport { buildShellScriptWithArgs } from './sandbox-shell-script.js';\nimport {\n\trunToolVmSshOperationWithGuard,\n\tToolVmSshOperationStaleError,\n} from './tool-vm-ssh-operation-guard.js';\n\nfunction agentLeaseCacheKey(params: { readonly agentId: string; readonly zoneId: string }): string {\n\treturn [params.zoneId, params.agentId].join('\\0');\n}\n\ntype CachedAgentLeaseCompatibility = Pick<\n\tCachedAgentLeaseEntry,\n\t'agentWorkspaceDir' | 'leaseWorkMountDir' | 'profileId'\n>;\n\nfunction findCachedLeaseCompatibilityMismatch(params: {\n\treadonly cachedEntry: CachedAgentLeaseCompatibility;\n\treadonly requestedEntry: CachedAgentLeaseCompatibility;\n}): string | undefined {\n\tif (params.cachedEntry.agentWorkspaceDir !== params.requestedEntry.agentWorkspaceDir) {\n\t\treturn 'agentWorkspaceDir';\n\t}\n\tif (params.cachedEntry.leaseWorkMountDir !== params.requestedEntry.leaseWorkMountDir) {\n\t\treturn 'leaseWorkMountDir';\n\t}\n\tif (params.cachedEntry.profileId !== params.requestedEntry.profileId) {\n\t\treturn 'profileId';\n\t}\n\treturn undefined;\n}\n\nfunction assertCachedLeaseCompatible(params: {\n\treadonly agentId: string;\n\treadonly cachedEntry: CachedAgentLeaseCompatibility;\n\treadonly requestedEntry: CachedAgentLeaseCompatibility;\n\treadonly zoneId: string;\n}): void {\n\tconst mismatch = findCachedLeaseCompatibilityMismatch(params);\n\tif (mismatch === undefined) {\n\t\treturn;\n\t}\n\tthrow new Error(\n\t\t`Cannot reuse cached Tool VM lease for zone '${params.zoneId}' agent '${params.agentId}': ${mismatch} changed.`,\n\t);\n}\n\nfunction formatControllerLeaseRequestError(error: ControllerLeaseRequestError): string {\n\tconst responseBody =\n\t\terror.responseBody === undefined ? error.bodyText : JSON.stringify(error.responseBody);\n\treturn `${error.message}; response=${responseBody}`;\n}\n\nfunction formatUnknownError(error: unknown): string {\n\tif (error instanceof ControllerLeaseRequestError) {\n\t\treturn formatControllerLeaseRequestError(error);\n\t}\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction writeSandboxBackendLog(message: string): void {\n\tprocess.stderr.write(`[openclaw-agent-vm-plugin] ${message}\\n`);\n}\n\nfunction shouldRefreshCachedLease(error: unknown): boolean {\n\treturn isRefreshableLeaseError(error);\n}\n\nfunction isRefreshableLeaseError(error: unknown): boolean {\n\treturn (\n\t\terror instanceof ControllerLeaseRequestError && (error.status === 404 || error.status === 410)\n\t);\n}\n\nfunction isCleanupNotFound(error: unknown): boolean {\n\treturn error instanceof ControllerLeaseRequestError && error.status === 404;\n}\n\ninterface DisposableFinalizeToken {\n\tdispose(): Promise<void>;\n}\n\ninterface ActiveUseFinalizeToken {\n\treadonly activeUseHandle: ToolVmActiveUseHandle;\n\treadonly innerToken?: unknown;\n}\n\nfunction isDisposableFinalizeToken(value: unknown): value is DisposableFinalizeToken {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t'dispose' in value &&\n\t\ttypeof Reflect.get(value, 'dispose') === 'function'\n\t);\n}\n\nfunction isActiveUseFinalizeToken(value: unknown): value is ActiveUseFinalizeToken {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t'activeUseHandle' in value &&\n\t\ttypeof Reflect.get(value, 'activeUseHandle') === 'object'\n\t);\n}\n\nfunction activeUseOutcomeForFinalizeParams(finalizeParams: {\n\treadonly status: 'completed' | 'failed';\n\treadonly timedOut: boolean;\n}): ToolVmActiveUseOutcome {\n\treturn finalizeParams.timedOut\n\t\t? 'timed-out'\n\t\t: finalizeParams.status === 'completed'\n\t\t\t? 'completed'\n\t\t\t: 'failed';\n}\n\nasync function publishFinalizeToolVmSshHealthEvent(options: {\n\treadonly agentId: string;\n\treadonly leaseId: string;\n\treadonly publishHealthEvent: (event: AgentVmHealthEvent) => Promise<void>;\n\treadonly timedOut: boolean;\n\treadonly zoneId: string;\n}): Promise<void> {\n\tconst event = {\n\t\tagentId: options.agentId,\n\t\telapsedMs: 0,\n\t\t...(options.timedOut ? { errorCode: 'ssh-command-timed-out' } : {}),\n\t\tkind: 'tool-vm-ssh',\n\t\tleaseId: options.leaseId,\n\t\tobservedAtMs: Date.now(),\n\t\toperation: 'finalize',\n\t\tresult: options.timedOut ? 'failed' : 'ok',\n\t\tzoneId: options.zoneId,\n\t} satisfies AgentVmHealthEvent;\n\ttry {\n\t\tawait options.publishHealthEvent(event);\n\t} catch (error) {\n\t\twriteSandboxBackendLog(\n\t\t\t`tool-vm-ssh finalize health publish failed for zone '${options.zoneId}' lease '${options.leaseId}': ${formatUnknownError(error)}`,\n\t\t);\n\t}\n}\n\nfunction mergedAbortSignal(\n\tfirstSignal: AbortSignal | undefined,\n\tsecondSignal: AbortSignal,\n): AbortSignal {\n\tif (firstSignal === undefined) {\n\t\treturn secondSignal;\n\t}\n\treturn AbortSignal.any([firstSignal, secondSignal]);\n}\n\nfunction mergedAbortSignals(\n\tsignals: readonly (AbortSignal | undefined)[],\n): AbortSignal | undefined {\n\tconst presentSignals = signals.filter((signal): signal is AbortSignal => signal !== undefined);\n\tif (presentSignals.length === 0) {\n\t\treturn undefined;\n\t}\n\tif (presentSignals.length === 1) {\n\t\treturn presentSignals[0];\n\t}\n\treturn AbortSignal.any(presentSignals);\n}\n\nfunction resolveLeaseRequestAgentId(sessionKey: string): string {\n\treturn resolveOpenClawAgentIdFromSessionKey(sessionKey);\n}\n\nfunction defaultOpenClawStateDir(): string | undefined {\n\tconst explicitStateDir = process.env.OPENCLAW_STATE_DIR?.trim();\n\tif (explicitStateDir) {\n\t\treturn path.resolve(explicitStateDir);\n\t}\n\tconst homeDirectory = process.env.HOME?.trim();\n\treturn homeDirectory ? path.join(homeDirectory, '.openclaw', 'state') : undefined;\n}\n\nfunction defaultOpenClawWorkspaceDir(): string | undefined {\n\tconst homeDirectory = process.env.HOME?.trim();\n\tif (!homeDirectory) {\n\t\treturn undefined;\n\t}\n\tconst profile = process.env.OPENCLAW_PROFILE?.trim().toLowerCase();\n\treturn profile && profile !== 'default'\n\t\t? path.join(homeDirectory, '.openclaw', `workspace-${profile}`)\n\t\t: path.join(homeDirectory, '.openclaw', 'workspace');\n}\n\nfunction assertPluginLeaseContract(params: {\n\treadonly cfg: OpenClawGondolinSandboxSnapshot;\n}): void {\n\tconst mismatch = findOpenClawGondolinSandboxMismatch(params.cfg);\n\tif (mismatch) {\n\t\tthrow new Error(\n\t\t\t`OpenClaw Gondolin sandbox requires ${mismatch.key}=${mismatch.expectedValue}; received ${String(params.cfg[mismatch.key])}.`,\n\t\t);\n\t}\n}\n\nexport function createGondolinSandboxBackendFactory(\n\toptions: {\n\t\treadonly controllerUrl: string;\n\t\treadonly openClawDefaultWorkspaceDirProvider?: () => string | undefined;\n\t\treadonly openClawRuntimeStatusProvider?: () => OpenClawRuntimeStatusReport | undefined;\n\t\treadonly openClawRuntimeConfigProvider?: () => Record<string, unknown> | undefined;\n\t\treadonly openClawStateDirProvider?: () => string | undefined;\n\t\treadonly profileId?: string;\n\t\treadonly zoneId: string;\n\t},\n\tdependencies: CreateBackendDependencies,\n): (params: {\n\treadonly agentWorkspaceDir: string;\n\treadonly cfg: OpenClawGondolinSandboxSnapshot & {\n\t\treadonly docker?: {\n\t\t\treadonly env?: Record<string, string>;\n\t\t};\n\t};\n\t// OpenClaw SDK boundary input only. Agent-vm leases are keyed by agentId,\n\t// so this value is intentionally not read or forwarded to the controller.\n\treadonly scopeKey: string;\n\treadonly sessionKey: string;\n\treadonly workspaceDir: string;\n}) => Promise<OpenClawSandboxBackendHandle> {\n\tconst agentLeaseCache = new Map<string, CachedAgentLeaseEntry>();\n\tconst inFlightLeaseRequests = new Map<string, Promise<CachedAgentLeaseEntry>>();\n\n\treturn async (params) => {\n\t\tconst profileId = options.profileId ?? 'standard';\n\t\tconst agentId = resolveLeaseRequestAgentId(params.sessionKey);\n\t\tassertPluginLeaseContract({\n\t\t\tcfg: params.cfg,\n\t\t});\n\t\tconst defaultWorkspaceDir =\n\t\t\toptions.openClawDefaultWorkspaceDirProvider?.() ?? defaultOpenClawWorkspaceDir();\n\t\tconst equivalentAgentWorkspaceDirs =\n\t\t\tdefaultWorkspaceDir === undefined ? [] : [defaultWorkspaceDir];\n\t\tconst workspaceSource = resolveOpenClawAgentWorkspaceSource({\n\t\t\tagentId,\n\t\t\tdefaultWorkspaceDir,\n\t\t\topenClawConfig: options.openClawRuntimeConfigProvider?.(),\n\t\t\tparamsAgentWorkspaceDir: params.agentWorkspaceDir,\n\t\t\tstateDir: options.openClawStateDirProvider?.() ?? defaultOpenClawStateDir(),\n\t\t});\n\t\tconst pathIntent = assertOpenClawToolVmPathIntent({\n\t\t\tagentWorkspaceDir: workspaceSource.sourceDir,\n\t\t\tequivalentAgentWorkspaceDirs,\n\t\t\tinputPath: params.workspaceDir,\n\t\t});\n\t\tconst cacheKey = agentLeaseCacheKey({\n\t\t\tagentId,\n\t\t\tzoneId: options.zoneId,\n\t\t});\n\t\tconst requestedCacheEntry = {\n\t\t\tagentWorkspaceDir: workspaceSource.sourceDir,\n\t\t\tleaseWorkMountDir: pathIntent.leaseWorkMountDir,\n\t\t\tprofileId,\n\t\t} satisfies CachedAgentLeaseCompatibility;\n\t\tconst leaseClient =\n\t\t\tdependencies.createLeaseClient?.({\n\t\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\t}) ?? createLeaseClient({ controllerUrl: options.controllerUrl });\n\t\tconst publishHealthEvent = async (event: AgentVmHealthEvent): Promise<void> => {\n\t\t\tconst response = await fetchControllerWithPolicy({\n\t\t\t\tinput: `${options.controllerUrl.replace(/\\/+$/u, '')}/zones/${encodeURIComponent(options.zoneId)}/health-events`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(event),\n\t\t\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'health-event-publish',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tawait response.text().catch(() => undefined);\n\t\t\t\tthrow new Error(`health event publish returned HTTP ${String(response.status)}`);\n\t\t\t}\n\t\t\tawait response.text().catch(() => undefined);\n\t\t};\n\t\tconst markLeaseStale = async (\n\t\t\tlease: CachedAgentLeaseEntry['lease'],\n\t\t\treason: ToolVmSshFailureKind,\n\t\t\terror: unknown,\n\t\t): Promise<void> => {\n\t\t\tagentLeaseCache.delete(cacheKey);\n\t\t\twriteSandboxBackendLog(\n\t\t\t\t`lease marked stale for zone '${options.zoneId}' agent '${agentId}' lease '${lease.leaseId}' reason '${reason}': ${formatUnknownError(error)}`,\n\t\t\t);\n\t\t\tawait leaseClient\n\t\t\t\t.releaseLease(lease.leaseId, { force: true })\n\t\t\t\t.catch((releaseError: unknown) => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`best-effort stale lease release failed for zone '${options.zoneId}' agent '${agentId}' lease '${lease.leaseId}': ${formatUnknownError(releaseError)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t};\n\t\tconst cachedEntry = agentLeaseCache.get(cacheKey);\n\t\tlet lease: CachedAgentLeaseEntry['lease'] | undefined;\n\t\tif (cachedEntry) {\n\t\t\tassertCachedLeaseCompatible({\n\t\t\t\tagentId,\n\t\t\t\tcachedEntry,\n\t\t\t\trequestedEntry: requestedCacheEntry,\n\t\t\t\tzoneId: options.zoneId,\n\t\t\t});\n\t\t\ttry {\n\t\t\t\tconst renewedLease = await leaseClient.renewLease(cachedEntry.lease.leaseId);\n\t\t\t\tawait runToolVmSshOperationWithGuard({\n\t\t\t\t\thealthEvent: {\n\t\t\t\t\t\tagentId,\n\t\t\t\t\t\tleaseId: renewedLease.leaseId,\n\t\t\t\t\t\toperation: 'probe',\n\t\t\t\t\t\tpublish: publishHealthEvent,\n\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t},\n\t\t\t\t\toperation: async (signal) =>\n\t\t\t\t\t\tawait dependencies.runRemoteShellScript({\n\t\t\t\t\t\t\tallowFailure: false,\n\t\t\t\t\t\t\tscript: 'true',\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t\tssh: renewedLease.ssh,\n\t\t\t\t\t\t}),\n\t\t\t\t\toperationName: 'cached-ssh-probe',\n\t\t\t\t\treport: () => {},\n\t\t\t\t\ttimeoutMs: 30_000,\n\t\t\t\t});\n\t\t\t\tlease = renewedLease;\n\t\t\t\tagentLeaseCache.set(cacheKey, { ...requestedCacheEntry, lease });\n\t\t\t} catch (error) {\n\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t`lease renew failed for zone '${options.zoneId}' agent '${agentId}' lease '${cachedEntry.lease.leaseId}': ${formatUnknownError(error)}`,\n\t\t\t\t);\n\t\t\t\tif (error instanceof ToolVmSshOperationStaleError) {\n\t\t\t\t\tawait markLeaseStale(cachedEntry.lease, error.reason, error);\n\t\t\t\t} else if (shouldRefreshCachedLease(error)) {\n\t\t\t\t\tagentLeaseCache.delete(cacheKey);\n\t\t\t\t} else {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (lease === undefined) {\n\t\t\tconst inFlightLeaseRequest = inFlightLeaseRequests.get(cacheKey);\n\t\t\tif (inFlightLeaseRequest !== undefined) {\n\t\t\t\tconst inFlightEntry = await inFlightLeaseRequest;\n\t\t\t\tassertCachedLeaseCompatible({\n\t\t\t\t\tagentId,\n\t\t\t\t\tcachedEntry: inFlightEntry,\n\t\t\t\t\trequestedEntry: requestedCacheEntry,\n\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t});\n\t\t\t\tlease = inFlightEntry.lease;\n\t\t\t} else {\n\t\t\t\t// OpenClaw SDK still names the selected sandbox path `workspaceDir`.\n\t\t\t\t// agent-vm's controller calls the selected host source `workMountDir`.\n\t\t\t\tconst leaseRequestPromise = (async (): Promise<CachedAgentLeaseEntry> => {\n\t\t\t\t\tconst runtimeStatus = options.openClawRuntimeStatusProvider?.();\n\t\t\t\t\tif (runtimeStatus && leaseClient.publishOpenClawRuntimeStatus) {\n\t\t\t\t\t\tawait leaseClient.publishOpenClawRuntimeStatus(runtimeStatus);\n\t\t\t\t\t}\n\t\t\t\t\tconst leaseResponse = await leaseClient.requestLease({\n\t\t\t\t\t\tagentId,\n\t\t\t\t\t\tagentWorkspaceDir: workspaceSource.sourceDir,\n\t\t\t\t\t\tprofileId,\n\t\t\t\t\t\tsessionKey: params.sessionKey,\n\t\t\t\t\t\tworkMountDir: pathIntent.leaseWorkMountDir,\n\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t});\n\t\t\t\t\tif (!isToolVmSshLease(leaseResponse)) {\n\t\t\t\t\t\tthrow new TypeError('Controller lease API returned an unexpected response.');\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\t...requestedCacheEntry,\n\t\t\t\t\t\tlease: leaseResponse,\n\t\t\t\t\t};\n\t\t\t\t})();\n\t\t\t\tinFlightLeaseRequests.set(cacheKey, leaseRequestPromise);\n\t\t\t\ttry {\n\t\t\t\t\tconst leaseEntry = await leaseRequestPromise;\n\t\t\t\t\tagentLeaseCache.set(cacheKey, leaseEntry);\n\t\t\t\t\tlease = leaseEntry.lease;\n\t\t\t\t} finally {\n\t\t\t\t\tif (inFlightLeaseRequests.get(cacheKey) === leaseRequestPromise) {\n\t\t\t\t\t\tinFlightLeaseRequests.delete(cacheKey);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tconst handle = createSandboxBackendHandle({\n\t\t\tcfg: params.cfg,\n\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\tcreateFsBridgeBuilder: dependencies.createFsBridgeBuilder,\n\t\t\teffectiveGuestCwd: pathIntent.effectiveGuestCwd,\n\t\t\tlease,\n\t\t\tleaseClient,\n\t\t\tmarkCachedLeaseStale: async (reason, error) => {\n\t\t\t\tawait markLeaseStale(lease, reason, error);\n\t\t\t},\n\t\t\tpublishHealthEvent,\n\t\t\trunRemoteShellScript: dependencies.runRemoteShellScript,\n\t\t\tbuildExecSpec: dependencies.buildExecSpec,\n\t\t\tsessionKey: params.sessionKey,\n\t\t\tzoneId: options.zoneId,\n\t\t});\n\t\treturn handle;\n\t};\n}\n\nfunction createSandboxBackendHandle(options: {\n\treadonly buildExecSpec: CreateBackendDependencies['buildExecSpec'];\n\treadonly cfg: {\n\t\treadonly docker?: {\n\t\t\treadonly env?: Record<string, string>;\n\t\t};\n\t};\n\treadonly controllerUrl: string;\n\treadonly createFsBridgeBuilder?: CreateBackendDependencies['createFsBridgeBuilder'];\n\treadonly effectiveGuestCwd: string;\n\treadonly lease: CachedAgentLeaseEntry['lease'];\n\treadonly leaseClient: LeaseClient;\n\treadonly markCachedLeaseStale: (reason: ToolVmSshFailureKind, error: unknown) => Promise<void>;\n\treadonly publishHealthEvent: (event: AgentVmHealthEvent) => Promise<void>;\n\treadonly runRemoteShellScript: CreateBackendDependencies['runRemoteShellScript'];\n\treadonly sessionKey: string;\n\treadonly zoneId: string;\n}): OpenClawSandboxBackendHandle {\n\tconst createActiveUseHandle = async (\n\t\tcorrelation: ToolVmActiveUseCorrelation,\n\t): Promise<ToolVmActiveUseHandle> => {\n\t\ttry {\n\t\t\treturn await createToolVmActiveUseHandle({\n\t\t\t\tcorrelation,\n\t\t\t\tendActiveUse: async (useId: string, request: EndToolVmActiveUseRequest): Promise<void> => {\n\t\t\t\t\tawait options.leaseClient.endActiveUse(options.lease.leaseId, useId, request);\n\t\t\t\t},\n\t\t\t\theartbeatActiveUse: async (useId, request): Promise<HeartbeatToolVmActiveUseResponse> =>\n\t\t\t\t\tawait options.leaseClient.heartbeatActiveUse(options.lease.leaseId, useId, request),\n\t\t\t\tisEndErrorTolerable: isCleanupNotFound,\n\t\t\t\tisHeartbeatErrorRefreshable: isRefreshableLeaseError,\n\t\t\t\tlogEndFailure: (error: unknown): void => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`active-use cleanup ignored for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(error)}`,\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t\tlogHeartbeatFailure: (error: unknown): void => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`active-use heartbeat failed for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(error)}`,\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t\tonRefreshableHeartbeatFailure: async (error): Promise<void> => {\n\t\t\t\t\tawait options.markCachedLeaseStale('active-use-refreshable-failure', error);\n\t\t\t\t},\n\t\t\t\tstartActiveUse: async (\n\t\t\t\t\trequest: StartToolVmActiveUseRequest,\n\t\t\t\t): Promise<StartToolVmActiveUseResponse> =>\n\t\t\t\t\tawait options.leaseClient.startActiveUse(options.lease.leaseId, request),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (isRefreshableLeaseError(error)) {\n\t\t\t\tawait options.markCachedLeaseStale('active-use-refreshable-failure', error);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tconst runWithActiveUse = async <TResult>(\n\t\tcorrelation: ToolVmActiveUseCorrelation,\n\t\tfn: (activeUseHandle: ToolVmActiveUseHandle) => Promise<TResult>,\n\t): Promise<TResult> => {\n\t\tconst activeUseHandle = await createActiveUseHandle(correlation);\n\t\ttry {\n\t\t\tconst result = await fn(activeUseHandle);\n\t\t\tawait activeUseHandle.dispose('completed');\n\t\t\treturn result;\n\t\t} catch (error) {\n\t\t\tawait activeUseHandle\n\t\t\t\t.dispose(\n\t\t\t\t\terror instanceof ToolVmSshOperationStaleError && error.reason === 'ssh-command-timed-out'\n\t\t\t\t\t\t? 'timed-out'\n\t\t\t\t\t\t: 'failed',\n\t\t\t\t)\n\t\t\t\t.catch((cleanupError: unknown) => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`failed to end active use after operation failure for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(cleanupError)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\tif (error instanceof ToolVmSshOperationStaleError) {\n\t\t\t\tawait options.markCachedLeaseStale(error.reason, error);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tconst boundRunRemoteShellScript: OpenClawFsBridgeLeaseContext['runRemoteShellScript'] = async (\n\t\tshellParams,\n\t) =>\n\t\tawait runWithActiveUse(\n\t\t\t{\n\t\t\t\tsessionKey: options.sessionKey,\n\t\t\t\ttoolName: 'fs-bridge',\n\t\t\t},\n\t\t\tasync (activeUseHandle) =>\n\t\t\t\tawait runToolVmSshOperationWithGuard({\n\t\t\t\t\thealthEvent: {\n\t\t\t\t\t\tagentId: options.lease.agentId,\n\t\t\t\t\t\tleaseId: options.lease.leaseId,\n\t\t\t\t\t\toperation: 'file-bridge',\n\t\t\t\t\t\tpublish: options.publishHealthEvent,\n\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t},\n\t\t\t\t\toperation: async (signal) => {\n\t\t\t\t\t\tconst operationSignal = mergedAbortSignals([\n\t\t\t\t\t\t\tshellParams.signal,\n\t\t\t\t\t\t\tactiveUseHandle.signal,\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t]);\n\t\t\t\t\t\treturn await options.runRemoteShellScript({\n\t\t\t\t\t\t\t...(shellParams.allowFailure !== undefined\n\t\t\t\t\t\t\t\t? { allowFailure: shellParams.allowFailure }\n\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\tscript: buildShellScriptWithArgs(shellParams.script, shellParams.args),\n\t\t\t\t\t\t\t...(operationSignal === undefined ? {} : { signal: operationSignal }),\n\t\t\t\t\t\t\tssh: options.lease.ssh,\n\t\t\t\t\t\t\t...(shellParams.stdin !== undefined ? { stdin: shellParams.stdin } : {}),\n\t\t\t\t\t\t});\n\t\t\t\t\t},\n\t\t\t\t\toperationName: 'fs-bridge',\n\t\t\t\t\treport: (report) => {\n\t\t\t\t\t\tactiveUseHandle.report(report);\n\t\t\t\t\t},\n\t\t\t\t\ttimeoutMs: 30_000,\n\t\t\t\t}),\n\t\t);\n\n\tconst disposeInnerFinalizeToken = async (token: unknown): Promise<void> => {\n\t\tif (isDisposableFinalizeToken(token)) {\n\t\t\tawait token.dispose();\n\t\t}\n\t};\n\n\tconst endActiveUseFinalizeToken = async (\n\t\ttoken: ActiveUseFinalizeToken,\n\t\toutcome: ToolVmActiveUseOutcome,\n\t): Promise<void> => {\n\t\tlet innerError: unknown;\n\t\ttry {\n\t\t\tawait disposeInnerFinalizeToken(token.innerToken);\n\t\t} catch (error) {\n\t\t\tinnerError = error;\n\t\t}\n\t\tlet activeUseError: unknown;\n\t\ttry {\n\t\t\tawait token.activeUseHandle.dispose(outcome);\n\t\t} catch (error) {\n\t\t\tactiveUseError = error;\n\t\t}\n\t\tif (innerError) {\n\t\t\tthrow innerError;\n\t\t}\n\t\tif (activeUseError) {\n\t\t\tthrow activeUseError;\n\t\t}\n\t};\n\n\tconst createFsBridge = options.createFsBridgeBuilder?.({\n\t\tremoteAgentWorkspaceDir: options.lease.workdir,\n\t\tremoteWorkspaceDir: options.effectiveGuestCwd,\n\t\trunRemoteShellScript: boundRunRemoteShellScript,\n\t});\n\n\treturn {\n\t\t...(createFsBridge ? { createFsBridge } : {}),\n\t\t...(options.cfg.docker?.env ? { env: options.cfg.docker.env } : {}),\n\t\tconfigLabel: `${options.controllerUrl} (${options.zoneId})`,\n\t\tconfigLabelKind: 'VM',\n\t\tid: 'gondolin',\n\t\truntimeId: options.lease.leaseId,\n\t\truntimeLabel: options.lease.leaseId,\n\t\tworkdir: options.effectiveGuestCwd,\n\t\tbuildExecSpec: async (execParams) => {\n\t\t\tconst activeUseHandle = await createActiveUseHandle({\n\t\t\t\tsessionKey: options.sessionKey,\n\t\t\t\ttoolName: 'shell',\n\t\t\t});\n\t\t\ttry {\n\t\t\t\tconst execSpec = await options.buildExecSpec({\n\t\t\t\t\tcommand: execParams.command,\n\t\t\t\t\tenv: execParams.env,\n\t\t\t\t\tssh: options.lease.ssh,\n\t\t\t\t\tusePty: execParams.usePty,\n\t\t\t\t\tworkdir: execParams.workdir ?? options.effectiveGuestCwd,\n\t\t\t\t});\n\t\t\t\treturn {\n\t\t\t\t\t...execSpec,\n\t\t\t\t\tfinalizeToken: {\n\t\t\t\t\t\tactiveUseHandle,\n\t\t\t\t\t\t...(execSpec.finalizeToken !== undefined ? { innerToken: execSpec.finalizeToken } : {}),\n\t\t\t\t\t} satisfies ActiveUseFinalizeToken,\n\t\t\t\t};\n\t\t\t} catch (error) {\n\t\t\t\tawait activeUseHandle.dispose('failed').catch((cleanupError: unknown) => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`failed to end active use after buildExecSpec failure for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(cleanupError)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t\tfinalizeExec: async (finalizeParams) => {\n\t\t\tif (isActiveUseFinalizeToken(finalizeParams.token)) {\n\t\t\t\tif (finalizeParams.timedOut) {\n\t\t\t\t\tfinalizeParams.token.activeUseHandle.report({\n\t\t\t\t\t\tobservedAtMs: Date.now(),\n\t\t\t\t\t\tphase: 'failed',\n\t\t\t\t\t\tssh: {\n\t\t\t\t\t\t\tfailure: {\n\t\t\t\t\t\t\t\tkind: 'ssh-command-timed-out',\n\t\t\t\t\t\t\t\tmessage: 'exec command timed out.',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tawait endActiveUseFinalizeToken(\n\t\t\t\t\tfinalizeParams.token,\n\t\t\t\t\tactiveUseOutcomeForFinalizeParams(finalizeParams),\n\t\t\t\t);\n\t\t\t\tvoid publishFinalizeToolVmSshHealthEvent({\n\t\t\t\t\tagentId: options.lease.agentId,\n\t\t\t\t\tleaseId: options.lease.leaseId,\n\t\t\t\t\tpublishHealthEvent: options.publishHealthEvent,\n\t\t\t\t\ttimedOut: finalizeParams.timedOut,\n\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t});\n\t\t\t\tif (finalizeParams.timedOut) {\n\t\t\t\t\tawait options.markCachedLeaseStale('ssh-command-timed-out', undefined);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait disposeInnerFinalizeToken(finalizeParams.token);\n\t\t},\n\t\trunShellCommand: async (commandParams) =>\n\t\t\tawait runWithActiveUse(\n\t\t\t\t{\n\t\t\t\t\tsessionKey: options.sessionKey,\n\t\t\t\t\ttoolName: 'runShellCommand',\n\t\t\t\t},\n\t\t\t\tasync (activeUseHandle) =>\n\t\t\t\t\tawait runToolVmSshOperationWithGuard({\n\t\t\t\t\t\thealthEvent: {\n\t\t\t\t\t\t\tagentId: options.lease.agentId,\n\t\t\t\t\t\t\tleaseId: options.lease.leaseId,\n\t\t\t\t\t\t\toperation: 'command',\n\t\t\t\t\t\t\tpublish: options.publishHealthEvent,\n\t\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t\t},\n\t\t\t\t\t\toperation: async (signal) =>\n\t\t\t\t\t\t\tawait options.runRemoteShellScript({\n\t\t\t\t\t\t\t\tscript: commandParams.script,\n\t\t\t\t\t\t\t\tsignal: mergedAbortSignal(activeUseHandle.signal, signal),\n\t\t\t\t\t\t\t\tssh: options.lease.ssh,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\toperationName: 'runShellCommand',\n\t\t\t\t\t\treport: (report) => {\n\t\t\t\t\t\t\tactiveUseHandle.report(report);\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttimeoutMs: 30_000,\n\t\t\t\t\t}),\n\t\t\t),\n\t} satisfies OpenClawSandboxBackendHandle;\n}\n","import { ControllerLeaseRequestError, createLeaseClient } from '../controller-lease-client.js';\nimport type { CreateBackendDependencies } from './sandbox-backend-contract.js';\n\nexport function createGondolinSandboxBackendManager(\n\toptions: {\n\t\treadonly controllerUrl: string;\n\t\treadonly zoneId: string;\n\t},\n\tdependencies: CreateBackendDependencies,\n): {\n\tdescribeRuntime: (params: {\n\t\treadonly entry: { readonly containerName: string };\n\t}) => Promise<{ readonly configLabelMatch: boolean; readonly running: boolean }>;\n\tremoveRuntime: (params: { readonly entry: { readonly containerName: string } }) => Promise<void>;\n} {\n\treturn {\n\t\tdescribeRuntime: async (params) => {\n\t\t\tconst leaseClient =\n\t\t\t\tdependencies.createLeaseClient?.({\n\t\t\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\t\t}) ?? createLeaseClient({ controllerUrl: options.controllerUrl });\n\t\t\ttry {\n\t\t\t\tconst leaseStatus = await leaseClient.peekLease(params.entry.containerName);\n\t\t\t\treturn { configLabelMatch: true, running: leaseStatus !== null };\n\t\t\t} catch (error) {\n\t\t\t\tif (!(error instanceof ControllerLeaseRequestError) || error.status !== 404) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\treturn { configLabelMatch: false, running: false };\n\t\t\t}\n\t\t},\n\t\tremoveRuntime: async (params) => {\n\t\t\tconst leaseClient =\n\t\t\t\tdependencies.createLeaseClient?.({\n\t\t\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\t\t}) ?? createLeaseClient({ controllerUrl: options.controllerUrl });\n\t\t\tawait leaseClient.releaseLease(params.entry.containerName, { force: true });\n\t\t},\n\t};\n}\n","export interface ResolvedGondolinPluginConfig {\n\treadonly controllerUrl: string;\n\treadonly gatewayControlLinkMonitor?: {\n\t\treadonly baseIntervalMs: number;\n\t\treadonly enabled: boolean;\n\t\treadonly maxIntervalMs: number;\n\t};\n\treadonly profileId?: string;\n\treadonly zoneGitToken?: string;\n\treadonly zoneGitTokenEnv?: string;\n\treadonly zoneId: string;\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function resolveGondolinPluginConfig(\n\tconfig: Record<string, unknown>,\n): ResolvedGondolinPluginConfig {\n\tif (typeof config.controllerUrl !== 'string' || typeof config.zoneId !== 'string') {\n\t\tthrow new Error('Gondolin plugin config requires controllerUrl and zoneId.');\n\t}\n\tconst rawGatewayControlLinkMonitor = config.gatewayControlLinkMonitor;\n\tconst gatewayControlLinkMonitor = isObjectRecord(rawGatewayControlLinkMonitor)\n\t\t? {\n\t\t\t\tbaseIntervalMs:\n\t\t\t\t\ttypeof rawGatewayControlLinkMonitor.baseIntervalMs === 'number'\n\t\t\t\t\t\t? rawGatewayControlLinkMonitor.baseIntervalMs\n\t\t\t\t\t\t: 10_000,\n\t\t\t\tenabled:\n\t\t\t\t\ttypeof rawGatewayControlLinkMonitor.enabled === 'boolean'\n\t\t\t\t\t\t? rawGatewayControlLinkMonitor.enabled\n\t\t\t\t\t\t: true,\n\t\t\t\tmaxIntervalMs:\n\t\t\t\t\ttypeof rawGatewayControlLinkMonitor.maxIntervalMs === 'number'\n\t\t\t\t\t\t? rawGatewayControlLinkMonitor.maxIntervalMs\n\t\t\t\t\t\t: 120_000,\n\t\t\t}\n\t\t: undefined;\n\n\treturn {\n\t\tcontrollerUrl: config.controllerUrl,\n\t\t...