@finalai/agent-provider 0.1.0

package/dist/modules/sandbox/testing.mjs

@@ -0,0 +1,64 @@
+import {
+  connectSandboxClient
+} from "./client.mjs";
+import {
+  createHandleRpcMessageHandler,
+  serveSandboxHandle
+} from "./server.mjs";
+import { createFrameChannelPair } from "./wire.mjs";
+const allowAllTokens = async () => ({ expiresAt: null });
+const createInMemoryHandleNetwork = () => {
+  const endpoints = /* @__PURE__ */ new Map();
+  const open = /* @__PURE__ */ new Set();
+  const dialLog = [];
+  const network = {
+    serve: (args) => {
+      const server = serveSandboxHandle({
+        sandbox: args.sandbox,
+        handle: args.handle,
+        authorize: args.authorize ?? allowAllTokens,
+        access: args.access,
+        binary: args.binary,
+        mcpChannels: args.mcpChannels
+      });
+      endpoints.set(args.url, (channel, token) => {
+        server.attach(channel, { token });
+      });
+    },
+    mount: (url, options) => {
+      endpoints.set(url, (channel, token) => {
+        const handler = createHandleRpcMessageHandler({
+          ...options,
+          connectionToken: token,
+          send: (frame) => channel.send(frame),
+          close: (code, reason) => channel.close(code, reason)
+        });
+        channel.listen({
+          frame: (frame) => handler.onFrame(frame),
+          close: (info) => handler.onClose(info.code, info.reason)
+        });
+      });
+    },
+    openChannel: async (target) => {
+      dialLog.push(target.url);
+      const endpoint = endpoints.get(target.url);
+      if (endpoint == null) throw new Error(`nothing listens at ${target.url}`);
+      const [client, server] = createFrameChannelPair();
+      open.add(client);
+      endpoint(server, target.token);
+      return client;
+    },
+    connect: (args) => connectSandboxClient({ ...args, openChannel: network.openChannel }),
+    dropAll: () => {
+      for (const channel of open) channel.close(1006, "network drop");
+      open.clear();
+    },
+    dials: () => [...dialLog]
+  };
+  return network;
+};
+export {
+  allowAllTokens,
+  createInMemoryHandleNetwork
+};
+//# sourceMappingURL=testing.mjs.map

package/dist/modules/sandbox/testing.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/sandbox/testing.ts"],
+  "sourcesContent": ["import {\n  connectSandboxClient,\n  type ConnectSandboxClientArgsIface,\n  type SandboxClientIface,\n} from \"./client.mjs\";\nimport {\n  createHandleRpcMessageHandler,\n  serveSandboxHandle,\n  type HandleAccessPolicyIface,\n  type HandleAuthorizeFn,\n  type HandleLifecycle,\n  type HandleRpcMessageHandlerOptionsIface,\n} from \"./server.mjs\";\nimport type { NetworkSandboxSessionIface } from \"./types.mjs\";\nimport { createFrameChannelPair, type FrameChannelIface } from \"./wire.mjs\";\n\n// In-memory hosting for the handle RPC: routes dial URLs to in-process\n// endpoints over frame channel pairs. Used by tests and the conformance kit.\n\nexport interface InMemoryHandleNetworkIface {\n  // Serves `sandbox` at `url`.\n  serve(args: {\n    url: string;\n    sandbox: NetworkSandboxSessionIface;\n    handle?: HandleLifecycle;\n    authorize?: HandleAuthorizeFn;\n    access?: HandleAccessPolicyIface;\n    binary?: boolean;\n    mcpChannels?: boolean;\n  }): void;\n  // Mounts a raw message handler at `url` (a stable endpoint that starts the\n  // sandbox on the first connection).\n  mount(\n    url: string,\n    options: Omit<HandleRpcMessageHandlerOptionsIface, 'send' | 'close' | 'connectionToken'>,\n  ): void;\n  openChannel(target: { url: string; token: string }): Promise<FrameChannelIface>;\n  connect(args: Omit<ConnectSandboxClientArgsIface, 'openChannel'>): Promise<SandboxClientIface>;\n  // Closes every connection the network opened (simulates a network drop).\n  dropAll(): void;\n  dials(): string[];\n}\n\nexport const allowAllTokens: HandleAuthorizeFn = async () => ({ expiresAt: null });\n\nexport const createInMemoryHandleNetwork = (): InMemoryHandleNetworkIface => {\n  const endpoints = new Map<string, (channel: FrameChannelIface, token: string) => void>();\n  const open = new Set<FrameChannelIface>();\n  const dialLog: string[] = [];\n  const network: InMemoryHandleNetworkIface = {\n    serve: (args) => {\n      const server = serveSandboxHandle({\n        sandbox: args.sandbox,\n        handle: args.handle,\n        authorize: args.authorize ?? allowAllTokens,\n        access: args.access,\n        binary: args.binary,\n        mcpChannels: args.mcpChannels,\n      });\n      endpoints.set(args.url, (channel, token) => {\n        server.attach(channel, { token });\n      });\n    },\n    mount: (url, options) => {\n      endpoints.set(url, (channel, token) => {\n        const handler = createHandleRpcMessageHandler({\n          ...options,\n          connectionToken: token,\n          send: (frame) => channel.send(frame),\n          close: (code, reason) => channel.close(code, reason),\n        });\n        channel.listen({\n          frame: (frame) => handler.onFrame(frame),\n          close: (info) => handler.onClose(info.code, info.reason),\n        });\n      });\n    },\n    openChannel: async (target) => {\n      dialLog.push(target.url);\n      const endpoint = endpoints.get(target.url);\n      if (endpoint == null) throw new Error(`nothing listens at ${target.url}`);\n      const [client, server] = createFrameChannelPair();\n      open.add(client);\n      endpoint(server, target.token);\n      return client;\n    },\n    connect: (args) => connectSandboxClient({ ...args, openChannel: network.openChannel }),\n    dropAll: () => {\n      for (const channel of open) channel.close(1006, 'network drop');\n      open.clear();\n    },\n    dials: () => [...dialLog],\n  };\n  return