@openclaw/mxc-sandbox 0.0.0 → 2026.7.2-beta.1

package/node_modules/@microsoft/mxc-sdk/bin/x64/_manifest/spdx_2.2/manifest.spdx.json.sha256

@@ -0,0 +1 @@
+072c25336487841e4b7b9a03f2532bac8835d04f74ad4a0bc9404a07f189e35c

package/node_modules/@microsoft/mxc-sdk/dist/diagnostic.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Send a diagnostic log message to the MXC diagnostic console.
+ *
+ * Messages are best-effort and non-blocking. If the console is not
+ * running, the message is silently dropped.
+ *
+ * Each message is sent as a newline-delimited JSON envelope so the
+ * console can split coalesced stream writes back into individual messages.
+ *
+ * @param message - The log message to send
+ */
+export declare function diagLog(message: string): void;
+/**
+ * Close the diagnostic pipe connection. Called during cleanup.
+ */
+export declare function diagClose(): void;
+//# sourceMappingURL=diagnostic.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic.d.ts","sourceRoot":"","sources":["../src/diagnostic.ts"],"names":[],"mappings":"AAsHA;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAgB7C;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,IAAI,CAUhC"}

package/node_modules/@microsoft/mxc-sdk/dist/diagnostic.js

@@ -0,0 +1,150 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+/**
+ * Diagnostic logging for the MXC SDK.
+ *
+ * When the MXC diagnostic console (`mxc-diagnostic-console.exe`) is running,
+ * this module sends log messages to it over the shared named pipe.
+ * Messages are best-effort: if the console is not running or the pipe
+ * write fails, the error is silently ignored.
+ *
+ * Enabled by environment variable `MXC_DIAG_CONSOLE=1`.
+ */
+import { execSync } from 'child_process';
+import * as net from 'net';
+import * as os from 'os';
+/**
+ * Compute the per-user pipe name (includes current user's SID).
+ * Falls back to the base name if the SID cannot be determined.
+ *
+ * Windows-only — the diagnostic console only runs on Windows. On other
+ * platforms this returns the base name (which is never used because
+ * `ensurePipe` short-circuits below) without spawning `whoami`. The
+ * `whoami /user /fo csv /nh` invocation uses Windows-only flags that
+ * cause GNU/BSD `whoami` to print "usage: whoami" on stderr — visible
+ * to any caller that inherits our stdio (e.g. mxc-exec-mac under a pty).
+ */
+function getDiagnosticPipeName() {
+    const baseName = '\\\\.\\pipe\\mxc-diagnostics';
+    if (os.platform() !== 'win32') {
+        return baseName;
+    }
+    try {
+        const output = execSync('whoami /user /fo csv /nh', {
+            encoding: 'utf8',
+            timeout: 3000,
+            windowsHide: true,
+        }).trim();
+        // Output is like: "DOMAIN\\user","S-1-5-21-..."
+        const match = output.match(/"(S-[\d-]+)"/);
+        if (match) {
+            return `${baseName}-${match[1]}`;
+        }
+    }
+    catch {
+        // Best-effort: fall back to base name without SID.
+    }
+    return baseName;
+}
+const PIPE_NAME = getDiagnosticPipeName();
+/** Cached pipe connection (lazy, best-effort). */
+let pipeSocket = null;
+let pipeConnected = false;
+let pipeAttempted = false;
+let diagnosticEnabled = null;
+/**
+ * Check whether diagnostic console logging is enabled via env var.
+ */
+function isDiagnosticEnabled() {
+    if (diagnosticEnabled !== null) {
+        return diagnosticEnabled;
+    }
+    const envVal = process.env['MXC_DIAG_CONSOLE'];
+    diagnosticEnabled =
+        envVal === '1' || envVal?.toLowerCase() === 'true';
+    return diagnosticEnabled;
+}
+/**
+ * Ensure the pipe is connected (lazy, best-effort).
+ */
+function ensurePipe() {
+    if (pipeConnected && pipeSocket) {
+        return pipeSocket;
+    }
+    if (pipeAttempted) {
+        return null;
+    }
+    // Only supported on Windows.
+    if (os.platform() !== 'win32') {
+        pipeAttempted = true;
+        return null;
+    }
+    pipeAttempted = true;
+    try {
+        const socket = net.createConnection(PIPE_NAME);
+        // Track connection state.
+        socket.on('connect', () => {
+            pipeConnected = true;
+        });
+        socket.on('error', () => {
+            pipeConnected = false;
+            pipeSocket = null;
+        });
+        socket.on('close', () => {
+            pipeConnected = false;
+            pipeSocket = null;
+        });
+        // Don't let the pipe keep the process alive.
+        socket.unref();
+        pipeSocket = socket;
+        // Connection is in-flight; the 'connect' handler sets pipeConnected.
+        // First message may be dropped, which is acceptable for best-effort diagnostics.
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Send a diagnostic log message to the MXC diagnostic console.
+ *
+ * Messages are best-effort and non-blocking. If the console is not
+ * running, the message is silently dropped.
+ *
+ * Each message is sent as a newline-delimited JSON envelope so the
+ * console can split coalesced stream writes back into individual messages.
+ *
+ * @param message - The log message to send
+ */
+export function diagLog(message) {
+    if (!isDiagnosticEnabled()) {
+        return;
+    }
+    const socket = ensurePipe();
+    if (!socket) {
+        return;
+    }
+    try {
+        const envelope = JSON.stringify({ msg: `[SDK] ${message}` }) + '\n';
+        socket.write(envelope);
+    }
+    catch {
+        // Best-effort: ignore write errors.
+    }
+}
+/**
+ * Close the diagnostic pipe connection. Called during cleanup.
+ */
+export function diagClose() {
+    if (pipeSocket) {
+        try {
+            pipeSocket.destroy();
+        }
+        catch {
+            // Ignore.
+        }
+        pipeSocket = null;
+        pipeConnected = false;
+    }
+}
+//# sourceMappingURL=diagnostic.js.map

