@openclaw/mxc-sandbox 0.0.0 → 2026.7.2-beta.1

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-helper.js

@@ -0,0 +1,184 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { spawn } from 'child_process';
+import { resolveBinaryAndCommonArgs } from './helper.js';
+import { mxcErrorFromCode } from './errors.js';
+import { diagLog } from './diagnostic.js';
+export const STATE_AWARE_VERSION = '0.6.0-alpha';
+// Wire-format cross-cutting fields that live at the envelope's top level.
+// Anything else on a per-(backend, phase) Config is backend-specific and is
+// nested under `experimental.<backend>.<phase>`.
+export const CROSS_CUTTING_FIELDS = ['filesystem', 'network', 'ui', 'process'];
+// Per-backend wire-format prefix. Each value mirrors the corresponding
+// Rust `<Backend>Runner::ID_PREFIX` const and is the leading segment of a
+// `sandboxId` produced by that backend. Each future state-aware backend
+// declares its own `<BACKEND>_ID_PREFIX` const here.
+export const ISOLATION_SESSION_ID_PREFIX = 'iso';
+// Mapping from a sandboxId's leading prefix segment to the wire-format
+// backend key. Extended as more state-aware backends opt in.
+export const PREFIX_TO_BACKEND = {
+    [ISOLATION_SESSION_ID_PREFIX]: 'isolation_session',
+};
+/**
+ * Resolves the wire-format backend key for a sandbox id by reading its
+ * leading prefix segment. Throws an `MxcError` with `code: 'malformed_id'`
+ * when the id has no recognised prefix.
+ */
+export function backendForSandboxId(sandboxId) {
+    const colon = sandboxId.indexOf(':');
+    if (colon < 0) {
+        throw mxcErrorFromCode('malformed_id', `sandboxId must carry a backend prefix: ${sandboxId}`);
+    }
+    const prefix = sandboxId.slice(0, colon);
+    const backend = PREFIX_TO_BACKEND[prefix];
+    if (!backend) {
+        throw mxcErrorFromCode('malformed_id', `sandboxId prefix '${prefix}' does not match a known state-aware backend`);
+    }
+    return backend;
+}
+/**
+ * Constructs the wire-format JSON-shaped envelope for a state-aware request
+ * from a per-(backend, phase) Config. Lifts cross-cutting fields
+ * (filesystem, network, ui, process) to envelope top-level; nests any
+ * remaining backend-specific fields under `experimental.<backend>.<phase>`.
+ */
+export function buildStateAwareEnvelope(args) {
+    const { phase, backendKey, containment, sandboxId, config } = args;
+    // Copy of config; fields are removed as they are lifted into the envelope.
+    // Anything left becomes experimental.<backend>.<phase>.
+    const backendSpecific = { ...(config ?? {}) };
+    const version = (typeof backendSpecific.version === 'string' && backendSpecific.version) || STATE_AWARE_VERSION;
+    delete backendSpecific.version;
+    const envelope = { version, phase };
+    if (containment) {
+        envelope.containment = containment;
+    }
+    if (sandboxId) {
+        envelope.sandboxId = sandboxId;
+    }
+    for (const field of CROSS_CUTTING_FIELDS) {
+        if (backendSpecific[field] !== undefined) {
+            envelope[field] = backendSpecific[field];
+            delete backendSpecific[field];
+        }
+    }
+    if (Object.keys(backendSpecific).length > 0) {
+        envelope.experimental = { [backendKey]: { [phase]: backendSpecific } };
+    }
+    return envelope;
+}
+/**
+ * Parses the single-envelope JSON stdout produced by non-exec state-aware
+ * phases. Throws the corresponding `MxcError` on `{error}`, returns the
+ * unwrapped `result` on `{result}`.
+ */
+export function parseNonExecResponse(stdout) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout.trim());
+    }
+    catch (e) {
+        throw new Error(`Failed to parse state-aware response envelope: ${e.message}`);
+    }
+    if (parsed && typeof parsed === 'object') {
+        if ('error' in parsed) {
+            const env = parsed.error;
+            throw mxcErrorFromCode(env.code, env.message, env.details);
+        }
+        if ('result' in parsed) {
+            return parsed.result;
+        }
+    }
+    throw new Error(`Unexpected state-aware response envelope shape: ${stdout}`);
+}
+/**
+ * Attempts to parse stdout as an `{error}` envelope. Returns the parsed
+ * envelope when stdout is exactly that, or `null` otherwise (script output
+ * mistaken for an envelope is suppressed). Used by exec to discriminate
+ * dispatch failure from script failure.