network;\n};\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAKK;AAEP,SAAS,8BAAsD;AA6BxD,MAAM,iBAAoC,aAAa,EAAE,WAAW,KAAK;AAEzE,MAAM,8BAA8B,MAAkC;AAC3E,QAAM,YAAY,oBAAI,IAAiE;AACvF,QAAM,OAAO,oBAAI,IAAuB;AACxC,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAsC;AAAA,IAC1C,OAAO,CAAC,SAAS;AACf,YAAM,SAAS,mBAAmB;AAAA,QAChC,SAAS,KAAK;AAAA,QACd,QAAQ,KAAK;AAAA,QACb,WAAW,KAAK,aAAa;AAAA,QAC7B,QAAQ,KAAK;AAAA,QACb,QAAQ,KAAK;AAAA,QACb,aAAa,KAAK;AAAA,MACpB,CAAC;AACD,gBAAU,IAAI,KAAK,KAAK,CAAC,SAAS,UAAU;AAC1C,eAAO,OAAO,SAAS,EAAE,MAAM,CAAC;AAAA,MAClC,CAAC;AAAA,IACH;AAAA,IACA,OAAO,CAAC,KAAK,YAAY;AACvB,gBAAU,IAAI,KAAK,CAAC,SAAS,UAAU;AACrC,cAAM,UAAU,8BAA8B;AAAA,UAC5C,GAAG;AAAA,UACH,iBAAiB;AAAA,UACjB,MAAM,CAAC,UAAU,QAAQ,KAAK,KAAK;AAAA,UACnC,OAAO,CAAC,MAAM,WAAW,QAAQ,MAAM,MAAM,MAAM;AAAA,QACrD,CAAC;AACD,gBAAQ,OAAO;AAAA,UACb,OAAO,CAAC,UAAU,QAAQ,QAAQ,KAAK;AAAA,UACvC,OAAO,CAAC,SAAS,QAAQ,QAAQ,KAAK,MAAM,KAAK,MAAM;AAAA,QACzD,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,IACA,aAAa,OAAO,WAAW;AAC7B,cAAQ,KAAK,OAAO,GAAG;AACvB,YAAM,WAAW,UAAU,IAAI,OAAO,GAAG;AACzC,UAAI,YAAY,KAAM,OAAM,IAAI,MAAM,sBAAsB,OAAO,GAAG,EAAE;AACxE,YAAM,CAAC,QAAQ,MAAM,IAAI,uBAAuB;AAChD,WAAK,IAAI,MAAM;AACf,eAAS,QAAQ,OAAO,KAAK;AAC7B,aAAO;AAAA,IACT;AAAA,IACA,SAAS,CAAC,SAAS,qBAAqB,EAAE,GAAG,MAAM,aAAa,QAAQ,YAAY,CAAC;AAAA,IACrF,SAAS,MAAM;AACb,iBAAW,WAAW,KAAM,SAAQ,MAAM,MAAM,cAAc;AAC9D,WAAK,MAAM;AAAA,IACb;AAAA,IACA,OAAO,MAAM,CAAC,GAAG,OAAO;AAAA,EAC1B;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/sandbox/types.d.mts

@@ -0,0 +1,352 @@
+import type { ProcessInspectionRequestIface, ProcessInspectionResultIface } from '@finalai/agent-protocol/process-inspection';
+import type { JsonValue } from "../json.mjs";
+import type { ToolDescriptorIface } from "../manifest.mjs";
+import type { SandboxEditorRequestIface, SandboxEditorResultIface } from "./editor.mjs";
+import { type AwaitableSandboxOpenRequestIface } from "./open-scope.mjs";
+import type { SandboxSnapshotRequestIface, SandboxSnapshotResponseIface } from "./snapshots.mjs";
+export interface AbortableIface {
+    abortSignal?: AbortSignal;
+}
+export interface SandboxProcessOptionsIface extends AbortableIface {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+    shell?: boolean;
+    stdin?: ReadableStream<Uint8Array> | string;
+    timeoutMs?: number;
+}
+export interface SandboxProcessIface {
+    readonly pid: string | null;
+    readonly stdout: ReadableStream<Uint8Array>;
+    readonly stderr: ReadableStream<Uint8Array>;
+    write(data: Uint8Array | string, options?: {
+        end?: boolean;
+    }): Promise<void>;
+    wait(): Promise<{
+        exitCode: number;
+    }>;
+    kill(signal?: string): Promise<void>;
+}
+export interface SandboxRunResultIface {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export declare enum SandboxEntryType {
+    File = "file",
+    Directory = "directory",
+    Symlink = "symlink",
+    Other = "other"
+}
+export interface StatIface {
+    path: string;
+    type: SandboxEntryType;
+    size: number;
+    modifiedAt: string | null;
+    mode: number | null;
+}
+export interface DirEntryIface {
+    name: string;
+    path: string;
+    type: SandboxEntryType;
+    size: number | null;
+}
+export interface ConfinedSandboxFilesIface {
+    readFile(options: {
+        path: string;
+        root: string;
+    } & AbortableIface): Promise<ReadableStream<Uint8Array> | null>;
+    stat(options: {
+        path: string;
+        root: string;
+    } & AbortableIface): Promise<StatIface | null>;
+    readDir(options: {
+        path: string;
+        root: string;
+    } & AbortableIface): Promise<DirEntryIface[] | null>;
+}
+export interface SandboxSessionIface {
+    readonly description: string;
+    readonly confinedFileReader?: ConfinedSandboxFilesIface;
+    readFile(options: {
+        path: string;
+        root?: string;
+    } & AbortableIface): Promise<ReadableStream<Uint8Array> | null>;
+    readBinaryFile(options: {
+        path: string;
+    } & AbortableIface): Promise<Uint8Array | null>;
+    readTextFile(options: {
+        path: string;
+        encoding?: string;
+        startLine?: number;
+        endLine?: number;
+    } & AbortableIface): Promise<string | null>;
+    writeFile(options: {
+        path: string;
+        content: ReadableStream<Uint8Array>;
+    } & AbortableIface): Promise<void>;
+    writeBinaryFile(options: {
+        path: string;
+        content: Uint8Array;
+    } & AbortableIface): Promise<void>;
+    writeTextFile(options: {
+        path: string;
+        content: string;
+        encoding?: string;
+    } & AbortableIface): Promise<void>;
+    spawn(options: SandboxProcessOptionsIface): Promise<SandboxProcessIface>;
+    run(options: SandboxProcessOptionsIface): Promise<SandboxRunResultIface>;
+    stat(options: {
+        path: string;
+        root?: string;
+    } & AbortableIface): Promise<StatIface | null>;
+    readDir(options: {
+        path: string;
+        root?: string;
+    } & AbortableIface): Promise<DirEntryIface[]>;
+    resolvePath(path: string): string;
+    removePath(options: {
+        path: string;
+        recursive?: boolean;
+        force?: boolean;
+    } & AbortableIface): Promise<void>;
+}
+export declare enum NetworkPolicy {
+    AllowAll = "allow-all",
+    DenyAll = "deny-all",
+    Allowlist = "allowlist"
+}
+export interface NetworkPolicyIface {
+    mode: NetworkPolicy;
+    allow?: string[];
+}
+export declare enum PortProtocol {
+    Http = "http",
+    Https = "https",
+    Ws = "ws"
+}
+export interface McpEndpointIface {
+    name: string;
+    url: string;
+    headers: Record<string, string>;
+}
+export interface McpChannelIface {
+    send(message: JsonValue, options?: AbortableIface): Promise<void>;
+    receive(options?: AbortableIface): Promise<JsonValue[]>;
+    close(): Promise<void>;
+}