(gatewayControlLinkMonitor ? { gatewayControlLinkMonitor } : {}),\n\t\t...(typeof config.profileId === 'string' ? { profileId: config.profileId } : {}),\n\t\t...(typeof config.zoneGitToken === 'string' ? { zoneGitToken: config.zoneGitToken } : {}),\n\t\t...(typeof config.zoneGitTokenEnv === 'string'\n\t\t\t? { zoneGitTokenEnv: config.zoneGitTokenEnv }\n\t\t\t: {}),\n\t\tzoneId: config.zoneId,\n\t};\n}\n","import { gatewayControlLinkHealthPins, type AgentVmHealthEvent } from '@agent-vm/gateway-interface';\n\nimport {\n\tControllerRequestPolicyTransportError,\n\tfetchControllerWithPolicy,\n} from './controller-request-policy.js';\n\nexport interface GatewayControlLinkMonitor {\n\tconsecutiveFailureCount(): number;\n\tnoteFailureForTest(): void;\n\tstart(): void;\n\tstop(): void;\n\ttick(): Promise<void>;\n}\n\nexport interface CreateGatewayControlLinkMonitorOptions {\n\treadonly baseIntervalMs: number;\n\treadonly clearTimeoutImpl?: (timer: NodeJS.Timeout) => void;\n\treadonly controllerUrl: string;\n\treadonly fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\treadonly maxIntervalMs: number;\n\treadonly now: () => number;\n\treadonly setTimeoutImpl?: (\n\t\tcallback: () => void | Promise<void>,\n\t\tdelayMs: number,\n\t) => NodeJS.Timeout;\n\treadonly writeLog?: (message: string) => void;\n\treadonly zoneId: string;\n}\n\nfunction defaultWriteLog(message: string): void {\n\tprocess.stderr.write(`[gateway-control-link-monitor] ${message}\\n`);\n}\n\nfunction joinUrl(baseUrl: string, path: string): string {\n\treturn `${baseUrl.replace(/\\/+$/, '')}${path}`;\n}\n\nfunction nextIntervalMs(options: {\n\treadonly baseIntervalMs: number;\n\treadonly consecutiveFailureCount: number;\n\treadonly maxIntervalMs: number;\n}): number {\n\tconst multiplier = 2 ** Math.min(options.consecutiveFailureCount, 8);\n\treturn Math.min(options.maxIntervalMs, options.baseIntervalMs * multiplier);\n}\n\nexport function createGatewayControlLinkMonitor(\n\toptions: CreateGatewayControlLinkMonitorOptions,\n): GatewayControlLinkMonitor {\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\tconst setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;\n\tconst clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;\n\tconst writeLog = options.writeLog ?? defaultWriteLog;\n\tlet consecutiveFailureCount = 0;\n\tlet stopped = true;\n\tlet timer: NodeJS.Timeout | undefined;\n\n\tconst publish = async (event: AgentVmHealthEvent): Promise<void> => {\n\t\tconst response = await fetchControllerWithPolicy({\n\t\t\tfetchImpl,\n\t\t\tinput: joinUrl(\n\t\t\t\toptions.controllerUrl,\n\t\t\t\t`/zones/${encodeURIComponent(options.zoneId)}/health-events`,\n\t\t\t),\n\t\t\tinit: {\n\t\t\t\tbody: JSON.stringify(event),\n\t\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\t\tmethod: 'POST',\n\t\t\t},\n\t\t\toperation: 'health-event-publish',\n\t\t});\n\t\tif (!response.ok) {\n\t\t\tawait response.text().catch(() => undefined);\n\t\t\tthrow new Error(`health event publish returned HTTP ${String(response.status)}`);\n\t\t}\n\t\tawait response.text().catch(() => undefined);\n\t};\n\n\tconst scheduleNext = (): void => {\n\t\tif (stopped) {\n\t\t\treturn;\n\t\t}\n\t\tif (timer) {\n\t\t\treturn;\n\t\t}\n\t\ttimer = setTimeoutImpl(\n\t\t\t() => {\n\t\t\t\ttimer = undefined;\n\t\t\t\tvoid tick().finally(scheduleNext);\n\t\t\t},\n\t\t\tnextIntervalMs({\n\t\t\t\tbaseIntervalMs: options.baseIntervalMs,\n\t\t\t\tconsecutiveFailureCount,\n\t\t\t\tmaxIntervalMs: options.maxIntervalMs,\n\t\t\t}),\n\t\t);\n\t\ttimer.unref?.();\n\t};\n\n\tconst tick = async (): Promise<void> => {\n\t\tconst startedAtMs = options.now();\n\t\tlet event: AgentVmHealthEvent;\n\t\ttry {\n\t\t\tconst response = await fetchControllerWithPolicy({\n\t\t\t\tfetchImpl,\n\t\t\t\tinput: joinUrl(options.controllerUrl, gatewayControlLinkHealthPins.path),\n\t\t\t\tinit: { method: 'GET' },\n\t\t\t\toperation: 'controller-health',\n\t\t\t});\n\t\t\tconst ok = response.ok;\n\t\t\tawait response.text().catch(() => undefined);\n\t\t\tconsecutiveFailureCount = ok ? 0 : consecutiveFailureCount + 1;\n\t\t\tevent = {\n\t\t\t\tcontrollerHost: gatewayControlLinkHealthPins.controllerHost,\n\t\t\t\tcontrollerPort: gatewayControlLinkHealthPins.controllerPort,\n\t\t\t\telapsedMs: options.now() - startedAtMs,\n\t\t\t\tkind: 'gateway-control-link',\n\t\t\t\tobservedAtMs: options.now(),\n\t\t\t\toperation: gatewayControlLinkHealthPins.operation,\n\t\t\t\tpath: gatewayControlLinkHealthPins.path,\n\t\t\t\tresult: ok ? 'ok' : 'failed',\n\t\t\t\tzoneId: options.zoneId,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconsecutiveFailureCount += 1;\n\t\t\tevent = {\n\t\t\t\tcontrollerHost: gatewayControlLinkHealthPins.controllerHost,\n\t\t\t\tcontrollerPort: gatewayControlLinkHealthPins.controllerPort,\n\t\t\t\telapsedMs: options.now() - startedAtMs,\n\t\t\t\tkind: 'gateway-control-link',\n\t\t\t\tobservedAtMs: options.now(),\n\t\t\t\toperation: gatewayControlLinkHealthPins.operation,\n\t\t\t\tpath: gatewayControlLinkHealthPins.path,\n\t\t\t\tresult:\n\t\t\t\t\terror instanceof ControllerRequestPolicyTransportError &&\n\t\t\t\t\terror.code === 'controller-request-timeout'\n\t\t\t\t\t\t? 'timeout'\n\t\t\t\t\t\t: 'failed',\n\t\t\t\tzoneId: options.zoneId,\n\t\t\t};\n\t\t\twriteLog(\n\t\t\t\t`gateway-control-link fetch failed operation=controller-health elapsedMs=${String(event.elapsedMs)} errorCode=${error instanceof ControllerRequestPolicyTransportError ? error.code : 'controller-request-failed'}`,\n\t\t\t);\n\t\t}\n\t\ttry {\n\t\t\t// The agent-vm controller cannot observe this successful gateway-local\n\t\t\t// fetch unless the gateway publishes the health event back over the\n\t\t\t// same control link.\n\t\t\tawait publish(event);\n\t\t} catch (error) {\n\t\t\twriteLog(\n\t\t\t\t`gateway-control-link publish failed operation=health-event-publish elapsedMs=${String(event.elapsedMs)} errorCode=${error instanceof ControllerRequestPolicyTransportError ? error.code : 'health-event-publish-failed'} message=${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\t};\n\n\treturn {\n\t\tconsecutiveFailureCount: () => consecutiveFailureCount,\n\t\tnoteFailureForTest: () => {\n\t\t\tconsecutiveFailureCount += 1;\n\t\t},\n\t\tstart: () => {\n\t\t\tstopped = false;\n\t\t\tscheduleNext();\n\t\t},\n\t\tstop: () => {\n\t\t\tstopped = true;\n\t\t\tif (!timer) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tclearTimeoutImpl(timer);\n\t\t\ttimer = undefined;\n\t\t},\n\t\ttick,\n\t};\n}\n","import type { SshHelpers, SshSandboxSession } from './openclaw-sandbox-sdk-contract.js';\nimport type {\n\tCreateBackendDependencies,\n\tOpenClawFsBridgeLeaseContext,\n\tOpenClawSandboxFsBridge,\n} from './sandbox-backend-factory.js';\n\nexport const OPENCLAW_SSH_SESSION_SCRATCH_ROOT = '/work';\n\nexport function createBackendDeps(ssh: SshHelpers): {\n\treadonly buildExecSpec: CreateBackendDependencies['buildExecSpec'];\n\treadonly createFsBridgeBuilder: (\n\t\tleaseContext: OpenClawFsBridgeLeaseContext,\n\t) => (params: { readonly sandbox: unknown }) => OpenClawSandboxFsBridge;\n\treadonly runRemoteShellScript: CreateBackendDependencies['runRemoteShellScript'];\n} {\n\treturn {\n\t\tbuildExecSpec: async ({ command, env, ssh: sshCreds, usePty, workdir }) => {\n\t\t\tconst session = await ssh.createSshSandboxSessionFromSettings({\n\t\t\t\tcommand: 'ssh',\n\t\t\t\tidentityData: sshCreds.identityPem,\n\t\t\t\tstrictHostKeyChecking: false,\n\t\t\t\ttarget: `${sshCreds.user}@${sshCreds.host}:${sshCreds.port}`,\n\t\t\t\tupdateHostKeys: false,\n\t\t\t\tworkspaceRoot: OPENCLAW_SSH_SESSION_SCRATCH_ROOT,\n\t\t\t});\n\t\t\tconst disposeSshSandboxSession = ssh.disposeSshSandboxSession;\n\t\t\treturn {\n\t\t\t\targv: ssh.buildSshSandboxArgv({\n\t\t\t\t\tremoteCommand: ssh.buildExecRemoteCommand({\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t\tenv,\n\t\t\t\t\t\tworkdir,\n\t\t\t\t\t}),\n\t\t\t\t\tsession,\n\t\t\t\t\ttty: usePty,\n\t\t\t\t}),\n\t\t\t\tenv: ssh.sanitizeEnvVars(process.env).allowed,\n\t\t\t\tfinalizeToken: {\n\t\t\t\t\tdispose: async (): Promise<void> => {\n\t\t\t\t\t\tif (disposeSshSandboxSession) {\n\t\t\t\t\t\t\tawait disposeSshSandboxSession(session);\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\tsession,\n\t\t\t\t},\n\t\t\t\tstdinMode: 'pipe-open' as const,\n\t\t\t};\n\t\t},\n\t\tcreateFsBridgeBuilder:\n\t\t\t(leaseContext: OpenClawFsBridgeLeaseContext) =>\n\t\t\t(params: { readonly sandbox: unknown }): OpenClawSandboxFsBridge =>\n\t\t\t\tssh.createRemoteShellSandboxFsBridge({\n\t\t\t\t\tsandbox: params.sandbox,\n\t\t\t\t\truntime: {\n\t\t\t\t\t\tremoteAgentWorkspaceDir: leaseContext.remoteAgentWorkspaceDir,\n\t\t\t\t\t\tremoteWorkspaceDir: leaseContext.remoteWorkspaceDir,\n\t\t\t\t\t\trunRemoteShellScript: leaseContext.runRemoteShellScript,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\trunRemoteShellScript: async ({ allowFailure, script, signal, ssh: sshCreds, stdin }) => {\n\t\t\tconst session = await ssh.createSshSandboxSessionFromSettings({\n\t\t\t\tcommand: 'ssh',\n\t\t\t\tidentityData: sshCreds.identityPem,\n\t\t\t\tstrictHostKeyChecking: false,\n\t\t\t\ttarget: `${sshCreds.user}@${sshCreds.host}:${sshCreds.port}`,\n\t\t\t\tupdateHostKeys: false,\n\t\t\t\tworkspaceRoot: OPENCLAW_SSH_SESSION_SCRATCH_ROOT,\n\t\t\t});\n\t\t\treturn await ssh.runSshSandboxCommand({\n\t\t\t\t...(allowFailure !== undefined ? { allowFailure } : {}),\n\t\t\t\tremoteCommand: ssh.buildRemoteCommand(['/bin/sh', '-c', script, 'gondolin-sandbox-fs']),\n\t\t\t\tsession,\n\t\t\t\t...(signal !== undefined ? { signal } : {}),\n\t\t\t\t...(stdin !== undefined ? { stdin } : {}),\n\t\t\t});\n\t\t},\n\t};\n}\n\nexport type { SshHelpers, SshSandboxSession };\n","import {\n\teffectiveOpenClawGondolinSandboxValue,\n\tformatOpenClawGondolinRequirementFieldPath,\n\tformatOpenClawGondolinRequirementFindingId,\n\tformatOpenClawGondolinRequirementHint,\n\tOPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS,\n\ttype OpenClawGondolinAgentConfig,\n} from './openclaw-gondolin-contract.js';\n\ninterface OpenClawRuntimeConfig {\n\treadonly [key: string]: unknown;\n\treadonly agents?: {\n\t\treadonly defaults?: OpenClawGondolinAgentConfig;\n\t\treadonly list?: readonly unknown[];\n\t};\n}\n\nexport interface OpenClawRuntimeRequirementFinding {\n\treadonly hint: string;\n\treadonly id: string;\n\treadonly ok: boolean;\n}\n\nexport interface OpenClawRuntimeStatusReport {\n\treadonly findings: readonly OpenClawRuntimeRequirementFinding[];\n\treadonly pluginId: 'gondolin';\n\treadonly zoneId: string;\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction readAgentConfigEntries(config: OpenClawRuntimeConfig): readonly {\n\treadonly config: OpenClawGondolinAgentConfig;\n\treadonly label: string;\n}[] {\n\tconst defaultConfig = config.agents?.defaults ?? {};\n\tconst agentConfigs = (config.agents?.list ?? [])\n\t\t.filter(isObjectRecord)\n\t\t.map((agentConfig, agentIndex) => ({\n\t\t\tconfig: agentConfig,\n\t\t\tlabel:\n\t\t\t\ttypeof agentConfig.id === 'string'\n\t\t\t\t\t? `agent-${agentConfig.id}`\n\t\t\t\t\t: `agent-${String(agentIndex)}`,\n\t\t}));\n\treturn [{ config: defaultConfig, label: 'defaults' }, ...agentConfigs];\n}\n\nfunction effectiveWorkspace(\n\tdefaults: OpenClawGondolinAgentConfig,\n\tagentConfig: OpenClawGondolinAgentConfig,\n): unknown {\n\treturn agentConfig.workspace ?? defaults.workspace;\n}\n\nfunction requirementFinding(options: {\n\treadonly actualValue: unknown;\n\treadonly expectedValue: string;\n\treadonly fieldPath: string;\n\treadonly label: string;\n\treadonly zoneId: string;\n}): OpenClawRuntimeRequirementFinding {\n\tconst ok = options.actualValue === options.expectedValue;\n\treturn {\n\t\tid: formatOpenClawGondolinRequirementFindingId({\n\t\t\tfieldPath: options.fieldPath,\n\t\t\tlabel: options.label,\n\t\t\tzoneId: options.zoneId,\n\t\t}),\n\t\tok,\n\t\thint: formatOpenClawGondolinRequirementHint({\n\t\t\texpectedValue: options.expectedValue,\n\t\t\tfieldPath: options.fieldPath,\n\t\t\tok,\n\t\t}),\n\t};\n}\n\nexport function buildOpenClawRuntimeStatusReport(options: {\n\treadonly config: Record<string, unknown>;\n\treadonly zoneId: string;\n}): OpenClawRuntimeStatusReport {\n\tconst config: OpenClawRuntimeConfig = options.config;\n\tconst defaults = config.agents?.defaults ?? {};\n\treturn {\n\t\tpluginId: 'gondolin',\n\t\tzoneId: options.zoneId,\n\t\tfindings: readAgentConfigEntries(config).flatMap(({ config: agentConfig, label }) => {\n\t\t\tconst workspace = effectiveWorkspace(defaults, agentConfig);\n\t\t\tconst requirementFindings = OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS.map((requirement) =>\n\t\t\t\trequirementFinding({\n\t\t\t\t\tactualValue: effectiveOpenClawGondolinSandboxValue(\n\t\t\t\t\t\tdefaults,\n\t\t\t\t\t\tagentConfig,\n\t\t\t\t\t\trequirement.key,\n\t\t\t\t\t),\n\t\t\t\t\texpectedValue: requirement.expectedValue,\n\t\t\t\t\tfieldPath: formatOpenClawGondolinRequirementFieldPath(label, requirement.key),\n\t\t\t\t\tlabel,\n\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst workspaceFinding = {\n\t\t\t\tid: `openclaw-tool-vm-workspace-${options.zoneId}-${label}`,\n\t\t\t\tok: workspace !== '/zone',\n\t\t\t\thint:\n\t\t\t\t\tworkspace === '/zone'\n\t\t\t\t\t\t? 'Use /zone/agents/default or per-agent workspaces; keep /zone for shared zone files.'\n\t\t\t\t\t\t: typeof workspace === 'string'\n\t\t\t\t\t\t\t? workspace\n\t\t\t\t\t\t\t: 'agents workspace is unset',\n\t\t\t} satisfies OpenClawRuntimeRequirementFinding;\n\t\t\treturn requirementFindings.concat(workspaceFinding);\n\t\t}),\n\t};\n}\n","export interface SshSandboxSession {\n\treadonly command: string;\n\treadonly configPath: string;\n\treadonly host: string;\n}\n\nexport interface SshHelpers {\n\treadonly buildExecRemoteCommand: (params: {\n\t\treadonly command: string;\n\t\treadonly env: Record<string, string>;\n\t\treadonly workdir?: string;\n\t}) => string;\n\treadonly buildRemoteCommand: (argv: readonly string[]) => string;\n\treadonly buildSshSandboxArgv: (params: {\n\t\treadonly remoteCommand: string;\n\t\treadonly session: SshSandboxSession;\n\t\treadonly tty?: boolean;\n\t}) => string[];\n\treadonly createRemoteShellSandboxFsBridge: (params: {\n\t\treadonly runtime: {\n\t\t\treadonly remoteAgentWorkspaceDir: string;\n\t\t\treadonly remoteWorkspaceDir: string;\n\t\t\treadonly runRemoteShellScript: (shellParams: {\n\t\t\t\treadonly allowFailure?: boolean;\n\t\t\t\treadonly args?: string[];\n\t\t\t\treadonly script: string;\n\t\t\t\treadonly signal?: AbortSignal;\n\t\t\t\treadonly stdin?: Buffer | string;\n\t\t\t}) => Promise<{\n\t\t\t\treadonly code: number;\n\t\t\t\treadonly stderr: Buffer;\n\t\t\t\treadonly stdout: Buffer;\n\t\t\t}>;\n\t\t};\n\t\treadonly sandbox: unknown;\n\t}) => import('./sandbox-backend-factory.js').OpenClawSandboxFsBridge;\n\treadonly createSshSandboxSessionFromSettings: (settings: {\n\t\treadonly command: string;\n\t\treadonly identityData?: string;\n\t\treadonly strictHostKeyChecking: boolean;\n\t\treadonly target: string;\n\t\treadonly updateHostKeys: boolean;\n\t\treadonly workspaceRoot: string;\n\t}) => Promise<SshSandboxSession>;\n\treadonly disposeSshSandboxSession?: (session: SshSandboxSession) => Promise<void>;\n\treadonly runSshSandboxCommand: (params: {\n\t\treadonly allowFailure?: boolean;\n\t\treadonly remoteCommand: string;\n\t\treadonly session: SshSandboxSession;\n\t\treadonly signal?: AbortSignal;\n\t\treadonly stdin?: Buffer | string;\n\t}) => Promise<{\n\t\treadonly code: number;\n\t\treadonly stderr: Buffer;\n\t\treadonly stdout: Buffer;\n\t}>;\n\treadonly sanitizeEnvVars: (env: NodeJS.ProcessEnv) => {\n\t\treadonly allowed: Record<string, string>;\n\t};\n}\n\nexport interface OpenClawToolRegistration {\n\treadonly description: string;\n\treadonly execute: (toolCallId: string, params: unknown) => Promise<OpenClawToolResult>;\n\treadonly name: string;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface OpenClawToolRegistrationOptions {\n\treadonly name?: string;\n\treadonly names?: readonly string[];\n\treadonly optional?: boolean;\n}\n\nexport interface OpenClawToolResult {\n\treadonly content: string;\n\treadonly details?: unknown;\n}\n\nexport interface OpenClawToolRegistrationApi {\n\treadonly registerTool?: (\n\t\ttool: OpenClawToolRegistration,\n\t\toptions?: OpenClawToolRegistrationOptions,\n\t) => void;\n}\n\nexport function assertSdkShape(value: unknown): asserts value is SshHelpers & {\n\tregisterSandboxBackend: (\n\t\tid: string,\n\t\tregistration: {\n\t\t\tfactory: ReturnType<\n\t\t\t\ttypeof import('./sandbox-backend-factory.js').createGondolinSandboxBackendFactory\n\t\t\t>;\n\t\t\tmanager?: ReturnType<\n\t\t\t\ttypeof import('./sandbox-backend-factory.js').createGondolinSandboxBackendManager\n\t\t\t>;\n\t\t},\n\t) => void;\n} {\n\tif (typeof value !== 'object' || value === null) {\n\t\tthrow new TypeError('OpenClaw SDK module is not an object');\n\t}\n\n\tfor (const exportName of [\n\t\t'buildExecRemoteCommand',\n\t\t'buildRemoteCommand',\n\t\t'buildSshSandboxArgv',\n\t\t'createRemoteShellSandboxFsBridge',\n\t\t'createSshSandboxSessionFromSettings',\n\t\t'runSshSandboxCommand',\n\t\t'sanitizeEnvVars',\n\t\t'registerSandboxBackend',\n\t] as const) {\n\t\tif (typeof (value as Record<string, unknown>)[exportName] !== 'function') {\n\t\t\tthrow new TypeError(`OpenClaw SDK missing required export: ${exportName}`);\n\t\t}\n\t}\n}\n","import { fetchControllerWithPolicy } from './controller-request-policy.js';\nimport type { OpenClawToolRegistrationApi } from './openclaw-sandbox-sdk-contract.js';\n\ntype RequiredOpenClawToolRegistrationApi = OpenClawToolRegistrationApi & {\n\treadonly registerTool: NonNullable<OpenClawToolRegistrationApi['registerTool']>;\n};\n\nexport interface RegisterZoneGitToolOptions {\n\treadonly api: RequiredOpenClawToolRegistrationApi;\n\treadonly controllerUrl: string;\n\treadonly fetchImpl?: typeof fetch;\n\treadonly zoneGitToken?: string;\n\treadonly zoneId: string;\n}\n\nconst zoneGitCapabilityHeader = 'x-agent-vm-zone-git-token';\n\nfunction readExpectedHead(input: unknown): string {\n\tif (typeof input !== 'object' || input === null || !('expectedHead' in input)) {\n\t\tthrow new Error('zone_git_push requires expectedHead.');\n\t}\n\tconst expectedHead = input.expectedHead;\n\tif (typeof expectedHead !== 'string' || expectedHead.length === 0) {\n\t\tthrow new Error('zone_git_push requires expectedHead.');\n\t}\n\treturn expectedHead;\n}\n\nfunction buildControllerUrl(controllerUrl: string, zoneId: string): string {\n\treturn `${controllerUrl.replace(/\\/$/u, '')}/zones/${encodeURIComponent(zoneId)}/zone-git/push`;\n}\n\nasync function readResponseText(response: Response): Promise<string> {\n\ttry {\n\t\treturn await response.text();\n\t} catch (error) {\n\t\treturn error instanceof Error ? error.message : String(error);\n\t}\n}\n\nfunction parseJsonPayload(responseText: string): unknown {\n\ttry {\n\t\treturn JSON.parse(responseText);\n\t} catch (error) {\n\t\tthrow new Error(`zone_git_push returned non-JSON response: ${responseText.slice(0, 500)}`, {\n\t\t\tcause: error,\n\t\t});\n\t}\n}\n\nexport function registerZoneGitTool(options: RegisterZoneGitToolOptions): void {\n\toptions.api.registerTool(\n\t\t{\n\t\t\tname: 'zone_git_push',\n\t\t\tdescription:\n\t\t\t\t'Push committed OpenClaw zone workspace changes through the agent-vm controller. Use after git commit; do not run raw git push.',\n\t\t\tparameters: {\n\t\t\t\ttype: 'object',\n\t\t\t\tadditionalProperties: false,\n\t\t\t\tproperties: {\n\t\t\t\t\texpectedHead: { type: 'string' },\n\t\t\t\t},\n\t\t\t\trequired: ['expectedHead'],\n\t\t\t},\n\t\t\texecute: async (_toolCallId: string, input: unknown) => {\n\t\t\t\tconst expectedHead = readExpectedHead(input);\n\t\t\t\tconst response = await fetchControllerWithPolicy({\n\t\t\t\t\tfetchImpl: options.fetchImpl ?? fetch,\n\t\t\t\t\tinput: buildControllerUrl(options.controllerUrl, options.zoneId),\n\t\t\t\t\tinit: {\n\t\t\t\t\t\tbody: JSON.stringify({ expectedHead }),\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t\t\t...(options.zoneGitToken ? { [zoneGitCapabilityHeader]: options.zoneGitToken } : {}),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\t},\n\t\t\t\t\toperation: 'zone-git-push',\n\t\t\t\t});\n\t\t\t\tconst responseText = await readResponseText(response);\n\t\t\t\tif (!response.ok) {\n\t\t\t\t\tthrow new Error(`zone_git_push failed: ${response.status} ${responseText.slice(0, 500)}`);\n\t\t\t\t}\n\t\t\t\tconst payload = parseJsonPayload(responseText);\n\t\t\t\treturn {\n\t\t\t\t\tcontent: JSON.stringify(payload),\n\t\t\t\t\tdetails: payload,\n\t\t\t\t};\n\t\t\t},\n\t\t},\n\t\t{ name: 'zone_git_push', optional: true },\n\t);\n}\n","import { createLeaseClient } from './controller-lease-client.js';\nimport { createGatewayControlLinkMonitor } from './gateway-control-link-monitor.js';\nimport { resolveGondolinPluginConfig } from './gondolin-plugin-config.js';\nimport {\n\tOPENCLAW_SSH_SESSION_SCRATCH_ROOT,\n\tcreateBackendDeps,\n} from './openclaw-backend-dependencies.js';\nimport { buildOpenClawRuntimeStatusReport } from './openclaw-runtime-status.js';\nimport {\n\tassertSdkShape,\n\ttype OpenClawToolRegistrationApi,\n\ttype SshHelpers,\n\ttype SshSandboxSession,\n} from './openclaw-sandbox-sdk-contract.js';\nimport {\n\tcreateGondolinSandboxBackendFactory,\n\tcreateGondolinSandboxBackendManager,\n} from './sandbox-backend-factory.js';\nimport { registerZoneGitTool } from './zone-git-tool.js';\n\nasync function publishRuntimeStatus(options: {\n\treadonly controllerUrl: string;\n\treadonly report: ReturnType<typeof buildOpenClawRuntimeStatusReport>;\n}): Promise<void> {\n\tconst leaseClient = createLeaseClient({ controllerUrl: options.controllerUrl });\n\tawait leaseClient.publishOpenClawRuntimeStatus?.(options.report);\n}\n\nconst plugin = {\n\tid: 'gondolin',\n\tname: 'Gondolin VM Sandbox',\n\tdescription: 'Sandbox backend powered by Gondolin micro-VMs.',\n\n\tregister(api: {\n\t\treadonly config?: Record<string, unknown>;\n\t\treadonly pluginConfig: Record<string, unknown>;\n\t\treadonly registerTool?: OpenClawToolRegistrationApi['registerTool'];\n\t\treadonly registrationMode: string;\n\t\treadonly runtime?: {\n\t\t\treadonly config?: {\n\t\t\t\treadonly current?: () => Record<string, unknown>;\n\t\t\t};\n\t\t};\n\t}): void {\n\t\tconst registerTool = api.registerTool;\n\t\tif (typeof registerTool !== 'function') {\n\t\t\tif (api.registrationMode === 'full') {\n\t\t\t\tthrow new Error('Gondolin full registration requires OpenClaw registerTool.');\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tconst pluginConfig = resolveGondolinPluginConfig(api.pluginConfig);\n\t\tconst zoneGitToken =\n\t\t\tpluginConfig.zoneGitToken ??\n\t\t\t(pluginConfig.zoneGitTokenEnv ? process.env[pluginConfig.zoneGitTokenEnv] : undefined);\n\t\tregisterZoneGitTool({\n\t\t\tapi: { registerTool },\n\t\t\tcontrollerUrl: pluginConfig.controllerUrl,\n\t\t\t...(zoneGitToken ? { zoneGitToken } : {}),\n\t\t\tzoneId: pluginConfig.zoneId,\n\t\t});\n\t\tif (api.registrationMode !== 'full') {\n\t\t\treturn;\n\t\t}\n\t\tif (pluginConfig.gatewayControlLinkMonitor?.enabled) {\n\t\t\tcreateGatewayControlLinkMonitor({\n\t\t\t\tbaseIntervalMs: pluginConfig.gatewayControlLinkMonitor.baseIntervalMs,\n\t\t\t\tcontrollerUrl: pluginConfig.controllerUrl,\n\t\t\t\tmaxIntervalMs: pluginConfig.gatewayControlLinkMonitor.maxIntervalMs,\n\t\t\t\tnow: () => Date.now(),\n\t\t\t\tzoneId: pluginConfig.zoneId,\n\t\t\t}).start();\n\t\t}\n\t\tconst buildRuntimeStatus = ():\n\t\t\t| ReturnType<typeof buildOpenClawRuntimeStatusReport>\n\t\t\t| undefined => {\n\t\t\tconst runtimeConfig = api.runtime?.config?.current?.() ?? api.config;\n\t\t\treturn runtimeConfig\n\t\t\t\t? buildOpenClawRuntimeStatusReport({\n\t\t\t\t\t\tconfig: runtimeConfig,\n\t\t\t\t\t\tzoneId: pluginConfig.zoneId,\n\t\t\t\t\t})\n\t\t\t\t: undefined;\n\t\t};\n\t\tconst initialRuntimeStatus = buildRuntimeStatus();\n\t\tif (initialRuntimeStatus) {\n\t\t\tvoid publishRuntimeStatus({\n\t\t\t\tcontrollerUrl: pluginConfig.controllerUrl,\n\t\t\t\treport: initialRuntimeStatus,\n\t\t\t}).catch((error: unknown) => {\n\t\t\t\tconst message = error instanceof Error ? error.message : JSON.stringify(error);\n\t\t\t\tprocess.stderr.write(`[gondolin] failed to publish OpenClaw runtime status: ${message}\\n`);\n\t\t\t});\n\t\t}\n\n\t\tconst sdkPath = '/opt/openclaw-sdk/sandbox.js';\n\t\tconst sdkPromise = import(sdkPath).then((sdkRaw: Record<string, unknown>) => {\n\t\t\tassertSdkShape(sdkRaw);\n\n\t\t\tconst sshHelpers: SshHelpers = {\n\t\t\t\tbuildExecRemoteCommand: sdkRaw.buildExecRemoteCommand,\n\t\t\t\tbuildRemoteCommand: sdkRaw.buildRemoteCommand,\n\t\t\t\tbuildSshSandboxArgv: sdkRaw.buildSshSandboxArgv,\n\t\t\t\tcreateRemoteShellSandboxFsBridge: sdkRaw.createRemoteShellSandboxFsBridge,\n\t\t\t\tcreateSshSandboxSessionFromSettings: sdkRaw.createSshSandboxSessionFromSettings,\n\t\t\t\t...(typeof sdkRaw.disposeSshSandboxSession === 'function'\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tdisposeSshSandboxSession: sdkRaw.disposeSshSandboxSession as (\n\t\t\t\t\t\t\t\tsession: SshSandboxSession,\n\t\t\t\t\t\t\t) => Promise<void>,\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t\trunSshSandboxCommand: sdkRaw.runSshSandboxCommand,\n\t\t\t\tsanitizeEnvVars: sdkRaw.sanitizeEnvVars,\n\t\t\t};\n\n\t\t\tconst backendDependencies = createBackendDeps(sshHelpers);\n\t\t\tsdkRaw.registerSandboxBackend('gondolin', {\n\t\t\t\tfactory: createGondolinSandboxBackendFactory(\n\t\t\t\t\t{\n\t\t\t\t\t\t...pluginConfig,\n\t\t\t\t\t\topenClawRuntimeConfigProvider: () => api.runtime?.config?.current?.