@geminixiang/mikan 1.0.0-beta.8 → 1.0.0-beta.80

package/dist/sandbox/provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAK1C,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAC1D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAC1C,EAAE,CAAC,WAAW,EAAE,CAAC;IACjB,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvC,CAAC;AACJ,CAAC;AAkBD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;QAChC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,sBAAsB;aAMT,kBAAa,GAAG,oBAAoB,AAAvB,CAAwB;aACrC,qBAAgB,GAAG,qBAAqB,AAAxB,CAAyB;aACzC,uBAAkB,GAAG,gBAAgB,AAAnB,CAAoB;aACtC,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;aACpD,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;aACpD,yBAAoB,GAAG,eAAe,AAAlB,CAAmB;aACvC,4BAAuB,GAAG,qBAAqB,AAAxB,CAAyB;IAQxE,YACmB,KAAa,EAC9B,OAAO,GAAkC,EAAE;QAD1B,UAAK,GAAL,KAAK,CAAQ;QApBxB,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC1C,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAE9C,qBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;QACpD,cAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;QAWvC,gBAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,mBAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QAOlE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,KAAa;QAClC,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,YAAoB;QACvC,OAAO,iBAAiB,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,YAAoB;QACrC,OAAO,qBAAqB,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,YAAoB;QACxC,OAAO,cAAc,YAAY,EAAE,CAAC;IACtC,CAAC;IAEO,SAAS,CAAI,YAAoB,EAAE,IAAsB;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,OAAO,GAAqB,EAAE;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAChD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAC3C,CAAC,OAAO,CAAC,GAAG,EAAE;YACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAAoB,EAAE,OAAyB;QAC1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACtF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,KAAK,GACT,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE;oBAC3D,KAAK;oBACL,MAAM;oBACN,UAAU;iBACX,CAAC,CAAC;YACT,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;gBACxB,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,oBAAoB,KAAK,wBAAwB,CAAC,CAAC;gBACzF,MAAM,IAAI,CAAC,0BAA0B,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACpF,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,wBAAwB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9E,CAAC;iBAAM,IAAI,KAAK,EAAE,CAAC;gBACjB,GAAG,CAAC,OAAO,CACT,aAAa,aAAa,2BAA2B,KAAK,yBAAyB,CACpF,CAAC;gBACF,MAAM,IAAI,CAAC,mCAAmC,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;gBACpF,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,YAAY,CAAC,CAAC;YACtD,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,MAAsB;QAC1D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,YAAoB;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,4BAA4B,aAAa,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,OAAO,GAA4B,EAAE;QAChE,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,YAAoB,EAAE,OAAgC;QAC9E,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,aAAa,aAAa,UAAU,EACpC,8BAA8B,aAAa,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,WAAW,WAAW,UAAU,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,4BAA4B,WAAW,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAEjE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,gCAAgC,CAAC,eAAoC;QACzE,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,EAAE,cAAc,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;gBAAE,OAAO;YACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,qBAAqB,aAAa,yBAAyB,EAC3D,8BAA8B,aAAa,yBAAyB,CACrE,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,OAAO,IAAI,YAAY;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACzE,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,UAAmC;QAC7D,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,OAAO,GAAG,IAAI;QAChD,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QACjC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iCAAiC,EAAE,CAAC;YACjE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,kDAAkD,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,KAAK,MAAM,aAAa,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,UAAU,CACZ,yCAAyC,aAAa,uBAAuB,EAC7E,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;IAC3C,CAAC;IAEO,sBAAsB,CAAC,aAAqB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACvF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,aAAqB,EACrB,UAAmC;QAEnC,MAAM,aAAa,GAAG,GAAG,sBAAsB,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QAExF,IAAI,aAAuB,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YAChE,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO;YAClC,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAC5E,OAAO;YACT,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,uBAAuB,aAAa,uBAAuB,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBAChC,QAAQ;gBACR,IAAI;gBACJ,SAAS,sBAAsB,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE;gBAC1G,aAAa;gBACb,aAAa;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,CAAC,2BAA2B,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,aAAqB,EACrB,SAAmB,EACnB,iBAA0B;QAE1B,MAAM,aAAa,GAAG,GAAG,sBAAsB,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACxF,MAAM,YAAY,GAChB,iBAAiB,IAAI,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC;QAC1F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAC9C,aAAa,EACb,sBAAsB,CAAC,yBAAyB,CACjD,CAAC;QACF,MAAM,MAAM,GAAG;YACb,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;SAC/D,CAAC;QACF,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,cAAc,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,IAAI,CAAC,cAAc,CACxE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAC/B,EAAE,CACJ,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,QAAQ;YACR,QAAQ;YACR,aAAa;YACb,WAAW;YACX,WAAW;YACX,YAAY;YACZ,KAAK;YACL,gBAAgB;YAChB,mBAAmB;YACnB,cAAc;YACd,MAAM;YACN,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC7D,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,aAAa;YACb,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,aAAqB,EACrB,SAA4B;QAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,SAAS;aACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;aAC3C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,wBAAwB,GAAG,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CACtE,CAAC;QACF,MAAM,MAAM,GAAG;YACb,MAAM,wBAAwB,wBAAwB;YACtD,gBAAgB;YAChB,2BAA2B;YAC3B,qDAAqD;YACrD,kCAAkC;YAClC,MAAM;SACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBAChC,MAAM;gBACN,IAAI;gBACJ,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAC7B,aAAa;gBACb,IAAI;gBACJ,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,wCAAwC,aAAa,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mCAAmC,CAC/C,YAAoB,EACpB,aAAqB,EACrB,MAAwB;QAExB,MAAM,aAAa,GAAG,GAAG,sBAAsB,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACxF,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,QAAQ;YACR,IAAI;YACJ,SAAS,sBAAsB,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE;YACtG,aAAa;YACb,aAAa;SACd,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,2BAA2B,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,aAAqB;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CACnC,aAAa,EACb,sBAAsB,CAAC,uBAAuB,CAC/C,CAAC;QACF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,kBAAkB,aAAa,kCAAkC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,GAAW;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,2BAA2B,GAAG,KAAK;gBACnC,KAAK;aACN,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,aAAqB;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBAChC,KAAK;gBACL,GAAG,sBAAsB,CAAC,oBAAoB,IAAI,aAAa,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,iCAAiC;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,QAAQ;gBACR,sBAAsB,CAAC,oBAAoB;gBAC3C,UAAU;gBACV,UAAU;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B;QACvC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBAC9C,QAAQ;gBACR,GAAG,sBAAsB,CAAC,oBAAoB,EAAE;gBAChD,UAAU;gBACV,0BAA0B;aAC3B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,KAAK,CAAC;gBAAE,SAAS;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,UAAU,CAAC,mCAAmC,KAAK,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,aAAqB,EAAE,KAAa;QACvE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,mBAAmB;YACnB,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YACnD,aAAa;YACb,OAAO,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC;SAC3D,CAAC,CAAC,CACJ,CAAC;QAEF,MAAM,cAAc,GAAoB,EAAE,CAAC;QAC3C,KAAK,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC5B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,GAAG,CAAC,UAAU,CAAC,0DAA0D,EAAE,aAAa,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YAED,IAAI,YAAY,KAAK,6BAA6B,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3E,cAAc,CAAC,IAAI,CACjB,IAAI,CAAC,oBAAoB,CACvB,aAAa,EACb,qBAAqB,aAAa,wCAAwC,EAC1E,2CAA2C,aAAa,EAAE,CAC3D,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CACxB,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAoB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QAC1C,GAAG,CAAC,OAAO,CACT,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,gCAAgC,OAAO,aAAa,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,YAAoB,EAAE,MAAuB,EAAE,aAAqB;QACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,gBAAgB,CAAC,YAAoB;QAC3C,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,aAAa;YAC3C,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CACnD,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,MAAwB;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,UAAU,CAAC,KAAqB;QACtC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,sBAAsB,aAAa,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG;YACb,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;SAC/D,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,OAAO,CAAC,cAAc,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,aAAa;YACb,WAAW;YACX,WAAW;YACX,YAAY;YACZ,KAAK;YACL,gBAAgB;YAChB,mBAAmB;YACnB,cAAc;YACd,MAAM;YACN,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC7D,IAAI;YACJ,GAAG,UAAU,IAAI,UAAU,EAAE;YAC7B,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,KAAK;YACV,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,YAAoB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,iBAAiB,CAAC,MAAkC;QAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,gDAAgD,aAAa,EAAE,EAC/D,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;YACF,qBAAqB,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,mBAAmB;gBAC5B,SAAS,EAAE,uBAAuB;gBAClC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO;oBACpB,YAAY;oBACZ,aAAa;oBACb,aAAa,EAAE,SAAS,CAAC,MAAM;oBAC/B,KAAK,EAAE,KAAK;iBACb;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAmF;QAEnF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC9C,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC;QAC1D,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC;YAAE,OAAO,eAAe,CAAC;QACrF,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QAClF,IAAI,UAAU,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB,CAAC,KAAwB,EAAE,MAAwB;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAEO,aAAa,CAAC,MAAwB;QAC5C,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;aACtC,KAAK,EAAE;aACP,QAAQ,EAAE,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,QAAkB,EAAE,MAAgB;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,aAAqB,EACrB,MAAwB;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,2BAA2B,sBAAsB,CAAC,yBAAyB,KAAK;YAChF,aAAa;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC7B,CAAC;IAEO,cAAc,CAAC,MAAwB;QAC7C,MAAM,OAAO,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC;SACvD,CAAC,CAAC;aACF,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxB,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,4BAA4B;YAC5B,aAAa;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;QAE5E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,aAAa,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,gBAAgB,CAAC,IAAY;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,KAAK,UAAU,CAAC;IAC/F,CAAC;IAEO,iBAAiB,CAAC,YAAoB,EAAE,KAAwB;QACtE,MAAM,QAAQ,GAAG,GAAG,sBAAsB,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,UAAU,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,aAAqB;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,YAAY;YACZ,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,OAAO;gBACP,SAAS;gBACT,IAAI;gBACJ,SAAS;gBACT,IAAI,CAAC,KAAK;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACjD,MAAM,UAAU,GAAG,sBAAsB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,QAAQ;YACR,QAAQ;YACR,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