+export interface McpChannelEndpointIface {
+    name: string;
+    connect(options?: AbortableIface): Promise<McpChannelIface>;
+}
+export type SandboxMcpEndpoint = McpEndpointIface | McpChannelEndpointIface;
+export interface SandboxMcpCatalogIface {
+    computerUse: ToolDescriptorIface[] | null;
+    localMcp: Record<string, ToolDescriptorIface[]> | null;
+}
+export declare const isMcpChannelEndpoint: (endpoint: SandboxMcpEndpoint) => endpoint is McpChannelEndpointIface;
+export interface ScreenOptionsIface {
+    viewOnly?: boolean;
+}
+export interface ScreenSessionIface {
+    url: string;
+    token: string;
+    expiresAt: string;
+}
+export interface NetworkSandboxSessionIface extends SandboxSessionIface {
+    readonly id: string;
+    readonly defaultWorkingDirectory: string;
+    readonly ports: readonly number[];
+    getPortEndpoint(options: {
+        port: number;
+        protocol?: PortProtocol;
+    }): Promise<{
+        url: string;
+        headers?: Record<string, string>;
+    }>;
+    getPortUrl(options: {
+        port: number;
+        protocol?: PortProtocol;
+    }): Promise<string>;
+    stop(): Promise<void>;
+    destroy(): Promise<void>;
+    setNetworkPolicy?(policy: NetworkPolicyIface): Promise<void>;
+    computerUse?(): Promise<SandboxMcpEndpoint>;
+    screen?(options?: ScreenOptionsIface): Promise<ScreenSessionIface>;
+    localMcp?(): Promise<SandboxMcpEndpoint[]>;
+}
+export declare enum SandboxCapability {
+    Files = "files",
+    Process = "process",
+    Ports = "ports",
+    NetworkPolicy = "networkPolicy",
+    ComputerUse = "computerUse",
+    Screen = "screen",
+    LocalMcp = "localMcp",
+    Browser = "browser"
+}
+export interface SandboxProviderHandleIface<S extends SandboxSessionIface> {
+    readonly sandbox: S;
+    onSandboxStop(): Promise<void>;
+    onSandboxDelete(options?: {
+        reason?: string;
+    }): Promise<void>;
+    onRuntimeShutdown(): Promise<void>;
+}
+export interface SandboxGuideVersionIface {
+    guideId: string;
+    versionId: string;
+    slug: string;
+    title: string;
+    number: number;
+    image: string;
+    templateConfig: JsonValue;
+    defaultParameters: JsonValue;
+    instructionsMarkdown: string | null;
+    preparedArtifact?: {
+        providerRef: string;
+        key: string;
+        artifact: JsonValue;
+    };
+}
+export interface SandboxGuidesIface {
+    get(args: {
+        ref: string;
+        version: number | 'latest';
+    }): Promise<SandboxGuideVersionIface | null>;
+    default(): Promise<SandboxGuideVersionIface | null>;
+}
+export interface SandboxRepositoryCloneSourceIface {
+    url: string;
+    ref: string | null;
+    authorization: string | null;
+}
+export interface SandboxRepositoriesIface {
+    cloneSource(args: {
+        repository: string;
+        ref: string | null;
+    }): Promise<SandboxRepositoryCloneSourceIface | null>;
+}
+export interface SandboxVariablesIface {
+    get(name: string): Promise<string | null>;
+}
+export declare const noSandboxGuides: SandboxGuidesIface;
+export declare const noSandboxRepositories: SandboxRepositoriesIface;
+export declare const noSandboxVariables: SandboxVariablesIface;
+export interface SandboxActingUserIface {
+    current(): Promise<string | null>;
+}
+export declare const noSandboxActingUser: SandboxActingUserIface;
+export interface SandboxOfferContextIface {
+    organizationId: string;
+    actingUser: SandboxActingUserIface;
+}
+export interface SandboxEnvironmentContextIface {
+    organizationId: string;
+    guides: SandboxGuidesIface;
+}
+export interface SandboxArtifactsIface {
+    get(key: string): Promise<JsonValue | null>;
+    put(key: string, artifact: JsonValue): Promise<void>;
+}
+export interface SandboxPreparationSourceIface {
+    sourceRevision: string;
+    read(): Promise<{
+        files: Record<string, string>;
+        resources: Record<string, JsonValue>;
+    }>;
+}
+export interface SandboxPrepareContextIface {
+    preparation?: SandboxPreparationSourceIface;
+    artifacts?: SandboxArtifactsIface;
+    files: Record<string, string>;
+    resources: Record<string, JsonValue>;
+    sourceRevision: string;
+    storagePath: string;
+    organizationId: string;
+    guides: SandboxGuidesIface;
+    actingUser: SandboxActingUserIface;
+    log?: (message: string) => void;
+}
+export interface SandboxStartContextIface {
+    /** Passive recovery only: never wake, create, seed, or restart backend services. */
+    passive?: boolean;
+    preparation?: SandboxPreparationSourceIface;
+    session: {
+        id: string;
+        organizationId: string;
+        conversationId: string | null;
+        definitionId: string;
+        bindingId: string;
+        target: string;
+    };
+    storagePath: string;
+    guides: SandboxGuidesIface;
+    variables: SandboxVariablesIface;
+    repositories: SandboxRepositoriesIface;
+    actingUser: SandboxActingUserIface;
+}
+export declare enum SandboxSessionEndReason {
+    Completed = "completed",
+    Expired = "expired",
+    Failed = "failed"
+}
+export declare enum SandboxWorkspace {
+    Session = "session",
+    Conversation = "conversation",
+    Ephemeral = "ephemeral"
+}
+export interface SandboxProviderImplementationIface<OpenOptions, Artifact extends JsonValue, State extends JsonValue, S extends NetworkSandboxSessionIface> {
+    workspace?(ctx: SandboxEnvironmentContextIface): Promise<SandboxWorkspace | null>;
+    capabilities?(ctx: SandboxOfferContextIface): Promise<SandboxCapability[] | null>;
+    mcpCatalog?(ctx: SandboxOfferContextIface): Promise<SandboxMcpCatalogIface | null>;
+    readSnapshot?(ctx: SandboxOfferContextIface, state: State, request: SandboxSnapshotRequestIface): Promise<SandboxSnapshotResponseIface | null>;
+    processes?(ctx: SandboxOfferContextIface & {
