@finalai/final-agent-provider 0.3.4 → 0.4.0

package/dist/modules/sandboxes/computers-api.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/sandboxes/computers-api.ts"],
-  "sourcesContent": ["import {\n  ProcessInspectionOperation,\n  type ProcessInspectionRequestIface,\n  type ProcessInspectionResultIface,\n} from '@finalai/agent-protocol/process-inspection';\nimport type { JsonValue } from '@finalai/agent-provider';\nimport { jsonValueSchema } from '@finalai/agent-provider';\nimport {\n  computerBrowserAccessSchema,\n  ComputerImageState,\n  computerSnapshotResponseSchema,\n  createTransport,\n  normalizeComputerBase,\n  normalizeComputerImage,\n  normalizeComputerInfo,\n  ok,\n  type ComputerBaseIface,\n  type ComputerBrowserAccessIface,\n  type ComputerBrowserAccessOptionsIface,\n  type ComputerCommandMode,\n  type ComputerEgressPolicy,\n  type ComputerIdlePolicy,\n  type ComputerImageIface,\n  type ComputerInfoIface,\n  type ComputerScreenOpenOptionsIface,\n  type ComputerSnapshotRequestIface,\n  type ComputerSnapshotResponseIface,\n} from '@finalai/computers';\nimport * as z from 'zod';\nimport { inspectComputerProcesses } from \"./computer-processes.mjs\";\nimport { COMPUTERS_API_KEY_SECRET } from \"./environment.mjs\";\n\n// The public Computers API (`/v1`, vm-service/docs/v1-api.md), authenticated the\n// way any developer's code is: an organization API key as the bearer. The\n// provider holds no platform credential and reaches no `/internal` route. This\n// speaks the REST surface directly, reusing @finalai/computers's row\n// normalization, because the provider needs an injected fetch and per-call\n// abort signals that the SDK's client does not take.\n\n// An organization's Computers API credential. `teamId` (`team_...`) owns the\n// computers when the key has no owning user (an organization or team key),\n// which POST /v1/computers requires.\nexport interface ComputersApiCredentialIface {\n  apiKey: string;\n  teamId: string | null;\n}\n\nexport interface ComputersApiConfigIface {\n  // Public Computers API origin (VM_SERVICE_WORKER_DOMAIN); requests go to `<url>/v1/...`.\n  url: string;\n  // The organization's credential, null when it has none.\n  credential: (args: { organizationId: string }) => Promise<ComputersApiCredentialIface | null>;\n  // How long a resolved credential is reused before it is read again; a 401 drops it at once.\n  credentialTtlMs?: number;\n  fetch?: typeof fetch;\n  requestTimeoutMs?: number;\n}\n\nexport enum ComputersApiErrorCode {\n  CredentialMissing = 'credential_missing',\n  RequestFailed = 'request_failed',\n}\n\nexport interface ComputersApiErrorIface extends Error {\n  code: ComputersApiErrorCode;\n  statusCode: number | null;\n}\n\nexport const computersApiError = (\n  message: string,\n  statusCode: number | null,\n  code: ComputersApiErrorCode = ComputersApiErrorCode.RequestFailed,\n): ComputersApiErrorIface =>\n  Object.assign(new Error(message), { name: 'ComputersApiError', code, statusCode });\n\nexport const isComputersApiError = (cause: unknown): cause is ComputersApiErrorIface =>\n  cause instanceof Error && 'statusCode' in cause && 'code' in cause;\n\nexport const isComputersApiStatus = (cause: unknown, ...statuses: number[]): boolean =>\n  isComputersApiError(cause) && cause.statusCode != null && statuses.includes(cause.statusCode);\n\n// Exactly one of imageVersionId (a registered image) and baseId (a captured computer).\nexport interface CreateComputerBodyIface {\n  name: string;\n  imageVersionId?: string;\n  baseId?: string;\n  regionSlug?: string;\n  vcpu?: number;\n  memoryMb?: number;\n  diskGb?: number;\n  // Null: no user volume, so everything the computer writes is on the disk a capture takes.\n  userVolumeGb?: number | null;\n  env: Record<string, string>;\n  commandMode?: ComputerCommandMode;\n  customCommand?: string;\n  ephemeral?: boolean;\n  idleTimeoutSeconds?: number;\n  idlePolicy?: ComputerIdlePolicy;\n  network?: { egress: ComputerEgressPolicy; allow?: string[] };\n  autoResume?: boolean;\n  tags?: string[];\n}\n\nexport interface ExecBodyIface {\n  autoResume?: boolean;\n  command: string;\n  env?: Record<string, string>;\n  cwd?: string;\n  user?: string;\n  timeoutMs?: number;\n  readyTimeoutMs?: number;\n}\n\n// `stop` shelves a computer that is not ephemeral: its disks go to storage and\n// its host is released; `start` brings it back with its files (vm-service\n// docs/v1-api.md).\nexport type ComputerAction = 'start' | 'stop' | 'pause' | 'resume' | 'delete';\n\nconst outputStreamSchema = z.object({\n  dataB64: z.string(),\n  offset: z.number(),\n  nextOffset: z.number(),\n  eof: z.boolean(),\n});\nconst processOutputSchema = z.object({\n  stdout: outputStreamSchema,\n  stderr: outputStreamSchema,\n  state: z.union([z.literal('running'), z.literal('exited')]),\n  result: z.object({ exitCode: z.number().nullable(), signal: z.string().nullable() }).nullable(),\n});\nexport type ComputerProcessOutputIface = z.infer<typeof processOutputSchema>;\nconst runResponseSchema = processOutputSchema.extend({\n  id: z.string(),\n  bootId: z.string(),\n  timedOut: z.boolean(),\n});\nexport type ComputerRunResultIface = z.infer<typeof runResponseSchema>;\nconst execResponseSchema = z.object({ id: z.string(), bootId: z.string() });\nconst fileReadSchema = z.object({\n  dataB64: z.string(),\n  eof: z.boolean(),\n  offset: z.number().optional(),\n});\nconst tokenSchema = z.object({ id: z.string(), token: z.string() });\nconst computerResponseSchema = z.object({ computer: jsonValueSchema });\nconst imageResponseSchema = z.object({ image: jsonValueSchema });\nconst baseResponseSchema = z.object({ base: jsonValueSchema });\nconst imagesResponseSchema = z.object({ images: z.array(jsonValueSchema) });\n\nexport interface ComputersApiClientIface {\n  inspectProcesses(\n    computerId: string,\n    input: ProcessInspectionRequestIface,\n  ): Promise<ProcessInspectionResultIface>;\n  openBrowserAccess(\n    computerId: string,\n    options: ComputerBrowserAccessOptionsIface,\n  ): Promise<ComputerBrowserAccessIface>;\n  closeBrowserAccess(computerId: string, tokenId: string): Promise<void>;\n  readSnapshot(\n    computerId: string,\n    request: ComputerSnapshotRequestIface,\n  ): Promise<ComputerSnapshotResponseIface>;\n  screenStatus(computerId: string, signal?: AbortSignal): Promise<{ available: boolean }>;\n  openScreen(\n    computerId: string,\n    options?: ComputerScreenOpenOptionsIface,\n  ): Promise<{ url: string; token: string; expiresAt: string }>;\n  computerUseStatus(\n    computerId: string,\n    signal?: AbortSignal,\n  ): Promise<{ available: boolean; installed: boolean }>;\n  openComputerUse(\n    computerId: string,\n    options: { cwd: string; readyTimeoutMs?: number; signal?: AbortSignal },\n  ): Promise<{ id: string; bootId: string }>;\n  setNetworkPolicy(\n    computerId: string,\n    policy: { egress: ComputerEgressPolicy; allow?: string[] },\n  ): Promise<void>;\n  createComputer(body: CreateComputerBodyIface, idempotencyKey: string): Promise<ComputerInfoIface>;\n  // Null when the computer does not exist (or was deleted).\n  getComputer(idOrName: string): Promise<ComputerInfoIface | null>;\n  action(idOrName: string, action: ComputerAction): Promise<void>;\n  exec(computerId: string, body: ExecBodyIface): Promise<{ id: string; bootId: string }>;\n  run(\n    computerId: string,\n    body: ExecBodyIface & { waitMs?: number },\n  ): Promise<ComputerRunResultIface>;\n  output(args: {\n    computerId: string;\n    processId: string;\n    bootId: string;\n    stdoutOffset: number;\n    stderrOffset: number;\n    waitMs: number;\n    signal?: AbortSignal;\n  }): Promise<ComputerProcessOutputIface>;\n  input(args: {\n    computerId: string;\n    processId: string;\n    body: Record<string, JsonValue>;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  terminate(args: { computerId: string; processId: string; bootId: string }): Promise<void>;\n  readFile(args: {\n    computerId: string;\n    path: string;\n    offset: number;\n    length: number;\n    signal?: AbortSignal;\n  }): Promise<{ dataB64: string; eof: boolean }>;\n  writeFile(args: {\n    computerId: string;\n    path: string;\n    dataB64: string;\n    append: boolean;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  // An `http`-scoped token for one computer's ports (a preview token).\n  createPreviewToken(args: { computerId: string; name: string; expiresAt: Date }): Promise<string>;\n  // The organization's and the platform's image versions, newest first.\n  listImages(args: { lineage: string; state: ComputerImageState }): Promise<ComputerImageIface[]>;\n  // Registering a digest the organization already has returns that version.\n  registerImage(args: {\n    reference: string;\n    registryCredentialId?: string;\n  }): Promise<ComputerImageIface>;\n  getImage(imageVersionId: string): Promise<ComputerImageIface>;\n  // Captures a running computer as a base; the computer stops for it.\n  captureComputer(idOrName: string, options?: { retained?: boolean }): Promise<ComputerBaseIface>;\n  setBaseRetention(baseId: string, retained: boolean): Promise<ComputerBaseIface>;\n  // Null when the base does not exist.\n  getBase(baseId: string): Promise<ComputerBaseIface | null>;\n}\n\ninterface CachedCredentialIface {\n  value: ComputersApiCredentialIface;\n  expiresAtMs: number;\n}\n\nexport interface ComputersApiCredentialsIface {\n  get(organizationId: string): Promise<ComputersApiCredentialIface>;\n  invalidate(organizationId: string): void;\n}\n\n// Credentials per organization, reused for `credentialTtlMs` (default 60 s, as\n// vm-service caches an API key's validation) so a handle's calls do not each\n// read the secret store.\nexport const createComputersApiCredentials = (\n  config: Pick<ComputersApiConfigIface, 'credential' | 'credentialTtlMs'>,\n  now: () => number = () => Date.now(),\n): ComputersApiCredentialsIface => {\n  const cache = new Map<string, CachedCredentialIface>();\n  const ttlMs = config.credentialTtlMs ?? 60_000;\n  return {\n    get: async (organizationId) => {\n      const cached = cache.get(organizationId);\n      if (cached != null && cached.expiresAtMs > now()) return cached.value;\n      const value = await config.credential({ organizationId });\n      if (value == null) {\n        throw computersApiError(\n          `this organization has no Computers API key for the computer sandbox: create an organization API key and store it as the organization secret ${COMPUTERS_API_KEY_SECRET}`,\n          null,\n          ComputersApiErrorCode.CredentialMissing,\n        );\n      }\n      cache.set(organizationId, { value, expiresAtMs: now() + ttlMs });\n      return value;\n    },\n    invalidate: (organizationId) => {\n      cache.delete(organizationId);\n    },\n  };\n};\n\nexport const createComputersApiClient = (args: {\n  config: ComputersApiConfigIface;\n  credentials: ComputersApiCredentialsIface;\n  organizationId: string;\n}): ComputersApiClientIface => {\n  const request = async <T>(req: {\n    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n    path: string;\n    query?: Record<string, string>;\n    body?: object;\n    headers?: Record<string, string>;\n    signal?: AbortSignal;\n    schema: z.ZodType<T>;\n  }): Promise<T> => {\n    const credential = await args.credentials.get(args.organizationId);\n    const transport = createTransport({\n      baseUrl: args.config.url,\n      auth: { apiKey: credential.apiKey },\n      fetch: args.config.fetch,\n      requestTimeoutMs: args.config.requestTimeoutMs,\n    });\n    const response = await transport.request({\n      method: req.method,\n      path: req.path,\n      query: req.query,\n      jsonBody: req.body,\n      headers: req.headers,\n      signal: req.signal,\n    });\n    if (!response.ok) {\n      if (response.statusCode === 401) args.credentials.invalidate(args.organizationId);\n      throw computersApiError(response.error, response.statusCode ?? null);\n    }\n    const parsed = response.data;\n    const result = req.schema.safeParse(parsed);\n    if (!result.success)\n      throw computersApiError(`unexpected Computers API ${req.path} response`, null);\n    return result.data;\n  };\n\n  const computerPath = (idOrName: string): string => `/computers/${encodeURIComponent(idOrName)}`;\n  const toInfo = (row: JsonValue): ComputerInfoIface => {\n    const info = normalizeComputerInfo(row);\n    if (info == null) throw computersApiError('unexpected computer shape', null);\n    return info;\n  };\n  const toImage = (row: JsonValue): ComputerImageIface => {\n    const image = normalizeComputerImage(row);\n    if (image == null) throw computersApiError('unexpected image shape', null);\n    return image;\n  };\n  const toBase = (row: JsonValue): ComputerBaseIface => {\n    const base = normalizeComputerBase(row);\n    if (base == null) throw computersApiError('unexpected base shape', null);\n    return base;\n  };\n  const anyBody = jsonValueSchema;\n\n  return {\n    inspectProcesses: async (computerId, input) => {\n      const result = await inspectComputerProcesses({\n        computerPath: computerPath(computerId),\n        request: input,\n        transport: {\n          request: async (args) =>\n            ok(\n              await request({\n                method: args.method,\n                path: args.path,\n                query: args.query,\n                body: args.jsonBody,\n                schema: jsonValueSchema,\n              }),\n            ),\n        },\n      });\n      if (!result.ok) throw computersApiError(result.error, result.statusCode ?? null);\n      return input.operation === ProcessInspectionOperation.Available && 'available' in result.data\n        ? { ...result.data, canStop: true }\n        : result.data;\n    },\n    createComputer: async (body, idempotencyKey) => {\n      const { teamId } = await args.credentials.get(args.organizationId);\n      const response = await request({\n        method: 'POST',\n        path: '/computers',\n        body: teamId == null ? body : { ...body, teamId },\n        headers: { 'idempotency-key': idempotencyKey },\n        schema: computerResponseSchema,\n      });\n      return toInfo(response.computer);\n    },\n    getComputer: async (idOrName) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: computerPath(idOrName),\n          schema: computerResponseSchema,\n        });\n        return toInfo(response.computer);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n    action: async (idOrName, action) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(idOrName)}/actions/${action}`,\n        body: {},\n        schema: anyBody,\n      });\n    },\n    openBrowserAccess: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/browser-access`,\n        body: options,\n        schema: computerBrowserAccessSchema,\n      }),\n    closeBrowserAccess: async (computerId, tokenId) => {\n      await request({\n        method: 'DELETE',\n        path: `${computerPath(computerId)}/browser-access/${encodeURIComponent(tokenId)}`,\n        schema: anyBody,\n      });\n    },\n    readSnapshot: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/file-snapshots/read`,\n        body,\n        schema: computerSnapshotResponseSchema,\n      }),\n    screenStatus: (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/screen`,\n        signal,\n        schema: z.object({ available: z.boolean() }),\n      }),\n    openScreen: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/screen`,\n        body: options ?? {},\n        schema: z.object({ url: z.string().url(), token: z.string(), expiresAt: z.string() }),\n      }),\n    computerUseStatus: async (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/computer-use`,\n        signal,\n        schema: z.object({ available: z.boolean(), installed: z.boolean().default(false) }),\n      }),\n    openComputerUse: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/computer-use`,\n        body: { cwd: options.cwd, readyTimeoutMs: options.readyTimeoutMs },\n        signal: options.signal,\n        schema: execResponseSchema,\n      }),\n    setNetworkPolicy: async (computerId, policy) => {\n      await request({\n        method: 'PATCH',\n        path: computerPath(computerId),\n        body: { network: policy },\n        schema: computerResponseSchema,\n      });\n    },\n    exec: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/exec`,\n        body,\n        schema: execResponseSchema,\n      }),\n    run: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/run`,\n        body,\n        schema: runResponseSchema,\n      }),\n    output: (o) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/output`,\n        query: {\n          bootId: o.bootId,\n          stdoutOffset: String(o.stdoutOffset),\n          stderrOffset: String(o.stderrOffset),\n          waitMs: String(o.waitMs),\n        },\n        signal: o.signal,\n        schema: processOutputSchema,\n      }),\n    input: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/input`,\n        body: o.body,\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    terminate: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/terminate`,\n        body: { bootId: o.bootId },\n        schema: anyBody,\n      });\n    },\n    readFile: async (o) => {\n      const read = await request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/files`,\n        query: {\n          path: o.path,\n          offset: String(o.offset),\n          length: String(o.length),\n          autoResume: 'false',\n        },\n        signal: o.signal,\n        schema: fileReadSchema,\n      });\n      // The API echoes the offset; a server that ignored the range would hand back the start again.\n      if (o.offset > 0 && read.offset !