@nimbus-sh/sdk 0.4.0 → 0.6.0

package/README.md

@@ -120,9 +120,9 @@ export default {
       subject: 'agent',
     });
 
-    await box.files.write('/home/user/app/main.py', 'print(2 + 2)\n');
+    await box.files.write('/home/user/example-app/main.py', 'print(2 + 2)\n');
     await box.runtimes.ensure('python');
-    const result = await box.exec('python /home/user/app/main.py');
+    const result = await box.exec('python /home/user/example-app/main.py');
 
     return Response.json(result);
   },
@@ -208,20 +208,20 @@ const box = nimbus.sandbox('session-or-job-id', {
 
 await box.ready();
 await box.exec('node -e "console.log(2 + 2)"');
-const proc = await box.startProcess('node --watch /home/user/app/server.js');
+const proc = await box.startProcess('node --watch /home/user/example-app/server.js');
 // returns immediately with proc.pid; poll box.processes.logs(proc.pid) for
 // output and the exit record, or box.processes.kill(proc.pid) to stop it
 await box.runCode('print(2 + 2)', { language: 'python', install: 'ifMissing' });
 
-await box.files.write('/home/user/app/a.txt', 'hello');
-await box.files.read('/home/user/app/a.txt');
-await box.files.list('/home/user/app');
-await box.files.stat('/home/user/app/a.txt');
-await box.files.lstat('/home/user/app/link');
-await box.files.rename('/home/user/app/a.txt', '/home/user/app/b.txt');
-await box.files.chmod('/home/user/app/b.txt', 0o755);
-await box.files.readRange('/home/user/app/b.txt', 0, 64);
-await box.files.delete('/home/user/app/b.txt');
+await box.files.write('/home/user/example-app/a.txt', 'hello');
+await box.files.read('/home/user/example-app/a.txt');
+await box.files.list('/home/user/example-app');
+await box.files.stat('/home/user/example-app/a.txt');
+await box.files.lstat('/home/user/example-app/link');
+await box.files.rename('/home/user/example-app/a.txt', '/home/user/example-app/b.txt');
+await box.files.chmod('/home/user/example-app/b.txt', 0o755);
+await box.files.readRange('/home/user/example-app/b.txt', 0, 64);
+await box.files.delete('/home/user/example-app/b.txt');
 
 await box.runtimes.available();
 await box.runtimes.installed();
@@ -232,14 +232,34 @@ await box.processes.list();
 await box.processes.logs(7);
 await box.processes.kill(7);
 
-const port = await box.ports.expose(3000);
-// port.url => https://my-nimbus.workers.dev/s/<session-or-job-id>/port/3000/
-await box.ports.unexpose(3000);
+box.ports.url(3000);
+// https://my-nimbus.workers.dev/s/<session-or-job-id>/port/3000/   (owner only)
+await box.ports.list();
+
+// Share a running server with anyone who has the link.
+const web = await box.apps.expose(3000, { visibility: 'public', name: 'web' });
+// web.url, web.capability, web.owner, web.port, web.pid
+await box.apps.list();   // adds status and restart policy per app
+await box.apps.rotateLink('web');                    // new link, old one revoked
+await box.apps.expose('web', { visibility: 'scoped' }); // back to owner only
+await box.apps.remove('web');                        // stop it, release the port and its storage
 ```
 
+Every server is durable: its journal row is restarted after a platform reset,
+on the next request to its URL. Identity is derived from the command and its
+working directory, so re-running the same command in the same directory is the
+same app, and a shared link is bound to that program rather than to the port.
+`startProcess(cmd, { restart: 'on-failure' })` also restarts it after a crash;
+the default restarts only after a reset. An app target can be a port, a pid, a
+name, or an owner.
+
 On deployments with a preview host suffix configured (the hosted product sets
-`NIMBUS_PREVIEW_HOST_SUFFIX=nimbus-os.dev`), `port.url` takes the hostname
-form `https://<port>--<session-id>.<suffix>/` instead. The
+`NIMBUS_PREVIEW_HOST_SUFFIX=nimbus-os.dev`), URLs take the hostname form:
+`https://<port>--<session-id>.<suffix>/` for the private preview,
+`https://<name>--<session-id>.<suffix>/` for a named app, and
+`https://<capability>--<name>--<session-id>.<suffix>/` for a public link.
+Public links need the `NIMBUS_PUBLIC_DIRECTORY` Durable Object binding, which
+`@nimbus-sh/config` emits with `nimbusPublicDirectory: true`. The
 `/s/<id>/port/<n>/` path route works on every deployment.
 
 Runtime policy comes from the sandbox profile:
@@ -255,8 +275,8 @@ Runtime policy comes from the sandbox profile:
 object, in the shape Proteus's tool provider takes. It carries
 `tools.exec.execute`, `runCode`, `readFile`, `writeFile`,
 `listFiles`/`readdir`, `deleteFile`, `exists`, `startProcess`, `killProcess`,
-`logs`, `exposePort`, `unexposePort`, `listPorts`, `installRuntime`, and
-`listRuntimes`.
+`logs`, `exposePort`, `unexposePort`, `listPorts`, `exposeApp`, `listApps`,
+`installRuntime`, and `listRuntimes`.
 
 `provider.capabilities` reports what Nimbus can do. Nimbus claims shell,
 JavaScript/TypeScript, npm, git, owned filesystem, outbound fetch, inbound

package/dist/sandbox.d.ts

@@ -74,6 +74,78 @@ export interface NimbusExecOptions {
      * user, which is what every programmatic exec has always run as.
      */
     cred?: VfsCred;
+    /**
+     * `startProcess` only: what to do when the process exits on its own with
+     * a non-zero code. 'never' (default) leaves it stopped; 'on-failure'
+     * restarts it under the session's restart budget with backoff. A platform
+     * reset re-drives the process either way.