+        bindingId: string;
+    }, state: State, request: ProcessInspectionRequestIface): Promise<ProcessInspectionResultIface>;
+    editor?(ctx: SandboxOfferContextIface, state: State, request: SandboxEditorRequestIface): Promise<SandboxEditorResultIface>;
+    artifactKey(ctx: SandboxPrepareContextIface): Promise<string>;
+    prepare(ctx: SandboxPrepareContextIface): Promise<Artifact>;
+    start(ctx: SandboxStartContextIface, options: OpenOptions | undefined, artifact: Artifact): Promise<{
+        handle: SandboxProviderHandleIface<S>;
+        state: State;
+        region?: string | null;
+    }>;
+    resume(ctx: SandboxStartContextIface, artifact: Artifact, state: State): Promise<SandboxProviderHandleIface<S>>;
+    resumePassive?(ctx: SandboxStartContextIface, artifact: Artifact, state: State): Promise<SandboxProviderHandleIface<S>>;
+    park?(ctx: SandboxStartContextIface, artifact: Artifact, state: State): Promise<State>;
+    onSessionEnd?(ctx: SandboxStartContextIface, artifact: Artifact, state: State, options: {
+        reason: SandboxSessionEndReason;
+    }): Promise<void>;
+}
+export interface SandboxProviderDefinitionIface<EnvOptions, OpenOptions, Artifact extends JsonValue, State extends JsonValue, S extends NetworkSandboxSessionIface> {
+    name: string;
+    stateProtocolVersion?: number;
+    environment(options?: EnvOptions): SandboxProviderImplementationIface<OpenOptions, Artifact, State, S>;
+}
+export interface SandboxProviderIface<EnvOptions, OpenOptions, Artifact extends JsonValue, State extends JsonValue, S extends NetworkSandboxSessionIface> {
+    readonly definition: SandboxProviderDefinitionIface<EnvOptions, OpenOptions, Artifact, State, S>;
+    readonly name: string;
+    environment(options?: EnvOptions): AwaitableSandboxEnvironmentIface<EnvOptions, OpenOptions>;
+}
+export interface SandboxEnvironmentIface<EnvOptions, OpenOptions> {
+    readonly providerName: string;
+    readonly options: EnvOptions | undefined;
+    readonly authoringWarnings?: readonly string[];
+    open(options?: OpenOptions): SandboxOpenRequestIface<EnvOptions, OpenOptions>;
+}
+export interface AwaitableSandboxEnvironmentIface<EnvOptions, OpenOptions> extends SandboxEnvironmentIface<EnvOptions, OpenOptions> {
+    open(options?: OpenOptions): AwaitableSandboxOpenRequestIface<EnvOptions, OpenOptions>;
+}
+export interface SandboxOpenRequestIface<EnvOptions, OpenOptions> {
+    readonly providerName: string;
+    readonly environmentOptions: EnvOptions | undefined;
+    readonly openOptions: OpenOptions | undefined;
+    readonly authoringWarnings?: readonly string[];
+}
+export declare const defineSandboxProvider: <EnvOptions, OpenOptions, Artifact extends JsonValue, State extends JsonValue, S extends NetworkSandboxSessionIface>(definition: SandboxProviderDefinitionIface<EnvOptions, OpenOptions, Artifact, State, S>) => SandboxProviderIface<EnvOptions, OpenOptions, Artifact, State, S>;
+export type AnySandboxProviderIface = SandboxProviderIface<JsonValue, JsonValue, JsonValue, JsonValue, NetworkSandboxSessionIface>;
+export declare enum SandboxEventKind {
+    ProcessExited = "process_exited"
+}

package/dist/modules/sandbox/types.mjs

@@ -0,0 +1,86 @@
+import { awaitableOpenRequest } from "./open-scope.mjs";
+var SandboxEntryType = /* @__PURE__ */ ((SandboxEntryType2) => {
+  SandboxEntryType2["File"] = "file";
+  SandboxEntryType2["Directory"] = "directory";
+  SandboxEntryType2["Symlink"] = "symlink";
+  SandboxEntryType2["Other"] = "other";
+  return SandboxEntryType2;
+})(SandboxEntryType || {});
+var NetworkPolicy = /* @__PURE__ */ ((NetworkPolicy2) => {
+  NetworkPolicy2["AllowAll"] = "allow-all";
+  NetworkPolicy2["DenyAll"] = "deny-all";
+  NetworkPolicy2["Allowlist"] = "allowlist";
+  return NetworkPolicy2;
+})(NetworkPolicy || {});
+var PortProtocol = /* @__PURE__ */ ((PortProtocol2) => {
+  PortProtocol2["Http"] = "http";
+  PortProtocol2["Https"] = "https";
+  PortProtocol2["Ws"] = "ws";
+  return PortProtocol2;
+})(PortProtocol || {});
+const isMcpChannelEndpoint = (endpoint) => "connect" in endpoint;
+var SandboxCapability = /* @__PURE__ */ ((SandboxCapability2) => {
+  SandboxCapability2["Files"] = "files";
+  SandboxCapability2["Process"] = "process";
+  SandboxCapability2["Ports"] = "ports";
+  SandboxCapability2["NetworkPolicy"] = "networkPolicy";
+  SandboxCapability2["ComputerUse"] = "computerUse";
+  SandboxCapability2["Screen"] = "screen";
+  SandboxCapability2["LocalMcp"] = "localMcp";
+  SandboxCapability2["Browser"] = "browser";
+  return SandboxCapability2;
+})(SandboxCapability || {});
+const noSandboxGuides = {
+  get: async () => null,
+  default: async () => null
+};
+const noSandboxRepositories = {
+  cloneSource: async () => null
+};
+const noSandboxVariables = { get: async () => null };
+const noSandboxActingUser = { current: async () => null };
+var SandboxSessionEndReason = /* @__PURE__ */ ((SandboxSessionEndReason2) => {
+  SandboxSessionEndReason2["Completed"] = "completed";
+  SandboxSessionEndReason2["Expired"] = "expired";
+  SandboxSessionEndReason2["Failed"] = "failed";
+  return SandboxSessionEndReason2;
+})(SandboxSessionEndReason || {});
+var SandboxWorkspace = /* @__PURE__ */ ((SandboxWorkspace2) => {
+  SandboxWorkspace2["Session"] = "session";
+  SandboxWorkspace2["Conversation"] = "conversation";
+  SandboxWorkspace2["Ephemeral"] = "ephemeral";
+  return SandboxWorkspace2;
+})(SandboxWorkspace || {});
+const defineSandboxProvider = (definition) => ({
+  definition,
+  name: definition.name,
+  environment: (options) => ({
+    providerName: definition.name,
+    options,
+    open: (openOptions) => awaitableOpenRequest({
+      providerName: definition.name,
+      environmentOptions: options,
+      openOptions
+    })
+  })
+});