== o.offset) {\n        throw computersApiError(\n          'the Computers API ignored a ranged file read; partial contents refused',\n          null,\n        );\n      }\n      return { dataB64: read.dataB64, eof: read.eof };\n    },\n    writeFile: async (o) => {\n      await request({\n        method: 'PUT',\n        path: `${computerPath(o.computerId)}/files`,\n        body: { path: o.path, dataB64: o.dataB64, append: o.append },\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    createPreviewToken: async (o) =>\n      (\n        await request({\n          method: 'POST',\n          path: '/tokens',\n          body: {\n            name: o.name,\n            computerId: o.computerId,\n            scopes: ['http'],\n            expiresAt: o.expiresAt.toISOString(),\n          },\n          schema: tokenSchema,\n        })\n      ).token,\n    listImages: async (o) =>\n      (\n        await request({\n          method: 'GET',\n          path: '/images',\n          query: { lineage: o.lineage, state: o.state },\n          schema: imagesResponseSchema,\n        })\n      ).images.map(toImage),\n    registerImage: async (o) =>\n      toImage(\n        (\n          await request({\n            method: 'POST',\n            path: '/images',\n            body: o.registryCredentialId == null ? { reference: o.reference } : o,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    getImage: async (imageVersionId) =>\n      toImage(\n        (\n          await request({\n            method: 'GET',\n            path: `/images/${encodeURIComponent(imageVersionId)}`,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    captureComputer: async (idOrName, options) =>\n      toBase(\n        (\n          await request({\n            method: 'POST',\n            path: `${computerPath(idOrName)}/capture`,\n            body: options ?? {},\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    setBaseRetention: async (baseId, retained) =>\n      toBase(\n        (\n          await request({\n            method: 'PATCH',\n            path: `/bases/${encodeURIComponent(baseId)}`,\n            body: { retained },\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    getBase: async (baseId) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: `/bases/${encodeURIComponent(baseId)}`,\n          schema: baseResponseSchema,\n        });\n        return toBase(response.base);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n  };\n};\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,OAGK;AAEP,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAYK;AACP,YAAY,OAAO;AACnB,SAAS,gCAAgC;AACzC,SAAS,gCAAgC;AA4BlC,IAAK,wBAAL,kBAAKA,2BAAL;AACL,EAAAA,uBAAA,uBAAoB;AACpB,EAAAA,uBAAA,mBAAgB;AAFN,SAAAA;AAAA,GAAA;AAUL,MAAM,oBAAoB,CAC/B,SACA,YACA,OAA8B,yCAE9B,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,MAAM,qBAAqB,MAAM,WAAW,CAAC;AAE5E,MAAM,sBAAsB,CAAC,UAClC,iBAAiB,SAAS,gBAAgB,SAAS,UAAU;AAExD,MAAM,uBAAuB,CAAC,UAAmB,aACtD,oBAAoB,KAAK,KAAK,MAAM,cAAc,QAAQ,SAAS,SAAS,MAAM,UAAU;AAuC9F,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,SAAS,EAAE,OAAO;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,EACjB,YAAY,EAAE,OAAO;AAAA,EACrB,KAAK,EAAE,QAAQ;AACjB,CAAC;AACD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC1D,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS;AAChG,CAAC;AAED,MAAM,oBAAoB,oBAAoB,OAAO;AAAA,EACnD,IAAI,EAAE,OAAO;AAAA,EACb,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1E,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,SAAS,EAAE,OAAO;AAAA,EAClB,KAAK,EAAE,QAAQ;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAClE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,gBAAgB,CAAC;AACrE,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC;AAC/D,MAAM,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC7D,MAAM,uBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,EAAE,CAAC;AAsGnE,MAAM,gCAAgC,CAC3C,QACA,MAAoB,MAAM,KAAK,IAAI,MACF;AACjC,QAAM,QAAQ,oBAAI,IAAmC;AACrD,QAAM,QAAQ,OAAO,mBAAmB;AACxC,SAAO;AAAA,IACL,KAAK,OAAO,mBAAmB;AAC7B,YAAM,SAAS,MAAM,IAAI,cAAc;AACvC,UAAI,UAAU,QAAQ,OAAO,cAAc,IAAI,EAAG,QAAO,OAAO;AAChE,YAAM,QAAQ,MAAM,OAAO,WAAW,EAAE,eAAe,CAAC;AACxD,UAAI,SAAS,MAAM;AACjB,cAAM;AAAA,UACJ,+IAA+I,wBAAwB;AAAA,UACvK;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,gBAAgB,EAAE,OAAO,aAAa,IAAI,IAAI,MAAM,CAAC;AAC/D,aAAO;AAAA,IACT;AAAA,IACA,YAAY,CAAC,mBAAmB;AAC9B,YAAM,OAAO,cAAc;AAAA,IAC7B;AAAA,EACF;AACF;AAEO,MAAM,2BAA2B,CAAC,SAIV;AAC7B,QAAM,UAAU,OAAU,QAQR;AAChB,UAAM,aAAa,MAAM,KAAK,YAAY,IAAI,KAAK,cAAc;AACjE,UAAM,YAAY,gBAAgB;AAAA,MAChC,SAAS,KAAK,OAAO;AAAA,MACrB,MAAM,EAAE,QAAQ,WAAW,OAAO;AAAA,MAClC,OAAO,KAAK,OAAO;AAAA,MACnB,kBAAkB,KAAK,OAAO;AAAA,IAChC,CAAC;AACD,UAAM,WAAW,MAAM,UAAU,QAAQ;AAAA,MACvC,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,OAAO,IAAI;AAAA,MACX,UAAU,IAAI;AAAA,MACd,SAAS,IAAI;AAAA,MACb,QAAQ,IAAI;AAAA,IACd,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,eAAe,IAAK,MAAK,YAAY,WAAW,KAAK,cAAc;AAChF,YAAM,kBAAkB,SAAS,OAAO,SAAS,cAAc,IAAI;AAAA,IACrE;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,SAAS,IAAI,OAAO,UAAU,MAAM;AAC1C,QAAI,CAAC,OAAO;AACV,YAAM,kBAAkB,4BAA4B,IAAI,IAAI,aAAa,IAAI;AAC/E,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,eAAe,CAAC,aAA6B,cAAc,mBAAmB,QAAQ,CAAC;AAC7F,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,6BAA6B,IAAI;AAC3E,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,QAAuC;AACtD,UAAM,QAAQ,uBAAuB,GAAG;AACxC,QAAI,SAAS,KAAM,OAAM,kBAAkB,0BAA0B,IAAI;AACzE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,yBAAyB,IAAI;AACvE,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAEhB,SAAO;AAAA,IACL,kBAAkB,OAAO,YAAY,UAAU;AAC7C,YAAM,SAAS,MAAM,yBAAyB;AAAA,QAC5C,cAAc,aAAa,UAAU;AAAA,QACrC,SAAS;AAAA,QACT,WAAW;AAAA,UACT,SAAS,OAAOC,UACd;AAAA,YACE,MAAM,QAAQ;AAAA,cACZ,QAAQA,MAAK;AAAA,cACb,MAAMA,MAAK;AAAA,cACX,OAAOA,MAAK;AAAA,cACZ,MAAMA,MAAK;AAAA,cACX,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACJ;AAAA,MACF,CAAC;AACD,UAAI,CAAC,OAAO,GAAI,OAAM,kBAAkB,OAAO,OAAO,OAAO,cAAc,IAAI;AAC/E,aAAO,MAAM,cAAc,2BAA2B,aAAa,eAAe,OAAO,OACrF,EAAE,GAAG,OAAO,MAAM,SAAS,KAAK,IAChC,OAAO;AAAA,IACb;AAAA,IACA,gBAAgB,OAAO,MAAM,mBAAmB;AAC9C,YAAM,EAAE,OAAO,IAAI,MAAM,KAAK,YAAY,IAAI,KAAK,cAAc;AACjE,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,UAAU,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO;AAAA,QAChD,SAAS,EAAE,mBAAmB,eAAe;AAAA,QAC7C,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,OAAO,SAAS,QAAQ;AAAA,IACjC;AAAA,IACA,aAAa,OAAO,aAAa;AAC/B,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,aAAa,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,QAAQ;AAAA,MACjC,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAU,WAAW;AAClC,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC,YAAY,MAAM;AAAA,QACjD,MAAM,CAAC;AAAA,QACP,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,CAAC,YAAY,YAC9B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,oBAAoB,OAAO,YAAY,YAAY;AACjD,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,UAAU,CAAC,mBAAmB,mBAAmB,OAAO,CAAC;AAAA,QAC/E,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,cAAc,CAAC,YAAY,SACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,cAAc,CAAC,YAAY,WACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAAA,IAC7C,CAAC;AAAA,IACH,YAAY,CAAC,YAAY,YACvB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,WAAW,CAAC;AAAA,MAClB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAAA,IACtF,CAAC;AAAA,IACH,mBAAmB,OAAO,YAAY,WACpC,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,CAAC;AAAA,IACpF,CAAC;AAAA,IACH,iBAAiB,CAAC,YAAY,YAC5B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,EAAE,KAAK,QAAQ,KAAK,gBAAgB,QAAQ,eAAe;AAAA,MACjE,QAAQ,QAAQ;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,kBAAkB,OAAO,YAAY,WAAW;AAC9C,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,aAAa,UAAU;AAAA,QAC7B,MAAM,EAAE,SAAS,OAAO;AAAA,QACxB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,MAAM,CAAC,YAAY,SACjB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,KAAK,CAAC,YAAY,SAChB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,QAAQ,CAAC,MACP,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,MAChF,OAAO;AAAA,QACL,QAAQ,EAAE;AAAA,QACV,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,QAAQ,OAAO,EAAE,MAAM;AAAA,MACzB;AAAA,MACA,QAAQ,EAAE;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,OAAO,OAAO,MAAM;AAClB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE;AAAA,QACR,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE,QAAQ,EAAE,OAAO;AAAA,QACzB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,UAAU,OAAO,MAAM;AACrB,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,OAAO;AAAA,UACL,MAAM,EAAE;AAAA,UACR,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,YAAY;AAAA,QACd;AAAA,QACA,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,EAAE,SAAS,KAAK,KAAK,WAAW,EAAE,QAAQ;AAC5C,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,SAAS,KAAK,SAAS,KAAK,KAAK,IAAI;AAAA,IAChD;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,QAAQ,EAAE,OAAO;AAAA,QAC3D,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,oBAAoB,OAAO,OAEvB,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,MAAM,EAAE;AAAA,QACR,YAAY,EAAE;AAAA,QACd,QAAQ,CAAC,MAAM;AAAA,QACf,WAAW,EAAE,UAAU,YAAY;AAAA,MACrC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC,GACD;AAAA,IACJ,YAAY,OAAO,OAEf,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,MAAM;AAAA,MAC5C,QAAQ;AAAA,IACV,CAAC,GACD,OAAO,IAAI,OAAO;AAAA,IACtB,eAAe,OAAO,MACpB;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,wBAAwB,OAAO,EAAE,WAAW,EAAE,UAAU,IAAI;AAAA,QACpE,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,UAAU,OAAO,mBACf;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,WAAW,mBAAmB,cAAc,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,iBAAiB,OAAO,UAAU,YAChC;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC;AAAA,QAC/B,MAAM,WAAW,CAAC;AAAA,QAClB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,kBAAkB,OAAO,QAAQ,aAC/B;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,QAC1C,MAAM,EAAE,SAAS;AAAA,QACjB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,SAAS,OAAO,WAAW;AACzB,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,UAC1C,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,IAAI;AAAA,MAC7B,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import {\n  ProcessInspectionOperation,\n  type ProcessInspectionRequestIface,\n  type ProcessInspectionResultIface,\n} from '@finalai/agent-protocol/process-inspection';\nimport type { JsonValue } from '@finalai/agent-provider';\nimport { jsonValueSchema } from '@finalai/agent-provider';\nimport {\n  computerBrowserAccessSchema,\n  ComputerImageState,\n  computerSnapshotResponseSchema,\n  createTransport,\n  normalizeComputerBase,\n  normalizeComputerImage,\n  normalizeComputerInfo,\n  ok,\n  type ComputerBaseIface,\n  type ComputerBrowserAccessIface,\n  type ComputerBrowserAccessOptionsIface,\n  type ComputerCommandMode,\n  ComputerEgressPolicy,\n  type ComputerIdlePolicy,\n  type ComputerImageIface,\n  type ComputerInfoIface,\n  type ComputerScreenOpenOptionsIface,\n  type ComputerSnapshotRequestIface,\n  type ComputerSnapshotResponseIface,\n} from '@finalai/computers';\nimport * as z from 'zod';\nimport { inspectComputerProcesses } from \"./computer-processes.mjs\";\nimport { COMPUTERS_API_KEY_SECRET } from \"./environment.mjs\";\n\n// The public Computers API (`/v1`, vm-service/docs/v1-api.md), authenticated the\n// way any developer's code is: an organization API key as the bearer. The\n// provider holds no platform credential and reaches no `/internal` route. This\n// speaks the REST surface directly, reusing @finalai/computers's row\n// normalization, because the provider needs an injected fetch and per-call\n// abort signals that the SDK's client does not take.\n\n// An organization's Computers API credential. `teamId` (`team_...`) owns the\n// computers when the key has no owning user (an organization or team key),\n// which POST /v1/computers requires.\nexport interface ComputersApiCredentialIface {\n  apiKey: string;\n  teamId: string | null;\n}\n\nexport interface ComputersApiConfigIface {\n  // Public Computers API origin (VM_SERVICE_WORKER_DOMAIN); requests go to `<url>/v1/...`.\n  url: string;\n  // The organization's credential, null when it has none.\n  credential: (args: { organizationId: string }) => Promise<ComputersApiCredentialIface | null>;\n  // How long a resolved credential is reused before it is read again; a 401 drops it at once.\n  credentialTtlMs?: number;\n  fetch?: typeof fetch;\n  requestTimeoutMs?: number;\n}\n\nexport enum ComputersApiErrorCode {\n  CredentialMissing = 'credential_missing',\n  RequestFailed = 'request_failed',\n}\n\nexport interface ComputersApiErrorIface extends Error {\n  code: ComputersApiErrorCode;\n  statusCode: number | null;\n}\n\nexport const computersApiError = (\n  message: string,\n  statusCode: number | null,\n  code: ComputersApiErrorCode = ComputersApiErrorCode.RequestFailed,\n): ComputersApiErrorIface =>\n  Object.assign(new Error(message), { name: 'ComputersApiError', code, statusCode });\n\nexport const isComputersApiError = (cause: unknown): cause is ComputersApiErrorIface =>\n  cause instanceof Error && 'statusCode' in cause && 'code' in cause;\n\nexport const isComputersApiStatus = (cause: unknown, ...statuses: number[]): boolean =>\n  isComputersApiError(cause) && cause.statusCode != null && statuses.includes(cause.statusCode);\n\n// Exactly one of imageVersionId (a registered image) and baseId (a captured computer).\nexport interface CreateComputerBodyIface {\n  name: string;\n  imageVersionId?: string;\n  baseId?: string;\n  regionSlug?: string;\n  vcpu?: number;\n  memoryMb?: number;\n  diskGb?: number;\n  // Null: no user volume, so everything the computer writes is on the disk a capture takes.\n  userVolumeGb?: number | null;\n  env: Record<string, string>;\n  commandMode?: ComputerCommandMode;\n  customCommand?: string;\n  ephemeral?: boolean;\n  idleTimeoutSeconds?: number;\n  idlePolicy?: ComputerIdlePolicy;\n  network?: { egress: ComputerEgressPolicy; allow?: string[] };\n  autoResume?: boolean;\n  tags?: string[];\n}\n\nexport interface ExecBodyIface {\n  autoResume?: boolean;\n  command: string;\n  env?: Record<string, string>;\n  cwd?: string;\n  user?: string;\n  timeoutMs?: number;\n  readyTimeoutMs?: number;\n}\n\n// `stop` shelves a computer that is not ephemeral: its disks go to storage and\n// its host is released; `start` brings it back with its files (vm-service\n// docs/v1-api.md).\nexport type ComputerAction = 'start' | 'stop' | 'pause' | 'resume' | 'delete';\n\nconst outputStreamSchema = z.object({\n  dataB64: z.string(),\n  offset: z.number(),\n  nextOffset: z.number(),\n  eof: z.boolean(),\n});\nconst processOutputSchema = z.object({\n  stdout: outputStreamSchema,\n  stderr: outputStreamSchema,\n  state: z.union([z.literal('running'), z.literal('exited')]),\n  result: z.object({ exitCode: z.number().nullable(), signal: z.string().nullable() }).nullable(),\n});\nexport type ComputerProcessOutputIface = z.infer<typeof processOutputSchema>;\nconst runResponseSchema = processOutputSchema.extend({\n  id: z.string(),\n  bootId: z.string(),\n  timedOut: z.boolean(),\n});\nexport type ComputerRunResultIface = z.infer<typeof runResponseSchema>;\nconst execResponseSchema = z.object({ id: z.string(), bootId: z.string() });\nconst fileReadSchema = z.object({\n  dataB64: z.string(),\n  eof: z.boolean(),\n  offset: z.number().optional(),\n});\nconst tokenSchema = z.object({ id: z.string(), token: z.string() });\nconst computerResponseSchema = z.object({ computer: jsonValueSchema });\nconst imageResponseSchema = z.object({ image: jsonValueSchema });\nconst baseResponseSchema = z.object({ base: jsonValueSchema });\nconst imagesResponseSchema = z.object({ images: z.array(jsonValueSchema) });\n\nexport interface ComputersApiClientIface {\n  disableAutoResume(computerId: string): Promise<void>;\n  inspectProcesses(\n    computerId: string,\n    input: ProcessInspectionRequestIface,\n  ): Promise<ProcessInspectionResultIface>;\n  openBrowserAccess(\n    computerId: string,\n    options: ComputerBrowserAccessOptionsIface,\n  ): Promise<ComputerBrowserAccessIface>;\n  closeBrowserAccess(computerId: string, tokenId: string): Promise<void>;\n  readSnapshot(\n    computerId: string,\n    request: ComputerSnapshotRequestIface,\n  ): Promise<ComputerSnapshotResponseIface>;\n  screenStatus(computerId: string, signal?: AbortSignal): Promise<{ available: boolean }>;\n  openScreen(\n    computerId: string,\n    options?: ComputerScreenOpenOptionsIface,\n  ): Promise<{ url: string; token: string; expiresAt: string }>;\n  computerUseStatus(\n    computerId: string,\n    signal?: AbortSignal,\n  ): Promise<{ available: boolean; installed: boolean }>;\n  openComputerUse(\n    computerId: string,\n    options: { cwd: string; readyTimeoutMs?: number; signal?: AbortSignal },\n  ): Promise<{ id: string; bootId: string }>;\n  setNetworkPolicy(\n    computerId: string,\n    policy: { egress: ComputerEgressPolicy; allow?: string[] },\n    lifecycle?: { autoResume: false },\n  ): Promise<void>;\n  createComputer(body: CreateComputerBodyIface, idempotencyKey: string): Promise<ComputerInfoIface>;\n  // Null when the computer does not exist (or was deleted).\n  getComputer(idOrName: string): Promise<ComputerInfoIface | null>;\n  getNetworkPolicy(\n    idOrName: string,\n  ): Promise<{ egress: ComputerEgressPolicy; allow: string[] } | null>;\n  action(idOrName: string, action: ComputerAction): Promise<void>;\n  exec(computerId: string, body: ExecBodyIface): Promise<{ id: string; bootId: string }>;\n  run(\n    computerId: string,\n    body: ExecBodyIface & { waitMs?: number },\n  ): Promise<ComputerRunResultIface>;\n  output(args: {\n    computerId: string;\n    processId: string;\n    bootId: string;\n    stdoutOffset: number;\n    stderrOffset: number;\n    waitMs: number;\n    signal?: AbortSignal;\n  }): Promise<ComputerProcessOutputIface>;\n  input(args: {\n    computerId: string;\n    processId: string;\n    body: Record<string, JsonValue>;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  terminate(args: { computerId: string; processId: string; bootId: string }): Promise<void>;\n  readFile(args: {\n    computerId: string;\n    path: string;\n    offset: number;\n    length: number;\n    signal?: AbortSignal;\n  }): Promise<{ dataB64: string; eof: boolean }>;\n  writeFile(args: {\n    computerId: string;\n    path: string;\n    dataB64: string;\n    append: boolean;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  // An `http`-scoped token for one computer's ports (a preview token).\n  createPreviewToken(args: { computerId: string; name: string; expiresAt: Date }): Promise<string>;\n  // The organization's and the platform's image versions, newest first.\n  listImages(args: { lineage: string; state: ComputerImageState }): Promise<ComputerImageIface[]>;\n  // Registering a digest the organization already has returns that version.