() ?? api.config,\n\t\t\t\t\t\topenClawRuntimeStatusProvider: buildRuntimeStatus,\n\t\t\t\t\t},\n\t\t\t\t\tbackendDependencies,\n\t\t\t\t),\n\t\t\t\tmanager: createGondolinSandboxBackendManager(pluginConfig, backendDependencies),\n\t\t\t});\n\t\t});\n\n\t\tsdkPromise.catch((error: unknown) => {\n\t\t\tconst message = error instanceof Error ? error.message : JSON.stringify(error);\n\t\t\tprocess.stderr.write(`[gondolin] failed to load OpenClaw SDK: ${message}\\n`);\n\t\t});\n\t},\n};\n\nexport default plugin;\n\nexport { OPENCLAW_SSH_SESSION_SCRATCH_ROOT, createBackendDeps };\nexport type { SshHelpers };\n","export * from './sandbox-backend-factory.js';\nexport * from './gondolin-plugin-config.js';\nexport * from './controller-request-policy.js';\nexport * from './controller-lease-client.js';\nexport { createGatewayControlLinkMonitor } from './gateway-control-link-monitor.js';\nexport * from './openclaw-plugin-registration.js';\nexport * from './openclaw-gondolin-contract.js';\nexport { buildOpenClawRuntimeStatusReport } from './openclaw-runtime-status.js';\nexport { default } from './openclaw-plugin-registration.js';\n\nexport const OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME = '@agent-vm/openclaw-agent-vm-plugin';\n"],"mappings":";;;;AA8EA,IAAa,8BAAb,cAAiD,MAAM;CACtD;CACA;CACA;CACA;CAEA,YAAY,SAKT;EACF,MAAM,OACL,QAAQ,UAAU,OAAO,QAAQ,SAAS,MAAM,iBAAiB;EAClE,MACC,GAAG,QAAQ,QAAQ,iBAAiB,OAAO,QAAQ,OAAO,CAAC,IAAI,KAAK,GAAG,4BACtE,QAAQ,aACR,GACD;EACD,KAAK,WAAW,QAAQ;EACxB,KAAK,OAAO;EACZ,KAAK,eAAe,QAAQ;EAC5B,KAAK,SAAS,QAAQ;;;AAIxB,MAAM,kCAAkC,EAAE,OAAO;CAChD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU;CAC5C,CAAC;AAEF,SAAS,mBAAmB,OAAgE;CAC3F,OACC,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAQ,MAAM,IACrB,OAAO,OAAO,MAAM,CAAC,MAAM,YAAY;;AAIzC,SAAS,YAAY,OAAoC;CACxD,IACC,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,aACjB,OAAO,UAAU,UAEjB,OAAO;CAER,IAAI,MAAM,QAAQ,MAAM,EACvB,OAAO,MAAM,MAAM,YAAY;CAEhC,OAAO,mBAAmB,MAAM;;AAGjC,MAAM,kBAAkB,EAAE,OAAkB,YAAY;AAExD,SAAS,YAAY,OAAoC;CACxD,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA;;AAG9D,SAAS,4BAA4B,cAA6C;CACjF,MAAM,cAAc,gCAAgC,UAAU,aAAa;CAC3E,IAAI,CAAC,YAAY,SAChB,OAAO;CAER,MAAM,EAAE,UAAU,YAAY,YAAY;CAC1C,MAAM,QAAQ,CAAC,SAAS,WAAW,aAAa,aAAa,KAAA,EAAU,CAAC,QACtE,SAAyB,SAAS,KAAA,EACnC;CACD,OAAO,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK;;AAGpD,SAAS,yBAAyB,OAAuD;CACxF,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,KAAK,YACnD,OAAO,QAAQ,IAAI,QAAQ,QAAQ,KAAK;;AAI1C,SAAS,6BAA6B,OAA2D;CAChG,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,KAAK;;AAIrD,SAASA,qBAAmB,OAAwB;CACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAS,oBAAoB,SAAuB;CACnD,QAAQ,OAAO,MAAM,8BAA8B,QAAQ,IAAI;;AAGhE,SAAS,cAAc,UAAkB,SAAwC;CAChF,IAAI;EACH,MAAM,aAAsB,KAAK,MAAM,SAAS;EAChD,MAAM,aAAa,gBAAgB,UAAU,WAAW;EACxD,OAAO,WAAW,UAAU,WAAW,OAAO,KAAA;UACtC,OAAO;EACf,oBAAoB,GAAG,QAAQ,mCAAmCA,qBAAmB,MAAM,GAAG;EAC9F;;;AAIF,eAAe,cACd,UACA,SAIE;CACF,MAAM,WAAW,MAAM,SAAS,MAAM,CAAC,YAAY,eAAe;CAClE,OAAO;EACN;EACA,cAAc,aAAa,iBAAiB,KAAA,IAAY,cAAc,UAAU,QAAQ;EACxF;;AAGF,eAAe,iBACd,UACA,SACA,oBACkB;CAClB,IAAI,CAAC,SAAS,IAAI;EACjB,MAAM,YAAY,MAAM,cAAc,UAAU,QAAQ;EACxD,MAAM,IAAI,4BAA4B;GACrC,UAAU,UAAU;GACpB;GACA,cAAc,UAAU;GACxB,QAAQ,SAAS;GACjB,CAAC;;CAEH,MAAM,UAAU,MAAM,SAAS,MAAM;CACrC,IAAI,CAAC,mBAAmB,QAAQ,EAC/B,MAAM,IAAI,UACT,GAAG,QAAQ,iCAAiC,KAAK,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,GACjF;CAEF,OAAO;;AAGR,SAAgB,kBAAkB,SAIlB;CACf,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,QAAQ,cAAc,QAAQ,QAAQ,GAAG;CACzD,MAAM,kBAAkB,OAAO,sBAK9B,MAAM,0BAA0B;EAC/B;EACA,OAAO,kBAAkB;EACzB,WAAW,kBAAkB;EAC7B,GAAI,kBAAkB,SAAS,KAAA,IAAY,EAAE,GAAG,EAAE,MAAM,kBAAkB,MAAM;EAChF,GAAI,QAAQ,kBAAkB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,QAAQ,eAAe;EAChF,CAAC;CAEH,MAAM,aAAa,OAAO,YAA6C;EAQtE,OAAO,MAAM,iBAAiB,MAPP,gBAAgB;GACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC;GACvD,MAAM,EACL,QAAQ,QACR;GACD,WAAW;GACX,CAAC,EACsC,8BAA8B,iBAAiB;;CAGxF,OAAO;EACN,cAAc,OACb,SACA,OACA,YACmB;GACnB,MAAM,WAAW,MAAM,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC,QAAQ,mBAAmB,MAAM;IACxF,MAAM;KACL,MAAM,KAAK,UAAU,QAAQ;KAC7B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,YAAY,MAAM,cAAc,UAAU,gCAAgC;IAChF,MAAM,IAAI,4BAA4B;KACrC,UAAU,UAAU;KACpB,SAAS;KACT,cAAc,UAAU;KACxB,QAAQ,SAAS;KACjB,CAAC;;GAEH,MAAM,4BAA4B,SAAS;;EAE5C,oBAAoB,OACnB,SACA,OACA,YAC+C;GAY/C,OAAO,MAAM,iBACZ,MAZsB,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC,QAAQ,mBAAmB,MAAM,CAAC;IACzF,MAAM;KACL,MAAM,KAAK,UAAU,QAAQ;KAC7B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC,EAGD,uCACA,6BACA;;EAEF;EACA,WAAW,OAAO,YAA8C;GAK/D,OAAO,MAAM,iBAAiB,MAJP,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC;IACvD,WAAW;IACX,CAAC,EACsC,6BAA6B,kBAAkB;;EAExF,8BAA8B,OAAO,WAA0B;GAC9D,MAAM,WAAW,MAAM,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,OAAO,OAAO,CAAC;IAC7D,MAAM;KACL,MAAM,KAAK,UAAU,OAAO;KAC5B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,YAAY,MAAM,cAAc,UAAU,yCAAyC;IACzF,MAAM,IAAI,4BAA4B;KACrC,UAAU,UAAU;KACpB,SAAS;KACT,cAAc,UAAU;KACxB,QAAQ,SAAS;KACjB,CAAC;;GAEH,MAAM,4BAA4B,SAAS;;EAE5C,cAAc,OACb,SACA,iBAA+C,EAAE,KAC9B;GACnB,MAAM,aAAa,IAAI,IAAI,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,GAAG;GAC7E,IAAI,eAAe,UAAU,MAC5B,WAAW,aAAa,IAAI,SAAS,OAAO;GAE7C,MAAM,WAAW,MAAM,gBAAgB;IACtC,OAAO,WAAW,UAAU;IAC5B,MAAM,EACL,QAAQ,UACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,YAAY,MAAM,cAAc,UAAU,+BAA+B;IAC/E,MAAM,IAAI,4BAA4B;KACrC,UAAU,UAAU;KACpB,SAAS;KACT,cAAc,UAAU;KACxB,QAAQ,SAAS;KACjB,CAAC;;GAEH,MAAM,4BAA4B,SAAS;;EAE5C,cAAc,OAAO,YAAqC;GAoBzD,OAAO,MAAM,iBAAiB,MAnBP,gBAAgB;IACtC,OAAO,GAAG,QAAQ;IAClB,MAAM;KACL,MAAM,KAAK,UAAU;MACpB,SAAS,QAAQ;MACjB,mBAAmB,QAAQ;MAC3B,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;MAC3E,WAAW,QAAQ;MACnB,YAAY,QAAQ;MACpB,cAAc,QAAQ;MACtB,QAAQ,QAAQ;MAChB,CAAC;KACF,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC,EACsC,wBAAwB,iBAAiB;;EAElF,gBAAgB,OACf,SACA,YAC2C;GAY3C,OAAO,MAAM,iBACZ,MAZsB,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC;IACvD,MAAM;KACL,MAAM,KAAK,UAAU,QAAQ;KAC7B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC,EAGD,mCACA,yBACA;;EAEF;;;;ACvZF,MAAM,iBAAiB;AAEvB,MAAa,4BAA4B;AAEzC,MAAa,yCAAyC;CACrD;EAAE,eAAe;EAAY,KAAK;EAAW;CAC7C;EAAE,eAAe;EAAO,KAAK;EAAQ;CACrC;EAAE,eAAe;EAAS,KAAK;EAAS;CACxC;EAAE,eAAe;EAAM,KAAK;EAAmB;CAC/C;AAED,MAAa,yCACZ;AAoBD,IAAa,uBAAb,cAA0C,MAAM;CAC/C,YAAY,SAAiB;EAC5B,MAAM,QAAQ;EACd,KAAK,OAAO;;;AAId,SAAgB,kBAAkB,OAAwB;CACzD,OAAO,eAAe,KAAK,MAAM,MAAM,CAAC;;AAGzC,SAAgB,sCACf,UACA,aACA,KACU;CACV,OAAO,YAAY,UAAU,QAAQ,SAAS,UAAU;;AAGzD,SAAgB,2CACf,OACA,KACS;CACT,OAAO,UAAU,MAAM,WAAW;;AAGnC,SAAgB,2CAA2C,SAIhD;CACV,OAAO,oBAAoB,QAAQ,UAAU,QAAQ,YAAY,IAAI,CAAC,GAAG,QAAQ,OAAO,GAAG,QAAQ;;AAGpG,SAAgB,sCAAsC,SAI3C;CACV,OAAO,QAAQ,KACZ,GAAG,QAAQ,UAAU,GAAG,QAAQ,kBAChC,OAAO,QAAQ,UAAU,OAAO,QAAQ,cAAc;;AAG1D,SAAgB,yBAAyB,OAA0C;CAClF,MAAM,WAAW,SAAS,IAAI,MAAM,CAAC,aAAa;CAClD,IAAI,YAAY,IACf,OAAO;CAER,IAAI,CAAC,kBAAkB,QAAQ,EAC9B,MAAM,IAAI,qBAAqB,6BAA6B,MAAM,IAAI;CAEvE,OAAO;;AAGR,SAAgB,qCAAqC,YAA4B;CAChF,MAAM,QAAQ,WAAW,MAAM,CAAC,MAAM,IAAI;CAC1C,IAAI,MAAM,OAAO,WAAW,CAAC,MAAM,MAAM,CAAC,kBAAkB,MAAM,GAAG,EACpE,MAAM,IAAI,qBACT,wBAAwB,WAAW,qDACnC;CAEF,OAAO,yBAAyB,MAAM,GAAG;;AAG1C,SAAgB,0BAA0B,YAA6B;CACtE,MAAM,QAAQ,WAAW,MAAM,CAAC,MAAM,IAAI;CAC1C,OAAO,MAAM,OAAO,WAAW,MAAM,OAAO,KAAA,KAAa,kBAAkB,MAAM,GAAG;;AAGrF,SAAgB,sCAAsC,KAKpD;CACD,OAAO;EACN,SAAS,IAAI;EACb,MAAM,IAAI;EACV,OAAO,IAAI;EACX,iBAAiB,IAAI;EACrB;;AAGF,SAAgB,oCACf,SACiD;CACjD,OAAO,uCAAuC,MAC5C,gBAAgB,QAAQ,YAAY,SAAS,YAAY,cAC1D;;;;AC1FF,IAAa,oCAAb,cAAuD,MAAM;CAC5D,YAAY,SAAiB;EAC5B,MAAM,QAAQ;EACd,KAAK,OAAO;;;AAId,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,2BAA2B,WAA2B;CAE9D,OAAO,IADU,UAAU,MAAM,IAAI,CAAC,QAAQ,YAAY,YAAY,MAAM,YAAY,IACrE,CAAC,KAAK,IAAI;;AAG9B,SAAS,wBAAwB,WAA4B;CAC5D,OAAO,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK;;AAG9C,SAAS,oBAAoB,WAAmB,UAA2B;CAC1E,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG,SAAS,GAAG;;AAGtE,SAAS,kBAAkB,WAAmB,qBAAkD;CAC/F,MAAM,aAAa,2BAA2B,UAAU;CACxD,MAAM,6BACL,wBAAwB,KAAA,IACrB,KAAA,IACA,2BAA2B,4BAA4B,oBAAoB,CAAC;CAChF,MAAM,8BACL,+BAA+B,KAAA,IAC5B,KAAA,IACA,2BAA2B,QAAQ,iBAAiB,GAAG;CAC3D,OACC,eAAe,gCACf,WAAW,WAAW,GAAG,6BAA6B,GAAG,IACzD,eAAe,8BACf,WAAW,WAAW,GAAG,2BAA2B,GAAG,IACvD,eAAe,oCACf,WAAW,WAAW,GAAG,iCAAiC,GAAG,IAC5D,+BAA+B,KAAA,MAC9B,oBAAoB,YAAY,2BAA2B,IAC3D,WAAW,WAAW,GAAG,2BAA2B,GAAG,KACxD,gCAAgC,KAAA,MAC/B,oBAAoB,YAAY,4BAA4B,IAC5D,WAAW,WAAW,GAAG,4BAA4B,GAAG;;AAI5D,SAAS,4BAA4B,WAA2B;CAC/D,MAAM,cAAc,UAAU,MAAM;CACpC,MAAM,gBAAgB,QAAQ,IAAI,MAAM,MAAM;CAC9C,IAAI,gBAAgB,OAAO,eAC1B,OAAO;CAER,IAAI,YAAY,WAAW,KAAK,IAAI,eACnC,OAAO,KAAK,QAAQ,KAAK,KAAK,eAAe,YAAY,MAAM,EAAE,CAAC,CAAC;CAEpE,OAAO,KAAK,QAAQ,YAAY;;AAGjC,SAAS,0BAA0B,WAAmB,SAAyB;CAC9E,MAAM,cAAc,UAAU,MAAM;CACpC,IAAI,gBAAgB,MAAM,wBAAwB,YAAY,EAC7D,MAAM,IAAI,kCACT,GAAG,QAAQ,qDACX;CAEF,IAAI,CAAC,YAAY,WAAW,IAAI,IAAI,CAAC,YAAY,WAAW,IAAI,EAC/D,MAAM,IAAI,kCACT,GAAG,QAAQ,6CACX;CAGF,MAAM,aAAa,2BADE,4BAA4B,YACS,CAAC;CAC3D,IACC,eAAe,OACf,eAAe,gCACf,WAAW,WAAW,GAAG,6BAA6B,GAAG,IACzD,eAAe,8BACf,WAAW,WAAW,GAAG,2BAA2B,GAAG,EAEvD,MAAM,IAAI,kCACT,GAAG,QAAQ,6EAA6E,WAAW,IACnG;CAEF,IACC,eAAe,oCACf,WAAW,WAAW,GAAG,iCAAiC,GAAG,EAE7D,MAAM,IAAI,kCACT,GAAG,QAAQ,uFAAuF,WAAW,IAC7G;CAEF,OAAO;;AAGR,SAAS,4BACR,WACA,SACA,qBACS;CACT,MAAM,aAAa,0BAA0B,WAAW,QAAQ;CAChE,IAAI,kBAAkB,YAAY,oBAAoB,EACrD,MAAM,IAAI,kCACT,GAAG,QAAQ,gHAAgH,WAAW,IACtI;CAEF,OAAO;;AAGR,SAAS,cAAc,OAAoC;CAC1D,OAAO,OAAO,UAAU,YAAY,MAAM,MAAM,KAAK,KAAK,MAAM,MAAM,GAAG,KAAA;;AAG1E,SAAS,YAAY,OAAwB;CAC5C,OAAO,yBAAyB,OAAO,UAAU,WAAW,QAAQ,KAAA,EAAU;;AAG/E,SAAS,aACR,QACqC;CACrC,OAAO,QAAQ,QAAQ,MAAM,OAAO,SAAS,IAAI,EAAE;;AAGpD,SAAS,eACR,QACA,SACsC;CACtC,OAAO,aAAa,OAAO,CAAC,MAAM,UAAU,YAAY,MAAM,GAAG,KAAK,QAAQ;;AAG/E,SAAS,sBAAsB,QAA0D;CACxF,MAAM,UAAU,aAAa,OAAO;CAGpC,OAAO,aAFc,QAAQ,MAAM,UAAU,MAAM,YAAY,KAC7B,IAAI,QAAQ,KACZ,GAAG;;AAGtC,SAAgB,oCAAoC,SAMnB;CAChC,MAAM,UAAU,yBAAyB,QAAQ,QAAQ;CAEzD,MAAM,iBAAiB,cADJ,eAAe,QAAQ,gBAAgB,QACX,EAAE,UAAU;CAC3D,IAAI,mBAAmB,KAAA,GACtB,OAAO;EACN,MAAM;EACN,WAAW,4BACV,gBACA,8BAA8B,QAAQ,IACtC,QAAQ,oBACR;EACD;CAGF,MAAM,oBAAoB,cAAc,QAAQ,gBAAgB,QAAQ,UAAU,UAAU;CAC5F,IAAI,sBAAsB,KAAA,GAAW;EACpC,MAAM,eAAe,4BACpB,mBACA,6BACA,QAAQ,oBACR;EACD,MAAM,iBAAiB,sBAAsB,QAAQ,eAAe;EACpE,OAAO;GACN,MAAM,YAAY,iBAAiB,4BAA4B;GAC/D,WAAW,YAAY,iBAAiB,eAAe,KAAK,KAAK,cAAc,QAAQ;GACvF;;CAGF,IAAI,CAAC,kBAAkB,QAAQ,yBAAyB,QAAQ,oBAAoB,EACnF,OAAO;EACN,MAAM;EACN,WAAW,0BACV,QAAQ,yBACR,qCACA;EACD;CAGF,MAAM,YACL,QAAQ,aAAa,KAAA,IAClB,KAAA,IACA,0BAA0B,QAAQ,UAAU,oBAAoB;CACpE,IAAI,cAAc,KAAA,GACjB,MAAM,IAAI,kCACT,wCAAwC,QAAQ,wBAAwB,eAAe,QAAQ,yGAC/F;CAIF,IAAI,YADmB,sBAAsB,QAAQ,eACvB,EAC7B,MAAM,IAAI,kCACT,wCAAwC,QAAQ,wBAAwB,uBAAuB,QAAQ,0KACvG;CAEF,OAAO;EACN,MAAM;EACN,WAAW,KAAK,KAAK,WAAW,aAAa,UAAU;EACvD;;;;ACvMF,IAAa,gCAAb,cAAmD,MAAM;CACxD;CAEA,YAAY,SAAsC;EACjD,MAAM,GAAG,QAAQ,QAAQ,GAAG,QAAQ,gBAAgB;EACpD,KAAK,OAAO;EACZ,KAAK,UAAU;;;AAIjB,SAAS,4BAA4B,WAA4B;CAChE,OAAO,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK;;AAG9C,SAAS,uBAAuB,WAA2B;CAE1D,OAAO,IADa,UAAU,MAAM,IAAI,CAAC,QAAQ,YAAY,YAAY,MAAM,YAAY,IACrE,CAAC,KAAK,IAAI;;AAGjC,SAAS,+BAA+B,mBAAwD;CAC/F,OAAO;EACN,kBAAkB,EAAE;EACpB,MAAM;EACN,WAAW;EACX,WAAW;EACX,SAAS,+BAA+B,kBAAkB;EAC1D,SAAS;EACT,eACC;EACD;;AAGF,SAAS,0BACR,mBAC0C;CAC1C,IACC,kBAAkB,MAAM,KAAK,MAC7B,CAAC,kBAAkB,WAAW,IAAI,IAClC,uBAAuB,kBAAkB,KAAK,OAC9C,4BAA4B,kBAAkB,EAE9C,OAAO,+BAA+B,kBAAkB;;AAK1D,SAAS,gCAAgC,SAElB;CACtB,OAAO;EACN,IAAI;EACJ,OAAO;GACN;IACC,IAAI;IACJ,SAAS;KACR,MAAM;KACN,YAAY;KACZ,QAAQ;KACR;IACD,cAAc;KACb,cAAc;KACd,YAAY;KACZ;IACD,WAAW;KACV,oBAAoB,QAAQ;KAC5B,iBAAiB;KACjB;IACD,iBAAiB;IACjB,eAAe;IACf;GACD;IACC,IAAI;IACJ,SAAS;KACR,MAAM;KACN,YAAY;KACZ;IACD,cAAc;KACb,cAAc;KACd,YAAY;KACZ;IACD,WAAW,EACV,iBAAiB,4BACjB;IACD,iBAAiB;IACjB,eAAe;IACf;GACD;IACC,IAAI;IACJ,SAAS;KACR,MAAM;KACN,YAAY;KACZ,QAAQ;KACR;IACD,cAAc;KACb,cAAc;KACd,YAAY;KACZ;IACD,WAAW,EACV,oBAAoB,kCACpB;IACD,iBAAiB;IACjB,eAAe;IACf;GACD;EACD;;AAGF,SAAS,iCAAiC,aAGxC;CACD,MAAM,CAAC,cAAc,GAAG,oBAAoB,YAAY,aAAa,MAAM,IAAI;CAC/E,MAAM,oBACL,iBAAiB,KAAA,KAAa,iBAAiB,KAC5C,YAAY,aACZ,GAAG,iCAAiC,GAAG;CAK3C,OAAO;EACN,mBAJA,iBAAiB,WAAW,IACzB,+BACA,GAAG,6BAA6B,GAAG,iBAAiB,KAAK,IAAI;EAGhE;EACA;;AAGF,SAAS,mBAAmB,aAAmE;CAC9F,MAAM,SAAS,YAAY,iBAAiB;CAC5C,IAAI,YAAY,WAAW,mBAC1B,OAAO,SAAS,iBAAiB;CAElC,IAAI,YAAY,WAAW,sBAC1B,OAAO;CAER,IAAI,YAAY,mBAAmB,oBAClC,OAAO,SAAS,wBAAwB;CAEzC,OAAO,SAAS,mBAAmB;;AAGpC,SAAS,wBAAwB,aAA6C;CAC7E,OAAO,YAAY,iBAAiB,KACjC,YAAY,aACZ,YAAY,WAAW,MAAM,GAAG,EAAE,YAAY,aAAa,SAAS,GAAG;;AAG3E,SAAgB,gCAAgC,SAIb;CAClC,MAAM,yBAAyB,0BAA0B,QAAQ,kBAAkB;CACnF,IAAI,2BAA2B,KAAA,GAC9B,OAAO;EACN,OAAO;EACP,IAAI;EACJ;CAEF,MAAM,WAAW,CAChB,gCAAgC,EAC/B,mBAAmB,QAAQ,mBAC3B,CAAC,EACF,IAAI,QAAQ,gCAAgC,EAAE,EAAE,KAAK,gCACpD,gCAAgC,EAC/B,mBAAmB,6BACnB,CAAC,CACF,CACD;CACD,MAAM,yBAAyB,QAAQ,gCAAgC,EAAE,EACvE,KAAK,gCAAgC,0BAA0B,4BAA4B,CAAC,CAC5F,MAAM,UAAU,UAAU,KAAA,EAAU;CACtC,IAAI,0BAA0B,KAAA,GAC7B,OAAO;EACN,OAAO;EACP,IAAI;EACJ;CAEF,MAAM,UAAU,gCAAgC,EAC/C,mBAAmB,QAAQ,mBAC3B,CAAC;CACF,MAAM,qBAAqB,qBAAqB;EAC/C,WAAW,QAAQ;EACnB;EACA,SAAS;EACT,iBAAiB;EACjB,iBAAiB;EACjB,CAAC;CACF,IAAI,mBAAmB,MAAM,mBAAmB,MAAM,WAAW,sBAAsB;EACtF,MAAM,oBAAoB,iCAAiC,mBAAmB,MAAM;EACpF,OAAO;GACN,IAAI;GACJ,OAAO;IACN,mBAAmB,kBAAkB;IACrC,oBAAoB,mBAAmB,MAAM;IAC7C,MAAM,mBAAmB,mBAAmB,MAAM;IAClD,mBAAmB,kBAAkB;IACrC;GACD;;CAEF,MAAM,qBAAqB,SAAS,KAAK,qBACxC,qBAAqB;EACpB,WAAW,QAAQ;EACnB,SAAS;EACT,SAAS;EACT,iBAAiB;EACjB,CAAC,CACF;CACD,MAAM,cAAc,mBAAmB,MAAM,yBAAyB,qBAAqB,GAAG;CAC9F,IAAI,gBAAgB,KAAA,GAAW;EAC9B,MAAM,qBAAqB,mBAAmB;EAC9C,IAAI,uBAAuB,KAAA,KAAa,mBAAmB,IAC1D,OAAO;GACN,OAAO,+BAA+B,QAAQ,kBAAkB;GAChE,IAAI;GACJ;EAEF,OAAO;;CAER,MAAM,4BAA4B,qBAAqB;EACtD,WAAW,QAAQ;EACnB;EACA,SAAS;EACT,iBAAiB;EACjB,CAAC;CACF,OAAO;EACN,IAAI;EACJ,OAAO;GACN,mBAAmB,YAAY,MAAM;GACrC,GAAI,0BAA0B,KAC3B,EAAE,oBAAoB,0BAA0B,MAAM,YAAY,GAClE,EAAE;GACL,MAAM,mBAAmB,YAAY,MAAM;GAC3C,mBACC,0BAA0B,MAAM,0BAA0B,MAAM,WAAW,oBACxE,wBAAwB,0BAA0B,MAAM,GACxD,QAAQ;GACZ;EACD;;AAGF,SAAgB,+BAA+B,SAIR;CACtC,MAAM,SAAS,gCAAgC,QAAQ;CACvD,IAAI,CAAC,OAAO,IACX,MAAM,IAAI,8BAA8B,OAAO,MAAM;CAEtD,OAAO,OAAO;;;;AC7Rf,SAAgB,yBAAyB,QAAgB,MAAkC;CAC1F,IAAI,CAAC,QAAQ,KAAK,WAAW,GAC5B,OAAO;CAIR,OAAO,UADa,KAAK,KAAK,QAAQ,IAAI,IAAI,QAAQ,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,IAClD,CAAC,IAAI;;;;ACClC,IAAa,+BAAb,cAAkD,MAAM;CACvD;CACA;CAEA,YAAY,SAIT;EACF,MAAM,QAAQ,QAAQ;EACtB,KAAK,QAAQ,QAAQ;EACrB,KAAK,SAAS,QAAQ;;;AAsBxB,SAASC,qBAAmB,OAAwB;CACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAASC,kBAAgB,SAAuB;CAC/C,QAAQ,OAAO,MAAM,iCAAiC,QAAQ,IAAI;;AAGnE,eAAe,mBAAmB,SAMhB;CACjB,IAAI,CAAC,QAAQ,aAAa,aACzB;CAED,MAAM,QAAQ;EACb,SAAS,QAAQ,aAAa,YAAY;EAC1C,WAAW,QAAQ;EACnB,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW,QAAQ,WAAW;EAC3E,MAAM;EACN,SAAS,QAAQ,aAAa,YAAY;EAC1C,cAAc,QAAQ;EACtB,WAAW,QAAQ,aAAa,YAAY;EAC5C,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,aAAa,YAAY;EACzC;CACD,IAAI;EACH,MAAM,QAAQ,aAAa,YAAY,QAAQ,MAAM;UAC7C,OAAO;EACf,CAAC,QAAQ,aAAa,YAAYA,mBACjC,+CAA+C,QAAQ,aAAa,YAAY,UAAU,aAAa,OAAO,QAAQ,UAAU,CAAC,SAASD,qBAAmB,MAAM,GACnK;;;AAIH,eAAsB,+BACrB,SACmB;CACnB,MAAM,MAAM,QAAQ,OAAO,KAAK;CAChC,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,kBAAkB,IAAI,iBAAiB;CAC7C,MAAM,cAAc,KAAK;CACzB,IAAI;CAEJ,QAAQ,OAAO;EACd,cAAc,KAAK;EACnB,OAAO;EACP,CAAC;CAEF,MAAM,iBAAiB,IAAI,SAAgB,UAAU,WAAW;EAC/D,gBAAgB,qBAAqB;GACpC,gBAAgB,OAAO;GACvB,OACC,IAAI,6BAA6B;IAChC,OAAO,KAAA;IACP,SAAS,GAAG,QAAQ,cAAc,YAAY,OAAO,QAAQ,UAAU,CAAC;IACxE,QAAQ;IACR,CAAC,CACF;KACC,QAAQ,UAAU;GACpB;CAEF,IAAI;EACH,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,QAAQ,UAAU,gBAAgB,OAAO,EAAE,eAAe,CAAC;EAC9F,QAAQ,OAAO;GACd,cAAc,KAAK;GACnB,OAAO;GACP,KAAK,EAAE,gBAAgB,MAAM;GAC7B,CAAC;EACF,MAAM,eAAe,KAAK;EAC1B,mBAAwB;GACvB,WAAW,eAAe;GAC1B,cAAc;GACd;GACA,QAAQ;GACR,CAAC;EACF,OAAO;UACC,OAAO;EACf,MAAM,aACL,iBAAiB,+BACd,QACA,IAAI,6BAA6B;GACjC,OAAO;GACP,SAASA,qBAAmB,MAAM;GAClC,QAAQ;GACR,CAAC;EACL,QAAQ,OAAO;GACd,cAAc,KAAK;GACnB,OAAO;GACP,KAAK,EACJ,SAAS;IACR,MAAM,WAAW;IACjB,SAAS,WAAW;IACpB,EACD;GACD,CAAC;EACF,MAAM,eAAe,KAAK;EAC1B,mBAAwB;GACvB,WAAW,eAAe;GAC1B,WAAW,WAAW;GACtB,cAAc;GACd;GACA,QAAQ;GACR,CAAC;EACF,MAAM;WACG;EACT,IAAI,kBAAkB,KAAA,GACrB,iBAAiB,cAAc;;;;;AC7GlC,SAAS,mBAAmB,QAAuE;CAClG,OAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,CAAC,KAAK,KAAK;;AAQlD,SAAS,qCAAqC,QAGvB;CACtB,IAAI,OAAO,YAAY,sBAAsB,OAAO,eAAe,mBAClE,OAAO;CAER,IAAI,OAAO,YAAY,sBAAsB,OAAO,eAAe,mBAClE,OAAO;CAER,IAAI,OAAO,YAAY,cAAc,OAAO,eAAe,WAC1D,OAAO;;AAKT,SAAS,4BAA4B,QAK5B;CACR,MAAM,WAAW,qCAAqC,OAAO;CAC7D,IAAI,aAAa,KAAA,GAChB;CAED,MAAM,IAAI,MACT,+CAA+C,OAAO,OAAO,WAAW,OAAO,QAAQ,KAAK,SAAS,WACrG;;AAGF,SAAS,kCAAkC,OAA4C;CACtF,MAAM,eACL,MAAM,iBAAiB,KAAA,IAAY,MAAM,WAAW,KAAK,UAAU,MAAM,aAAa;CACvF,OAAO,GAAG,MAAM,QAAQ,aAAa;;AAGtC,SAAS,mBAAmB,OAAwB;CACnD,IAAI,iBAAiB,6BACpB,OAAO,kCAAkC,MAAM;CAEhD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAS,uBAAuB,SAAuB;CACtD,QAAQ,OAAO,MAAM,8BAA8B,QAAQ,IAAI;;AAGhE,SAAS,yBAAyB,OAAyB;CAC1D,OAAO,wBAAwB,MAAM;;AAGtC,SAAS,wBAAwB,OAAyB;CACzD,OACC,iBAAiB,gCAAgC,MAAM,WAAW,OAAO,MAAM,WAAW;;AAI5F,SAAS,kBAAkB,OAAyB;CACnD,OAAO,iBAAiB,+BAA+B,MAAM,WAAW;;AAYzE,SAAS,0BAA0B,OAAkD;CACpF,OACC,OAAO,UAAU,YACjB,UAAU,QACV,aAAa,SACb,OAAO,QAAQ,IAAI,OAAO,UAAU,KAAK;;AAI3C,SAAS,yBAAyB,OAAiD;CAClF,OACC,OAAO,UAAU,YACjB,UAAU,QACV,qBAAqB,SACrB,OAAO,QAAQ,IAAI,OAAO,kBAAkB,KAAK;;AAInD,SAAS,kCAAkC,gBAGhB;CAC1B,OAAO,eAAe,WACnB,cACA,eAAe,WAAW,cACzB,cACA;;AAGL,eAAe,oCAAoC,SAMjC;CACjB,MAAM,QAAQ;EACb,SAAS,QAAQ;EACjB,WAAW;EACX,GAAI,QAAQ,WAAW,EAAE,WAAW,yBAAyB,GAAG,EAAE;EAClE,MAAM;EACN,SAAS,QAAQ;EACjB,cAAc,KAAK,KAAK;EACxB,WAAW;EACX,QAAQ,QAAQ,WAAW,WAAW;EACtC,QAAQ,QAAQ;EAChB;CACD,IAAI;EACH,MAAM,QAAQ,mBAAmB,MAAM;UAC/B,OAAO;EACf,uBACC,wDAAwD,QAAQ,OAAO,WAAW,QAAQ,QAAQ,KAAK,mBAAmB,MAAM,GAChI;;;AAIH,SAAS,kBACR,aACA,cACc;CACd,IAAI,gBAAgB,KAAA,GACnB,OAAO;CAER,OAAO,YAAY,IAAI,CAAC,aAAa,aAAa,CAAC;;AAGpD,SAAS,mBACR,SAC0B;CAC1B,MAAM,iBAAiB,QAAQ,QAAQ,WAAkC,WAAW,KAAA,EAAU;CAC9F,IAAI,eAAe,WAAW,GAC7B;CAED,IAAI,eAAe,WAAW,GAC7B,OAAO,eAAe;CAEvB,OAAO,YAAY,IAAI,eAAe;;AAGvC,SAAS,2BAA2B,YAA4B;CAC/D,OAAO,qCAAqC,WAAW;;AAGxD,SAAS,0BAA8C;CACtD,MAAM,mBAAmB,QAAQ,IAAI,oBAAoB,MAAM;CAC/D,IAAI,kBACH,OAAO,KAAK,QAAQ,iBAAiB;CAEtC,MAAM,gBAAgB,QAAQ,IAAI,MAAM,MAAM;CAC9C,OAAO,gBAAgB,KAAK,KAAK,eAAe,aAAa,QAAQ,GAAG,KAAA;;AAGzE,SAAS,8BAAkD;CAC1D,MAAM,gBAAgB,QAAQ,IAAI,MAAM,MAAM;CAC9C,IAAI,CAAC,eACJ;CAED,MAAM,UAAU,QAAQ,IAAI,kBAAkB,MAAM,CAAC,aAAa;CAClE,OAAO,WAAW,YAAY,YAC3B,KAAK,KAAK,eAAe,aAAa,aAAa,UAAU,GAC7D,KAAK,KAAK,eAAe,aAAa,YAAY;;AAGtD,SAAS,0BAA0B,QAE1B;CACR,MAAM,WAAW,oCAAoC,OAAO,IAAI;CAChE,IAAI,UACH,MAAM,IAAI,MACT,sCAAsC,SAAS,IAAI,GAAG,SAAS,cAAc,aAAa,OAAO,OAAO,IAAI,SAAS,KAAK,CAAC,GAC3H;;AAIH,SAAgB,oCACf,SASA,cAa2C;CAC3C,MAAM,kCAAkB,IAAI,KAAoC;CAChE,MAAM,wCAAwB,IAAI,KAA6C;CAE/E,OAAO,OAAO,WAAW;EACxB,MAAM,YAAY,QAAQ,aAAa;EACvC,MAAM,UAAU,2BAA2B,OAAO,WAAW;EAC7D,0BAA0B,EACzB,KAAK,OAAO,KACZ,CAAC;EACF,MAAM,sBACL,QAAQ,uCAAuC,IAAI,6BAA6B;EACjF,MAAM,+BACL,wBAAwB,KAAA,IAAY,EAAE,GAAG,CAAC,oBAAoB;EAC/D,MAAM,kBAAkB,oCAAoC;GAC3D;GACA;GACA,gBAAgB,QAAQ,iCAAiC;GACzD,yBAAyB,OAAO;GAChC,UAAU,QAAQ,4BAA4B,IAAI,yBAAyB;GAC3E,CAAC;EACF,MAAM,aAAa,+BAA+B;GACjD,mBAAmB,gBAAgB;GACnC;GACA,WAAW,OAAO;GAClB,CAAC;EACF,MAAM,WAAW,mBAAmB;GACnC;GACA,QAAQ,QAAQ;GAChB,CAAC;EACF,MAAM,sBAAsB;GAC3B,mBAAmB,gBAAgB;GACnC,mBAAmB,WAAW;GAC9B;GACA;EACD,MAAM,cACL,aAAa,oBAAoB,EAChC,eAAe,QAAQ,eACvB,CAAC,IAAI,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAAC;EAClE,MAAM,qBAAqB,OAAO,UAA6C;GAC9E,MAAM,WAAW,MAAM,0BAA0B;IAChD,OAAO,GAAG,QAAQ,cAAc,QAAQ,SAAS,GAAG,CAAC,SAAS,mBAAmB,QAAQ,OAAO,CAAC;IACjG,MAAM;KACL,MAAM,KAAK,UAAU,MAAM;KAC3B,SAAS,EAAE,gBAAgB,oBAAoB;KAC/C,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;IAC5C,MAAM,IAAI,MAAM,sCAAsC,OAAO,SAAS,OAAO,GAAG;;GAEjF,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;;EAE7C,MAAM,iBAAiB,OACtB,OACA,QACA,UACmB;GACnB,gBAAgB,OAAO,SAAS;GAChC,uBACC,gCAAgC,QAAQ,OAAO,WAAW,QAAQ,WAAW,MAAM,QAAQ,YAAY,OAAO,KAAK,mBAAmB,MAAM,GAC5I;GACD,MAAM,YACJ,aAAa,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC,CAC5C,OAAO,iBAA0B;IACjC,uBACC,oDAAoD,QAAQ,OAAO,WAAW,QAAQ,WAAW,MAAM,QAAQ,KAAK,mBAAmB,aAAa,GACpJ;KACA;;EAEJ,MAAM,cAAc,gBAAgB,IAAI,SAAS;EACjD,IAAI;EACJ,IAAI,aAAa;GAChB,4BAA4B;IAC3B;IACA;IACA,gBAAgB;IAChB,QAAQ,QAAQ;IAChB,CAAC;GACF,IAAI;IACH,MAAM,eAAe,MAAM,YAAY,WAAW,YAAY,MAAM,QAAQ;IAC5E,MAAM,+BAA+B;KACpC,aAAa;MACZ;MACA,SAAS,aAAa;MACtB,WAAW;MACX,SAAS;MACT,QAAQ,QAAQ;MAChB;KACD,WAAW,OAAO,WACjB,MAAM,aAAa,qBAAqB;MACvC,cAAc;MACd,QAAQ;MACR;MACA,KAAK,aAAa;MAClB,CAAC;KACH,eAAe;KACf,cAAc;KACd,WAAW;KACX,CAAC;IACF,QAAQ;IACR,gBAAgB,IAAI,UAAU;KAAE,GAAG;KAAqB;KAAO,CAAC;YACxD,OAAO;IACf,uBACC,gCAAgC,QAAQ,OAAO,WAAW,QAAQ,WAAW,YAAY,MAAM,QAAQ,KAAK,mBAAmB,MAAM,GACrI;IACD,IAAI,iBAAiB,8BACpB,MAAM,eAAe,YAAY,OAAO,MAAM,QAAQ,MAAM;SACtD,IAAI,yBAAyB,MAAM,EACzC,gBAAgB,OAAO,SAAS;SAEhC,MAAM;;;EAIT,IAAI,UAAU,KAAA,GAAW;GACxB,MAAM,uBAAuB,sBAAsB,IAAI,SAAS;GAChE,IAAI,yBAAyB,KAAA,GAAW;IACvC,MAAM,gBAAgB,MAAM;IAC5B,4BAA4B;KAC3B;KACA,aAAa;KACb,gBAAgB;KAChB,QAAQ,QAAQ;KAChB,CAAC;IACF,QAAQ,cAAc;UAChB;IAGN,MAAM,uBAAuB,YAA4C;KACxE,MAAM,gBAAgB,QAAQ,iCAAiC;KAC/D,IAAI,iBAAiB,YAAY,8BAChC,MAAM,YAAY,6BAA6B,cAAc;KAE9D,MAAM,gBAAgB,MAAM,YAAY,aAAa;MACpD;MACA,mBAAmB,gBAAgB;MACnC;MACA,YAAY,OAAO;MACnB,cAAc,WAAW;MACzB,QAAQ,QAAQ;MAChB,CAAC;KACF,IAAI,CAAC,iBAAiB,cAAc,EACnC,MAAM,IAAI,UAAU,wDAAwD;KAE7E,OAAO;MACN,GAAG;MACH,OAAO;MACP;QACE;IACJ,sBAAsB,IAAI,UAAU,oBAAoB;IACxD,IAAI;KACH,MAAM,aAAa,MAAM;KACzB,gBAAgB,IAAI,UAAU,WAAW;KACzC,QAAQ,WAAW;cACV;KACT,IAAI,sBAAsB,IAAI,SAAS,KAAK,qBAC3C,sBAAsB,OAAO,SAAS;;;;EAqB1C,OAhBe,2BAA2B;GACzC,KAAK,OAAO;GACZ,eAAe,QAAQ;GACvB,uBAAuB,aAAa;GACpC,mBAAmB,WAAW;GAC9B;GACA;GACA,sBAAsB,OAAO,QAAQ,UAAU;IAC9C,MAAM,eAAe,OAAO,QAAQ,MAAM;;GAE3C;GACA,sBAAsB,aAAa;GACnC,eAAe,aAAa;GAC5B,YAAY,OAAO;GACnB,QAAQ,QAAQ;GAChB,CACY;;;AAIf,SAAS,2BAA2B,SAiBH;CAChC,MAAM,wBAAwB,OAC7B,gBACoC;EACpC,IAAI;GACH,OAAO,MAAM,4BAA4B;IACxC;IACA,cAAc,OAAO,OAAe,YAAsD;KACzF,MAAM,QAAQ,YAAY,aAAa,QAAQ,MAAM,SAAS,OAAO,QAAQ;;IAE9E,oBAAoB,OAAO,OAAO,YACjC,MAAM,QAAQ,YAAY,mBAAmB,QAAQ,MAAM,SAAS,OAAO,QAAQ;IACpF,qBAAqB;IACrB,6BAA6B;IAC7B,gBAAgB,UAAyB;KACxC,uBACC,wCAAwC,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,MAAM,GACtH;;IAEF,sBAAsB,UAAyB;KAC9C,uBACC,yCAAyC,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,MAAM,GACvH;;IAEF,+BAA+B,OAAO,UAAyB;KAC9D,MAAM,QAAQ,qBAAqB,kCAAkC,MAAM;;IAE5E,gBAAgB,OACf,YAEA,MAAM,QAAQ,YAAY,eAAe,QAAQ,MAAM,SAAS,QAAQ;IACzE,CAAC;WACM,OAAO;GACf,IAAI,wBAAwB,MAAM,EACjC,MAAM,QAAQ,qBAAqB,kCAAkC,MAAM;GAE5E,MAAM;;;CAIR,MAAM,mBAAmB,OACxB,aACA,OACsB;EACtB,MAAM,kBAAkB,MAAM,sBAAsB,YAAY;EAChE,IAAI;GACH,MAAM,SAAS,MAAM,GAAG,gBAAgB;GACxC,MAAM,gBAAgB,QAAQ,YAAY;GAC1C,OAAO;WACC,OAAO;GACf,MAAM,gBACJ,QACA,iBAAiB,gCAAgC,MAAM,WAAW,0BAC/D,cACA,SACH,CACA,OAAO,iBAA0B;IACjC,uBACC,8DAA8D,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,aAAa,GACnJ;KACA;GACH,IAAI,iBAAiB,8BACpB,MAAM,QAAQ,qBAAqB,MAAM,QAAQ,MAAM;GAExD,MAAM;;;CAIR,MAAM,4BAAkF,OACvF,gBAEA,MAAM,iBACL;EACC,YAAY,QAAQ;EACpB,UAAU;EACV,EACD,OAAO,oBACN,MAAM,+BAA+B;EACpC,aAAa;GACZ,SAAS,QAAQ,MAAM;GACvB,SAAS,QAAQ,MAAM;GACvB,WAAW;GACX,SAAS,QAAQ;GACjB,QAAQ,QAAQ;GAChB;EACD,WAAW,OAAO,WAAW;GAC5B,MAAM,kBAAkB,mBAAmB;IAC1C,YAAY;IACZ,gBAAgB;IAChB;IACA,CAAC;GACF,OAAO,MAAM,QAAQ,qBAAqB;IACzC,GAAI,YAAY,iBAAiB,KAAA,IAC9B,EAAE,cAAc,YAAY,cAAc,GAC1C,EAAE;IACL,QAAQ,yBAAyB,YAAY,QAAQ,YAAY,KAAK;IACtE,GAAI,oBAAoB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,iBAAiB;IACpE,KAAK,QAAQ,MAAM;IACnB,GAAI,YAAY,UAAU,KAAA,IAAY,EAAE,OAAO,YAAY,OAAO,GAAG,EAAE;IACvE,CAAC;;EAEH,eAAe;EACf,SAAS,WAAW;GACnB,gBAAgB,OAAO,OAAO;;EAE/B,WAAW;EACX,CAAC,CACH;CAEF,MAAM,4BAA4B,OAAO,UAAkC;EAC1E,IAAI,0BAA0B,MAAM,EACnC,MAAM,MAAM,SAAS;;CAIvB,MAAM,4BAA4B,OACjC,OACA,YACmB;EACnB,IAAI;EACJ,IAAI;GACH,MAAM,0BAA0B,MAAM,WAAW;WACzC,OAAO;GACf,aAAa;;EAEd,IAAI;EACJ,IAAI;GACH,MAAM,MAAM,gBAAgB,QAAQ,QAAQ;WACpC,OAAO;GACf,iBAAiB;;EAElB,IAAI,YACH,MAAM;EAEP,IAAI,gBACH,MAAM;;CAIR,MAAM,iBAAiB,QAAQ,wBAAwB;EACtD,yBAAyB,QAAQ,MAAM;EACvC,oBAAoB,QAAQ;EAC5B,sBAAsB;EACtB,CAAC;CAEF,OAAO;EACN,GAAI,iBAAiB,EAAE,gBAAgB,GAAG,EAAE;EAC5C,GAAI,QAAQ,IAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,EAAE;EAClE,aAAa,GAAG,QAAQ,cAAc,IAAI,QAAQ,OAAO;EACzD,iBAAiB;EACjB,IAAI;EACJ,WAAW,QAAQ,MAAM;EACzB,cAAc,QAAQ,MAAM;EAC5B,SAAS,QAAQ;EACjB,eAAe,OAAO,eAAe;GACpC,MAAM,kBAAkB,MAAM,sBAAsB;IACnD,YAAY,QAAQ;IACpB,UAAU;IACV,CAAC;GACF,IAAI;IACH,MAAM,WAAW,MAAM,QAAQ,cAAc;KAC5C,SAAS,WAAW;KACpB,KAAK,WAAW;KAChB,KAAK,QAAQ,MAAM;KACnB,QAAQ,WAAW;KACnB,SAAS,WAAW,WAAW,QAAQ;KACvC,CAAC;IACF,OAAO;KACN,GAAG;KACH,eAAe;MACd;MACA,GAAI,SAAS,kBAAkB,KAAA,IAAY,EAAE,YAAY,SAAS,eAAe,GAAG,EAAE;MACtF;KACD;YACO,OAAO;IACf,MAAM,gBAAgB,QAAQ,SAAS,CAAC,OAAO,iBAA0B;KACxE,uBACC,kEAAkE,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,aAAa,GACvJ;MACA;IACF,MAAM;;;EAGR,cAAc,OAAO,mBAAmB;GACvC,IAAI,yBAAyB,eAAe,MAAM,EAAE;IACnD,IAAI,eAAe,UAClB,eAAe,MAAM,gBAAgB,OAAO;KAC3C,cAAc,KAAK,KAAK;KACxB,OAAO;KACP,KAAK,EACJ,SAAS;MACR,MAAM;MACN,SAAS;MACT,EACD;KACD,CAAC;IAEH,MAAM,0BACL,eAAe,OACf,kCAAkC,eAAe,CACjD;IACD,oCAAyC;KACxC,SAAS,QAAQ,MAAM;KACvB,SAAS,QAAQ,MAAM;KACvB,oBAAoB,QAAQ;KAC5B,UAAU,eAAe;KACzB,QAAQ,QAAQ;KAChB,CAAC;IACF,IAAI,eAAe,UAClB,MAAM,QAAQ,qBAAqB,yBAAyB,KAAA,EAAU;IAEvE;;GAED,MAAM,0BAA0B,eAAe,MAAM;;EAEtD,iBAAiB,OAAO,kBACvB,MAAM,iBACL;GACC,YAAY,QAAQ;GACpB,UAAU;GACV,EACD,OAAO,oBACN,MAAM,+BAA+B;GACpC,aAAa;IACZ,SAAS,QAAQ,MAAM;IACvB,SAAS,QAAQ,MAAM;IACvB,WAAW;IACX,SAAS,QAAQ;IACjB,QAAQ,QAAQ;IAChB;GACD,WAAW,OAAO,WACjB,MAAM,QAAQ,qBAAqB;IAClC,QAAQ,cAAc;IACtB,QAAQ,kBAAkB,gBAAgB,QAAQ,OAAO;IACzD,KAAK,QAAQ,MAAM;IACnB,CAAC;GACH,eAAe;GACf,SAAS,WAAW;IACnB,gBAAgB,OAAO,OAAO;;GAE/B,WAAW;GACX,CAAC,CACH;EACF;;;;AC5rBF,SAAgB,oCACf,SAIA,cAMC;CACD,OAAO;EACN,iBAAiB,OAAO,WAAW;GAClC,MAAM,cACL,aAAa,oBAAoB,EAChC,eAAe,QAAQ,eACvB,CAAC,IAAI,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAAC;GAClE,IAAI;IAEH,OAAO;KAAE,kBAAkB;KAAM,SAAS,MADhB,YAAY,UAAU,OAAO,MAAM,cAAc,KACjB;KAAM;YACxD,OAAO;IACf,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KACvE,MAAM;IAEP,OAAO;KAAE,kBAAkB;KAAO,SAAS;KAAO;;;EAGpD,eAAe,OAAO,WAAW;GAKhC,OAHC,aAAa,oBAAoB,EAChC,eAAe,QAAQ,eACvB,CAAC,IAAI,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAAC,EAChD,aAAa,OAAO,MAAM,eAAe,EAAE,OAAO,MAAM,CAAC;;EAE5E;;;;ACzBF,SAASE,iBAAe,OAAkD;CACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,4BACf,QAC+B;CAC/B,IAAI,OAAO,OAAO,kBAAkB,YAAY,OAAO,OAAO,WAAW,UACxE,MAAM,IAAI,MAAM,4DAA4D;CAE7E,MAAM,+BAA+B,OAAO;CAC5C,MAAM,4BAA4BA,iBAAe,6BAA6B,GAC3E;EACA,gBACC,OAAO,6BAA6B,mBAAmB,WACpD,6BAA6B,iBAC7B;EACJ,SACC,OAAO,6BAA6B,YAAY,YAC7C,6BAA6B,UAC7B;EACJ,eACC,OAAO,6BAA6B,kBAAkB,WACnD,6BAA6B,gBAC7B;EACJ,GACA,KAAA;CAEH,OAAO;EACN,eAAe,OAAO;EACtB,GAAI,4BAA4B,EAAE,2BAA2B,GAAG,EAAE;EAClE,GAAI,OAAO,OAAO,cAAc,WAAW,EAAE,WAAW,OAAO,WAAW,GAAG,EAAE;EAC/E,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,cAAc,GAAG,EAAE;EACxF,GAAI,OAAO,OAAO,oBAAoB,WACnC,EAAE,iBAAiB,OAAO,iBAAiB,GAC3C,EAAE;EACL,QAAQ,OAAO;EACf;;;;ACpBF,SAAS,gBAAgB,SAAuB;CAC/C,QAAQ,OAAO,MAAM,kCAAkC,QAAQ,IAAI;;AAGpE,SAAS,QAAQ,SAAiB,MAAsB;CACvD,OAAO,GAAG,QAAQ,QAAQ,QAAQ,GAAG,GAAG;;AAGzC,SAAS,eAAe,SAIb;CACV,MAAM,aAAa,KAAK,KAAK,IAAI,QAAQ,yBAAyB,EAAE;CACpE,OAAO,KAAK,IAAI,QAAQ,eAAe,QAAQ,iBAAiB,WAAW;;AAG5E,SAAgB,gCACf,SAC4B;CAC5B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,WAAW,QAAQ,YAAY;CACrC,IAAI,0BAA0B;CAC9B,IAAI,UAAU;CACd,IAAI;CAEJ,MAAM,UAAU,OAAO,UAA6C;EACnE,MAAM,WAAW,MAAM,0BAA0B;GAChD;GACA,OAAO,QACN,QAAQ,eACR,UAAU,mBAAmB,QAAQ,OAAO,CAAC,gBAC7C;GACD,MAAM;IACL,MAAM,KAAK,UAAU,MAAM;IAC3B,SAAS,EAAE,gBAAgB,oBAAoB;IAC/C,QAAQ;IACR;GACD,WAAW;GACX,CAAC;EACF,IAAI,CAAC,SAAS,IAAI;GACjB,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;GAC5C,MAAM,IAAI,MAAM,sCAAsC,OAAO,SAAS,OAAO,GAAG;;EAEjF,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;;CAG7C,MAAM,qBAA2B;EAChC,IAAI,SACH;EAED,IAAI,OACH;EAED,QAAQ,qBACD;GACL,QAAQ,KAAA;GACR,MAAW,CAAC,QAAQ,aAAa;KAElC,eAAe;GACd,gBAAgB,QAAQ;GACxB;GACA,eAAe,QAAQ;GACvB,CAAC,CACF;EACD,MAAM,SAAS;;CAGhB,MAAM,OAAO,YAA2B;EACvC,MAAM,cAAc,QAAQ,KAAK;EACjC,IAAI;EACJ,IAAI;GACH,MAAM,WAAW,MAAM,0BAA0B;IAChD;IACA,OAAO,QAAQ,QAAQ,eAAe,6BAA6B,KAAK;IACxE,MAAM,EAAE,QAAQ,OAAO;IACvB,WAAW;IACX,CAAC;GACF,MAAM,KAAK,SAAS;GACpB,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;GAC5C,0BAA0B,KAAK,IAAI,0BAA0B;GAC7D,QAAQ;IACP,gBAAgB,6BAA6B;IAC7C,gBAAgB,6BAA6B;IAC7C,WAAW,QAAQ,KAAK,GAAG;IAC3B,MAAM;IACN,cAAc,QAAQ,KAAK;IAC3B,WAAW,6BAA6B;IACxC,MAAM,6BAA6B;IACnC,QAAQ,KAAK,OAAO;IACpB,QAAQ,QAAQ;IAChB;WACO,OAAO;GACf,2BAA2B;GAC3B,QAAQ;IACP,gBAAgB,6BAA6B;IAC7C,gBAAgB,6BAA6B;IAC7C,WAAW,QAAQ,KAAK,GAAG;IAC3B,MAAM;IACN,cAAc,QAAQ,KAAK;IAC3B,WAAW,6BAA6B;IACxC,MAAM,6BAA6B;IACnC,QACC,iBAAiB,yCACjB,MAAM,SAAS,+BACZ,YACA;IACJ,QAAQ,QAAQ;IAChB;GACD,SACC,2EAA2E,OAAO,MAAM,UAAU,CAAC,aAAa,iBAAiB,wCAAwC,MAAM,OAAO,8BACtL;;EAEF,IAAI;GAIH,MAAM,QAAQ,MAAM;WACZ,OAAO;GACf,SACC,gFAAgF,OAAO,MAAM,UAAU,CAAC,aAAa,iBAAiB,wCAAwC,MAAM,OAAO,8BAA8B,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAC1R;;;CAIH,OAAO;EACN,+BAA+B;EAC/B,0BAA0B;GACzB,2BAA2B;;EAE5B,aAAa;GACZ,UAAU;GACV,cAAc;;EAEf,YAAY;GACX,UAAU;GACV,IAAI,CAAC,OACJ;GAED,iBAAiB,MAAM;GACvB,QAAQ,KAAA;;EAET;EACA;;;;ACxKF,MAAa,oCAAoC;AAEjD,SAAgB,kBAAkB,KAMhC;CACD,OAAO;EACN,eAAe,OAAO,EAAE,SAAS,KAAK,KAAK,UAAU,QAAQ,cAAc;GAC1E,MAAM,UAAU,MAAM,IAAI,oCAAoC;IAC7D,SAAS;IACT,cAAc,SAAS;IACvB,uBAAuB;IACvB,QAAQ,GAAG,SAAS,KAAK,GAAG,SAAS,KAAK,GAAG,SAAS;IACtD,gBAAgB;IAChB,eAAe;IACf,CAAC;GACF,MAAM,2BAA2B,IAAI;GACrC,OAAO;IACN,MAAM,IAAI,oBAAoB;KAC7B,eAAe,IAAI,uBAAuB;MACzC;MACA;MACA;MACA,CAAC;KACF;KACA,KAAK;KACL,CAAC;IACF,KAAK,IAAI,gBAAgB,QAAQ,IAAI,CAAC;IACtC,eAAe;KACd,SAAS,YAA2B;MACnC,IAAI,0BACH,MAAM,yBAAyB,QAAQ;;KAGzC;KACA;IACD,WAAW;IACX;;EAEF,wBACE,kBACA,WACA,IAAI,iCAAiC;GACpC,SAAS,OAAO;GAChB,SAAS;IACR,yBAAyB,aAAa;IACtC,oBAAoB,aAAa;IACjC,sBAAsB,aAAa;IACnC;GACD,CAAC;EACJ,sBAAsB,OAAO,EAAE,cAAc,QAAQ,QAAQ,KAAK,UAAU,YAAY;GACvF,MAAM,UAAU,MAAM,IAAI,oCAAoC;IAC7D,SAAS;IACT,cAAc,SAAS;IACvB,uBAAuB;IACvB,QAAQ,GAAG,SAAS,KAAK,GAAG,SAAS,KAAK,GAAG,SAAS;IACtD,gBAAgB;IAChB,eAAe;IACf,CAAC;GACF,OAAO,MAAM,IAAI,qBAAqB;IACrC,GAAI,iBAAiB,KAAA,IAAY,EAAE,cAAc,GAAG,EAAE;IACtD,eAAe,IAAI,mBAAmB;KAAC;KAAW;KAAM;KAAQ;KAAsB,CAAC;IACvF;IACA,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;IAC1C,