+var SandboxEventKind = /* @__PURE__ */ ((SandboxEventKind2) => {
+  SandboxEventKind2["ProcessExited"] = "process_exited";
+  return SandboxEventKind2;
+})(SandboxEventKind || {});
+export {
+  NetworkPolicy,
+  PortProtocol,
+  SandboxCapability,
+  SandboxEntryType,
+  SandboxEventKind,
+  SandboxSessionEndReason,
+  SandboxWorkspace,
+  defineSandboxProvider,
+  isMcpChannelEndpoint,
+  noSandboxActingUser,
+  noSandboxGuides,
+  noSandboxRepositories,
+  noSandboxVariables
+};
+//# sourceMappingURL=types.mjs.map

package/dist/modules/sandbox/types.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/sandbox/types.ts"],
+  "sourcesContent": ["import type {\n  ProcessInspectionRequestIface,\n  ProcessInspectionResultIface,\n} from '@finalai/agent-protocol/process-inspection';\nimport type { JsonValue } from \"../json.mjs\";\nimport type { ToolDescriptorIface } from \"../manifest.mjs\";\nimport type { SandboxEditorRequestIface, SandboxEditorResultIface } from \"./editor.mjs\";\nimport { awaitableOpenRequest, type AwaitableSandboxOpenRequestIface } from \"./open-scope.mjs\";\nimport type { SandboxSnapshotRequestIface, SandboxSnapshotResponseIface } from \"./snapshots.mjs\";\n\n// Sandbox providers and consumers share the streaming session contract.\n\nexport interface AbortableIface {\n  abortSignal?: AbortSignal;\n}\n\nexport interface SandboxProcessOptionsIface extends AbortableIface {\n  command: string;\n  args?: string[];\n  cwd?: string;\n  env?: Record<string, string>;\n  // Run through the sandbox's login shell (`bash -lc`) instead of exec'ing.\n  shell?: boolean;\n  stdin?: ReadableStream<Uint8Array> | string;\n  timeoutMs?: number;\n}\n\nexport interface SandboxProcessIface {\n  readonly pid: string | null;\n  readonly stdout: ReadableStream<Uint8Array>;\n  readonly stderr: ReadableStream<Uint8Array>;\n  // Writes to the process's stdin; closes stdin when `end` is true.\n  write(data: Uint8Array | string, options?: { end?: boolean }): Promise<void>;\n  wait(): Promise<{ exitCode: number }>;\n  kill(signal?: string): Promise<void>;\n}\n\nexport interface SandboxRunResultIface {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\nexport enum SandboxEntryType {\n  File = 'file',\n  Directory = 'directory',\n  Symlink = 'symlink',\n  Other = 'other',\n}\n\nexport interface StatIface {\n  path: string;\n  type: SandboxEntryType;\n  size: number;\n  modifiedAt: string | null;\n  mode: number | null;\n}\n\nexport interface DirEntryIface {\n  name: string;\n  path: string;\n  type: SandboxEntryType;\n  size: number | null;\n}\n\nexport interface ConfinedSandboxFilesIface {\n  readFile(\n    options: { path: string; root: string } & AbortableIface,\n  ): Promise<ReadableStream<Uint8Array> | null>;\n  stat(options: { path: string; root: string } & AbortableIface): Promise<StatIface | null>;\n  readDir(\n    options: { path: string; root: string } & AbortableIface,\n  ): Promise<DirEntryIface[] | null>;\n}\n\nexport interface SandboxSessionIface {\n  readonly description: string;\n  readonly confinedFileReader?: ConfinedSandboxFilesIface;\n  // On the RPC surface, root confines viewer reads to this directory, rejects\n  // symlink ancestors and requires Python 3 in the sandbox (confinedFiles feature).\n  readFile(\n    options: { path: string; root?: string } & AbortableIface,\n  ): Promise<ReadableStream<Uint8Array> | null>;\n  readBinaryFile(options: { path: string } & AbortableIface): Promise<Uint8Array | null>;\n  readTextFile(\n    options: {\n      path: string;\n      encoding?: string;\n      startLine?: number;\n      endLine?: number;\n    } & AbortableIface,\n  ): Promise<string | null>;\n  writeFile(\n    options: { path: string; content: ReadableStream<Uint8Array> } & AbortableIface,\n  ): Promise<void>;\n  writeBinaryFile(options: { path: string; content: Uint8Array } & AbortableIface): Promise<void>;\n  writeTextFile(\n    options: { path: string; content: string; encoding?: string } & AbortableIface,\n  ): Promise<void>;\n  spawn(options: SandboxProcessOptionsIface): Promise<SandboxProcessIface>;\n  run(options: SandboxProcessOptionsIface): Promise<SandboxRunResultIface>;\n  stat(options: { path: string; root?: string } & AbortableIface): Promise<StatIface | null>;\n  readDir(options: { path: string; root?: string } & AbortableIface): Promise<DirEntryIface[]>;\n  resolvePath(path: string): string;\n  removePath(\n    options: { path: string; recursive?: boolean; force?: boolean } & AbortableIface,\n  ): Promise<void>;\n}\n\nexport enum NetworkPolicy {\n  AllowAll = 'allow-all',\n  DenyAll = 'deny-all',\n  Allowlist = 'allowlist',\n}\n\nexport interface NetworkPolicyIface {\n  mode: NetworkPolicy;\n  allow?: string[];\n}\n\nexport enum PortProtocol {\n  Http = 'http',\n  Https = 'https',\n  Ws = 'ws',\n}\n\n// An MCP transport the sandbox serves for an optional capability: an HTTP MCP\n// endpoint the harness (or the session service) can dial.\nexport interface McpEndpointIface {\n  name: string;\n  url: string;\n  headers: Record<string, string>;\n}\n\n// A JSON-RPC message channel to an MCP server the sandbox hosts, for backends\n// whose API reaches it some other way than HTTP MCP (a byte pipe, a socket).\n// Messages are JSON-RPC objects, in order.\nexport interface McpChannelIface {\n  send(message: JsonValue, options?: AbortableIface): Promise<void>;\n  // The messages that arrived since the last call; [] when none did.\n  receive(options?: AbortableIface): Promise<JsonValue[]>;\n  close(): Promise<void>;\n}\n\n// An MCP server the sandbox hosts, opened in process by whoever runs the handle.\n// It cannot cross the handle RPC wire.