;YAC9D,UAAU;SACX,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACjD,MAAM,UAAU,GAAG,sBAAsB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,eAAe,UAAU,UAAU,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC;gBAAE,OAAO;YACvC,GAAG,CAAC,UAAU,CAAC,gCAAgC,UAAU,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,0BAA0B,CACtC,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,aAAa,aAAa,0BAA0B,EACpD,8BAA8B,aAAa,kBAAkB,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,kBAAkB,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,KAAK,MAAM,aAAa,IAAI,KAAK,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,UAAU,GAAG,YAAY;gBAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC;gBACvD,CAAC,CAAC,KAAK,CAAC;YACV,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa;gBACb,YAAY;gBACZ,OAAO,EAAE,MAAM,KAAK,SAAS;gBAC7B,UAAU;gBACV,UAAU,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,aAAqB;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,IAAY,EAAE,IAAY;QACjD,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,mBAAmB,CAAC,YAAoB;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,YAAoB;QAEpB,MAAM,aAAa,GAAG,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC;YAAE,OAAO,kBAAkB,CAAC;QAErF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;aAC9C,GAAG,CAAC,eAAe,CAAC,CAAC;QACxB,MAAM,aAAa,GAAG,GAAG,sBAAsB,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,uBAAuB,aAAa,mBAAmB,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,KAAK;YACL,MAAM;YACN,WAAW;YACX,MAAM;YACN,IAAI;YACJ,GAAG,UAAU,IAAI,UAAU,EAAE;YAC7B,aAAa;YACb,MAAM;SACP,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,aAAa,aAAa,oCAAoC,EAC9D,8BAA8B,aAAa,4BAA4B,CACxE,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,YAAY,CACrB,YAAY,EACZ,aAAa,EACb,MAAM,EACN,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,4BAA4B,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,6BAA6B;YAC7B,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,YAAoB;QAC9C,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACvE,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,SAAS;YACT,QAAQ;YACR,UAAU;YACV,QAAQ;YACR,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;YAC9D,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,oBAAoB;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,SAAS,sBAAsB,CAAC,aAAa,EAAE;gBAC/C,UAAU;gBACV,SAAS,sBAAsB,CAAC,gBAAgB,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,2CAA2C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,0BAA0B;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,QAAQ,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,0CAA0C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,aAAqB;QAErB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,qEAAqE,sBAAsB,CAAC,kBAAkB,gCAAgC,sBAAsB,CAAC,yBAAyB,KAAK;gBACnM,aAAa;aACd,CAAC,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,AAAD,EAAG,iBAAiB,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,+BAA+B,aAAa,mBAAmB,EAC/D,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAEO,6BAA6B,CAAC,aAAqB;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,aAAqB,EACrB,UAAkB,EAClB,UAAkB;QAElB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,aAAqB;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAC7B,aAAa,EACb,kCAAkC,aAAa,iCAAiC,EAChF,2CAA2C,aAAa,EAAE,CAC3D,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { legacyConversationResourceKey, sanitizeIdentitySegment } from \"./identity.js\";\nimport { GUEST_HOME, GUEST_PUBLIC_OFFICES_DIR } from \"./layout.js\";\nimport { createHash } from \"node:crypto\";\nimport { readFileSync, statSync } from \"node:fs\";\nimport { promisify } from \"node:util\";\nimport * as log from \"../log.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\n\nconst execFileAsync = promisify(execFile);\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\ntype DriftReason = \"binds\" | \"mount-content\" | \"network\" | \"image\";\n\nfunction isDockerNotFoundError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const stderr = (err as { stderr?: unknown }).stderr;\n  const message = (err as { message?: unknown }).message;\n  const haystack = `${typeof stderr === \"string\" ? stderr : \"\"}\\n${\n    typeof message === \"string\" ? message : \"\"\n  }`.toLowerCase();\n  return (\n    haystack.includes(\"no such network\") ||\n    haystack.includes(\"no such container\") ||\n    haystack.includes(\"no such object\") ||\n    haystack.includes(\"network not found\") ||\n    /network [^\\n]+ not found/.test(haystack) ||\n    /error: no such [^\\n]+/.test(haystack)\n  );\n}\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nimport type {\n  ContainerBindTranslator,\n  ContainerMount,\n  DockerContainerManagerOptions,\n  HomeVolumeMigrationOutcome,\n  ManagedContainerInventoryEntry,\n  ProvisionOptions,\n  ResourceLimits,\n  SandboxLimitStatus,\n} from \"../types.js\";\nimport { errorMessage } from \"../unknown-values.js\";\nimport type { DockerExecFile } from \"./types.js\";\n\nfunction bindSpecToMount(bindSpec: string): ContainerMount {\n  const readOnly = bindSpec.endsWith(\":ro\");\n  const spec = readOnly ? bindSpec.slice(0, -3) : bindSpec;\n  const separator = spec.indexOf(\":\");\n  return {\n    source: spec.slice(0, separator),\n    target: spec.slice(separator + 1),\n    readOnly: readOnly ? true : undefined,\n  };\n}\n\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  private inflight = new Map<string, Promise<string>>();\n  private bindTranslator?: ContainerBindTranslator;\n  private layoutMigrations = new Map<string, Promise<void>>();\n  private keyQueues = new Map<string, Promise<unknown>>();\n  private static readonly MANAGED_LABEL = \"mikan.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mikan.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mikan.vault-id\";\n  private static readonly CONVERSATION_ID_LABEL_KEY = \"mikan.conversation-id\";\n  private static readonly MOUNT_SIGNATURE_LABEL_KEY = \"mikan.mount-signature\";\n  private static readonly MIGRATE_IMAGE_PREFIX = \"mikan-migrate\";\n  private static readonly MIGRATE_BINDS_LABEL_KEY = \"mikan.migrate-binds\";\n\n  private readonly limits?: ResourceLimits;\n  private readonly boostLimits?: ResourceLimits;\n  private readonly boostedKeys = new Set<string>();\n  private readonly overrideLimits = new Map<string, ResourceLimits>();\n  private readonly execFileImpl: DockerExecFile;\n\n  constructor(\n    private readonly image: string,\n    options: DockerContainerManagerOptions = {},\n  ) {\n    this.limits = options.limits;\n    this.boostLimits = options.boostLimits;\n    this.execFileImpl = options.execFileImpl ?? execFileAsync;\n  }\n\n  static sanitizeSegment(value: string): string {\n    return sanitizeIdentitySegment(value);\n  }\n\n  static containerName(containerKey: string): string {\n    return `mikan-sandbox-${containerKey}`;\n  }\n\n  static networkName(containerKey: string): string {\n    return `mikan-sandbox-net-${containerKey}`;\n  }\n\n  static homeVolumeName(containerKey: string): string {\n    return `mikan-home-${containerKey}`;\n  }\n\n  private serialize<T>(containerKey: string, task: () => Promise<T>): Promise<T> {\n    const previous = this.keyQueues.get(containerKey) ?? Promise.resolve();\n    const next = previous.then(task, task);\n    const settled = next.catch(() => undefined);\n    this.keyQueues.set(containerKey, settled);\n    void settled.then(() => {\n      if (this.keyQueues.get(containerKey) === settled) this.keyQueues.delete(containerKey);\n    });\n    return next;\n  }\n\n  async provision(containerKey: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(containerKey);\n    if (existing) return existing;\n\n    const pending = this.serialize(containerKey, () =>\n      this.provisionInner(containerKey, options),\n    ).finally(() => {\n      this.inflight.delete(containerKey);\n    });\n    this.inflight.set(containerKey, pending);\n    return pending;\n  }\n\n  private async provisionInner(containerKey: string, options: ProvisionOptions): Promise<string> {\n    const containerName =\n      options.containerName ?? DockerContainerManager.containerName(containerKey);\n    const mounts = options.mounts ?? [];\n    await this.migrateContainerLayout(containerName);\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      const binds = status === \"missing\" ? [] : await this.inspectBindMounts(containerName);\n      const homeVolume = this.hasHomeVolumeBind(containerKey, binds);\n      const drift =\n        status === \"missing\"\n          ? undefined\n          : await this.runtimeDrift(containerKey, containerName, mounts, {\n              binds,\n              status,\n              homeVolume,\n            });\n      if (drift && homeVolume) {\n        log.logInfo(`Container ${containerName} is out of date (${drift}); replacing container`);\n        await this.replaceHomeVolumeContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} replaced from image ${this.image}`);\n      } else if (drift) {\n        log.logInfo(\n          `Container ${containerName} configuration changed (${drift}); recreating container`,\n        );\n        await this.recreateContainerPreservingContents(containerKey, containerName, mounts);\n        log.logInfo(`Container ${containerName} recreated`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else if (status === \"missing\") {\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      this.state.delete(containerKey);\n      throw err;\n    }\n\n    this.setState(containerKey, \"running\", containerName);\n    await this.applyResourceLimits(containerKey, containerName);\n    return containerName;\n  }\n\n  async boost(containerKey: string): Promise<SandboxLimitStatus> {\n    if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {\n      return this.getLimitStatus(containerKey);\n    }\n\n    this.overrideLimits.delete(containerKey);\n    this.boostedKeys.add(containerKey);\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  async setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus> {\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.set(containerKey, { ...this.limits, ...limits });\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  getLimitStatus(containerKey: string): SandboxLimitStatus {\n    const boosted = this.boostedKeys.has(containerKey);\n    return { limits: this.effectiveLimits(containerKey), boosted };\n  }\n\n  getDefaultLimits(): ResourceLimits | undefined {\n    return this.limits;\n  }\n\n  getBoostLimits(): ResourceLimits | undefined {\n    return this.boostLimits;\n  }\n\n  stop(containerKey: string): Promise<void> {\n    return this.serialize(containerKey, () => this.stopInner(containerKey));\n  }\n\n  private async stopInner(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(containerKey, \"stopped\", containerName);\n      this.boostedKeys.delete(containerKey);\n      this.overrideLimits.delete(containerKey);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(`Failed to stop container ${containerName}`, errorMessage(err));\n    }\n  }\n\n  remove(containerKey: string, options: { purgeHome?: boolean } = {}): Promise<void> {\n    return this.serialize(containerKey, () => this.removeInner(containerKey, options));\n  }\n\n  private async removeInner(containerKey: string, options: { purgeHome?: boolean }): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    const networkName = DockerContainerManager.networkName(containerKey);\n\n    const removed = await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed`,\n      `Failed to remove container ${containerName}`,\n    );\n    if (!removed) {\n      throw new Error(`Failed to remove container ${containerName}`);\n    }\n\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"rm\", networkName]);\n      log.logInfo(`Network ${networkName} removed`);\n    } catch (err) {\n      log.logWarning(`Failed to remove network ${networkName}`, errorMessage(err));\n    }\n\n    await this.removeMigrateSnapshot(containerName);\n    if (options.purgeHome) await this.removeHomeVolume(containerKey);\n\n    this.state.delete(containerKey);\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.delete(containerKey);\n  }\n\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [containerKey, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(containerKey);\n      }\n    }\n    await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));\n  }\n\n  async removeContainersForConversations(conversationIds: ReadonlySet<string>): Promise<void> {\n    if (conversationIds.size === 