+ */
+export function tryParseErrorEnvelope(stdout) {
+    try {
+        const parsed = JSON.parse(stdout.trim());
+        if (parsed && typeof parsed === 'object' && 'error' in parsed &&
+            parsed.error?.code) {
+            return parsed;
+        }
+    }
+    catch {
+        // Not JSON. Definitely script output.
+    }
+    return null;
+}
+let spawnImpl = spawn;
+/**
+ * Test-only hook: replace the `child_process.spawn` implementation used by
+ * non-exec state-aware calls and the buffered `execInSandboxAsync`. Not
+ * exported from `index.ts` — production code uses the real `spawn`.
+ */
+export function _setSpawnImpl(fn) {
+    spawnImpl = fn;
+}
+/** Test-only hook: restore the default `child_process.spawn`. */
+export function _resetSpawnImpl() {
+    spawnImpl = spawn;
+}
+/**
+ * Spawns the executor with the given envelope, captures stdout/stderr,
+ * and resolves on close. Honors `options.signal` for cancellation.
+ */
+export function spawnAndCollect(envelope, options) {
+    return new Promise((resolve, reject) => {
+        const signal = options.signal;
+        if (signal?.aborted) {
+            reject(signal.reason ?? new Error('Aborted'));
+            return;
+        }
+        let executablePath;
+        let args;
+        try {
+            ({ executablePath, args } = resolveBinaryAndCommonArgs(JSON.stringify(envelope), options));
+        }
+        catch (err) {
+            reject(err);
+            return;
+        }
+        diagLog(`state-aware: spawning phase=${envelope.phase}`);
+        const child = spawnImpl(executablePath, args, {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        let stdoutData = '';
+        let stderrData = '';
+        child.stdout?.on('data', (d) => {
+            stdoutData += typeof d === 'string' ? d : d.toString('utf-8');
+        });
+        child.stderr?.on('data', (d) => {
+            stderrData += typeof d === 'string' ? d : d.toString('utf-8');
+        });
+        const onAbort = () => {
+            child.kill();
+        };
+        if (signal) {
+            signal.addEventListener('abort', onAbort, { once: true });
+        }
+        child.on('close', (...a) => {
+            const code = a[0];
+            if (signal) {
+                signal.removeEventListener('abort', onAbort);
+            }
+            if (signal?.aborted) {
+                reject(signal.reason ?? new Error('Aborted'));
+                return;
+            }
+            resolve({ stdout: stdoutData, stderr: stderrData, exitCode: code ?? -1 });
+        });
+        child.on('error', (...a) => {
+            reject(a[0]);
+        });
+    });
+}
+export async function nonExecCall(envelope, options) {
+    const { stdout } = await spawnAndCollect(envelope, options);
+    return parseNonExecResponse(stdout);
+}
+//# sourceMappingURL=state-aware-helper.js.map

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-aware-helper.js","sourceRoot":"","sources":["../src/state-aware-helper.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD,0EAA0E;AAC1E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAU,CAAC;AAExF,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,qDAAqD;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD,uEAAuE;AACvE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAiD;IAC7E,CAAC,2BAA2B,CAAC,EAAE,mBAAmB;CACnD,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,gBAAgB,CAAC,cAAc,EAAE,0CAA0C,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,gBAAgB,CAAC,cAAc,EAAE,qBAAqB,MAAM,8CAA8C,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAuB;IAC7D,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnE,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,eAAe,GAA4B,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,OAAO,eAAe,CAAC,OAAO,KAAK,QAAQ,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC;IAChH,OAAO,eAAe,CAAC,OAAO,CAAC;IAE/B,MAAM,QAAQ,GAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACzC,QAAQ,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACzC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAI,MAAc;IACpD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kDAAmD,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,GAAG,GAAI,MAA4B,CAAC,KAAK,CAAC;YAChD,MAAM,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YACvB,OAAQ,MAAgC,CAAC,MAAM,CAAC;QAClD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IACE,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,MAAM;YACxD,MAA4B,CAAC,KAAK,EAAE,IAAI,EACzC,CAAC;YACD,OAAO,MAA2B,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,IAAI,SAAS,GAAc,KAA6B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAAa;IACzC,SAAS,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,eAAe;IAC7B,SAAS,GAAG,KAA6B,CAAC;AAC5C,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAiC,EACjC,OAA4B;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QAED,OAAO,CAAC,+BAA+B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE;YAC5C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAKA,CAAC;QAEF,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAkB,EAAE,EAAE;YAC9C,UAAU,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAkB,EAAE,EAAE;YAC9C,UAAU,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,CAAY,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAkB,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,CAAY,EAAE,EAAE;YACpC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAU,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAiC,EACjC,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,oBAAoB,CAAI,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-types.d.ts

@@ -0,0 +1,130 @@
+import { ContainmentBackend, FilesystemConfig, ProcessConfig } from './types.js';
+/**
+ * Lifecycle phase in a state-aware sandbox request.