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACxC,CAAC;;EAEH;;;;AChDF,SAAS,eAAe,OAAkD;CACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,uBAAuB,QAG5B;CACH,MAAM,gBAAgB,OAAO,QAAQ,YAAY,EAAE;CACnD,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,EAAE,EAC7C,OAAO,eAAe,CACtB,KAAK,aAAa,gBAAgB;EAClC,QAAQ;EACR,OACC,OAAO,YAAY,OAAO,WACvB,SAAS,YAAY,OACrB,SAAS,OAAO,WAAW;EAC/B,EAAE;CACJ,OAAO,CAAC;EAAE,QAAQ;EAAe,OAAO;EAAY,EAAE,GAAG,aAAa;;AAGvE,SAAS,mBACR,UACA,aACU;CACV,OAAO,YAAY,aAAa,SAAS;;AAG1C,SAAS,mBAAmB,SAMU;CACrC,MAAM,KAAK,QAAQ,gBAAgB,QAAQ;CAC3C,OAAO;EACN,IAAI,2CAA2C;GAC9C,WAAW,QAAQ;GACnB,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB,CAAC;EACF;EACA,MAAM,sCAAsC;GAC3C,eAAe,QAAQ;GACvB,WAAW,QAAQ;GACnB;GACA,CAAC;EACF;;AAGF,SAAgB,iCAAiC,SAGjB;CAC/B,MAAM,SAAgC,QAAQ;CAC9C,MAAM,WAAW,OAAO,QAAQ,YAAY,EAAE;CAC9C,OAAO;EACN,UAAU;EACV,QAAQ,QAAQ;EAChB,UAAU,uBAAuB,OAAO,CAAC,SAAS,EAAE,QAAQ,aAAa,YAAY;GACpF,MAAM,YAAY,mBAAmB,UAAU,YAAY;GAC3D,MAAM,sBAAsB,uCAAuC,KAAK,gBACvE,mBAAmB;IAClB,aAAa,sCACZ,UACA,aACA,YAAY,IACZ;IACD,eAAe,YAAY;IAC3B,WAAW,2CAA2C,OAAO,YAAY,IAAI;IAC7E;IACA,QAAQ,QAAQ;IAChB,CAAC,CACF;GACD,MAAM,mBAAmB;IACxB,IAAI,8BAA8B,QAAQ,OAAO,GAAG;IACpD,IAAI,cAAc;IAClB,MACC,cAAc,UACX,wFACA,OAAO,cAAc,WACpB,YACA;IACL;GACD,OAAO,oBAAoB,OAAO,iBAAiB;IAClD;EACF;;;;AC9BF,SAAgB,eAAe,OAY7B;CACD,IAAI,OAAO,UAAU,YAAY,UAAU,MAC1C,MAAM,IAAI,UAAU,uCAAuC;CAG5D,KAAK,MAAM,cAAc;EACxB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,EACA,IAAI,OAAQ,MAAkC,gBAAgB,YAC7D,MAAM,IAAI,UAAU,yCAAyC,aAAa;;;;ACnG7E,MAAM,0BAA0B;AAEhC,SAAS,iBAAiB,OAAwB;CACjD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,kBAAkB,QACtE,MAAM,IAAI,MAAM,uCAAuC;CAExD,MAAM,eAAe,MAAM;CAC3B,IAAI,OAAO,iBAAiB,YAAY,aAAa,WAAW,GAC/D,MAAM,IAAI,MAAM,uCAAuC;CAExD,OAAO;;AAGR,SAAS,mBAAmB,eAAuB,QAAwB;CAC1E,OAAO,GAAG,cAAc,QAAQ,QAAQ,GAAG,CAAC,SAAS,mBAAmB,OAAO,CAAC;;AAGjF,eAAe,iBAAiB,UAAqC;CACpE,IAAI;EACH,OAAO,MAAM,SAAS,MAAM;UACpB,OAAO;EACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;;AAI/D,SAAS,iBAAiB,cAA+B;CACxD,IAAI;EACH,OAAO,KAAK,MAAM,aAAa;UACvB,OAAO;EACf,MAAM,IAAI,MAAM,6CAA6C,aAAa,MAAM,GAAG,IAAI,IAAI,EAC1F,OAAO,OACP,CAAC;;;AAIJ,SAAgB,oBAAoB,SAA2C;CAC9E,QAAQ,IAAI,aACX;EACC,MAAM;EACN,aACC;EACD,YAAY;GACX,MAAM;GACN,sBAAsB;GACtB,YAAY,EACX,cAAc,EAAE,MAAM,UAAU,EAChC;GACD,UAAU,CAAC,eAAe;GAC1B;EACD,SAAS,OAAO,aAAqB,UAAmB;GACvD,MAAM,eAAe,iBAAiB,MAAM;GAC5C,MAAM,WAAW,MAAM,0BAA0B;IAChD,WAAW,QAAQ,aAAa;IAChC,OAAO,mBAAmB,QAAQ,eAAe,QAAQ,OAAO;IAChE,MAAM;KACL,MAAM,KAAK,UAAU,EAAE,cAAc,CAAC;KACtC,SAAS;MACR,gBAAgB;MAChB,GAAI,QAAQ,eAAe,GAAG,0BAA0B,QAAQ,cAAc,GAAG,EAAE;MACnF;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,MAAM,eAAe,MAAM,iBAAiB,SAAS;GACrD,IAAI,CAAC,SAAS,IACb,MAAM,IAAI,MAAM,yBAAyB,SAAS,OAAO,GAAG,aAAa,MAAM,GAAG,IAAI,GAAG;GAE1F,MAAM,UAAU,iBAAiB,aAAa;GAC9C,OAAO;IACN,SAAS,KAAK,UAAU,QAAQ;IAChC,SAAS;IACT;;EAEF,EACD;EAAE,MAAM;EAAiB,UAAU;EAAM,CACzC;;;;ACvEF,eAAe,qBAAqB,SAGlB;CAEjB,MADoB,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAC7D,CAAC,+BAA+B,QAAQ,OAAO;;AAGjE,MAAM,SAAS;CACd,IAAI;CACJ,MAAM;CACN,aAAa;CAEb,SAAS,KAUA;EACR,MAAM,eAAe,IAAI;EACzB,IAAI,OAAO,iBAAiB,YAAY;GACvC,IAAI,IAAI,qBAAqB,QAC5B,MAAM,IAAI,MAAM,6DAA6D;GAE9E;;EAED,MAAM,eAAe,4BAA4B,IAAI,aAAa;EAClE,MAAM,eACL,aAAa,iBACZ,aAAa,kBAAkB,QAAQ,IAAI,aAAa,mBAAmB,KAAA;EAC7E,oBAAoB;GACnB,KAAK,EAAE,cAAc;GACrB,eAAe,aAAa;GAC5B,GAAI,eAAe,EAAE,cAAc,GAAG,EAAE;GACxC,QAAQ,aAAa;GACrB,CAAC;EACF,IAAI,IAAI,qBAAqB,QAC5B;EAED,IAAI,aAAa,2BAA2B,SAC3C,gCAAgC;GAC/B,gBAAgB,aAAa,0BAA0B;GACvD,eAAe,aAAa;GAC5B,eAAe,aAAa,0BAA0B;GACtD,WAAW,KAAK,KAAK;GACrB,QAAQ,aAAa;GACrB,CAAC,CAAC,OAAO;EAEX,MAAM,2BAEU;GACf,MAAM,gBAAgB,IAAI,SAAS,QAAQ,WAAW,IAAI,IAAI;GAC9D,OAAO,gBACJ,iCAAiC;IACjC,QAAQ;IACR,QAAQ,aAAa;IACrB,CAAC,GACD,KAAA;;EAEJ,MAAM,uBAAuB,oBAAoB;EACjD,IAAI,sBACH,qBAA0B;GACzB,eAAe,aAAa;GAC5B,QAAQ;GACR,CAAC,CAAC,OAAO,UAAmB;GAC5B,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM;GAC9E,QAAQ,OAAO,MAAM,yDAAyD,QAAQ,IAAI;IACzF;EAsCH,OAlC0B,gCAAS,MAAM,WAAoC;GAC5E,eAAe,OAAO;GAmBtB,MAAM,sBAAsB,kBAAkB;IAhB7C,wBAAwB,OAAO;IAC/B,oBAAoB,OAAO;IAC3B,qBAAqB,OAAO;IAC5B,kCAAkC,OAAO;IACzC,qCAAqC,OAAO;IAC5C,GAAI,OAAO,OAAO,6BAA6B,aAC5C,EACA,0BAA0B,OAAO,0BAGjC,GACA,EAAE;IACL,sBAAsB,OAAO;IAC7B,iBAAiB,OAAO;IAG+B,CAAC;GACzD,OAAO,uBAAuB,YAAY;IACzC,SAAS,oCACR;KACC,GAAG;KACH,qCAAqC,IAAI,SAAS,QAAQ,WAAW,IAAI,IAAI;KAC7E,+BAA+B;KAC/B,EACD,oBACA;IACD,SAAS,oCAAoC,cAAc,oBAAoB;IAC/E,CAAC;IAGO,CAAC,OAAO,UAAmB;GACpC,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM;GAC9E,QAAQ,OAAO,MAAM,2CAA2C,QAAQ,IAAI;IAC3E;;CAEH;;;AC7HD,MAAa,wCAAwC"}
+{"version":3,"file":"index.js","names":["formatUnknownError","formatUnknownError","defaultWriteLog","isObjectRecord"],"sources":["../src/controller-lease-client.ts","../src/openclaw-gondolin-contract.ts","../src/sandbox-backend/openclaw-agent-workspace-source.ts","../src/sandbox-backend/openclaw-tool-vm-path-mapping.ts","../src/sandbox-backend/sandbox-shell-script.ts","../src/sandbox-backend/tool-vm-ssh-operation-guard.ts","../src/sandbox-backend/sandbox-backend-handle-factory.ts","../src/sandbox-backend/sandbox-backend-manager.ts","../src/gondolin-plugin-config.ts","../src/gateway-control-link-monitor.ts","../src/openclaw-backend-dependencies.ts","../src/openclaw-runtime-status.ts","../src/openclaw-sandbox-sdk-contract.ts","../src/zone-git-tool.ts","../src/openclaw-plugin-registration.ts","../src/provider-health/agent-channel-provider-health.ts","../src/index.ts"],"sourcesContent":["import {\n\tisToolVmLeasePeek,\n\tisToolVmSshLease,\n\ttype ToolVmLeasePeek,\n\ttype ToolVmSshLease,\n} from '@agent-vm/gateway-interface';\nimport type {\n\tEndToolVmActiveUseRequest,\n\tHeartbeatToolVmActiveUseRequest,\n\tHeartbeatToolVmActiveUseResponse,\n\tStartToolVmActiveUseRequest,\n\tStartToolVmActiveUseResponse,\n} from '@agent-vm/gateway-interface';\nimport { z } from 'zod';\n\nimport {\n\tdrainControllerResponseBody,\n\tfetchControllerWithPolicy,\n\ttype ControllerRequestPolicy,\n\ttype ControllerRequestPolicyOperation,\n} from './controller-request-policy.js';\n\nexport type JsonValue =\n\t| boolean\n\t| null\n\t| number\n\t| string\n\t| { readonly [key: string]: JsonValue }\n\t| readonly JsonValue[];\n\nexport interface OpenClawRuntimeStatusReport {\n\treadonly findings: readonly {\n\t\treadonly hint: string;\n\t\treadonly id: string;\n\t\treadonly ok: boolean;\n\t}[];\n\treadonly pluginId: 'gondolin';\n\treadonly zoneId: string;\n}\n\nexport interface OpenClawGondolinLeaseSandboxSnapshot {\n\treadonly backend: unknown;\n\treadonly mode: unknown;\n\treadonly scope: unknown;\n\treadonly workspaceAccess: unknown;\n}\n\nexport interface OpenClawGondolinLeaseRequest {\n\treadonly agentId: string;\n\treadonly agentWorkspaceDir: string;\n\treadonly idleTtlMs?: number;\n\treadonly profileId: string;\n\treadonly sessionKey: string;\n\treadonly workMountDir: string;\n\treadonly zoneId: string;\n}\n\nexport interface LeaseClient {\n\t// Cached handles use renewLease; read-only runtime probes use peekLease.\n\tendActiveUse(leaseId: string, useId: string, request: EndToolVmActiveUseRequest): Promise<void>;\n\theartbeatActiveUse(\n\t\tleaseId: string,\n\t\tuseId: string,\n\t\trequest: HeartbeatToolVmActiveUseRequest,\n\t): Promise<HeartbeatToolVmActiveUseResponse>;\n\tpeekLease(leaseId: string): Promise<ToolVmLeasePeek>;\n\tpublishOpenClawRuntimeStatus?(report: OpenClawRuntimeStatusReport): Promise<void>;\n\treleaseLease(leaseId: string, options?: { readonly force?: boolean }): Promise<void>;\n\trenewLease(leaseId: string): Promise<ToolVmSshLease>;\n\trequestLease(request: OpenClawGondolinLeaseRequest): Promise<ToolVmSshLease>;\n\tstartActiveUse(\n\t\tleaseId: string,\n\t\trequest: StartToolVmActiveUseRequest,\n\t): Promise<StartToolVmActiveUseResponse>;\n}\n\nexport type ControllerLeaseRequestErrorKind = 'client-error' | 'server-error';\n\nexport class ControllerLeaseRequestError extends Error {\n\treadonly bodyText: string;\n\treadonly kind: ControllerLeaseRequestErrorKind;\n\treadonly responseBody: JsonValue | undefined;\n\treadonly status: number;\n\n\tconstructor(options: {\n\t\treadonly bodyText: string;\n\t\treadonly context: string;\n\t\treadonly responseBody: JsonValue | undefined;\n\t\treadonly status: number;\n\t}) {\n\t\tconst kind: ControllerLeaseRequestErrorKind =\n\t\t\toptions.status >= 400 && options.status < 500 ? 'client-error' : 'server-error';\n\t\tsuper(\n\t\t\t`${options.context} returned HTTP ${String(options.status)} (${kind})${formatStructuredErrorSuffix(\n\t\t\t\toptions.responseBody,\n\t\t\t)}`,\n\t\t);\n\t\tthis.bodyText = options.bodyText;\n\t\tthis.kind = kind;\n\t\tthis.responseBody = options.responseBody;\n\t\tthis.status = options.status;\n\t}\n}\n\nconst structuredControllerErrorSchema = z.object({\n\tguidance: z.string().trim().min(1).optional(),\n\tmessage: z.string().trim().min(1).optional(),\n});\n\nfunction isJsonObjectRecord(value: unknown): value is { readonly [key: string]: JsonValue } {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t!Array.isArray(value) &&\n\t\tObject.values(value).every(isJsonValue)\n\t);\n}\n\nfunction isJsonValue(value: unknown): value is JsonValue {\n\tif (\n\t\tvalue === null ||\n\t\ttypeof value === 'string' ||\n\t\ttypeof value === 'boolean' ||\n\t\ttypeof value === 'number'\n\t) {\n\t\treturn true;\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.every(isJsonValue);\n\t}\n\treturn isJsonObjectRecord(value);\n}\n\nconst jsonValueSchema = z.custom<JsonValue>(isJsonValue);\n\nfunction objectValue(value: unknown): object | undefined {\n\treturn typeof value === 'object' && value !== null ? value : undefined;\n}\n\nfunction formatStructuredErrorSuffix(responseBody: JsonValue | undefined): string {\n\tconst parsedError = structuredControllerErrorSchema.safeParse(responseBody);\n\tif (!parsedError.success) {\n\t\treturn '';\n\t}\n\tconst { guidance, message } = parsedError.data;\n\tconst parts = [message, guidance ? `Guidance: ${guidance}` : undefined].filter(\n\t\t(part): part is string => part !== undefined,\n\t);\n\treturn parts.length > 0 ? `: ${parts.join(' ')}` : '';\n}\n\nfunction isStartActiveUseResponse(value: unknown): value is StartToolVmActiveUseResponse {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'expiresAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'heartbeatAfterMs') === 'number' &&\n\t\ttypeof Reflect.get(record, 'useId') === 'string'\n\t);\n}\n\nfunction isHeartbeatActiveUseResponse(value: unknown): value is HeartbeatToolVmActiveUseResponse {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'expiresAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'heartbeatAfterMs') === 'number'\n\t);\n}\n\nfunction formatUnknownError(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction writeLeaseClientLog(message: string): void {\n\tprocess.stderr.write(`[openclaw-agent-vm-plugin] ${message}\\n`);\n}\n\nfunction parseJsonBody(bodyText: string, context: string): JsonValue | undefined {\n\ttry {\n\t\tconst parsedJson: unknown = JSON.parse(bodyText);\n\t\tconst parsedBody = jsonValueSchema.safeParse(parsedJson);\n\t\treturn parsedBody.success ? parsedBody.data : undefined;\n\t} catch (error) {\n\t\twriteLeaseClientLog(`${context} returned a non-JSON error body: ${formatUnknownError(error)}`);\n\t\treturn undefined;\n\t}\n}\n\nasync function readErrorBody(\n\tresponse: Response,\n\tcontext: string,\n): Promise<{\n\treadonly bodyText: string;\n\treadonly responseBody: JsonValue | undefined;\n}> {\n\tconst bodyText = await response.text().catch(() => '(unreadable)');\n\treturn {\n\t\tbodyText,\n\t\tresponseBody: bodyText === '(unreadable)' ? undefined : parseJsonBody(bodyText, context),\n\t};\n}\n\nasync function readJsonResponse<TValue>(\n\tresponse: Response,\n\tcontext: string,\n\tisExpectedResponse: (value: unknown) => value is TValue,\n): Promise<TValue> {\n\tif (!response.ok) {\n\t\tconst errorBody = await readErrorBody(response, context);\n\t\tthrow new ControllerLeaseRequestError({\n\t\t\tbodyText: errorBody.bodyText,\n\t\t\tcontext,\n\t\t\tresponseBody: errorBody.responseBody,\n\t\t\tstatus: response.status,\n\t\t});\n\t}\n\tconst payload = await response.json();\n\tif (!isExpectedResponse(payload)) {\n\t\tthrow new TypeError(\n\t\t\t`${context} returned an invalid response: ${JSON.stringify(payload).slice(0, 200)}`,\n\t\t);\n\t}\n\treturn payload;\n}\n\nexport function createLeaseClient(options: {\n\treadonly controllerUrl: string;\n\treadonly fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\treadonly requestPolicy?: ControllerRequestPolicy | undefined;\n}): LeaseClient {\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\tconst baseUrl = options.controllerUrl.replace(/\\/$/u, '');\n\tconst fetchController = async (optionsForRequest: {\n\t\treadonly init?: RequestInit | undefined;\n\t\treadonly input: string | URL | Request;\n\t\treadonly operation: ControllerRequestPolicyOperation;\n\t}): Promise<Response> =>\n\t\tawait fetchControllerWithPolicy({\n\t\t\tfetchImpl,\n\t\t\tinput: optionsForRequest.input,\n\t\t\toperation: optionsForRequest.operation,\n\t\t\t...(optionsForRequest.init === undefined ? {} : { init: optionsForRequest.init }),\n\t\t\t...(options.requestPolicy === undefined ? {} : { policy: options.requestPolicy }),\n\t\t});\n\n\tconst renewLease = async (leaseId: string): Promise<ToolVmSshLease> => {\n\t\tconst response = await fetchController({\n\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/renew`,\n\t\t\tinit: {\n\t\t\t\tmethod: 'POST',\n\t\t\t},\n\t\t\toperation: 'lease-renew',\n\t\t});\n\t\treturn await readJsonResponse(response, 'Controller lease renew API', isToolVmSshLease);\n\t};\n\n\treturn {\n\t\tendActiveUse: async (\n\t\t\tleaseId: string,\n\t\t\tuseId: string,\n\t\t\trequest: EndToolVmActiveUseRequest,\n\t\t): Promise<void> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/uses/${encodeURIComponent(useId)}`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(request),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'DELETE',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-use-end',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tconst errorBody = await readErrorBody(response, 'Controller active-use end API');\n\t\t\t\tthrow new ControllerLeaseRequestError({\n\t\t\t\t\tbodyText: errorBody.bodyText,\n\t\t\t\t\tcontext: 'Controller active-use end API',\n\t\t\t\t\tresponseBody: errorBody.responseBody,\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t});\n\t\t\t}\n\t\t\tawait drainControllerResponseBody(response);\n\t\t},\n\t\theartbeatActiveUse: async (\n\t\t\tleaseId: string,\n\t\t\tuseId: string,\n\t\t\trequest: HeartbeatToolVmActiveUseRequest,\n\t\t): Promise<HeartbeatToolVmActiveUseResponse> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/uses/${encodeURIComponent(useId)}/heartbeat`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(request),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-heartbeat',\n\t\t\t});\n\t\t\treturn await readJsonResponse(\n\t\t\t\tresponse,\n\t\t\t\t'Controller active-use heartbeat API',\n\t\t\t\tisHeartbeatActiveUseResponse,\n\t\t\t);\n\t\t},\n\t\trenewLease,\n\t\tpeekLease: async (leaseId: string): Promise<ToolVmLeasePeek> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/peek`,\n\t\t\t\toperation: 'lease-peek',\n\t\t\t});\n\t\t\treturn await readJsonResponse(response, 'Controller lease peek API', isToolVmLeasePeek);\n\t\t},\n\t\tpublishOpenClawRuntimeStatus: async (report): Promise<void> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/zones/${encodeURIComponent(report.zoneId)}/openclaw-runtime-status`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(report),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'openclaw-runtime-status',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tconst errorBody = await readErrorBody(response, 'Controller OpenClaw runtime status API');\n\t\t\t\tthrow new ControllerLeaseRequestError({\n\t\t\t\t\tbodyText: errorBody.bodyText,\n\t\t\t\t\tcontext: 'Controller OpenClaw runtime status API',\n\t\t\t\t\tresponseBody: errorBody.responseBody,\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t});\n\t\t\t}\n\t\t\tawait drainControllerResponseBody(response);\n\t\t},\n\t\treleaseLease: async (\n\t\t\tleaseId: string,\n\t\t\treleaseOptions: { readonly force?: boolean } = {},\n\t\t): Promise<void> => {\n\t\t\tconst releaseUrl = new URL(`${baseUrl}/lease/${encodeURIComponent(leaseId)}`);\n\t\t\tif (releaseOptions.force === true) {\n\t\t\t\treleaseUrl.searchParams.set('force', 'true');\n\t\t\t}\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: releaseUrl.toString(),\n\t\t\t\tinit: {\n\t\t\t\t\tmethod: 'DELETE',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-release',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tconst errorBody = await readErrorBody(response, 'Controller lease release API');\n\t\t\t\tthrow new ControllerLeaseRequestError({\n\t\t\t\t\tbodyText: errorBody.bodyText,\n\t\t\t\t\tcontext: 'Controller lease release API',\n\t\t\t\t\tresponseBody: errorBody.responseBody,\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t});\n\t\t\t}\n\t\t\tawait drainControllerResponseBody(response);\n\t\t},\n\t\trequestLease: async (request): Promise<ToolVmSshLease> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tagentId: request.agentId,\n\t\t\t\t\t\tagentWorkspaceDir: request.agentWorkspaceDir,\n\t\t\t\t\t\t...(request.idleTtlMs !== undefined ? { idleTtlMs: request.idleTtlMs } : {}),\n\t\t\t\t\t\tprofileId: request.profileId,\n\t\t\t\t\t\tsessionKey: request.sessionKey,\n\t\t\t\t\t\tworkMountDir: request.workMountDir,\n\t\t\t\t\t\tzoneId: request.zoneId,\n\t\t\t\t\t}),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-create',\n\t\t\t});\n\t\t\treturn await readJsonResponse(response, 'Controller lease API', isToolVmSshLease);\n\t\t},\n\t\tstartActiveUse: async (\n\t\t\tleaseId: string,\n\t\t\trequest: StartToolVmActiveUseRequest,\n\t\t): Promise<StartToolVmActiveUseResponse> => {\n\t\t\tconst response = await fetchController({\n\t\t\t\tinput: `${baseUrl}/lease/${encodeURIComponent(leaseId)}/uses`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(request),\n\t\t\t\t\theaders: {\n\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t},\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'lease-use-start',\n\t\t\t});\n\t\t\treturn await readJsonResponse(\n\t\t\t\tresponse,\n\t\t\t\t'Controller active-use start API',\n\t\t\t\tisStartActiveUseResponse,\n\t\t\t);\n\t\t},\n\t};\n}\n","const agentIdPattern = /^[a-z0-9][a-z0-9_-]{0,63}$/iu;\n\nexport const OPENCLAW_DEFAULT_AGENT_ID = 'main';\n\nexport const OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS = [\n\t{ expectedValue: 'gondolin', key: 'backend' },\n\t{ expectedValue: 'all', key: 'mode' },\n\t{ expectedValue: 'agent', key: 'scope' },\n\t{ expectedValue: 'rw', key: 'workspaceAccess' },\n] as const;\n\nexport const OPENCLAW_GONDOLIN_LEASE_SCOPE_GUIDANCE =\n\t'Managed OpenClaw/Gondolin leases are agent-scoped. The plugin derives agentId from sessionKey and does not send OpenClaw scope keys to the controller.';\n\nexport type OpenClawGondolinSandboxRequirement =\n\t(typeof OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS)[number];\n\nexport type OpenClawGondolinSandboxRequirementKey = OpenClawGondolinSandboxRequirement['key'];\n\nexport interface OpenClawGondolinSandboxSnapshot {\n\treadonly backend?: unknown;\n\treadonly mode?: unknown;\n\treadonly scope?: unknown;\n\treadonly workspaceAccess?: unknown;\n}\n\nexport interface OpenClawGondolinAgentConfig {\n\treadonly id?: unknown;\n\treadonly sandbox?: OpenClawGondolinSandboxSnapshot;\n\treadonly workspace?: unknown;\n}\n\nexport class OpenClawAgentIdError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = 'OpenClawAgentIdError';\n\t}\n}\n\nexport function isOpenClawAgentId(value: string): boolean {\n\treturn agentIdPattern.test(value.trim());\n}\n\nexport function effectiveOpenClawGondolinSandboxValue(\n\tdefaults: OpenClawGondolinAgentConfig,\n\tagentConfig: OpenClawGondolinAgentConfig,\n\tkey: OpenClawGondolinSandboxRequirementKey,\n): unknown {\n\treturn agentConfig.sandbox?.[key] ?? defaults.sandbox?.[key];\n}\n\nexport function formatOpenClawGondolinRequirementFieldPath(\n\tlabel: string,\n\tkey: OpenClawGondolinSandboxRequirementKey,\n): string {\n\treturn `agents.${label}.sandbox.${key}`;\n}\n\nexport function formatOpenClawGondolinRequirementFindingId(options: {\n\treadonly fieldPath: string;\n\treadonly label: string;\n\treadonly zoneId: string;\n}): string {\n\treturn `openclaw-tool-vm-${options.fieldPath.replace(/[.[\\]]/gu, '-')}-${options.zoneId}-${options.label}`;\n}\n\nexport function formatOpenClawGondolinRequirementHint(options: {\n\treadonly expectedValue: string;\n\treadonly fieldPath: string;\n\treadonly ok: boolean;\n}): string {\n\treturn options.ok\n\t\t? `${options.fieldPath}=${options.expectedValue}`\n\t\t: `Set ${options.fieldPath} to \"${options.expectedValue}\" for OpenClaw Tool VM mediation.`;\n}\n\nexport function normalizeOpenClawAgentId(value: string | undefined | null): string {\n\tconst trimmed = (value ?? '').trim().toLowerCase();\n\tif (trimmed === '') {\n\t\treturn OPENCLAW_DEFAULT_AGENT_ID;\n\t}\n\tif (!isOpenClawAgentId(trimmed)) {\n\t\tthrow new OpenClawAgentIdError(`Invalid OpenClaw agentId '${value}'.`);\n\t}\n\treturn trimmed;\n}\n\nexport function resolveOpenClawAgentIdFromSessionKey(sessionKey: string): string {\n\tconst parts = sessionKey.trim().split(':');\n\tif (parts[0] !== 'agent' || !parts[1] || !isOpenClawAgentId(parts[1])) {\n\t\tthrow new OpenClawAgentIdError(\n\t\t\t`OpenClaw sessionKey '${sessionKey}' must be agent-shaped and include a valid agentId.`,\n\t\t);\n\t}\n\treturn normalizeOpenClawAgentId(parts[1]);\n}\n\nexport function isOpenClawAgentSessionKey(sessionKey: string): boolean {\n\tconst parts = sessionKey.trim().split(':');\n\treturn parts[0] === 'agent' && parts[1] !== undefined && isOpenClawAgentId(parts[1]);\n}\n\nexport function snapshotOpenClawGondolinSandboxConfig(cfg: OpenClawGondolinSandboxSnapshot): {\n\treadonly backend: unknown;\n\treadonly mode: unknown;\n\treadonly scope: unknown;\n\treadonly workspaceAccess: unknown;\n} {\n\treturn {\n\t\tbackend: cfg.backend,\n\t\tmode: cfg.mode,\n\t\tscope: cfg.scope,\n\t\tworkspaceAccess: cfg.workspaceAccess,\n\t};\n}\n\nexport function findOpenClawGondolinSandboxMismatch(\n\tsandbox: OpenClawGondolinSandboxSnapshot,\n): OpenClawGondolinSandboxRequirement | undefined {\n\treturn OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS.find(\n\t\t(requirement) => sandbox[requirement.key] !== requirement.expectedValue,\n\t);\n}\n","import path from 'node:path/posix';\n\nimport {\n\tOPENCLAW_STATE_SANDBOXES_VM_ROOT,\n\tTOOL_VM_SCRATCH_GUEST_ROOT,\n\tTOOL_VM_WORKSPACE_GUEST_ROOT,\n} from '@agent-vm/gateway-interface';\n\nimport { normalizeOpenClawAgentId } from '../openclaw-gondolin-contract.js';\n\nexport interface OpenClawAgentWorkspaceConfig {\n\treadonly agents?: {\n\t\treadonly defaults?: {\n\t\t\treadonly workspace?: unknown;\n\t\t};\n\t\treadonly list?: readonly unknown[];\n\t};\n}\n\nexport type OpenClawAgentWorkspaceSourceKind =\n\t| 'configured-agent-workspace'\n\t| 'default-agent-workspace'\n\t| 'default-workspace-child'\n\t| 'sdk-agent-workspace'\n\t| 'state-workspace-child';\n\nexport interface OpenClawAgentWorkspaceSource {\n\treadonly kind: OpenClawAgentWorkspaceSourceKind;\n\treadonly sourceDir: string;\n}\n\nexport class OpenClawAgentWorkspaceSourceError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = 'OpenClawAgentWorkspaceSourceError';\n\t}\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction normalizeAbsolutePosixPath(inputPath: string): string {\n\tconst segments = inputPath.split('/').filter((segment) => segment !== '' && segment !== '.');\n\treturn `/${segments.join('/')}`;\n}\n\nfunction containsParentTraversal(inputPath: string): boolean {\n\treturn inputPath.split(/\\/+/u).includes('..');\n}\n\nfunction pathIsInsideOrEqual(inputPath: string, rootPath: string): boolean {\n\treturn inputPath === rootPath || inputPath.startsWith(`${rootPath}/`);\n}\n\nfunction isRuntimePathLeak(inputPath: string, defaultWorkspaceDir: string | undefined): boolean {\n\tconst normalized = normalizeAbsolutePosixPath(inputPath);\n\tconst normalizedDefaultWorkspace =\n\t\tdefaultWorkspaceDir === undefined\n\t\t\t? undefined\n\t\t\t: normalizeAbsolutePosixPath(resolveUserPathLikeOpenClaw(defaultWorkspaceDir));\n\tconst implicitWorkspaceFamilyRoot =\n\t\tnormalizedDefaultWorkspace === undefined\n\t\t\t? undefined\n\t\t\t: normalizedDefaultWorkspace.replace(/(?:-[^/]+)?$/u, '');\n\treturn (\n\t\tnormalized === TOOL_VM_WORKSPACE_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_WORKSPACE_GUEST_ROOT}/`) ||\n\t\tnormalized === TOOL_VM_SCRATCH_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_SCRATCH_GUEST_ROOT}/`) ||\n\t\tnormalized === OPENCLAW_STATE_SANDBOXES_VM_ROOT ||\n\t\tnormalized.startsWith(`${OPENCLAW_STATE_SANDBOXES_VM_ROOT}/`) ||\n\t\t(normalizedDefaultWorkspace !== undefined &&\n\t\t\t(pathIsInsideOrEqual(normalized, normalizedDefaultWorkspace) ||\n\t\t\t\tnormalized.startsWith(`${normalizedDefaultWorkspace}-`))) ||\n\t\t(implicitWorkspaceFamilyRoot !== undefined &&\n\t\t\t(pathIsInsideOrEqual(normalized, implicitWorkspaceFamilyRoot) ||\n\t\t\t\tnormalized.startsWith(`${implicitWorkspaceFamilyRoot}-`)))\n\t);\n}\n\nfunction resolveUserPathLikeOpenClaw(inputPath: string): string {\n\tconst trimmedPath = inputPath.trim();\n\tconst homeDirectory = process.env.HOME?.trim();\n\tif (trimmedPath === '~' && homeDirectory) {\n\t\treturn homeDirectory;\n\t}\n\tif (trimmedPath.startsWith('~/') && homeDirectory) {\n\t\treturn path.resolve(path.join(homeDirectory, trimmedPath.slice(2)));\n\t}\n\treturn path.resolve(trimmedPath);\n}\n\nfunction assertCanonicalSourcePath(inputPath: string, context: string): string {\n\tconst trimmedPath = inputPath.trim();\n\tif (trimmedPath === '' || containsParentTraversal(trimmedPath)) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must be a non-empty path without parent traversal.`,\n\t\t);\n\t}\n\tif (!trimmedPath.startsWith('/') && !trimmedPath.startsWith('~')) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must be an absolute or home-relative path.`,\n\t\t);\n\t}\n\tconst resolvedPath = resolveUserPathLikeOpenClaw(trimmedPath);\n\tconst normalized = normalizeAbsolutePosixPath(resolvedPath);\n\tif (\n\t\tnormalized === '/' ||\n\t\tnormalized === TOOL_VM_WORKSPACE_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_WORKSPACE_GUEST_ROOT}/`) ||\n\t\tnormalized === TOOL_VM_SCRATCH_GUEST_ROOT ||\n\t\tnormalized.startsWith(`${TOOL_VM_SCRATCH_GUEST_ROOT}/`)\n\t) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must resolve to an OpenClaw/Gondolin source path, not Tool VM guest path '${normalized}'.`,\n\t\t);\n\t}\n\tif (\n\t\tnormalized === OPENCLAW_STATE_SANDBOXES_VM_ROOT ||\n\t\tnormalized.startsWith(`${OPENCLAW_STATE_SANDBOXES_VM_ROOT}/`)\n\t) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must resolve to a stable agent workspace path, not transient OpenClaw sandbox path '${normalized}'.`,\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction assertLeaseBackedSourcePath(\n\tinputPath: string,\n\tcontext: string,\n\tdefaultWorkspaceDir: string | undefined,\n): string {\n\tconst normalized = assertCanonicalSourcePath(inputPath, context);\n\tif (isRuntimePathLeak(normalized, defaultWorkspaceDir)) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`${context} must resolve to a controller lease-backed OpenClaw/Gondolin source path, not OpenClaw runtime fallback path '${normalized}'.