package/node_modules/@microsoft/mxc-sdk/dist/diagnostic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic.js","sourceRoot":"","sources":["../src/diagnostic.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB;IAC1B,MAAM,QAAQ,GAAG,8BAA8B,CAAC;IAChD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,0BAA0B,EAAE;YAChD,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;SACpB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,gDAAgD;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,GAAG,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,mDAAmD;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;AAE1C,kDAAkD;AAClD,IAAI,UAAU,GAAsB,IAAI,CAAC;AACzC,IAAI,aAAa,GAAG,KAAK,CAAC;AAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;AAC1B,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C;;GAEG;AACH,SAAS,mBAAmB;IACxB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,iBAAiB,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC/C,iBAAiB;QACb,MAAM,KAAK,GAAG,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IACvD,OAAO,iBAAiB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,UAAU;IACf,IAAI,aAAa,IAAI,UAAU,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,6BAA6B;IAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,aAAa,GAAG,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,aAAa,GAAG,IAAI,CAAC;IAErB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC/C,0BAA0B;QAC1B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACtB,aAAa,GAAG,IAAI,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,aAAa,GAAG,KAAK,CAAC;YACtB,UAAU,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,aAAa,GAAG,KAAK,CAAC;YACtB,UAAU,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,6CAA6C;QAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,UAAU,GAAG,MAAM,CAAC;QACpB,qEAAqE;QACrE,iFAAiF;QACjF,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe;IACnC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACzB,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO;IACX,CAAC;IAED,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,oCAAoC;IACxC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACrB,IAAI,UAAU,EAAE,CAAC;QACb,IAAI,CAAC;YACD,UAAU,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACL,UAAU;QACd,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,aAAa,GAAG,KAAK,CAAC;IAC1B,CAAC;AACL,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/errors.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Closed set of MXC wire-format error codes. Mirrors `MxcErrorCode` on the
+ * Rust side one-for-one and serialises as the same snake_case strings on
+ * the wire. Backend-specific failures that don't fit one of these codes
+ * surface as `backend_error`, with structured information carried in
+ * `details`.
+ */
+export type ErrorCode = 'malformed_request' | 'unsupported_containment' | 'unsupported_phase' | 'backend_unavailable' | 'malformed_id' | 'stale_id' | 'not_provisioned' | 'not_started' | 'already_started' | 'already_stopped' | 'policy_validation' | 'backend_error';
+/**
+ * Typed error thrown by the MXC SDK in response to a wire-format error
+ * envelope. Discriminate by comparing `.code` to a wire-format error code
+ * string; the TypeScript string-literal union gives the same IDE
+ * completion as a class hierarchy without the multiplicative class count.
+ */
+export declare class MxcError extends Error {
+    readonly code: ErrorCode;
+    readonly details?: Record<string, unknown>;
+    constructor(code: ErrorCode, message: string, details?: Record<string, unknown>);
+}
+/**
+ * Constructs an `MxcError` from a wire-format error code. Accepts a plain
+ * `string` so callers parsing a wire envelope don't need to narrow first;
+ * unknown codes still produce an `MxcError` with `.code` set to whatever
+ * was on the wire.
+ */
+export declare function mxcErrorFromCode(code: string, message: string, details?: Record<string, unknown>): MxcError;
+//# sourceMappingURL=errors.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,yBAAyB,GACzB,mBAAmB,GACnB,qBAAqB,GACrB,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,aAAa,GACb,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,eAAe,CAAC;AAEpB;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAShF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,QAAQ,CAEV"}