+     */
+    restart?: NimbusRestartPolicy;
+}
+export type NimbusRestartPolicy = 'never' | 'on-failure';
+export type NimbusAppVisibility = 'scoped' | 'public';
+/** The sandbox file plane; see `NimbusSandbox.files`. */
+export interface NimbusSandboxFiles {
+    /** The same API bound to `cred` — the view `SqliteVFS.as(cred)` gives in-process. */
+    as(cred: VfsCred): NimbusSandboxFiles;
+    read(path: string): Promise<string | null>;
+    readBytes(path: string): Promise<Uint8Array | null>;
+    write(path: string, content: string | Uint8Array): Promise<void>;
+    stat(path: string): Promise<NimbusFileStat | null>;
+    /** stat without following a symlink leaf. */
+    lstat(path: string): Promise<NimbusFileStat | null>;
+    rename(from: string, to: string): Promise<void>;
+    chmod(path: string, mode: number): Promise<void>;
+    /** Read `length` bytes at `offset` without materializing the whole file. */
+    readRange(path: string, offset: number, length: number): Promise<Uint8Array | null>;
+    list(path?: string): Promise<{
+        name: string;
+        type: string;
+    }[]>;
+    mkdir(path: string): Promise<void>;
+    exists(path: string): Promise<boolean>;
+    delete(path: string, options?: {
+        recursive?: boolean;
+    }): Promise<void>;
+}
+/**
+ * An application target: a port, a pid, a name, or an owner — every
+ * `apps.*` verb takes one. A bare number is a port when something listens
+ * on it or a reservation names it, else a pid; a bare string is a name
+ * first, then an owner. The object forms are unambiguous.
+ */
+export type NimbusAppTarget = number | string | {
+    port: number;
+} | {
+    pid: number;
+} | {
+    name: string;
+} | {
+    owner: string;
+};
+export interface NimbusExposedApp {
+    /** The application's identity: derived (`auto:…`) for an ordinary process, explicit for a durable worker app. */
+    owner: string;
+    name: string | null;
+    port: number;
+    pid: number | null;
+    capability: string | null;
+    visibility: NimbusAppVisibility;
+    /** Browser-facing URL, built the way `ports.url` builds one; undefined when the deployment is not addressable. */
+    url: string | undefined;
+}
+export interface NimbusApp {
+    owner: string;
+    name: string | null;
+    port: number | null;
+    pid: number | null;
+    status: 'running' | 'starting' | 'stopped' | 'failed';
+    visibility: NimbusAppVisibility;
+    capability: string | null;
+    restart: NimbusRestartPolicy;
+    /** With status 'failed': what went wrong, e.g. `listened on 3000, owns 5173`. */
+    diagnostic: string | null;
+    url: string | undefined;
 }
 export interface NimbusExecResult {
     command: string;
@@ -201,23 +273,23 @@ interface NimbusSessionStub {
     _rpcExec(command: string, options?: Record<string, unknown>): Promise<NimbusExecResult>;
     _rpcStartProcess(command: string, options?: Record<string, unknown>): Promise<NimbusStartResult>;
     _rpcRunCode(code: string, options?: Record<string, unknown>): Promise<NimbusExecResult>;
-    _rpcReadFile(path: string): Promise<string | null>;
-    _rpcReadFileBytes(path: string): Promise<Uint8Array | null>;
-    _rpcWriteFile(path: string, content: string | Uint8Array): Promise<void>;
-    _rpcStat(path: string): Promise<NimbusFileStat | null>;
-    _rpcLstat(path: string): Promise<NimbusFileStat | null>;
-    _rpcReaddir(path: string): Promise<{
+    _rpcReadFile(path: string, pid?: undefined, cred?: VfsCred): Promise<string | null>;
+    _rpcReadFileBytes(path: string, pid?: undefined, cred?: VfsCred): Promise<Uint8Array | null>;
+    _rpcWriteFile(path: string, content: string | Uint8Array, pid?: undefined, cred?: VfsCred): Promise<void>;
+    _rpcStat(path: string, pid?: undefined, cred?: VfsCred): Promise<NimbusFileStat | null>;
+    _rpcLstat(path: string, pid?: undefined, cred?: VfsCred): Promise<NimbusFileStat | null>;
+    _rpcReaddir(path: string, pid?: undefined, cred?: VfsCred): Promise<{
         name: string;
         type: string;
     }[]>;
-    _rpcRename(from: string, to: string): Promise<void>;
-    _rpcChmod(path: string, mode: number): Promise<void>;
-    _rpcFsReadRange(path: string, offset: number, length: number): Promise<Uint8Array | null>;
-    _rpcExists(path: string): Promise<boolean>;
-    _rpcMkdir(path: string): Promise<void>;
+    _rpcRename(from: string, to: string, pid?: undefined, cred?: VfsCred): Promise<void>;
+    _rpcChmod(path: string, mode: number, pid?: undefined, cred?: VfsCred): Promise<void>;
+    _rpcFsReadRange(path: string, offset: number, length: number, pid?: undefined, cred?: VfsCred): Promise<Uint8Array | null>;
+    _rpcExists(path: string, pid?: undefined, cred?: VfsCred): Promise<boolean>;
+    _rpcMkdir(path: string, pid?: undefined, cred?: VfsCred): Promise<void>;
     _rpcDeleteFile(path: string, options?: {
         recursive?: boolean;
-    }): Promise<void>;
+    }, cred?: VfsCred): Promise<void>;
     _rpcInstallRuntime(spec: string, options?: {
         force?: boolean;
     }): Promise<unknown>;
@@ -253,6 +325,7 @@ interface NimbusSessionStub {
     _rpcListPorts(): Promise<NimbusPort[]>;
     _rpcExposePort(port: number, options?: {
         visibility?: 'scoped' | 'public';
+        name?: string;
     }): Promise<{
         port: number;
         listening: boolean;
@@ -260,6 +333,25 @@ interface NimbusSessionStub {
         registeredAt: number | null;
         capability: string | null;
         visibility?: 'scoped' | 'public';
+        owner?: string | null;
+        name?: string | null;
+    }>;
+    _rpcExposeApp(target: NimbusAppTarget, options?: {
+        visibility?: 'scoped' | 'public';
+        name?: string;
+    }): Promise<Omit<NimbusExposedApp, 'url'> & {
+        url: string | null;
+    }>;
+    _rpcListApps(): Promise<Array<Omit<NimbusApp, 'url'> & {
+        url: string | null;
+    }>>;
+    _rpcRotateLink(target: NimbusAppTarget): Promise<Omit<NimbusExposedApp, 'url'> & {
+        url: string | null;
+    }>;
+    _rpcRemoveApp(target: NimbusAppTarget): Promise<{
+        owner: string;
+        removed: boolean;
+        port: number | null;
     }>;
     _rpcEnsureDurableApp(input: {
         owner: string;
@@ -341,27 +433,19 @@ export declare class NimbusSandbox {
         install?: 'never' | 'ifMissing';
     }): Promise<NimbusExecResult>;
     destroy(options?: NimbusDestroyOptions): Promise<NimbusDestroyResult>;
-    files: {
-        read: (path: string) => Promise<string | null>;
-        readBytes: (path: string) => Promise<Uint8Array | null>;
-        write: (path: string, content: string | Uint8Array) => Promise<void>;
-        stat: (path: string) => Promise<NimbusFileStat | null>;
-        /** stat without following a symlink leaf. */
-        lstat: (path: string) => Promise<NimbusFileStat | null>;
-        rename: (from: string, to: string) => Promise<void>;
-        chmod: (path: string, mode: number) => Promise<void>;
-        /** Read `length` bytes at `offset` without materializing the whole file. */
-        readRange: (path: string, offset: number, length: number) => Promise<Uint8Array | null>;
-        list: (path?: string) => Promise<{
-            name: string;
-            type: string;
-        }[]>;
-        mkdir: (path: string) => Promise<void>;
-        exists: (path: string) => Promise<boolean>;
-        delete: (path: string, options?: {
-            recursive?: boolean;
-        }) => Promise<void>;
-    };
+    /**
+     * The session file plane. Every method acts as the session's default
+     * identity for a pid-less caller — the session user for reads, writes,
+     * stat, list, mkdir, rename and chmod; the kernel for `delete` — which is
+     * the embedder's trusted surface, reached only by a caller holding the DO
+     * binding or a remote token. `files.as(cred)` returns the same API bound
+     * to `cred` instead, the view `SqliteVFS.as(cred)` gives in-process: a
+     * file the identity cannot read answers EACCES, one it owns answers.