`,\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction readWorkspace(value: unknown): string | undefined {\n\treturn typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;\n}\n\nfunction readAgentId(value: unknown): string {\n\treturn normalizeOpenClawAgentId(typeof value === 'string' ? value : undefined);\n}\n\nfunction agentEntries(\n\tconfig: OpenClawAgentWorkspaceConfig | undefined,\n): readonly Record<string, unknown>[] {\n\treturn config?.agents?.list?.filter(isRecord) ?? [];\n}\n\nfunction findAgentEntry(\n\tconfig: OpenClawAgentWorkspaceConfig | undefined,\n\tagentId: string,\n): Record<string, unknown> | undefined {\n\treturn agentEntries(config).find((entry) => readAgentId(entry.id) === agentId);\n}\n\nfunction resolveDefaultAgentId(config: OpenClawAgentWorkspaceConfig | undefined): string {\n\tconst entries = agentEntries(config);\n\tconst defaultEntry = entries.find((entry) => entry.default === true);\n\tconst fallbackEntry = defaultEntry ?? entries[0];\n\treturn readAgentId(fallbackEntry?.id);\n}\n\nexport function resolveOpenClawAgentWorkspaceSource(options: {\n\treadonly agentId: string;\n\treadonly defaultWorkspaceDir: string | undefined;\n\treadonly openClawConfig: OpenClawAgentWorkspaceConfig | undefined;\n\treadonly paramsAgentWorkspaceDir: string;\n\treadonly stateDir: string | undefined;\n}): OpenClawAgentWorkspaceSource {\n\tconst agentId = normalizeOpenClawAgentId(options.agentId);\n\tconst agentEntry = findAgentEntry(options.openClawConfig, agentId);\n\tconst agentWorkspace = readWorkspace(agentEntry?.workspace);\n\tif (agentWorkspace !== undefined) {\n\t\treturn {\n\t\t\tkind: 'configured-agent-workspace',\n\t\t\tsourceDir: assertLeaseBackedSourcePath(\n\t\t\t\tagentWorkspace,\n\t\t\t\t`agents.list workspace for '${agentId}'`,\n\t\t\t\toptions.defaultWorkspaceDir,\n\t\t\t),\n\t\t};\n\t}\n\n\tconst defaultsWorkspace = readWorkspace(options.openClawConfig?.agents?.defaults?.workspace);\n\tif (defaultsWorkspace !== undefined) {\n\t\tconst defaultsRoot = assertLeaseBackedSourcePath(\n\t\t\tdefaultsWorkspace,\n\t\t\t'agents.defaults.workspace',\n\t\t\toptions.defaultWorkspaceDir,\n\t\t);\n\t\tconst defaultAgentId = resolveDefaultAgentId(options.openClawConfig);\n\t\treturn {\n\t\t\tkind: agentId === defaultAgentId ? 'default-agent-workspace' : 'default-workspace-child',\n\t\t\tsourceDir: agentId === defaultAgentId ? defaultsRoot : path.join(defaultsRoot, agentId),\n\t\t};\n\t}\n\n\tif (!isRuntimePathLeak(options.paramsAgentWorkspaceDir, options.defaultWorkspaceDir)) {\n\t\treturn {\n\t\t\tkind: 'sdk-agent-workspace',\n\t\t\tsourceDir: assertCanonicalSourcePath(\n\t\t\t\toptions.paramsAgentWorkspaceDir,\n\t\t\t\t'OpenClaw backend agentWorkspaceDir',\n\t\t\t),\n\t\t};\n\t}\n\n\tconst stateRoot =\n\t\toptions.stateDir === undefined\n\t\t\t? undefined\n\t\t\t: assertCanonicalSourcePath(options.stateDir, 'OpenClaw stateDir');\n\tif (stateRoot === undefined) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`OpenClaw provided agentWorkspaceDir '${options.paramsAgentWorkspaceDir}' for agent '${agentId}', which is a runtime path. Provide an OpenClaw stateDir provider or configure agents.list[].workspace.`,\n\t\t);\n\t}\n\n\tconst defaultAgentId = resolveDefaultAgentId(options.openClawConfig);\n\tif (agentId === defaultAgentId) {\n\t\tthrow new OpenClawAgentWorkspaceSourceError(\n\t\t\t`OpenClaw provided agentWorkspaceDir '${options.paramsAgentWorkspaceDir}' for default agent '${agentId}', but OpenClaw's implicit default workspace is not controller lease backed; configure agents.list[].workspace or agents.defaults.workspace for managed Gondolin agents.`,\n\t\t);\n\t}\n\treturn {\n\t\tkind: 'state-workspace-child',\n\t\tsourceDir: path.join(stateRoot, `workspace-${agentId}`),\n\t};\n}\n","import {\n\tOPENCLAW_STATE_SANDBOXES_VM_ROOT,\n\tTOOL_VM_SCRATCH_GUEST_ROOT,\n\tTOOL_VM_WORKSPACE_GUEST_ROOT,\n\ttranslateRuntimePath,\n\ttype RuntimePathMapping,\n\ttype RuntimePathTranslation,\n\ttype RuntimePathTranslationError,\n} from '@agent-vm/gateway-interface';\n\nexport type OpenClawToolVmPathIntentKind =\n\t| 'host-workspace-root'\n\t| 'host-workspace-subpath'\n\t| 'openclaw-sandbox-path'\n\t| 'workspace-root'\n\t| 'workspace-subpath'\n\t| 'scratch-root'\n\t| 'scratch-subpath';\n\nexport interface OpenClawToolVmPathIntentResolution {\n\treadonly effectiveGuestCwd: string;\n\treadonly hostEquivalentPath?: string;\n\treadonly kind: OpenClawToolVmPathIntentKind;\n\treadonly leaseWorkMountDir: string;\n}\n\nexport type OpenClawToolVmPathIntentResult =\n\t| {\n\t\t\treadonly ok: true;\n\t\t\treadonly value: OpenClawToolVmPathIntentResolution;\n\t  }\n\t| {\n\t\t\treadonly ok: false;\n\t\t\treadonly error: RuntimePathTranslationError;\n\t  };\n\nexport class OpenClawToolVmPathIntentError extends Error {\n\treadonly details: RuntimePathTranslationError;\n\n\tconstructor(details: RuntimePathTranslationError) {\n\t\tsuper(`${details.message} ${details.retryGuidance}`);\n\t\tthis.name = 'OpenClawToolVmPathIntentError';\n\t\tthis.details = details;\n\t}\n}\n\nfunction pathContainsParentTraversal(inputPath: string): boolean {\n\treturn inputPath.split(/\\/+/u).includes('..');\n}\n\nfunction normalizedAbsolutePath(inputPath: string): string {\n\tconst rawSegments = inputPath.split('/').filter((segment) => segment !== '' && segment !== '.');\n\treturn `/${rawSegments.join('/')}`;\n}\n\nfunction invalidAgentWorkspaceRootError(agentWorkspaceDir: string): RuntimePathTranslationError {\n\treturn {\n\t\tallowedPathForms: [],\n\t\tcode: 'invalid-runtime-root',\n\t\tinputPath: agentWorkspaceDir,\n\t\tmappingId: 'openclaw-tool-vm',\n\t\tmessage: `OpenClaw agentWorkspaceDir '${agentWorkspaceDir}' must be an absolute non-root path without parent traversal.`,\n\t\tpurpose: 'executionCwd',\n\t\tretryGuidance:\n\t\t\t'Retry with OpenClaw agentWorkspaceDir set to the resolved host RealFS workspace for the requested agent.',\n\t};\n}\n\nfunction validateAgentWorkspaceDir(\n\tagentWorkspaceDir: string,\n): RuntimePathTranslationError | undefined {\n\tif (\n\t\tagentWorkspaceDir.trim() === '' ||\n\t\t!agentWorkspaceDir.startsWith('/') ||\n\t\tnormalizedAbsolutePath(agentWorkspaceDir) === '/' ||\n\t\tpathContainsParentTraversal(agentWorkspaceDir)\n\t) {\n\t\treturn invalidAgentWorkspaceRootError(agentWorkspaceDir);\n\t}\n\treturn undefined;\n}\n\nfunction createOpenClawToolVmPathMapping(options: {\n\treadonly agentWorkspaceDir: string;\n}): RuntimePathMapping {\n\treturn {\n\t\tid: 'openclaw-tool-vm',\n\t\troots: [\n\t\t\t{\n\t\t\t\tid: 'agent-workspace',\n\t\t\t\tbacking: {\n\t\t\t\t\tkind: 'host-realfs',\n\t\t\t\t\tdurability: 'durable',\n\t\t\t\t\tbackup: 'included',\n\t\t\t\t},\n\t\t\t\tcapabilities: {\n\t\t\t\t\texecutionCwd: true,\n\t\t\t\t\tleaseMount: true,\n\t\t\t\t},\n\t\t\t\tlocations: {\n\t\t\t\t\t'openclaw-gateway': options.agentWorkspaceDir,\n\t\t\t\t\t'tool-vm-guest': TOOL_VM_WORKSPACE_GUEST_ROOT,\n\t\t\t\t},\n\t\t\t\trootPathAllowed: true,\n\t\t\t\tguidanceLabel: 'agent workspace',\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: 'tool-vm-scratch',\n\t\t\t\tbacking: {\n\t\t\t\t\tkind: 'guest-rootfs-cow',\n\t\t\t\t\tdurability: 'vm-lifetime',\n\t\t\t\t},\n\t\t\t\tcapabilities: {\n\t\t\t\t\texecutionCwd: true,\n\t\t\t\t\tleaseMount: false,\n\t\t\t\t},\n\t\t\t\tlocations: {\n\t\t\t\t\t'tool-vm-guest': TOOL_VM_SCRATCH_GUEST_ROOT,\n\t\t\t\t},\n\t\t\t\trootPathAllowed: true,\n\t\t\t\tguidanceLabel: 'Tool VM scratch',\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: 'openclaw-sandboxes',\n\t\t\t\tbacking: {\n\t\t\t\t\tkind: 'host-realfs',\n\t\t\t\t\tdurability: 'durable',\n\t\t\t\t\tbackup: 'included',\n\t\t\t\t},\n\t\t\t\tcapabilities: {\n\t\t\t\t\texecutionCwd: true,\n\t\t\t\t\tleaseMount: true,\n\t\t\t\t},\n\t\t\t\tlocations: {\n\t\t\t\t\t'openclaw-gateway': OPENCLAW_STATE_SANDBOXES_VM_ROOT,\n\t\t\t\t},\n\t\t\t\trootPathAllowed: false,\n\t\t\t\tguidanceLabel: 'OpenClaw sandbox work directory',\n\t\t\t},\n\t\t],\n\t};\n}\n\nfunction resolveOpenClawSandboxPathIntent(translation: RuntimePathTranslation): {\n\treadonly effectiveGuestCwd: string;\n\treadonly leaseWorkMountDir: string;\n} {\n\tconst [sandboxChild, ...guestCwdSegments] = translation.relativePath.split('/');\n\tconst leaseWorkMountDir =\n\t\tsandboxChild === undefined || sandboxChild === ''\n\t\t\t? translation.outputPath\n\t\t\t: `${OPENCLAW_STATE_SANDBOXES_VM_ROOT}/${sandboxChild}`;\n\tconst effectiveGuestCwd =\n\t\tguestCwdSegments.length === 0\n\t\t\t? TOOL_VM_WORKSPACE_GUEST_ROOT\n\t\t\t: `${TOOL_VM_WORKSPACE_GUEST_ROOT}/${guestCwdSegments.join('/')}`;\n\treturn {\n\t\teffectiveGuestCwd,\n\t\tleaseWorkMountDir,\n\t};\n}\n\nfunction kindForTranslation(translation: RuntimePathTranslation): OpenClawToolVmPathIntentKind {\n\tconst isRoot = translation.relativePath === '';\n\tif (translation.rootId === 'tool-vm-scratch') {\n\t\treturn isRoot ? 'scratch-root' : 'scratch-subpath';\n\t}\n\tif (translation.rootId === 'openclaw-sandboxes') {\n\t\treturn 'openclaw-sandbox-path';\n\t}\n\tif (translation.inputNamespace === 'openclaw-gateway') {\n\t\treturn isRoot ? 'host-workspace-root' : 'host-workspace-subpath';\n\t}\n\treturn isRoot ? 'workspace-root' : 'workspace-subpath';\n}\n\nfunction leaseRootForTranslation(translation: RuntimePathTranslation): string {\n\treturn translation.relativePath === ''\n\t\t? translation.outputPath\n\t\t: translation.outputPath.slice(0, -(translation.relativePath.length + 1));\n}\n\nexport function resolveOpenClawToolVmPathIntent(options: {\n\treadonly agentWorkspaceDir: string;\n\treadonly equivalentAgentWorkspaceDirs?: readonly string[];\n\treadonly inputPath: string;\n}): OpenClawToolVmPathIntentResult {\n\tconst agentWorkspaceDirError = validateAgentWorkspaceDir(options.agentWorkspaceDir);\n\tif (agentWorkspaceDirError !== undefined) {\n\t\treturn {\n\t\t\terror: agentWorkspaceDirError,\n\t\t\tok: false,\n\t\t};\n\t}\n\tconst mappings = [\n\t\tcreateOpenClawToolVmPathMapping({\n\t\t\tagentWorkspaceDir: options.agentWorkspaceDir,\n\t\t}),\n\t\t...(options.equivalentAgentWorkspaceDirs ?? []).map((equivalentAgentWorkspaceDir) =>\n\t\t\tcreateOpenClawToolVmPathMapping({\n\t\t\t\tagentWorkspaceDir: equivalentAgentWorkspaceDir,\n\t\t\t}),\n\t\t),\n\t];\n\tconst invalidEquivalentRoot = (options.equivalentAgentWorkspaceDirs ?? [])\n\t\t.map((equivalentAgentWorkspaceDir) => validateAgentWorkspaceDir(equivalentAgentWorkspaceDir))\n\t\t.find((error) => error !== undefined);\n\tif (invalidEquivalentRoot !== undefined) {\n\t\treturn {\n\t\t\terror: invalidEquivalentRoot,\n\t\t\tok: false,\n\t\t};\n\t}\n\tconst mapping = createOpenClawToolVmPathMapping({\n\t\tagentWorkspaceDir: options.agentWorkspaceDir,\n\t});\n\tconst sandboxTranslation = translateRuntimePath({\n\t\tinputPath: options.inputPath,\n\t\tmapping,\n\t\tpurpose: 'executionCwd',\n\t\tsourceNamespace: 'openclaw-gateway',\n\t\ttargetNamespace: 'openclaw-gateway',\n\t});\n\tif (sandboxTranslation.ok && sandboxTranslation.value.rootId === 'openclaw-sandboxes') {\n\t\tconst sandboxPathIntent = resolveOpenClawSandboxPathIntent(sandboxTranslation.value);\n\t\treturn {\n\t\t\tok: true,\n\t\t\tvalue: {\n\t\t\t\teffectiveGuestCwd: sandboxPathIntent.effectiveGuestCwd,\n\t\t\t\thostEquivalentPath: sandboxTranslation.value.outputPath,\n\t\t\t\tkind: kindForTranslation(sandboxTranslation.value),\n\t\t\t\tleaseWorkMountDir: sandboxPathIntent.leaseWorkMountDir,\n\t\t\t},\n\t\t};\n\t}\n\tconst translationResults = mappings.map((candidateMapping) =>\n\t\ttranslateRuntimePath({\n\t\t\tinputPath: options.inputPath,\n\t\t\tmapping: candidateMapping,\n\t\t\tpurpose: 'executionCwd',\n\t\t\ttargetNamespace: 'tool-vm-guest',\n\t\t}),\n\t);\n\tconst translation = translationResults.find((candidateTranslation) => candidateTranslation.ok);\n\tif (translation === undefined) {\n\t\tconst primaryTranslation = translationResults[0];\n\t\tif (primaryTranslation === undefined || primaryTranslation.ok) {\n\t\t\treturn {\n\t\t\t\terror: invalidAgentWorkspaceRootError(options.agentWorkspaceDir),\n\t\t\t\tok: false,\n\t\t\t};\n\t\t}\n\t\treturn primaryTranslation;\n\t}\n\tconst hostEquivalentTranslation = translateRuntimePath({\n\t\tinputPath: options.inputPath,\n\t\tmapping,\n\t\tpurpose: 'executionCwd',\n\t\ttargetNamespace: 'openclaw-gateway',\n\t});\n\treturn {\n\t\tok: true,\n\t\tvalue: {\n\t\t\teffectiveGuestCwd: translation.value.outputPath,\n\t\t\t...(hostEquivalentTranslation.ok\n\t\t\t\t? { hostEquivalentPath: hostEquivalentTranslation.value.outputPath }\n\t\t\t\t: {}),\n\t\t\tkind: kindForTranslation(translation.value),\n\t\t\tleaseWorkMountDir:\n\t\t\t\thostEquivalentTranslation.ok && hostEquivalentTranslation.value.rootId !== 'tool-vm-scratch'\n\t\t\t\t\t? leaseRootForTranslation(hostEquivalentTranslation.value)\n\t\t\t\t\t: options.agentWorkspaceDir,\n\t\t},\n\t};\n}\n\nexport function assertOpenClawToolVmPathIntent(options: {\n\treadonly agentWorkspaceDir: string;\n\treadonly equivalentAgentWorkspaceDirs?: readonly string[];\n\treadonly inputPath: string;\n}): OpenClawToolVmPathIntentResolution {\n\tconst result = resolveOpenClawToolVmPathIntent(options);\n\tif (!result.ok) {\n\t\tthrow new OpenClawToolVmPathIntentError(result.error);\n\t}\n\treturn result.value;\n}\n","export function buildShellScriptWithArgs(script: string, args?: readonly string[]): string {\n\tif (!args || args.length === 0) {\n\t\treturn script;\n\t}\n\n\tconst escapedArgs = args.map((arg) => `'${arg.replace(/'/g, \"'\\\\''\")}'`).join(' ');\n\treturn `set -- ${escapedArgs}; ${script}`;\n}\n","import type {\n\tAgentVmHealthEvent,\n\tToolVmActiveUseOperationReport,\n\tToolVmSshHealthOperation,\n\tToolVmSshFailureKind,\n} from '@agent-vm/gateway-interface';\n\nexport class ToolVmSshOperationStaleError extends Error {\n\toverride readonly cause: unknown;\n\treadonly reason: ToolVmSshFailureKind;\n\n\tconstructor(options: {\n\t\treadonly cause: unknown;\n\t\treadonly message: string;\n\t\treadonly reason: ToolVmSshFailureKind;\n\t}) {\n\t\tsuper(options.message);\n\t\tthis.cause = options.cause;\n\t\tthis.reason = options.reason;\n\t}\n}\n\nexport interface ToolVmSshOperationGuardOptions<TResult> {\n\treadonly clearTimeoutImpl?: typeof clearTimeout | undefined;\n\treadonly healthEvent?: {\n\t\treadonly agentId: string;\n\t\treadonly leaseId: string;\n\t\treadonly operation: ToolVmSshHealthOperation;\n\t\treadonly publish: (event: AgentVmHealthEvent) => Promise<void>;\n\t\treadonly zoneId: string;\n\t};\n\treadonly now?: (() => number) | undefined;\n\treadonly operation: (signal: AbortSignal) => Promise<TResult>;\n\treadonly operationName: string;\n\treadonly report: (report: ToolVmActiveUseOperationReport) => void;\n\treadonly setTimeoutImpl?: typeof setTimeout | undefined;\n\treadonly timeoutMs: number;\n\treadonly writeLog?: (message: string) => void;\n}\n\nfunction formatUnknownError(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction defaultWriteLog(message: string): void {\n\tprocess.stderr.write(`[tool-vm-ssh-operation-guard] ${message}\\n`);\n}\n\nasync function publishHealthEvent(options: {\n\treadonly elapsedMs: number;\n\treadonly errorCode?: string | undefined;\n\treadonly guardOptions: Pick<ToolVmSshOperationGuardOptions<unknown>, 'healthEvent' | 'writeLog'>;\n\treadonly observedAtMs: number;\n\treadonly result: 'failed' | 'ok';\n}): Promise<void> {\n\tif (!options.guardOptions.healthEvent) {\n\t\treturn;\n\t}\n\tconst event = {\n\t\tagentId: options.guardOptions.healthEvent.agentId,\n\t\telapsedMs: options.elapsedMs,\n\t\t...(options.errorCode === undefined ? {} : { errorCode: options.errorCode }),\n\t\tkind: 'tool-vm-ssh',\n\t\tleaseId: options.guardOptions.healthEvent.leaseId,\n\t\tobservedAtMs: options.observedAtMs,\n\t\toperation: options.guardOptions.healthEvent.operation,\n\t\tresult: options.result,\n\t\tzoneId: options.guardOptions.healthEvent.zoneId,\n\t} satisfies AgentVmHealthEvent;\n\ttry {\n\t\tawait options.guardOptions.healthEvent.publish(event);\n\t} catch (error) {\n\t\t(options.guardOptions.writeLog ?? defaultWriteLog)(\n\t\t\t`tool-vm-ssh health publish failed operation=${options.guardOptions.healthEvent.operation} elapsedMs=${String(options.elapsedMs)} error=${formatUnknownError(error)}`,\n\t\t);\n\t}\n}\n\nexport async function runToolVmSshOperationWithGuard<TResult>(\n\toptions: ToolVmSshOperationGuardOptions<TResult>,\n): Promise<TResult> {\n\tconst now = options.now ?? Date.now;\n\tconst setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;\n\tconst clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;\n\tconst abortController = new AbortController();\n\tconst startedAtMs = now();\n\tlet timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n\n\toptions.report({\n\t\tobservedAtMs: now(),\n\t\tphase: 'running',\n\t});\n\n\tconst timeoutPromise = new Promise<never>((_resolve, reject) => {\n\t\ttimeoutHandle = setTimeoutImpl(() => {\n\t\t\tabortController.abort();\n\t\t\treject(\n\t\t\t\tnew ToolVmSshOperationStaleError({\n\t\t\t\t\tcause: undefined,\n\t\t\t\t\tmessage: `${options.operationName} exceeded ${String(options.timeoutMs)}ms.`,\n\t\t\t\t\treason: 'ssh-command-timed-out',\n\t\t\t\t}),\n\t\t\t);\n\t\t}, options.timeoutMs);\n\t});\n\n\ttry {\n\t\tconst result = await Promise.race([options.operation(abortController.signal), timeoutPromise]);\n\t\toptions.report({\n\t\t\tobservedAtMs: now(),\n\t\t\tphase: 'completed',\n\t\t\tssh: { probeSucceeded: true },\n\t\t});\n\t\tconst observedAtMs = now();\n\t\tvoid publishHealthEvent({\n\t\t\telapsedMs: observedAtMs - startedAtMs,\n\t\t\tguardOptions: options,\n\t\t\tobservedAtMs,\n\t\t\tresult: 'ok',\n\t\t});\n\t\treturn result;\n\t} catch (error) {\n\t\tconst staleError =\n\t\t\terror instanceof ToolVmSshOperationStaleError\n\t\t\t\t? error\n\t\t\t\t: new ToolVmSshOperationStaleError({\n\t\t\t\t\t\tcause: error,\n\t\t\t\t\t\tmessage: formatUnknownError(error),\n\t\t\t\t\t\treason: 'ssh-command-failed',\n\t\t\t\t\t});\n\t\toptions.report({\n\t\t\tobservedAtMs: now(),\n\t\t\tphase: 'failed',\n\t\t\tssh: {\n\t\t\t\tfailure: {\n\t\t\t\t\tkind: staleError.reason,\n\t\t\t\t\tmessage: staleError.message,\n\t\t\t\t},\n\t\t\t},\n\t\t});\n\t\tconst observedAtMs = now();\n\t\tvoid publishHealthEvent({\n\t\t\telapsedMs: observedAtMs - startedAtMs,\n\t\t\terrorCode: staleError.reason,\n\t\t\tguardOptions: options,\n\t\t\tobservedAtMs,\n\t\t\tresult: 'failed',\n\t\t});\n\t\tthrow staleError;\n\t} finally {\n\t\tif (timeoutHandle !== undefined) {\n\t\t\tclearTimeoutImpl(timeoutHandle);\n\t\t}\n\t}\n}\n","import path from 'node:path/posix';\n\nimport {\n\ttype AgentVmHealthEvent,\n\tcreateToolVmActiveUseHandle,\n\ttype EndToolVmActiveUseRequest,\n\ttype HeartbeatToolVmActiveUseResponse,\n\ttype StartToolVmActiveUseRequest,\n\ttype StartToolVmActiveUseResponse,\n\ttype ToolVmActiveUseCorrelation,\n\ttype ToolVmActiveUseHandle,\n\ttype ToolVmActiveUseOutcome,\n\ttype ToolVmSshFailureKind,\n\tisToolVmSshLease,\n} from '@agent-vm/gateway-interface';\n\nimport {\n\tControllerLeaseRequestError,\n\tcreateLeaseClient,\n\ttype LeaseClient,\n\ttype OpenClawRuntimeStatusReport,\n} from '../controller-lease-client.js';\nimport { fetchControllerWithPolicy } from '../controller-request-policy.js';\nimport {\n\tfindOpenClawGondolinSandboxMismatch,\n\tresolveOpenClawAgentIdFromSessionKey,\n\ttype OpenClawGondolinSandboxSnapshot,\n} from '../openclaw-gondolin-contract.js';\nimport { resolveOpenClawAgentWorkspaceSource } from './openclaw-agent-workspace-source.js';\nimport { assertOpenClawToolVmPathIntent } from './openclaw-tool-vm-path-mapping.js';\nimport {\n\ttype CachedAgentLeaseEntry,\n\ttype CreateBackendDependencies,\n\ttype OpenClawFsBridgeLeaseContext,\n\ttype OpenClawSandboxBackendHandle,\n} from './sandbox-backend-contract.js';\nimport { buildShellScriptWithArgs } from './sandbox-shell-script.js';\nimport {\n\trunToolVmSshOperationWithGuard,\n\tToolVmSshOperationStaleError,\n} from './tool-vm-ssh-operation-guard.js';\n\nfunction agentLeaseCacheKey(params: { readonly agentId: string; readonly zoneId: string }): string {\n\treturn [params.zoneId, params.agentId].join('\\0');\n}\n\ntype CachedAgentLeaseCompatibility = Pick<\n\tCachedAgentLeaseEntry,\n\t'agentWorkspaceDir' | 'leaseWorkMountDir' | 'profileId'\n>;\n\nfunction findCachedLeaseCompatibilityMismatch(params: {\n\treadonly cachedEntry: CachedAgentLeaseCompatibility;\n\treadonly requestedEntry: CachedAgentLeaseCompatibility;\n}): string | undefined {\n\tif (params.cachedEntry.agentWorkspaceDir !== params.requestedEntry.agentWorkspaceDir) {\n\t\treturn 'agentWorkspaceDir';\n\t}\n\tif (params.cachedEntry.leaseWorkMountDir !== params.requestedEntry.leaseWorkMountDir) {\n\t\treturn 'leaseWorkMountDir';\n\t}\n\tif (params.cachedEntry.profileId !== params.requestedEntry.profileId) {\n\t\treturn 'profileId';\n\t}\n\treturn undefined;\n}\n\nfunction assertCachedLeaseCompatible(params: {\n\treadonly agentId: string;\n\treadonly cachedEntry: CachedAgentLeaseCompatibility;\n\treadonly requestedEntry: CachedAgentLeaseCompatibility;\n\treadonly zoneId: string;\n}): void {\n\tconst mismatch = findCachedLeaseCompatibilityMismatch(params);\n\tif (mismatch === undefined) {\n\t\treturn;\n\t}\n\tthrow new Error(\n\t\t`Cannot reuse cached Tool VM lease for zone '${params.zoneId}' agent '${params.agentId}': ${mismatch} changed.`,\n\t);\n}\n\nfunction formatControllerLeaseRequestError(error: ControllerLeaseRequestError): string {\n\tconst responseBody =\n\t\terror.responseBody === undefined ? error.bodyText : JSON.stringify(error.responseBody);\n\treturn `${error.message}; response=${responseBody}`;\n}\n\nfunction formatUnknownError(error: unknown): string {\n\tif (error instanceof ControllerLeaseRequestError) {\n\t\treturn formatControllerLeaseRequestError(error);\n\t}\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction writeSandboxBackendLog(message: string): void {\n\tprocess.stderr.write(`[openclaw-agent-vm-plugin] ${message}\\n`);\n}\n\nfunction shouldRefreshCachedLease(error: unknown): boolean {\n\treturn isRefreshableLeaseError(error);\n}\n\nfunction isRefreshableLeaseError(error: unknown): boolean {\n\treturn (\n\t\terror instanceof ControllerLeaseRequestError && (error.status === 404 || error.status === 410)\n\t);\n}\n\nfunction isCleanupNotFound(error: unknown): boolean {\n\treturn error instanceof ControllerLeaseRequestError && error.status === 404;\n}\n\ninterface DisposableFinalizeToken {\n\tdispose(): Promise<void>;\n}\n\ninterface ActiveUseFinalizeToken {\n\treadonly activeUseHandle: ToolVmActiveUseHandle;\n\treadonly innerToken?: unknown;\n}\n\nfunction isDisposableFinalizeToken(value: unknown): value is DisposableFinalizeToken {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t'dispose' in value &&\n\t\ttypeof Reflect.get(value, 'dispose') === 'function'\n\t);\n}\n\nfunction isActiveUseFinalizeToken(value: unknown): value is ActiveUseFinalizeToken {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t'activeUseHandle' in value &&\n\t\ttypeof Reflect.get(value, 'activeUseHandle') === 'object'\n\t);\n}\n\nfunction activeUseOutcomeForFinalizeParams(finalizeParams: {\n\treadonly status: 'completed' | 'failed';\n\treadonly timedOut: boolean;\n}): ToolVmActiveUseOutcome {\n\treturn finalizeParams.timedOut\n\t\t? 'timed-out'\n\t\t: finalizeParams.status === 'completed'\n\t\t\t? 'completed'\n\t\t\t: 'failed';\n}\n\nasync function publishFinalizeToolVmSshHealthEvent(options: {\n\treadonly agentId: string;\n\treadonly leaseId: string;\n\treadonly publishHealthEvent: (event: AgentVmHealthEvent) => Promise<void>;\n\treadonly timedOut: boolean;\n\treadonly zoneId: string;\n}): Promise<void> {\n\tconst event = {\n\t\tagentId: options.agentId,\n\t\telapsedMs: 0,\n\t\t...(options.timedOut ? { errorCode: 'ssh-command-timed-out' } : {}),\n\t\tkind: 'tool-vm-ssh',\n\t\tleaseId: options.leaseId,\n\t\tobservedAtMs: Date.now(),\n\t\toperation: 'finalize',\n\t\tresult: options.timedOut ? 'failed' : 'ok',\n\t\tzoneId: options.zoneId,\n\t} satisfies AgentVmHealthEvent;\n\ttry {\n\t\tawait options.publishHealthEvent(event);\n\t} catch (error) {\n\t\twriteSandboxBackendLog(\n\t\t\t`tool-vm-ssh finalize health publish failed for zone '${options.zoneId}' lease '${options.leaseId}': ${formatUnknownError(error)}`,\n\t\t);\n\t}\n}\n\nfunction mergedAbortSignal(\n\tfirstSignal: AbortSignal | undefined,\n\tsecondSignal: AbortSignal,\n): AbortSignal {\n\tif (firstSignal === undefined) {\n\t\treturn secondSignal;\n\t}\n\treturn AbortSignal.any([firstSignal, secondSignal]);\n}\n\nfunction mergedAbortSignals(\n\tsignals: readonly (AbortSignal | undefined)[],\n): AbortSignal | undefined {\n\tconst presentSignals = signals.filter((signal): signal is AbortSignal => signal !== undefined);\n\tif (presentSignals.length === 0) {\n\t\treturn undefined;\n\t}\n\tif (presentSignals.length === 1) {\n\t\treturn presentSignals[0];\n\t}\n\treturn AbortSignal.any(presentSignals);\n}\n\nfunction resolveLeaseRequestAgentId(sessionKey: string): string {\n\treturn resolveOpenClawAgentIdFromSessionKey(sessionKey);\n}\n\nfunction defaultOpenClawStateDir(): string | undefined {\n\tconst explicitStateDir = process.env.OPENCLAW_STATE_DIR?.trim();\n\tif (explicitStateDir) {\n\t\treturn path.resolve(explicitStateDir);\n\t}\n\tconst homeDirectory = process.env.HOME?.trim();\n\treturn homeDirectory ? path.join(homeDirectory, '.openclaw', 'state') : undefined;\n}\n\nfunction defaultOpenClawWorkspaceDir(): string | undefined {\n\tconst homeDirectory = process.env.HOME?.trim();\n\tif (!homeDirectory) {\n\t\treturn undefined;\n\t}\n\tconst profile = process.env.OPENCLAW_PROFILE?.trim().toLowerCase();\n\treturn profile && profile !== 'default'\n\t\t? path.join(homeDirectory, '.openclaw', `workspace-${profile}`)\n\t\t: path.join(homeDirectory, '.openclaw', 'workspace');\n}\n\nfunction assertPluginLeaseContract(params: {\n\treadonly cfg: OpenClawGondolinSandboxSnapshot;\n}): void {\n\tconst mismatch = findOpenClawGondolinSandboxMismatch(params.cfg);\n\tif (mismatch) {\n\t\tthrow new Error(\n\t\t\t`OpenClaw Gondolin sandbox requires ${mismatch.key}=${mismatch.expectedValue}; received ${String(params.cfg[mismatch.key])}.`,\n\t\t);\n\t}\n}\n\nexport function createGondolinSandboxBackendFactory(\n\toptions: {\n\t\treadonly controllerUrl: string;\n\t\treadonly openClawDefaultWorkspaceDirProvider?: () => string | undefined;\n\t\treadonly openClawRuntimeStatusProvider?: () => OpenClawRuntimeStatusReport | undefined;\n\t\treadonly openClawRuntimeConfigProvider?: () => Record<string, unknown> | undefined;\n\t\treadonly openClawStateDirProvider?: () => string | undefined;\n\t\treadonly profileId?: string;\n\t\treadonly zoneId: string;\n\t},\n\tdependencies: CreateBackendDependencies,\n): (params: {\n\treadonly agentWorkspaceDir: string;\n\treadonly cfg: OpenClawGondolinSandboxSnapshot & {\n\t\treadonly docker?: {\n\t\t\treadonly env?: Record<string, string>;\n\t\t};\n\t};\n\t// OpenClaw SDK boundary input only. Agent-vm leases are keyed by agentId,\n\t// so this value is intentionally not read or forwarded to the controller.\n\treadonly scopeKey: string;\n\treadonly sessionKey: string;\n\treadonly workspaceDir: string;\n}) => Promise<OpenClawSandboxBackendHandle> {\n\tconst agentLeaseCache = new Map<string, CachedAgentLeaseEntry>();\n\tconst inFlightLeaseRequests = new Map<string, Promise<CachedAgentLeaseEntry>>();\n\n\treturn async (params) => {\n\t\tconst profileId = options.profileId ?? 'standard';\n\t\tconst agentId = resolveLeaseRequestAgentId(params.sessionKey);\n\t\tassertPluginLeaseContract({\n\t\t\tcfg: params.cfg,\n\t\t});\n\t\tconst defaultWorkspaceDir =\n\t\t\toptions.openClawDefaultWorkspaceDirProvider?.() ?? defaultOpenClawWorkspaceDir();\n\t\tconst equivalentAgentWorkspaceDirs =\n\t\t\tdefaultWorkspaceDir === undefined ? [] : [defaultWorkspaceDir];\n\t\tconst workspaceSource = resolveOpenClawAgentWorkspaceSource({\n\t\t\tagentId,\n\t\t\tdefaultWorkspaceDir,\n\t\t\topenClawConfig: options.openClawRuntimeConfigProvider?.