package/node_modules/@microsoft/mxc-sdk/dist/errors.js

@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+/**
+ * Typed error thrown by the MXC SDK in response to a wire-format error
+ * envelope. Discriminate by comparing `.code` to a wire-format error code
+ * string; the TypeScript string-literal union gives the same IDE
+ * completion as a class hierarchy without the multiplicative class count.
+ */
+export class MxcError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        // Restore the prototype chain so `instanceof MxcError` keeps working
+        // after the TypeScript ES2020 → ES5-compatible class downlevelling.
+        Object.setPrototypeOf(this, new.target.prototype);
+        this.name = 'MxcError';
+    }
+}
+/**
+ * Constructs an `MxcError` from a wire-format error code. Accepts a plain
+ * `string` so callers parsing a wire envelope don't need to narrow first;
+ * unknown codes still produce an `MxcError` with `.code` set to whatever
+ * was on the wire.
+ */
+export function mxcErrorFromCode(code, message, details) {
+    return new MxcError(code, message, details);
+}
+//# sourceMappingURL=errors.js.map

package/node_modules/@microsoft/mxc-sdk/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAuBlC;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAY;IAChB,OAAO,CAA2B;IAE3C,YAAY,IAAe,EAAE,OAAe,EAAE,OAAiC;QAC7E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,QAAQ,CAAC,IAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/helper.d.ts