+     * Over the remote endpoint a `cred` is refused by the dispatcher, as it is
+     * on `exec` — a token authenticates a session, not a user inside it.
+     */
+    files: NimbusSandboxFiles;
+    private filesAs;
     runtimes: {
         available: () => Promise<NimbusAvailableRuntime[]>;
         installed: () => Promise<NimbusRuntimeSummary[]>;
@@ -403,8 +487,15 @@ export declare class NimbusSandbox {
     };
     ports: {
         list: () => Promise<NimbusPort[]>;
+        /**
+         * Expose a port. When the port's occupant carries an identity (a node
+         * resident, a durable worker app) this is the same lazy reservation
+         * `apps.expose` makes and the result names the owner; a bare port —
+         * a dev server, a python resident — is written port-only as before.
+         */
         expose: (port: number, options?: {
             visibility?: "scoped" | "public";
+            name?: string;
         }) => Promise<{
             url: string | undefined;
             port: number;
@@ -413,6 +504,8 @@ export declare class NimbusSandbox {
             registeredAt: number | null;
             capability: string | null;
             visibility?: "scoped" | "public";
+            owner?: string | null;
+            name?: string | null;
         }>;
         unexpose: (port: number) => Promise<{
             port: number;
@@ -446,8 +539,30 @@ export declare class NimbusSandbox {
         url: (port: number, options?: {
             visibility?: "scoped" | "public";
             capability?: string;
+            name?: string;
         }) => string | undefined;
     };
+    /**
+     * The application surface: every server is durable under its identity
+     * from the moment it is spawned; exposing it reserves its port for that
+     * identity, names it, and (when public) mints the capability its shared
+     * URL is built on. `ports.expose` is the port-addressed alias of
+     * `apps.expose`; the identity-addressed verbs live here.
+     */
+    apps: {
+        list: () => Promise<NimbusApp[]>;
+        expose: (target: NimbusAppTarget, options?: {
+            visibility?: "scoped" | "public";
+            name?: string;
+        }) => Promise<NimbusExposedApp>;
+        rotateLink: (target: NimbusAppTarget) => Promise<NimbusExposedApp>;
+        remove: (target: NimbusAppTarget) => Promise<{
+            owner: string;
+            removed: boolean;
+            port: number | null;
+        }>;
+    };
+    private exposedApp;
     tools(options?: {
         namespace?: string;
         kind?: string;
@@ -555,6 +670,8 @@ export declare class NimbusSandbox {
                     registeredAt: number | null;
                     capability: string | null;
                     visibility?: "scoped" | "public";
+                    owner?: string | null;
+                    name?: string | null;
                 }>;
             };
             unexposePort: {
@@ -568,6 +685,16 @@ export declare class NimbusSandbox {
             listPorts: {
                 execute: () => Promise<NimbusPort[]>;
             };
+            exposeApp: {
+                execute: (input: NimbusAppTarget | {
+                    target: NimbusAppTarget;
+                    visibility?: "scoped" | "public";
+                    name?: string;
+                }) => Promise<NimbusExposedApp>;
+            };
+            listApps: {
+                execute: () => Promise<NimbusApp[]>;
+            };
             installRuntime: {
                 execute: (spec: RuntimeSpec) => Promise<unknown>;
             };

package/dist/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAGvE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AACjC,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,UAAU,iBAAiB;IACzB,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxF,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxF,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACxD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACrE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;QAAC,SAAS,EAAE,sBAAsB,EAAE,CAAA;KAAE,CAAC,CAAC;IACxG,iBAAiB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9C,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnG,aAAa,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAC;IAC1O,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAC;IAChM,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACvG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC3E;AAED,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,iBAAiB,CAAC;CAC7C;AAED,KAAK,YAAY,GACb;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,sBAAsB,CAAA;CAAE,GACtD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB,CAAC;AAEN,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAOxF;AAyLD,qBAAa,MAAM;IA8Cf,OAAO,CAAC,QAAQ,CAAC,MAAM;IA7CzB,MAAM,CAAC,OAAO,CACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,GAAE,YAAiB,EACzB,OAAO,GAAE,oBAAyB,GACjC,MAAM;IAeT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM;IAsBrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAGpC,MAAM,EAAE,sBAAsB,GAAG,YAAY,EAC5B,MAAM,GAAE,YAAiB;IAO5C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,aAAa;CAGvE;AAED,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,YAAY,CAA8B;gBAG/B,MAAM,EAAE,YAAY,EACrC,EAAE,EAAE,MAAM,EACO,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,YAAY;IAOvC,OAAO,KAAK,aAAa,GAIxB;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,UAAU;YA2CJ,SAAS;IAyDjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAStB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKvF;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAK1F,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,iBAAiB,GAAG;QAC3B,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;QACrE,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;KAC5B,GACL,OAAO,CAAC,gBAAgB,CAAC;IAatB,OAAO,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK/E,KAAK;qBACgB,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;0BAI1B,MAAM,KAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;sBAIvC,MAAM,WAAW,MAAM,GAAG,UAAU,KAAG,OAAO,CAAC,IAAI,CAAC;qBAIrD,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;QAI1D,6CAA6C;sBACzB,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;uBAItC,MAAM,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;sBAInC,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QAIxD,4EAA4E;0BACpD,MAAM,UAAU,MAAM,UAAU,MAAM,KAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;iCAI3D,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;sBAIrD,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;uBAIrB,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;uBAIzB,MAAM,YAAW;YAAE,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;MAIlF;IAEF,QAAQ;yBACe,OAAO,CAAC,sBAAsB,EAAE,CAAC;yBAIjC,OAAO,CAAC,oBAAoB,EAAE,CAAC;;uBAjhBb,oBAAoB,EAAE;uBAAa,sBAAsB,EAAE;;wBAyhB5E,WAAW,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;wBAKzC,WAAW,GAAG,WAAW,EAAE,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;MAM/E;IAEF,SAAS;oBACS,OAAO,CAAC,aAAa,EAAE,CAAC;oBAItB,MAAM;gBAziBkB,OAAO;iBAAO,MAAM;;qBA6iB3C,MAAM,QAAQ,MAAM;gBA5iBuB,OAAO;iBAAO,MAAM;;wBAgjB5D,MAAM;gBA/iBkB,OAAO;iBAAO,MAAM;;sBAmjB9C,MAAM,QAAQ,kBAAkB;gBAljBkB,OAAO;iBAAO,MAAM;;sBAsjBtE,MAAM,UAAU,MAAM;gBArjBkB,OAAO;iBAAO,MAAM;;oBAyjB9D,MAAM,YAAW,wBAAwB,KAAQ,OAAO,CAAC,uBAAuB,CAAC;sBAIrF,MAAM,YAAW,0BAA0B,KAAQ,uBAAuB;MAGxF;IAEF,KAAK;oBACa,OAAO,CAAC,UAAU,EAAE,CAAC;uBAIhB,MAAM,YAAW;YAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;SAAE;;kBApkBkB,MAAM;uBAAa,OAAO;iBAAO,MAAM,GAAG,IAAI;0BAAgB,MAAM,GAAG,IAAI;wBAAc,MAAM,GAAG,IAAI;yBAAe,QAAQ,GAAG,QAAQ;;yBA+kB7M,MAAM;kBA5kBiB,MAAM;gBAAM,OAAO;;QAglBjE;;;;WAIG;kCAC6B;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;SAAE;kBAvlBa,MAAM;wBAAc,MAAM,GAAG,IAAI;wBAAc,QAAQ,GAAG,QAAQ;;QA2lB1L;;;;;WAKG;kCAC6B,MAAM;mBAhmBc,MAAM;qBAAW,OAAO;kBAAQ,MAAM,GAAG,IAAI;;oBAomBrF,MAAM,YAAW;YAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,KAAQ,MAAM,GAAG,SAAS;MAEhH;IAEF,KAAK,CAAC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;;;;;;;;;mCA2BvC,MAAM,SAAS,iBAAiB;;;gCAChC,MAAM,SAAS,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;;iCACpD,OAAO;;;iCACN,OAAO;;;kCAIP,OAAO;0BA3JO,MAAM;0BAAQ,MAAM;;;;kCA4JpC,OAAO;0BA5JS,MAAM;0BAAQ,MAAM;;;;iCA6JjC,OAAO;;;iCAIX,OAAO;;;mCACC,MAAM,SAAS,iBAAiB;;;iCACnC,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAA;iBAAE;wBA3pBlB,OAAO;yBAAO,MAAM;;;;iCA4pBpB;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE;wBA3pBT,OAAO;yBAAO,MAAM;;;;iCA4pB1C,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAA;iBAAE;wBA3pBlB,OAAO;yBAAO,MAAM;;;;iCA4pB5B;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,OAAO,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE;wBA3pBd,OAAO;yBAAO,MAAM;;;;iCA4pBpD;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,MAAM,EAAE,MAAM,CAAA;iBAAE;wBA3pBT,OAAO;yBAAO,MAAM;;;;iCA4pBnD,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;iBAAE;;;iCAElD,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;;0BA3pBgC,MAAM;+BAAa,OAAO;yBAAO,MAAM,GAAG,IAAI;kCAAgB,MAAM,GAAG,IAAI;gCAAc,MAAM,GAAG,IAAI;iCAAe,QAAQ,GAAG,QAAQ;;;;iCA4pB/L,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;0BAzpBhB,MAAM;wBAAM,OAAO;;;;;;;gCA2pB3B,WAAW;;;;+BAvqBV,oBAAoB,EAAE;+BAAa,sBAAsB,EAAE;;;;;IA6qBpG,YAAY,IAAI,MAAM,EAAE;IAwBxB,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;YAwBD,GAAG;CAKlB;AAED,qBAAa,uBAAwB,YAAW,aAAa,CAAC,qBAAqB,CAAC;IAIhF,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,MAAM,CAAuB;gBAGlB,OAAO,EAAE,aAAa,EAC9B,GAAG,EAAE,MAAM,EACH,OAAO,GAAE,0BAA+B;IAGrD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI1D,QAAQ,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAIjD,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7D,IAAI,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7C,IAAI,CAAC,OAAO,GAAE,wBAA6B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAMpF,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAkCtF,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,qBAAqB,CAAC;CAG/D"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAGvE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AACjC,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,CAAC;AACzD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACnD,6CAA6C;IAC7C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,4EAA4E;IAC5E,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAOD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,MAAM,GACN;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,iHAAiH;IACjH,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,kHAAkH;IAClH,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtD,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iFAAiF;IACjF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,UAAU,iBAAiB;IACzB,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxF,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAIxF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7F,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1G,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACxF,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACzF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3H,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;QAAC,SAAS,EAAE,sBAAsB,EAAE,CAAA;KAAE,CAAC,CAAC;IACxG,iBAAiB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9C,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnG,aAAa,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACtS,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACvK,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAChF,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACzG,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC1G,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAC;IAChM,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACvG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC3E;AAED,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,iBAAiB,CAAC;CAC7C;AAED,KAAK,YAAY,GACb;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,sBAAsB,CAAA;CAAE,GACtD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB,CAAC;AAEN,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAOxF;AAkND,qBAAa,MAAM;IA8Cf,OAAO,CAAC,QAAQ,CAAC,MAAM;IA7CzB,MAAM,CAAC,OAAO,CACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,GAAE,YAAiB,EACzB,OAAO,GAAE,oBAAyB,GACjC,MAAM;IAeT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM;IAsBrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAGpC,MAAM,EAAE,sBAAsB,GAAG,YAAY,EAC5B,MAAM,GAAE,YAAiB;IAO5C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,aAAa;CAGvE;AAED,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,YAAY,CAA8B;gBAG/B,MAAM,EAAE,YAAY,EACrC,EAAE,EAAE,MAAM,EACO,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,YAAY;IAOvC,OAAO,KAAK,aAAa,GAIxB;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,UAAU;YAmDJ,SAAS;IAyDjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAStB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKvF;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAK1F,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,iBAAiB,GAAG;QAC3B,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;QACrE,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;KAC5B,GACL,OAAO,CAAC,gBAAgB,CAAC;IAatB,OAAO,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK/E;;;;;;;;;;OAUG;IACH,KAAK,EAAE,kBAAkB,CAA2B;IAEpD,OAAO,CAAC,OAAO;IAwDf,QAAQ;yBACe,OAAO,CAAC,sBAAsB,EAAE,CAAC;yBAIjC,OAAO,CAAC,oBAAoB,EAAE,CAAC;;uBAtkBb,oBAAoB,EAAE;uBAAa,sBAAsB,EAAE;;wBA8kB5E,WAAW,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;wBAKzC,WAAW,GAAG,WAAW,EAAE,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;MAM/E;IAEF,SAAS;oBACS,OAAO,CAAC,aAAa,EAAE,CAAC;oBAItB,MAAM;gBA9lBkB,OAAO;iBAAO,MAAM;;qBAkmB3C,MAAM,QAAQ,MAAM;gBAjmBuB,OAAO;iBAAO,MAAM;;wBAqmB5D,MAAM;gBApmBkB,OAAO;iBAAO,MAAM;;sBAwmB9C,MAAM,QAAQ,kBAAkB;gBAvmBkB,OAAO;iBAAO,MAAM;;sBA2mBtE,MAAM,UAAU,MAAM;gBA1mBkB,OAAO;iBAAO,MAAM;;oBA8mB9D,MAAM,YAAW,wBAAwB,KAAQ,OAAO,CAAC,uBAAuB,CAAC;sBAIrF,MAAM,YAAW,0BAA0B,KAAQ,uBAAuB;MAGxF;IAEF,KAAK;oBACa,OAAO,CAAC,UAAU,EAAE,CAAC;QAIrC;;;;;WAKG;uBACkB,MAAM,YAAW;YAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE;;kBA/nBkB,MAAM;uBAAa,OAAO;iBAAO,MAAM,GAAG,IAAI;0BAAgB,MAAM,GAAG,IAAI;wBAAc,MAAM,GAAG,IAAI;yBAAe,QAAQ,GAAG,QAAQ;oBAAU,MAAM,GAAG,IAAI;mBAAS,MAAM,GAAG,IAAI;;yBA2oBzQ,MAAM;kBApoBiB,MAAM;gBAAM,OAAO;;QAwoBjE;;;;WAIG;kCAC6B;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;SAAE;kBA/oBa,MAAM;wBAAc,MAAM,GAAG,IAAI;wBAAc,QAAQ,GAAG,QAAQ;;QAmpB1L;;;;;WAKG;kCAC6B,MAAM;mBAxpBc,MAAM;qBAAW,OAAO;kBAAQ,MAAM,GAAG,IAAI;;oBA4pBrF,MAAM,YAAW;YAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,KAAQ,MAAM,GAAG,SAAS;MAE/H;IAEF;;;;;;OAMG;IACH,IAAI;oBACc,OAAO,CAAC,SAAS,EAAE,CAAC;yBAYb,eAAe,YAAW;YAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,KAAQ,OAAO,CAAC,gBAAgB,CAAC;6BAK1G,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAAC;yBAK/C,eAAe;mBAhsBiB,MAAM;qBAAW,OAAO;kBAAQ,MAAM,GAAG,IAAI;;MAosBpG;IAEF,OAAO,CAAC,UAAU;IAWlB,KAAK,CAAC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;;;;;;;;;mCA2BvC,MAAM,SAAS,iBAAiB;;;gCAChC,MAAM,SAAS,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;;iCACpD,OAAO;;;iCACN,OAAO;;;kCAIP,OAAO;0BAx8BN,MAAM;0BAAQ,MAAM;;;;kCAy8BvB,OAAO;0BAz8BJ,MAAM;0BAAQ,MAAM;;;;iCA08BpB,OAAO;;;iCAIX,OAAO;;;mCACC,MAAM,SAAS,iBAAiB;;;iCACnC,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAA;iBAAE;wBAtwBlB,OAAO;yBAAO,MAAM;;;;iCAuwBpB;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE;wBAtwBT,OAAO;yBAAO,MAAM;;;;iCAuwB1C,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAA;iBAAE;wBAtwBlB,OAAO;yBAAO,MAAM;;;;iCAuwB5B;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,OAAO,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE;wBAtwBd,OAAO;yBAAO,MAAM;;;;iCAuwBpD;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,MAAM,EAAE,MAAM,CAAA;iBAAE;wBAtwBT,OAAO;yBAAO,MAAM;;;;iCAuwBnD,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;iBAAE;;;iCAElD,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;;0BAtwB+C,MAAM;+BAAa,OAAO;yBAAO,MAAM,GAAG,IAAI;kCAAgB,MAAM,GAAG,IAAI;gCAAc,MAAM,GAAG,IAAI;iCAAe,QAAQ,GAAG,QAAQ;4BAAU,MAAM,GAAG,IAAI;2BAAS,MAAM,GAAG,IAAI;;;;iCAuwB3P,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;0BAhwBhB,MAAM;wBAAM,OAAO;;;;;;;iCAkwB/B,eAAe,GAAG;oBAAE,MAAM,EAAE,eAAe,CAAC;oBAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE;;;;;;gCAK1F,WAAW;;;;+BAvxBV,oBAAoB,EAAE;+BAAa,sBAAsB,EAAE;;;;;IA6xBpG,YAAY,IAAI,MAAM,EAAE;IAwBxB,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;YA2BD,GAAG;CAKlB;AAED,qBAAa,uBAAwB,YAAW,aAAa,CAAC,qBAAqB,CAAC;IAIhF,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,MAAM,CAAuB;gBAGlB,OAAO,EAAE,aAAa,EAC9B,GAAG,EAAE,MAAM,EACH,OAAO,GAAE,0BAA+B;IAGrD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI1D,QAAQ,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAIjD,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7D,IAAI,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7C,IAAI,CAAC,OAAO,GAAE,wBAA6B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAMpF,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAkCtF,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,qBAAqB,CAAC;CAG/D"}

package/dist/sandbox.js

@@ -3,6 +3,10 @@
  */
 import { buildPreviewHost, buildPublicPreviewHost, isPreviewHostSafeSid, readPreviewHostSuffix, } from '@nimbus-sh/worker/preview-host';
 import { z } from 'zod/v4';
+/** The trailing wire argument a credentialed file op carries, or nothing. */
+function fileWireOptions(cred) {
+    return cred === undefined ? [] : [{ cred }];
+}
 export class NimbusRemoteError extends Error {
     status;
     code;
@@ -139,6 +143,29 @@ const ExposedPortSchema = z.object({
     registeredAt: z.number().nullable(),
     capability: z.string().nullable(),
     visibility: z.enum(['scoped', 'public']).optional(),
+    owner: z.string().nullable().optional(),
+    name: z.string().nullable().optional(),
+});
+const ExposedAppSchema = z.object({
+    owner: z.string(),
+    name: z.string().nullable(),
+    port: z.number(),
+    pid: z.number().nullable(),