0) return;\n    const names = await this.listContainerNamesByLabel();\n    await Promise.all(\n      names.map(async (containerName) => {\n        const details = await this.inspectContainerDetails(containerName);\n        if (!details?.conversationId || !conversationIds.has(details.conversationId)) return;\n        const removed = await this.forceRemoveContainer(\n          containerName,\n          `Removed container ${containerName} after office migration`,\n          `Failed to remove container ${containerName} after office migration`,\n        );\n        const containerKey = this.containerKeyFromContainerName(containerName);\n        if (removed && containerKey) await this.removeHomeVolume(containerKey);\n      }),\n    );\n  }\n\n  armContainerLayoutMigration(translator: ContainerBindTranslator): void {\n    this.bindTranslator = translator;\n  }\n\n  async sweepContainerLayoutMigration(delayMs = 2000): Promise<void> {\n    if (!this.bindTranslator) return;\n    let names: string[];\n    try {\n      const containers = await this.listContainerNamesByLabel();\n      const snapshots = await this.listMigrateSnapshotContainerNames();\n      names = Array.from(new Set([...containers, ...snapshots]));\n    } catch (err) {\n      log.logWarning(\"Container layout sweep could not list containers\", String(err));\n      return;\n    }\n    for (const containerName of names) {\n      try {\n        await this.migrateContainerLayout(containerName);\n      } catch (err) {\n        log.logWarning(\n          `Container layout migration failed for ${containerName}; leaving it in place`,\n          errorMessage(err),\n        );\n      }\n      await new Promise((resolve) => setTimeout(resolve, delayMs));\n    }\n    await this.removeDanglingMigrateImages();\n  }\n\n  private migrateContainerLayout(containerName: string): Promise<void> {\n    const translator = this.bindTranslator;\n    if (!translator) return Promise.resolve();\n    const existing = this.layoutMigrations.get(containerName);\n    if (existing) return existing;\n    const pending = this.migrateContainerLayoutInner(containerName, translator).finally(() => {\n      this.layoutMigrations.delete(containerName);\n    });\n    this.layoutMigrations.set(containerName, pending);\n    return pending;\n  }\n\n  private async migrateContainerLayoutInner(\n    containerName: string,\n    translator: ContainerBindTranslator,\n  ): Promise<void> {\n    const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;\n\n    let originalBinds: string[];\n    const status = await this.inspectStatus(containerName);\n    if (status === \"missing\") {\n      const labeled = await this.readMigrateImageBinds(snapshotImage);\n      if (labeled === undefined) return;\n      originalBinds = labeled;\n    } else {\n      originalBinds = await this.inspectBindMounts(containerName);\n      const translated = originalBinds.map(translator);\n      if (this.sameBinds(translated.toSorted(), originalBinds.slice().toSorted())) {\n        return;\n      }\n      log.logInfo(`Migrating container ${containerName} to the office layout`);\n      await this.execFileImpl(\"docker\", [\n        \"commit\",\n        \"-c\",\n        `LABEL ${DockerContainerManager.MIGRATE_BINDS_LABEL_KEY}=${JSON.stringify(JSON.stringify(originalBinds))}`,\n        containerName,\n        snapshotImage,\n      ]);\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n    }\n\n    await this.createContainerFromSnapshot(containerName, originalBinds.map(translator));\n    await this.removeMigrateSnapshot(containerName);\n    log.logInfo(`Container ${containerName} migrated to the office layout`);\n  }\n\n  private async createContainerFromSnapshot(\n    containerName: string,\n    bindSpecs: string[],\n    knownContainerKey?: string,\n  ): Promise<void> {\n    const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;\n    const containerKey =\n      knownContainerKey ?? this.containerKeyFromContainerName(containerName) ?? containerName;\n    const networkName = await this.ensureNetwork(containerKey);\n    const conversationId = await this.readImageLabel(\n      snapshotImage,\n      DockerContainerManager.CONVERSATION_ID_LABEL_KEY,\n    );\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${conversationId}`,\n      );\n    }\n    labels.push(\n      \"--label\",\n      `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(\n        bindSpecs.map(bindSpecToMount),\n      )}`,\n    );\n    await this.execFileImpl(\"docker\", [\n      \"create\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      \"--cap-drop\",\n      \"ALL\",\n      \"--security-opt\",\n      \"no-new-privileges\",\n      \"--pids-limit\",\n      \"1024\",\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      ...bindSpecs.flatMap((bind) => [\"-v\", bind]),\n      snapshotImage,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private async removeStaleMountpoints(\n    containerName: string,\n    bindSpecs: readonly string[],\n  ): Promise<void> {\n    const keep = new Set(\n      bindSpecs\n        .map((bind) => bindSpecToMount(bind).target)\n        .filter((target) => target.startsWith(`${GUEST_PUBLIC_OFFICES_DIR}/`))\n        .map((target) => target.slice(GUEST_PUBLIC_OFFICES_DIR.length + 1)),\n    );\n    const script = [\n      `cd ${GUEST_PUBLIC_OFFICES_DIR} 2>/dev/null || exit 0`,\n      \"for d in *; do\",\n      '  [ -e \"$d\" ] || continue',\n      '  case \" $KEEP \" in *\" ${d##*/} \"*) continue;; esac',\n      '  rmdir \"$d\" 2>/dev/null || true',\n      \"done\",\n    ].join(\"\\n\");\n    try {\n      await this.execFileImpl(\"docker\", [\n        \"exec\",\n        \"-e\",\n        `KEEP=${[...keep].join(\" \")}`,\n        containerName,\n        \"sh\",\n        \"-c\",\n        script,\n      ]);\n    } catch (err) {\n      log.logWarning(`Could not clean stale mountpoints in ${containerName}`, String(err));\n    }\n  }\n\n  private async recreateContainerPreservingContents(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<void> {\n    const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;\n    const bindSpecs = mounts.map((mount) => this.toBindSpec(mount));\n    await this.execFileImpl(\"docker\", [\n      \"commit\",\n      \"-c\",\n      `LABEL ${DockerContainerManager.MIGRATE_BINDS_LABEL_KEY}=${JSON.stringify(JSON.stringify(bindSpecs))}`,\n      containerName,\n      snapshotImage,\n    ]);\n    await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n    await this.createContainerFromSnapshot(containerName, bindSpecs, containerKey);\n    await this.execFileImpl(\"docker\", [\"start\", containerName]);\n    await this.removeStaleMountpoints(containerName, bindSpecs);\n    await this.removeMigrateSnapshot(containerName);\n  }\n\n  private async readMigrateImageBinds(snapshotImage: string): Promise<string[] | undefined> {\n    const raw = await this.readImageLabel(\n      snapshotImage,\n      DockerContainerManager.MIGRATE_BINDS_LABEL_KEY,\n    );\n    if (raw === undefined) return undefined;\n    const parsed = JSON.parse(raw) as unknown;\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Snapshot image ${snapshotImage} carries malformed migrate binds`);\n    }\n    return parsed;\n  }\n\n  private async readImageLabel(image: string, key: string): Promise<string | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{index .Config.Labels \"${key}\"}}`,\n        image,\n      ]);\n      return this.normalizeDockerValue(stdout.trim());\n    } catch {\n      return undefined;\n    }\n  }\n\n  private async removeMigrateSnapshot(containerName: string): Promise<void> {\n    try {\n      await this.execFileImpl(\"docker\", [\n        \"rmi\",\n        `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`,\n      ]);\n    } catch {}\n  }\n\n  private async listMigrateSnapshotContainerNames(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"images\",\n        DockerContainerManager.MIGRATE_IMAGE_PREFIX,\n        \"--format\",\n        \"{{.Tag}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch {\n      return [];\n    }\n  }\n\n  private async removeDanglingMigrateImages(): Promise<void> {\n    let stdout: string;\n    try {\n      ({ stdout } = await this.execFileImpl(\"docker\", [\n        \"images\",\n        `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}`,\n        \"--format\",\n        \"{{.Repository}}:{{.Tag}}\",\n      ]));\n    } catch {\n      return;\n    }\n    for (const image of this.parseNameLines(stdout)) {\n      const containerName = image.slice(DockerContainerManager.MIGRATE_IMAGE_PREFIX.length + 1);\n      const status = await this.inspectStatus(containerName);\n      if (status === \"missing\") continue;\n      if (await this.containerRunsFromImage(containerName, image)) continue;\n      try {\n        await this.execFileImpl(\"docker\", [\"rmi\", image]);\n        log.logInfo(`Removed layout-migration snapshot image ${image}`);\n      } catch (err) {\n        log.logWarning(`Could not remove snapshot image ${image}`, String(err));\n      }\n    }\n  }\n\n  private async containerRunsFromImage(containerName: string, image: string): Promise<boolean> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.Config.Image}}\",\n      containerName,\n    ]);\n    return stdout.trim() === image;\n  }\n\n  async reconcile(): Promise<void> {\n    const discovered = new Set<string>();\n    const labeledNames = await this.listContainerNamesByLabel();\n    for (const name of labeledNames) discovered.add(name);\n    const legacyNames = await this.listContainerNamesByPrefix();\n    for (const name of legacyNames) discovered.add(name);\n\n    this.state.clear();\n\n    const inspected = await Promise.all(\n      Array.from(discovered).map(async (containerName) => ({\n        containerName,\n        details: await this.inspectContainerDetails(containerName),\n      })),\n    );\n\n    const legacyRemovals: Promise<void>[] = [];\n    for (const { containerName, details } of inspected) {\n      if (!details) continue;\n\n      if (!details.conversationId) {\n        legacyRemovals.push(this.removeLegacyContainer(containerName));\n        continue;\n      }\n\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      if (!containerKey) {\n        log.logWarning(`Skipping unmanaged-style container without container key`, containerName);\n        continue;\n      }\n\n      if (containerKey === legacyConversationResourceKey(details.conversationId)) {\n        legacyRemovals.push(\n          this.forceRemoveContainer(\n            containerName,\n            `Removed container ${containerName} keyed by pre-office resource identity`,\n            `Failed to remove legacy-keyed container ${containerName}`,\n          ).then(() => undefined),\n        );\n        continue;\n      }\n\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(containerKey, { status, lastUsed, containerName });\n    }\n    await Promise.all(legacyRemovals);\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(containerKey: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(containerKey: string): string {\n    return (\n      this.state.get(containerKey)?.containerName ??