@@ -0,0 +1,101 @@
+import { FileLogger } from './logger.js';
+import { ContainerConfig } from './types.js';
+import { SandboxSpawnOptions } from './sandbox.js';
+/** SDK version read from package.json at module load time. */
+export declare const SDK_VERSION: string;
+/** Log the SDK version to the diagnostic console (once per process). */
+export declare function diagLogVersion(): void;
+/**
+ * Emit a one-shot deprecation hint via the diagnostic console when a caller
+ * uses a legacy containment wire value. Dedup'd per legacy value per process
+ * so the message doesn't flood the diag stream on repeated spawns.
+ *
+ * Exposed for tests so the latch can be reset between describes.
+ */
+export declare function warnLegacyContainmentOnce(legacy: string, canonical: string): void;
+/** @internal Reset the legacy-containment dedup latch. Intended for unit tests. */
+export declare function _resetLegacyContainmentWarnedForTesting(): void;
+/**
+ * Result of preparing a sandbox spawn — includes the resolved binary,
+ * CLI arguments, and optional diagnostic logger.
+ */
+export interface PrepareSpawnResult {
+    /** Absolute path to the wxc-exec or lxc-exec binary. */
+    executablePath: string;
+    /** CLI arguments to pass to the binary. */
+    args: string[];
+    /** Diagnostic logger, created when logDir is set or debug is enabled. */
+    logger?: FileLogger;
+    /** Path to the diagnostic log file (if logger is active). */
+    logFile?: string;
+    /** Timestamp when spawn preparation started (for duration tracking). */
+    startTime: number;
+}
+/**
+ * Generate a timestamped log file path in the given directory.
+ */
+export declare function makeLogFilePath(dir: string): string;
+/**
+ * Apply Linux network-policy defaults to a `ContainerConfig`.
+ *
+ * Linux enforces per-host filtering in one of two ways:
+ *   1. **iptables firewall** (`enforcementMode: 'firewall'`) — LXC's
+ *      privileged enforcement path. Requires root / CAP_NET_ADMIN.
+ *   2. **Cooperative HTTP proxy** (`network.proxy` set) — Bubblewrap's
+ *      unprivileged enforcement path. The proxy applies the host policy
+ *      for cooperating HTTP clients; raw-socket clients bypass it.
+ *
+ * This helper auto-promotes `enforcementMode` to `'firewall'` when host
+ * lists are present without a proxy — without it, the parser would leave
+ * the mode unset and the runtime would silently ignore `allowedHosts` /
+ * `blockedHosts`.
+ *
+ * If the caller explicitly passes `enforcementMode: 'capabilities'` we
+ * warn: `'capabilities'` is a Windows/AppContainer concept (a token
+ * capability mask) and has no Linux equivalent — the Linux runner will
+ * not enforce anything and the field is silently dropped.
+ *
+ * Shared between the explicit `'bubblewrap'` / `'lxc'` builders and the
+ * abstract `'process'` branch on Linux (which resolves to Bubblewrap
+ * server-side).
+ *
+ * NOTE: when `network.proxy` is configured on Bubblewrap, host filtering
+ * is enforced at the proxy layer (unprivileged, no CAP_NET_ADMIN). The
+ * Rust config parser explicitly rejects `bubblewrap + proxy + firewall`
+ * since the iptables path requires privilege the bwrap backend
+ * deliberately avoids. Callers in that mode must leave enforcementMode
+ * at its default.
+ */
+export declare function applyLinuxNetworkPolicy(config: ContainerConfig): void;
+/**
+ * Resolves the executor binary and builds the common CLI arguments for any
+ * MXC request envelope (one-shot or state-aware). Performs platform support
+ * and binary-presence checks; does not validate envelope contents — callers
+ * apply request-specific validation before delegating to this helper.
+ */
+export declare function resolveBinaryAndCommonArgs(envelopeJson: string, options: SandboxSpawnOptions): {
+    executablePath: string;
+    args: string[];
+};
+/**
+ * Resolves the executable path and builds CLI arguments for a one-shot
+ * sandbox invocation. Validates one-shot-specific invariants (commandLine
+ * required, experimental gating, containment-vs-platform compatibility)
+ * before delegating to the shared `resolveBinaryAndCommonArgs`.
+ */
+export declare function resolveExecutableAndArgs(config: ContainerConfig, options?: SandboxSpawnOptions): {
+    executablePath: string;
+    args: string[];
+};
+/**
+ * Sets up logging and resolves the executable path + args.
+ * Shared by both PTY and non-PTY spawn paths.
+ *
+ * If resolveExecutableAndArgs throws, any open logger is closed
+ * before the error propagates.
+ *
+ * @param config - The container configuration
+ * @param options - Spawn options (debug, logDir, etc.)
+ */
+export declare function prepareSpawn(config: ContainerConfig, options: SandboxSpawnOptions): PrepareSpawnResult;
+//# sourceMappingURL=helper.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAwF,MAAM,YAAY,CAAC;AAEnI,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD,8DAA8D;AAC9D,eAAO,MAAM,WAAW,EAAE,MAWtB,CAAC;AAIL,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,IAAI,CAKrC;AAID;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASjF;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yEAAyE;IACzE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,mBAAmB,GAC3B;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAiD5C;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,mBAAwB,GAChC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA6D5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,mBAAmB,GAC3B,kBAAkB,CA6BpB"}