+    capability: z.string().nullable(),
+    visibility: z.enum(['scoped', 'public']),
+    url: z.string().nullable(),
+});
+const AppSchema = z.object({
+    owner: z.string(),
+    name: z.string().nullable(),
+    port: z.number().nullable(),
+    pid: z.number().nullable(),
+    status: z.enum(['running', 'starting', 'stopped', 'failed']),
+    visibility: z.enum(['scoped', 'public']),
+    capability: z.string().nullable(),
+    restart: z.enum(['never', 'on-failure']),
+    diagnostic: z.string().nullable(),
+    url: z.string().nullable(),
 });
 const EnsureDurableAppSchema = z.object({
     port: z.number(),
@@ -259,23 +286,26 @@ export class NimbusSandbox {
             _rpcExec: (command, options) => this.remoteRpc('exec', [command, options], ExecResultSchema),
             _rpcStartProcess: (command, options) => this.remoteRpc('startProcess', [command, options], StartResultSchema),
             _rpcRunCode: (code, options) => this.remoteRpc('runCode', [code, options], ExecResultSchema),
-            _rpcReadFile: (path) => this.remoteRpc('readFile', [path], StringOrNullSchema),
-            _rpcReadFileBytes: (path) => this.remoteRpc('readFileBytes', [path], Uint8ArrayOrNullSchema),
-            _rpcWriteFile: async (path, content) => {
+            // A credential rides the wire as a trailing `{ cred }` options object
+            // so the payload names it explicitly; the remote dispatcher decides
+            // what to do with it (today: refuse, as it refuses `cred` on exec).
+            _rpcReadFile: (path, _pid, cred) => this.remoteRpc('readFile', [path, ...fileWireOptions(cred)], StringOrNullSchema),
+            _rpcReadFileBytes: (path, _pid, cred) => this.remoteRpc('readFileBytes', [path, ...fileWireOptions(cred)], Uint8ArrayOrNullSchema),
+            _rpcWriteFile: async (path, content, _pid, cred) => {
                 // The byte count is the wire contract but not part of the public
                 // `files.write` surface, so it is validated and dropped. Declaring
                 // this `undefined` made every remote write throw after succeeding.
-                await this.remoteRpc('writeFile', [path, content], WriteFileResultSchema);
+                await this.remoteRpc('writeFile', [path, content, ...fileWireOptions(cred)], WriteFileResultSchema);
             },
-            _rpcStat: (path) => this.remoteRpc('stat', [path], FileStatSchema.nullable()),
-            _rpcLstat: (path) => this.remoteRpc('lstat', [path], FileStatSchema.nullable()),
-            _rpcRename: (from, to) => this.remoteRpc('rename', [from, to], UndefinedResultSchema),
-            _rpcChmod: (path, mode) => this.remoteRpc('chmod', [path, mode], UndefinedResultSchema),
-            _rpcFsReadRange: (path, offset, length) => this.remoteRpc('readRange', [path, offset, length], Uint8ArrayOrNullSchema),
-            _rpcReaddir: (path) => this.remoteRpc('readdir', [path], z.array(DirectoryEntrySchema)),
-            _rpcExists: (path) => this.remoteRpc('exists', [path], BooleanResultSchema),
-            _rpcMkdir: (path) => this.remoteRpc('mkdir', [path], UndefinedResultSchema),
-            _rpcDeleteFile: (path, options) => this.remoteRpc('deleteFile', [path, options], UndefinedResultSchema),
+            _rpcStat: (path, _pid, cred) => this.remoteRpc('stat', [path, ...fileWireOptions(cred)], FileStatSchema.nullable()),
+            _rpcLstat: (path, _pid, cred) => this.remoteRpc('lstat', [path, ...fileWireOptions(cred)], FileStatSchema.nullable()),
+            _rpcRename: (from, to, _pid, cred) => this.remoteRpc('rename', [from, to, ...fileWireOptions(cred)], UndefinedResultSchema),
+            _rpcChmod: (path, mode, _pid, cred) => this.remoteRpc('chmod', [path, mode, ...fileWireOptions(cred)], UndefinedResultSchema),
+            _rpcFsReadRange: (path, offset, length, _pid, cred) => this.remoteRpc('readRange', [path, offset, length, ...fileWireOptions(cred)], Uint8ArrayOrNullSchema),
+            _rpcReaddir: (path, _pid, cred) => this.remoteRpc('readdir', [path, ...fileWireOptions(cred)], z.array(DirectoryEntrySchema)),
+            _rpcExists: (path, _pid, cred) => this.remoteRpc('exists', [path, ...fileWireOptions(cred)], BooleanResultSchema),
+            _rpcMkdir: (path, _pid, cred) => this.remoteRpc('mkdir', [path, ...fileWireOptions(cred)], UndefinedResultSchema),
+            _rpcDeleteFile: (path, options, cred) => this.remoteRpc('deleteFile', [path, { ...(options ?? {}), ...(cred !== undefined ? { cred } : {}) }], UndefinedResultSchema),
             _rpcInstallRuntime: (spec, options) => this.remoteRpc('installRuntime', [spec, options], UnknownResultSchema),
             _rpcEnsureRuntimes: (specs, options) => this.remoteRpc('ensureRuntimes', [specs, options], UnknownResultSchema),
             _rpcListRuntimes: () => this.remoteRpc('listRuntimes', [], RuntimeListSchema),
@@ -290,6 +320,10 @@ export class NimbusSandbox {
             _rpcExposePort: (port, options) => this.remoteRpc('exposePort', [port, options], ExposedPortSchema),
             _rpcEnsureDurableApp: (input) => this.remoteRpc('ensureDurableApp', [input], EnsureDurableAppSchema),
             _rpcRemoveDurableApp: (owner) => this.remoteRpc('removeDurableApp', [{ owner }], RemoveDurableAppSchema),
+            _rpcExposeApp: (target, options) => this.remoteRpc('exposeApp', [target, options], ExposedAppSchema),
+            _rpcListApps: () => this.remoteRpc('listApps', [], z.array(AppSchema)),
+            _rpcRotateLink: (target) => this.remoteRpc('rotateLink', [target], ExposedAppSchema),
+            _rpcRemoveApp: (target) => this.remoteRpc('removeApp', [target], RemoveDurableAppSchema),
             _rpcUnexposePort: (port) => this.remoteRpc('unexposePort', [port], UnexposedPortSchema),
             _rpcDestroy: (options) => this.remoteRpc('destroy', [options], DestroyResultSchema),
         };
@@ -380,58 +414,73 @@ export class NimbusSandbox {
         this.readyPromise = null;
         return this.rpc(this.stub()._rpcDestroy(options));