\nexport interface McpChannelEndpointIface {\n  name: string;\n  connect(options?: AbortableIface): Promise<McpChannelIface>;\n}\n\nexport type SandboxMcpEndpoint = McpEndpointIface | McpChannelEndpointIface;\n\n// The tools of a sandbox's hosted MCP servers, as far as they are known without\n// starting it. Null: unknown until the sandbox is attached and asked.\nexport interface SandboxMcpCatalogIface {\n  computerUse: ToolDescriptorIface[] | null;\n  // Local MCP server name \u2192 its tools.\n  localMcp: Record<string, ToolDescriptorIface[]> | null;\n}\n\nexport const isMcpChannelEndpoint = (\n  endpoint: SandboxMcpEndpoint,\n): endpoint is McpChannelEndpointIface => 'connect' in endpoint;\n\nexport interface ScreenOptionsIface {\n  // View-only by default; explicit input control requires execute access.\n  viewOnly?: boolean;\n}\n\nexport interface ScreenSessionIface {\n  // A short-lived viewer grant; providers enforce the requested input access.\n  url: string;\n  token: string;\n  expiresAt: string;\n}\n\nexport interface NetworkSandboxSessionIface extends SandboxSessionIface {\n  readonly id: string;\n  readonly defaultWorkingDirectory: string;\n  readonly ports: readonly number[];\n  getPortEndpoint(options: {\n    port: number;\n    protocol?: PortProtocol;\n  }): Promise<{ url: string; headers?: Record<string, string> }>;\n  getPortUrl(options: { port: number; protocol?: PortProtocol }): Promise<string>;\n  stop(): Promise<void>;\n  destroy(): Promise<void>;\n  setNetworkPolicy?(policy: NetworkPolicyIface): Promise<void>;\n  computerUse?(): Promise<SandboxMcpEndpoint>;\n  screen?(options?: ScreenOptionsIface): Promise<ScreenSessionIface>;\n  localMcp?(): Promise<SandboxMcpEndpoint[]>;\n}\n\n// Capabilities a started sandbox advertises (and the handle RPC exposes).\nexport enum SandboxCapability {\n  Files = 'files',\n  Process = 'process',\n  Ports = 'ports',\n  NetworkPolicy = 'networkPolicy',\n  ComputerUse = 'computerUse',\n  Screen = 'screen',\n  LocalMcp = 'localMcp',\n  Browser = 'browser',\n}\n\nexport interface SandboxProviderHandleIface<S extends SandboxSessionIface> {\n  readonly sandbox: S;\n  onSandboxStop(): Promise<void>;\n  onSandboxDelete(options?: { reason?: string }): Promise<void>;\n  onRuntimeShutdown(): Promise<void>;\n}\n\n// A saved computer setup guide version: Build's versioned build-\n// and start-time inputs for a sandbox, as the session service serves them.\nexport interface SandboxGuideVersionIface {\n  guideId: string;\n  versionId: string;\n  slug: string;\n  title: string;\n  number: number;\n  image: string;\n  // `.final/sandbox-template.yaml` v2 as JSON.\n  templateConfig: JsonValue;\n  // The start-time parameters this version defaults to.\n  defaultParameters: JsonValue;\n  instructionsMarkdown: string | null;\n  // A ready build from the guide's provider, reusable independently of workspace seeds.\n  preparedArtifact?: { providerRef: string; key: string; artifact: JsonValue };\n}\n\n// The organization's computer setup guides, read through the session service.\n// Every provider gets the same reader; a provider whose\n// environments name no guide never calls it.\nexport interface SandboxGuidesIface {\n  get(args: { ref: string; version: number | 'latest' }): Promise<SandboxGuideVersionIface | null>;\n  // The organization's default guide; null when it has none.\n  default(): Promise<SandboxGuideVersionIface | null>;\n}\n\n// Where to clone a repository from, with a short-lived read credential that\n// must reach only the clone process (never a repository's git config).\nexport interface SandboxRepositoryCloneSourceIface {\n  url: string;\n  // Checked out after the clone; null keeps the default branch.\n  ref: string | null;\n  // An HTTP Authorization header value for the clone, or null.\n  authorization: string | null;\n}\n\n// Repository credentials for the repositories an environment names (a Code\n// Storage id, a GitHub owner/name), resolved by the session service for the\n// session's organization only. Null: not a repository it can resolve.\nexport interface SandboxRepositoriesIface {\n  cloneSource(args: {\n    repository: string;\n    ref: string | null;\n  }): Promise<SandboxRepositoryCloneSourceIface | null>;\n}\n\n// Reads a named organization variable (managed in Build) for the session's\n// organization. Values are injected into the sandbox only, never stored in a\n// manifest, a state or the log.\nexport interface SandboxVariablesIface {\n  get(name: string): Promise<string | null>;\n}\n\nexport const noSandboxGuides: SandboxGuidesIface = {\n  get: async () => null,\n  default: async () => null,\n};\n\nexport const noSandboxRepositories: SandboxRepositoriesIface = {\n  cloneSource: async () => null,\n};\n\nexport const noSandboxVariables: SandboxVariablesIface = { get: async () => null };\n\n// The user a session acts for: the author of its running turn, else its owner,\n// else the user whose Home its conversation is. A call a person makes through\n// the platform's sandbox viewer acts for that person instead. Null when it acts\n// for no user (a turn nobody prompted in a shared conversation) and outside any\n// session (a guide build). Read on each call, because it changes between turns\n// and between callers.\nexport interface SandboxActingUserIface {\n  current(): Promise<string | null>;\n}\n\nexport const noSandboxActingUser: SandboxActingUserIface = { current: async () => null };\n\n// What an environment's pre-start reads (capabilities, mcpCatalog) are given.\nexport interface SandboxOfferContextIface {\n  organizationId: string;\n  actingUser: SandboxActingUserIface;\n}\n\n// What an environment's hooks are given before anything starts.\nexport interface SandboxEnvironmentContextIface {\n  organizationId: string;\n  guides: SandboxGuidesIface;\n}\n\n// Scoped by the host to this organization and provider. Providers can retain\n// reusable intermediate artifacts independently of a revision's seed files.