\n  registerImage(args: {\n    reference: string;\n    registryCredentialId?: string;\n  }): Promise<ComputerImageIface>;\n  getImage(imageVersionId: string): Promise<ComputerImageIface>;\n  // Captures a running computer as a base; the computer stops for it.\n  captureComputer(idOrName: string, options?: { retained?: boolean }): Promise<ComputerBaseIface>;\n  setBaseRetention(baseId: string, retained: boolean): Promise<ComputerBaseIface>;\n  // Null when the base does not exist.\n  getBase(baseId: string): Promise<ComputerBaseIface | null>;\n}\n\ninterface CachedCredentialIface {\n  value: ComputersApiCredentialIface;\n  expiresAtMs: number;\n}\n\nexport interface ComputersApiCredentialsIface {\n  get(organizationId: string): Promise<ComputersApiCredentialIface>;\n  invalidate(organizationId: string): void;\n}\n\n// Credentials per organization, reused for `credentialTtlMs` (default 60 s, as\n// vm-service caches an API key's validation) so a handle's calls do not each\n// read the secret store.\nexport const createComputersApiCredentials = (\n  config: Pick<ComputersApiConfigIface, 'credential' | 'credentialTtlMs'>,\n  now: () => number = () => Date.now(),\n): ComputersApiCredentialsIface => {\n  const cache = new Map<string, CachedCredentialIface>();\n  const ttlMs = config.credentialTtlMs ?? 60_000;\n  return {\n    get: async (organizationId) => {\n      const cached = cache.get(organizationId);\n      if (cached != null && cached.expiresAtMs > now()) return cached.value;\n      const value = await config.credential({ organizationId });\n      if (value == null) {\n        throw computersApiError(\n          `this organization has no Computers API key for the computer sandbox: create an organization API key and store it as the organization secret ${COMPUTERS_API_KEY_SECRET}`,\n          null,\n          ComputersApiErrorCode.CredentialMissing,\n        );\n      }\n      cache.set(organizationId, { value, expiresAtMs: now() + ttlMs });\n      return value;\n    },\n    invalidate: (organizationId) => {\n      cache.delete(organizationId);\n    },\n  };\n};\n\nexport const createComputersApiClient = (args: {\n  config: ComputersApiConfigIface;\n  credentials: ComputersApiCredentialsIface;\n  organizationId: string;\n}): ComputersApiClientIface => {\n  const request = async <T>(req: {\n    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n    path: string;\n    query?: Record<string, string>;\n    body?: object;\n    headers?: Record<string, string>;\n    signal?: AbortSignal;\n    schema: z.ZodType<T>;\n  }): Promise<T> => {\n    const credential = await args.credentials.get(args.organizationId);\n    const transport = createTransport({\n      baseUrl: args.config.url,\n      auth: { apiKey: credential.apiKey },\n      fetch: args.config.fetch,\n      requestTimeoutMs: args.config.requestTimeoutMs,\n    });\n    const response = await transport.request({\n      method: req.method,\n      path: req.path,\n      query: req.query,\n      jsonBody: req.body,\n      headers: req.headers,\n      signal: req.signal,\n    });\n    if (!response.ok) {\n      if (response.statusCode === 401) args.credentials.invalidate(args.organizationId);\n      throw computersApiError(response.error, response.statusCode ?? null);\n    }\n    const parsed = response.data;\n    const result = req.schema.safeParse(parsed);\n    if (!result.success)\n      throw computersApiError(`unexpected Computers API ${req.path} response`, null);\n    return result.data;\n  };\n\n  const computerPath = (idOrName: string): string => `/computers/${encodeURIComponent(idOrName)}`;\n  const toInfo = (row: JsonValue): ComputerInfoIface => {\n    const info = normalizeComputerInfo(row);\n    if (info == null) throw computersApiError('unexpected computer shape', null);\n    return info;\n  };\n  const toImage = (row: JsonValue): ComputerImageIface => {\n    const image = normalizeComputerImage(row);\n    if (image == null) throw computersApiError('unexpected image shape', null);\n    return image;\n  };\n  const toBase = (row: JsonValue): ComputerBaseIface => {\n    const base = normalizeComputerBase(row);\n    if (base == null) throw computersApiError('unexpected base shape', null);\n    return base;\n  };\n  const anyBody = jsonValueSchema;\n\n  return {\n    inspectProcesses: async (computerId, input) => {\n      const result = await inspectComputerProcesses({\n        computerPath: computerPath(computerId),\n        request: input,\n        transport: {\n          request: async (args) =>\n            ok(\n              await request({\n                method: args.method,\n                path: args.path,\n                query: args.query,\n                body: args.jsonBody,\n                schema: jsonValueSchema,\n              }),\n            ),\n        },\n      });\n      if (!result.ok) throw computersApiError(result.error, result.statusCode ?? null);\n      return input.operation === ProcessInspectionOperation.Available && 'available' in result.data\n        ? { ...result.data, canStop: true }\n        : result.data;\n    },\n    createComputer: async (body, idempotencyKey) => {\n      const { teamId } = await args.credentials.get(args.organizationId);\n      const response = await request({\n        method: 'POST',\n        path: '/computers',\n        body: teamId == null ? body : { ...body, teamId },\n        headers: { 'idempotency-key': idempotencyKey },\n        schema: computerResponseSchema,\n      });\n      return toInfo(response.computer);\n    },\n    getNetworkPolicy: async (idOrName) => {\n      const response = await request({\n        method: 'GET',\n        path: computerPath(idOrName),\n        schema: computerResponseSchema,\n      });\n      const parsed = z\n        .object({\n          network: z.object({\n            egress: z.nativeEnum(ComputerEgressPolicy),\n            allow: z.array(z.string()).default([]),\n          }),\n        })\n        .safeParse(response.computer);\n      if (!parsed.success)\n        throw computersApiError(\n          'The public Computers API did not return a supported network policy',\n          null,\n        );\n      return parsed.data.network;\n    },\n    getComputer: async (idOrName) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: computerPath(idOrName),\n          schema: computerResponseSchema,\n        });\n        return toInfo(response.computer);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n    action: async (idOrName, action) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(idOrName)}/actions/${action}`,\n        body: {},\n        schema: anyBody,\n      });\n    },\n    openBrowserAccess: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/browser-access`,\n        body: options,\n        schema: computerBrowserAccessSchema,\n      }),\n    closeBrowserAccess: async (computerId, tokenId) => {\n      await request({\n        method: 'DELETE',\n        path: `${computerPath(computerId)}/browser-access/${encodeURIComponent(tokenId)}`,\n        schema: anyBody,\n      });\n    },\n    readSnapshot: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/file-snapshots/read`,\n        body,\n        schema: computerSnapshotResponseSchema,\n      }),\n    screenStatus: (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/screen`,\n        signal,\n        schema: z.object({ available: z.boolean() }),\n      }),\n    openScreen: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/screen`,\n        body: options ?? {},\n        schema: z.object({ url: z.string().url(), token: z.string(), expiresAt: z.string() }),\n      }),\n    computerUseStatus: async (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/computer-use`,\n        signal,\n        schema: z.object({ available: z.boolean(), installed: z.boolean().default(false) }),\n      }),\n    openComputerUse: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/computer-use`,\n        body: { cwd: options.cwd, readyTimeoutMs: options.readyTimeoutMs },\n        signal: options.signal,\n        schema: execResponseSchema,\n      }),\n    disableAutoResume: async (computerId) => {\n      await request({\n        method: 'PATCH',\n        path: computerPath(computerId),\n        body: { autoResume: false },\n        schema: computerResponseSchema,\n      });\n    },\n    setNetworkPolicy: async (computerId, policy, lifecycle) => {\n      await request({\n        method: 'PATCH',\n        path: computerPath(computerId),\n        body: { network: policy, ...lifecycle },\n        schema: computerResponseSchema,\n      });\n    },\n    exec: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/exec`,\n        body,\n        schema: execResponseSchema,\n      }),\n    run: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/run`,\n        body,\n        schema: runResponseSchema,\n      }),\n    output: (o) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/output`,\n        query: {\n          bootId: o.bootId,\n          stdoutOffset: String(o.stdoutOffset),\n          stderrOffset: String(o.stderrOffset),\n          waitMs: String(o.waitMs),\n        },\n        signal: o.signal,\n        schema: processOutputSchema,\n      }),\n    input: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/input`,\n        body: o.body,\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    terminate: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/terminate`,\n        body: { bootId: o.bootId },\n        schema: anyBody,\n      });\n    },\n    readFile: async (o) => {\n      const read = await request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/files`,\n        query: {\n          path: o.path,\n          offset: String(o.offset),\n          length: String(o.length),\n          autoResume: 'false',\n        },\n        signal: o.signal,\n        schema: fileReadSchema,\n      });\n      // The API echoes the offset; a server that ignored the range would hand back the start again.\n      if (o.offset > 0 && read.offset !== o.offset) {\n        throw computersApiError(\n          'the Computers API ignored a ranged file read; partial contents refused',\n          null,\n        );\n      }\n      return { dataB64: read.dataB64, eof: read.eof };\n    },\n    writeFile: async (o) => {\n      await request({\n        method: 'PUT',\n        path: `${computerPath(o.computerId)}/files`,\n        body: { path: o.path, dataB64: o.dataB64, append: o.append },\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    createPreviewToken: async (o) =>\n      (\n        await request({\n          method: 'POST',\n          path: '/tokens',\n          body: {\n            name: o.name,\n            computerId: o.computerId,\n            scopes: ['http'],\n            expiresAt: o.expiresAt.toISOString(),\n          },\n          schema: tokenSchema,\n        })\n      ).token,\n    listImages: async (o) =>\n      (\n        await request({\n          method: 'GET',\n          path: '/images',\n          query: { lineage: o.lineage, state: o.state },\n          schema: imagesResponseSchema,\n        })\n      ).images.map(toImage),\n    registerImage: async (o) =>\n      toImage(\n        (\n          await request({\n            method: 'POST',\n            path: '/images',\n            body: o.registryCredentialId == null ? { reference: o.reference } : o,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    getImage: async (imageVersionId) =>\n      toImage(\n        (\n          await request({\n            method: 'GET',\n            path: `/images/${encodeURIComponent(imageVersionId)}`,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    captureComputer: async (idOrName, options) =>\n      toBase(\n        (\n          await request({\n            method: 'POST',\n            path: `${computerPath(idOrName)}/capture`,\n            body: options ?? {},\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    setBaseRetention: async (baseId, retained) =>\n      toBase(\n        (\n          await request({\n            method: 'PATCH',\n            path: `/bases/${encodeURIComponent(baseId)}`,\n            body: { retained },\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    getBase: async (baseId) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: `/bases/${encodeURIComponent(baseId)}`,\n          schema: baseResponseSchema,\n        });\n        return toBase(response.base);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n  };\n};\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,OAGK;AAEP,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAKA;AAAA,OAOK;AACP,YAAY,OAAO;AACnB,SAAS,gCAAgC;AACzC,SAAS,gCAAgC;AA4BlC,IAAK,wBAAL,kBAAKA,2BAAL;AACL,EAAAA,uBAAA,uBAAoB;AACpB,EAAAA,uBAAA,mBAAgB;AAFN,SAAAA;AAAA,GAAA;AAUL,MAAM,oBAAoB,CAC/B,SACA,YACA,OAA8B,yCAE9B,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,MAAM,qBAAqB,MAAM,WAAW,CAAC;AAE5E,MAAM,sBAAsB,CAAC,UAClC,iBAAiB,SAAS,gBAAgB,SAAS,UAAU;AAExD,MAAM,uBAAuB,CAAC,UAAmB,aACtD,oBAAoB,KAAK,KAAK,MAAM,cAAc,QAAQ,SAAS,SAAS,MAAM,UAAU;AAuC9F,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,SAAS,EAAE,OAAO;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,EACjB,YAAY,EAAE,OAAO;AAAA,EACrB,KAAK,EAAE,QAAQ;AACjB,CAAC;AACD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC1D,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS;AAChG,CAAC;AAED,MAAM,oBAAoB,oBAAoB,OAAO;AAAA,EACnD,IAAI,EAAE,OAAO;AAAA,EACb,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1E,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,SAAS,EAAE,OAAO;AAAA,EAClB,KAAK,EAAE,QAAQ;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAClE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,gBAAgB,CAAC;AACrE,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC;AAC/D,MAAM,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC7D,MAAM,uBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,EAAE,CAAC;AA2GnE,MAAM,gCAAgC,CAC3C,QACA,MAAoB,MAAM,KAAK,IAAI,MACF;AACjC,QAAM,QAAQ,oBAAI,IAAmC;AACrD,QAAM,QAAQ,OAAO,mBAAmB;AACxC,SAAO;AAAA,IACL,KAAK,OAAO,mBAAmB;AAC7B,YAAM,SAAS,MAAM,IAAI,cAAc;AACvC,UAAI,UAAU,QAAQ,OAAO,cAAc,IAAI,EAAG,QAAO,OAAO;AAChE,YAAM,QAAQ,MAAM,OAAO,WAAW,EAAE,eAAe,CAAC;AACxD,UAAI,SAAS,MAAM;AACjB,cAAM;AAAA,UACJ,+IAA+I,wBAAwB;AAAA,UACvK;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,gBAAgB,EAAE,OAAO,aAAa,IAAI,IAAI,MAAM,CAAC;AAC/D,aAAO;AAAA,IACT;AAAA,IACA,YAAY,CAAC,mBAAmB;AAC9B,YAAM,OAAO,cAAc;AAAA,IAC7B;AAAA,EACF;AACF;AAEO,MAAM,2BAA2B,CAAC,SAIV;AAC7B,QAAM,UAAU,OAAU,QAQR;AAChB,UAAM,aAAa,MAAM,KAAK,YAAY,IAAI,KAAK,cAAc;AACjE,UAAM,YAAY,gBAAgB;AAAA,MAChC,SAAS,KAAK,OAAO;AAAA,MACrB,MAAM,EAAE,QAAQ,WAAW,OAAO;AAAA,MAClC,OAAO,KAAK,OAAO;AAAA,MACnB,kBAAkB,KAAK,OAAO;AAAA,IAChC,CAAC;AACD,UAAM,WAAW,MAAM,UAAU,QAAQ;AAAA,MACvC,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,OAAO,IAAI;AAAA,MACX,UAAU,IAAI;AAAA,MACd,SAAS,IAAI;AAAA,MACb,QAAQ,IAAI;AAAA,IACd,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,eAAe,IAAK,MAAK,YAAY,WAAW,KAAK,cAAc;AAChF,YAAM,kBAAkB,SAAS,OAAO,SAAS,cAAc,IAAI;AAAA,IACrE;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,SAAS,IAAI,OAAO,UAAU,MAAM;AAC1C,QAAI,CAAC,OAAO;AACV,YAAM,kBAAkB,4BAA4B,IAAI,IAAI,aAAa,IAAI;AAC/E,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,eAAe,CAAC,aAA6B,cAAc,mBAAmB,QAAQ,CAAC;AAC7F,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,6BAA6B,IAAI;AAC3E,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,QAAuC;AACtD,UAAM,QAAQ,uBAAuB,GAAG;AACxC,QAAI,SAAS,KAAM,OAAM,kBAAkB,0BAA0B,IAAI;AACzE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,yBAAyB,IAAI;AACvE,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAEhB,SAAO;AAAA,IACL,kBAAkB,OAAO,YAAY,UAAU;AAC7C,YAAM,SAAS,MAAM,yBAAyB;AAAA,QAC5C,cAAc,aAAa,UAAU;AAAA,QACrC,SAAS;AAAA,QACT,WAAW;AAAA,UACT,SAAS,OAAOC,UACd;AAAA,YACE,MAAM,QAAQ;AAAA,cACZ,QAAQA,MAAK;AAAA,cACb,MAAMA,MAAK;AAAA,cACX,OAAOA,MAAK;AAAA,cACZ,MAAMA,MAAK;AAAA,cACX,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACJ;AAAA,MACF,CAAC;AACD,UAAI,CAAC,OAAO,GAAI,OAAM,kBAAkB,OAAO,OAAO,OAAO,cAAc,IAAI;AAC/E,aAAO,MAAM,cAAc,2BAA2B,aAAa,eAAe,OAAO,OACrF,EAAE,GAAG,OAAO,MAAM,SAAS,KAAK,IAChC,OAAO;AAAA,IACb;AAAA,IACA,gBAAgB,OAAO,MAAM,mBAAmB;AAC9C,YAAM,EAAE,OAAO,IAAI,MAAM,KAAK,YAAY,IAAI,KAAK,cAAc;AACjE,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,UAAU,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO;AAAA,QAChD,SAAS,EAAE,mBAAmB,eAAe;AAAA,QAC7C,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,OAAO,SAAS,QAAQ;AAAA,IACjC;AAAA,IACA,kBAAkB,OAAO,aAAa;AACpC,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B,QAAQ;AAAA,QACR,MAAM,aAAa,QAAQ;AAAA,QAC3B,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,SAAS,EACZ,OAAO;AAAA,QACN,SAAS,EAAE,OAAO;AAAA,UAChB,QAAQ,EAAE,WAAW,oBAAoB;AAAA,UACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,QACvC,CAAC;AAAA,MACH,CAAC,EACA,UAAU,SAAS,QAAQ;AAC9B,UAAI,CAAC,OAAO;AACV,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AACF,aAAO,OAAO,KAAK;AAAA,IACrB;AAAA,IACA,aAAa,OAAO,aAAa;AAC/B,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,aAAa,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,QAAQ;AAAA,MACjC,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAU,WAAW;AAClC,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC,YAAY,MAAM;AAAA,QACjD,MAAM,CAAC;AAAA,QACP,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,CAAC,YAAY,YAC9B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,oBAAoB,OAAO,YAAY,YAAY;AACjD,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,UAAU,CAAC,mBAAmB,mBAAmB,OAAO,CAAC;AAAA,QAC/E,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,cAAc,CAAC,YAAY,SACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,cAAc,CAAC,YAAY,WACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAAA,IAC7C,CAAC;AAAA,IACH,YAAY,CAAC,YAAY,YACvB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,WAAW,CAAC;AAAA,MAClB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAAA,IACtF,CAAC;AAAA,IACH,mBAAmB,OAAO,YAAY,WACpC,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,CAAC;AAAA,IACpF,CAAC;AAAA,IACH,iBAAiB,CAAC,YAAY,YAC5B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,EAAE,KAAK,QAAQ,KAAK,gBAAgB,QAAQ,eAAe;AAAA,MACjE,QAAQ,QAAQ;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,mBAAmB,OAAO,eAAe;AACvC,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,aAAa,UAAU;AAAA,QAC7B,MAAM,EAAE,YAAY,MAAM;AAAA,QAC1B,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,OAAO,YAAY,QAAQ,cAAc;AACzD,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,aAAa,UAAU;AAAA,QAC7B,MAAM,EAAE,SAAS,QAAQ,GAAG,UAAU;AAAA,QACtC,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,MAAM,CAAC,YAAY,SACjB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,KAAK,CAAC,YAAY,SAChB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,QAAQ,CAAC,MACP,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,MAChF,OAAO;AAAA,QACL,QAAQ,EAAE;AAAA,QACV,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,QAAQ,OAAO,EAAE,MAAM;AAAA,MACzB;AAAA,MACA,QAAQ,EAAE;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,OAAO,OAAO,MAAM;AAClB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE;AAAA,QACR,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE,QAAQ,EAAE,OAAO;AAAA,QACzB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,UAAU,OAAO,MAAM;AACrB,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,OAAO;AAAA,UACL,MAAM,EAAE;AAAA,UACR,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,YAAY;AAAA,QACd;AAAA,QACA,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,EAAE,SAAS,KAAK,KAAK,WAAW,EAAE,QAAQ;AAC5C,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,SAAS,KAAK,SAAS,KAAK,KAAK,IAAI;AAAA,IAChD;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,QAAQ,EAAE,OAAO;AAAA,QAC3D,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,oBAAoB,OAAO,OAEvB,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,MAAM,EAAE;AAAA,QACR,YAAY,EAAE;AAAA,QACd,QAAQ,CAAC,MAAM;AAAA,QACf,WAAW,EAAE,UAAU,YAAY;AAAA,MACrC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC,GACD;AAAA,IACJ,YAAY,OAAO,OAEf,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,MAAM;AAAA,MAC5C,QAAQ;AAAA,IACV,CAAC,GACD,OAAO,IAAI,OAAO;AAAA,IACtB,eAAe,OAAO,MACpB;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,wBAAwB,OAAO,EAAE,WAAW,EAAE,UAAU,IAAI;AAAA,QACpE,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,UAAU,OAAO,mBACf;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,WAAW,mBAAmB,cAAc,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,iBAAiB,OAAO,UAAU,YAChC;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC;AAAA,QAC/B,MAAM,WAAW,CAAC;AAAA,QAClB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,kBAAkB,OAAO,QAAQ,aAC/B;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,QAC1C,MAAM,EAAE,SAAS;AAAA,QACjB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,SAAS,OAAO,WAAW;AACzB,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,UAC1C,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,IAAI;AAAA,MAC7B,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["ComputersApiErrorCode", "args"]