     }
-    files = {
-        read: async (path) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcReadFile(path));
-        },
-        readBytes: async (path) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcReadFileBytes(path));
-        },
-        write: async (path, content) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcWriteFile(path, content));
-        },
-        stat: async (path) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcStat(path));
-        },
-        /** stat without following a symlink leaf. */
-        lstat: async (path) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcLstat(path));
-        },
-        rename: async (from, to) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcRename(from, to));
-        },
-        chmod: async (path, mode) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcChmod(path, mode));
-        },
-        /** Read `length` bytes at `offset` without materializing the whole file. */
-        readRange: async (path, offset, length) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcFsReadRange(path, offset, length));
-        },
-        list: async (path = this.root) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcReaddir(path));
-        },
-        mkdir: async (path) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcMkdir(path));
-        },
-        exists: async (path) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcExists(path));
-        },
-        delete: async (path, options = {}) => {
-            await this.ready();
-            return this.rpc(this.stub()._rpcDeleteFile(path, options));
-        },
-    };
+    /**
+     * The session file plane. Every method acts as the session's default
+     * identity for a pid-less caller — the session user for reads, writes,
+     * stat, list, mkdir, rename and chmod; the kernel for `delete` — which is
+     * the embedder's trusted surface, reached only by a caller holding the DO
+     * binding or a remote token. `files.as(cred)` returns the same API bound
+     * to `cred` instead, the view `SqliteVFS.as(cred)` gives in-process: a
+     * file the identity cannot read answers EACCES, one it owns answers.
+     * Over the remote endpoint a `cred` is refused by the dispatcher, as it is
+     * on `exec` — a token authenticates a session, not a user inside it.
+     */
+    files = this.filesAs(undefined);
+    filesAs(cred) {
+        return {
+            as: (bound) => this.filesAs(bound),
+            read: async (path) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcReadFile(path, undefined, cred));
+            },
+            readBytes: async (path) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcReadFileBytes(path, undefined, cred));
+            },
+            write: async (path, content) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcWriteFile(path, content, undefined, cred));
+            },
+            stat: async (path) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcStat(path, undefined, cred));
+            },
+            /** stat without following a symlink leaf. */
+            lstat: async (path) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcLstat(path, undefined, cred));
+            },
+            rename: async (from, to) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcRename(from, to, undefined, cred));
+            },
+            chmod: async (path, mode) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcChmod(path, mode, undefined, cred));
+            },
+            /** Read `length` bytes at `offset` without materializing the whole file. */
+            readRange: async (path, offset, length) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcFsReadRange(path, offset, length, undefined, cred));
+            },
+            list: async (path = this.root) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcReaddir(path, undefined, cred));
+            },
+            mkdir: async (path) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcMkdir(path, undefined, cred));
+            },
+            exists: async (path) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcExists(path, undefined, cred));
+            },
+            delete: async (path, options = {}) => {
+                await this.ready();
+                return this.rpc(this.stub()._rpcDeleteFile(path, options, cred));
+            },
+        };
+    }
     runtimes = {
         available: async () => {
             await this.ready();
@@ -496,6 +545,12 @@ export class NimbusSandbox {
             await this.ready();
             return this.rpc(this.stub()._rpcListPorts());
         },
+        /**
+         * Expose a port. When the port's occupant carries an identity (a node
+         * resident, a durable worker app) this is the same lazy reservation
+         * `apps.expose` makes and the result names the owner; a bare port —
+         * a dev server, a python resident — is written port-only as before.
+         */
         expose: async (port, options = {}) => {
             await this.ready();
             const result = await this.rpc(this.stub()._rpcExposePort(port, options));
@@ -504,6 +559,7 @@ export class NimbusSandbox {
                 url: this.portUrl(port, {
                     visibility: result.visibility ?? 'scoped',
                     capability: result.capability ?? undefined,
+                    name: result.name ?? undefined,
                 }),
             };
         },
@@ -532,6 +588,51 @@ export class NimbusSandbox {
         },
         url: (port, options = {}) => this.portUrl(port, options),
     };
+    /**
+     * The application surface: every server is durable under its identity
+     * from the moment it is spawned; exposing it reserves its port for that
+     * identity, names it, and (when public) mints the capability its shared
+     * URL is built on. `ports.expose` is the port-addressed alias of
+     * `apps.expose`; the identity-addressed verbs live here.