(),\n\t\t\tparamsAgentWorkspaceDir: params.agentWorkspaceDir,\n\t\t\tstateDir: options.openClawStateDirProvider?.() ?? defaultOpenClawStateDir(),\n\t\t});\n\t\tconst pathIntent = assertOpenClawToolVmPathIntent({\n\t\t\tagentWorkspaceDir: workspaceSource.sourceDir,\n\t\t\tequivalentAgentWorkspaceDirs,\n\t\t\tinputPath: params.workspaceDir,\n\t\t});\n\t\tconst cacheKey = agentLeaseCacheKey({\n\t\t\tagentId,\n\t\t\tzoneId: options.zoneId,\n\t\t});\n\t\tconst requestedCacheEntry = {\n\t\t\tagentWorkspaceDir: workspaceSource.sourceDir,\n\t\t\tleaseWorkMountDir: pathIntent.leaseWorkMountDir,\n\t\t\tprofileId,\n\t\t} satisfies CachedAgentLeaseCompatibility;\n\t\tconst leaseClient =\n\t\t\tdependencies.createLeaseClient?.({\n\t\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\t}) ?? createLeaseClient({ controllerUrl: options.controllerUrl });\n\t\tconst publishHealthEvent = async (event: AgentVmHealthEvent): Promise<void> => {\n\t\t\tconst response = await fetchControllerWithPolicy({\n\t\t\t\tinput: `${options.controllerUrl.replace(/\\/+$/u, '')}/zones/${encodeURIComponent(options.zoneId)}/health-events`,\n\t\t\t\tinit: {\n\t\t\t\t\tbody: JSON.stringify(event),\n\t\t\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t},\n\t\t\t\toperation: 'health-event-publish',\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tawait response.text().catch(() => undefined);\n\t\t\t\tthrow new Error(`health event publish returned HTTP ${String(response.status)}`);\n\t\t\t}\n\t\t\tawait response.text().catch(() => undefined);\n\t\t};\n\t\tconst markLeaseStale = async (\n\t\t\tlease: CachedAgentLeaseEntry['lease'],\n\t\t\treason: ToolVmSshFailureKind,\n\t\t\terror: unknown,\n\t\t): Promise<void> => {\n\t\t\tagentLeaseCache.delete(cacheKey);\n\t\t\twriteSandboxBackendLog(\n\t\t\t\t`lease marked stale for zone '${options.zoneId}' agent '${agentId}' lease '${lease.leaseId}' reason '${reason}': ${formatUnknownError(error)}`,\n\t\t\t);\n\t\t\tawait leaseClient\n\t\t\t\t.releaseLease(lease.leaseId, { force: true })\n\t\t\t\t.catch((releaseError: unknown) => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`best-effort stale lease release failed for zone '${options.zoneId}' agent '${agentId}' lease '${lease.leaseId}': ${formatUnknownError(releaseError)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t};\n\t\tconst cachedEntry = agentLeaseCache.get(cacheKey);\n\t\tlet lease: CachedAgentLeaseEntry['lease'] | undefined;\n\t\tif (cachedEntry) {\n\t\t\tassertCachedLeaseCompatible({\n\t\t\t\tagentId,\n\t\t\t\tcachedEntry,\n\t\t\t\trequestedEntry: requestedCacheEntry,\n\t\t\t\tzoneId: options.zoneId,\n\t\t\t});\n\t\t\ttry {\n\t\t\t\tconst renewedLease = await leaseClient.renewLease(cachedEntry.lease.leaseId);\n\t\t\t\tawait runToolVmSshOperationWithGuard({\n\t\t\t\t\thealthEvent: {\n\t\t\t\t\t\tagentId,\n\t\t\t\t\t\tleaseId: renewedLease.leaseId,\n\t\t\t\t\t\toperation: 'probe',\n\t\t\t\t\t\tpublish: publishHealthEvent,\n\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t},\n\t\t\t\t\toperation: async (signal) =>\n\t\t\t\t\t\tawait dependencies.runRemoteShellScript({\n\t\t\t\t\t\t\tallowFailure: false,\n\t\t\t\t\t\t\tscript: 'true',\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t\tssh: renewedLease.ssh,\n\t\t\t\t\t\t}),\n\t\t\t\t\toperationName: 'cached-ssh-probe',\n\t\t\t\t\treport: () => {},\n\t\t\t\t\ttimeoutMs: 30_000,\n\t\t\t\t});\n\t\t\t\tlease = renewedLease;\n\t\t\t\tagentLeaseCache.set(cacheKey, { ...requestedCacheEntry, lease });\n\t\t\t} catch (error) {\n\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t`lease renew failed for zone '${options.zoneId}' agent '${agentId}' lease '${cachedEntry.lease.leaseId}': ${formatUnknownError(error)}`,\n\t\t\t\t);\n\t\t\t\tif (error instanceof ToolVmSshOperationStaleError) {\n\t\t\t\t\tawait markLeaseStale(cachedEntry.lease, error.reason, error);\n\t\t\t\t} else if (shouldRefreshCachedLease(error)) {\n\t\t\t\t\tagentLeaseCache.delete(cacheKey);\n\t\t\t\t} else {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (lease === undefined) {\n\t\t\tconst inFlightLeaseRequest = inFlightLeaseRequests.get(cacheKey);\n\t\t\tif (inFlightLeaseRequest !== undefined) {\n\t\t\t\tconst inFlightEntry = await inFlightLeaseRequest;\n\t\t\t\tassertCachedLeaseCompatible({\n\t\t\t\t\tagentId,\n\t\t\t\t\tcachedEntry: inFlightEntry,\n\t\t\t\t\trequestedEntry: requestedCacheEntry,\n\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t});\n\t\t\t\tlease = inFlightEntry.lease;\n\t\t\t} else {\n\t\t\t\t// OpenClaw SDK still names the selected sandbox path `workspaceDir`.\n\t\t\t\t// agent-vm's controller calls the selected host source `workMountDir`.\n\t\t\t\tconst leaseRequestPromise = (async (): Promise<CachedAgentLeaseEntry> => {\n\t\t\t\t\tconst runtimeStatus = options.openClawRuntimeStatusProvider?.();\n\t\t\t\t\tif (runtimeStatus && leaseClient.publishOpenClawRuntimeStatus) {\n\t\t\t\t\t\tawait leaseClient.publishOpenClawRuntimeStatus(runtimeStatus);\n\t\t\t\t\t}\n\t\t\t\t\tconst leaseResponse = await leaseClient.requestLease({\n\t\t\t\t\t\tagentId,\n\t\t\t\t\t\tagentWorkspaceDir: workspaceSource.sourceDir,\n\t\t\t\t\t\tprofileId,\n\t\t\t\t\t\tsessionKey: params.sessionKey,\n\t\t\t\t\t\tworkMountDir: pathIntent.leaseWorkMountDir,\n\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t});\n\t\t\t\t\tif (!isToolVmSshLease(leaseResponse)) {\n\t\t\t\t\t\tthrow new TypeError('Controller lease API returned an unexpected response.');\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\t...requestedCacheEntry,\n\t\t\t\t\t\tlease: leaseResponse,\n\t\t\t\t\t};\n\t\t\t\t})();\n\t\t\t\tinFlightLeaseRequests.set(cacheKey, leaseRequestPromise);\n\t\t\t\ttry {\n\t\t\t\t\tconst leaseEntry = await leaseRequestPromise;\n\t\t\t\t\tagentLeaseCache.set(cacheKey, leaseEntry);\n\t\t\t\t\tlease = leaseEntry.lease;\n\t\t\t\t} finally {\n\t\t\t\t\tif (inFlightLeaseRequests.get(cacheKey) === leaseRequestPromise) {\n\t\t\t\t\t\tinFlightLeaseRequests.delete(cacheKey);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tconst handle = createSandboxBackendHandle({\n\t\t\tcfg: params.cfg,\n\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\tcreateFsBridgeBuilder: dependencies.createFsBridgeBuilder,\n\t\t\teffectiveGuestCwd: pathIntent.effectiveGuestCwd,\n\t\t\tlease,\n\t\t\tleaseClient,\n\t\t\tmarkCachedLeaseStale: async (reason, error) => {\n\t\t\t\tawait markLeaseStale(lease, reason, error);\n\t\t\t},\n\t\t\tpublishHealthEvent,\n\t\t\trunRemoteShellScript: dependencies.runRemoteShellScript,\n\t\t\tbuildExecSpec: dependencies.buildExecSpec,\n\t\t\tsessionKey: params.sessionKey,\n\t\t\tzoneId: options.zoneId,\n\t\t});\n\t\treturn handle;\n\t};\n}\n\nfunction createSandboxBackendHandle(options: {\n\treadonly buildExecSpec: CreateBackendDependencies['buildExecSpec'];\n\treadonly cfg: {\n\t\treadonly docker?: {\n\t\t\treadonly env?: Record<string, string>;\n\t\t};\n\t};\n\treadonly controllerUrl: string;\n\treadonly createFsBridgeBuilder?: CreateBackendDependencies['createFsBridgeBuilder'];\n\treadonly effectiveGuestCwd: string;\n\treadonly lease: CachedAgentLeaseEntry['lease'];\n\treadonly leaseClient: LeaseClient;\n\treadonly markCachedLeaseStale: (reason: ToolVmSshFailureKind, error: unknown) => Promise<void>;\n\treadonly publishHealthEvent: (event: AgentVmHealthEvent) => Promise<void>;\n\treadonly runRemoteShellScript: CreateBackendDependencies['runRemoteShellScript'];\n\treadonly sessionKey: string;\n\treadonly zoneId: string;\n}): OpenClawSandboxBackendHandle {\n\tconst createActiveUseHandle = async (\n\t\tcorrelation: ToolVmActiveUseCorrelation,\n\t): Promise<ToolVmActiveUseHandle> => {\n\t\ttry {\n\t\t\treturn await createToolVmActiveUseHandle({\n\t\t\t\tcorrelation,\n\t\t\t\tendActiveUse: async (useId: string, request: EndToolVmActiveUseRequest): Promise<void> => {\n\t\t\t\t\tawait options.leaseClient.endActiveUse(options.lease.leaseId, useId, request);\n\t\t\t\t},\n\t\t\t\theartbeatActiveUse: async (useId, request): Promise<HeartbeatToolVmActiveUseResponse> =>\n\t\t\t\t\tawait options.leaseClient.heartbeatActiveUse(options.lease.leaseId, useId, request),\n\t\t\t\tisEndErrorTolerable: isCleanupNotFound,\n\t\t\t\tisHeartbeatErrorRefreshable: isRefreshableLeaseError,\n\t\t\t\tlogEndFailure: (error: unknown): void => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`active-use cleanup ignored for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(error)}`,\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t\tlogHeartbeatFailure: (error: unknown): void => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`active-use heartbeat failed for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(error)}`,\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t\tonRefreshableHeartbeatFailure: async (error): Promise<void> => {\n\t\t\t\t\tawait options.markCachedLeaseStale('active-use-refreshable-failure', error);\n\t\t\t\t},\n\t\t\t\tstartActiveUse: async (\n\t\t\t\t\trequest: StartToolVmActiveUseRequest,\n\t\t\t\t): Promise<StartToolVmActiveUseResponse> =>\n\t\t\t\t\tawait options.leaseClient.startActiveUse(options.lease.leaseId, request),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (isRefreshableLeaseError(error)) {\n\t\t\t\tawait options.markCachedLeaseStale('active-use-refreshable-failure', error);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tconst runWithActiveUse = async <TResult>(\n\t\tcorrelation: ToolVmActiveUseCorrelation,\n\t\tfn: (activeUseHandle: ToolVmActiveUseHandle) => Promise<TResult>,\n\t): Promise<TResult> => {\n\t\tconst activeUseHandle = await createActiveUseHandle(correlation);\n\t\ttry {\n\t\t\tconst result = await fn(activeUseHandle);\n\t\t\tawait activeUseHandle.dispose('completed');\n\t\t\treturn result;\n\t\t} catch (error) {\n\t\t\tawait activeUseHandle\n\t\t\t\t.dispose(\n\t\t\t\t\terror instanceof ToolVmSshOperationStaleError && error.reason === 'ssh-command-timed-out'\n\t\t\t\t\t\t? 'timed-out'\n\t\t\t\t\t\t: 'failed',\n\t\t\t\t)\n\t\t\t\t.catch((cleanupError: unknown) => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`failed to end active use after operation failure for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(cleanupError)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\tif (error instanceof ToolVmSshOperationStaleError) {\n\t\t\t\tawait options.markCachedLeaseStale(error.reason, error);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tconst boundRunRemoteShellScript: OpenClawFsBridgeLeaseContext['runRemoteShellScript'] = async (\n\t\tshellParams,\n\t) =>\n\t\tawait runWithActiveUse(\n\t\t\t{\n\t\t\t\tsessionKey: options.sessionKey,\n\t\t\t\ttoolName: 'fs-bridge',\n\t\t\t},\n\t\t\tasync (activeUseHandle) =>\n\t\t\t\tawait runToolVmSshOperationWithGuard({\n\t\t\t\t\thealthEvent: {\n\t\t\t\t\t\tagentId: options.lease.agentId,\n\t\t\t\t\t\tleaseId: options.lease.leaseId,\n\t\t\t\t\t\toperation: 'file-bridge',\n\t\t\t\t\t\tpublish: options.publishHealthEvent,\n\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t},\n\t\t\t\t\toperation: async (signal) => {\n\t\t\t\t\t\tconst operationSignal = mergedAbortSignals([\n\t\t\t\t\t\t\tshellParams.signal,\n\t\t\t\t\t\t\tactiveUseHandle.signal,\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t]);\n\t\t\t\t\t\treturn await options.runRemoteShellScript({\n\t\t\t\t\t\t\t...(shellParams.allowFailure !== undefined\n\t\t\t\t\t\t\t\t? { allowFailure: shellParams.allowFailure }\n\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\tscript: buildShellScriptWithArgs(shellParams.script, shellParams.args),\n\t\t\t\t\t\t\t...(operationSignal === undefined ? {} : { signal: operationSignal }),\n\t\t\t\t\t\t\tssh: options.lease.ssh,\n\t\t\t\t\t\t\t...(shellParams.stdin !== undefined ? { stdin: shellParams.stdin } : {}),\n\t\t\t\t\t\t});\n\t\t\t\t\t},\n\t\t\t\t\toperationName: 'fs-bridge',\n\t\t\t\t\treport: (report) => {\n\t\t\t\t\t\tactiveUseHandle.report(report);\n\t\t\t\t\t},\n\t\t\t\t\ttimeoutMs: 30_000,\n\t\t\t\t}),\n\t\t);\n\n\tconst disposeInnerFinalizeToken = async (token: unknown): Promise<void> => {\n\t\tif (isDisposableFinalizeToken(token)) {\n\t\t\tawait token.dispose();\n\t\t}\n\t};\n\n\tconst endActiveUseFinalizeToken = async (\n\t\ttoken: ActiveUseFinalizeToken,\n\t\toutcome: ToolVmActiveUseOutcome,\n\t): Promise<void> => {\n\t\tlet innerError: unknown;\n\t\ttry {\n\t\t\tawait disposeInnerFinalizeToken(token.innerToken);\n\t\t} catch (error) {\n\t\t\tinnerError = error;\n\t\t}\n\t\tlet activeUseError: unknown;\n\t\ttry {\n\t\t\tawait token.activeUseHandle.dispose(outcome);\n\t\t} catch (error) {\n\t\t\tactiveUseError = error;\n\t\t}\n\t\tif (innerError) {\n\t\t\tthrow innerError;\n\t\t}\n\t\tif (activeUseError) {\n\t\t\tthrow activeUseError;\n\t\t}\n\t};\n\n\tconst createFsBridge = options.createFsBridgeBuilder?.({\n\t\tremoteAgentWorkspaceDir: options.lease.workdir,\n\t\tremoteWorkspaceDir: options.effectiveGuestCwd,\n\t\trunRemoteShellScript: boundRunRemoteShellScript,\n\t});\n\n\treturn {\n\t\t...(createFsBridge ? { createFsBridge } : {}),\n\t\t...(options.cfg.docker?.env ? { env: options.cfg.docker.env } : {}),\n\t\tconfigLabel: `${options.controllerUrl} (${options.zoneId})`,\n\t\tconfigLabelKind: 'VM',\n\t\tid: 'gondolin',\n\t\truntimeId: options.lease.leaseId,\n\t\truntimeLabel: options.lease.leaseId,\n\t\tworkdir: options.effectiveGuestCwd,\n\t\tbuildExecSpec: async (execParams) => {\n\t\t\tconst activeUseHandle = await createActiveUseHandle({\n\t\t\t\tsessionKey: options.sessionKey,\n\t\t\t\ttoolName: 'shell',\n\t\t\t});\n\t\t\ttry {\n\t\t\t\tconst execSpec = await options.buildExecSpec({\n\t\t\t\t\tcommand: execParams.command,\n\t\t\t\t\tenv: execParams.env,\n\t\t\t\t\tssh: options.lease.ssh,\n\t\t\t\t\tusePty: execParams.usePty,\n\t\t\t\t\tworkdir: execParams.workdir ?? options.effectiveGuestCwd,\n\t\t\t\t});\n\t\t\t\treturn {\n\t\t\t\t\t...execSpec,\n\t\t\t\t\tfinalizeToken: {\n\t\t\t\t\t\tactiveUseHandle,\n\t\t\t\t\t\t...(execSpec.finalizeToken !== undefined ? { innerToken: execSpec.finalizeToken } : {}),\n\t\t\t\t\t} satisfies ActiveUseFinalizeToken,\n\t\t\t\t};\n\t\t\t} catch (error) {\n\t\t\t\tawait activeUseHandle.dispose('failed').catch((cleanupError: unknown) => {\n\t\t\t\t\twriteSandboxBackendLog(\n\t\t\t\t\t\t`failed to end active use after buildExecSpec failure for zone '${options.zoneId}' lease '${options.lease.leaseId}': ${formatUnknownError(cleanupError)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t\tfinalizeExec: async (finalizeParams) => {\n\t\t\tif (isActiveUseFinalizeToken(finalizeParams.token)) {\n\t\t\t\tif (finalizeParams.timedOut) {\n\t\t\t\t\tfinalizeParams.token.activeUseHandle.report({\n\t\t\t\t\t\tobservedAtMs: Date.now(),\n\t\t\t\t\t\tphase: 'failed',\n\t\t\t\t\t\tssh: {\n\t\t\t\t\t\t\tfailure: {\n\t\t\t\t\t\t\t\tkind: 'ssh-command-timed-out',\n\t\t\t\t\t\t\t\tmessage: 'exec command timed out.',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tawait endActiveUseFinalizeToken(\n\t\t\t\t\tfinalizeParams.token,\n\t\t\t\t\tactiveUseOutcomeForFinalizeParams(finalizeParams),\n\t\t\t\t);\n\t\t\t\tvoid publishFinalizeToolVmSshHealthEvent({\n\t\t\t\t\tagentId: options.lease.agentId,\n\t\t\t\t\tleaseId: options.lease.leaseId,\n\t\t\t\t\tpublishHealthEvent: options.publishHealthEvent,\n\t\t\t\t\ttimedOut: finalizeParams.timedOut,\n\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t});\n\t\t\t\tif (finalizeParams.timedOut) {\n\t\t\t\t\tawait options.markCachedLeaseStale('ssh-command-timed-out', undefined);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait disposeInnerFinalizeToken(finalizeParams.token);\n\t\t},\n\t\trunShellCommand: async (commandParams) =>\n\t\t\tawait runWithActiveUse(\n\t\t\t\t{\n\t\t\t\t\tsessionKey: options.sessionKey,\n\t\t\t\t\ttoolName: 'runShellCommand',\n\t\t\t\t},\n\t\t\t\tasync (activeUseHandle) =>\n\t\t\t\t\tawait runToolVmSshOperationWithGuard({\n\t\t\t\t\t\thealthEvent: {\n\t\t\t\t\t\t\tagentId: options.lease.agentId,\n\t\t\t\t\t\t\tleaseId: options.lease.leaseId,\n\t\t\t\t\t\t\toperation: 'command',\n\t\t\t\t\t\t\tpublish: options.publishHealthEvent,\n\t\t\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t\t\t},\n\t\t\t\t\t\toperation: async (signal) =>\n\t\t\t\t\t\t\tawait options.runRemoteShellScript({\n\t\t\t\t\t\t\t\tscript: commandParams.script,\n\t\t\t\t\t\t\t\tsignal: mergedAbortSignal(activeUseHandle.signal, signal),\n\t\t\t\t\t\t\t\tssh: options.lease.ssh,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\toperationName: 'runShellCommand',\n\t\t\t\t\t\treport: (report) => {\n\t\t\t\t\t\t\tactiveUseHandle.report(report);\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttimeoutMs: 30_000,\n\t\t\t\t\t}),\n\t\t\t),\n\t} satisfies OpenClawSandboxBackendHandle;\n}\n","import { ControllerLeaseRequestError, createLeaseClient } from '../controller-lease-client.js';\nimport type { CreateBackendDependencies } from './sandbox-backend-contract.js';\n\nexport function createGondolinSandboxBackendManager(\n\toptions: {\n\t\treadonly controllerUrl: string;\n\t\treadonly zoneId: string;\n\t},\n\tdependencies: CreateBackendDependencies,\n): {\n\tdescribeRuntime: (params: {\n\t\treadonly entry: { readonly containerName: string };\n\t}) => Promise<{ readonly configLabelMatch: boolean; readonly running: boolean }>;\n\tremoveRuntime: (params: { readonly entry: { readonly containerName: string } }) => Promise<void>;\n} {\n\treturn {\n\t\tdescribeRuntime: async (params) => {\n\t\t\tconst leaseClient =\n\t\t\t\tdependencies.createLeaseClient?.({\n\t\t\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\t\t}) ?? createLeaseClient({ controllerUrl: options.controllerUrl });\n\t\t\ttry {\n\t\t\t\tconst leaseStatus = await leaseClient.peekLease(params.entry.containerName);\n\t\t\t\treturn { configLabelMatch: true, running: leaseStatus !== null };\n\t\t\t} catch (error) {\n\t\t\t\tif (!(error instanceof ControllerLeaseRequestError) || error.status !== 404) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\treturn { configLabelMatch: false, running: false };\n\t\t\t}\n\t\t},\n\t\tremoveRuntime: async (params) => {\n\t\t\tconst leaseClient =\n\t\t\t\tdependencies.createLeaseClient?.({\n\t\t\t\t\tcontrollerUrl: options.controllerUrl,\n\t\t\t\t}) ?? createLeaseClient({ controllerUrl: options.controllerUrl });\n\t\t\tawait leaseClient.releaseLease(params.entry.containerName, { force: true });\n\t\t},\n\t};\n}\n","export interface ResolvedGondolinPluginConfig {\n\treadonly controllerUrl: string;\n\treadonly gatewayControlLinkMonitor?: {\n\t\treadonly baseIntervalMs: number;\n\t\treadonly enabled: boolean;\n\t\treadonly maxIntervalMs: number;\n\t};\n\treadonly profileId?: string;\n\treadonly zoneGitToken?: string;\n\treadonly zoneGitTokenEnv?: string;\n\treadonly zoneId: string;\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function resolveGondolinPluginConfig(\n\tconfig: Record<string, unknown>,\n): ResolvedGondolinPluginConfig {\n\tif (typeof config.controllerUrl !== 'string' || typeof config.zoneId !== 'string') {\n\t\tthrow new Error('Gondolin plugin config requires controllerUrl and zoneId.');\n\t}\n\tconst rawGatewayControlLinkMonitor = config.gatewayControlLinkMonitor;\n\tconst gatewayControlLinkMonitor = isObjectRecord(rawGatewayControlLinkMonitor)\n\t\t? {\n\t\t\t\tbaseIntervalMs:\n\t\t\t\t\ttypeof rawGatewayControlLinkMonitor.baseIntervalMs === 'number'\n\t\t\t\t\t\t? rawGatewayControlLinkMonitor.baseIntervalMs\n\t\t\t\t\t\t: 10_000,\n\t\t\t\tenabled:\n\t\t\t\t\ttypeof rawGatewayControlLinkMonitor.enabled === 'boolean'\n\t\t\t\t\t\t? rawGatewayControlLinkMonitor.enabled\n\t\t\t\t\t\t: true,\n\t\t\t\tmaxIntervalMs:\n\t\t\t\t\ttypeof rawGatewayControlLinkMonitor.maxIntervalMs === 'number'\n\t\t\t\t\t\t? rawGatewayControlLinkMonitor.maxIntervalMs\n\t\t\t\t\t\t: 120_000,\n\t\t\t}\n\t\t: undefined;\n\n\treturn {\n\t\tcontrollerUrl: config.controllerUrl,\n\t\t...(gatewayControlLinkMonitor ? { gatewayControlLinkMonitor } : {}),\n\t\t...(typeof config.profileId === 'string' ? { profileId: config.profileId } : {}),\n\t\t...(typeof config.zoneGitToken === 'string' ? { zoneGitToken: config.zoneGitToken } : {}),\n\t\t...(typeof config.zoneGitTokenEnv === 'string'\n\t\t\t? { zoneGitTokenEnv: config.zoneGitTokenEnv }\n\t\t\t: {}),\n\t\tzoneId: config.zoneId,\n\t};\n}\n","import { gatewayControlLinkHealthPins, type AgentVmHealthEvent } from '@agent-vm/gateway-interface';\n\nimport {\n\tControllerRequestPolicyTransportError,\n\tfetchControllerWithPolicy,\n} from './controller-request-policy.js';\n\nexport interface GatewayControlLinkMonitor {\n\tconsecutiveFailureCount(): number;\n\tnoteFailureForTest(): void;\n\tstart(): void;\n\tstop(): void;\n\ttick(): Promise<void>;\n}\n\nexport interface CreateGatewayControlLinkMonitorOptions {\n\treadonly baseIntervalMs: number;\n\treadonly clearTimeoutImpl?: (timer: NodeJS.Timeout) => void;\n\treadonly controllerUrl: string;\n\treadonly fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\treadonly maxIntervalMs: number;\n\treadonly now: () => number;\n\treadonly setTimeoutImpl?: (\n\t\tcallback: () => void | Promise<void>,\n\t\tdelayMs: number,\n\t) => NodeJS.Timeout;\n\treadonly writeLog?: (message: string) => void;\n\treadonly zoneId: string;\n}\n\nfunction defaultWriteLog(message: string): void {\n\tprocess.stderr.write(`[gateway-control-link-monitor] ${message}\\n`);\n}\n\nfunction joinUrl(baseUrl: string, path: string): string {\n\treturn `${baseUrl.replace(/\\/+$/, '')}${path}`;\n}\n\nfunction nextIntervalMs(options: {\n\treadonly baseIntervalMs: number;\n\treadonly consecutiveFailureCount: number;\n\treadonly maxIntervalMs: number;\n}): number {\n\tconst multiplier = 2 ** Math.min(options.consecutiveFailureCount, 8);\n\treturn Math.min(options.maxIntervalMs, options.baseIntervalMs * multiplier);\n}\n\nexport function createGatewayControlLinkMonitor(\n\toptions: CreateGatewayControlLinkMonitorOptions,\n): GatewayControlLinkMonitor {\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\tconst setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;\n\tconst clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;\n\tconst writeLog = options.writeLog ?? defaultWriteLog;\n\tlet consecutiveFailureCount = 0;\n\tlet stopped = true;\n\tlet timer: NodeJS.Timeout | undefined;\n\n\tconst publish = async (event: AgentVmHealthEvent): Promise<void> => {\n\t\tconst response = await fetchControllerWithPolicy({\n\t\t\tfetchImpl,\n\t\t\tinput: joinUrl(\n\t\t\t\toptions.controllerUrl,\n\t\t\t\t`/zones/${encodeURIComponent(options.zoneId)}/health-events`,\n\t\t\t),\n\t\t\tinit: {\n\t\t\t\tbody: JSON.stringify(event),\n\t\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\t\tmethod: 'POST',\n\t\t\t},\n\t\t\toperation: 'health-event-publish',\n\t\t});\n\t\tif (!response.ok) {\n\t\t\tawait response.text().catch(() => undefined);\n\t\t\tthrow new Error(`health event publish returned HTTP ${String(response.status)}`);\n\t\t}\n\t\tawait response.text().catch(() => undefined);\n\t};\n\n\tconst scheduleNext = (): void => {\n\t\tif (stopped) {\n\t\t\treturn;\n\t\t}\n\t\tif (timer) {\n\t\t\treturn;\n\t\t}\n\t\ttimer = setTimeoutImpl(\n\t\t\t() => {\n\t\t\t\ttimer = undefined;\n\t\t\t\tvoid tick().finally(scheduleNext);\n\t\t\t},\n\t\t\tnextIntervalMs({\n\t\t\t\tbaseIntervalMs: options.baseIntervalMs,\n\t\t\t\tconsecutiveFailureCount,\n\t\t\t\tmaxIntervalMs: options.maxIntervalMs,\n\t\t\t}),\n\t\t);\n\t\ttimer.unref?.();\n\t};\n\n\tconst tick = async (): Promise<void> => {\n\t\tconst startedAtMs = options.now();\n\t\tlet event: AgentVmHealthEvent;\n\t\ttry {\n\t\t\tconst response = await fetchControllerWithPolicy({\n\t\t\t\tfetchImpl,\n\t\t\t\tinput: joinUrl(options.controllerUrl, gatewayControlLinkHealthPins.path),\n\t\t\t\tinit: { method: 'GET' },\n\t\t\t\toperation: 'controller-health',\n\t\t\t});\n\t\t\tconst ok = response.ok;\n\t\t\tawait response.text().catch(() => undefined);\n\t\t\tconsecutiveFailureCount = ok ? 0 : consecutiveFailureCount + 1;\n\t\t\tevent = {\n\t\t\t\tcontrollerHost: gatewayControlLinkHealthPins.controllerHost,\n\t\t\t\tcontrollerPort: gatewayControlLinkHealthPins.controllerPort,\n\t\t\t\telapsedMs: options.now() - startedAtMs,\n\t\t\t\tkind: 'gateway-control-link',\n\t\t\t\tobservedAtMs: options.now(),\n\t\t\t\toperation: gatewayControlLinkHealthPins.operation,\n\t\t\t\tpath: gatewayControlLinkHealthPins.path,\n\t\t\t\tresult: ok ? 'ok' : 'failed',\n\t\t\t\tzoneId: options.zoneId,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconsecutiveFailureCount += 1;\n\t\t\tevent = {\n\t\t\t\tcontrollerHost: gatewayControlLinkHealthPins.controllerHost,\n\t\t\t\tcontrollerPort: gatewayControlLinkHealthPins.controllerPort,\n\t\t\t\telapsedMs: options.now() - startedAtMs,\n\t\t\t\tkind: 'gateway-control-link',\n\t\t\t\tobservedAtMs: options.now(),\n\t\t\t\toperation: gatewayControlLinkHealthPins.operation,\n\t\t\t\tpath: gatewayControlLinkHealthPins.path,\n\t\t\t\tresult:\n\t\t\t\t\terror instanceof ControllerRequestPolicyTransportError &&\n\t\t\t\t\terror.code === 'controller-request-timeout'\n\t\t\t\t\t\t? 'timeout'\n\t\t\t\t\t\t: 'failed',\n\t\t\t\tzoneId: options.zoneId,\n\t\t\t};\n\t\t\twriteLog(\n\t\t\t\t`gateway-control-link fetch failed operation=controller-health elapsedMs=${String(event.elapsedMs)} errorCode=${error instanceof ControllerRequestPolicyTransportError ? error.code : 'controller-request-failed'}`,\n\t\t\t);\n\t\t}\n\t\ttry {\n\t\t\t// The agent-vm controller cannot observe this successful gateway-local\n\t\t\t// fetch unless the gateway publishes the health event back over the\n\t\t\t// same control link.\n\t\t\tawait publish(event);\n\t\t} catch (error) {\n\t\t\twriteLog(\n\t\t\t\t`gateway-control-link publish failed operation=health-event-publish elapsedMs=${String(event.elapsedMs)} errorCode=${error instanceof ControllerRequestPolicyTransportError ? error.code : 'health-event-publish-failed'} message=${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\t};\n\n\treturn {\n\t\tconsecutiveFailureCount: () => consecutiveFailureCount,\n\t\tnoteFailureForTest: () => {\n\t\t\tconsecutiveFailureCount += 1;\n\t\t},\n\t\tstart: () => {\n\t\t\tstopped = false;\n\t\t\tscheduleNext();\n\t\t},\n\t\tstop: () => {\n\t\t\tstopped = true;\n\t\t\tif (!timer) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tclearTimeoutImpl(timer);\n\t\t\ttimer = undefined;\n\t\t},\n\t\ttick,\n\t};\n}\n","import type { SshHelpers, SshSandboxSession } from './openclaw-sandbox-sdk-contract.js';\nimport type {\n\tCreateBackendDependencies,\n\tOpenClawFsBridgeLeaseContext,\n\tOpenClawSandboxFsBridge,\n} from './sandbox-backend-factory.js';\n\nexport const OPENCLAW_SSH_SESSION_SCRATCH_ROOT = '/work';\n\nexport function createBackendDeps(ssh: SshHelpers): {\n\treadonly buildExecSpec: CreateBackendDependencies['buildExecSpec'];\n\treadonly createFsBridgeBuilder: (\n\t\tleaseContext: OpenClawFsBridgeLeaseContext,\n\t) => (params: { readonly sandbox: unknown }) => OpenClawSandboxFsBridge;\n\treadonly runRemoteShellScript: CreateBackendDependencies['runRemoteShellScript'];\n} {\n\treturn {\n\t\tbuildExecSpec: async ({ command, env, ssh: sshCreds, usePty, workdir }) => {\n\t\t\tconst session = await ssh.createSshSandboxSessionFromSettings({\n\t\t\t\tcommand: 'ssh',\n\t\t\t\tidentityData: sshCreds.identityPem,\n\t\t\t\tstrictHostKeyChecking: false,\n\t\t\t\ttarget: `${sshCreds.user}@${sshCreds.host}:${sshCreds.port}`,\n\t\t\t\tupdateHostKeys: false,\n\t\t\t\tworkspaceRoot: OPENCLAW_SSH_SESSION_SCRATCH_ROOT,\n\t\t\t});\n\t\t\tconst disposeSshSandboxSession = ssh.disposeSshSandboxSession;\n\t\t\treturn {\n\t\t\t\targv: ssh.buildSshSandboxArgv({\n\t\t\t\t\tremoteCommand: ssh.buildExecRemoteCommand({\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t\tenv,\n\t\t\t\t\t\tworkdir,\n\t\t\t\t\t}),\n\t\t\t\t\tsession,\n\t\t\t\t\ttty: usePty,\n\t\t\t\t}),\n\t\t\t\tenv: ssh.sanitizeEnvVars(process.env).allowed,\n\t\t\t\tfinalizeToken: {\n\t\t\t\t\tdispose: async (): Promise<void> => {\n\t\t\t\t\t\tif (disposeSshSandboxSession) {\n\t\t\t\t\t\t\tawait disposeSshSandboxSession(session);\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\tsession,\n\t\t\t\t},\n\t\t\t\tstdinMode: 'pipe-open' as const,\n\t\t\t};\n\t\t},\n\t\tcreateFsBridgeBuilder:\n\t\t\t(leaseContext: OpenClawFsBridgeLeaseContext) =>\n\t\t\t(params: { readonly sandbox: unknown }): OpenClawSandboxFsBridge =>\n\t\t\t\tssh.createRemoteShellSandboxFsBridge({\n\t\t\t\t\tsandbox: params.sandbox,\n\t\t\t\t\truntime: {\n\t\t\t\t\t\tremoteAgentWorkspaceDir: leaseContext.remoteAgentWorkspaceDir,\n\t\t\t\t\t\tremoteWorkspaceDir: leaseContext.remoteWorkspaceDir,\n\t\t\t\t\t\trunRemoteShellScript: leaseContext.runRemoteShellScript,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\trunRemoteShellScript: async ({ allowFailure, script, signal, ssh: sshCreds, stdin }) => {\n\t\t\tconst session = await ssh.createSshSandboxSessionFromSettings({\n\t\t\t\tcommand: 'ssh',\n\t\t\t\tidentityData: sshCreds.identityPem,\n\t\t\t\tstrictHostKeyChecking: false,\n\t\t\t\ttarget: `${sshCreds.user}@${sshCreds.host}:${sshCreds.port}`,\n\t\t\t\tupdateHostKeys: false,\n\t\t\t\tworkspaceRoot: OPENCLAW_SSH_SESSION_SCRATCH_ROOT,\n\t\t\t});\n\t\t\treturn await ssh.runSshSandboxCommand({\n\t\t\t\t...