\n      DockerContainerManager.containerName(containerKey)\n    );\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}${mount.readOnly ? \":ro\" : \"\"}`;\n  }\n\n  private async runContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const networkName = await this.ensureNetwork(containerKey);\n    const homeVolume = await this.ensureHomeVolume(containerKey);\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (options.conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`,\n      );\n    }\n    if (mounts.length > 0) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`,\n      );\n    }\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      \"--cap-drop\",\n      \"ALL\",\n      \"--security-opt\",\n      \"no-new-privileges\",\n      \"--pids-limit\",\n      \"1024\",\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      \"-v\",\n      `${homeVolume}:${GUEST_HOME}`,\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private effectiveLimits(containerKey: string): ResourceLimits | undefined {\n    const override = this.overrideLimits.get(containerKey);\n    if (override) return override;\n    if (!this.boostedKeys.has(containerKey)) return this.limits;\n    return { ...this.limits, ...this.boostLimits };\n  }\n\n  private resourceLimitArgs(limits: ResourceLimits | undefined): string[] {\n    const args: string[] = [];\n    if (limits?.cpus) args.push(\"--cpus\", limits.cpus);\n    if (limits?.memory) {\n      args.push(\"--memory\", limits.memory);\n      args.push(\"--memory-swap\", limits.memory);\n    }\n    return args;\n  }\n\n  private async applyResourceLimits(containerKey: string, containerName: string): Promise<void> {\n    const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));\n    if (limitArgs.length === 0) return;\n    const args = [\"update\", ...limitArgs, containerName];\n    try {\n      await this.execFileImpl(\"docker\", args);\n    } catch (err) {\n      log.logWarning(\n        `Failed to apply resource limits to container ${containerName}`,\n        errorMessage(err),\n      );\n      reportUserFacingError(err, {\n        domain: \"sandbox\",\n        surface: \"sandbox_provision\",\n        operation: \"apply_resource_limits\",\n        severity: \"warning\",\n        context: {\n          sandboxType: \"image\",\n          containerKey,\n          containerName,\n          limitArgCount: limitArgs.length,\n          fatal: false,\n        },\n      });\n    }\n  }\n\n  private async runtimeDrift(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    current: { binds: readonly string[]; status: ContainerStatus; homeVolume: boolean },\n  ): Promise<DriftReason | undefined> {\n    const { binds, status, homeVolume } = current;\n    if (this.hasBindMountDrift(binds, mounts)) return \"binds\";\n    if (await this.hasMountSignatureDrift(containerName, mounts)) return \"mount-content\";\n    if (await this.hasNetworkModeDrift(containerKey, containerName)) return \"network\";\n    if (homeVolume && status === \"stopped\" && (await this.hasImageDrift(containerName))) {\n      return \"image\";\n    }\n    return undefined;\n  }\n\n  private hasBindMountDrift(binds: readonly string[], mounts: ContainerMount[]): boolean {\n    const expected = this.expectedBinds(mounts);\n    const actual = binds.filter((bind) => !this.isHomeVolumeBind(bind));\n    return !this.sameBinds(expected, actual);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return mounts\n      .map((mount) => this.toBindSpec(mount))\n      .slice()\n      .toSorted();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async hasMountSignatureDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (mounts.length === 0) return false;\n    const expected = this.mountSignature(mounts);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      `{{index .Config.Labels \"${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}\"}}`,\n      containerName,\n    ]);\n    const actual = this.normalizeDockerValue(stdout.trim());\n    return actual !== expected;\n  }\n\n  private mountSignature(mounts: ContainerMount[]): string {\n    const payload = mounts\n      .map((mount) => ({\n        source: mount.source,\n        target: mount.target,\n        fingerprint: this.mountSourceFingerprint(mount.source),\n      }))\n      .toSorted((left, right) =>\n        `${left.target}\\0${left.source}`.localeCompare(`${right.target}\\0${right.source}`),\n      );\n    return createHash(\"sha256\").update(JSON.stringify(payload)).digest(\"hex\");\n  }\n\n  private mountSourceFingerprint(source: string): string {\n    try {\n      const stat = statSync(source);\n      if (stat.isFile()) {\n        return createHash(\"sha256\").update(readFileSync(source)).digest(\"hex\");\n      }\n      return `${stat.isDirectory() ? \"dir\" : \"other\"}:${stat.dev}:${stat.ino}:${stat.birthtimeMs}`;\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].toSorted();\n  }\n\n  private isHomeVolumeBind(bind: string): boolean {\n    const separator = bind.indexOf(\":\");\n    if (separator === -1) return false;\n    const source = bind.slice(0, separator);\n    const target = bind.slice(separator + 1).replace(/:r[ow]$/, \"\");\n    return source.startsWith(DockerContainerManager.homeVolumeName(\"\")) && target === GUEST_HOME;\n  }\n\n  private hasHomeVolumeBind(containerKey: string, binds: readonly string[]): boolean {\n    const expected = `${DockerContainerManager.homeVolumeName(containerKey)}:${GUEST_HOME}`;\n    return binds.includes(expected);\n  }\n\n  private async hasHomeVolume(containerKey: string, containerName: string): Promise<boolean> {\n    return this.hasHomeVolumeBind(containerKey, await this.inspectBindMounts(containerName));\n  }\n\n  private async hasImageDrift(containerName: string): Promise<boolean> {\n    const desired = await this.localImageId();\n    if (!desired) return false;\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.Image}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== desired;\n  }\n\n  private async localImageId(): Promise<string | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"image\",\n        \"inspect\",\n        \"-f\",\n        \"{{.Id}}\",\n        this.image,\n      ]);\n      return this.normalizeDockerValue(stdout.trim());\n    } catch {\n      return undefined;\n    }\n  }\n\n  private async ensureHomeVolume(containerKey: string): Promise<string> {\n    const volumeName = DockerContainerManager.homeVolumeName(containerKey);\n    await this.execFileImpl(\"docker\", [\n      \"volume\",\n      \"create\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      volumeName,\n    ]);\n    return volumeName;\n  }\n\n  private async removeHomeVolume(containerKey: string): Promise<void> {\n    const volumeName = DockerContainerManager.homeVolumeName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"volume\", \"rm\", volumeName]);\n      log.logInfo(`Home volume ${volumeName} removed`);\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return;\n      log.logWarning(`Failed to remove home volume ${volumeName}`, errorMessage(err));\n    }\n  }\n\n  private async replaceHomeVolumeContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const removed = await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed for replacement`,\n      `Failed to remove container ${containerName} for replacement`,\n    );\n    if (!removed) throw new Error(`Failed to remove container ${containerName} for replacement`);\n    await this.runContainer(containerKey, containerName, mounts, options);\n  }\n\n  async inventory(): Promise<ManagedContainerInventoryEntry[]> {\n    const names = await this.listContainerNamesByLabel();\n    const entries: ManagedContainerInventoryEntry[] = [];\n    for (const containerName of names) {\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      const status = await this.inspectStatus(containerName);\n      if (status === \"missing\") continue;\n      const homeVolume = containerKey\n        ? await this.hasHomeVolume(containerKey, containerName)\n        : false;\n      entries.push({\n        containerName,\n        containerKey,\n        running: status === \"running\",\n        homeVolume,\n        imageStale: await this.hasImageDrift(containerName),\n      });\n    }\n    return entries;\n  }\n\n  async systemChanges(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\"diff\", containerName]);\n    return this.parseNameLines(stdout).filter((line) => {\n      const path = line.slice(2);\n      return !this.isUnderGuestPath(path, GUEST_HOME) && !this.isUnderGuestPath(path, \"/workspace\");\n    });\n  }\n\n  private isUnderGuestPath(path: string, root: string): boolean {\n    return path === root || path.startsWith(`${root}/`);\n  }\n\n  migrateToHomeVolume(containerKey: string): Promise<HomeVolumeMigrationOutcome> {\n    return this.serialize(containerKey, () => this.migrateToHomeVolumeInner(containerKey));\n  }\n\n  private async migrateToHomeVolumeInner(\n    containerKey: string,\n  ): Promise<HomeVolumeMigrationOutcome> {\n    const containerName = DockerContainerManager.containerName(containerKey);\n    const status = await this.inspectStatus(containerName);\n    if (status === \"missing\") return \"missing\";\n    if (await this.hasHomeVolume(containerKey, containerName)) return \"already-migrated\";\n\n    const details = await this.inspectContainerDetails(containerName);\n    const mounts = (await this.inspectBindMounts(containerName))\n      .filter((bind) => !this.isHomeVolumeBind(bind))\n      .map(bindSpecToMount);\n    const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;\n    log.logInfo(`Migrating container ${containerName} to a home volume`);\n    await this.execFileImpl(\"docker\", [\"commit\", containerName, snapshotImage]);\n    const homeVolume = await this.ensureHomeVolume(containerKey);\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"--rm\",\n      \"--network\",\n      \"none\",\n      \"-v\",\n      `${homeVolume}:${GUEST_HOME}`,\n      snapshotImage,\n      \"true\",\n    ]);\n    const removed = await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed for home-volume migration`,\n      `Failed to remove container ${containerName} for home-volume migration`,\n    );\n    if (!removed) throw new Error(`Failed to remove container ${containerName}`);\n    await this.runContainer(\n      containerKey,\n      containerName,\n      mounts,\n      details?.conversationId ? { conversationId: details.conversationId } : {},\n    );\n    if (status === \"stopped\") await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n    await this.removeMigrateSnapshot(containerName);\n    this.setState(containerKey, status === \"stopped\" ? \"stopped\" : \"running\", containerName);\n    log.logInfo(`Container ${containerName} migrated to home volume ${homeVolume}`);\n    return \"migrated\";\n  }\n\n  private async hasNetworkModeDrift(containerKey: string, containerName: string): Promise<boolean> {\n    const expected = DockerContainerManager.networkName(containerKey);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.HostConfig.NetworkMode}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== expected;\n  }\n\n  private async ensureNetwork(containerKey: string): Promise<string> {\n    const networkName = DockerContainerManager.networkName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"inspect\", networkName]);\n      return networkName;\n    } catch (err) {\n      if (!isDockerNotFoundError(err)) throw err;\n    }\n    await this.execFileImpl(\"docker\", [\n      \"network\",\n      \"create\",\n      \"--driver\",\n      \"bridge\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      networkName,\n    ]);\n    return networkName;\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return \"missing\";\n      throw err;\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\"Failed to list labeled managed containers\", errorMessage(err));\n      return [];\n    }\n  }\n\n  private async listContainerNamesByPrefix(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `name=${DockerContainerManager.containerName(\"\")}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\"Failed to list legacy managed containers\", errorMessage(err));\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<{ running: boolean; startedAtMs?: number; conversationId?: string } | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{index .Config.Labels \"${DockerContainerManager.VAULT_ID_LABEL_KEY}\"}}\\t{{index .Config.Labels \"${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}\"}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, , conversationIdRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      const conversationId = this.normalizeDockerValue(conversationIdRaw);\n      return { running, startedAtMs, conversationId };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        errorMessage(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private containerKeyFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const containerKey = containerName.slice(prefix.length);\n    return containerKey.length > 0 ? containerKey : undefined;\n  }\n\n  private async forceRemoveContainer(\n    containerName: string,\n    successLog: string,\n    failureLog: string,\n  ): Promise<boolean> {\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      log.logInfo(successLog);\n      return true;\n    } catch (err) {\n      const message = errorMessage(err);\n      if (/no such container/i.test(message)) return true;\n      log.logWarning(failureLog, message);\n      return false;\n    }\n  }\n\n  private async removeLegacyContainer(containerName: string): Promise<void> {\n    await this.forceRemoveContainer(\n      containerName,\n      `Removed legacy mikan container ${containerName} (pre-channel-isolation scheme)`,\n      `Failed to remove legacy mikan container ${containerName}`,\n    );\n  }\n}\n"]}