 }

package/dist/modules/sandboxes/device-api.d.mts

@@ -1,3 +1,4 @@
+import { deviceEgressEnrollmentSchema, deviceEgressLeaseSchema, deviceEgressWorkspaceSchema, deviceWorkspaceNetworkStateSchema, type WorkspaceNetworkPolicyIface } from '@finalai/agent-protocol/device-egress';
 import { type ProcessInspectionRequestIface, type ProcessInspectionResultIface } from '@finalai/agent-protocol/process-inspection';
 import { type SandboxActingUserIface } from '@finalai/agent-provider/sandbox';
 import * as z from 'zod';
@@ -13,6 +14,7 @@ export interface DeviceApiConfigIface {
         organizationId: string;
     }) => Promise<string | null>;
     credentialTtlMs?: number;
+    fetch?: DeviceApiFetchIface;
 }
 export interface DeviceApiFetchIface {
     (input: string, init: RequestInit): Promise<Response>;
@@ -66,14 +68,59 @@ export declare const DEVICE_API_FILE_CHUNK_BYTES: number;
 export declare const DEVICE_API_OUTPUT_WAIT_MS = 15000;
 export declare enum DeviceApiClientErrorCode {
     CredentialMissing = "credential_missing",
-    NoActingUser = "no_acting_user"
+    NoActingUser = "no_acting_user",
+    EgressEnrollmentLost = "egress_enrollment_lost"
 }
 export interface DeviceApiErrorIface extends Error {
     status: number | null;
     code: string;
 }
+export declare const deviceApiCodeOf: (cause: unknown) => string | null;
 export declare const deviceApiStatusOf: (cause: Error) => number | null;
 export interface DeviceApiClientIface {
+    egress: {
+        networkState(args: {
+            organizationId: string;
+            workspaceId: string;
+        }): Promise<z.infer<typeof deviceWorkspaceNetworkStateSchema>>;
+        setNetworkPolicy(args: {
+            caller: DeviceApiCallerIface;
+            workspaceId: string;
+            policy: WorkspaceNetworkPolicyIface;
+            initializeIfMissing?: boolean;
+        }): Promise<void>;
+        workspace(args: {
+            caller: DeviceApiCallerIface;
+            workspaceId: string;
+        }): Promise<z.infer<typeof deviceEgressWorkspaceSchema>>;
+        create(args: {
+            caller: DeviceApiCallerIface;
+            workspaceId: string;
+            deviceIds: string[];
+            dnsResolvers?: string[];
+        }): Promise<z.infer<typeof deviceEgressEnrollmentSchema>>;
+        renew(args: {
+            caller: DeviceApiCallerIface;
+            leaseId: string;
+        }): Promise<z.infer<typeof deviceEgressLeaseSchema>>;
+        activate(args: {
+            caller: DeviceApiCallerIface;
+            leaseId: string;
+        }): Promise<z.infer<typeof deviceEgressLeaseSchema>>;
+        revoke(args: {
+            caller: DeviceApiCallerIface;
+            leaseId: string;
+            workspaceId: string;
+        }): Promise<void>;
+        disable(args: {
+            caller: DeviceApiCallerIface;
+            workspaceId: string;
+        }): Promise<void>;
+        suspend(args: {
+            caller: DeviceApiCallerIface;
+            workspaceId: string;
+        }): Promise<void>;
+    };
     releaseWorkspaceLeases(args: {
         caller: DeviceApiCallerIface;
         deviceId: string;
@@ -154,7 +201,7 @@ export interface DeviceApiClientIface {
     }>;
 }
 export declare const createDeviceApiClient: (config: {
-    api: DeviceApiConfigIface;
+    api: DeviceApiConfigIface | (() => DeviceApiConfigIface);
     fetch?: DeviceApiFetchIface;
     now?: () => number;
 }) => DeviceApiClientIface;

package/dist/modules/sandboxes/device-api.mjs

@@ -1,3 +1,12 @@
+import {
+  deviceEgressCreateRequestSchema,
+  deviceEgressWorkspaceIdSchema,
+  deviceEgressEnrollmentSchema,
+  deviceEgressLeaseSchema,
+  deviceEgressWorkspaceSchema,
+  workspaceNetworkPolicySchema,
+  deviceWorkspaceNetworkStateSchema
+} from "@finalai/agent-protocol/device-egress";
 import {
   ProcessInspectionOperation,
   processInspectionResultSchema
@@ -96,6 +105,7 @@ const DEVICE_API_OUTPUT_WAIT_MS = 15e3;
 var DeviceApiClientErrorCode = /* @__PURE__ */ ((DeviceApiClientErrorCode2) => {
   DeviceApiClientErrorCode2["CredentialMissing"] = "credential_missing";
   DeviceApiClientErrorCode2["NoActingUser"] = "no_acting_user";
+  DeviceApiClientErrorCode2["EgressEnrollmentLost"] = "egress_enrollment_lost";
   return DeviceApiClientErrorCode2;
 })(DeviceApiClientErrorCode || {});
 const apiError = (status, code, message) => Object.assign(new Error(`Device API ${status} ${code}: ${message}`), { status, code });
@@ -112,6 +122,7 @@ const noActingUser = () => Object.assign(
   { status: null, code: "no_acting_user" /* NoActingUser */ }
 );
 const statusSchema = z.object({ status: z.number() });
+const deviceApiCodeOf = (cause) => z.object({ code: z.string() }).safeParse(cause).data?.code ?? null;
 const deviceApiStatusOf = (cause) => statusSchema.safeParse(cause).data?.status ?? null;
 const parseJson = (text) => {
   try {
@@ -131,39 +142,41 @@ const leaseOf = (raw) => ({
   expiresAtMs: Date.parse(raw.expiresAt)
 });
 const createDeviceApiClient = (config) => {
-  const doFetch = config.fetch ?? ((input, init) => fetch(input, init));
   const now = config.now ?? Date.now;
-  const origin = config.api.url.replace(/\/+$/, "");
-  const credentialTtlMs = config.api.credentialTtlMs ?? 6e4;
+  const readApi = () => typeof config.api === "function" ? config.api() : config.api;
   const keys = /* @__PURE__ */ new Map();
   const failure = async (response) => {
     const text = await response.text().catch(() => "");
     const body = errorBodySchema.safeParse(parseJson(text));
     return body.success ? apiError(response.status, body.data.error.code, body.data.error.message) : apiError(response.status, "http", text.slice(0, 200) || response.statusText);
   };
-  const organizationKey = async (organizationId, reread) => {
-    const cached = keys.get(organizationId);
+  const organizationKey = async (args) => {
+    const { organizationId, reread, api } = args;
+    const cacheKey = api.url + "\0" + organizationId;
+    const cached = keys.get(cacheKey);
     if (cached != null && !reread && cached.expiresAtMs > now()) return cached.key;
-    const key = await config.api.credential({ organizationId });
+    const key = await api.credential({ organizationId });
     if (key == null) {
-      keys.delete(organizationId);
+      keys.delete(cacheKey);
       throw credentialMissing();
     }
-    keys.set(organizationId, { key, expiresAtMs: now() + credentialTtlMs });
+    keys.set(cacheKey, { key, expiresAtMs: now() + (api.credentialTtlMs ?? 6e4) });
     return key;
   };
   const send = async (args) => {
+    const api = readApi();
+    const origin = api.url.replace(/\/+$/, "");
     const url = new URL(`${origin}${args.path}`);
     for (const [key, value] of Object.entries(args.query ?? {})) url.searchParams.set(key, value);
     const actingUserId = await args.caller.actingUser.current();
-    if (actingUserId == null) throw noActingUser();
+    if (actingUserId == null && !args.anonymous) throw noActingUser();
     const attempt = async (refresh) => {
       const headers = new Headers({
-        authorization: `Bearer ${await organizationKey(args.caller.organizationId, refresh)}`,
-        [DEVICE_API_ACTING_USER_HEADER]: actingUserId
+        authorization: `Bearer ${await organizationKey({ organizationId: args.caller.organizationId, reread: refresh, api })}`
       });
+      if (actingUserId != null) headers.set(DEVICE_API_ACTING_USER_HEADER, actingUserId);
       if (args.contentType != null) headers.set("content-type", args.contentType);
-      return doFetch(url.toString(), {
+      return (config.fetch ?? api.fetch ?? fetch)(url.toString(), {
         method: args.method,
         headers,
         body: args.body,
@@ -306,6 +319,86 @@ const createDeviceApiClient = (config) => {
     };
   };
   return {
+    egress: {
+      networkState: ({ organizationId, workspaceId }) => json(deviceWorkspaceNetworkStateSchema, {
+        caller: { organizationId, actingUser: { current: async () => null } },
+        anonymous: true,
+        method: "GET",
+        path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}/network-state`,
+        signal: AbortSignal.timeout(3e4)
+      }),
+      setNetworkPolicy: async ({ caller, workspaceId, policy, initializeIfMissing }) => {
+        const userId = await caller.actingUser.current();
+        const anonymous = userId == null;
+        const resolvedCaller = { ...caller, actingUser: { current: async () => userId } };
+        const result = await json(z.object({ ok: z.boolean() }), {
+          caller: resolvedCaller,
+          method: initializeIfMissing === true ? "POST" : "PUT",
+          anonymous,
+          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}/${initializeIfMissing === true ? "network-state/initialize" : anonymous ? "network-state" : "network-policy"}`,
+          json: workspaceNetworkPolicySchema.parse(policy),
+          signal: AbortSignal.timeout(3e4)
+        });
+        if (!result.ok) throw new Error("Device API did not save the workspace network policy");
+      },
+      workspace: ({ caller, workspaceId }) => json(deviceEgressWorkspaceSchema, {
+        caller,
+        method: "GET",
+        path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}`,
+        signal: AbortSignal.timeout(3e4)
+      }),
+      create: ({ caller, ...input }) => json(deviceEgressEnrollmentSchema, {
+        caller,
+        method: "POST",
+        path: "/v1/egress/leases",
+        json: deviceEgressCreateRequestSchema.parse(input),
+        signal: AbortSignal.timeout(18e4)
+      }),
+      renew: ({ caller, leaseId }) => json(deviceEgressLeaseSchema, {
+        caller,
+        method: "POST",
+        path: `/v1/egress/leases/${encodeURIComponent(leaseId)}/renew`,
+        signal: AbortSignal.timeout(18e4)
+      }),
+      activate: ({ caller, leaseId }) => json(deviceEgressLeaseSchema, {
+        caller,
+        method: "POST",
+        path: `/v1/egress/leases/${encodeURIComponent(leaseId)}/activate`,
+        signal: AbortSignal.timeout(6e4)
+      }),
+      revoke: async ({ caller, leaseId, workspaceId }) => {
+        await json(emptySchema, {
+          caller,
+          method: "DELETE",
+          json: { workspaceId },
+          path: `/v1/egress/leases/${encodeURIComponent(leaseId)}`,
+          signal: AbortSignal.timeout(6e4)
+        });
+      },
+      suspend: async ({
+        caller,
+        workspaceId
+      }) => {
+        const userId = await caller.actingUser.current();
+        const anonymous = userId == null;
+        const resolvedCaller = { ...caller, actingUser: { current: async () => userId } };
+        await json(emptySchema, {
+          caller: resolvedCaller,
+          anonymous,
+          method: "POST",
+          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}/${anonymous ? "network-state/suspend" : "suspend"}`,
+          signal: AbortSignal.timeout(6e4)
+        });
+      },
+      disable: async ({ caller, workspaceId }) => {
+        await json(emptySchema, {
+          caller,
+          method: "DELETE",
+          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}`,
+          signal: AbortSignal.timeout(6e4)
+        });
+      }
+    },
     releaseWorkspaceLeases: async ({ caller, deviceId, bindingId }) => {
       const result = await json(z.object({ released: z.boolean() }), {
         caller,
@@ -402,6 +495,7 @@ export {
   DeviceApiClientErrorCode,
   DeviceApiLeaseAccess,
   createDeviceApiClient,
+  deviceApiCodeOf,
   deviceApiStatusOf
 };
 //# sourceMappingURL=device-api.mjs.map

package/dist/modules/sandboxes/device-api.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/sandboxes/device-api.ts"],
-  "sourcesContent": ["import {\n  ProcessInspectionOperation,\n  processInspectionResultSchema,\n  type ProcessInspectionRequestIface,\n  type ProcessInspectionResultIface,\n} from '@finalai/agent-protocol/process-inspection';\nimport { jsonObjectSchema, jsonValueSchema, type JsonValue } from '@finalai/agent-provider';\nimport { SandboxEntryType, type SandboxActingUserIface } from '@finalai/agent-provider/sandbox';\nimport * as z from 'zod';\nimport { decodeBase64, encodeBase64 } from \"./bytes.mjs\";\nimport { DEVICE_API_ACTING_USER_HEADER, DEVICE_API_KEY_SECRET } from \"./environment.mjs\";\nimport type {\n  SandboxTransportIface,\n  TransportDirEntryIface,\n  TransportOutputIface,\n  TransportStatIface,\n} from \"./transport.mjs\";\n\n// A client of the Device API (device-api-service), the Final Device's backend,\n// as any vendor provider has a client of its vendor's API. The provider's\n// install config is only the API origin; every call carries the session\n// organization's own API key, kept as an organization secret\n// (DEVICE_API_KEY_SECRET) like any customer's vendor key, exactly as the\n// `computer` provider calls the Computers API. A Device is one person's\n// machine, so every call also names the user it acts for\n// (DEVICE_API_ACTING_USER_HEADER), and the Device API refuses a Device that user\n// does not own, whatever the key.\n\n// The Device API's header naming the user a request acts for (a Final user id).\nexport { DEVICE_API_ACTING_USER_HEADER } from \"./environment.mjs\";\n\n// Whom a call is made for: the organization whose key it carries, and the user\n// it acts for, read on each call.\nexport interface DeviceApiCallerIface {\n  organizationId: string;\n  actingUser: SandboxActingUserIface;\n}\n\nexport interface DeviceApiConfigIface {\n  // The Device API origin.\n  url: string;\n  // The organization's Device API key (a Final organization API key), or null\n  // when it stored none.\n  credential: (args: { organizationId: string }) => Promise<string | null>;\n  // How long a read key is reused before the secret is read again (default 60 s).\n  credentialTtlMs?: number;\n}\n\nexport interface DeviceApiFetchIface {\n  (input: string, init: RequestInit): Promise<Response>;\n}\n\nexport enum DeviceApiLeaseAccess {\n  Read = 'read',\n  Write = 'write',\n}\n\nexport enum DeviceApiCapability {\n  Files = 'files',\n  Process = 'process',\n  ComputerUse = 'computer-use',\n  LocalMcp = 'local-mcp',\n}\n\nexport const DEVICE_API_COMPUTER_USE_SERVER = 'computer-use';\n\n// Unknown values from a newer API read as absent rather than failing the call.\nconst tolerantEnum = <T extends Record<string, string>>(values: T) =>\n  z.string().transform((value): T[keyof T] | null => {\n    const parsed = z.nativeEnum(values).safeParse(value);\n    return parsed.success ? parsed.data : null;\n  });\n\nconst deviceSchema = z.object({\n  id: z.string(),\n  organizationId: z.string(),\n  displayName: z.string(),\n  os: z.string(),\n  online: z.boolean(),\n  writable: z.boolean(),\n  allowProcesses: z.boolean(),\n  computerUseReady: z.boolean(),\n  screenReady: z.boolean(),\n});\nexport type DeviceApiDeviceIface = z.infer<typeof deviceSchema>;\n\nconst leaseSchema = z.object({\n  lease: z.string(),\n  deviceId: z.string(),\n  generation: z.number(),\n  workspaceRoot: z.string(),\n  platform: z.string(),\n  access: z.nativeEnum(DeviceApiLeaseAccess),\n  capabilities: z.array(tolerantEnum(DeviceApiCapability)),\n  expiresAt: z.string(),\n});\nexport interface DeviceApiLeaseIface {\n  lease: string;\n  deviceId: string;\n  generation: number;\n  workspaceRoot: string;\n  platform: string;\n  access: DeviceApiLeaseAccess;\n  capabilities: DeviceApiCapability[];\n  expiresAtMs: number;\n}\n\ninterface ProcessInputBodyIface {\n  bootId: string;\n  dataBase64?: string;\n  eof?: boolean;\n}\n\nconst errorBodySchema = z.object({ error: z.object({ code: z.string(), message: z.string() }) });\nconst statBodySchema = z.object({\n  stat: z\n    .object({\n      type: tolerantEnum(SandboxEntryType),\n      size: z.number(),\n      modifiedAtMs: z.number().nullable(),\n      mode: z.number().nullable(),\n    })\n    .nullable(),\n});\nconst dirBodySchema = z.object({\n  entries: z.array(\n    z.object({\n      name: z.string(),\n      type: tolerantEnum(SandboxEntryType),\n      size: z.number().nullable(),\n    }),\n  ),\n});\nconst processSchema = z.object({ id: z.string(), bootId: z.string() });\nconst outputStreamSchema = z.object({\n  dataBase64: z.string(),\n  nextOffset: z.number(),\n  eof: z.boolean(),\n});\nconst outputSchema = z.object({\n  stdout: outputStreamSchema,\n  stderr: outputStreamSchema,\n  exited: z.boolean(),\n  exitCode: z.number().nullable(),\n  exitSignal: z.string().nullable(),\n});\nconst devicesSchema = z.object({ devices: z.array(deviceSchema) });\nconst serversSchema = z.object({ servers: z.array(z.string()) });\n// A Device server's tool as the API recorded it; checked against the tool\n// descriptor contract where the provider hands it on.