\nexport interface SandboxArtifactsIface {\n  get(key: string): Promise<JsonValue | null>;\n  put(key: string, artifact: JsonValue): Promise<void>;\n}\n\nexport interface SandboxPreparationSourceIface {\n  sourceRevision: string;\n  read(): Promise<{ files: Record<string, string>; resources: Record<string, JsonValue> }>;\n}\n\nexport interface SandboxPrepareContextIface {\n  // A host-persisted resource source; artifacts may retain its identity instead of seed contents.\n  preparation?: SandboxPreparationSourceIface;\n  artifacts?: SandboxArtifactsIface;\n  // Agent revisions supply workspace-relative seeds; setup-guide builds supply\n  // guide.json and optional instructions.md. Resources name workspace, skills or guide.\n  // Model instructions remain harness config.\n  files: Record<string, string>;\n  resources: Record<string, JsonValue>;\n  sourceRevision: string;\n  storagePath: string;\n  organizationId: string;\n  // The guide inputs (build-time) an environment names, resolved by the platform.\n  guides: SandboxGuidesIface;\n  // Who the session the artifact is prepared for acts for, for environments that\n  // name a backend resource relative to that user; the key must then name it.\n  actingUser: SandboxActingUserIface;\n  log?: (message: string) => void;\n}\n\nexport interface SandboxStartContextIface {\n  /** Passive recovery only: never wake, create, seed, or restart backend services. */\n  passive?: boolean;\n  preparation?: SandboxPreparationSourceIface;\n  session: {\n    id: string;\n    organizationId: string;\n    conversationId: string | null;\n    definitionId: string;\n    bindingId: string;\n    target: string;\n  };\n  storagePath: string;\n  // Start-time inputs: guides, the variables to inject, repository credentials.\n  guides: SandboxGuidesIface;\n  variables: SandboxVariablesIface;\n  repositories: SandboxRepositoriesIface;\n  actingUser: SandboxActingUserIface;\n}\n\nexport enum SandboxSessionEndReason {\n  Completed = 'completed',\n  Expired = 'expired',\n  Failed = 'failed',\n}\n\n// How long an environment's sandbox outlives a session: `session`\n// keeps it for the session's life; `conversation` gives every session in the\n// conversation one shared sandbox per target, surviving session resets;\n// `ephemeral` discards it when released.\nexport enum SandboxWorkspace {\n  Session = 'session',\n  Conversation = 'conversation',\n  Ephemeral = 'ephemeral',\n}\n\nexport interface SandboxProviderImplementationIface<\n  OpenOptions,\n  Artifact extends JsonValue,\n  State extends JsonValue,\n  S extends NetworkSandboxSessionIface,\n> {\n  // The workspace this environment declares, read before anything starts so the\n  // session service knows which sessions share a binding. Absent or null: session.\n  workspace?(ctx: SandboxEnvironmentContextIface): Promise<SandboxWorkspace | null>;\n  // The capabilities this environment's sandboxes offer, read before anything\n  // starts through the backend's own API. Absent or null: unknown\n  // until started; local MCP is then not projected.\n  capabilities?(ctx: SandboxOfferContextIface): Promise<SandboxCapability[] | null>;\n  // The hosted MCP servers' tool catalogs the backend can give without starting\n  // a sandbox (from its own records), so the MCP projection lists them from the\n  // first `tools/list`. The projection checks a server's catalog against the\n  // live server when a call first opens that server (servers a session never\n  // uses stay closed) and announces a change with\n  // `notifications/tools/list_changed`.\n  //\n  // Trade-off: a catalog left unknown (absent hook, null, or a null field) can\n  // only be learned from the live sandbox, so the first `tools/list` that finds\n  // it unknown starts the sandbox in the background, at session start rather\n  // than on the first tool call. Otherwise those tools would never be listed,\n  // and nothing would ever call them. Providers that can give the catalog keep\n  // attach lazy.\n  mcpCatalog?(ctx: SandboxOfferContextIface): Promise<SandboxMcpCatalogIface | null>;\n  // Reads committed files without starting/resuming a sandbox. Null means the backend\n  // is live or offers no snapshot. An unavailable sleeping snapshot must throw,\n  // never fall through to a read that wakes it. Pin subsequent ranges by snapshotId.\n  readSnapshot?(\n    ctx: SandboxOfferContextIface,\n    state: State,\n    request: SandboxSnapshotRequestIface,\n  ): Promise<SandboxSnapshotResponseIface | null>;\n  // Inspect retained backend processes without opening, resuming or extending a sandbox.\n  // Stop requires execute access; the provider also enforces backend ownership.\n  processes?(\n    ctx: SandboxOfferContextIface & { bindingId: string },\n    state: State,\n    request: ProcessInspectionRequestIface,\n  ): Promise<ProcessInspectionResultIface>;\n  // Browser editor for this provider's existing workspace. The host checks write\n  // authorization; this hook never creates or wakes a backend. Credentials stay\n  // in the authentication form, never the editor URL or stored provider state.\n  editor?(\n    ctx: SandboxOfferContextIface,\n    state: State,\n    request: SandboxEditorRequestIface,\n  ): Promise<SandboxEditorResultIface>;\n  // Content-addressed by `artifactKey`; the session service caches artifacts in\n  // agent.sandbox_artifacts and calls prepare only on a miss.\n  artifactKey(ctx: SandboxPrepareContextIface): Promise<string>;\n  prepare(ctx: SandboxPrepareContextIface): Promise<Artifact>;\n  // `region`: where the backend placed the sandbox (its own region name), so the\n  // session service can place the harness near it; null when unknown.