package/dist/sandbox/registry.d.ts

@@ -0,0 +1,12 @@
+import type { Executor, ImageSandboxConfig, RuntimePathContext, SandboxAdapter, SandboxConfig } from "./types.js";
+declare const sandboxAdapters: readonly [SandboxAdapter<import("./types.js").HostSandboxConfig>, SandboxAdapter<import("./types.js").ContainerSandboxConfig>, SandboxAdapter<ImageSandboxConfig>, SandboxAdapter<import("./types.js").CloudflareSandboxConfig>];
+export declare function getSandboxAdapters(): readonly [...typeof sandboxAdapters];
+export declare function getSandboxCredentialCapabilities(type: SandboxConfig["type"]): SandboxAdapter["credentials"];
+export declare function getSandboxWorkspaceCapabilities(type: SandboxConfig["type"]): SandboxAdapter["workspace"];
+export declare function assertSandboxSupportsWorkspacePolicy(sandboxConfig: SandboxConfig, visibility: "public" | "private", officeKey: string): void;
+export declare function parseSandboxArg(value: string): SandboxConfig;
+export declare function validateSandbox(config: SandboxConfig): Promise<void>;
+export declare function createExecutor(config: SandboxConfig, env?: Record<string, string>, ensureReady?: () => Promise<void>): Executor;
+export declare function getUnresolvedSandboxPathContext(sandboxConfig: SandboxConfig, hostWorkspaceRoot: string): RuntimePathContext;
+export {};
+//# sourceMappingURL=registry.d.ts.map