package/node_modules/@microsoft/mxc-sdk/dist/helper.js

@@ -0,0 +1,256 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import * as os from 'os';
+import * as fs from 'fs';
+import * as path from 'path';
+import { randomBytes } from 'crypto';
+import { FileLogger } from './logger.js';
+import { ContainmentTypes, ExperimentalBackends, LegacyContainmentAliases } from './types.js';
+import { findWxcExecutable, findLxcExecutable, findSeatbeltExecutable, getPlatformSupport } from './platform.js';
+import { diagLog } from './diagnostic.js';
+/** SDK version read from package.json at module load time. */
+export const SDK_VERSION = (() => {
+    try {
+        const pkgPath = require.resolve('@microsoft/mxc-sdk/package.json');
+        return require(pkgPath).version;
+    }
+    catch {
+        try {
+            return require(path.resolve(__dirname, '..', 'package.json')).version;
+        }
+        catch {
+            return 'unknown';
+        }
+    }
+})();
+let sdkVersionLogged = false;
+/** Log the SDK version to the diagnostic console (once per process). */
+export function diagLogVersion() {
+    if (!sdkVersionLogged) {
+        sdkVersionLogged = true;
+        diagLog(`mxc-sdk v${SDK_VERSION} (PID ${process.pid})`);
+    }
+}
+const legacyContainmentWarned = new Set();
+/**
+ * Emit a one-shot deprecation hint via the diagnostic console when a caller
+ * uses a legacy containment wire value. Dedup'd per legacy value per process
+ * so the message doesn't flood the diag stream on repeated spawns.
+ *
+ * Exposed for tests so the latch can be reset between describes.
+ */
+export function warnLegacyContainmentOnce(legacy, canonical) {
+    if (!legacyContainmentWarned.has(legacy)) {
+        legacyContainmentWarned.add(legacy);
+        diagLog(`Containment value '${legacy}' is deprecated; use '${canonical}' instead. ` +
+            `The legacy spelling is accepted via a backward-compatibility alias and may be ` +
+            `removed in a future SDK release.`);
+    }
+}
+/** @internal Reset the legacy-containment dedup latch. Intended for unit tests. */
+export function _resetLegacyContainmentWarnedForTesting() {
+    legacyContainmentWarned.clear();
+}
+/**
+ * Generate a timestamped log file path in the given directory.
+ */
+export function makeLogFilePath(dir) {
+    const ts = new Date().toISOString().replace(/[:.]/g, '-').replace(/Z$/, '');
+    const suffix = randomBytes(3).toString('hex');
+    return path.join(dir, `mxc-diag-${ts}-${suffix}.log`);
+}
+/**
+ * Apply Linux network-policy defaults to a `ContainerConfig`.
+ *
+ * Linux enforces per-host filtering in one of two ways:
+ *   1. **iptables firewall** (`enforcementMode: 'firewall'`) — LXC's
+ *      privileged enforcement path. Requires root / CAP_NET_ADMIN.
+ *   2. **Cooperative HTTP proxy** (`network.proxy` set) — Bubblewrap's
+ *      unprivileged enforcement path. The proxy applies the host policy
+ *      for cooperating HTTP clients; raw-socket clients bypass it.
+ *
+ * This helper auto-promotes `enforcementMode` to `'firewall'` when host
+ * lists are present without a proxy — without it, the parser would leave
+ * the mode unset and the runtime would silently ignore `allowedHosts` /
+ * `blockedHosts`.
+ *
+ * If the caller explicitly passes `enforcementMode: 'capabilities'` we
+ * warn: `'capabilities'` is a Windows/AppContainer concept (a token
+ * capability mask) and has no Linux equivalent — the Linux runner will
+ * not enforce anything and the field is silently dropped.
+ *
+ * Shared between the explicit `'bubblewrap'` / `'lxc'` builders and the
+ * abstract `'process'` branch on Linux (which resolves to Bubblewrap
+ * server-side).
+ *
+ * NOTE: when `network.proxy` is configured on Bubblewrap, host filtering
+ * is enforced at the proxy layer (unprivileged, no CAP_NET_ADMIN). The
+ * Rust config parser explicitly rejects `bubblewrap + proxy + firewall`
+ * since the iptables path requires privilege the bwrap backend
+ * deliberately avoids. Callers in that mode must leave enforcementMode
+ * at its default.
+ */
+export function applyLinuxNetworkPolicy(config) {
+    if (!config.network) {
+        return;
+    }
+    if (config.network.enforcementMode === 'capabilities') {
+        console.warn("mxc-sdk: network.enforcementMode='capabilities' has no effect on Linux " +
+            "(it is a Windows AppContainer / ProcessContainer concept). The Linux " +
+            "runner will not enforce host filtering via capabilities. Use the " +
+            "default mode (auto-promotes to 'firewall' for LXC, or use network.proxy " +
+            "for unprivileged Bubblewrap enforcement).");
+    }
+    const hasProxy = !!config.network.proxy;
+    const hasHostRules = !!(config.network.allowedHosts?.length || config.network.blockedHosts?.length);
+    if (hasHostRules && !hasProxy) {
+        config.network.enforcementMode = 'firewall';
+    }
+}
+/**
+ * Resolves the executor binary and builds the common CLI arguments for any
+ * MXC request envelope (one-shot or state-aware). Performs platform support
+ * and binary-presence checks; does not validate envelope contents — callers
+ * apply request-specific validation before delegating to this helper.
+ */
+export function resolveBinaryAndCommonArgs(envelopeJson, options) {
+    const platformSupport = getPlatformSupport();
+    if (!platformSupport.isSupported && !options.skipPlatformCheck) {
+        throw new Error(`MXC is not supported on this platform: ${platformSupport.reason}`);
+    }
+    const platform = os.platform();
+    let executablePath;
+    if (options.executablePath) {
+        if (!fs.existsSync(options.executablePath)) {
+            throw new Error(`File not found: ${options.executablePath}`);
+        }
+        executablePath = options.executablePath;
+    }
+    else if (platform === 'linux') {
+        const p = findLxcExecutable();
+        if (!p) {