\n  start(\n    ctx: SandboxStartContextIface,\n    options: OpenOptions | undefined,\n    artifact: Artifact,\n  ): Promise<{ handle: SandboxProviderHandleIface<S>; state: State; region?: string | null }>;\n  resume(\n    ctx: SandboxStartContextIface,\n    artifact: Artifact,\n    state: State,\n  ): Promise<SandboxProviderHandleIface<S>>;\n  // Reconnect to an already running backend after host restart for a read-only viewer.\n  // Absent: viewers can use a retained live handle but cannot trigger resume.\n  resumePassive?(\n    ctx: SandboxStartContextIface,\n    artifact: Artifact,\n    state: State,\n  ): Promise<SandboxProviderHandleIface<S>>;\n  // Park: pause or stop the sandbox, returning the state resume needs.\n  park?(ctx: SandboxStartContextIface, artifact: Artifact, state: State): Promise<State>;\n  onSessionEnd?(\n    ctx: SandboxStartContextIface,\n    artifact: Artifact,\n    state: State,\n    options: { reason: SandboxSessionEndReason },\n  ): Promise<void>;\n}\n\nexport interface SandboxProviderDefinitionIface<\n  EnvOptions,\n  OpenOptions,\n  Artifact extends JsonValue,\n  State extends JsonValue,\n  S extends NetworkSandboxSessionIface,\n> {\n  name: string;\n  // The version of `State`'s shape. The session service records it with each\n  // binding and refuses to resume a state written under another version (the\n  // next call starts the sandbox again instead).\n  stateProtocolVersion?: number;\n  environment(\n    options?: EnvOptions,\n  ): SandboxProviderImplementationIface<OpenOptions, Artifact, State, S>;\n}\n\n// A defined provider: the definition plus authoring sugar. `environment(opts)`\n// returns an environment whose `.open(openOptions)` records a sandbox binding\n// target when authored, and is what the session service drives at run time.\nexport interface SandboxProviderIface<\n  EnvOptions,\n  OpenOptions,\n  Artifact extends JsonValue,\n  State extends JsonValue,\n  S extends NetworkSandboxSessionIface,\n> {\n  readonly definition: SandboxProviderDefinitionIface<EnvOptions, OpenOptions, Artifact, State, S>;\n  readonly name: string;\n  environment(options?: EnvOptions): AwaitableSandboxEnvironmentIface<EnvOptions, OpenOptions>;\n}\n\nexport interface SandboxEnvironmentIface<EnvOptions, OpenOptions> {\n  readonly providerName: string;\n  readonly options: EnvOptions | undefined;\n  // Provider-authored notices shown by the compiler and Build before publication.\n  readonly authoringWarnings?: readonly string[];\n  // Authoring: records the open options (access, ...) for this target.\n  open(options?: OpenOptions): SandboxOpenRequestIface<EnvOptions, OpenOptions>;\n}\n\n// An environment whose open request a sandbox.ts selector can await to get\n// the live session (open-scope.ts); what defineSandboxProvider and the\n// installed helpers return.\nexport interface AwaitableSandboxEnvironmentIface<\n  EnvOptions,\n  OpenOptions,\n> extends SandboxEnvironmentIface<EnvOptions, OpenOptions> {\n  open(options?: OpenOptions): AwaitableSandboxOpenRequestIface<EnvOptions, OpenOptions>;\n}\n\nexport interface SandboxOpenRequestIface<EnvOptions, OpenOptions> {\n  readonly providerName: string;\n  readonly environmentOptions: EnvOptions | undefined;\n  readonly openOptions: OpenOptions | undefined;\n  readonly authoringWarnings?: readonly string[];\n}\n\nexport const defineSandboxProvider = <\n  EnvOptions,\n  OpenOptions,\n  Artifact extends JsonValue,\n  State extends JsonValue,\n  S extends NetworkSandboxSessionIface,\n>(\n  definition: SandboxProviderDefinitionIface<EnvOptions, OpenOptions, Artifact, State, S>,\n): SandboxProviderIface<EnvOptions, OpenOptions, Artifact, State, S> => ({\n  definition,\n  name: definition.name,\n  environment: (options) => ({\n    providerName: definition.name,\n    options,\n    open: (openOptions) =>\n      awaitableOpenRequest({\n        providerName: definition.name,\n        environmentOptions: options,\n        openOptions,\n      }),\n  }),\n});\n\n// Erased form the session service stores in its provider registry.\nexport type AnySandboxProviderIface = SandboxProviderIface<\n  JsonValue,\n  JsonValue,\n  JsonValue,\n  JsonValue,\n  NetworkSandboxSessionIface\n>;\n\n// Events emitted through a sandbox provider's process lifecycle.\nexport enum SandboxEventKind {\n  ProcessExited = 'process_exited',\n}\n"],
+  "mappings": "AAOA,SAAS,4BAAmE;AAoCrE,IAAK,mBAAL,kBAAKA,sBAAL;AACL,EAAAA,kBAAA,UAAO;AACP,EAAAA,kBAAA,eAAY;AACZ,EAAAA,kBAAA,aAAU;AACV,EAAAA,kBAAA,WAAQ;AAJE,SAAAA;AAAA,GAAA;AAkEL,IAAK,gBAAL,kBAAKC,mBAAL;AACL,EAAAA,eAAA,cAAW;AACX,EAAAA,eAAA,aAAU;AACV,EAAAA,eAAA,eAAY;AAHF,SAAAA;AAAA,GAAA;AAWL,IAAK,eAAL,kBAAKC,kBAAL;AACL,EAAAA,cAAA,UAAO;AACP,EAAAA,cAAA,WAAQ;AACR,EAAAA,cAAA,QAAK;AAHK,SAAAA;AAAA,GAAA;AAyCL,MAAM,uBAAuB,CAClC,aACwC,aAAa;AAgChD,IAAK,oBAAL,kBAAKC,uBAAL;AACL,EAAAA,mBAAA,WAAQ;AACR,EAAAA,mBAAA,aAAU;AACV,EAAAA,mBAAA,WAAQ;AACR,EAAAA,mBAAA,mBAAgB;AAChB,EAAAA,mBAAA,iBAAc;AACd,EAAAA,mBAAA,YAAS;AACT,EAAAA,mBAAA,cAAW;AACX,EAAAA,mBAAA,aAAU;AARA,SAAAA;AAAA,GAAA;AAwEL,MAAM,kBAAsC;AAAA,EACjD,KAAK,YAAY;AAAA,EACjB,SAAS,YAAY;AACvB;AAEO,MAAM,wBAAkD;AAAA,EAC7D,aAAa,YAAY;AAC3B;AAEO,MAAM,qBAA4C,EAAE,KAAK,YAAY,KAAK;AAY1E,MAAM,sBAA8C,EAAE,SAAS,YAAY,KAAK;AAkEhF,IAAK,0BAAL,kBAAKC,6BAAL;AACL,EAAAA,yBAAA,eAAY;AACZ,EAAAA,yBAAA,aAAU;AACV,EAAAA,yBAAA,YAAS;AAHC,SAAAA;AAAA,GAAA;AAUL,IAAK,mBAAL,kBAAKC,sBAAL;AACL,EAAAA,kBAAA,aAAU;AACV,EAAAA,kBAAA,kBAAe;AACf,EAAAA,kBAAA,eAAY;AAHF,SAAAA;AAAA,GAAA;AAmJL,MAAM,wBAAwB,CAOnC,gBACuE;AAAA,EACvE;AAAA,EACA,MAAM,WAAW;AAAA,EACjB,aAAa,CAAC,aAAa;AAAA,IACzB,cAAc,WAAW;AAAA,IACzB;AAAA,IACA,MAAM,CAAC,gBACL,qBAAqB;AAAA,MACnB,cAAc,WAAW;AAAA,MACzB,oBAAoB;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACL;AACF;AAYO,IAAK,mBAAL,kBAAKC,sBAAL;AACL,EAAAA,kBAAA,mBAAgB;AADN,SAAAA;AAAA,GAAA;",
+  "names": ["SandboxEntryType", "NetworkPolicy", "PortProtocol", "SandboxCapability", "SandboxSessionEndReason", "SandboxWorkspace", "SandboxEventKind"]
+}