package/dist/sandbox/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sandbox/registry.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AA+BpB,QAAA,MAAM,eAAe,kOAKX,CAAC;AAKX,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,GAAG,OAAO,eAAe,CAAC,CAEzE;AAQD,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,cAAc,CAAC,aAAa,CAAC,CAE/B;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,cAAc,CAAC,WAAW,CAAC,CAE7B;AAID,wBAAgB,oCAAoC,CAClD,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,QAAQ,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAChB,IAAI,CASN;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAiB5D;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAMV;AAED,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CAMpB"}

package/dist/sandbox/registry.js

@@ -0,0 +1,93 @@
+import { containerSandboxAdapter } from "./container.js";
+import { cloudflareSandboxAdapter } from "./cloudflare.js";
+import { hostSandboxAdapter } from "./host.js";
+import { createMountedRuntimePathContext, execSimple, SandboxError } from "./utils.js";
+import { GUEST_WORKSPACE_ROOT } from "./layout.js";
+import * as log from "../log.js";
+function parseImageSandboxArg(value) {
+    if (!value.startsWith("image:")) {
+        return undefined;
+    }
+    const image = value.slice("image:".length);
+    if (!image) {
+        throw new SandboxError("Error: image sandbox requires image name (e.g., image:ubuntu:24.04)");
+    }
+    return { type: "image", image };
+}
+async function validateImageSandbox(config) {
+    try {
+        await execSimple("docker", ["--version"]);
+    }
+    catch {
+        throw new SandboxError("Error: Docker is not installed or not in PATH");
+    }
+    console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);
+}
+const imageSandboxAdapter = {
+    type: "image",
+    credentials: { env: true, fileMounts: true },
+    workspace: { managedProjection: true },
+    parse: parseImageSandboxArg,
+    validate: validateImageSandbox,
+};
+const sandboxAdapters = [
+    hostSandboxAdapter,
+    containerSandboxAdapter,
+    imageSandboxAdapter,
+    cloudflareSandboxAdapter,
+];
+const sandboxAdapterByType = new Map(sandboxAdapters.map((adapter) => [adapter.type, adapter]));
+export function getSandboxAdapters() {
+    return sandboxAdapters;
+}
+function requireSandboxAdapter(type) {
+    const adapter = sandboxAdapterByType.get(type);
+    if (!adapter)
+        throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);
+    return adapter;
+}
+export function getSandboxCredentialCapabilities(type) {
+    return requireSandboxAdapter(type).credentials;
+}
+export function getSandboxWorkspaceCapabilities(type) {
+    return requireSandboxAdapter(type).workspace;
+}
+const warnedUnenforcedPrivacy = new Set();
+export function assertSandboxSupportsWorkspacePolicy(sandboxConfig, visibility, officeKey) {
+    const capabilities = getSandboxWorkspaceCapabilities(sandboxConfig.type);
+    if (capabilities.managedProjection || visibility === "public")
+        return;
+    if (warnedUnenforcedPrivacy.has(officeKey))
+        return;
+    warnedUnenforcedPrivacy.add(officeKey);
+    log.logWarning(`Sandbox '${sandboxConfig.type}' cannot enforce private office visibility for ${officeKey}`, "host, container, and cloudflare backends share one filesystem; use image:* to isolate private channels and DMs");
+}
+export function parseSandboxArg(value) {
+    for (const adapter of sandboxAdapters) {
+        const config = adapter.parse(value);
+        if (config) {
+            return config;
+        }
+    }
+    if (value.startsWith("docker:")) {
+        throw new SandboxError(`Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`);
+    }
+    throw new SandboxError(`Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', or 'cloudflare:<sandbox-id>'`);
+}
+export async function validateSandbox(config) {
+    await requireSandboxAdapter(config.type).validate?.(config);
+}
+export function createExecutor(config, env, ensureReady) {
+    const adapter = requireSandboxAdapter(config.type);
+    if (!adapter.createExecutor) {
+        throw new SandboxError("Error: image sandbox must resolve to a concrete container executor");
+    }
+    return adapter.createExecutor(config, env, ensureReady);
+}
+export function getUnresolvedSandboxPathContext(sandboxConfig, hostWorkspaceRoot) {
+    if (sandboxConfig.type === "image") {
+        return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);
+    }
+    return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);
+}
+//# sourceMappingURL=registry.js.map

package/dist/sandbox/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sandbox/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,+BAA+B,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AASjC,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,qEAAqE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC5D,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,mBAAmB,GAAuC;IAC9D,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5C,SAAS,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;IACtC,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,oBAAoB;CAC/B,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,wBAAwB;CAChB,CAAC;AACX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACZ,CAAC;AAEhD,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAA2B;IACxD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,oCAAoC,IAAI,GAAG,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,IAA2B;IAE3B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAA2B;IAE3B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD,MAAM,UAAU,oCAAoC,CAClD,aAA4B,EAC5B,UAAgC,EAChC,SAAiB;IAEjB,MAAM,YAAY,GAAG,+BAA+B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,iBAAiB,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IACtE,IAAI,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IACnD,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,GAAG,CAAC,UAAU,CACZ,YAAY,aAAa,CAAC,IAAI,kDAAkD,SAAS,EAAE,EAC3F,gHAAgH,CACjH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,WAAW,KAAK,mJAAmJ,CACpK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,gCAAgC,KAAK,iGAAiG,CACvI,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAqB;IACzD,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,GAA4B,EAC5B,WAAiC;IAEjC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,aAA4B,EAC5B,iBAAyB;IAEzB,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,cAAc,CAAC,aAAa,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { containerSandboxAdapter } from \"./container.js\";\nimport { cloudflareSandboxAdapter } from \"./cloudflare.js\";\nimport { hostSandboxAdapter } from \"./host.js\";\nimport { createMountedRuntimePathContext, execSimple, SandboxError } from \"./utils.js\";\nimport { GUEST_WORKSPACE_ROOT } from \"./layout.js\";\nimport * as log from \"../log.js\";\nimport type {\n  Executor,\n  ImageSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n  SandboxConfig,\n} from \"./types.js\";\n\nfunction parseImageSandboxArg(value: string): ImageSandboxConfig | undefined {\n  if (!value.startsWith(\"image:\")) {\n    return undefined;\n  }\n\n  const image = value.slice(\"image:\".length);\n  if (!image) {\n    throw new SandboxError(\"Error: image sandbox requires image name (e.g., image:ubuntu:24.04)\");\n  }\n  return { type: \"image\", image };\n}\n\nasync function validateImageSandbox(config: ImageSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n  console.log(`  Image auto-provisioning enabled. Image: ${config.image}`);\n}\n\nconst imageSandboxAdapter: SandboxAdapter<ImageSandboxConfig> = {\n  type: \"image\",\n  credentials: { env: true, fileMounts: true },\n  workspace: { managedProjection: true },\n  parse: parseImageSandboxArg,\n  validate: validateImageSandbox,\n};\n\nconst sandboxAdapters = [\n  hostSandboxAdapter,\n  containerSandboxAdapter,\n  imageSandboxAdapter,\n  cloudflareSandboxAdapter,\n] as const;\nconst sandboxAdapterByType = new Map(\n  sandboxAdapters.map((adapter) => [adapter.type, adapter]),\n) as Map<SandboxConfig[\"type\"], SandboxAdapter>;\n\nexport function getSandboxAdapters(): readonly [...typeof sandboxAdapters] {\n  return sandboxAdapters;\n}\n\nfunction requireSandboxAdapter(type: SandboxConfig[\"type\"]): SandboxAdapter {\n  const adapter = sandboxAdapterByType.get(type);\n  if (!adapter) throw new SandboxError(`Error: Unsupported sandbox type '${type}'`);\n  return adapter;\n}\n\nexport function getSandboxCredentialCapabilities(\n  type: SandboxConfig[\"type\"],\n): SandboxAdapter[\"credentials\"] {\n  return requireSandboxAdapter(type).credentials;\n}\n\nexport function getSandboxWorkspaceCapabilities(\n  type: SandboxConfig[\"type\"],\n): SandboxAdapter[\"workspace\"] {\n  return requireSandboxAdapter(type).workspace;\n}\n\nconst warnedUnenforcedPrivacy = new Set<string>();\n\nexport function assertSandboxSupportsWorkspacePolicy(\n  sandboxConfig: SandboxConfig,\n  visibility: \"public\" | \"private\",\n  officeKey: string,\n): void {\n  const capabilities = getSandboxWorkspaceCapabilities(sandboxConfig.type);\n  if (capabilities.managedProjection || visibility === \"public\") return;\n  if (warnedUnenforcedPrivacy.has(officeKey)) return;\n  warnedUnenforcedPrivacy.add(officeKey);\n  log.logWarning(\n    `Sandbox '${sandboxConfig.type}' cannot enforce private office visibility for ${officeKey}`,\n    \"host, container, and cloudflare backends share one filesystem; use image:* to isolate private channels and DMs\",\n  );\n}\n\nexport function parseSandboxArg(value: string): SandboxConfig {\n  for (const adapter of sandboxAdapters) {\n    const config = adapter.parse(value);\n    if (config) {\n      return config;\n    }\n  }\n\n  if (value.startsWith(\"docker:\")) {\n    throw new SandboxError(\n      `Error: '${value}' is not supported. Use 'container:<container-name>' for the shared-container mode or 'image:<image-name>' for mikan-managed per-user containers.`,\n    );\n  }\n\n  throw new SandboxError(\n    `Error: Invalid sandbox type '${value}'. Use 'host', 'container:<container-name>', 'image:<image-name>', or 'cloudflare:<sandbox-id>'`,\n  );\n}\n\nexport async function validateSandbox(config: SandboxConfig): Promise<void> {\n  await requireSandboxAdapter(config.type).validate?.(config);\n}\n\nexport function createExecutor(\n  config: SandboxConfig,\n  env?: Record<string, string>,\n  ensureReady?: () => Promise<void>,\n): Executor {\n  const adapter = requireSandboxAdapter(config.type);\n  if (!adapter.createExecutor) {\n    throw new SandboxError(\"Error: image sandbox must resolve to a concrete container executor\");\n  }\n  return adapter.createExecutor(config, env, ensureReady);\n}\n\nexport function getUnresolvedSandboxPathContext(\n  sandboxConfig: SandboxConfig,\n  hostWorkspaceRoot: string,\n): RuntimePathContext {\n  if (sandboxConfig.type === \"image\") {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);\n  }\n\n  return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);\n}\n"]}