+ */
+export type Phase = 'provision' | 'start' | 'exec' | 'stop' | 'deprovision';
+/**
+ * Subset of `ContainmentBackend` whose backends participate in the state-aware
+ * lifecycle. Extended as more backends opt in.
+ */
+export type StateAwareContainmentBackend = Extract<ContainmentBackend, 'isolation_session'>;
+/**
+ * Branded sandbox identifier returned by `provisionSandbox` and routed back
+ * to the same backend by subsequent phases. The runtime value is a plain
+ * string; the brand exists at compile time only — TypeScript prevents
+ * callers from passing a bare string, or a `SandboxId` from one backend
+ * where one for a different backend is expected.
+ */
+export type SandboxId<C extends StateAwareContainmentBackend> = string & {
+    readonly __mxcBrand: 'SandboxId';
+    readonly __mxcBackend: C;
+};
+declare const ISO_USER_INSPECT: unique symbol;
+/**
+ * Entra credentials, supplied at provision to opt into an Entra-backed
+ * sandbox and at start to authenticate the session. `wamToken` is treated
+ * as a secret: `util.inspect` and `console.log` redact it. `JSON.stringify`
+ * is unaffected — the wire envelope carries the token verbatim.
+ */
+export declare class IsolationSessionUserConfig {
+    readonly upn: string;
+    readonly wamToken: string;
+    constructor(upn: string, wamToken: string);
+    [ISO_USER_INSPECT](): string;
+}
+export interface IsolationSessionProvisionConfig {
+    /** Schema version (semver). When omitted, the SDK fills in its own SUPPORTED_VERSION. */
+    version?: string;
+    filesystem?: FilesystemConfig;
+    /**
+     * Optional Entra credentials. When supplied, provisioning uses the Entra
+     * identity for the sandbox; the same `user` must be supplied to
+     * `startSandbox`. Hosts that don't support this surface `backend_unavailable`.
+     */
+    user?: IsolationSessionUserConfig;
+}
+export interface IsolationSessionStartConfig {
+    /** Schema version (semver). */
+    version?: string;
+    /**
+     * Selected IsoSession size profile. Unknown values are warned and
+     * downgraded to `'composable'` on the Rust side.
+     */
+    configurationId?: 'small' | 'medium' | 'large' | 'composable';
+    /**
+     * Entra credentials. Required when the sandbox was provisioned with a
+     * `user` bundle; rejected otherwise. When required, `upn` must match the
+     * UPN supplied at provision (case-insensitive).
+     */
+    user?: IsolationSessionUserConfig;
+}
+export interface IsolationSessionExecConfig {
+    /** Schema version (semver). */
+    version?: string;
+    process: ProcessConfig;
+}
+export interface IsolationSessionStopConfig {
+    /** Schema version (semver). */
+    version?: string;
+}
+export interface IsolationSessionDeprovisionConfig {
+    /** Schema version (semver). */
+    version?: string;
+}
+/**
+ * IsolationSession's provision-phase metadata: the per-instance agent user
+ * account name minted for this sandbox.
+ */
+export interface IsolationSessionProvisionMetadata {
+    agentUserName: string;
+}
+/**
+ * Per-backend per-phase typed Config bundle. Selects the correct Config
+ * bundle for the backend type parameter.