(allowFailure !== undefined ? { allowFailure } : {}),\n\t\t\t\tremoteCommand: ssh.buildRemoteCommand(['/bin/sh', '-c', script, 'gondolin-sandbox-fs']),\n\t\t\t\tsession,\n\t\t\t\t...(signal !== undefined ? { signal } : {}),\n\t\t\t\t...(stdin !== undefined ? { stdin } : {}),\n\t\t\t});\n\t\t},\n\t};\n}\n\nexport type { SshHelpers, SshSandboxSession };\n","import {\n\teffectiveOpenClawGondolinSandboxValue,\n\tformatOpenClawGondolinRequirementFieldPath,\n\tformatOpenClawGondolinRequirementFindingId,\n\tformatOpenClawGondolinRequirementHint,\n\tOPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS,\n\ttype OpenClawGondolinAgentConfig,\n} from './openclaw-gondolin-contract.js';\n\ninterface OpenClawRuntimeConfig {\n\treadonly [key: string]: unknown;\n\treadonly agents?: {\n\t\treadonly defaults?: OpenClawGondolinAgentConfig;\n\t\treadonly list?: readonly unknown[];\n\t};\n}\n\nexport interface OpenClawRuntimeRequirementFinding {\n\treadonly hint: string;\n\treadonly id: string;\n\treadonly ok: boolean;\n}\n\nexport interface OpenClawRuntimeStatusReport {\n\treadonly findings: readonly OpenClawRuntimeRequirementFinding[];\n\treadonly pluginId: 'gondolin';\n\treadonly zoneId: string;\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction readAgentConfigEntries(config: OpenClawRuntimeConfig): readonly {\n\treadonly config: OpenClawGondolinAgentConfig;\n\treadonly label: string;\n}[] {\n\tconst defaultConfig = config.agents?.defaults ?? {};\n\tconst agentConfigs = (config.agents?.list ?? [])\n\t\t.filter(isObjectRecord)\n\t\t.map((agentConfig, agentIndex) => ({\n\t\t\tconfig: agentConfig,\n\t\t\tlabel:\n\t\t\t\ttypeof agentConfig.id === 'string'\n\t\t\t\t\t? `agent-${agentConfig.id}`\n\t\t\t\t\t: `agent-${String(agentIndex)}`,\n\t\t}));\n\treturn [{ config: defaultConfig, label: 'defaults' }, ...agentConfigs];\n}\n\nfunction effectiveWorkspace(\n\tdefaults: OpenClawGondolinAgentConfig,\n\tagentConfig: OpenClawGondolinAgentConfig,\n): unknown {\n\treturn agentConfig.workspace ?? defaults.workspace;\n}\n\nfunction requirementFinding(options: {\n\treadonly actualValue: unknown;\n\treadonly expectedValue: string;\n\treadonly fieldPath: string;\n\treadonly label: string;\n\treadonly zoneId: string;\n}): OpenClawRuntimeRequirementFinding {\n\tconst ok = options.actualValue === options.expectedValue;\n\treturn {\n\t\tid: formatOpenClawGondolinRequirementFindingId({\n\t\t\tfieldPath: options.fieldPath,\n\t\t\tlabel: options.label,\n\t\t\tzoneId: options.zoneId,\n\t\t}),\n\t\tok,\n\t\thint: formatOpenClawGondolinRequirementHint({\n\t\t\texpectedValue: options.expectedValue,\n\t\t\tfieldPath: options.fieldPath,\n\t\t\tok,\n\t\t}),\n\t};\n}\n\nexport function buildOpenClawRuntimeStatusReport(options: {\n\treadonly config: Record<string, unknown>;\n\treadonly zoneId: string;\n}): OpenClawRuntimeStatusReport {\n\tconst config: OpenClawRuntimeConfig = options.config;\n\tconst defaults = config.agents?.defaults ?? {};\n\treturn {\n\t\tpluginId: 'gondolin',\n\t\tzoneId: options.zoneId,\n\t\tfindings: readAgentConfigEntries(config).flatMap(({ config: agentConfig, label }) => {\n\t\t\tconst workspace = effectiveWorkspace(defaults, agentConfig);\n\t\t\tconst requirementFindings = OPENCLAW_GONDOLIN_SANDBOX_REQUIREMENTS.map((requirement) =>\n\t\t\t\trequirementFinding({\n\t\t\t\t\tactualValue: effectiveOpenClawGondolinSandboxValue(\n\t\t\t\t\t\tdefaults,\n\t\t\t\t\t\tagentConfig,\n\t\t\t\t\t\trequirement.key,\n\t\t\t\t\t),\n\t\t\t\t\texpectedValue: requirement.expectedValue,\n\t\t\t\t\tfieldPath: formatOpenClawGondolinRequirementFieldPath(label, requirement.key),\n\t\t\t\t\tlabel,\n\t\t\t\t\tzoneId: options.zoneId,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst workspaceFinding = {\n\t\t\t\tid: `openclaw-tool-vm-workspace-${options.zoneId}-${label}`,\n\t\t\t\tok: workspace !== '/zone',\n\t\t\t\thint:\n\t\t\t\t\tworkspace === '/zone'\n\t\t\t\t\t\t? 'Use /zone/agents/default or per-agent workspaces; keep /zone for shared zone files.'\n\t\t\t\t\t\t: typeof workspace === 'string'\n\t\t\t\t\t\t\t? workspace\n\t\t\t\t\t\t\t: 'agents workspace is unset',\n\t\t\t} satisfies OpenClawRuntimeRequirementFinding;\n\t\t\treturn requirementFindings.concat(workspaceFinding);\n\t\t}),\n\t};\n}\n","export interface SshSandboxSession {\n\treadonly command: string;\n\treadonly configPath: string;\n\treadonly host: string;\n}\n\nexport interface SshHelpers {\n\treadonly buildExecRemoteCommand: (params: {\n\t\treadonly command: string;\n\t\treadonly env: Record<string, string>;\n\t\treadonly workdir?: string;\n\t}) => string;\n\treadonly buildRemoteCommand: (argv: readonly string[]) => string;\n\treadonly buildSshSandboxArgv: (params: {\n\t\treadonly remoteCommand: string;\n\t\treadonly session: SshSandboxSession;\n\t\treadonly tty?: boolean;\n\t}) => string[];\n\treadonly createRemoteShellSandboxFsBridge: (params: {\n\t\treadonly runtime: {\n\t\t\treadonly remoteAgentWorkspaceDir: string;\n\t\t\treadonly remoteWorkspaceDir: string;\n\t\t\treadonly runRemoteShellScript: (shellParams: {\n\t\t\t\treadonly allowFailure?: boolean;\n\t\t\t\treadonly args?: string[];\n\t\t\t\treadonly script: string;\n\t\t\t\treadonly signal?: AbortSignal;\n\t\t\t\treadonly stdin?: Buffer | string;\n\t\t\t}) => Promise<{\n\t\t\t\treadonly code: number;\n\t\t\t\treadonly stderr: Buffer;\n\t\t\t\treadonly stdout: Buffer;\n\t\t\t}>;\n\t\t};\n\t\treadonly sandbox: unknown;\n\t}) => import('./sandbox-backend-factory.js').OpenClawSandboxFsBridge;\n\treadonly createSshSandboxSessionFromSettings: (settings: {\n\t\treadonly command: string;\n\t\treadonly identityData?: string;\n\t\treadonly strictHostKeyChecking: boolean;\n\t\treadonly target: string;\n\t\treadonly updateHostKeys: boolean;\n\t\treadonly workspaceRoot: string;\n\t}) => Promise<SshSandboxSession>;\n\treadonly disposeSshSandboxSession?: (session: SshSandboxSession) => Promise<void>;\n\treadonly runSshSandboxCommand: (params: {\n\t\treadonly allowFailure?: boolean;\n\t\treadonly remoteCommand: string;\n\t\treadonly session: SshSandboxSession;\n\t\treadonly signal?: AbortSignal;\n\t\treadonly stdin?: Buffer | string;\n\t}) => Promise<{\n\t\treadonly code: number;\n\t\treadonly stderr: Buffer;\n\t\treadonly stdout: Buffer;\n\t}>;\n\treadonly sanitizeEnvVars: (env: NodeJS.ProcessEnv) => {\n\t\treadonly allowed: Record<string, string>;\n\t};\n}\n\nexport interface OpenClawToolRegistration {\n\treadonly description: string;\n\treadonly execute: (toolCallId: string, params: unknown) => Promise<OpenClawToolResult>;\n\treadonly name: string;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface OpenClawToolRegistrationOptions {\n\treadonly name?: string;\n\treadonly names?: readonly string[];\n\treadonly optional?: boolean;\n}\n\nexport interface OpenClawToolResult {\n\treadonly content: string;\n\treadonly details?: unknown;\n}\n\nexport interface OpenClawToolRegistrationApi {\n\treadonly registerTool?: (\n\t\ttool: OpenClawToolRegistration,\n\t\toptions?: OpenClawToolRegistrationOptions,\n\t) => void;\n}\n\nexport function assertSdkShape(value: unknown): asserts value is SshHelpers & {\n\tregisterSandboxBackend: (\n\t\tid: string,\n\t\tregistration: {\n\t\t\tfactory: ReturnType<\n\t\t\t\ttypeof import('./sandbox-backend-factory.js').createGondolinSandboxBackendFactory\n\t\t\t>;\n\t\t\tmanager?: ReturnType<\n\t\t\t\ttypeof import('./sandbox-backend-factory.js').createGondolinSandboxBackendManager\n\t\t\t>;\n\t\t},\n\t) => void;\n} {\n\tif (typeof value !== 'object' || value === null) {\n\t\tthrow new TypeError('OpenClaw SDK module is not an object');\n\t}\n\n\tfor (const exportName of [\n\t\t'buildExecRemoteCommand',\n\t\t'buildRemoteCommand',\n\t\t'buildSshSandboxArgv',\n\t\t'createRemoteShellSandboxFsBridge',\n\t\t'createSshSandboxSessionFromSettings',\n\t\t'runSshSandboxCommand',\n\t\t'sanitizeEnvVars',\n\t\t'registerSandboxBackend',\n\t] as const) {\n\t\tif (typeof (value as Record<string, unknown>)[exportName] !== 'function') {\n\t\t\tthrow new TypeError(`OpenClaw SDK missing required export: ${exportName}`);\n\t\t}\n\t}\n}\n","import { fetchControllerWithPolicy } from './controller-request-policy.js';\nimport type { OpenClawToolRegistrationApi } from './openclaw-sandbox-sdk-contract.js';\n\ntype RequiredOpenClawToolRegistrationApi = OpenClawToolRegistrationApi & {\n\treadonly registerTool: NonNullable<OpenClawToolRegistrationApi['registerTool']>;\n};\n\nexport interface RegisterZoneGitToolOptions {\n\treadonly api: RequiredOpenClawToolRegistrationApi;\n\treadonly controllerUrl: string;\n\treadonly fetchImpl?: typeof fetch;\n\treadonly zoneGitToken?: string;\n\treadonly zoneId: string;\n}\n\nconst zoneGitCapabilityHeader = 'x-agent-vm-zone-git-token';\n\nfunction readExpectedHead(input: unknown): string {\n\tif (typeof input !== 'object' || input === null || !('expectedHead' in input)) {\n\t\tthrow new Error('zone_git_push requires expectedHead.');\n\t}\n\tconst expectedHead = input.expectedHead;\n\tif (typeof expectedHead !== 'string' || expectedHead.length === 0) {\n\t\tthrow new Error('zone_git_push requires expectedHead.');\n\t}\n\treturn expectedHead;\n}\n\nfunction buildControllerUrl(controllerUrl: string, zoneId: string): string {\n\treturn `${controllerUrl.replace(/\\/$/u, '')}/zones/${encodeURIComponent(zoneId)}/zone-git/push`;\n}\n\nasync function readResponseText(response: Response): Promise<string> {\n\ttry {\n\t\treturn await response.text();\n\t} catch (error) {\n\t\treturn error instanceof Error ? error.message : String(error);\n\t}\n}\n\nfunction parseJsonPayload(responseText: string): unknown {\n\ttry {\n\t\treturn JSON.parse(responseText);\n\t} catch (error) {\n\t\tthrow new Error(`zone_git_push returned non-JSON response: ${responseText.slice(0, 500)}`, {\n\t\t\tcause: error,\n\t\t});\n\t}\n}\n\nexport function registerZoneGitTool(options: RegisterZoneGitToolOptions): void {\n\toptions.api.registerTool(\n\t\t{\n\t\t\tname: 'zone_git_push',\n\t\t\tdescription:\n\t\t\t\t'Push committed OpenClaw zone workspace changes through the agent-vm controller. Use after git commit; do not run raw git push.',\n\t\t\tparameters: {\n\t\t\t\ttype: 'object',\n\t\t\t\tadditionalProperties: false,\n\t\t\t\tproperties: {\n\t\t\t\t\texpectedHead: { type: 'string' },\n\t\t\t\t},\n\t\t\t\trequired: ['expectedHead'],\n\t\t\t},\n\t\t\texecute: async (_toolCallId: string, input: unknown) => {\n\t\t\t\tconst expectedHead = readExpectedHead(input);\n\t\t\t\tconst response = await fetchControllerWithPolicy({\n\t\t\t\t\tfetchImpl: options.fetchImpl ?? fetch,\n\t\t\t\t\tinput: buildControllerUrl(options.controllerUrl, options.zoneId),\n\t\t\t\t\tinit: {\n\t\t\t\t\t\tbody: JSON.stringify({ expectedHead }),\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t'content-type': 'application/json',\n\t\t\t\t\t\t\t...(options.zoneGitToken ? { [zoneGitCapabilityHeader]: options.zoneGitToken } : {}),\n\t\t\t\t\t\t},\n\t\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\t},\n\t\t\t\t\toperation: 'zone-git-push',\n\t\t\t\t});\n\t\t\t\tconst responseText = await readResponseText(response);\n\t\t\t\tif (!response.ok) {\n\t\t\t\t\tthrow new Error(`zone_git_push failed: ${response.status} ${responseText.slice(0, 500)}`);\n\t\t\t\t}\n\t\t\t\tconst payload = parseJsonPayload(responseText);\n\t\t\t\treturn {\n\t\t\t\t\tcontent: JSON.stringify(payload),\n\t\t\t\t\tdetails: payload,\n\t\t\t\t};\n\t\t\t},\n\t\t},\n\t\t{ name: 'zone_git_push', optional: true },\n\t);\n}\n","import { createLeaseClient } from './controller-lease-client.js';\nimport { createGatewayControlLinkMonitor } from './gateway-control-link-monitor.js';\nimport { resolveGondolinPluginConfig } from './gondolin-plugin-config.js';\nimport {\n\tOPENCLAW_SSH_SESSION_SCRATCH_ROOT,\n\tcreateBackendDeps,\n} from './openclaw-backend-dependencies.js';\nimport { buildOpenClawRuntimeStatusReport } from './openclaw-runtime-status.js';\nimport {\n\tassertSdkShape,\n\ttype OpenClawToolRegistrationApi,\n\ttype SshHelpers,\n\ttype SshSandboxSession,\n} from './openclaw-sandbox-sdk-contract.js';\nimport {\n\tcreateGondolinSandboxBackendFactory,\n\tcreateGondolinSandboxBackendManager,\n} from './sandbox-backend-factory.js';\nimport { registerZoneGitTool } from './zone-git-tool.js';\n\nasync function publishRuntimeStatus(options: {\n\treadonly controllerUrl: string;\n\treadonly report: ReturnType<typeof buildOpenClawRuntimeStatusReport>;\n}): Promise<void> {\n\tconst leaseClient = createLeaseClient({ controllerUrl: options.controllerUrl });\n\tawait leaseClient.publishOpenClawRuntimeStatus?.(options.report);\n}\n\nconst plugin = {\n\tid: 'gondolin',\n\tname: 'Gondolin VM Sandbox',\n\tdescription: 'Sandbox backend powered by Gondolin micro-VMs.',\n\n\tregister(api: {\n\t\treadonly config?: Record<string, unknown>;\n\t\treadonly pluginConfig: Record<string, unknown>;\n\t\treadonly registerTool?: OpenClawToolRegistrationApi['registerTool'];\n\t\treadonly registrationMode: string;\n\t\treadonly runtime?: {\n\t\t\treadonly config?: {\n\t\t\t\treadonly current?: () => Record<string, unknown>;\n\t\t\t};\n\t\t};\n\t}): void {\n\t\tconst registerTool = api.registerTool;\n\t\tif (typeof registerTool !== 'function') {\n\t\t\tif (api.registrationMode === 'full') {\n\t\t\t\tthrow new Error('Gondolin full registration requires OpenClaw registerTool.');\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tconst pluginConfig = resolveGondolinPluginConfig(api.pluginConfig);\n\t\tconst zoneGitToken =\n\t\t\tpluginConfig.zoneGitToken ??\n\t\t\t(pluginConfig.zoneGitTokenEnv ? process.env[pluginConfig.zoneGitTokenEnv] : undefined);\n\t\tregisterZoneGitTool({\n\t\t\tapi: { registerTool },\n\t\t\tcontrollerUrl: pluginConfig.controllerUrl,\n\t\t\t...(zoneGitToken ? { zoneGitToken } : {}),\n\t\t\tzoneId: pluginConfig.zoneId,\n\t\t});\n\t\tif (api.registrationMode !== 'full') {\n\t\t\treturn;\n\t\t}\n\t\tif (pluginConfig.gatewayControlLinkMonitor?.enabled) {\n\t\t\tcreateGatewayControlLinkMonitor({\n\t\t\t\tbaseIntervalMs: pluginConfig.gatewayControlLinkMonitor.baseIntervalMs,\n\t\t\t\tcontrollerUrl: pluginConfig.controllerUrl,\n\t\t\t\tmaxIntervalMs: pluginConfig.gatewayControlLinkMonitor.maxIntervalMs,\n\t\t\t\tnow: () => Date.now(),\n\t\t\t\tzoneId: pluginConfig.zoneId,\n\t\t\t}).start();\n\t\t}\n\t\tconst buildRuntimeStatus = ():\n\t\t\t| ReturnType<typeof buildOpenClawRuntimeStatusReport>\n\t\t\t| undefined => {\n\t\t\tconst runtimeConfig = api.runtime?.config?.current?.() ?? api.config;\n\t\t\treturn runtimeConfig\n\t\t\t\t? buildOpenClawRuntimeStatusReport({\n\t\t\t\t\t\tconfig: runtimeConfig,\n\t\t\t\t\t\tzoneId: pluginConfig.zoneId,\n\t\t\t\t\t})\n\t\t\t\t: undefined;\n\t\t};\n\t\tconst initialRuntimeStatus = buildRuntimeStatus();\n\t\tif (initialRuntimeStatus) {\n\t\t\tvoid publishRuntimeStatus({\n\t\t\t\tcontrollerUrl: pluginConfig.controllerUrl,\n\t\t\t\treport: initialRuntimeStatus,\n\t\t\t}).catch((error: unknown) => {\n\t\t\t\tconst message = error instanceof Error ? error.message : JSON.stringify(error);\n\t\t\t\tprocess.stderr.write(`[gondolin] failed to publish OpenClaw runtime status: ${message}\\n`);\n\t\t\t});\n\t\t}\n\n\t\tconst sdkPath = '/opt/openclaw-sdk/sandbox.js';\n\t\tconst sdkPromise = import(sdkPath).then((sdkRaw: Record<string, unknown>) => {\n\t\t\tassertSdkShape(sdkRaw);\n\n\t\t\tconst sshHelpers: SshHelpers = {\n\t\t\t\tbuildExecRemoteCommand: sdkRaw.buildExecRemoteCommand,\n\t\t\t\tbuildRemoteCommand: sdkRaw.buildRemoteCommand,\n\t\t\t\tbuildSshSandboxArgv: sdkRaw.buildSshSandboxArgv,\n\t\t\t\tcreateRemoteShellSandboxFsBridge: sdkRaw.createRemoteShellSandboxFsBridge,\n\t\t\t\tcreateSshSandboxSessionFromSettings: sdkRaw.createSshSandboxSessionFromSettings,\n\t\t\t\t...(typeof sdkRaw.disposeSshSandboxSession === 'function'\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tdisposeSshSandboxSession: sdkRaw.disposeSshSandboxSession as (\n\t\t\t\t\t\t\t\tsession: SshSandboxSession,\n\t\t\t\t\t\t\t) => Promise<void>,\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t\trunSshSandboxCommand: sdkRaw.runSshSandboxCommand,\n\t\t\t\tsanitizeEnvVars: sdkRaw.sanitizeEnvVars,\n\t\t\t};\n\n\t\t\tconst backendDependencies = createBackendDeps(sshHelpers);\n\t\t\tsdkRaw.registerSandboxBackend('gondolin', {\n\t\t\t\tfactory: createGondolinSandboxBackendFactory(\n\t\t\t\t\t{\n\t\t\t\t\t\t...pluginConfig,\n\t\t\t\t\t\topenClawRuntimeConfigProvider: () => api.runtime?.config?.current?.() ?? api.config,\n\t\t\t\t\t\topenClawRuntimeStatusProvider: buildRuntimeStatus,\n\t\t\t\t\t},\n\t\t\t\t\tbackendDependencies,\n\t\t\t\t),\n\t\t\t\tmanager: createGondolinSandboxBackendManager(pluginConfig, backendDependencies),\n\t\t\t});\n\t\t});\n\n\t\tsdkPromise.catch((error: unknown) => {\n\t\t\tconst message = error instanceof Error ? error.message : JSON.stringify(error);\n\t\t\tprocess.stderr.write(`[gondolin] failed to load OpenClaw SDK: ${message}\\n`);\n\t\t});\n\t},\n};\n\nexport default plugin;\n\nexport { OPENCLAW_SSH_SESSION_SCRATCH_ROOT, createBackendDeps };\nexport type { SshHelpers };\n","import {\n\tisAgentVmHealthEvent,\n\ttype AgentChannelProviderHealthDetails,\n\ttype AgentChannelProviderHealthKind,\n\ttype AgentVmHealthEvent,\n\ttype AgentVmHealthResultKind,\n} from '@agent-vm/gateway-interface';\n\ntype AgentChannelProviderHealthEvent = Extract<\n\tAgentVmHealthEvent,\n\t{ readonly kind: 'agent-channel-provider-health' }\n>;\n\nexport interface BuildAgentChannelProviderHealthEventOptions {\n\treadonly channelProviderId: string;\n\treadonly details?: AgentChannelProviderHealthDetails | undefined;\n\treadonly health: AgentChannelProviderHealthKind;\n\treadonly observedAtMs: number;\n\treadonly transitionStartedAtMs?: number | undefined;\n\treadonly unhealthySinceMs?: number | undefined;\n\treadonly zoneId: string;\n}\n\nexport function buildAgentChannelProviderHealthEvent(\n\toptions: BuildAgentChannelProviderHealthEventOptions,\n): AgentChannelProviderHealthEvent {\n\tconst event = {\n\t\tchannelProviderId: options.channelProviderId,\n\t\t...(options.details === undefined ? {} : { details: options.details }),\n\t\thealth: options.health,\n\t\tkind: 'agent-channel-provider-health',\n\t\tobservedAtMs: options.observedAtMs,\n\t\tresult: resultForChannelProviderHealth(options.health),\n\t\t...(options.transitionStartedAtMs === undefined\n\t\t\t? {}\n\t\t\t: { transitionStartedAtMs: options.transitionStartedAtMs }),\n\t\t...(options.unhealthySinceMs === undefined\n\t\t\t? {}\n\t\t\t: { unhealthySinceMs: options.unhealthySinceMs }),\n\t\tzoneId: options.zoneId,\n\t} satisfies AgentChannelProviderHealthEvent;\n\tif (!isAgentVmHealthEvent(event)) {\n\t\tthrow new Error(\n\t\t\t'Channel-provider health event requires whitelisted and redacted channel-provider health details.',\n\t\t);\n\t}\n\treturn event;\n}\n\nfunction resultForChannelProviderHealth(\n\thealth: AgentChannelProviderHealthKind,\n): AgentVmHealthResultKind {\n\tswitch (health) {\n\t\tcase 'healthy':\n\t\tcase 'transitioning':\n\t\t\treturn 'ok';\n\t\tcase 'unhealthy-recoverable':\n\t\tcase 'unhealthy-unrecoverable':\n\t\t\treturn 'failed';\n\t}\n\treturn assertNeverAgentChannelProviderHealth(health);\n}\n\nfunction assertNeverAgentChannelProviderHealth(health: never): never {\n\tthrow new Error(`Unhandled agent channel provider health: ${String(health)}`);\n}\n","export * from './sandbox-backend-factory.js';\nexport * from './gondolin-plugin-config.js';\nexport * from './controller-request-policy.js';\nexport * from './controller-lease-client.js';\nexport { createGatewayControlLinkMonitor } from './gateway-control-link-monitor.js';\nexport * from './openclaw-plugin-registration.js';\nexport * from './openclaw-gondolin-contract.js';\nexport * from './provider-health/agent-channel-provider-health.js';\nexport { buildOpenClawRuntimeStatusReport } from './openclaw-runtime-status.js';\nexport { default } from './openclaw-plugin-registration.js';\n\nexport const OPENCLAW_GONDOLIN_PLUGIN_PACKAGE_NAME = '@agent-vm/openclaw-agent-vm-plugin';\n"],"mappings":";;;;AA8EA,IAAa,8BAAb,cAAiD,MAAM;CACtD;CACA;CACA;CACA;CAEA,YAAY,SAKT;EACF,MAAM,OACL,QAAQ,UAAU,OAAO,QAAQ,SAAS,MAAM,iBAAiB;EAClE,MACC,GAAG,QAAQ,QAAQ,iBAAiB,OAAO,QAAQ,OAAO,CAAC,IAAI,KAAK,GAAG,4BACtE,QAAQ,aACR,GACD;EACD,KAAK,WAAW,QAAQ;EACxB,KAAK,OAAO;EACZ,KAAK,eAAe,QAAQ;EAC5B,KAAK,SAAS,QAAQ;;;AAIxB,MAAM,kCAAkC,EAAE,OAAO;CAChD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU;CAC7C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU;CAC5C,CAAC;AAEF,SAAS,mBAAmB,OAAgE;CAC3F,OACC,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAQ,MAAM,IACrB,OAAO,OAAO,MAAM,CAAC,MAAM,YAAY;;AAIzC,SAAS,YAAY,OAAoC;CACxD,IACC,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,aACjB,OAAO,UAAU,UAEjB,OAAO;CAER,IAAI,MAAM,QAAQ,MAAM,EACvB,OAAO,MAAM,MAAM,YAAY;CAEhC,OAAO,mBAAmB,MAAM;;AAGjC,MAAM,kBAAkB,EAAE,OAAkB,YAAY;AAExD,SAAS,YAAY,OAAoC;CACxD,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA;;AAG9D,SAAS,4BAA4B,cAA6C;CACjF,MAAM,cAAc,gCAAgC,UAAU,aAAa;CAC3E,IAAI,CAAC,YAAY,SAChB,OAAO;CAER,MAAM,EAAE,UAAU,YAAY,YAAY;CAC1C,MAAM,QAAQ,CAAC,SAAS,WAAW,aAAa,aAAa,KAAA,EAAU,CAAC,QACtE,SAAyB,SAAS,KAAA,EACnC;CACD,OAAO,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK;;AAGpD,SAAS,yBAAyB,OAAuD;CACxF,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,KAAK,YACnD,OAAO,QAAQ,IAAI,QAAQ,QAAQ,KAAK;;AAI1C,SAAS,6BAA6B,OAA2D;CAChG,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,KAAK;;AAIrD,SAASA,qBAAmB,OAAwB;CACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAS,oBAAoB,SAAuB;CACnD,QAAQ,OAAO,MAAM,8BAA8B,QAAQ,IAAI;;AAGhE,SAAS,cAAc,UAAkB,SAAwC;CAChF,IAAI;EACH,MAAM,aAAsB,KAAK,MAAM,SAAS;EAChD,MAAM,aAAa,gBAAgB,UAAU,WAAW;EACxD,OAAO,WAAW,UAAU,WAAW,OAAO,KAAA;UACtC,OAAO;EACf,oBAAoB,GAAG,QAAQ,mCAAmCA,qBAAmB,MAAM,GAAG;EAC9F;;;AAIF,eAAe,cACd,UACA,SAIE;CACF,MAAM,WAAW,MAAM,SAAS,MAAM,CAAC,YAAY,eAAe;CAClE,OAAO;EACN;EACA,cAAc,aAAa,iBAAiB,KAAA,IAAY,cAAc,UAAU,QAAQ;EACxF;;AAGF,eAAe,iBACd,UACA,SACA,oBACkB;CAClB,IAAI,CAAC,SAAS,IAAI;EACjB,MAAM,YAAY,MAAM,cAAc,UAAU,QAAQ;EACxD,MAAM,IAAI,4BAA4B;GACrC,UAAU,UAAU;GACpB;GACA,cAAc,UAAU;GACxB,QAAQ,SAAS;GACjB,CAAC;;CAEH,MAAM,UAAU,MAAM,SAAS,MAAM;CACrC,IAAI,CAAC,mBAAmB,QAAQ,EAC/B,MAAM,IAAI,UACT,GAAG,QAAQ,iCAAiC,KAAK,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,GACjF;CAEF,OAAO;;AAGR,SAAgB,kBAAkB,SAIlB;CACf,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,QAAQ,cAAc,QAAQ,QAAQ,GAAG;CACzD,MAAM,kBAAkB,OAAO,sBAK9B,MAAM,0BAA0B;EAC/B;EACA,OAAO,kBAAkB;EACzB,WAAW,kBAAkB;EAC7B,GAAI,kBAAkB,SAAS,KAAA,IAAY,EAAE,GAAG,EAAE,MAAM,kBAAkB,MAAM;EAChF,GAAI,QAAQ,kBAAkB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,QAAQ,eAAe;EAChF,CAAC;CAEH,MAAM,aAAa,OAAO,YAA6C;EAQtE,OAAO,MAAM,iBAAiB,MAPP,gBAAgB;GACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC;GACvD,MAAM,EACL,QAAQ,QACR;GACD,WAAW;GACX,CAAC,EACsC,8BAA8B,iBAAiB;;CAGxF,OAAO;EACN,cAAc,OACb,SACA,OACA,YACmB;GACnB,MAAM,WAAW,MAAM,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC,QAAQ,mBAAmB,MAAM;IACxF,MAAM;KACL,MAAM,KAAK,UAAU,QAAQ;KAC7B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,YAAY,MAAM,cAAc,UAAU,gCAAgC;IAChF,MAAM,IAAI,4BAA4B;KACrC,UAAU,UAAU;KACpB,SAAS;KACT,cAAc,UAAU;KACxB,QAAQ,SAAS;KACjB,CAAC;;GAEH,MAAM,4BAA4B,SAAS;;EAE5C,oBAAoB,OACnB,SACA,OACA,YAC+C;GAY/C,OAAO,MAAM,iBACZ,MAZsB,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC,QAAQ,mBAAmB,MAAM,CAAC;IACzF,MAAM;KACL,MAAM,KAAK,UAAU,QAAQ;KAC7B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC,EAGD,uCACA,6BACA;;EAEF;EACA,WAAW,OAAO,YAA8C;GAK/D,OAAO,MAAM,iBAAiB,MAJP,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC;IACvD,WAAW;IACX,CAAC,EACsC,6BAA6B,kBAAkB;;EAExF,8BAA8B,OAAO,WAA0B;GAC9D,MAAM,WAAW,MAAM,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,OAAO,OAAO,CAAC;IAC7D,MAAM;KACL,MAAM,KAAK,UAAU,OAAO;KAC5B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,YAAY,MAAM,cAAc,UAAU,yCAAyC;IACzF,MAAM,IAAI,4BAA4B;KACrC,UAAU,UAAU;KACpB,SAAS;KACT,cAAc,UAAU;KACxB,QAAQ,SAAS;KACjB,CAAC;;GAEH,MAAM,4BAA4B,SAAS;;EAE5C,cAAc,OACb,SACA,iBAA+C,EAAE,KAC9B;GACnB,MAAM,aAAa,IAAI,IAAI,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,GAAG;GAC7E,IAAI,eAAe,UAAU,MAC5B,WAAW,aAAa,IAAI,SAAS,OAAO;GAE7C,MAAM,WAAW,MAAM,gBAAgB;IACtC,OAAO,WAAW,UAAU;IAC5B,MAAM,EACL,QAAQ,UACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,YAAY,MAAM,cAAc,UAAU,+BAA+B;IAC/E,MAAM,IAAI,4BAA4B;KACrC,UAAU,UAAU;KACpB,SAAS;KACT,cAAc,UAAU;KACxB,QAAQ,SAAS;KACjB,CAAC;;GAEH,MAAM,4BAA4B,SAAS;;EAE5C,cAAc,OAAO,YAAqC;GAoBzD,OAAO,MAAM,iBAAiB,MAnBP,gBAAgB;IACtC,OAAO,GAAG,QAAQ;IAClB,MAAM;KACL,MAAM,KAAK,UAAU;MACpB,SAAS,QAAQ;MACjB,mBAAmB,QAAQ;MAC3B,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;MAC3E,WAAW,QAAQ;MACnB,YAAY,QAAQ;MACpB,cAAc,QAAQ;MACtB,QAAQ,QAAQ;MAChB,CAAC;KACF,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC,EACsC,wBAAwB,iBAAiB;;EAElF,gBAAgB,OACf,SACA,YAC2C;GAY3C,OAAO,MAAM,iBACZ,MAZsB,gBAAgB;IACtC,OAAO,GAAG,QAAQ,SAAS,mBAAmB,QAAQ,CAAC;IACvD,MAAM;KACL,MAAM,KAAK,UAAU,QAAQ;KAC7B,SAAS,EACR,gBAAgB,oBAChB;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC,EAGD,mCACA,yBACA;;EAEF;;;;ACvZF,MAAM,iBAAiB;AAEvB,MAAa,4BAA4B;AAEzC,MAAa,yCAAyC;CACrD;EAAE,eAAe;EAAY,KAAK;EAAW;CAC7C;EAAE,eAAe;EAAO,KAAK;EAAQ;CACrC;EAAE,eAAe;EAAS,KAAK;EAAS;CACxC;EAAE,eAAe;EAAM,KAAK;EAAmB;CAC/C;AAED,MAAa,yCACZ;AAoBD,IAAa,uBAAb,cAA0C,MAAM;CAC/C,YAAY,SAAiB;EAC5B,MAAM,QAAQ;EACd,KAAK,OAAO;;;AAId,SAAgB,kBAAkB,OAAwB;CACzD,OAAO,eAAe,KAAK,MAAM,MAAM,CAAC;;AAGzC,SAAgB,sCACf,UACA,aACA,KACU;CACV,OAAO,YAAY,UAAU,QAAQ,SAAS,UAAU;;AAGzD,SAAgB,2CACf,OACA,KACS;CACT,OAAO,UAAU,MAAM,WAAW;;AAGnC,SAAgB,2CAA2C,SAIhD;CACV,OAAO,oBAAoB,QAAQ,UAAU,QAAQ,YAAY,IAAI,CAAC,GAAG,QAAQ,OAAO,GAAG,QAAQ;;AAGpG,SAAgB,sCAAsC,SAI3C;CACV,OAAO,QAAQ,KACZ,GAAG,QAAQ,UAAU,GAAG,QAAQ,kBAChC,OAAO,QAAQ,UAAU,OAAO,QAAQ,cAAc;;AAG1D,SAAgB,yBAAyB,OAA0C;CAClF,MAAM,WAAW,SAAS,IAAI,MAAM,CAAC,aAAa;CAClD,IAAI,YAAY,IACf,OAAO;CAER,IAAI,CAAC,kBAAkB,QAAQ,EAC9B,MAAM,IAAI,qBAAqB,6BAA6B,MAAM,IAAI;CAEvE,OAAO;;AAGR,SAAgB,qCAAqC,YAA4B;CAChF,MAAM,QAAQ,WAAW,MAAM,CAAC,MAAM,IAAI;CAC1C,IAAI,MAAM,OAAO,WAAW,CAAC,MAAM,MAAM,CAAC,kBAAkB,MAAM,GAAG,EACpE,MAAM,IAAI,qBACT,wBAAwB,WAAW,qDACnC;CAEF,OAAO,yBAAyB,MAAM,GAAG;;AAG1C,SAAgB,0BAA0B,YAA6B;CACtE,MAAM,QAAQ,WAAW,MAAM,CAAC,MAAM,IAAI;CAC1C,OAAO,MAAM,OAAO,WAAW,MAAM,OAAO,KAAA,KAAa,kBAAkB,MAAM,GAAG;;AAGrF,SAAgB,sCAAsC,KAKpD;CACD,OAAO;EACN,SAAS,IAAI;EACb,MAAM,IAAI;EACV,OAAO,IAAI;EACX,iBAAiB,IAAI;EACrB;;AAGF,SAAgB,oCACf,SACiD;CACjD,OAAO,uCAAuC,MAC5C,gBAAgB,QAAQ,YAAY,SAAS,YAAY,cAC1D;;;;AC1FF,IAAa,oCAAb,cAAuD,MAAM;CAC5D,YAAY,SAAiB;EAC5B,MAAM,QAAQ;EACd,KAAK,OAAO;;;AAId,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,2BAA2B,WAA2B;CAE9D,OAAO,IADU,UAAU,MAAM,IAAI,CAAC,QAAQ,YAAY,YAAY,MAAM,YAAY,IACrE,CAAC,KAAK,IAAI;;AAG9B,SAAS,wBAAwB,WAA4B;CAC5D,OAAO,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK;;AAG9C,SAAS,oBAAoB,WAAmB,UAA2B;CAC1E,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG,SAAS,GAAG;;AAGtE,SAAS,kBAAkB,WAAmB,qBAAkD;CAC/F,MAAM,aAAa,2BAA2B,UAAU;CACxD,MAAM,6BACL,wBAAwB,KAAA,IACrB,KAAA,IACA,2BAA2B,4BAA4B,oBAAoB,CAAC;CAChF,MAAM,8BACL,+BAA+B,KAAA,IAC5B,KAAA,IACA,2BAA2B,QAAQ,iBAAiB,GAAG;CAC3D,OACC,eAAe,gCACf,WAAW,WAAW,GAAG,6BAA6B,GAAG,IACzD,eAAe,8BACf,WAAW,WAAW,GAAG,2BAA2B,GAAG,IACvD,eAAe,oCACf,WAAW,WAAW,GAAG,iCAAiC,GAAG,IAC5D,+BAA+B,KAAA,MAC9B,oBAAoB,YAAY,2BAA2B,IAC3D,WAAW,WAAW,GAAG,2BAA2B,GAAG,KACxD,gCAAgC,KAAA,MAC/B,oBAAoB,YAAY,4BAA4B,IAC5D,WAAW,WAAW,GAAG,4BAA4B,GAAG;;AAI5D,SAAS,4BAA4B,WAA2B;CAC/D,MAAM,cAAc,UAAU,MAAM;CACpC,MAAM,gBAAgB,QAAQ,IAAI,MAAM,MAAM;CAC9C,IAAI,gBAAgB,OAAO,eAC1B,OAAO;CAER,IAAI,YAAY,WAAW,KAAK,IAAI,eACnC,OAAO,KAAK,QAAQ,KAAK,KAAK,eAAe,YAAY,MAAM,EAAE,CAAC,CAAC;CAEpE,OAAO,KAAK,QAAQ,YAAY;;AAGjC,SAAS,0BAA0B,WAAmB,SAAyB;CAC9E,MAAM,cAAc,UAAU,MAAM;CACpC,IAAI,gBAAgB,MAAM,wBAAwB,YAAY,EAC7D,MAAM,IAAI,kCACT,GAAG,QAAQ,qDACX;CAEF,IAAI,CAAC,YAAY,WAAW,IAAI,IAAI,CAAC,YAAY,WAAW,IAAI,EAC/D,MAAM,IAAI,kCACT,GAAG,QAAQ,6CACX;CAGF,MAAM,aAAa,2BADE,4BAA4B,YACS,CAAC;CAC3D,IACC,eAAe,OACf,eAAe,gCACf,WAAW,WAAW,GAAG,6BAA6B,GAAG,IACzD,eAAe,8BACf,WAAW,WAAW,GAAG,2BAA2B,GAAG,EAEvD,MAAM,IAAI,kCACT,GAAG,QAAQ,6EAA6E,WAAW,IACnG;CAEF,IACC,eAAe,oCACf,WAAW,WAAW,GAAG,iCAAiC,GAAG,EAE7D,MAAM,IAAI,kCACT,GAAG,QAAQ,uFAAuF,WAAW,IAC7G;CAEF,OAAO;;AAGR,SAAS,4BACR,WACA,SACA,qBACS;CACT,MAAM,aAAa,0BAA0B,WAAW,QAAQ;CAChE,IAAI,kBAAkB,YAAY,oBAAoB,EACrD,MAAM,IAAI,kCACT,GAAG,QAAQ,gHAAgH,WAAW,IACtI;CAEF,OAAO;;AAGR,SAAS,cAAc,OAAoC;CAC1D,OAAO,OAAO,UAAU,YAAY,MAAM,MAAM,KAAK,KAAK,MAAM,MAAM,GAAG,KAAA;;AAG1E,SAAS,YAAY,OAAwB;CAC5C,OAAO,yBAAyB,OAAO,UAAU,WAAW,QAAQ,KAAA,EAAU;;AAG/E,SAAS,aACR,QACqC;CACrC,OAAO,QAAQ,QAAQ,MAAM,OAAO,SAAS,IAAI,EAAE;;AAGpD,SAAS,eACR,QACA,SACsC;CACtC,OAAO,aAAa,OAAO,CAAC,MAAM,UAAU,YAAY,MAAM,GAAG,KAAK,QAAQ;;AAG/E,SAAS,sBAAsB,QAA0D;CACxF,MAAM,UAAU,aAAa,OAAO;CAGpC,OAAO,aAFc,QAAQ,MAAM,UAAU,MAAM,YAAY,KAC7B,IAAI,QAAQ,KACZ,GAAG;;AAGtC,SAAgB,oCAAoC,SAMnB;CAChC,MAAM,UAAU,yBAAyB,QAAQ,QAAQ;CAEzD,MAAM,iBAAiB,cADJ,eAAe,QAAQ,gBAAgB,QACX,EAAE,UAAU;CAC3D,IAAI,mBAAmB,KAAA,GACtB,OAAO;EACN,MAAM;EACN,WAAW,4BACV,gBACA,8BAA8B,QAAQ,IACtC,QAAQ,oBACR;EACD;CAGF,MAAM,oBAAoB,cAAc,QAAQ,gBAAgB,QAAQ,UAAU,UAAU;CAC5F,IAAI,sBAAsB,KAAA,GAAW;EACpC,MAAM,eAAe,4BACpB,mBACA,6BACA,QAAQ,oBACR;EACD,MAAM,iBAAiB,sBAAsB,QAAQ,eAAe;EACpE,OAAO;GACN,MAAM,YAAY,iBAAiB,4BAA4B;GAC/D,WAAW,YAAY,iBAAiB,eAAe,KAAK,KAAK,cAAc,QAAQ;GACvF;;CAGF,IAAI,CAAC,kBAAkB,QAAQ,yBAAyB,QAAQ,oBAAoB,EACnF,OAAO;EACN,MAAM;EACN,WAAW,0BACV,QAAQ,yBACR,qCACA;EACD;CAGF,MAAM,YACL,QAAQ,aAAa,KAAA,IAClB,KAAA,IACA,0BAA0B,QAAQ,UAAU,oBAAoB;CACpE,IAAI,cAAc,KAAA,GACjB,MAAM,IAAI,kCACT,wCAAwC,QAAQ,wBAAwB,eAAe,QAAQ,yGAC/F;CAIF,IAAI,YADmB,sBAAsB,QAAQ,eACvB,EAC7B,MAAM,IAAI,kCACT,wCAAwC,QAAQ,wBAAwB,uBAAuB,QAAQ,0KACvG;CAEF,OAAO;EACN,MAAM;EACN,WAAW,KAAK,KAAK,WAAW,aAAa,UAAU;EACvD;;;;ACvMF,IAAa,gCAAb,cAAmD,MAAM;CACxD;CAEA,YAAY,SAAsC;EACjD,MAAM,GAAG,QAAQ,QAAQ,GAAG,QAAQ,gBAAgB;EACpD,KAAK,OAAO;EACZ,KAAK,UAAU;;;AAIjB,SAAS,4BAA4B,WAA4B;CAChE,OAAO,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK;;AAG9C,SAAS,uBAAuB,WAA2B;CAE1D,OAAO,IADa,UAAU,MAAM,IAAI,CAAC,QAAQ,YAAY,YAAY,MAAM,YAAY,IACrE,CAAC,KAAK,IAAI;;AAGjC,SAAS,+BAA+B,mBAAwD;CAC/F,OAAO;EACN,kBAAkB,EAAE;EACpB,MAAM;EACN,WAAW;EACX,WAAW;EACX,SAAS,+BAA+B,kBAAkB;EAC1D,SAAS;EACT,eACC;EACD;;AAGF,SAAS,0BACR,mBAC0C;CAC1C,IACC,kBAAkB,MAAM,KAAK,MAC7B,CAAC,kBAAkB,WAAW,IAAI,IAClC,uBAAuB,kBAAkB,KAAK,OAC9C,4BAA4B,kBAAkB,EAE9C,OAAO,+BAA+B,kBAAkB;;AAK1D,SAAS,gCAAgC,SAElB;CACtB,OAAO;EACN,IAAI;EACJ,OAAO;GACN;IACC,IAAI;IACJ,SAAS;KACR,MAAM;KACN,YAAY;KACZ,QAAQ;KACR;IACD,cAAc;KACb,cAAc;KACd,YAAY;KACZ;IACD,WAAW;KACV,oBAAoB,QAAQ;KAC5B,iBAAiB;KACjB;IACD,iBAAiB;IACjB,eAAe;IACf;GACD;IACC,IAAI;IACJ,SAAS;KACR,MAAM;KACN,YAAY;KACZ;IACD,cAAc;KACb,cAAc;KACd,YAAY;KACZ;IACD,WAAW,EACV,iBAAiB,4BACjB;IACD,iBAAiB;IACjB,eAAe;IACf;GACD;IACC,IAAI;IACJ,SAAS;KACR,MAAM;KACN,YAAY;KACZ,QAAQ;KACR;IACD,cAAc;KACb,cAAc;KACd,YAAY;KACZ;IACD,WAAW,EACV,oBAAoB,kCACpB;IACD,iBAAiB;IACjB,eAAe;IACf;GACD;EACD;;AAGF,SAAS,iCAAiC,aAGxC;CACD,MAAM,CAAC,cAAc,GAAG,oBAAoB,YAAY,aAAa,MAAM,IAAI;CAC/E,MAAM,oBACL,iBAAiB,KAAA,KAAa,iBAAiB,KAC5C,YAAY,aACZ,GAAG,iCAAiC,GAAG;CAK3C,OAAO;EACN,mBAJA,iBAAiB,WAAW,IACzB,+BACA,GAAG,6BAA6B,GAAG,iBAAiB,KAAK,IAAI;EAGhE;EACA;;AAGF,SAAS,mBAAmB,aAAmE;CAC9F,MAAM,SAAS,YAAY,iBAAiB;CAC5C,IAAI,YAAY,WAAW,mBAC1B,OAAO,SAAS,iBAAiB;CAElC,IAAI,YAAY,WAAW,sBAC1B,OAAO;CAER,IAAI,YAAY,mBAAmB,oBAClC,OAAO,SAAS,wBAAwB;CAEzC,OAAO,SAAS,mBAAmB;;AAGpC,SAAS,wBAAwB,aAA6C;CAC7E,OAAO,YAAY,iBAAiB,KACjC,YAAY,aACZ,YAAY,WAAW,MAAM,GAAG,EAAE,YAAY,aAAa,SAAS,GAAG;;AAG3E,SAAgB,gCAAgC,SAIb;CAClC,MAAM,yBAAyB,0BAA0B,QAAQ,kBAAkB;CACnF,IAAI,2BAA2B,KAAA,GAC9B,OAAO;EACN,OAAO;EACP,IAAI;EACJ;CAEF,MAAM,WAAW,CAChB,gCAAgC,EAC/B,mBAAmB,QAAQ,mBAC3B,CAAC,EACF,IAAI,QAAQ,gCAAgC,EAAE,EAAE,KAAK,gCACpD,gCAAgC,EAC/B,mBAAmB,6BACnB,CAAC,CACF,CACD;CACD,MAAM,yBAAyB,QAAQ,gCAAgC,EAAE,EACvE,KAAK,gCAAgC,0BAA0B,4BAA4B,CAAC,CAC5F,MAAM,UAAU,UAAU,KAAA,EAAU;CACtC,IAAI,0BAA0B,KAAA,GAC7B,OAAO;EACN,OAAO;EACP,IAAI;EACJ;CAEF,MAAM,UAAU,gCAAgC,EAC/C,mBAAmB,QAAQ,mBAC3B,CAAC;CACF,MAAM,qBAAqB,qBAAqB;EAC/C,WAAW,QAAQ;EACnB;EACA,SAAS;EACT,iBAAiB;EACjB,iBAAiB;EACjB,CAAC;CACF,IAAI,mBAAmB,MAAM,mBAAmB,MAAM,WAAW,sBAAsB;EACtF,MAAM,oBAAoB,iCAAiC,mBAAmB,MAAM;EACpF,OAAO;GACN,IAAI;GACJ,OAAO;IACN,mBAAmB,kBAAkB;IACrC,oBAAoB,mBAAmB,MAAM;IAC7C,MAAM,mBAAmB,mBAAmB,MAAM;IAClD,mBAAmB,kBAAkB;IACrC;GACD;;CAEF,MAAM,qBAAqB,SAAS,KAAK,qBACxC,qBAAqB;EACpB,WAAW,QAAQ;EACnB,SAAS;EACT,SAAS;EACT,iBAAiB;EACjB,CAAC,CACF;CACD,MAAM,cAAc,mBAAmB,MAAM,yBAAyB,qBAAqB,GAAG;CAC9F,IAAI,gBAAgB,KAAA,GAAW;EAC9B,MAAM,qBAAqB,mBAAmB;EAC9C,IAAI,uBAAuB,KAAA,KAAa,mBAAmB,IAC1D,OAAO;GACN,OAAO,+BAA+B,QAAQ,kBAAkB;GAChE,IAAI;GACJ;EAEF,OAAO;;CAER,MAAM,4BAA4B,qBAAqB;EACtD,WAAW,QAAQ;EACnB;EACA,SAAS;EACT,iBAAiB;EACjB,CAAC;CACF,OAAO;EACN,IAAI;EACJ,OAAO;GACN,mBAAmB,YAAY,MAAM;GACrC,GAAI,0BAA0B,KAC3B,EAAE,oBAAoB,0BAA0B,MAAM,YAAY,GAClE,EAAE;GACL,MAAM,mBAAmB,YAAY,MAAM;GAC3C,mBACC,0BAA0B,MAAM,0BAA0B,MAAM,WAAW,oBACxE,wBAAwB,0BAA0B,MAAM,GACxD,QAAQ;GACZ;EACD;;AAGF,SAAgB,+BAA+B,SAIR;CACtC,MAAM,SAAS,gCAAgC,QAAQ;CACvD,IAAI,CAAC,OAAO,IACX,MAAM,IAAI,8BAA8B,OAAO,MAAM;CAEtD,OAAO,OAAO;;;;AC7Rf,SAAgB,yBAAyB,QAAgB,MAAkC;CAC1F,IAAI,CAAC,QAAQ,KAAK,WAAW,GAC5B,OAAO;CAIR,OAAO,UADa,KAAK,KAAK,QAAQ,IAAI,IAAI,QAAQ,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,IAClD,CAAC,IAAI;;;;ACClC,IAAa,+BAAb,cAAkD,MAAM;CACvD;CACA;CAEA,YAAY,SAIT;EACF,MAAM,QAAQ,QAAQ;EACtB,KAAK,QAAQ,QAAQ;EACrB,KAAK,SAAS,QAAQ;;;AAsBxB,SAASC,qBAAmB,OAAwB;CACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAASC,kBAAgB,SAAuB;CAC/C,QAAQ,OAAO,MAAM,iCAAiC,QAAQ,IAAI;;AAGnE,eAAe,mBAAmB,SAMhB;CACjB,IAAI,CAAC,QAAQ,aAAa,aACzB;CAED,MAAM,QAAQ;EACb,SAAS,QAAQ,aAAa,YAAY;EAC1C,WAAW,QAAQ;EACnB,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW,QAAQ,WAAW;EAC3E,MAAM;EACN,SAAS,QAAQ,aAAa,YAAY;EAC1C,cAAc,QAAQ;EACtB,WAAW,QAAQ,aAAa,YAAY;EAC5C,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,aAAa,YAAY;EACzC;CACD,IAAI;EACH,MAAM,QAAQ,aAAa,YAAY,QAAQ,MAAM;UAC7C,OAAO;EACf,CAAC,QAAQ,aAAa,YAAYA,mBACjC,+CAA+C,QAAQ,aAAa,YAAY,UAAU,aAAa,OAAO,QAAQ,UAAU,CAAC,SAASD,qBAAmB,MAAM,GACnK;;;AAIH,eAAsB,+BACrB,SACmB;CACnB,MAAM,MAAM,QAAQ,OAAO,KAAK;CAChC,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,kBAAkB,IAAI,iBAAiB;CAC7C,MAAM,cAAc,KAAK;CACzB,IAAI;CAEJ,QAAQ,OAAO;EACd,cAAc,KAAK;EACnB,OAAO;EACP,CAAC;CAEF,MAAM,iBAAiB,IAAI,SAAgB,UAAU,WAAW;EAC/D,gBAAgB,qBAAqB;GACpC,gBAAgB,OAAO;GACvB,OACC,IAAI,6BAA6B;IAChC,OAAO,KAAA;IACP,SAAS,GAAG,QAAQ,cAAc,YAAY,OAAO,QAAQ,UAAU,CAAC;IACxE,QAAQ;IACR,CAAC,CACF;KACC,QAAQ,UAAU;GACpB;CAEF,IAAI;EACH,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,QAAQ,UAAU,gBAAgB,OAAO,EAAE,eAAe,CAAC;EAC9F,QAAQ,OAAO;GACd,cAAc,KAAK;GACnB,OAAO;GACP,KAAK,EAAE,gBAAgB,MAAM;GAC7B,CAAC;EACF,MAAM,eAAe,KAAK;EAC1B,mBAAwB;GACvB,WAAW,eAAe;GAC1B,cAAc;GACd;GACA,QAAQ;GACR,CAAC;EACF,OAAO;UACC,OAAO;EACf,MAAM,aACL,iBAAiB,+BACd,QACA,IAAI,6BAA6B;GACjC,OAAO;GACP,SAASA,qBAAmB,MAAM;GAClC,QAAQ;GACR,CAAC;EACL,QAAQ,OAAO;GACd,cAAc,KAAK;GACnB,OAAO;GACP,KAAK,EACJ,SAAS;IACR,MAAM,WAAW;IACjB,SAAS,WAAW;IACpB,EACD;GACD,CAAC;EACF,MAAM,eAAe,KAAK;EAC1B,mBAAwB;GACvB,WAAW,eAAe;GAC1B,WAAW,WAAW;GACtB,cAAc;GACd;GACA,QAAQ;GACR,CAAC;EACF,MAAM;WACG;EACT,IAAI,kBAAkB,KAAA,GACrB,iBAAiB,cAAc;;;;;AC7GlC,SAAS,mBAAmB,QAAuE;CAClG,OAAO,CAAC,OAAO,QAAQ,OAAO,QAAQ,CAAC,KAAK,KAAK;;AAQlD,SAAS,qCAAqC,QAGvB;CACtB,IAAI,OAAO,YAAY,sBAAsB,OAAO,eAAe,mBAClE,OAAO;CAER,IAAI,OAAO,YAAY,sBAAsB,OAAO,eAAe,mBAClE,OAAO;CAER,IAAI,OAAO,YAAY,cAAc,OAAO,eAAe,WAC1D,OAAO;;AAKT,SAAS,4BAA4B,QAK5B;CACR,MAAM,WAAW,qCAAqC,OAAO;CAC7D,IAAI,aAAa,KAAA,GAChB;CAED,MAAM,IAAI,MACT,+CAA+C,OAAO,OAAO,WAAW,OAAO,QAAQ,KAAK,SAAS,WACrG;;AAGF,SAAS,kCAAkC,OAA4C;CACtF,MAAM,eACL,MAAM,iBAAiB,KAAA,IAAY,MAAM,WAAW,KAAK,UAAU,MAAM,aAAa;CACvF,OAAO,GAAG,MAAM,QAAQ,aAAa;;AAGtC,SAAS,mBAAmB,OAAwB;CACnD,IAAI,iBAAiB,6BACpB,OAAO,kCAAkC,MAAM;CAEhD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAS,uBAAuB,SAAuB;CACtD,QAAQ,OAAO,MAAM,8BAA8B,QAAQ,IAAI;;AAGhE,SAAS,yBAAyB,OAAyB;CAC1D,OAAO,wBAAwB,MAAM;;AAGtC,SAAS,wBAAwB,OAAyB;CACzD,OACC,iBAAiB,gCAAgC,MAAM,WAAW,OAAO,MAAM,WAAW;;AAI5F,SAAS,kBAAkB,OAAyB;CACnD,OAAO,iBAAiB,+BAA+B,MAAM,WAAW;;AAYzE,SAAS,0BAA0B,OAAkD;CACpF,OACC,OAAO,UAAU,YACjB,UAAU,QACV,aAAa,SACb,OAAO,QAAQ,IAAI,OAAO,UAAU,KAAK;;AAI3C,SAAS,yBAAyB,OAAiD;CAClF,OACC,OAAO,UAAU,YACjB,UAAU,QACV,qBAAqB,SACrB,OAAO,QAAQ,IAAI,OAAO,kBAAkB,KAAK;;AAInD,SAAS,kCAAkC,gBAGhB;CAC1B,OAAO,eAAe,WACnB,cACA,eAAe,WAAW,cACzB,cACA;;AAGL,eAAe,oCAAoC,SAMjC;CACjB,MAAM,QAAQ;EACb,SAAS,QAAQ;EACjB,WAAW;EACX,GAAI,QAAQ,WAAW,EAAE,WAAW,yBAAyB,GAAG,EAAE;EAClE,MAAM;EACN,SAAS,QAAQ;EACjB,cAAc,KAAK,KAAK;EACxB,WAAW;EACX,QAAQ,QAAQ,WAAW,WAAW;EACtC,QAAQ,QAAQ;EAChB;CACD,IAAI;EACH,MAAM,QAAQ,mBAAmB,MAAM;UAC/B,OAAO;EACf,uBACC,wDAAwD,QAAQ,OAAO,WAAW,QAAQ,QAAQ,KAAK,mBAAmB,MAAM,GAChI;;;AAIH,SAAS,kBACR,aACA,cACc;CACd,IAAI,gBAAgB,KAAA,GACnB,OAAO;CAER,OAAO,YAAY,IAAI,CAAC,aAAa,aAAa,CAAC;;AAGpD,SAAS,mBACR,SAC0B;CAC1B,MAAM,iBAAiB,QAAQ,QAAQ,WAAkC,WAAW,KAAA,EAAU;CAC9F,IAAI,eAAe,WAAW,GAC7B;CAED,IAAI,eAAe,WAAW,GAC7B,OAAO,eAAe;CAEvB,OAAO,YAAY,IAAI,eAAe;;AAGvC,SAAS,2BAA2B,YAA4B;CAC/D,OAAO,qCAAqC,WAAW;;AAGxD,SAAS,0BAA8C;CACtD,MAAM,mBAAmB,QAAQ,IAAI,oBAAoB,MAAM;CAC/D,IAAI,kBACH,OAAO,KAAK,QAAQ,iBAAiB;CAEtC,MAAM,gBAAgB,QAAQ,IAAI,MAAM,MAAM;CAC9C,OAAO,gBAAgB,KAAK,KAAK,eAAe,aAAa,QAAQ,GAAG,KAAA;;AAGzE,SAAS,8BAAkD;CAC1D,MAAM,gBAAgB,QAAQ,IAAI,MAAM,MAAM;CAC9C,IAAI,CAAC,eACJ;CAED,MAAM,UAAU,QAAQ,IAAI,kBAAkB,MAAM,CAAC,aAAa;CAClE,OAAO,WAAW,YAAY,YAC3B,KAAK,KAAK,eAAe,aAAa,aAAa,UAAU,GAC7D,KAAK,KAAK,eAAe,aAAa,YAAY;;AAGtD,SAAS,0BAA0B,QAE1B;CACR,MAAM,WAAW,oCAAoC,OAAO,IAAI;CAChE,IAAI,UACH,MAAM,IAAI,MACT,sCAAsC,SAAS,IAAI,GAAG,SAAS,cAAc,aAAa,OAAO,OAAO,IAAI,SAAS,KAAK,CAAC,GAC3H;;AAIH,SAAgB,oCACf,SASA,cAa2C;CAC3C,MAAM,kCAAkB,IAAI,KAAoC;CAChE,MAAM,wCAAwB,IAAI,KAA6C;CAE/E,OAAO,OAAO,WAAW;EACxB,MAAM,YAAY,QAAQ,aAAa;EACvC,MAAM,UAAU,2BAA2B,OAAO,WAAW;EAC7D,0BAA0B,EACzB,KAAK,OAAO,KACZ,CAAC;EACF,MAAM,sBACL,QAAQ,uCAAuC,IAAI,6BAA6B;EACjF,MAAM,+BACL,wBAAwB,KAAA,IAAY,EAAE,GAAG,CAAC,oBAAoB;EAC/D,MAAM,kBAAkB,oCAAoC;GAC3D;GACA;GACA,gBAAgB,QAAQ,iCAAiC;GACzD,yBAAyB,OAAO;GAChC,UAAU,QAAQ,4BAA4B,IAAI,yBAAyB;GAC3E,CAAC;EACF,MAAM,aAAa,+BAA+B;GACjD,mBAAmB,gBAAgB;GACnC;GACA,WAAW,OAAO;GAClB,CAAC;EACF,MAAM,WAAW,mBAAmB;GACnC;GACA,QAAQ,QAAQ;GAChB,CAAC;EACF,MAAM,sBAAsB;GAC3B,mBAAmB,gBAAgB;GACnC,mBAAmB,WAAW;GAC9B;GACA;EACD,MAAM,cACL,aAAa,oBAAoB,EAChC,eAAe,QAAQ,eACvB,CAAC,IAAI,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAAC;EAClE,MAAM,qBAAqB,OAAO,UAA6C;GAC9E,MAAM,WAAW,MAAM,0BAA0B;IAChD,OAAO,GAAG,QAAQ,cAAc,QAAQ,SAAS,GAAG,CAAC,SAAS,mBAAmB,QAAQ,OAAO,CAAC;IACjG,MAAM;KACL,MAAM,KAAK,UAAU,MAAM;KAC3B,SAAS,EAAE,gBAAgB,oBAAoB;KAC/C,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,IAAI,CAAC,SAAS,IAAI;IACjB,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;IAC5C,MAAM,IAAI,MAAM,sCAAsC,OAAO,SAAS,OAAO,GAAG;;GAEjF,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;;EAE7C,MAAM,iBAAiB,OACtB,OACA,QACA,UACmB;GACnB,gBAAgB,OAAO,SAAS;GAChC,uBACC,gCAAgC,QAAQ,OAAO,WAAW,QAAQ,WAAW,MAAM,QAAQ,YAAY,OAAO,KAAK,mBAAmB,MAAM,GAC5I;GACD,MAAM,YACJ,aAAa,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC,CAC5C,OAAO,iBAA0B;IACjC,uBACC,oDAAoD,QAAQ,OAAO,WAAW,QAAQ,WAAW,MAAM,QAAQ,KAAK,mBAAmB,aAAa,GACpJ;KACA;;EAEJ,MAAM,cAAc,gBAAgB,IAAI,SAAS;EACjD,IAAI;EACJ,IAAI,aAAa;GAChB,4BAA4B;IAC3B;IACA;IACA,gBAAgB;IAChB,QAAQ,QAAQ;IAChB,CAAC;GACF,IAAI;IACH,MAAM,eAAe,MAAM,YAAY,WAAW,YAAY,MAAM,QAAQ;IAC5E,MAAM,+BAA+B;KACpC,aAAa;MACZ;MACA,SAAS,aAAa;MACtB,WAAW;MACX,SAAS;MACT,QAAQ,QAAQ;MAChB;KACD,WAAW,OAAO,WACjB,MAAM,aAAa,qBAAqB;MACvC,cAAc;MACd,QAAQ;MACR;MACA,KAAK,aAAa;MAClB,CAAC;KACH,eAAe;KACf,cAAc;KACd,WAAW;KACX,CAAC;IACF,QAAQ;IACR,gBAAgB,IAAI,UAAU;KAAE,GAAG;KAAqB;KAAO,CAAC;YACxD,OAAO;IACf,uBACC,gCAAgC,QAAQ,OAAO,WAAW,QAAQ,WAAW,YAAY,MAAM,QAAQ,KAAK,mBAAmB,MAAM,GACrI;IACD,IAAI,iBAAiB,8BACpB,MAAM,eAAe,YAAY,OAAO,MAAM,QAAQ,MAAM;SACtD,IAAI,yBAAyB,MAAM,EACzC,gBAAgB,OAAO,SAAS;SAEhC,MAAM;;;EAIT,IAAI,UAAU,KAAA,GAAW;GACxB,MAAM,uBAAuB,sBAAsB,IAAI,SAAS;GAChE,IAAI,yBAAyB,KAAA,GAAW;IACvC,MAAM,gBAAgB,MAAM;IAC5B,4BAA4B;KAC3B;KACA,aAAa;KACb,gBAAgB;KAChB,QAAQ,QAAQ;KAChB,CAAC;IACF,QAAQ,cAAc;UAChB;IAGN,MAAM,uBAAuB,YAA4C;KACxE,MAAM,gBAAgB,QAAQ,iCAAiC;KAC/D,IAAI,iBAAiB,YAAY,8BAChC,MAAM,YAAY,6BAA6B,cAAc;KAE9D,MAAM,gBAAgB,MAAM,YAAY,aAAa;MACpD;MACA,mBAAmB,gBAAgB;MACnC;MACA,YAAY,OAAO;MACnB,cAAc,WAAW;MACzB,QAAQ,QAAQ;MAChB,CAAC;KACF,IAAI,CAAC,iBAAiB,cAAc,EACnC,MAAM,IAAI,UAAU,wDAAwD;KAE7E,OAAO;MACN,GAAG;MACH,OAAO;MACP;QACE;IACJ,sBAAsB,IAAI,UAAU,oBAAoB;IACxD,IAAI;KACH,MAAM,aAAa,MAAM;KACzB,gBAAgB,IAAI,UAAU,WAAW;KACzC,QAAQ,WAAW;cACV;KACT,IAAI,sBAAsB,IAAI,SAAS,KAAK,qBAC3C,sBAAsB,OAAO,SAAS;;;;EAqB1C,OAhBe,2BAA2B;GACzC,KAAK,OAAO;GACZ,eAAe,QAAQ;GACvB,uBAAuB,aAAa;GACpC,mBAAmB,WAAW;GAC9B;GACA;GACA,sBAAsB,OAAO,QAAQ,UAAU;IAC9C,MAAM,eAAe,OAAO,QAAQ,MAAM;;GAE3C;GACA,sBAAsB,aAAa;GACnC,eAAe,aAAa;GAC5B,YAAY,OAAO;GACnB,QAAQ,QAAQ;GAChB,CACY;;;AAIf,SAAS,2BAA2B,SAiBH;CAChC,MAAM,wBAAwB,OAC7B,gBACoC;EACpC,IAAI;GACH,OAAO,MAAM,4BAA4B;IACxC;IACA,cAAc,OAAO,OAAe,YAAsD;KACzF,MAAM,QAAQ,YAAY,aAAa,QAAQ,MAAM,SAAS,OAAO,QAAQ;;IAE9E,oBAAoB,OAAO,OAAO,YACjC,MAAM,QAAQ,YAAY,mBAAmB,QAAQ,MAAM,SAAS,OAAO,QAAQ;IACpF,qBAAqB;IACrB,6BAA6B;IAC7B,gBAAgB,UAAyB;KACxC,uBACC,wCAAwC,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,MAAM,GACtH;;IAEF,sBAAsB,UAAyB;KAC9C,uBACC,yCAAyC,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,MAAM,GACvH;;IAEF,+BAA+B,OAAO,UAAyB;KAC9D,MAAM,QAAQ,qBAAqB,kCAAkC,MAAM;;IAE5E,gBAAgB,OACf,YAEA,MAAM,QAAQ,YAAY,eAAe,QAAQ,MAAM,SAAS,QAAQ;IACzE,CAAC;WACM,OAAO;GACf,IAAI,wBAAwB,MAAM,EACjC,MAAM,QAAQ,qBAAqB,kCAAkC,MAAM;GAE5E,MAAM;;;CAIR,MAAM,mBAAmB,OACxB,aACA,OACsB;EACtB,MAAM,kBAAkB,MAAM,sBAAsB,YAAY;EAChE,IAAI;GACH,MAAM,SAAS,MAAM,GAAG,gBAAgB;GACxC,MAAM,gBAAgB,QAAQ,YAAY;GAC1C,OAAO;WACC,OAAO;GACf,MAAM,gBACJ,QACA,iBAAiB,gCAAgC,MAAM,WAAW,0BAC/D,cACA,SACH,CACA,OAAO,iBAA0B;IACjC,uBACC,8DAA8D,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,aAAa,GACnJ;KACA;GACH,IAAI,iBAAiB,8BACpB,MAAM,QAAQ,qBAAqB,MAAM,QAAQ,MAAM;GAExD,MAAM;;;CAIR,MAAM,4BAAkF,OACvF,gBAEA,MAAM,iBACL;EACC,YAAY,QAAQ;EACpB,UAAU;EACV,EACD,OAAO,oBACN,MAAM,+BAA+B;EACpC,aAAa;GACZ,SAAS,QAAQ,MAAM;GACvB,SAAS,QAAQ,MAAM;GACvB,WAAW;GACX,SAAS,QAAQ;GACjB,QAAQ,QAAQ;GAChB;EACD,WAAW,OAAO,WAAW;GAC5B,MAAM,kBAAkB,mBAAmB;IAC1C,YAAY;IACZ,gBAAgB;IAChB;IACA,CAAC;GACF,OAAO,MAAM,QAAQ,qBAAqB;IACzC,GAAI,YAAY,iBAAiB,KAAA,IAC9B,EAAE,cAAc,YAAY,cAAc,GAC1C,EAAE;IACL,QAAQ,yBAAyB,YAAY,QAAQ,YAAY,KAAK;IACtE,GAAI,oBAAoB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,iBAAiB;IACpE,KAAK,QAAQ,MAAM;IACnB,GAAI,YAAY,UAAU,KAAA,IAAY,EAAE,OAAO,YAAY,OAAO,GAAG,EAAE;IACvE,CAAC;;EAEH,eAAe;EACf,SAAS,WAAW;GACnB,gBAAgB,OAAO,OAAO;;EAE/B,WAAW;EACX,CAAC,CACH;CAEF,MAAM,4BAA4B,OAAO,UAAkC;EAC1E,IAAI,0BAA0B,MAAM,EACnC,MAAM,MAAM,SAAS;;CAIvB,MAAM,4BAA4B,OACjC,OACA,YACmB;EACnB,IAAI;EACJ,IAAI;GACH,MAAM,0BAA0B,MAAM,WAAW;WACzC,OAAO;GACf,aAAa;;EAEd,IAAI;EACJ,IAAI;GACH,MAAM,MAAM,gBAAgB,QAAQ,QAAQ;WACpC,OAAO;GACf,iBAAiB;;EAElB,IAAI,YACH,MAAM;EAEP,IAAI,gBACH,MAAM;;CAIR,MAAM,iBAAiB,QAAQ,wBAAwB;EACtD,yBAAyB,QAAQ,MAAM;EACvC,oBAAoB,QAAQ;EAC5B,sBAAsB;EACtB,CAAC;CAEF,OAAO;EACN,GAAI,iBAAiB,EAAE,gBAAgB,GAAG,EAAE;EAC5C,GAAI,QAAQ,IAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,EAAE;EAClE,aAAa,GAAG,QAAQ,cAAc,IAAI,QAAQ,OAAO;EACzD,iBAAiB;EACjB,IAAI;EACJ,WAAW,QAAQ,MAAM;EACzB,cAAc,QAAQ,MAAM;EAC5B,SAAS,QAAQ;EACjB,eAAe,OAAO,eAAe;GACpC,MAAM,kBAAkB,MAAM,sBAAsB;IACnD,YAAY,QAAQ;IACpB,UAAU;IACV,CAAC;GACF,IAAI;IACH,MAAM,WAAW,MAAM,QAAQ,cAAc;KAC5C,SAAS,WAAW;KACpB,KAAK,WAAW;KAChB,KAAK,QAAQ,MAAM;KACnB,QAAQ,WAAW;KACnB,SAAS,WAAW,WAAW,QAAQ;KACvC,CAAC;IACF,OAAO;KACN,GAAG;KACH,eAAe;MACd;MACA,GAAI,SAAS,kBAAkB,KAAA,IAAY,EAAE,YAAY,SAAS,eAAe,GAAG,EAAE;MACtF;KACD;YACO,OAAO;IACf,MAAM,gBAAgB,QAAQ,SAAS,CAAC,OAAO,iBAA0B;KACxE,uBACC,kEAAkE,QAAQ,OAAO,WAAW,QAAQ,MAAM,QAAQ,KAAK,mBAAmB,aAAa,GACvJ;MACA;IACF,MAAM;;;EAGR,cAAc,OAAO,mBAAmB;GACvC,IAAI,yBAAyB,eAAe,MAAM,EAAE;IACnD,IAAI,eAAe,UAClB,eAAe,MAAM,gBAAgB,OAAO;KAC3C,cAAc,KAAK,KAAK;KACxB,OAAO;KACP,KAAK,EACJ,SAAS;MACR,MAAM;MACN,SAAS;MACT,EACD;KACD,CAAC;IAEH,MAAM,0BACL,eAAe,OACf,kCAAkC,eAAe,CACjD;IACD,oCAAyC;KACxC,SAAS,QAAQ,MAAM;KACvB,SAAS,QAAQ,MAAM;KACvB,oBAAoB,QAAQ;KAC5B,UAAU,eAAe;KACzB,QAAQ,QAAQ;KAChB,CAAC;IACF,IAAI,eAAe,UAClB,MAAM,QAAQ,qBAAqB,yBAAyB,KAAA,EAAU;IAEvE;;GAED,MAAM,0BAA0B,eAAe,MAAM;;EAEtD,iBAAiB,OAAO,kBACvB,MAAM,iBACL;GACC,YAAY,QAAQ;GACpB,UAAU;GACV,EACD,OAAO,oBACN,MAAM,+BAA+B;GACpC,aAAa;IACZ,SAAS,QAAQ,MAAM;IACvB,SAAS,QAAQ,MAAM;IACvB,WAAW;IACX,SAAS,QAAQ;IACjB,QAAQ,QAAQ;IAChB;GACD,WAAW,OAAO,WACjB,MAAM,QAAQ,qBAAqB;IAClC,QAAQ,cAAc;IACtB,QAAQ,kBAAkB,gBAAgB,QAAQ,OAAO;IACzD,KAAK,QAAQ,MAAM;IACnB,CAAC;GACH,eAAe;GACf,SAAS,WAAW;IACnB,gBAAgB,OAAO,OAAO;;GAE/B,WAAW;GACX,CAAC,CACH;EACF;;;;AC5rBF,SAAgB,oCACf,SAIA,cAMC;CACD,OAAO;EACN,iBAAiB,OAAO,WAAW;GAClC,MAAM,cACL,aAAa,oBAAoB,EAChC,eAAe,QAAQ,eACvB,CAAC,IAAI,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAAC;GAClE,IAAI;IAEH,OAAO;KAAE,kBAAkB;KAAM,SAAS,MADhB,YAAY,UAAU,OAAO,MAAM,cAAc,KACjB;KAAM;YACxD,OAAO;IACf,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KACvE,MAAM;IAEP,OAAO;KAAE,kBAAkB;KAAO,SAAS;KAAO;;;EAGpD,eAAe,OAAO,WAAW;GAKhC,OAHC,aAAa,oBAAoB,EAChC,eAAe,QAAQ,eACvB,CAAC,IAAI,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAAC,EAChD,aAAa,OAAO,MAAM,eAAe,EAAE,OAAO,MAAM,CAAC;;EAE5E;;;;ACzBF,SAASE,iBAAe,OAAkD;CACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,4BACf,QAC+B;CAC/B,IAAI,OAAO,OAAO,kBAAkB,YAAY,OAAO,OAAO,WAAW,UACxE,MAAM,IAAI,MAAM,4DAA4D;CAE7E,MAAM,+BAA+B,OAAO;CAC5C,MAAM,4BAA4BA,iBAAe,6BAA6B,GAC3E;EACA,gBACC,OAAO,6BAA6B,mBAAmB,WACpD,6BAA6B,iBAC7B;EACJ,SACC,OAAO,6BAA6B,YAAY,YAC7C,6BAA6B,UAC7B;EACJ,eACC,OAAO,6BAA6B,kBAAkB,WACnD,6BAA6B,gBAC7B;EACJ,GACA,KAAA;CAEH,OAAO;EACN,eAAe,OAAO;EACtB,GAAI,4BAA4B,EAAE,2BAA2B,GAAG,EAAE;EAClE,GAAI,OAAO,OAAO,cAAc,WAAW,EAAE,WAAW,OAAO,WAAW,GAAG,EAAE;EAC/E,GAAI,OAAO,OAAO,iBAAiB,WAAW,EAAE,cAAc,OAAO,cAAc,GAAG,EAAE;EACxF,GAAI,OAAO,OAAO,oBAAoB,WACnC,EAAE,iBAAiB,OAAO,iBAAiB,GAC3C,EAAE;EACL,QAAQ,OAAO;EACf;;;;ACpBF,SAAS,gBAAgB,SAAuB;CAC/C,QAAQ,OAAO,MAAM,kCAAkC,QAAQ,IAAI;;AAGpE,SAAS,QAAQ,SAAiB,MAAsB;CACvD,OAAO,GAAG,QAAQ,QAAQ,QAAQ,GAAG,GAAG;;AAGzC,SAAS,eAAe,SAIb;CACV,MAAM,aAAa,KAAK,KAAK,IAAI,QAAQ,yBAAyB,EAAE;CACpE,OAAO,KAAK,IAAI,QAAQ,eAAe,QAAQ,iBAAiB,WAAW;;AAG5E,SAAgB,gCACf,SAC4B;CAC5B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,WAAW,QAAQ,YAAY;CACrC,IAAI,0BAA0B;CAC9B,IAAI,UAAU;CACd,IAAI;CAEJ,MAAM,UAAU,OAAO,UAA6C;EACnE,MAAM,WAAW,MAAM,0BAA0B;GAChD;GACA,OAAO,QACN,QAAQ,eACR,UAAU,mBAAmB,QAAQ,OAAO,CAAC,gBAC7C;GACD,MAAM;IACL,MAAM,KAAK,UAAU,MAAM;IAC3B,SAAS,EAAE,gBAAgB,oBAAoB;IAC/C,QAAQ;IACR;GACD,WAAW;GACX,CAAC;EACF,IAAI,CAAC,SAAS,IAAI;GACjB,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;GAC5C,MAAM,IAAI,MAAM,sCAAsC,OAAO,SAAS,OAAO,GAAG;;EAEjF,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;;CAG7C,MAAM,qBAA2B;EAChC,IAAI,SACH;EAED,IAAI,OACH;EAED,QAAQ,qBACD;GACL,QAAQ,KAAA;GACR,MAAW,CAAC,QAAQ,aAAa;KAElC,eAAe;GACd,gBAAgB,QAAQ;GACxB;GACA,eAAe,QAAQ;GACvB,CAAC,CACF;EACD,MAAM,SAAS;;CAGhB,MAAM,OAAO,YAA2B;EACvC,MAAM,cAAc,QAAQ,KAAK;EACjC,IAAI;EACJ,IAAI;GACH,MAAM,WAAW,MAAM,0BAA0B;IAChD;IACA,OAAO,QAAQ,QAAQ,eAAe,6BAA6B,KAAK;IACxE,MAAM,EAAE,QAAQ,OAAO;IACvB,WAAW;IACX,CAAC;GACF,MAAM,KAAK,SAAS;GACpB,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;GAC5C,0BAA0B,KAAK,IAAI,0BAA0B;GAC7D,QAAQ;IACP,gBAAgB,6BAA6B;IAC7C,gBAAgB,6BAA6B;IAC7C,WAAW,QAAQ,KAAK,GAAG;IAC3B,MAAM;IACN,cAAc,QAAQ,KAAK;IAC3B,WAAW,6BAA6B;IACxC,MAAM,6BAA6B;IACnC,QAAQ,KAAK,OAAO;IACpB,QAAQ,QAAQ;IAChB;WACO,OAAO;GACf,2BAA2B;GAC3B,QAAQ;IACP,gBAAgB,6BAA6B;IAC7C,gBAAgB,6BAA6B;IAC7C,WAAW,QAAQ,KAAK,GAAG;IAC3B,MAAM;IACN,cAAc,QAAQ,KAAK;IAC3B,WAAW,6BAA6B;IACxC,MAAM,6BAA6B;IACnC,QACC,iBAAiB,yCACjB,MAAM,SAAS,+BACZ,YACA;IACJ,QAAQ,QAAQ;IAChB;GACD,SACC,2EAA2E,OAAO,MAAM,UAAU,CAAC,aAAa,iBAAiB,wCAAwC,MAAM,OAAO,8BACtL;;EAEF,IAAI;GAIH,MAAM,QAAQ,MAAM;WACZ,OAAO;GACf,SACC,gFAAgF,OAAO,MAAM,UAAU,CAAC,aAAa,iBAAiB,wCAAwC,MAAM,OAAO,8BAA8B,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAC1R;;;CAIH,OAAO;EACN,+BAA+B;EAC/B,0BAA0B;GACzB,2BAA2B;;EAE5B,aAAa;GACZ,UAAU;GACV,cAAc;;EAEf,YAAY;GACX,UAAU;GACV,IAAI,CAAC,OACJ;GAED,iBAAiB,MAAM;GACvB,QAAQ,KAAA;;EAET;EACA;;;;ACxKF,MAAa,oCAAoC;AAEjD,SAAgB,kBAAkB,KAMhC;CACD,OAAO;EACN,eAAe,OAAO,EAAE,SAAS,KAAK,KAAK,UAAU,QAAQ,cAAc;GAC1E,MAAM,UAAU,MAAM,IAAI,oCAAoC;IAC7D,SAAS;IACT,cAAc,SAAS;IACvB,uBAAuB;IACvB,QAAQ,GAAG,SAAS,KAAK,GAAG,SAAS,KAAK,GAAG,SAAS;IACtD,gBAAgB;IAChB,eAAe;IACf,CAAC;GACF,MAAM,2BAA2B,IAAI;GACrC,OAAO;IACN,MAAM,IAAI,oBAAoB;KAC7B,eAAe,IAAI,uBAAuB;MACzC;MACA;MACA;MACA,CAAC;KACF;KACA,KAAK;KACL,CAAC;IACF,KAAK,IAAI,gBAAgB,QAAQ,IAAI,CAAC;IACtC,eAAe;KACd,SAAS,YAA2B;MACnC,IAAI,0BACH,MAAM,yBAAyB,QAAQ;;KAGzC;KACA;IACD,WAAW;IACX;;EAEF,wBACE,kBACA,WACA,IAAI,iCAAiC;GACpC,SAAS,OAAO;GAChB,SAAS;IACR,yBAAyB,aAAa;IACtC,oBAAoB,aAAa;IACjC,sBAAsB,aAAa;IACnC;GACD,CAAC;EACJ,sBAAsB,OAAO,EAAE,cAAc,QAAQ,QAAQ,KAAK,UAAU,YAAY;GACvF,MAAM,UAAU,MAAM,IAAI,oCAAoC;IAC7D,SAAS;IACT,cAAc,SAAS;IACvB,uBAAuB;IACvB,QAAQ,GAAG,SAAS,KAAK,GAAG,SAAS,KAAK,GAAG,SAAS;IACtD,gBAAgB;IAChB,eAAe;IACf,CAAC;GACF,OAAO,MAAM,IAAI,qBAAqB;IACrC,GAAI,iBAAiB,KAAA,IAAY,EAAE,cAAc,GAAG,EAAE;IACtD,eAAe,IAAI,mBAAmB;KAAC;KAAW;KAAM;KAAQ;KAAsB,CAAC;IACvF;IACA,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;IAC1C,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACxC,CAAC;;EAEH;;;;AChDF,SAAS,eAAe,OAAkD;CACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,uBAAuB,QAG5B;CACH,MAAM,gBAAgB,OAAO,QAAQ,YAAY,EAAE;CACnD,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,EAAE,EAC7C,OAAO,eAAe,CACtB,KAAK,aAAa,gBAAgB;EAClC,QAAQ;EACR,OACC,OAAO,YAAY,OAAO,WACvB,SAAS,YAAY,OACrB,SAAS,OAAO,WAAW;EAC/B,EAAE;CACJ,OAAO,CAAC;EAAE,QAAQ;EAAe,OAAO;EAAY,EAAE,GAAG,aAAa;;AAGvE,SAAS,mBACR,UACA,aACU;CACV,OAAO,YAAY,aAAa,SAAS;;AAG1C,SAAS,mBAAmB,SAMU;CACrC,MAAM,KAAK,QAAQ,gBAAgB,QAAQ;CAC3C,OAAO;EACN,IAAI,2CAA2C;GAC9C,WAAW,QAAQ;GACnB,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB,CAAC;EACF;EACA,MAAM,sCAAsC;GAC3C,eAAe,QAAQ;GACvB,WAAW,QAAQ;GACnB;GACA,CAAC;EACF;;AAGF,SAAgB,iCAAiC,SAGjB;CAC/B,MAAM,SAAgC,QAAQ;CAC9C,MAAM,WAAW,OAAO,QAAQ,YAAY,EAAE;CAC9C,OAAO;EACN,UAAU;EACV,QAAQ,QAAQ;EAChB,UAAU,uBAAuB,OAAO,CAAC,SAAS,EAAE,QAAQ,aAAa,YAAY;GACpF,MAAM,YAAY,mBAAmB,UAAU,YAAY;GAC3D,MAAM,sBAAsB,uCAAuC,KAAK,gBACvE,mBAAmB;IAClB,aAAa,sCACZ,UACA,aACA,YAAY,IACZ;IACD,eAAe,YAAY;IAC3B,WAAW,2CAA2C,OAAO,YAAY,IAAI;IAC7E;IACA,QAAQ,QAAQ;IAChB,CAAC,CACF;GACD,MAAM,mBAAmB;IACxB,IAAI,8BAA8B,QAAQ,OAAO,GAAG;IACpD,IAAI,cAAc;IAClB,MACC,cAAc,UACX,wFACA,OAAO,cAAc,WACpB,YACA;IACL;GACD,OAAO,oBAAoB,OAAO,iBAAiB;IAClD;EACF;;;;AC9BF,SAAgB,eAAe,OAY7B;CACD,IAAI,OAAO,UAAU,YAAY,UAAU,MAC1C,MAAM,IAAI,UAAU,uCAAuC;CAG5D,KAAK,MAAM,cAAc;EACxB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,EACA,IAAI,OAAQ,MAAkC,gBAAgB,YAC7D,MAAM,IAAI,UAAU,yCAAyC,aAAa;;;;ACnG7E,MAAM,0BAA0B;AAEhC,SAAS,iBAAiB,OAAwB;CACjD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,kBAAkB,QACtE,MAAM,IAAI,MAAM,uCAAuC;CAExD,MAAM,eAAe,MAAM;CAC3B,IAAI,OAAO,iBAAiB,YAAY,aAAa,WAAW,GAC/D,MAAM,IAAI,MAAM,uCAAuC;CAExD,OAAO;;AAGR,SAAS,mBAAmB,eAAuB,QAAwB;CAC1E,OAAO,GAAG,cAAc,QAAQ,QAAQ,GAAG,CAAC,SAAS,mBAAmB,OAAO,CAAC;;AAGjF,eAAe,iBAAiB,UAAqC;CACpE,IAAI;EACH,OAAO,MAAM,SAAS,MAAM;UACpB,OAAO;EACf,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;;AAI/D,SAAS,iBAAiB,cAA+B;CACxD,IAAI;EACH,OAAO,KAAK,MAAM,aAAa;UACvB,OAAO;EACf,MAAM,IAAI,MAAM,6CAA6C,aAAa,MAAM,GAAG,IAAI,IAAI,EAC1F,OAAO,OACP,CAAC;;;AAIJ,SAAgB,oBAAoB,SAA2C;CAC9E,QAAQ,IAAI,aACX;EACC,MAAM;EACN,aACC;EACD,YAAY;GACX,MAAM;GACN,sBAAsB;GACtB,YAAY,EACX,cAAc,EAAE,MAAM,UAAU,EAChC;GACD,UAAU,CAAC,eAAe;GAC1B;EACD,SAAS,OAAO,aAAqB,UAAmB;GACvD,MAAM,eAAe,iBAAiB,MAAM;GAC5C,MAAM,WAAW,MAAM,0BAA0B;IAChD,WAAW,QAAQ,aAAa;IAChC,OAAO,mBAAmB,QAAQ,eAAe,QAAQ,OAAO;IAChE,MAAM;KACL,MAAM,KAAK,UAAU,EAAE,cAAc,CAAC;KACtC,SAAS;MACR,gBAAgB;MAChB,GAAI,QAAQ,eAAe,GAAG,0BAA0B,QAAQ,cAAc,GAAG,EAAE;MACnF;KACD,QAAQ;KACR;IACD,WAAW;IACX,CAAC;GACF,MAAM,eAAe,MAAM,iBAAiB,SAAS;GACrD,IAAI,CAAC,SAAS,IACb,MAAM,IAAI,MAAM,yBAAyB,SAAS,OAAO,GAAG,aAAa,MAAM,GAAG,IAAI,GAAG;GAE1F,MAAM,UAAU,iBAAiB,aAAa;GAC9C,OAAO;IACN,SAAS,KAAK,UAAU,QAAQ;IAChC,SAAS;IACT;;EAEF,EACD;EAAE,MAAM;EAAiB,UAAU;EAAM,CACzC;;;;ACvEF,eAAe,qBAAqB,SAGlB;CAEjB,MADoB,kBAAkB,EAAE,eAAe,QAAQ,eAAe,CAC7D,CAAC,+BAA+B,QAAQ,OAAO;;AAGjE,MAAM,SAAS;CACd,IAAI;CACJ,MAAM;CACN,aAAa;CAEb,SAAS,KAUA;EACR,MAAM,eAAe,IAAI;EACzB,IAAI,OAAO,iBAAiB,YAAY;GACvC,IAAI,IAAI,qBAAqB,QAC5B,MAAM,IAAI,MAAM,6DAA6D;GAE9E;;EAED,MAAM,eAAe,4BAA4B,IAAI,aAAa;EAClE,MAAM,eACL,aAAa,iBACZ,aAAa,kBAAkB,QAAQ,IAAI,aAAa,mBAAmB,KAAA;EAC7E,oBAAoB;GACnB,KAAK,EAAE,cAAc;GACrB,eAAe,aAAa;GAC5B,GAAI,eAAe,EAAE,cAAc,GAAG,EAAE;GACxC,QAAQ,aAAa;GACrB,CAAC;EACF,IAAI,IAAI,qBAAqB,QAC5B;EAED,IAAI,aAAa,2BAA2B,SAC3C,gCAAgC;GAC/B,gBAAgB,aAAa,0BAA0B;GACvD,eAAe,aAAa;GAC5B,eAAe,aAAa,0BAA0B;GACtD,WAAW,KAAK,KAAK;GACrB,QAAQ,aAAa;GACrB,CAAC,CAAC,OAAO;EAEX,MAAM,2BAEU;GACf,MAAM,gBAAgB,IAAI,SAAS,QAAQ,WAAW,IAAI,IAAI;GAC9D,OAAO,gBACJ,iCAAiC;IACjC,QAAQ;IACR,QAAQ,aAAa;IACrB,CAAC,GACD,KAAA;;EAEJ,MAAM,uBAAuB,oBAAoB;EACjD,IAAI,sBACH,qBAA0B;GACzB,eAAe,aAAa;GAC5B,QAAQ;GACR,CAAC,CAAC,OAAO,UAAmB;GAC5B,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM;GAC9E,QAAQ,OAAO,MAAM,yDAAyD,QAAQ,IAAI;IACzF;EAsCH,OAlC0B,gCAAS,MAAM,WAAoC;GAC5E,eAAe,OAAO;GAmBtB,MAAM,sBAAsB,kBAAkB;IAhB7C,wBAAwB,OAAO;IAC/B,oBAAoB,OAAO;IAC3B,qBAAqB,OAAO;IAC5B,kCAAkC,OAAO;IACzC,qCAAqC,OAAO;IAC5C,GAAI,OAAO,OAAO,6BAA6B,aAC5C,EACA,0BAA0B,OAAO,0BAGjC,GACA,EAAE;IACL,sBAAsB,OAAO;IAC7B,iBAAiB,OAAO;IAG+B,CAAC;GACzD,OAAO,uBAAuB,YAAY;IACzC,SAAS,oCACR;KACC,GAAG;KACH,qCAAqC,IAAI,SAAS,QAAQ,WAAW,IAAI,IAAI;KAC7E,+BAA+B;KAC/B,EACD,oBACA;IACD,SAAS,oCAAoC,cAAc,oBAAoB;IAC/E,CAAC;IAGO,CAAC,OAAO,UAAmB;GACpC,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM;GAC9E,QAAQ,OAAO,MAAM,2CAA2C,QAAQ,IAAI;IAC3E;;CAEH;;;AChHD,SAAgB,qCACf,SACkC;CAClC,MAAM,QAAQ;EACb,mBAAmB,QAAQ;EAC3B,GAAI,QAAQ,YAAY,KAAA,IAAY,EAAE,GAAG,EAAE,SAAS,QAAQ,SAAS;EACrE,QAAQ,QAAQ;EAChB,MAAM;EACN,cAAc,QAAQ;EACtB,QAAQ,+BAA+B,QAAQ,OAAO;EACtD,GAAI,QAAQ,0BAA0B,KAAA,IACnC,EAAE,GACF,EAAE,uBAAuB,QAAQ,uBAAuB;EAC3D,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,kBAAkB,QAAQ,kBAAkB;EACjD,QAAQ,QAAQ;EAChB;CACD,IAAI,CAAC,qBAAqB,MAAM,EAC/B,MAAM,IAAI,MACT,mGACA;CAEF,OAAO;;AAGR,SAAS,+BACR,QAC0B;CAC1B,QAAQ,QAAR;EACC,KAAK;EACL,KAAK,iBACJ,OAAO;EACR,KAAK;EACL,KAAK,2BACJ,OAAO;;CAET,OAAO,sCAAsC,OAAO;;AAGrD,SAAS,sCAAsC,QAAsB;CACpE,MAAM,IAAI,MAAM,4CAA4C,OAAO,OAAO,GAAG;;;;ACrD9E,MAAa,wCAAwC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/openclaw-agent-vm-plugin",
-  "version": "0.0.92",
+  "version": "0.0.93",
   "description": "OpenClaw sandbox-backend plugin that delegates execution to a Gondolin-managed VM.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "zod": "^4.4.3",
-    "@agent-vm/gondolin-adapter": "0.0.92",
-    "@agent-vm/gateway-interface": "0.0.92"
+    "@agent-vm/gateway-interface": "0.0.93",
+    "@agent-vm/gondolin-adapter": "0.0.93"
   },
   "scripts": {
     "build": "tsdown && cp openclaw.plugin.json sdk-validate.mjs dist/",