package/dist/sandbox/types.d.ts

@@ -1,4 +1,5 @@
-export type SandboxConfig = HostSandboxConfig | ContainerSandboxConfig | ImageSandboxConfig | FirecrackerSandboxConfig | CloudflareSandboxConfig;
+import type { OfficeAddress } from "../types.js";
+export type SandboxConfig = HostSandboxConfig | ContainerSandboxConfig | ImageSandboxConfig | CloudflareSandboxConfig;
 export interface HostSandboxConfig {
     type: "host";
 }
@@ -10,58 +11,55 @@ export interface ImageSandboxConfig {
     type: "image";
     image: string;
 }
-export interface FirecrackerSandboxConfig {
-    type: "firecracker";
-    vmId: string;
-    hostPath: string;
-    sshUser?: string;
-    sshPort?: number;
-}
 export interface CloudflareSandboxConfig {
     type: "cloudflare";
     sandboxId: string;
 }
 export interface Executor {
-    /**
-     * Execute a bash command.
-     */
     exec(command: string, options?: ExecOptions): Promise<ExecResult>;
-    /**
-     * Get the workspace path prefix for this executor.
-     * Host: returns the actual path.
-     * Container/Firecracker: returns /workspace.
-     */
+    readFile(path: string, options?: ExecOptions): Promise<string>;
+    readFileBase64(path: string, options?: ExecOptions): Promise<string>;
+    writeFile(path: string, content: string, options?: ExecOptions): Promise<void>;
     getWorkspacePath(hostPath: string): string;
-    /**
-     * Return explicit host/control-plane/runtime path semantics for this executor.
-     */
     getPathContext(hostWorkspaceRoot: string): RuntimePathContext;
-    /**
-     * Get the current sandbox config used by this executor.
-     */
     getSandboxConfig(): SandboxConfig;
 }
 export interface RuntimePathContext {
-    /** Host-side workspace root used by mikan's control plane. */
     hostWorkspaceRoot: string;
-    /** Workspace root as seen by bash/read/write/edit inside the runtime. */
     runtimeWorkspaceRoot: string;
-    /** Translate a runtime path back to a host path when the runtime is host-backed. */
     runtimeToHostPath?: (runtimePath: string) => string;
 }
 export interface ExecOptions {
     timeout?: number;
+    cwd?: string;
     signal?: AbortSignal;
 }
+export type DockerExecFile = (file: string, args: string[]) => Promise<{
+    stdout: string;
+}>;
 export interface ExecResult {
     stdout: string;
     stderr: string;
     code: number;
 }
+export interface SandboxCredentialCapabilities {
+    env: boolean;
+    fileMounts: boolean;
+}
+export interface CredentialScope {
+    userId: string;
+    address: OfficeAddress;
+}
+interface SandboxWorkspaceCapabilities {
+    managedProjection: boolean;
+}
 export interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {
     type: TConfig["type"];
+    credentials: SandboxCredentialCapabilities;
+    workspace: SandboxWorkspaceCapabilities;
     parse(value: string): TConfig | undefined;
     validate?(config: TConfig): Promise<void>;
     createExecutor?(config: TConfig, env?: Record<string, string>, ensureReady?: () => Promise<void>): Executor;
 }
+export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/sandbox/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,kBAAkB,GAClB,wBAAwB,GACxB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAE9D;;OAEG;IACH,gBAAgB,IAAI,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC3E,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,CACb,MAAM,EAAE,OAAO,EACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAAC;CACb"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,kBAAkB,GAClB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAErE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAE3C,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAE9D,gBAAgB,IAAI,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3F,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,4BAA4B;IACpC,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC3E,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,6BAA6B,CAAC;IAC3C,SAAS,EAAE,4BAA4B,CAAC;IACxC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,CACb,MAAM,EAAE,OAAO,EACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,QAAQ,CAAC;CACb"}

package/dist/sandbox/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"","sourcesContent":["export type SandboxConfig =\n  | HostSandboxConfig\n  | ContainerSandboxConfig\n  | ImageSandboxConfig\n  | FirecrackerSandboxConfig\n  | CloudflareSandboxConfig;\n\nexport interface HostSandboxConfig {\n  type: \"host\";\n}\n\nexport interface ContainerSandboxConfig {\n  type: \"container\";\n  container: string;\n}\n\nexport interface ImageSandboxConfig {\n  type: \"image\";\n  image: string;\n}\n\nexport interface FirecrackerSandboxConfig {\n  type: \"firecracker\";\n  vmId: string;\n  hostPath: string;\n  sshUser?: string;\n  sshPort?: number;\n}\n\nexport interface CloudflareSandboxConfig {\n  type: \"cloudflare\";\n  sandboxId: string;\n}\n\nexport interface Executor {\n  /**\n   * Execute a bash command.\n   */\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n\n  /**\n   * Get the workspace path prefix for this executor.\n   * Host: returns the actual path.\n   * Container/Firecracker: returns /workspace.\n   */\n  getWorkspacePath(hostPath: string): string;\n\n  /**\n   * Return explicit host/control-plane/runtime path semantics for this executor.\n   */\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext;\n\n  /**\n   * Get the current sandbox config used by this executor.\n   */\n  getSandboxConfig(): SandboxConfig;\n}\n\nexport interface RuntimePathContext {\n  /** Host-side workspace root used by mikan's control plane. */\n  hostWorkspaceRoot: string;\n  /** Workspace root as seen by bash/read/write/edit inside the runtime. */\n  runtimeWorkspaceRoot: string;\n  /** Translate a runtime path back to a host path when the runtime is host-backed. */\n  runtimeToHostPath?: (runtimePath: string) => string;\n}\n\nexport interface ExecOptions {\n  timeout?: number;\n  signal?: AbortSignal;\n}\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  code: number;\n}\n\nexport interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {\n  type: TConfig[\"type\"];\n  parse(value: string): TConfig | undefined;\n  validate?(config: TConfig): Promise<void>;\n  createExecutor?(\n    config: TConfig,\n    env?: Record<string, string>,\n    ensureReady?: () => Promise<void>,\n  ): Executor;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { OfficeAddress } from \"../types.js\";\n\nexport type SandboxConfig =\n  | HostSandboxConfig\n  | ContainerSandboxConfig\n  | ImageSandboxConfig\n  | CloudflareSandboxConfig;\n\nexport interface HostSandboxConfig {\n  type: \"host\";\n}\n\nexport interface ContainerSandboxConfig {\n  type: \"container\";\n  container: string;\n}\n\nexport interface ImageSandboxConfig {\n  type: \"image\";\n  image: string;\n}\n\nexport interface CloudflareSandboxConfig {\n  type: \"cloudflare\";\n  sandboxId: string;\n}\n\nexport interface Executor {\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n\n  readFile(path: string, options?: ExecOptions): Promise<string>;\n\n  readFileBase64(path: string, options?: ExecOptions): Promise<string>;\n\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void>;\n\n  getWorkspacePath(hostPath: string): string;\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext;\n\n  getSandboxConfig(): SandboxConfig;\n}\n\nexport interface RuntimePathContext {\n  hostWorkspaceRoot: string;\n  runtimeWorkspaceRoot: string;\n  runtimeToHostPath?: (runtimePath: string) => string;\n}\n\nexport interface ExecOptions {\n  timeout?: number;\n  cwd?: string;\n  signal?: AbortSignal;\n}\n\nexport type DockerExecFile = (file: string, args: string[]) => Promise<{ stdout: string }>;\n\nexport interface ExecResult {\n  stdout: string;\n  stderr: string;\n  code: number;\n}\n\nexport interface SandboxCredentialCapabilities {\n  env: boolean;\n  fileMounts: boolean;\n}\n\nexport interface CredentialScope {\n  userId: string;\n  address: OfficeAddress;\n}\n\ninterface SandboxWorkspaceCapabilities {\n  managedProjection: boolean;\n}\n\nexport interface SandboxAdapter<TConfig extends SandboxConfig = SandboxConfig> {\n  type: TConfig[\"type\"];\n  credentials: SandboxCredentialCapabilities;\n  workspace: SandboxWorkspaceCapabilities;\n  parse(value: string): TConfig | undefined;\n  validate?(config: TConfig): Promise<void>;\n  createExecutor?(\n    config: TConfig,\n    env?: Record<string, string>,\n    ensureReady?: () => Promise<void>,\n  ): Executor;\n}\n"]}