\nconst catalogToolSchema = jsonObjectSchema;\nconst mcpCatalogSchema = z.object({\n  computerUse: z.object({ tools: z.array(catalogToolSchema) }).nullable(),\n  localServers: z\n    .object({\n      servers: z.array(\n        z.object({ name: z.string(), tools: z.array(catalogToolSchema).nullable() }),\n      ),\n    })\n    .nullable(),\n});\nexport type DeviceApiMcpCatalogIface = z.infer<typeof mcpCatalogSchema>;\nconst pipeReadSchema = z.object({ dataBase64: z.string().optional() });\nconst screenSchema = z.object({ url: z.string(), token: z.string(), expiresAt: z.string() });\nconst emptySchema = z.unknown();\n\n// One ranged read or write; the API splits it into the Device's own chunks.\nexport const DEVICE_API_FILE_CHUNK_BYTES = 4 * 1024 * 1024;\n// The API long-polls the Device for output up to this long.\nexport const DEVICE_API_OUTPUT_WAIT_MS = 15_000;\n\nexport enum DeviceApiClientErrorCode {\n  // The organization stored no Device API key.\n  CredentialMissing = 'credential_missing',\n  // The session acts for no user, and a Device is only used for its owner.\n  NoActingUser = 'no_acting_user',\n}\n\nexport interface DeviceApiErrorIface extends Error {\n  status: number | null;\n  code: string;\n}\n\nconst apiError = (status: number, code: string, message: string): DeviceApiErrorIface =>\n  Object.assign(new Error(`Device API ${status} ${code}: ${message}`), { status, code });\n\nconst credentialMissing = (): DeviceApiErrorIface =>\n  Object.assign(\n    new Error(\n      `this organization has no Device API key for the device sandbox: create an organization API key and store it as the organization secret ${DEVICE_API_KEY_SECRET}`,\n    ),\n    { status: null, code: DeviceApiClientErrorCode.CredentialMissing },\n  );\n\nconst noActingUser = (): DeviceApiErrorIface =>\n  Object.assign(\n    new Error(\n      'this session acts for no user, and a Final Device is only used by sessions acting for its owner',\n    ),\n    { status: null, code: DeviceApiClientErrorCode.NoActingUser },\n  );\n\nconst statusSchema = z.object({ status: z.number() });\n\nexport const deviceApiStatusOf = (cause: Error): number | null =>\n  statusSchema.safeParse(cause).data?.status ?? null;\n\nconst parseJson = (text: string): JsonValue => {\n  try {\n    return jsonValueSchema.parse(JSON.parse(text));\n  } catch {\n    return null;\n  }\n};\n\nconst leaseOf = (raw: z.infer<typeof leaseSchema>): DeviceApiLeaseIface => ({\n  lease: raw.lease,\n  deviceId: raw.deviceId,\n  generation: raw.generation,\n  workspaceRoot: raw.workspaceRoot,\n  platform: raw.platform,\n  access: raw.access,\n  capabilities: raw.capabilities.filter((capability) => capability != null),\n  expiresAtMs: Date.parse(raw.expiresAt),\n});\n\nexport interface DeviceApiClientIface {\n  releaseWorkspaceLeases(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    bindingId: string;\n  }): Promise<void>;\n  inspectProcesses(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    bindingId: string;\n    request: ProcessInspectionRequestIface;\n  }): Promise<ProcessInspectionResultIface>;\n  getDevice(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n  }): Promise<DeviceApiDeviceIface | null>;\n  // The Devices of the user the call acts for.\n  listDevices(args: { caller: DeviceApiCallerIface }): Promise<DeviceApiDeviceIface[]>;\n  resolvePairing(args: {\n    caller: DeviceApiCallerIface;\n    code: string;\n  }): Promise<DeviceApiDeviceIface | null>;\n  lease(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    sessionId: string;\n    bindingId: string;\n    access: DeviceApiLeaseAccess;\n    ttlMs: number;\n    afterGeneration?: number;\n  }): Promise<DeviceApiLeaseIface>;\n  recoverLease(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    sessionId: string;\n    bindingId: string;\n    access: DeviceApiLeaseAccess;\n  }): Promise<DeviceApiLeaseIface>;\n  renew(args: {\n    caller: DeviceApiCallerIface;\n    lease: string;\n    ttlMs: number;\n  }): Promise<DeviceApiLeaseIface>;\n  release(args: { caller: DeviceApiCallerIface; lease: string }): Promise<void>;\n  // The sandbox transport over one lease; `lease()` is the current handle.\n  transport(args: {\n    caller: DeviceApiCallerIface;\n    lease: () => Promise<string>;\n  }): SandboxTransportIface;\n  localMcpServers(args: { caller: DeviceApiCallerIface; lease: string }): Promise<string[]>;\n  // What the Device's MCP servers last listed through the API, without a lease.\n  mcpCatalog(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n  }): Promise<DeviceApiMcpCatalogIface>;\n  pipe(args: {\n    caller: DeviceApiCallerIface;\n    lease: string;\n    server: string;\n    action: 'open' | 'write' | 'read' | 'close';\n    clientId: string;\n    dataBase64?: string;\n    signal?: AbortSignal;\n  }): Promise<string>;\n  screen(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    sessionId: string;\n    viewOnly?: boolean;\n  }): Promise<{ url: string; token: string; expiresAt: string }>;\n}\n\nexport const createDeviceApiClient = (config: {\n  api: DeviceApiConfigIface;\n  fetch?: DeviceApiFetchIface;\n  now?: () => number;\n}): DeviceApiClientIface => {\n  const doFetch: DeviceApiFetchIface = config.fetch ?? ((input, init) => fetch(input, init));\n  const now = config.now ?? Date.now;\n  const origin = config.api.url.replace(/\\/+$/, '');\n  const credentialTtlMs = config.api.credentialTtlMs ?? 60_000;\n  const keys = new Map<string, { key: string; expiresAtMs: number }>();\n\n  const failure = async (response: Response): Promise<DeviceApiErrorIface> => {\n    // Read as text so proxy and load balancer error pages survive.\n    const text = await response.text().catch(() => '');\n    const body = errorBodySchema.safeParse(parseJson(text));\n    return body.success\n      ? apiError(response.status, body.data.error.code, body.data.error.message)\n      : apiError(response.status, 'http', text.slice(0, 200) || response.statusText);\n  };\n\n  // The organization's key, reused for a minute so calls do not each read the secret store.\n  const organizationKey = async (organizationId: string, reread: boolean): Promise<string> => {\n    const cached = keys.get(organizationId);\n    if (cached != null && !reread && cached.expiresAtMs > now()) return cached.key;\n    const key = await config.api.credential({ organizationId });\n    if (key == null) {\n      keys.delete(organizationId);\n      throw credentialMissing();\n    }\n    keys.set(organizationId, { key, expiresAtMs: now() + credentialTtlMs });\n    return key;\n  };\n\n  // One authenticated call for the user it acts for; a rejected key is read\n  // again once, in case it was rotated.\n  const send = async (args: {\n    caller: DeviceApiCallerIface;\n    method: string;\n    path: string;\n    query?: Record<string, string>;\n    body?: BodyInit;\n    contentType?: string;\n    signal?: AbortSignal;\n  }): Promise<Response> => {\n    const url = new URL(`${origin}${args.path}`);\n    for (const [key, value] of Object.entries(args.query ?? {})) url.searchParams.set(key, value);\n    const actingUserId = await args.caller.actingUser.current();\n    if (actingUserId == null) throw noActingUser();\n    const attempt = async (refresh: boolean): Promise<Response> => {\n      const headers = new Headers({\n        authorization: `Bearer ${await organizationKey(args.caller.organizationId, refresh)}`,\n        [DEVICE_API_ACTING_USER_HEADER]: actingUserId,\n      });\n      if (args.contentType != null) headers.set('content-type', args.contentType);\n      return doFetch(url.toString(), {\n        method: args.method,\n        headers,\n        body: args.body,\n        signal: args.signal,\n      });\n    };\n    let response = await attempt(false);\n    if (response.status === 401) {\n      await response.text().catch(() => '');\n      response = await attempt(true);\n    }\n    return response;\n  };\n\n  const json = async <T extends z.ZodType>(\n    schema: T,\n    args: Parameters<typeof send>[0] & { json?: unknown },\n  ): Promise<z.infer<T>> => {\n    const response = await send({\n      ...args,\n      body: args.json === undefined ? args.body : JSON.stringify(args.json),\n      contentType: args.json === undefined ? args.contentType : 'application/json',\n    });\n    if (!response.ok) throw await failure(response);\n    const text = await response.text();\n    return schema.parse(text === '' ? null : parseJson(text));\n  };\n\n  // A 404 reads as absent.\n  const orNull = async <T>(work: Promise<T>): Promise<T | null> => {\n    try {\n      return await work;\n    } catch (cause) {\n      if (cause instanceof Error && deviceApiStatusOf(cause) === 404) return null;\n      throw cause;\n    }\n  };\n\n  const leasePath = (lease: string, rest: string): string =>\n    `/v1/leases/${encodeURIComponent(lease)}${rest}`;\n\n  const transport: DeviceApiClientIface['transport'] = ({ caller, lease }) => {\n    const call = async <T extends z.ZodType>(\n      schema: T,\n      args: Omit<Parameters<typeof json>[1], 'caller' | 'path'> & { path: string },\n    ): Promise<z.infer<T>> =>\n      json(schema, { ...args, caller, path: leasePath(await lease(), args.path) });\n    const processPath = (id: string, rest: string): string =>\n      `/processes/${encodeURIComponent(id)}${rest}`;\n    return {\n      kind: 'device-api',\n      fileChunkBytes: DEVICE_API_FILE_CHUNK_BYTES,\n      outputWaitMs: DEVICE_API_OUTPUT_WAIT_MS,\n      stat: async ({ path, signal }): Promise<TransportStatIface | null> => {\n        const { stat } = await call(statBodySchema, {\n          method: 'GET',\n          path: '/files/stat',\n          query: { path },\n          signal,\n        });\n        return stat == null ? null : { ...stat, type: stat.type ?? SandboxEntryType.Other };\n      },\n      readDir: async ({ path, signal }): Promise<TransportDirEntryIface[]> =>\n        (\n          await call(dirBodySchema, { method: 'GET', path: '/files/dir', query: { path }, signal })\n        ).entries.map((entry) => ({ ...entry, type: entry.type ?? SandboxEntryType.Other })),\n      readChunk: async ({ path, offset, length, signal }) => {\n        const response = await send({\n          caller,\n          method: 'GET',\n          path: leasePath(await lease(), '/files/content'),\n          query: { path, offset: String(offset), length: String(length) },\n          signal,\n        });\n        if (!response.ok) throw await failure(response);\n        const bytes = new Uint8Array(await response.arrayBuffer());\n        return { bytes, eof: bytes.byteLength < length };\n      },\n      writeChunk: async ({ path, offset, bytes, signal }) => {\n        await call(emptySchema, {\n          method: 'PUT',\n          path: '/files/content',\n          query: { path, offset: String(offset) },\n          body: new Blob([bytes.slice()]),\n          contentType: 'application/octet-stream',\n          signal,\n        });\n      },\n      createDirectory: async ({ path, signal }) => {\n        await call(emptySchema, {\n          method: 'POST',\n          path: '/files/directories',\n          json: { path },\n          signal,\n        });\n      },\n      remove: async ({ path, recursive, force, signal }) => {\n        await call(emptySchema, {\n          method: 'DELETE',\n          path: '/files',\n          query: { path, recursive: String(recursive), force: String(force) },\n          signal,\n        });\n      },\n      exec: async ({ id, command, cwd, env, timeoutMs, signal }) =>\n        call(processSchema, {\n          method: 'POST',\n          path: '/processes',\n          json: { id, command, cwd, env, timeoutMs },\n          signal,\n        }),\n      output: async ({ process, stdoutOffset, stderrOffset, waitMs, signal }) => {\n        const output = await call(outputSchema, {\n          method: 'POST',\n          path: processPath(process.id, '/output'),\n          json: { bootId: process.bootId, stdoutOffset, stderrOffset, waitMs },\n          signal,\n        });\n        const stream = (value: z.infer<typeof outputStreamSchema>) => ({\n          data: decodeBase64(value.dataBase64),\n          nextOffset: value.nextOffset,\n          eof: value.eof,\n        });\n        const result: TransportOutputIface = {\n          stdout: stream(output.stdout),\n          stderr: stream(output.stderr),\n          exited: output.exited,\n          exitCode: output.exitCode,\n          exitSignal: output.exitSignal,\n        };\n        return result;\n      },\n      input: async ({ process, data, eof, signal, terminate, abortSignal }) => {\n        if (terminate === true || signal != null) {\n          await call(emptySchema, {\n            method: 'POST',\n            path: processPath(process.id, '/kill'),\n            json:\n              terminate === true ? { bootId: process.bootId } : { bootId: process.bootId, signal },\n            signal: abortSignal,\n          });\n          if (terminate === true) return;\n        }\n        if ((data != null && data.byteLength > 0) || eof === true) {\n          const body: ProcessInputBodyIface = {\n            bootId: process.bootId,\n          };\n          if (data != null && data.byteLength > 0) body.dataBase64 = encodeBase64(data);\n          if (eof === true) body.eof = true;\n          await call(emptySchema, {\n            method: 'POST',\n            path: processPath(process.id, '/input'),\n            json: body,\n            signal: abortSignal,\n          });\n        }\n      },\n      close: () => undefined,\n    };\n  };\n\n  return {\n    releaseWorkspaceLeases: async ({ caller, deviceId, bindingId }) => {\n      const result = await json(z.object({ released: z.boolean() }), {\n        caller,\n        method: 'DELETE',\n        path:\n          '/v1/devices/' +\n          encodeURIComponent(deviceId) +\n          '/workspaces/' +\n          encodeURIComponent(bindingId) +\n          '/leases',\n      });\n      if (!result.released) throw new Error('The Device did not release its workspace leases');\n    },\n    inspectProcesses: ({ caller, deviceId, bindingId, request }) => {\n      const suffix =\n        request.operation === ProcessInspectionOperation.Available\n          ? '/available'\n          : 'processId' in request\n            ? '/' + encodeURIComponent(request.processId)\n            : '';\n      const query: Record<string, string> = {};\n      if (bindingId != null) query.bindingId = bindingId;\n      if ('bootId' in request) query.bootId = request.bootId;\n      if ('cursor' in request && request.cursor != null) query.cursor = request.cursor;\n      if ('limit' in request && request.limit != null) query.limit = String(request.limit);\n      return json(processInspectionResultSchema, {\n        caller,\n        method: request.operation === ProcessInspectionOperation.Stop ? 