+ */
+export type ConfigsForBackend<C extends StateAwareContainmentBackend> = C extends 'isolation_session' ? {
+    provision: IsolationSessionProvisionConfig;
+    start: IsolationSessionStartConfig;
+    exec: IsolationSessionExecConfig;
+    stop: IsolationSessionStopConfig;
+    deprovision: IsolationSessionDeprovisionConfig;
+} : never;
+export type ProvisionConfigFor<C extends StateAwareContainmentBackend> = ConfigsForBackend<C>['provision'];
+export type StartConfigFor<C extends StateAwareContainmentBackend> = ConfigsForBackend<C>['start'];
+export type ExecConfigFor<C extends StateAwareContainmentBackend> = ConfigsForBackend<C>['exec'];
+export type StopConfigFor<C extends StateAwareContainmentBackend> = ConfigsForBackend<C>['stop'];
+export type DeprovisionConfigFor<C extends StateAwareContainmentBackend> = ConfigsForBackend<C>['deprovision'];
+/**
+ * Per-backend per-phase metadata bundle. Backends that don't return
+ * metadata for a given phase omit that key.
+ */
+export interface StateAwareMetadata {
+    isolation_session?: {
+        provision?: IsolationSessionProvisionMetadata;
+    };
+}
+type MetadataForPhase<C extends StateAwareContainmentBackend, Phase extends string> = Phase extends keyof NonNullable<StateAwareMetadata[C]> ? NonNullable<StateAwareMetadata[C]>[Phase] : undefined;
+export type ProvisionMetadataFor<C extends StateAwareContainmentBackend> = MetadataForPhase<C, 'provision'>;
+export type StartMetadataFor<C extends StateAwareContainmentBackend> = MetadataForPhase<C, 'start'>;
+export type StopMetadataFor<C extends StateAwareContainmentBackend> = MetadataForPhase<C, 'stop'>;
+export type DeprovisionMetadataFor<C extends StateAwareContainmentBackend> = MetadataForPhase<C, 'deprovision'>;
+export interface ProvisionResult<C extends StateAwareContainmentBackend> {
+    sandboxId: SandboxId<C>;
+    metadata?: ProvisionMetadataFor<C>;
+}
+export interface StartResult<C extends StateAwareContainmentBackend> {
+    metadata?: StartMetadataFor<C>;
+}
+export interface StopResult<C extends StateAwareContainmentBackend> {
+    metadata?: StopMetadataFor<C>;
+}
+export interface DeprovisionResult<C extends StateAwareContainmentBackend> {
+    metadata?: DeprovisionMetadataFor<C>;
+}
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export {};
+//# sourceMappingURL=state-aware-types.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-aware-types.d.ts","sourceRoot":"","sources":["../src/state-aware-types.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;AAE5E;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,4BAA4B,IAC1D,MAAM,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAA;CAAE,CAAC;AAE1E,QAAA,MAAM,gBAAgB,eAA2C,CAAC;AAElE;;;;;GAKG;AACH,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAKzC,CAAC,gBAAgB,CAAC,IAAI,MAAM;CAG7B;AAOD,MAAM,WAAW,+BAA+B;IAC9C,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,IAAI,CAAC,EAAE,0BAA0B,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAC1C,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,YAAY,CAAC;IAC9D;;;;OAIG;IACH,IAAI,CAAC,EAAE,0BAA0B,CAAC;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iCAAiC;IAChD,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iCAAiC;IAChD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,4BAA4B,IAClE,CAAC,SAAS,mBAAmB,GACzB;IACE,SAAS,EAAE,+BAA+B,CAAC;IAC3C,KAAK,EAAE,2BAA2B,CAAC;IACnC,IAAI,EAAE,0BAA0B,CAAC;IACjC,IAAI,EAAE,0BAA0B,CAAC;IACjC,WAAW,EAAE,iCAAiC,CAAC;CAChD,GACD,KAAK,CAAC;AAEZ,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,4BAA4B,IACnE,iBAAiB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;AACpC,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,4BAA4B,IAC/D,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAChC,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,4BAA4B,IAC9D,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/B,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,4BAA4B,IAC9D,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/B,MAAM,MAAM,oBAAoB,CAAC,CAAC,SAAS,4BAA4B,IACrE,iBAAiB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,EAAE;QAClB,SAAS,CAAC,EAAE,iCAAiC,CAAC;KAE/C,CAAC;CAEH;AAED,KAAK,gBAAgB,CAAC,CAAC,SAAS,4BAA4B,EAAE,KAAK,SAAS,MAAM,IAChF,KAAK,SAAS,MAAM,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAClD,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GACzC,SAAS,CAAC;AAEhB,MAAM,MAAM,oBAAoB,CAAC,CAAC,SAAS,4BAA4B,IAAI,gBAAgB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AAC5G,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,4BAA4B,IAAI,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpG,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,4BAA4B,IAAI,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAClG,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,4BAA4B,IAAI,gBAAgB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAEhH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,4BAA4B;IACrE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,4BAA4B;IACjE,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,4BAA4B;IAChE,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,4BAA4B;IACvE,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-types.js

@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+const ISO_USER_INSPECT = Symbol.for('nodejs.util.inspect.custom');
+/**
+ * Entra credentials, supplied at provision to opt into an Entra-backed
+ * sandbox and at start to authenticate the session. `wamToken` is treated
+ * as a secret: `util.inspect` and `console.log` redact it. `JSON.stringify`
+ * is unaffected — the wire envelope carries the token verbatim.