package/dist/sandbox/utils.d.ts

@@ -1,4 +1,25 @@
+import type { RuntimePathContext } from "./types.js";
 export declare function execSimple(cmd: string, args: string[]): Promise<string>;
 export declare function killProcessTree(pid: number): void;
+export declare function linkAbortSignal(signal: AbortSignal | undefined, onAbort: () => void): () => void;
 export declare function shellEscape(s: string): string;
+interface ExecLikeResult {
+    stdout: string;
+    stderr: string;
+    code: number;
+}
+interface ExecLike<TOptions> {
+    exec(command: string, options?: TOptions): Promise<ExecLikeResult>;
+}
+export declare function execReadFileBase64<TOptions>(executor: ExecLike<TOptions>, path: string, options?: TOptions): Promise<string>;
+export declare function execReadFile<TOptions>(executor: ExecLike<TOptions>, path: string, options?: TOptions): Promise<string>;
+export declare function execWriteFile<TOptions>(executor: ExecLike<TOptions>, path: string, content: string | Uint8Array, options?: TOptions): Promise<void>;
+export declare function execAppendFile<TOptions>(executor: ExecLike<TOptions>, path: string, content: string | Uint8Array, options?: TOptions): Promise<void>;
+export declare function createMountedRuntimePathContext(hostWorkspaceRoot: string, runtimeWorkspaceRoot: string): RuntimePathContext;
+export declare class SandboxError extends Error {
+    readonly details: string[];
+    constructor(message: string, details?: string[]);
+    formatForCli(): string[];
+}
+export {};
 //# sourceMappingURL=utils.d.ts.map

package/dist/sandbox/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/utils.ts"],"names":[],"mappings":"AAEA,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAqBjD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG7C"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/sandbox/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBvE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAiBjD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAQhG;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AAID,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,QAAQ,CAAC,QAAQ;IACzB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpE;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAC/C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,YAAY,CAAC,QAAQ,EACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,OAAO,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,OAAO,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAmCD,wBAAgB,+BAA+B,CAC7C,iBAAiB,EAAE,MAAM,EACzB,oBAAoB,EAAE,MAAM,GAC3B,kBAAkB,CAOpB;AAkCD,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3B,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,EAI9C;IAED,YAAY,IAAI,MAAM,EAAE,CAEvB;CACF"}

package/dist/sandbox/utils.js

@@ -1,4 +1,5 @@
-import { spawn } from "child_process";
+import { spawn } from "node:child_process";
+import { isAbsolute, relative, resolve as resolvePath, sep } from "node:path";
 export function execSimple(cmd, args) {
     return new Promise((resolve, reject) => {
         const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -10,6 +11,7 @@ export function execSimple(cmd, args) {
         child.stderr?.on("data", (d) => {
             stderr += d;
         });
+        child.on("error", reject);
         child.on("close", (code) => {
             if (code === 0)
                 resolve(stdout);
@@ -26,9 +28,7 @@ export function killProcessTree(pid) {
                 detached: true,
             });
         }
-        catch {
-            // Ignore errors
-        }
+        catch { }
     }
     else {
         try {
@@ -38,14 +38,106 @@ export function killProcessTree(pid) {
             try {
                 process.kill(pid, "SIGKILL");
             }
-            catch {
-                // Process already dead
-            }
+            catch { }
         }
     }
 }
+export function linkAbortSignal(signal, onAbort) {
+    if (!signal)
+        return () => { };
+    if (signal.aborted) {
+        onAbort();
+        return () => { };
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+    return () => signal.removeEventListener("abort", onAbort);
+}
 export function shellEscape(s) {
-    // Escape for passing to sh -c
     return `'${s.replace(/'/g, "'\\''")}'`;
 }
+const FILE_TRANSPORT_CHUNK_CHARS = 65_536;
+export async function execReadFileBase64(executor, path, options) {
+    const result = await executor.exec(`base64 < ${shellEscape(path)}`, options);
+    if (result.code !== 0) {
+        throw new Error(result.stderr.trim() || `Failed to read file: ${path}`);
+    }
+    return result.stdout.replace(/\s+/g, "");
+}
+export async function execReadFile(executor, path, options) {
+    return Buffer.from(await execReadFileBase64(executor, path, options), "base64").toString("utf-8");
+}
+export async function execWriteFile(executor, path, content, options) {
+    const encoded = Buffer.from(content).toString("base64");
+    const escapedPath = shellEscape(path);
+    const stage = shellEscape(`${path}.mikan-stage`);
+    const stageB64Path = `${path}.mikan-stage.b64`;
+    const stageB64 = shellEscape(stageB64Path);
+    const run = createFileTransportRunner(executor, path, [stage, stageB64], options);
+    await prepareBase64Stage(run, path, stageB64Path, encoded);
+    await run(`base64 -d < ${stageB64} > ${stage} && mv ${stage} ${escapedPath} && rm -f ${stageB64}`);
+}
+export async function execAppendFile(executor, path, content, options) {
+    const encoded = Buffer.from(content).toString("base64");
+    const stagePath = `${path}.mikan-append.b64`;
+    const stage = shellEscape(stagePath);
+    const run = createFileTransportRunner(executor, path, [stage], options);
+    await prepareBase64Stage(run, path, stagePath, encoded);
+    await run(`base64 -d < ${stage} >> ${shellEscape(path)} && rm -f ${stage}`);
+}
+function createFileTransportRunner(executor, path, cleanupPaths, options) {
+    return async (command) => {
+        const result = await executor.exec(command, options);
+        if (result.code === 0)
+            return;
+        await executor.exec(`rm -f ${cleanupPaths.join(" ")}`, options).catch(() => { });
+        throw new Error(result.stderr.trim() || `Failed to write file: ${path}`);
+    };
+}
+async function prepareBase64Stage(run, path, stagePath, encoded) {
+    const dir = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) || "/" : ".";
+    const stage = shellEscape(stagePath);
+    await run(`mkdir -p ${shellEscape(dir)} && : > ${stage}`);
+    for (let offset = 0; offset === 0 || offset < encoded.length; offset += FILE_TRANSPORT_CHUNK_CHARS) {
+        const chunk = encoded.slice(offset, offset + FILE_TRANSPORT_CHUNK_CHARS);
+        await run(`printf '%s' ${shellEscape(chunk)} >> ${stage}`);
+    }
+}
+export function createMountedRuntimePathContext(hostWorkspaceRoot, runtimeWorkspaceRoot) {
+    return {
+        hostWorkspaceRoot,
+        runtimeWorkspaceRoot,
+        runtimeToHostPath: (runtimePath) => translateMountedRuntimePathToHost(runtimePath, runtimeWorkspaceRoot, hostWorkspaceRoot),
+    };
+}
+function translateMountedRuntimePathToHost(runtimePath, runtimeWorkspaceRoot, hostWorkspaceRoot) {
+    if (!isAbsolute(runtimePath)) {
+        return runtimePath;
+    }
+    const runtimeRoot = resolvePath(runtimeWorkspaceRoot);
+    const normalizedRuntimePath = resolvePath(runtimePath);
+    const runtimeRelativePath = relative(runtimeRoot, normalizedRuntimePath);
+    const escapesRuntimeRoot = runtimeRelativePath === ".." ||
+        runtimeRelativePath.startsWith(`..${sep}`) ||
+        isAbsolute(runtimeRelativePath);
+    if (escapesRuntimeRoot) {
+        return runtimePath;
+    }
+    const hostRoot = resolvePath(hostWorkspaceRoot);
+    const hostPath = resolvePath(hostRoot, runtimeRelativePath);
+    const hostRelativePath = relative(hostRoot, hostPath);
+    const escapesHostRoot = hostRelativePath === ".." ||
+        hostRelativePath.startsWith(`..${sep}`) ||
+        isAbsolute(hostRelativePath);
+    return escapesHostRoot ? runtimePath : hostPath;
+}
+export class SandboxError extends Error {
+    constructor(message, details) {
+        super(message);
+        this.name = "SandboxError";
+        this.details = details ?? [];
+    }
+    formatForCli() {
+        return [this.message, ...this.details];
+    }
+}
 //# sourceMappingURL=utils.js.map