'DELETE' : 'GET',\n        path: '/v1/devices/' + encodeURIComponent(deviceId) + '/processes' + suffix,\n        query,\n      });\n    },\n    getDevice: ({ caller, deviceId }) =>\n      orNull(\n        json(deviceSchema, {\n          caller,\n          method: 'GET',\n          path: `/v1/devices/${encodeURIComponent(deviceId)}`,\n        }),\n      ),\n    listDevices: async ({ caller }) =>\n      (await json(devicesSchema, { caller, method: 'GET', path: '/v1/devices' })).devices,\n    resolvePairing: ({ caller, code }) =>\n      orNull(\n        json(deviceSchema, {\n          caller,\n          method: 'POST',\n          path: '/v1/pairings/resolve',\n          json: { code },\n        }),\n      ),\n    lease: async ({ caller, deviceId, sessionId, bindingId, access, ttlMs, afterGeneration }) =>\n      leaseOf(\n        await json(leaseSchema, {\n          caller,\n          method: 'POST',\n          path: `/v1/devices/${encodeURIComponent(deviceId)}/leases`,\n          json: { sessionId, bindingId, access, ttlMs, afterGeneration },\n        }),\n      ),\n    recoverLease: async ({ caller, deviceId, sessionId, bindingId, access }) =>\n      leaseOf(\n        await json(leaseSchema, {\n          caller,\n          method: 'POST',\n          path: `/v1/devices/${encodeURIComponent(deviceId)}/leases/recover`,\n          json: { sessionId, bindingId, access },\n        }),\n      ),\n    renew: async ({ caller, lease, ttlMs }) =>\n      leaseOf(\n        await json(leaseSchema, {\n          caller,\n          method: 'POST',\n          path: leasePath(lease, '/renew'),\n          json: { ttlMs },\n        }),\n      ),\n    release: async ({ caller, lease }) => {\n      await json(emptySchema, { caller, method: 'DELETE', path: leasePath(lease, '') });\n    },\n    transport,\n    mcpCatalog: ({ caller, deviceId }) =>\n      json(mcpCatalogSchema, {\n        caller,\n        method: 'GET',\n        path: `/v1/devices/${encodeURIComponent(deviceId)}/mcp`,\n      }),\n    localMcpServers: async ({ caller, lease }) =>\n      (await json(serversSchema, { caller, method: 'GET', path: leasePath(lease, '/mcp') }))\n        .servers,\n    pipe: async ({ caller, lease, server, action, clientId, dataBase64, signal }) =>\n      (\n        await json(pipeReadSchema, {\n          caller,\n          method: 'POST',\n          path: leasePath(lease, `/mcp/${encodeURIComponent(server)}/${action}`),\n          json: dataBase64 == null ? { clientId } : { clientId, dataBase64 },\n          signal,\n        })\n      ).dataBase64 ?? '',\n    screen: ({ caller, deviceId, sessionId, viewOnly }) =>\n      json(screenSchema, {\n        caller,\n        method: 'POST',\n        path: `/v1/devices/${encodeURIComponent(deviceId)}/screen`,\n        json: { sessionId, viewOnly },\n      }),\n  };\n};\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,kBAAkB,uBAAuC;AAClE,SAAS,wBAAqD;AAC9D,YAAY,OAAO;AACnB,SAAS,cAAc,oBAAoB;AAC3C,SAAS,+BAA+B,6BAA6B;AAmBrE,SAAS,iCAAAA,sCAAqC;AAuBvC,IAAK,uBAAL,kBAAKC,0BAAL;AACL,EAAAA,sBAAA,UAAO;AACP,EAAAA,sBAAA,WAAQ;AAFE,SAAAA;AAAA,GAAA;AAKL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,WAAQ;AACR,EAAAA,qBAAA,aAAU;AACV,EAAAA,qBAAA,iBAAc;AACd,EAAAA,qBAAA,cAAW;AAJD,SAAAA;AAAA,GAAA;AAOL,MAAM,iCAAiC;AAG9C,MAAM,eAAe,CAAmC,WACtD,EAAE,OAAO,EAAE,UAAU,CAAC,UAA6B;AACjD,QAAM,SAAS,EAAE,WAAW,MAAM,EAAE,UAAU,KAAK;AACnD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC,CAAC;AAEH,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO;AAAA,EACb,gBAAgB,EAAE,OAAO;AAAA,EACzB,aAAa,EAAE,OAAO;AAAA,EACtB,IAAI,EAAE,OAAO;AAAA,EACb,QAAQ,EAAE,QAAQ;AAAA,EAClB,UAAU,EAAE,QAAQ;AAAA,EACpB,gBAAgB,EAAE,QAAQ;AAAA,EAC1B,kBAAkB,EAAE,QAAQ;AAAA,EAC5B,aAAa,EAAE,QAAQ;AACzB,CAAC;AAGD,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO;AAAA,EACxB,UAAU,EAAE,OAAO;AAAA,EACnB,QAAQ,EAAE,WAAW,oBAAoB;AAAA,EACzC,cAAc,EAAE,MAAM,aAAa,mBAAmB,CAAC;AAAA,EACvD,WAAW,EAAE,OAAO;AACtB,CAAC;AAkBD,MAAM,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC/F,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EACH,OAAO;AAAA,IACN,MAAM,aAAa,gBAAgB;AAAA,IACnC,MAAM,EAAE,OAAO;AAAA,IACf,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,EACA,SAAS;AACd,CAAC;AACD,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,SAAS,EAAE;AAAA,IACT,EAAE,OAAO;AAAA,MACP,MAAM,EAAE,OAAO;AAAA,MACf,MAAM,aAAa,gBAAgB;AAAA,MACnC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH;AACF,CAAC;AACD,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AAAA,EACrB,KAAK,EAAE,QAAQ;AACjB,CAAC;AACD,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ,EAAE,QAAQ;AAAA,EAClB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AACD,MAAM,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,EAAE,CAAC;AACjE,MAAM,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAG/D,MAAM,oBAAoB;AAC1B,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,CAAC,EAAE,SAAS;AAAA,EACtE,cAAc,EACX,OAAO;AAAA,IACN,SAAS,EAAE;AAAA,MACT,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAAA,IAC7E;AAAA,EACF,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrE,MAAM,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAC3F,MAAM,cAAc,EAAE,QAAQ;AAGvB,MAAM,8BAA8B,IAAI,OAAO;AAE/C,MAAM,4BAA4B;AAElC,IAAK,2BAAL,kBAAKC,8BAAL;AAEL,EAAAA,0BAAA,uBAAoB;AAEpB,EAAAA,0BAAA,kBAAe;AAJL,SAAAA;AAAA,GAAA;AAYZ,MAAM,WAAW,CAAC,QAAgB,MAAc,YAC9C,OAAO,OAAO,IAAI,MAAM,cAAc,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;AAEvF,MAAM,oBAAoB,MACxB,OAAO;AAAA,EACL,IAAI;AAAA,IACF,0IAA0I,qBAAqB;AAAA,EACjK;AAAA,EACA,EAAE,QAAQ,MAAM,MAAM,6CAA2C;AACnE;AAEF,MAAM,eAAe,MACnB,OAAO;AAAA,EACL,IAAI;AAAA,IACF;AAAA,EACF;AAAA,EACA,EAAE,QAAQ,MAAM,MAAM,oCAAsC;AAC9D;AAEF,MAAM,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAE7C,MAAM,oBAAoB,CAAC,UAChC,aAAa,UAAU,KAAK,EAAE,MAAM,UAAU;AAEhD,MAAM,YAAY,CAAC,SAA4B;AAC7C,MAAI;AACF,WAAO,gBAAgB,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,UAAU,CAAC,SAA2D;AAAA,EAC1E,OAAO,IAAI;AAAA,EACX,UAAU,IAAI;AAAA,EACd,YAAY,IAAI;AAAA,EAChB,eAAe,IAAI;AAAA,EACnB,UAAU,IAAI;AAAA,EACd,QAAQ,IAAI;AAAA,EACZ,cAAc,IAAI,aAAa,OAAO,CAAC,eAAe,cAAc,IAAI;AAAA,EACxE,aAAa,KAAK,MAAM,IAAI,SAAS;AACvC;AA0EO,MAAM,wBAAwB,CAAC,WAIV;AAC1B,QAAM,UAA+B,OAAO,UAAU,CAAC,OAAO,SAAS,MAAM,OAAO,IAAI;AACxF,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,SAAS,OAAO,IAAI,IAAI,QAAQ,QAAQ,EAAE;AAChD,QAAM,kBAAkB,OAAO,IAAI,mBAAmB;AACtD,QAAM,OAAO,oBAAI,IAAkD;AAEnE,QAAM,UAAU,OAAO,aAAqD;AAE1E,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,OAAO,gBAAgB,UAAU,UAAU,IAAI,CAAC;AACtD,WAAO,KAAK,UACR,SAAS,SAAS,QAAQ,KAAK,KAAK,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,IACvE,SAAS,SAAS,QAAQ,QAAQ,KAAK,MAAM,GAAG,GAAG,KAAK,SAAS,UAAU;AAAA,EACjF;AAGA,QAAM,kBAAkB,OAAO,gBAAwB,WAAqC;AAC1F,UAAM,SAAS,KAAK,IAAI,cAAc;AACtC,QAAI,UAAU,QAAQ,CAAC,UAAU,OAAO,cAAc,IAAI,EAAG,QAAO,OAAO;AAC3E,UAAM,MAAM,MAAM,OAAO,IAAI,WAAW,EAAE,eAAe,CAAC;AAC1D,QAAI,OAAO,MAAM;AACf,WAAK,OAAO,cAAc;AAC1B,YAAM,kBAAkB;AAAA,IAC1B;AACA,SAAK,IAAI,gBAAgB,EAAE,KAAK,aAAa,IAAI,IAAI,gBAAgB,CAAC;AACtE,WAAO;AAAA,EACT;AAIA,QAAM,OAAO,OAAO,SAQK;AACvB,UAAM,MAAM,IAAI,IAAI,GAAG,MAAM,GAAG,KAAK,IAAI,EAAE;AAC3C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,EAAG,KAAI,aAAa,IAAI,KAAK,KAAK;AAC5F,UAAM,eAAe,MAAM,KAAK,OAAO,WAAW,QAAQ;AAC1D,QAAI,gBAAgB,KAAM,OAAM,aAAa;AAC7C,UAAM,UAAU,OAAO,YAAwC;AAC7D,YAAM,UAAU,IAAI,QAAQ;AAAA,QAC1B,eAAe,UAAU,MAAM,gBAAgB,KAAK,OAAO,gBAAgB,OAAO,CAAC;AAAA,QACnF,CAAC,6BAA6B,GAAG;AAAA,MACnC,CAAC;AACD,UAAI,KAAK,eAAe,KAAM,SAAQ,IAAI,gBAAgB,KAAK,WAAW;AAC1E,aAAO,QAAQ,IAAI,SAAS,GAAG;AAAA,QAC7B,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK;AAAA,MACf,CAAC;AAAA,IACH;AACA,QAAI,WAAW,MAAM,QAAQ,KAAK;AAClC,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACpC,iBAAW,MAAM,QAAQ,IAAI;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OACX,QACA,SACwB;AACxB,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B,GAAG;AAAA,MACH,MAAM,KAAK,SAAS,SAAY,KAAK,OAAO,KAAK,UAAU,KAAK,IAAI;AAAA,MACpE,aAAa,KAAK,SAAS,SAAY,KAAK,cAAc;AAAA,IAC5D,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,MAAM,QAAQ,QAAQ;AAC9C,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,OAAO,MAAM,SAAS,KAAK,OAAO,UAAU,IAAI,CAAC;AAAA,EAC1D;AAGA,QAAM,SAAS,OAAU,SAAwC;AAC/D,QAAI;AACF,aAAO,MAAM;AAAA,IACf,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,kBAAkB,KAAK,MAAM,IAAK,QAAO;AACvE,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,YAAY,CAAC,OAAe,SAChC,cAAc,mBAAmB,KAAK,CAAC,GAAG,IAAI;AAEhD,QAAM,YAA+C,CAAC,EAAE,QAAQ,MAAM,MAAM;AAC1E,UAAM,OAAO,OACX,QACA,SAEA,KAAK,QAAQ,EAAE,GAAG,MAAM,QAAQ,MAAM,UAAU,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC;AAC7E,UAAM,cAAc,CAAC,IAAY,SAC/B,cAAc,mBAAmB,EAAE,CAAC,GAAG,IAAI;AAC7C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,cAAc;AAAA,MACd,MAAM,OAAO,EAAE,MAAM,OAAO,MAA0C;AACpE,cAAM,EAAE,KAAK,IAAI,MAAM,KAAK,gBAAgB;AAAA,UAC1C,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,KAAK;AAAA,UACd;AAAA,QACF,CAAC;AACD,eAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,MAAM,KAAK,QAAQ,iBAAiB,MAAM;AAAA,MACpF;AAAA,MACA,SAAS,OAAO,EAAE,MAAM,OAAO,OAE3B,MAAM,KAAK,eAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,GACxF,QAAQ,IAAI,CAAC,WAAW,EAAE,GAAG,OAAO,MAAM,MAAM,QAAQ,iBAAiB,MAAM,EAAE;AAAA,MACrF,WAAW,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,MAAM;AACrD,cAAM,WAAW,MAAM,KAAK;AAAA,UAC1B;AAAA,UACA,QAAQ;AAAA,UACR,MAAM,UAAU,MAAM,MAAM,GAAG,gBAAgB;AAAA,UAC/C,OAAO,EAAE,MAAM,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,MAAM,EAAE;AAAA,UAC9D;AAAA,QACF,CAAC;AACD,YAAI,CAAC,SAAS,GAAI,OAAM,MAAM,QAAQ,QAAQ;AAC9C,cAAM,QAAQ,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACzD,eAAO,EAAE,OAAO,KAAK,MAAM,aAAa,OAAO;AAAA,MACjD;AAAA,MACA,YAAY,OAAO,EAAE,MAAM,QAAQ,OAAO,OAAO,MAAM;AACrD,cAAM,KAAK,aAAa;AAAA,UACtB,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,UACtC,MAAM,IAAI,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC;AAAA,UAC9B,aAAa;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,iBAAiB,OAAO,EAAE,MAAM,OAAO,MAAM;AAC3C,cAAM,KAAK,aAAa;AAAA,UACtB,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,MAAM,EAAE,KAAK;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,QAAQ,OAAO,EAAE,MAAM,WAAW,OAAO,OAAO,MAAM;AACpD,cAAM,KAAK,aAAa;AAAA,UACtB,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,MAAM,WAAW,OAAO,SAAS,GAAG,OAAO,OAAO,KAAK,EAAE;AAAA,UAClE;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,MAAM,OAAO,EAAE,IAAI,SAAS,KAAK,KAAK,WAAW,OAAO,MACtD,KAAK,eAAe;AAAA,QAClB,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,IAAI,SAAS,KAAK,KAAK,UAAU;AAAA,QACzC;AAAA,MACF,CAAC;AAAA,MACH,QAAQ,OAAO,EAAE,SAAS,cAAc,cAAc,QAAQ,OAAO,MAAM;AACzE,cAAM,SAAS,MAAM,KAAK,cAAc;AAAA,UACtC,QAAQ;AAAA,UACR,MAAM,YAAY,QAAQ,IAAI,SAAS;AAAA,UACvC,MAAM,EAAE,QAAQ,QAAQ,QAAQ,cAAc,cAAc,OAAO;AAAA,UACnE;AAAA,QACF,CAAC;AACD,cAAM,SAAS,CAAC,WAA+C;AAAA,UAC7D,MAAM,aAAa,MAAM,UAAU;AAAA,UACnC,YAAY,MAAM;AAAA,UAClB,KAAK,MAAM;AAAA,QACb;AACA,cAAM,SAA+B;AAAA,UACnC,QAAQ,OAAO,OAAO,MAAM;AAAA,UAC5B,QAAQ,OAAO,OAAO,MAAM;AAAA,UAC5B,QAAQ,OAAO;AAAA,UACf,UAAU,OAAO;AAAA,UACjB,YAAY,OAAO;AAAA,QACrB;AACA,eAAO;AAAA,MACT;AAAA,MACA,OAAO,OAAO,EAAE,SAAS,MAAM,KAAK,QAAQ,WAAW,YAAY,MAAM;AACvE,YAAI,cAAc,QAAQ,UAAU,MAAM;AACxC,gBAAM,KAAK,aAAa;AAAA,YACtB,QAAQ;AAAA,YACR,MAAM,YAAY,QAAQ,IAAI,OAAO;AAAA,YACrC,MACE,cAAc,OAAO,EAAE,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,QAAQ,QAAQ,OAAO;AAAA,YACrF,QAAQ;AAAA,UACV,CAAC;AACD,cAAI,cAAc,KAAM;AAAA,QAC1B;AACA,YAAK,QAAQ,QAAQ,KAAK,aAAa,KAAM,QAAQ,MAAM;AACzD,gBAAM,OAA8B;AAAA,YAClC,QAAQ,QAAQ;AAAA,UAClB;AACA,cAAI,QAAQ,QAAQ,KAAK,aAAa,EAAG,MAAK,aAAa,aAAa,IAAI;AAC5E,cAAI,QAAQ,KAAM,MAAK,MAAM;AAC7B,gBAAM,KAAK,aAAa;AAAA,YACtB,QAAQ;AAAA,YACR,MAAM,YAAY,QAAQ,IAAI,QAAQ;AAAA,YACtC,MAAM;AAAA,YACN,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,OAAO,MAAM;AAAA,IACf;AAAA,EACF;AAEA,SAAO;AAAA,IACL,wBAAwB,OAAO,EAAE,QAAQ,UAAU,UAAU,MAAM;AACjE,YAAM,SAAS,MAAM,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG;AAAA,QAC7D;AAAA,QACA,QAAQ;AAAA,QACR,MACE,iBACA,mBAAmB,QAAQ,IAC3B,iBACA,mBAAmB,SAAS,IAC5B;AAAA,MACJ,CAAC;AACD,UAAI,CAAC,OAAO,SAAU,OAAM,IAAI,MAAM,iDAAiD;AAAA,IACzF;AAAA,IACA,kBAAkB,CAAC,EAAE,QAAQ,UAAU,WAAW,QAAQ,MAAM;AAC9D,YAAM,SACJ,QAAQ,cAAc,2BAA2B,YAC7C,eACA,eAAe,UACb,MAAM,mBAAmB,QAAQ,SAAS,IAC1C;AACR,YAAM,QAAgC,CAAC;AACvC,UAAI,aAAa,KAAM,OAAM,YAAY;AACzC,UAAI,YAAY,QAAS,OAAM,SAAS,QAAQ;AAChD,UAAI,YAAY,WAAW,QAAQ,UAAU,KAAM,OAAM,SAAS,QAAQ;AAC1E,UAAI,WAAW,WAAW,QAAQ,SAAS,KAAM,OAAM,QAAQ,OAAO,QAAQ,KAAK;AACnF,aAAO,KAAK,+BAA+B;AAAA,QACzC;AAAA,QACA,QAAQ,QAAQ,cAAc,2BAA2B,OAAO,WAAW;AAAA,QAC3E,MAAM,iBAAiB,mBAAmB,QAAQ,IAAI,eAAe;AAAA,QACrE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,WAAW,CAAC,EAAE,QAAQ,SAAS,MAC7B;AAAA,MACE,KAAK,cAAc;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,MACnD,CAAC;AAAA,IACH;AAAA,IACF,aAAa,OAAO,EAAE,OAAO,OAC1B,MAAM,KAAK,eAAe,EAAE,QAAQ,QAAQ,OAAO,MAAM,cAAc,CAAC,GAAG;AAAA,IAC9E,gBAAgB,CAAC,EAAE,QAAQ,KAAK,MAC9B;AAAA,MACE,KAAK,cAAc;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,KAAK;AAAA,MACf,CAAC;AAAA,IACH;AAAA,IACF,OAAO,OAAO,EAAE,QAAQ,UAAU,WAAW,WAAW,QAAQ,OAAO,gBAAgB,MACrF;AAAA,MACE,MAAM,KAAK,aAAa;AAAA,QACtB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,QACjD,MAAM,EAAE,WAAW,WAAW,QAAQ,OAAO,gBAAgB;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,IACF,cAAc,OAAO,EAAE,QAAQ,UAAU,WAAW,WAAW,OAAO,MACpE;AAAA,MACE,MAAM,KAAK,aAAa;AAAA,QACtB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,QACjD,MAAM,EAAE,WAAW,WAAW,OAAO;AAAA,MACvC,CAAC;AAAA,IACH;AAAA,IACF,OAAO,OAAO,EAAE,QAAQ,OAAO,MAAM,MACnC;AAAA,MACE,MAAM,KAAK,aAAa;AAAA,QACtB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,UAAU,OAAO,QAAQ;AAAA,QAC/B,MAAM,EAAE,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,IACF,SAAS,OAAO,EAAE,QAAQ,MAAM,MAAM;AACpC,YAAM,KAAK,aAAa,EAAE,QAAQ,QAAQ,UAAU,MAAM,UAAU,OAAO,EAAE,EAAE,CAAC;AAAA,IAClF;AAAA,IACA;AAAA,IACA,YAAY,CAAC,EAAE,QAAQ,SAAS,MAC9B,KAAK,kBAAkB;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,IACnD,CAAC;AAAA,IACH,iBAAiB,OAAO,EAAE,QAAQ,MAAM,OACrC,MAAM,KAAK,eAAe,EAAE,QAAQ,QAAQ,OAAO,MAAM,UAAU,OAAO,MAAM,EAAE,CAAC,GACjF;AAAA,IACL,MAAM,OAAO,EAAE,QAAQ,OAAO,QAAQ,QAAQ,UAAU,YAAY,OAAO,OAEvE,MAAM,KAAK,gBAAgB;AAAA,MACzB;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,UAAU,OAAO,QAAQ,mBAAmB,MAAM,CAAC,IAAI,MAAM,EAAE;AAAA,MACrE,MAAM,cAAc,OAAO,EAAE,SAAS,IAAI,EAAE,UAAU,WAAW;AAAA,MACjE;AAAA,IACF,CAAC,GACD,cAAc;AAAA,IAClB,QAAQ,CAAC,EAAE,QAAQ,UAAU,WAAW,SAAS,MAC/C,KAAK,cAAc;AAAA,MACjB;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,MACjD,MAAM,EAAE,WAAW,SAAS;AAAA,IAC9B,CAAC;AAAA,EACL;AACF;",
+  "sourcesContent": ["import {\n  deviceEgressCreateRequestSchema,\n  deviceEgressWorkspaceIdSchema,\n  deviceEgressEnrollmentSchema,\n  deviceEgressLeaseSchema,\n  deviceEgressWorkspaceSchema,\n  workspaceNetworkPolicySchema,\n  deviceWorkspaceNetworkStateSchema,\n  type WorkspaceNetworkPolicyIface,\n} from '@finalai/agent-protocol/device-egress';\nimport {\n  ProcessInspectionOperation,\n  processInspectionResultSchema,\n  type ProcessInspectionRequestIface,\n  type ProcessInspectionResultIface,\n} from '@finalai/agent-protocol/process-inspection';\nimport { jsonObjectSchema, jsonValueSchema, type JsonValue } from '@finalai/agent-provider';\nimport { SandboxEntryType, type SandboxActingUserIface } from '@finalai/agent-provider/sandbox';\nimport * as z from 'zod';\nimport { decodeBase64, encodeBase64 } from \"./bytes.mjs\";\nimport { DEVICE_API_ACTING_USER_HEADER, DEVICE_API_KEY_SECRET } from \"./environment.mjs\";\nimport type {\n  SandboxTransportIface,\n  TransportDirEntryIface,\n  TransportOutputIface,\n  TransportStatIface,\n} from \"./transport.mjs\";\n\n// A client of the Device API (device-api-service), the Final Device's backend,\n// as any vendor provider has a client of its vendor's API. The provider's\n// install config is only the API origin; every call carries the session\n// organization's own API key, kept as an organization secret\n// (DEVICE_API_KEY_SECRET) like any customer's vendor key, exactly as the\n// `computer` provider calls the Computers API. A Device is one person's\n// machine, so every call also names the user it acts for\n// (DEVICE_API_ACTING_USER_HEADER), and the Device API refuses a Device that user\n// does not own, whatever the key.\n\n// The Device API's header naming the user a request acts for (a Final user id).\nexport { DEVICE_API_ACTING_USER_HEADER } from \"./environment.mjs\";\n\n// Whom a call is made for: the organization whose key it carries, and the user\n// it acts for, read on each call.\nexport interface DeviceApiCallerIface {\n  organizationId: string;\n  actingUser: SandboxActingUserIface;\n}\n\nexport interface DeviceApiConfigIface {\n  // The Device API origin.\n  url: string;\n  // The organization's Device API key (a Final organization API key), or null\n  // when it stored none.\n  credential: (args: { organizationId: string }) => Promise<string | null>;\n  // How long a read key is reused before the secret is read again (default 60 s).\n  credentialTtlMs?: number;\n  fetch?: DeviceApiFetchIface;\n}\n\nexport interface DeviceApiFetchIface {\n  (input: string, init: RequestInit): Promise<Response>;\n}\n\nexport enum DeviceApiLeaseAccess {\n  Read = 'read',\n  Write = 'write',\n}\n\nexport enum DeviceApiCapability {\n  Files = 'files',\n  Process = 'process',\n  ComputerUse = 'computer-use',\n  LocalMcp = 'local-mcp',\n}\n\nexport const DEVICE_API_COMPUTER_USE_SERVER = 'computer-use';\n\n// Unknown values from a newer API read as absent rather than failing the call.\nconst tolerantEnum = <T extends Record<string, string>>(values: T) =>\n  z.string().transform((value): T[keyof T] | null => {\n    const parsed = z.nativeEnum(values).safeParse(value);\n    return parsed.success ? parsed.data : null;\n  });\n\nconst deviceSchema = z.object({\n  id: z.string(),\n  organizationId: z.string(),\n  displayName: z.string(),\n  os: z.string(),\n  online: z.boolean(),\n  writable: z.boolean(),\n  allowProcesses: z.boolean(),\n  computerUseReady: z.boolean(),\n  screenReady: z.boolean(),\n});\nexport type DeviceApiDeviceIface = z.infer<typeof deviceSchema>;\n\nconst leaseSchema = z.object({\n  lease: z.string(),\n  deviceId: z.string(),\n  generation: z.number(),\n  workspaceRoot: z.string(),\n  platform: z.string(),\n  access: z.nativeEnum(DeviceApiLeaseAccess),\n  capabilities: z.array(tolerantEnum(DeviceApiCapability)),\n  expiresAt: z.string(),\n});\nexport interface DeviceApiLeaseIface {\n  lease: string;\n  deviceId: string;\n  generation: number;\n  workspaceRoot: string;\n  platform: string;\n  access: DeviceApiLeaseAccess;\n  capabilities: DeviceApiCapability[];\n  expiresAtMs: number;\n}\n\ninterface ProcessInputBodyIface {\n  bootId: string;\n  dataBase64?: string;\n  eof?: boolean;\n}\n\nconst errorBodySchema = z.object({ error: z.object({ code: z.string(), message: z.string() }) });\nconst statBodySchema = z.object({\n  stat: z\n    .object({\n      type: tolerantEnum(SandboxEntryType),\n      size: z.number(),\n      modifiedAtMs: z.number().nullable(),\n      mode: z.number().nullable(),\n    })\n    .nullable(),\n});\nconst dirBodySchema = z.object({\n  entries: z.array(\n    z.object({\n      name: z.string(),\n      type: tolerantEnum(SandboxEntryType),\n      size: z.number().nullable(),\n    }),\n  ),\n});\nconst processSchema = z.object({ id: z.string(), bootId: z.string() });\nconst outputStreamSchema = z.object({\n  dataBase64: z.string(),\n  nextOffset: z.number(),\n  eof: z.boolean(),\n});\nconst outputSchema = z.object({\n  stdout: outputStreamSchema,\n  stderr: outputStreamSchema,\n  exited: z.boolean(),\n  exitCode: z.number().nullable(),\n  exitSignal: z.string().nullable(),\n});\nconst devicesSchema = z.object({ devices: z.array(deviceSchema) });\nconst serversSchema = z.object({ servers: z.array(z.string()) });\n// A Device server's tool as the API recorded it; checked against the tool\n// descriptor contract where the provider hands it on.\nconst catalogToolSchema = jsonObjectSchema;\nconst mcpCatalogSchema = z.object({\n  computerUse: z.object({ tools: z.array(catalogToolSchema) }).nullable(),\n  localServers: z\n    .object({\n      servers: z.array(\n        z.object({ name: z.string(), tools: z.array(catalogToolSchema).nullable() }),\n      ),\n    })\n    .nullable(),\n});\nexport type DeviceApiMcpCatalogIface = z.infer<typeof mcpCatalogSchema>;\nconst pipeReadSchema = z.object({ dataBase64: z.string().optional() });\nconst screenSchema = z.object({ url: z.string(), token: z.string(), expiresAt: z.string() });\nconst emptySchema = z.unknown();\n\n// One ranged read or write; the API splits it into the Device's own chunks.\nexport const DEVICE_API_FILE_CHUNK_BYTES = 4 * 1024 * 1024;\n// The API long-polls the Device for output up to this long.\nexport const DEVICE_API_OUTPUT_WAIT_MS = 15_000;\n\nexport enum DeviceApiClientErrorCode {\n  // The organization stored no Device API key.\n  CredentialMissing = 'credential_missing',\n  // The session acts for no user, and a Device is only used for its owner.