+ */
+export class IsolationSessionUserConfig {
+    upn;
+    wamToken;
+    constructor(upn, wamToken) {
+        this.upn = upn;
+        this.wamToken = wamToken;
+    }
+    [ISO_USER_INSPECT]() {
+        return `IsolationSessionUserConfig { upn: '${this.upn}', wamToken: '<redacted>' }`;
+    }
+}
+//# sourceMappingURL=state-aware-types.js.map

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-aware-types.js","sourceRoot":"","sources":["../src/state-aware-types.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AA6BlC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IAC5B,GAAG,CAAS;IACZ,QAAQ,CAAS;IAE1B,YAAY,GAAW,EAAE,QAAgB;QACvC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,CAAC,gBAAgB,CAAC;QAChB,OAAO,sCAAsC,IAAI,CAAC,GAAG,6BAA6B,CAAC;IACrF,CAAC;CACF"}

package/node_modules/@microsoft/mxc-sdk/dist/state-aware.d.ts

@@ -0,0 +1,39 @@
+import pty from 'node-pty';
+import { SandboxSpawnOptions } from './sandbox.js';
+import { DeprovisionConfigFor, DeprovisionResult, ExecConfigFor, ExecResult, ProvisionConfigFor, ProvisionResult, SandboxId, StartConfigFor, StartResult, StateAwareContainmentBackend, StopConfigFor, StopResult } from './state-aware-types.js';
+/**
+ * Provisions a state-aware sandbox of the requested backend. Returns a
+ * branded sandbox id and any provision-time metadata the backend produces.
+ */
+export declare function provisionSandbox<C extends StateAwareContainmentBackend>(containment: C, config?: ProvisionConfigFor<C>, options?: SandboxSpawnOptions): Promise<ProvisionResult<C>>;
+/**
+ * Starts a previously provisioned sandbox. The backend is inferred from
+ * the `sandboxId` prefix.
+ */
+export declare function startSandbox<C extends StateAwareContainmentBackend>(sandboxId: SandboxId<C>, config?: StartConfigFor<C>, options?: SandboxSpawnOptions): Promise<StartResult<C>>;
+/**
+ * Streams a script execution inside a started sandbox. Returns an
+ * `IPty` for live stdout/stderr/exit handling, mirroring `spawnSandbox`.
+ * On dispatch failure the executor emits a single error envelope on stdout;
+ * the SDK does not parse it here — callers consuming `IPty.onData` see the
+ * raw bytes. Use `execInSandboxAsync` when typed-error throwing is needed.
+ */
+export declare function execInSandbox<C extends StateAwareContainmentBackend>(sandboxId: SandboxId<C>, config: ExecConfigFor<C>, options?: SandboxSpawnOptions): pty.IPty;
+/**
+ * Buffered exec convenience. Resolves with `{stdout, stderr, exitCode}`
+ * on script completion. Throws an `MxcError` (with the wire-format `code`
+ * field set) when the executor reports a dispatch failure (recognised by
+ * exit != 0 and stdout being a complete `{error}` envelope).
+ */
+export declare function execInSandboxAsync<C extends StateAwareContainmentBackend>(sandboxId: SandboxId<C>, config: ExecConfigFor<C>, options?: SandboxSpawnOptions): Promise<ExecResult>;
+/**
+ * Stops a started sandbox without releasing its provision-side resources.
+ * The same sandbox can be started again via `startSandbox`.