+            throw new Error('lxc-exec not found. Ensure it is built and available in a standard location.');
+        }
+        executablePath = p;
+    }
+    else if (platform === 'darwin') {
+        const p = findSeatbeltExecutable();
+        if (!p) {
+            throw new Error('mxc-exec-mac not found. Ensure it is built and available in a standard location.');
+        }
+        executablePath = p;
+    }
+    else {
+        const p = findWxcExecutable();
+        if (!p) {
+            throw new Error('wxc-exec.exe not found. Set options.executablePath or ensure it exists in a standard location.');
+        }
+        executablePath = p;
+    }
+    const args = [];
+    const envelopeBase64 = Buffer.from(envelopeJson, 'utf-8').toString('base64');
+    args.push('--config-base64', envelopeBase64);
+    if (options.dryRun)
+        args.push('--dry-run');
+    if (options.debug)
+        args.push('--debug');
+    if (options.experimental)
+        args.push('--experimental');
+    return { executablePath, args };
+}
+/**
+ * Resolves the executable path and builds CLI arguments for a one-shot
+ * sandbox invocation. Validates one-shot-specific invariants (commandLine
+ * required, experimental gating, containment-vs-platform compatibility)
+ * before delegating to the shared `resolveBinaryAndCommonArgs`.
+ */
+export function resolveExecutableAndArgs(config, options = {}) {
+    if (!config.process?.commandLine) {
+        throw new Error('script is required. Set process.commandLine on the config or pass a script to spawnSandbox().');
+    }
+    // Resolve deprecated wire values (e.g. "appcontainer" → "processcontainer",
+    // "macos_sandbox" → "seatbelt") once, and drive every containment check
+    // from the resolved value. The native binary accepts both spellings via
+    // serde aliases, so the wire payload is forwarded unchanged below — this
+    // resolution is purely for SDK-side validation. Without it, legacy values
+    // bypass the experimental-mode gate (because they are not in
+    // ExperimentalBackends under their alias) and produce a confusing
+    // "not available on this platform" error instead.
+    const rawContainment = config.containment;
+    const effectiveContainment = rawContainment
+        ? (LegacyContainmentAliases[rawContainment] ?? rawContainment)
+        : undefined;
+    if (rawContainment && effectiveContainment !== rawContainment) {
+        warnLegacyContainmentOnce(rawContainment, effectiveContainment);
+    }
+    // Check experimental mode before anything else so the caller gets a clear
+    // message about the missing flag rather than a platform/binary error.
+    if (effectiveContainment && ExperimentalBackends.includes(effectiveContainment) && !options.experimental) {
+        throw new Error(`'${rawContainment}' containment requires experimental mode. Set 'experimental: true' in SandboxSpawnOptions.`);
+    }
+    const platformSupport = getPlatformSupport();
+    const isExperimental = !!effectiveContainment &&
+        ExperimentalBackends.includes(effectiveContainment);
+    if (!platformSupport.isSupported && !isExperimental && !options.skipPlatformCheck) {
+        throw new Error(`MXC is not supported on this platform: ${platformSupport.reason}`);
+    }
+    // Hard platform requirement: microvm needs WHP/Hyper-V on Windows. This guard
+    // runs even when `skipPlatformCheck` is set because it's not a build-version
+    // check — the backend literally cannot run on non-Windows hosts.
+    if (effectiveContainment === 'microvm' && os.platform() !== 'win32') {
+        throw new Error('The microvm backend is only supported on Windows (requires WHP/Hyper-V).');
+    }
+    // Validate containment against platform
+    if (effectiveContainment && !options.skipPlatformCheck) {
+        // Abstract intents (process, microvm) are resolved by the native binary
+        // at run time, so the SDK accepts them without checking against the
+        // host's concrete backend list.
+        const isIntent = ContainmentTypes.includes(effectiveContainment);
+        const isAvailable = platformSupport.availableMethods.includes(effectiveContainment);
+        if (!isIntent && !isExperimental && !isAvailable) {
+            throw new Error(`Containment backend '${rawContainment}' is not available on this platform. ` +
+                `Available methods: ${platformSupport.availableMethods.join(', ')}`);
+        }
+    }
+    return resolveBinaryAndCommonArgs(JSON.stringify(config), options);
+}
+/**
+ * Sets up logging and resolves the executable path + args.
+ * Shared by both PTY and non-PTY spawn paths.
+ *
+ * If resolveExecutableAndArgs throws, any open logger is closed
+ * before the error propagates.
+ *
+ * @param config - The container configuration
+ * @param options - Spawn options (debug, logDir, etc.)
+ */
+export function prepareSpawn(config, options) {
+    let logger;
+    let logFile;
+    const logDir = options.logDir ?? (options.debug ? path.join(os.tmpdir(), 'mxc-logs') : undefined);
+    if (logDir) {
+        logFile = makeLogFilePath(logDir);
+        logger = new FileLogger(logFile);
+        logger.log('info', 'mxc.log.created', { logFile });
+    }
+    const startTime = Date.now();
+    logger?.log('info', 'mxc.spawn.start', {
+        platform: os.platform(),
+        arch: os.arch(),
+        containment: config.containment,
+    });
+    try {
+        const { executablePath, args } = resolveExecutableAndArgs(config, options);
+        // Pass the SDK log file to wxc-exec so Rust-side diagnostics go to the same file.
+        if (logFile) {
+            args.push('--log-file', logFile);
+        }
+        logger?.log('info', 'mxc.binary.resolved', { resolved: !!executablePath });
+        return { executablePath, args, logger, logFile, startTime };
+    }
+    catch (err) {
+        logger?.close();
+        throw err;
+    }
+}
+//# sourceMappingURL=helper.js.map