\n  NoActingUser = 'no_acting_user',\n  EgressEnrollmentLost = 'egress_enrollment_lost',\n}\n\nexport interface DeviceApiErrorIface extends Error {\n  status: number | null;\n  code: string;\n}\n\nconst apiError = (status: number, code: string, message: string): DeviceApiErrorIface =>\n  Object.assign(new Error(`Device API ${status} ${code}: ${message}`), { status, code });\n\nconst credentialMissing = (): DeviceApiErrorIface =>\n  Object.assign(\n    new Error(\n      `this organization has no Device API key for the device sandbox: create an organization API key and store it as the organization secret ${DEVICE_API_KEY_SECRET}`,\n    ),\n    { status: null, code: DeviceApiClientErrorCode.CredentialMissing },\n  );\n\nconst noActingUser = (): DeviceApiErrorIface =>\n  Object.assign(\n    new Error(\n      'this session acts for no user, and a Final Device is only used by sessions acting for its owner',\n    ),\n    { status: null, code: DeviceApiClientErrorCode.NoActingUser },\n  );\n\nconst statusSchema = z.object({ status: z.number() });\nexport const deviceApiCodeOf = (cause: unknown): string | null =>\n  z.object({ code: z.string() }).safeParse(cause).data?.code ?? null;\n\nexport const deviceApiStatusOf = (cause: Error): number | null =>\n  statusSchema.safeParse(cause).data?.status ?? null;\n\nconst parseJson = (text: string): JsonValue => {\n  try {\n    return jsonValueSchema.parse(JSON.parse(text));\n  } catch {\n    return null;\n  }\n};\n\nconst leaseOf = (raw: z.infer<typeof leaseSchema>): DeviceApiLeaseIface => ({\n  lease: raw.lease,\n  deviceId: raw.deviceId,\n  generation: raw.generation,\n  workspaceRoot: raw.workspaceRoot,\n  platform: raw.platform,\n  access: raw.access,\n  capabilities: raw.capabilities.filter((capability) => capability != null),\n  expiresAtMs: Date.parse(raw.expiresAt),\n});\n\nexport interface DeviceApiClientIface {\n  egress: {\n    networkState(args: {\n      organizationId: string;\n      workspaceId: string;\n    }): Promise<z.infer<typeof deviceWorkspaceNetworkStateSchema>>;\n    setNetworkPolicy(args: {\n      caller: DeviceApiCallerIface;\n      workspaceId: string;\n      policy: WorkspaceNetworkPolicyIface;\n      initializeIfMissing?: boolean;\n    }): Promise<void>;\n    workspace(args: {\n      caller: DeviceApiCallerIface;\n      workspaceId: string;\n    }): Promise<z.infer<typeof deviceEgressWorkspaceSchema>>;\n    create(args: {\n      caller: DeviceApiCallerIface;\n      workspaceId: string;\n      deviceIds: string[];\n      dnsResolvers?: string[];\n    }): Promise<z.infer<typeof deviceEgressEnrollmentSchema>>;\n    renew(args: {\n      caller: DeviceApiCallerIface;\n      leaseId: string;\n    }): Promise<z.infer<typeof deviceEgressLeaseSchema>>;\n    activate(args: {\n      caller: DeviceApiCallerIface;\n      leaseId: string;\n    }): Promise<z.infer<typeof deviceEgressLeaseSchema>>;\n    revoke(args: {\n      caller: DeviceApiCallerIface;\n      leaseId: string;\n      workspaceId: string;\n    }): Promise<void>;\n    disable(args: { caller: DeviceApiCallerIface; workspaceId: string }): Promise<void>;\n    suspend(args: { caller: DeviceApiCallerIface; workspaceId: string }): Promise<void>;\n  };\n  releaseWorkspaceLeases(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    bindingId: string;\n  }): Promise<void>;\n  inspectProcesses(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    bindingId: string;\n    request: ProcessInspectionRequestIface;\n  }): Promise<ProcessInspectionResultIface>;\n  getDevice(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n  }): Promise<DeviceApiDeviceIface | null>;\n  // The Devices of the user the call acts for.\n  listDevices(args: { caller: DeviceApiCallerIface }): Promise<DeviceApiDeviceIface[]>;\n  resolvePairing(args: {\n    caller: DeviceApiCallerIface;\n    code: string;\n  }): Promise<DeviceApiDeviceIface | null>;\n  lease(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    sessionId: string;\n    bindingId: string;\n    access: DeviceApiLeaseAccess;\n    ttlMs: number;\n    afterGeneration?: number;\n  }): Promise<DeviceApiLeaseIface>;\n  recoverLease(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    sessionId: string;\n    bindingId: string;\n    access: DeviceApiLeaseAccess;\n  }): Promise<DeviceApiLeaseIface>;\n  renew(args: {\n    caller: DeviceApiCallerIface;\n    lease: string;\n    ttlMs: number;\n  }): Promise<DeviceApiLeaseIface>;\n  release(args: { caller: DeviceApiCallerIface; lease: string }): Promise<void>;\n  // The sandbox transport over one lease; `lease()` is the current handle.\n  transport(args: {\n    caller: DeviceApiCallerIface;\n    lease: () => Promise<string>;\n  }): SandboxTransportIface;\n  localMcpServers(args: { caller: DeviceApiCallerIface; lease: string }): Promise<string[]>;\n  // What the Device's MCP servers last listed through the API, without a lease.\n  mcpCatalog(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n  }): Promise<DeviceApiMcpCatalogIface>;\n  pipe(args: {\n    caller: DeviceApiCallerIface;\n    lease: string;\n    server: string;\n    action: 'open' | 'write' | 'read' | 'close';\n    clientId: string;\n    dataBase64?: string;\n    signal?: AbortSignal;\n  }): Promise<string>;\n  screen(args: {\n    caller: DeviceApiCallerIface;\n    deviceId: string;\n    sessionId: string;\n    viewOnly?: boolean;\n  }): Promise<{ url: string; token: string; expiresAt: string }>;\n}\n\nexport const createDeviceApiClient = (config: {\n  api: DeviceApiConfigIface | (() => DeviceApiConfigIface);\n  fetch?: DeviceApiFetchIface;\n  now?: () => number;\n}): DeviceApiClientIface => {\n  const now = config.now ?? Date.now;\n  const readApi = () => (typeof config.api === 'function' ? config.api() : config.api);\n  const keys = new Map<string, { key: string; expiresAtMs: number }>();\n\n  const failure = async (response: Response): Promise<DeviceApiErrorIface> => {\n    // Read as text so proxy and load balancer error pages survive.\n    const text = await response.text().catch(() => '');\n    const body = errorBodySchema.safeParse(parseJson(text));\n    return body.success\n      ? apiError(response.status, body.data.error.code, body.data.error.message)\n      : apiError(response.status, 'http', text.slice(0, 200) || response.statusText);\n  };\n\n  // The organization's key, reused for a minute so calls do not each read the secret store.\n  const organizationKey = async (args: {\n    organizationId: string;\n    reread: boolean;\n    api: DeviceApiConfigIface;\n  }): Promise<string> => {\n    const { organizationId, reread, api } = args;\n    const cacheKey = api.url + '\\0' + organizationId;\n    const cached = keys.get(cacheKey);\n    if (cached != null && !reread && cached.expiresAtMs > now()) return cached.key;\n    const key = await api.credential({ organizationId });\n    if (key == null) {\n      keys.delete(cacheKey);\n      throw credentialMissing();\n    }\n    keys.set(cacheKey, { key, expiresAtMs: now() + (api.credentialTtlMs ?? 60_000) });\n    return key;\n  };\n\n  // One authenticated call for the user it acts for; a rejected key is read\n  // again once, in case it was rotated.\n  const send = async (args: {\n    caller: DeviceApiCallerIface;\n    method: string;\n    path: string;\n    query?: Record<string, string>;\n    body?: BodyInit;\n    contentType?: string;\n    signal?: AbortSignal;\n    anonymous?: boolean;\n  }): Promise<Response> => {\n    const api = readApi();\n    const origin = api.url.replace(/\\/+$/, '');\n    const url = new URL(`${origin}${args.path}`);\n    for (const [key, value] of Object.entries(args.query ?? {})) url.searchParams.set(key, value);\n    const actingUserId = await args.caller.actingUser.current();\n    if (actingUserId == null && !args.anonymous) throw noActingUser();\n    const attempt = async (refresh: boolean): Promise<Response> => {\n      const headers = new Headers({\n        authorization: `Bearer ${await organizationKey({ organizationId: args.caller.organizationId, reread: refresh, api })}`,\n      });\n      if (actingUserId != null) headers.set(DEVICE_API_ACTING_USER_HEADER, actingUserId);\n      if (args.contentType != null) headers.set('content-type', args.contentType);\n      return (config.fetch ?? api.fetch ?? fetch)(url.toString(), {\n        method: args.method,\n        headers,\n        body: args.body,\n        signal: args.signal,\n      });\n    };\n    let response = await attempt(false);\n    if (response.status === 401) {\n      await response.text().catch(() => '');\n      response = await attempt(true);\n    }\n    return response;\n  };\n\n  const json = async <T extends z.ZodType>(\n    schema: T,\n    args: Parameters<typeof send>[0] & { json?: unknown },\n  ): Promise<z.infer<T>> => {\n    const response = await send({\n      ...args,\n      body: args.json === undefined ? args.body : JSON.stringify(args.json),\n      contentType: args.json === undefined ? args.contentType : 'application/json',\n    });\n    if (!response.ok) throw await failure(response);\n    const text = await response.text();\n    return schema.parse(text === '' ? null : parseJson(text));\n  };\n\n  // A 404 reads as absent.\n  const orNull = async <T>(work: Promise<T>): Promise<T | null> => {\n    try {\n      return await work;\n    } catch (cause) {\n      if (cause instanceof Error && deviceApiStatusOf(cause) === 404) return null;\n      throw cause;\n    }\n  };\n\n  const leasePath = (lease: string, rest: string): string =>\n    `/v1/leases/${encodeURIComponent(lease)}${rest}`;\n\n  const transport: DeviceApiClientIface['transport'] = ({ caller, lease }) => {\n    const call = async <T extends z.ZodType>(\n      schema: T,\n      args: Omit<Parameters<typeof json>[1], 'caller' | 'path'> & { path: string },\n    ): Promise<z.infer<T>> =>\n      json(schema, { ...args, caller, path: leasePath(await lease(), args.path) });\n    const processPath = (id: string, rest: string): string =>\n      `/processes/${encodeURIComponent(id)}${rest}`;\n    return {\n      kind: 'device-api',\n      fileChunkBytes: DEVICE_API_FILE_CHUNK_BYTES,\n      outputWaitMs: DEVICE_API_OUTPUT_WAIT_MS,\n      stat: async ({ path, signal }): Promise<TransportStatIface | null> => {\n        const { stat } = await call(statBodySchema, {\n          method: 'GET',\n          path: '/files/stat',\n          query: { path },\n          signal,\n        });\n        return stat == null ? null : { ...stat, type: stat.type ?? SandboxEntryType.Other };\n      },\n      readDir: async ({ path, signal }): Promise<TransportDirEntryIface[]> =>\n        (\n          await call(dirBodySchema, { method: 'GET', path: '/files/dir', query: { path }, signal })\n        ).entries.map((entry) => ({ ...entry, type: entry.type ?? SandboxEntryType.Other })),\n      readChunk: async ({ path, offset, length, signal }) => {\n        const response = await send({\n          caller,\n          method: 'GET',\n          path: leasePath(await lease(), '/files/content'),\n          query: { path, offset: String(offset), length: String(length) },\n          signal,\n        });\n        if (!response.ok) throw await failure(response);\n        const bytes = new Uint8Array(await response.arrayBuffer());\n        return { bytes, eof: bytes.byteLength < length };\n      },\n      writeChunk: async ({ path, offset, bytes, signal }) => {\n        await call(emptySchema, {\n          method: 'PUT',\n          path: '/files/content',\n          query: { path, offset: String(offset) },\n          body: new Blob([bytes.slice()]),\n          contentType: 'application/octet-stream',\n          signal,\n        });\n      },\n      createDirectory: async ({ path, signal }) => {\n        await call(emptySchema, {\n          method: 'POST',\n          path: '/files/directories',\n          json: { path },\n          signal,\n        });\n      },\n      remove: async ({ path, recursive, force, signal }) => {\n        await call(emptySchema, {\n          method: 'DELETE',\n          path: '/files',\n          query: { path, recursive: String(recursive), force: String(force) },\n          signal,\n        });\n      },\n      exec: async ({ id, command, cwd, env, timeoutMs, signal }) =>\n        call(processSchema, {\n          method: 'POST',\n          path: '/processes',\n          json: { id, command, cwd, env, timeoutMs },\n          signal,\n        }),\n      output: async ({ process, stdoutOffset, stderrOffset, waitMs, signal }) => {\n        const output = await call(outputSchema, {\n          method: 'POST',\n          path: processPath(process.id, '/output'),\n          json: { bootId: process.bootId, stdoutOffset, stderrOffset, waitMs },\n          signal,\n        });\n        const stream = (value: z.infer<typeof outputStreamSchema>) => ({\n          data: decodeBase64(value.dataBase64),\n          nextOffset: value.nextOffset,\n          eof: value.eof,\n        });\n        const result: TransportOutputIface = {\n          stdout: stream(output.stdout),\n          stderr: stream(output.stderr),\n          exited: output.exited,\n          exitCode: output.exitCode,\n          exitSignal: output.exitSignal,\n        };\n        return result;\n      },\n      input: async ({ process, data, eof, signal, terminate, abortSignal }) => {\n        if (terminate === true || signal != null) {\n          await call(emptySchema, {\n            method: 'POST',\n            path: processPath(process.id, '/kill'),\n            json:\n              terminate === true ? { bootId: process.bootId } : { bootId: process.bootId, signal },\n            signal: abortSignal,\n          });\n          if (terminate === true) return;\n        }\n        if ((data != null && data.byteLength > 0) || eof === true) {\n          const body: ProcessInputBodyIface = {\n            bootId: process.bootId,\n          };\n          if (data != null && data.byteLength > 0) body.dataBase64 = encodeBase64(data);\n          if (eof === true) body.eof = true;\n          await call(emptySchema, {\n            method: 'POST',\n            path: processPath(process.id, '/input'),\n            json: body,\n            signal: abortSignal,\n          });\n        }\n      },\n      close: () => undefined,\n    };\n  };\n\n  return {\n    egress: {\n      networkState: ({ organizationId, workspaceId }) =>\n        json(deviceWorkspaceNetworkStateSchema, {\n          caller: { organizationId, actingUser: { current: async () => null } },\n          anonymous: true,\n          method: 'GET',\n          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}/network-state`,\n          signal: AbortSignal.timeout(30_000),\n        }),\n      setNetworkPolicy: async ({ caller, workspaceId, policy, initializeIfMissing }) => {\n        const userId = await caller.actingUser.current();\n        const anonymous = userId == null;\n        const resolvedCaller = { ...caller, actingUser: { current: async () => userId } };\n        const result = await json(z.object({ ok: z.boolean() }), {\n          caller: resolvedCaller,\n          method: initializeIfMissing === true ? 'POST' : 'PUT',\n          anonymous,\n          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}/${initializeIfMissing === true ? 'network-state/initialize' : anonymous ? 'network-state' : 'network-policy'}`,\n          json: workspaceNetworkPolicySchema.parse(policy),\n          signal: AbortSignal.timeout(30_000),\n        });\n        if (!result.ok) throw new Error('Device API did not save the workspace network policy');\n      },\n      workspace: ({ caller, workspaceId }) =>\n        json(deviceEgressWorkspaceSchema, {\n          caller,\n          method: 'GET',\n          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}`,\n          signal: AbortSignal.timeout(30_000),\n        }),\n      create: ({ caller, ...input }) =>\n        json(deviceEgressEnrollmentSchema, {\n          caller,\n          method: 'POST',\n          path: '/v1/egress/leases',\n          json: deviceEgressCreateRequestSchema.parse(input),\n          signal: AbortSignal.timeout(180_000),\n        }),\n      renew: ({ caller, leaseId }) =>\n        json(deviceEgressLeaseSchema, {\n          caller,\n          method: 'POST',\n          path: `/v1/egress/leases/${encodeURIComponent(leaseId)}/renew`,\n          signal: AbortSignal.timeout(180_000),\n        }),\n      activate: ({ caller, leaseId }) =>\n        json(deviceEgressLeaseSchema, {\n          caller,\n          method: 'POST',\n          path: `/v1/egress/leases/${encodeURIComponent(leaseId)}/activate`,\n          signal: AbortSignal.timeout(60_000),\n        }),\n      revoke: async ({ caller, leaseId, workspaceId }) => {\n        await json(emptySchema, {\n          caller,\n          method: 'DELETE',\n          json: { workspaceId },\n          path: `/v1/egress/leases/${encodeURIComponent(leaseId)}`,\n          signal: AbortSignal.timeout(60_000),\n        });\n      },\n      suspend: async ({\n        caller,\n        workspaceId,\n      }: {\n        caller: DeviceApiCallerIface;\n        workspaceId: string;\n      }) => {\n        const userId = await caller.actingUser.current();\n        const anonymous = userId == null;\n        const resolvedCaller = { ...caller, actingUser: { current: async () => userId } };\n        await json(emptySchema, {\n          caller: resolvedCaller,\n          anonymous,\n          method: 'POST',\n          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}/${anonymous ? 'network-state/suspend' : 'suspend'}`,\n          signal: AbortSignal.timeout(60_000),\n        });\n      },\n      disable: async ({ caller, workspaceId }) => {\n        await json(emptySchema, {\n          caller,\n          method: 'DELETE',\n          path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}`,\n          signal: AbortSignal.timeout(60_000),\n        });\n      },\n    },\n    releaseWorkspaceLeases: async ({ caller, deviceId, bindingId }) => {\n      const result = await json(z.object({ released: z.boolean() }), {\n        caller,\n        method: 'DELETE',\n        path:\n          '/v1/devices/' +\n          encodeURIComponent(deviceId) +\n          '/workspaces/' +\n          encodeURIComponent(bindingId) +\n          '/leases',\n      });\n      if (!result.released) throw new Error('The Device did not release its workspace leases');\n    },\n    inspectProcesses: ({ caller, deviceId, bindingId, request }) => {\n      const suffix =\n        request.operation === ProcessInspectionOperation.Available\n          ? '/available'\n          : 'processId' in request\n            ? '/' + encodeURIComponent(request.processId)\n            : '';\n      const query: Record<string, string> = {};\n      if (bindingId != null) query.bindingId = bindingId;\n      if ('bootId' in request) query.bootId = request.bootId;\n      if ('cursor' in request && request.cursor != null) query.cursor = request.cursor;\n      if ('limit' in request && request.limit != null) query.limit = String(request.limit);\n      return json(processInspectionResultSchema, {\n        caller,\n        method: request.operation === ProcessInspectionOperation.Stop ? 