+ */
+export declare function stopSandbox<C extends StateAwareContainmentBackend>(sandboxId: SandboxId<C>, config?: StopConfigFor<C>, options?: SandboxSpawnOptions): Promise<StopResult<C>>;
+/**
+ * Releases all backend resources associated with a provisioned sandbox.
+ * The id becomes invalid after this call returns successfully.
+ */
+export declare function deprovisionSandbox<C extends StateAwareContainmentBackend>(sandboxId: SandboxId<C>, config?: DeprovisionConfigFor<C>, options?: SandboxSpawnOptions): Promise<DeprovisionResult<C>>;
+//# sourceMappingURL=state-aware.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/state-aware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-aware.d.ts","sourceRoot":"","sources":["../src/state-aware.ts"],"names":[],"mappings":"AAGA,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,kBAAkB,EAElB,eAAe,EACf,SAAS,EACT,cAAc,EACd,WAAW,EACX,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACX,MAAM,wBAAwB,CAAC;AAShC;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,4BAA4B,EAC3E,WAAW,EAAE,CAAC,EACd,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAC9B,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAe7B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,CAAC,SAAS,4BAA4B,EACvE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAC1B,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CASzB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,4BAA4B,EAClE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,OAAO,GAAE,mBAAwB,GAChC,GAAG,CAAC,IAAI,CA4BV;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,SAAS,4BAA4B,EAC7E,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,CAAC,SAAS,4BAA4B,EACtE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CASxB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,SAAS,4BAA4B,EAC7E,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAChC,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAS/B"}

package/node_modules/@microsoft/mxc-sdk/dist/state-aware.js

@@ -0,0 +1,128 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import pty from 'node-pty';
+import { resolveBinaryAndCommonArgs } from './helper.js';
+import { mxcErrorFromCode } from './errors.js';
+import { diagLog } from './diagnostic.js';
+import { backendForSandboxId, buildStateAwareEnvelope, nonExecCall, spawnAndCollect, tryParseErrorEnvelope, } from './state-aware-helper.js';
+/**
+ * Provisions a state-aware sandbox of the requested backend. Returns a
+ * branded sandbox id and any provision-time metadata the backend produces.
+ */
+export async function provisionSandbox(containment, config, options = {}) {
+    const envelope = buildStateAwareEnvelope({
+        phase: 'provision',
+        backendKey: containment,
+        containment,
+        config: config,
+    });
+    const result = await nonExecCall(envelope, options);
+    return {
+        sandboxId: result.sandboxId,
+        metadata: result.metadata,
+    };
+}
+/**
+ * Starts a previously provisioned sandbox. The backend is inferred from
+ * the `sandboxId` prefix.
+ */
+export async function startSandbox(sandboxId, config, options = {}) {
+    const backendKey = backendForSandboxId(sandboxId);
+    const envelope = buildStateAwareEnvelope({
+        phase: 'start',
+        backendKey,
+        sandboxId,
+        config: config,
+    });
+    return nonExecCall(envelope, options);
+}
+/**
+ * Streams a script execution inside a started sandbox. Returns an
+ * `IPty` for live stdout/stderr/exit handling, mirroring `spawnSandbox`.
+ * On dispatch failure the executor emits a single error envelope on stdout;
+ * the SDK does not parse it here — callers consuming `IPty.onData` see the
+ * raw bytes. Use `execInSandboxAsync` when typed-error throwing is needed.
+ */
+export function execInSandbox(sandboxId, config, options = {}) {
+    const backendKey = backendForSandboxId(sandboxId);
+    const envelope = buildStateAwareEnvelope({
+        phase: 'exec',
+        backendKey,
+        sandboxId,
+        config: config,
+    });
+    const { executablePath, args } = resolveBinaryAndCommonArgs(JSON.stringify(envelope), options);
+    diagLog(`state-aware: spawning exec via PTY`);
+    const ptyProcess = pty.spawn(executablePath, args, {
+        name: 'xterm-color',
+        cols: 120,
+        rows: 80,
+        cwd: process.cwd(),
+        ...options.ptyOptions,
+    });
+    const signal = options.signal;
+    if (signal) {
+        if (signal.aborted) {
+            ptyProcess.kill();
+        }
+        else {
+            const onAbort = () => ptyProcess.kill();
+            signal.addEventListener('abort', onAbort, { once: true });
+            ptyProcess.onExit(() => signal.removeEventListener('abort', onAbort));
+        }
+    }
+    return ptyProcess;
+}
+/**
+ * Buffered exec convenience. Resolves with `{stdout, stderr, exitCode}`
+ * on script completion. Throws an `MxcError` (with the wire-format `code`
+ * field set) when the executor reports a dispatch failure (recognised by
+ * exit != 0 and stdout being a complete `{error}` envelope).