+     */
+    apps = {
+        list: async () => {
+            await this.ready();
+            const apps = await this.rpc(this.stub()._rpcListApps());
+            return apps.map((app) => ({
+                ...app,
+                url: app.port === null ? undefined : this.portUrl(app.port, {
+                    visibility: app.visibility,
+                    capability: app.capability ?? undefined,
+                    name: app.name ?? undefined,
+                }) ?? app.url ?? undefined,
+            }));
+        },
+        expose: async (target, options = {}) => {
+            await this.ready();
+            const result = await this.rpc(this.stub()._rpcExposeApp(target, options));
+            return this.exposedApp(result);
+        },
+        rotateLink: async (target) => {
+            await this.ready();
+            const result = await this.rpc(this.stub()._rpcRotateLink(target));
+            return this.exposedApp(result);
+        },
+        remove: async (target) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcRemoveApp(target));
+        },
+    };
+    exposedApp(result) {
+        return {
+            ...result,
+            url: this.portUrl(result.port, {
+                visibility: result.visibility,
+                capability: result.capability ?? undefined,
+                name: result.name ?? undefined,
+            }) ?? result.url ?? undefined,
+        };
+    }
     tools(options = {}) {
         const namespace = options.namespace ?? this.profile.tools?.namespace ?? 'nimbus';
         const kind = options.kind ?? this.profile.tools?.kind ?? 'nimbus';
@@ -585,6 +686,10 @@ export class NimbusSandbox {
                 exposePort: { execute: (input) => this.ports.expose(typeof input === 'number' ? input : input.port) },
                 unexposePort: { execute: (input) => this.ports.unexpose(typeof input === 'number' ? input : input.port) },
                 listPorts: { execute: () => this.ports.list() },
+                exposeApp: { execute: (input) => typeof input === 'object' && input !== null && 'target' in input
+                        ? this.apps.expose(input.target, { visibility: input.visibility, name: input.name })
+                        : this.apps.expose(input) },
+                listApps: { execute: () => this.apps.list() },
                 installRuntime: { execute: (spec) => this.runtimes.install(spec) },
                 listRuntimes: { execute: () => this.runtimes.list() },
             },
@@ -618,6 +723,13 @@ export class NimbusSandbox {
     }
     execOptions(options) {
         const normalized = { ...options };
+        if (typeof normalized.cwd === 'string') {
+            // The session shell only understands absolute paths; a relative cwd
+            // forwarded verbatim used to reach it anyway — `pwd` echoed the
+            // literal string and every write beneath it landed ENOENT. Resolve
+            // against the sandbox root here, at the SDK boundary.
+            normalized.cwd = resolveSandboxCwd(this.root, normalized.cwd);
+        }
         if (normalized.shellId) {
             // A named shell owns its cwd, so defaulting one here would reset it on
             // every call. The sandbox root is only where a NEW shell starts.
@@ -654,23 +766,26 @@ export class NimbusSandbox {
     portUrl(port, options = {}) {
         const hostSuffix = this.config.previewHostSuffix;
         if (hostSuffix && !this.profile.preview?.pathStyle && isPreviewHostSafeSid(this.id)) {
-            // The public form names its bearer in the label: a public port with a
+            // The name stands where the port stands when the app has one. The
+            // public form names its bearer in the label: a public port with a
             // capability builds the unauthenticated host, anything else keeps the
             // session-attached one.
+            const label = options.name ?? port;
             if (options.visibility === 'public' && options.capability !== undefined) {
-                return `https://${buildPublicPreviewHost(this.id, port, options.capability, hostSuffix)}/`;
+                return `https://${buildPublicPreviewHost(this.id, label, options.capability, hostSuffix)}/`;
             }
-            return `https://${buildPreviewHost(this.id, port, hostSuffix)}/`;
+            return `https://${buildPreviewHost(this.id, label, hostSuffix)}/`;
         }
+        const door = options.name !== undefined ? `/app/${options.name}/` : `/port/${port}/`;
         const explicit = this.profile.preview?.baseUrl;
         if (explicit) {
             const base = trimTrailingSlashes(explicit.replace('{sessionId}', encodeURIComponent(this.id)));
-            return `${base}/port/${port}/`;
+            return `${base}${door}`;
         }
         const endpoint = this.config.endpoint ? trimTrailingSlashes(this.config.endpoint) : '';
         if (!endpoint)
             return undefined;
-        return `${endpoint}/s/${encodeURIComponent(this.id)}/port/${port}/`;
+        return `${endpoint}/s/${encodeURIComponent(this.id)}${door}`;
     }
     async rpc(promise) {
         const value = await promise;
@@ -814,6 +929,30 @@ function trimTrailingSlashes(value) {
         end--;
     return value.slice(0, end);
 }
+/**
+ * Resolve an exec `cwd` to the absolute POSIX path the session shell needs.
+ * Absolute inputs pass through untouched; relative ones resolve against the
+ * sandbox root, collapsing `.`/`..` segments (`rel` → `<root>/rel`,
+ * `../x` → the sibling of root). The session filesystem is always POSIX —
+ * `node:path` is not portable across every SDK host, so this resolves by
+ * segment instead of importing it.
+ */
+function resolveSandboxCwd(root, cwd) {
+    if (cwd.startsWith('/'))
+        return cwd;
+    const segments = [];
+    for (const seg of `${root}/${cwd}`.split('/')) {
+        if (seg === '..') {
+            // A '..' at the filesystem root stays at the root, POSIX-style.
+            if (segments.length > 0)
+                segments.pop();
+        }
+        else if (seg !== '' && seg !== '.') {
+            segments.push(seg);
+        }
+    }
+    return '/' + segments.join('/');
+}
 function disposeSdkRpcResult(value) {
     if ((typeof value !== 'object' && typeof value !== 'function') || value === null)
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/sdk",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Nimbus SDK — Worker embedder, programmatic sandboxes, token mint, and client helpers.",
   "keywords": [
     "cloudflare",
@@ -72,12 +72,12 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@nimbus-sh/core": "^0.7.0",
-    "@nimbus-sh/worker": "^0.5.0"
+    "@nimbus-sh/core": "^0.9.0",
+    "@nimbus-sh/worker": "^0.7.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250327.0",
-    "@nimbus-sh/worker": "^0.5.0",
+    "@nimbus-sh/worker": "^0.7.0",
     "typescript": "^5.7.0"
   },
   "publishConfig": {
@@ -85,6 +85,6 @@
   },
   "dependencies": {
     "zod": "^4.4.3",
-    "@nimbus-sh/core": "^0.7.0"
+    "@nimbus-sh/core": "^0.9.0"
   }
 }