package/node_modules/@microsoft/mxc-sdk/dist/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAuC,gBAAgB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AACnI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEjH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAW,CAAC,GAAG,EAAE;IACrC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,OAAiB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAiB,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;AACL,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC1B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAC5D,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,SAAiB;IACvE,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CACH,sBAAsB,MAAM,yBAAyB,SAAS,aAAa;YAC3E,gFAAgF;YAChF,kCAAkC,CACrC,CAAC;IACN,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uCAAuC;IACnD,uBAAuB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,MAAM,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,cAAc,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,0EAA0E;YAC1E,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAChB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAoB,EACpB,OAA4B;IAE5B,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,cAAsB,CAAC;IAE3B,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtD,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAuB,EACvB,UAA+B,EAAE;IAEjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,6DAA6D;IAC7D,kEAAkE;IAClE,kDAAkD;IAClD,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,MAAM,oBAAoB,GAAG,cAAc;QACzC,CAAC,CAAC,CAAC,wBAAwB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,cAAc,IAAI,oBAAoB,KAAK,cAAc,EAAE,CAAC;QAC9D,yBAAyB,CAAC,cAAc,EAAE,oBAA0C,CAAC,CAAC;IACxF,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,oBAAoB,IAAI,oBAAoB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CACb,IAAI,cAAc,4FAA4F,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,CAAC,CAAC,oBAAoB;QAC1C,oBAA0C,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC7E,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,IAAI,oBAAoB,KAAK,SAAS,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IAED,wCAAwC;IACxC,IAAI,oBAAoB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACvD,wEAAwE;QACxE,oEAAoE;QACpE,gCAAgC;QAChC,MAAM,QAAQ,GAAI,gBAAsC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAC3D,oBAA0C,CAC3C,CAAC;QACF,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,wBAAwB,cAAc,uCAAuC;gBAC7E,sBAAsB,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,OAA4B;IAE5B,IAAI,MAA8B,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE;QACrC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,kFAAkF;QAClF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}