+ */
+export async function execInSandboxAsync(sandboxId, config, options = {}) {
+    const backendKey = backendForSandboxId(sandboxId);
+    const envelope = buildStateAwareEnvelope({
+        phase: 'exec',
+        backendKey,
+        sandboxId,
+        config: config,
+    });
+    const { stdout, stderr, exitCode } = await spawnAndCollect(envelope, options);
+    if (exitCode !== 0) {
+        const errorEnvelope = tryParseErrorEnvelope(stdout);
+        if (errorEnvelope) {
+            const e = errorEnvelope.error;
+            throw mxcErrorFromCode(e.code, e.message, e.details);
+        }
+    }
+    return { stdout, stderr, exitCode };
+}
+/**
+ * Stops a started sandbox without releasing its provision-side resources.
+ * The same sandbox can be started again via `startSandbox`.
+ */
+export async function stopSandbox(sandboxId, config, options = {}) {
+    const backendKey = backendForSandboxId(sandboxId);
+    const envelope = buildStateAwareEnvelope({
+        phase: 'stop',
+        backendKey,
+        sandboxId,
+        config: config,
+    });
+    return nonExecCall(envelope, options);
+}
+/**
+ * Releases all backend resources associated with a provisioned sandbox.
+ * The id becomes invalid after this call returns successfully.
+ */
+export async function deprovisionSandbox(sandboxId, config, options = {}) {
+    const backendKey = backendForSandboxId(sandboxId);
+    const envelope = buildStateAwareEnvelope({
+        phase: 'deprovision',
+        backendKey,
+        sandboxId,
+        config: config,
+    });
+    return nonExecCall(envelope, options);
+}
+//# sourceMappingURL=state-aware.js.map

package/node_modules/@microsoft/mxc-sdk/dist/state-aware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-aware.js","sourceRoot":"","sources":["../src/state-aware.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAgB1C,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAc,EACd,MAA8B,EAC9B,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE,WAAW;QAClB,UAAU,EAAE,WAAW;QACvB,WAAW;QACX,MAAM,EAAE,MAA6C;KACtD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,QAAQ,EACR,OAAO,CACR,CAAC;IACF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAyB;QAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAuB,EACvB,MAA0B,EAC1B,UAA+B,EAAE;IAEjC,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAM,CAAC;IACvD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE,OAAO;QACd,UAAU;QACV,SAAS;QACT,MAAM,EAAE,MAA6C;KACtD,CAAC,CAAC;IACH,OAAO,WAAW,CAAiB,QAAQ,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAuB,EACvB,MAAwB,EACxB,UAA+B,EAAE;IAEjC,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAM,CAAC;IACvD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE,MAAM;QACb,UAAU;QACV,SAAS;QACT,MAAM,EAAE,MAA4C;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/F,OAAO,CAAC,oCAAoC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE;QACjD,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,EAAE;QACR,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,GAAG,OAAO,CAAC,UAAU;KACtB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAuB,EACvB,MAAwB,EACxB,UAA+B,EAAE;IAEjC,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAM,CAAC;IACvD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE,MAAM;QACb,UAAU;QACV,SAAS;QACT,MAAM,EAAE,MAA4C;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE9E,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC;YAC9B,MAAM,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAuB,EACvB,MAAyB,EACzB,UAA+B,EAAE;IAEjC,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAM,CAAC;IACvD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE,MAAM;QACb,UAAU;QACV,SAAS;QACT,MAAM,EAAE,MAA6C;KACtD,CAAC,CAAC;IACH,OAAO,WAAW,CAAgB,QAAQ,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAuB,EACvB,MAAgC,EAChC,UAA+B,EAAE;IAEjC,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAM,CAAC;IACvD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE,aAAa;QACpB,UAAU;QACV,SAAS;QACT,MAAM,EAAE,MAA6C;KACtD,CAAC,CAAC;IACH,OAAO,WAAW,CAAuB,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC"}