'DELETE' : 'GET',\n        path: '/v1/devices/' + encodeURIComponent(deviceId) + '/processes' + suffix,\n        query,\n      });\n    },\n    getDevice: ({ caller, deviceId }) =>\n      orNull(\n        json(deviceSchema, {\n          caller,\n          method: 'GET',\n          path: `/v1/devices/${encodeURIComponent(deviceId)}`,\n        }),\n      ),\n    listDevices: async ({ caller }) =>\n      (await json(devicesSchema, { caller, method: 'GET', path: '/v1/devices' })).devices,\n    resolvePairing: ({ caller, code }) =>\n      orNull(\n        json(deviceSchema, {\n          caller,\n          method: 'POST',\n          path: '/v1/pairings/resolve',\n          json: { code },\n        }),\n      ),\n    lease: async ({ caller, deviceId, sessionId, bindingId, access, ttlMs, afterGeneration }) =>\n      leaseOf(\n        await json(leaseSchema, {\n          caller,\n          method: 'POST',\n          path: `/v1/devices/${encodeURIComponent(deviceId)}/leases`,\n          json: { sessionId, bindingId, access, ttlMs, afterGeneration },\n        }),\n      ),\n    recoverLease: async ({ caller, deviceId, sessionId, bindingId, access }) =>\n      leaseOf(\n        await json(leaseSchema, {\n          caller,\n          method: 'POST',\n          path: `/v1/devices/${encodeURIComponent(deviceId)}/leases/recover`,\n          json: { sessionId, bindingId, access },\n        }),\n      ),\n    renew: async ({ caller, lease, ttlMs }) =>\n      leaseOf(\n        await json(leaseSchema, {\n          caller,\n          method: 'POST',\n          path: leasePath(lease, '/renew'),\n          json: { ttlMs },\n        }),\n      ),\n    release: async ({ caller, lease }) => {\n      await json(emptySchema, { caller, method: 'DELETE', path: leasePath(lease, '') });\n    },\n    transport,\n    mcpCatalog: ({ caller, deviceId }) =>\n      json(mcpCatalogSchema, {\n        caller,\n        method: 'GET',\n        path: `/v1/devices/${encodeURIComponent(deviceId)}/mcp`,\n      }),\n    localMcpServers: async ({ caller, lease }) =>\n      (await json(serversSchema, { caller, method: 'GET', path: leasePath(lease, '/mcp') }))\n        .servers,\n    pipe: async ({ caller, lease, server, action, clientId, dataBase64, signal }) =>\n      (\n        await json(pipeReadSchema, {\n          caller,\n          method: 'POST',\n          path: leasePath(lease, `/mcp/${encodeURIComponent(server)}/${action}`),\n          json: dataBase64 == null ? { clientId } : { clientId, dataBase64 },\n          signal,\n        })\n      ).dataBase64 ?? '',\n    screen: ({ caller, deviceId, sessionId, viewOnly }) =>\n      json(screenSchema, {\n        caller,\n        method: 'POST',\n        path: `/v1/devices/${encodeURIComponent(deviceId)}/screen`,\n        json: { sessionId, viewOnly },\n      }),\n  };\n};\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,kBAAkB,uBAAuC;AAClE,SAAS,wBAAqD;AAC9D,YAAY,OAAO;AACnB,SAAS,cAAc,oBAAoB;AAC3C,SAAS,+BAA+B,6BAA6B;AAmBrE,SAAS,iCAAAA,sCAAqC;AAwBvC,IAAK,uBAAL,kBAAKC,0BAAL;AACL,EAAAA,sBAAA,UAAO;AACP,EAAAA,sBAAA,WAAQ;AAFE,SAAAA;AAAA,GAAA;AAKL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,WAAQ;AACR,EAAAA,qBAAA,aAAU;AACV,EAAAA,qBAAA,iBAAc;AACd,EAAAA,qBAAA,cAAW;AAJD,SAAAA;AAAA,GAAA;AAOL,MAAM,iCAAiC;AAG9C,MAAM,eAAe,CAAmC,WACtD,EAAE,OAAO,EAAE,UAAU,CAAC,UAA6B;AACjD,QAAM,SAAS,EAAE,WAAW,MAAM,EAAE,UAAU,KAAK;AACnD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC,CAAC;AAEH,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO;AAAA,EACb,gBAAgB,EAAE,OAAO;AAAA,EACzB,aAAa,EAAE,OAAO;AAAA,EACtB,IAAI,EAAE,OAAO;AAAA,EACb,QAAQ,EAAE,QAAQ;AAAA,EAClB,UAAU,EAAE,QAAQ;AAAA,EACpB,gBAAgB,EAAE,QAAQ;AAAA,EAC1B,kBAAkB,EAAE,QAAQ;AAAA,EAC5B,aAAa,EAAE,QAAQ;AACzB,CAAC;AAGD,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO;AAAA,EACxB,UAAU,EAAE,OAAO;AAAA,EACnB,QAAQ,EAAE,WAAW,oBAAoB;AAAA,EACzC,cAAc,EAAE,MAAM,aAAa,mBAAmB,CAAC;AAAA,EACvD,WAAW,EAAE,OAAO;AACtB,CAAC;AAkBD,MAAM,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC/F,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EACH,OAAO;AAAA,IACN,MAAM,aAAa,gBAAgB;AAAA,IACnC,MAAM,EAAE,OAAO;AAAA,IACf,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,EACA,SAAS;AACd,CAAC;AACD,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,SAAS,EAAE;AAAA,IACT,EAAE,OAAO;AAAA,MACP,MAAM,EAAE,OAAO;AAAA,MACf,MAAM,aAAa,gBAAgB;AAAA,MACnC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH;AACF,CAAC;AACD,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AAAA,EACrB,KAAK,EAAE,QAAQ;AACjB,CAAC;AACD,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ,EAAE,QAAQ;AAAA,EAClB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AACD,MAAM,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,EAAE,CAAC;AACjE,MAAM,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAG/D,MAAM,oBAAoB;AAC1B,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,CAAC,EAAE,SAAS;AAAA,EACtE,cAAc,EACX,OAAO;AAAA,IACN,SAAS,EAAE;AAAA,MACT,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAAA,IAC7E;AAAA,EACF,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrE,MAAM,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAC3F,MAAM,cAAc,EAAE,QAAQ;AAGvB,MAAM,8BAA8B,IAAI,OAAO;AAE/C,MAAM,4BAA4B;AAElC,IAAK,2BAAL,kBAAKC,8BAAL;AAEL,EAAAA,0BAAA,uBAAoB;AAEpB,EAAAA,0BAAA,kBAAe;AACf,EAAAA,0BAAA,0BAAuB;AALb,SAAAA;AAAA,GAAA;AAaZ,MAAM,WAAW,CAAC,QAAgB,MAAc,YAC9C,OAAO,OAAO,IAAI,MAAM,cAAc,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;AAEvF,MAAM,oBAAoB,MACxB,OAAO;AAAA,EACL,IAAI;AAAA,IACF,0IAA0I,qBAAqB;AAAA,EACjK;AAAA,EACA,EAAE,QAAQ,MAAM,MAAM,6CAA2C;AACnE;AAEF,MAAM,eAAe,MACnB,OAAO;AAAA,EACL,IAAI;AAAA,IACF;AAAA,EACF;AAAA,EACA,EAAE,QAAQ,MAAM,MAAM,oCAAsC;AAC9D;AAEF,MAAM,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7C,MAAM,kBAAkB,CAAC,UAC9B,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,KAAK,EAAE,MAAM,QAAQ;AAEzD,MAAM,oBAAoB,CAAC,UAChC,aAAa,UAAU,KAAK,EAAE,MAAM,UAAU;AAEhD,MAAM,YAAY,CAAC,SAA4B;AAC7C,MAAI;AACF,WAAO,gBAAgB,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,UAAU,CAAC,SAA2D;AAAA,EAC1E,OAAO,IAAI;AAAA,EACX,UAAU,IAAI;AAAA,EACd,YAAY,IAAI;AAAA,EAChB,eAAe,IAAI;AAAA,EACnB,UAAU,IAAI;AAAA,EACd,QAAQ,IAAI;AAAA,EACZ,cAAc,IAAI,aAAa,OAAO,CAAC,eAAe,cAAc,IAAI;AAAA,EACxE,aAAa,KAAK,MAAM,IAAI,SAAS;AACvC;AA+GO,MAAM,wBAAwB,CAAC,WAIV;AAC1B,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,UAAU,MAAO,OAAO,OAAO,QAAQ,aAAa,OAAO,IAAI,IAAI,OAAO;AAChF,QAAM,OAAO,oBAAI,IAAkD;AAEnE,QAAM,UAAU,OAAO,aAAqD;AAE1E,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,OAAO,gBAAgB,UAAU,UAAU,IAAI,CAAC;AACtD,WAAO,KAAK,UACR,SAAS,SAAS,QAAQ,KAAK,KAAK,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,IACvE,SAAS,SAAS,QAAQ,QAAQ,KAAK,MAAM,GAAG,GAAG,KAAK,SAAS,UAAU;AAAA,EACjF;AAGA,QAAM,kBAAkB,OAAO,SAIR;AACrB,UAAM,EAAE,gBAAgB,QAAQ,IAAI,IAAI;AACxC,UAAM,WAAW,IAAI,MAAM,OAAO;AAClC,UAAM,SAAS,KAAK,IAAI,QAAQ;AAChC,QAAI,UAAU,QAAQ,CAAC,UAAU,OAAO,cAAc,IAAI,EAAG,QAAO,OAAO;AAC3E,UAAM,MAAM,MAAM,IAAI,WAAW,EAAE,eAAe,CAAC;AACnD,QAAI,OAAO,MAAM;AACf,WAAK,OAAO,QAAQ;AACpB,YAAM,kBAAkB;AAAA,IAC1B;AACA,SAAK,IAAI,UAAU,EAAE,KAAK,aAAa,IAAI,KAAK,IAAI,mBAAmB,KAAQ,CAAC;AAChF,WAAO;AAAA,EACT;AAIA,QAAM,OAAO,OAAO,SASK;AACvB,UAAM,MAAM,QAAQ;AACpB,UAAM,SAAS,IAAI,IAAI,QAAQ,QAAQ,EAAE;AACzC,UAAM,MAAM,IAAI,IAAI,GAAG,MAAM,GAAG,KAAK,IAAI,EAAE;AAC3C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,EAAG,KAAI,aAAa,IAAI,KAAK,KAAK;AAC5F,UAAM,eAAe,MAAM,KAAK,OAAO,WAAW,QAAQ;AAC1D,QAAI,gBAAgB,QAAQ,CAAC,KAAK,UAAW,OAAM,aAAa;AAChE,UAAM,UAAU,OAAO,YAAwC;AAC7D,YAAM,UAAU,IAAI,QAAQ;AAAA,QAC1B,eAAe,UAAU,MAAM,gBAAgB,EAAE,gBAAgB,KAAK,OAAO,gBAAgB,QAAQ,SAAS,IAAI,CAAC,CAAC;AAAA,MACtH,CAAC;AACD,UAAI,gBAAgB,KAAM,SAAQ,IAAI,+BAA+B,YAAY;AACjF,UAAI,KAAK,eAAe,KAAM,SAAQ,IAAI,gBAAgB,KAAK,WAAW;AAC1E,cAAQ,OAAO,SAAS,IAAI,SAAS,OAAO,IAAI,SAAS,GAAG;AAAA,QAC1D,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK;AAAA,MACf,CAAC;AAAA,IACH;AACA,QAAI,WAAW,MAAM,QAAQ,KAAK;AAClC,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACpC,iBAAW,MAAM,QAAQ,IAAI;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OACX,QACA,SACwB;AACxB,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B,GAAG;AAAA,MACH,MAAM,KAAK,SAAS,SAAY,KAAK,OAAO,KAAK,UAAU,KAAK,IAAI;AAAA,MACpE,aAAa,KAAK,SAAS,SAAY,KAAK,cAAc;AAAA,IAC5D,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,MAAM,QAAQ,QAAQ;AAC9C,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,OAAO,MAAM,SAAS,KAAK,OAAO,UAAU,IAAI,CAAC;AAAA,EAC1D;AAGA,QAAM,SAAS,OAAU,SAAwC;AAC/D,QAAI;AACF,aAAO,MAAM;AAAA,IACf,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,kBAAkB,KAAK,MAAM,IAAK,QAAO;AACvE,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,YAAY,CAAC,OAAe,SAChC,cAAc,mBAAmB,KAAK,CAAC,GAAG,IAAI;AAEhD,QAAM,YAA+C,CAAC,EAAE,QAAQ,MAAM,MAAM;AAC1E,UAAM,OAAO,OACX,QACA,SAEA,KAAK,QAAQ,EAAE,GAAG,MAAM,QAAQ,MAAM,UAAU,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC;AAC7E,UAAM,cAAc,CAAC,IAAY,SAC/B,cAAc,mBAAmB,EAAE,CAAC,GAAG,IAAI;AAC7C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,cAAc;AAAA,MACd,MAAM,OAAO,EAAE,MAAM,OAAO,MAA0C;AACpE,cAAM,EAAE,KAAK,IAAI,MAAM,KAAK,gBAAgB;AAAA,UAC1C,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,KAAK;AAAA,UACd;AAAA,QACF,CAAC;AACD,eAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,MAAM,KAAK,QAAQ,iBAAiB,MAAM;AAAA,MACpF;AAAA,MACA,SAAS,OAAO,EAAE,MAAM,OAAO,OAE3B,MAAM,KAAK,eAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,GACxF,QAAQ,IAAI,CAAC,WAAW,EAAE,GAAG,OAAO,MAAM,MAAM,QAAQ,iBAAiB,MAAM,EAAE;AAAA,MACrF,WAAW,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,MAAM;AACrD,cAAM,WAAW,MAAM,KAAK;AAAA,UAC1B;AAAA,UACA,QAAQ;AAAA,UACR,MAAM,UAAU,MAAM,MAAM,GAAG,gBAAgB;AAAA,UAC/C,OAAO,EAAE,MAAM,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,MAAM,EAAE;AAAA,UAC9D;AAAA,QACF,CAAC;AACD,YAAI,CAAC,SAAS,GAAI,OAAM,MAAM,QAAQ,QAAQ;AAC9C,cAAM,QAAQ,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACzD,eAAO,EAAE,OAAO,KAAK,MAAM,aAAa,OAAO;AAAA,MACjD;AAAA,MACA,YAAY,OAAO,EAAE,MAAM,QAAQ,OAAO,OAAO,MAAM;AACrD,cAAM,KAAK,aAAa;AAAA,UACtB,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,MAAM,QAAQ,OAAO,MAAM,EAAE;AAAA,UACtC,MAAM,IAAI,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC;AAAA,UAC9B,aAAa;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,iBAAiB,OAAO,EAAE,MAAM,OAAO,MAAM;AAC3C,cAAM,KAAK,aAAa;AAAA,UACtB,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,MAAM,EAAE,KAAK;AAAA,UACb;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,QAAQ,OAAO,EAAE,MAAM,WAAW,OAAO,OAAO,MAAM;AACpD,cAAM,KAAK,aAAa;AAAA,UACtB,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,MAAM,WAAW,OAAO,SAAS,GAAG,OAAO,OAAO,KAAK,EAAE;AAAA,UAClE;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,MAAM,OAAO,EAAE,IAAI,SAAS,KAAK,KAAK,WAAW,OAAO,MACtD,KAAK,eAAe;AAAA,QAClB,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,IAAI,SAAS,KAAK,KAAK,UAAU;AAAA,QACzC;AAAA,MACF,CAAC;AAAA,MACH,QAAQ,OAAO,EAAE,SAAS,cAAc,cAAc,QAAQ,OAAO,MAAM;AACzE,cAAM,SAAS,MAAM,KAAK,cAAc;AAAA,UACtC,QAAQ;AAAA,UACR,MAAM,YAAY,QAAQ,IAAI,SAAS;AAAA,UACvC,MAAM,EAAE,QAAQ,QAAQ,QAAQ,cAAc,cAAc,OAAO;AAAA,UACnE;AAAA,QACF,CAAC;AACD,cAAM,SAAS,CAAC,WAA+C;AAAA,UAC7D,MAAM,aAAa,MAAM,UAAU;AAAA,UACnC,YAAY,MAAM;AAAA,UAClB,KAAK,MAAM;AAAA,QACb;AACA,cAAM,SAA+B;AAAA,UACnC,QAAQ,OAAO,OAAO,MAAM;AAAA,UAC5B,QAAQ,OAAO,OAAO,MAAM;AAAA,UAC5B,QAAQ,OAAO;AAAA,UACf,UAAU,OAAO;AAAA,UACjB,YAAY,OAAO;AAAA,QACrB;AACA,eAAO;AAAA,MACT;AAAA,MACA,OAAO,OAAO,EAAE,SAAS,MAAM,KAAK,QAAQ,WAAW,YAAY,MAAM;AACvE,YAAI,cAAc,QAAQ,UAAU,MAAM;AACxC,gBAAM,KAAK,aAAa;AAAA,YACtB,QAAQ;AAAA,YACR,MAAM,YAAY,QAAQ,IAAI,OAAO;AAAA,YACrC,MACE,cAAc,OAAO,EAAE,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,QAAQ,QAAQ,OAAO;AAAA,YACrF,QAAQ;AAAA,UACV,CAAC;AACD,cAAI,cAAc,KAAM;AAAA,QAC1B;AACA,YAAK,QAAQ,QAAQ,KAAK,aAAa,KAAM,QAAQ,MAAM;AACzD,gBAAM,OAA8B;AAAA,YAClC,QAAQ,QAAQ;AAAA,UAClB;AACA,cAAI,QAAQ,QAAQ,KAAK,aAAa,EAAG,MAAK,aAAa,aAAa,IAAI;AAC5E,cAAI,QAAQ,KAAM,MAAK,MAAM;AAC7B,gBAAM,KAAK,aAAa;AAAA,YACtB,QAAQ;AAAA,YACR,MAAM,YAAY,QAAQ,IAAI,QAAQ;AAAA,YACtC,MAAM;AAAA,YACN,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,OAAO,MAAM;AAAA,IACf;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,cAAc,CAAC,EAAE,gBAAgB,YAAY,MAC3C,KAAK,mCAAmC;AAAA,QACtC,QAAQ,EAAE,gBAAgB,YAAY,EAAE,SAAS,YAAY,KAAK,EAAE;AAAA,QACpE,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,MAAM,yBAAyB,mBAAmB,8BAA8B,MAAM,WAAW,CAAC,CAAC;AAAA,QACnG,QAAQ,YAAY,QAAQ,GAAM;AAAA,MACpC,CAAC;AAAA,MACH,kBAAkB,OAAO,EAAE,QAAQ,aAAa,QAAQ,oBAAoB,MAAM;AAChF,cAAM,SAAS,MAAM,OAAO,WAAW,QAAQ;AAC/C,cAAM,YAAY,UAAU;AAC5B,cAAM,iBAAiB,EAAE,GAAG,QAAQ,YAAY,EAAE,SAAS,YAAY,OAAO,EAAE;AAChF,cAAM,SAAS,MAAM,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG;AAAA,UACvD,QAAQ;AAAA,UACR,QAAQ,wBAAwB,OAAO,SAAS;AAAA,UAChD;AAAA,UACA,MAAM,yBAAyB,mBAAmB,8BAA8B,MAAM,WAAW,CAAC,CAAC,IAAI,wBAAwB,OAAO,6BAA6B,YAAY,kBAAkB,gBAAgB;AAAA,UACjN,MAAM,6BAA6B,MAAM,MAAM;AAAA,UAC/C,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC,CAAC;AACD,YAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,sDAAsD;AAAA,MACxF;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,YAAY,MAChC,KAAK,6BAA6B;AAAA,QAChC;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,yBAAyB,mBAAmB,8BAA8B,MAAM,WAAW,CAAC,CAAC;AAAA,QACnG,QAAQ,YAAY,QAAQ,GAAM;AAAA,MACpC,CAAC;AAAA,MACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,MAC1B,KAAK,8BAA8B;AAAA,QACjC;AAAA,QACA,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,gCAAgC,MAAM,KAAK;AAAA,QACjD,QAAQ,YAAY,QAAQ,IAAO;AAAA,MACrC,CAAC;AAAA,MACH,OAAO,CAAC,EAAE,QAAQ,QAAQ,MACxB,KAAK,yBAAyB;AAAA,QAC5B;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,qBAAqB,mBAAmB,OAAO,CAAC;AAAA,QACtD,QAAQ,YAAY,QAAQ,IAAO;AAAA,MACrC,CAAC;AAAA,MACH,UAAU,CAAC,EAAE,QAAQ,QAAQ,MAC3B,KAAK,yBAAyB;AAAA,QAC5B;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,qBAAqB,mBAAmB,OAAO,CAAC;AAAA,QACtD,QAAQ,YAAY,QAAQ,GAAM;AAAA,MACpC,CAAC;AAAA,MACH,QAAQ,OAAO,EAAE,QAAQ,SAAS,YAAY,MAAM;AAClD,cAAM,KAAK,aAAa;AAAA,UACtB;AAAA,UACA,QAAQ;AAAA,UACR,MAAM,EAAE,YAAY;AAAA,UACpB,MAAM,qBAAqB,mBAAmB,OAAO,CAAC;AAAA,UACtD,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC,CAAC;AAAA,MACH;AAAA,MACA,SAAS,OAAO;AAAA,QACd;AAAA,QACA;AAAA,MACF,MAGM;AACJ,cAAM,SAAS,MAAM,OAAO,WAAW,QAAQ;AAC/C,cAAM,YAAY,UAAU;AAC5B,cAAM,iBAAiB,EAAE,GAAG,QAAQ,YAAY,EAAE,SAAS,YAAY,OAAO,EAAE;AAChF,cAAM,KAAK,aAAa;AAAA,UACtB,QAAQ;AAAA,UACR;AAAA,UACA,QAAQ;AAAA,UACR,MAAM,yBAAyB,mBAAmB,8BAA8B,MAAM,WAAW,CAAC,CAAC,IAAI,YAAY,0BAA0B,SAAS;AAAA,UACtJ,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC,CAAC;AAAA,MACH;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,YAAY,MAAM;AAC1C,cAAM,KAAK,aAAa;AAAA,UACtB;AAAA,UACA,QAAQ;AAAA,UACR,MAAM,yBAAyB,mBAAmB,8BAA8B,MAAM,WAAW,CAAC,CAAC;AAAA,UACnG,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,wBAAwB,OAAO,EAAE,QAAQ,UAAU,UAAU,MAAM;AACjE,YAAM,SAAS,MAAM,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG;AAAA,QAC7D;AAAA,QACA,QAAQ;AAAA,QACR,MACE,iBACA,mBAAmB,QAAQ,IAC3B,iBACA,mBAAmB,SAAS,IAC5B;AAAA,MACJ,CAAC;AACD,UAAI,CAAC,OAAO,SAAU,OAAM,IAAI,MAAM,iDAAiD;AAAA,IACzF;AAAA,IACA,kBAAkB,CAAC,EAAE,QAAQ,UAAU,WAAW,QAAQ,MAAM;AAC9D,YAAM,SACJ,QAAQ,cAAc,2BAA2B,YAC7C,eACA,eAAe,UACb,MAAM,mBAAmB,QAAQ,SAAS,IAC1C;AACR,YAAM,QAAgC,CAAC;AACvC,UAAI,aAAa,KAAM,OAAM,YAAY;AACzC,UAAI,YAAY,QAAS,OAAM,SAAS,QAAQ;AAChD,UAAI,YAAY,WAAW,QAAQ,UAAU,KAAM,OAAM,SAAS,QAAQ;AAC1E,UAAI,WAAW,WAAW,QAAQ,SAAS,KAAM,OAAM,QAAQ,OAAO,QAAQ,KAAK;AACnF,aAAO,KAAK,+BAA+B;AAAA,QACzC;AAAA,QACA,QAAQ,QAAQ,cAAc,2BAA2B,OAAO,WAAW;AAAA,QAC3E,MAAM,iBAAiB,mBAAmB,QAAQ,IAAI,eAAe;AAAA,QACrE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,WAAW,CAAC,EAAE,QAAQ,SAAS,MAC7B;AAAA,MACE,KAAK,cAAc;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,MACnD,CAAC;AAAA,IACH;AAAA,IACF,aAAa,OAAO,EAAE,OAAO,OAC1B,MAAM,KAAK,eAAe,EAAE,QAAQ,QAAQ,OAAO,MAAM,cAAc,CAAC,GAAG;AAAA,IAC9E,gBAAgB,CAAC,EAAE,QAAQ,KAAK,MAC9B;AAAA,MACE,KAAK,cAAc;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,KAAK;AAAA,MACf,CAAC;AAAA,IACH;AAAA,IACF,OAAO,OAAO,EAAE,QAAQ,UAAU,WAAW,WAAW,QAAQ,OAAO,gBAAgB,MACrF;AAAA,MACE,MAAM,KAAK,aAAa;AAAA,QACtB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,QACjD,MAAM,EAAE,WAAW,WAAW,QAAQ,OAAO,gBAAgB;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,IACF,cAAc,OAAO,EAAE,QAAQ,UAAU,WAAW,WAAW,OAAO,MACpE;AAAA,MACE,MAAM,KAAK,aAAa;AAAA,QACtB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,QACjD,MAAM,EAAE,WAAW,WAAW,OAAO;AAAA,MACvC,CAAC;AAAA,IACH;AAAA,IACF,OAAO,OAAO,EAAE,QAAQ,OAAO,MAAM,MACnC;AAAA,MACE,MAAM,KAAK,aAAa;AAAA,QACtB;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,UAAU,OAAO,QAAQ;AAAA,QAC/B,MAAM,EAAE,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,IACF,SAAS,OAAO,EAAE,QAAQ,MAAM,MAAM;AACpC,YAAM,KAAK,aAAa,EAAE,QAAQ,QAAQ,UAAU,MAAM,UAAU,OAAO,EAAE,EAAE,CAAC;AAAA,IAClF;AAAA,IACA;AAAA,IACA,YAAY,CAAC,EAAE,QAAQ,SAAS,MAC9B,KAAK,kBAAkB;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,IACnD,CAAC;AAAA,IACH,iBAAiB,OAAO,EAAE,QAAQ,MAAM,OACrC,MAAM,KAAK,eAAe,EAAE,QAAQ,QAAQ,OAAO,MAAM,UAAU,OAAO,MAAM,EAAE,CAAC,GACjF;AAAA,IACL,MAAM,OAAO,EAAE,QAAQ,OAAO,QAAQ,QAAQ,UAAU,YAAY,OAAO,OAEvE,MAAM,KAAK,gBAAgB;AAAA,MACzB;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,UAAU,OAAO,QAAQ,mBAAmB,MAAM,CAAC,IAAI,MAAM,EAAE;AAAA,MACrE,MAAM,cAAc,OAAO,EAAE,SAAS,IAAI,EAAE,UAAU,WAAW;AAAA,MACjE;AAAA,IACF,CAAC,GACD,cAAc;AAAA,IAClB,QAAQ,CAAC,EAAE,QAAQ,UAAU,WAAW,SAAS,MAC/C,KAAK,cAAc;AAAA,MACjB;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,eAAe,mBAAmB,QAAQ,CAAC;AAAA,MACjD,MAAM,EAAE,WAAW,SAAS;AAAA,IAC9B,CAAC;AAAA,EACL;AACF;",
   "names": ["DEVICE_API_ACTING_USER_HEADER", "DeviceApiLeaseAccess", "DeviceApiCapability", "DeviceApiClientErrorCode"]
 }

package/dist/modules/sandboxes/egress-bootstrap.d.mts

@@ -0,0 +1,3 @@
+export declare const workspaceEgressBootstrap: string;
+export declare const cachedWorkspaceEgressBootstrap: (sha256: string) => string;
+export declare const workspaceEgressLauncher: string;