@openclaw/mxc-sandbox 0.0.0 → 2026.7.2-beta.2

package/node_modules/@microsoft/mxc-sdk/dist/platform.js

@@ -0,0 +1,477 @@
+import * as os from 'os';
+import * as fs from 'fs';
+import * as path from 'path';
+import { execSync, execFileSync } from 'child_process';
+import { fileURLToPath } from 'node:url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+/**
+ * Resolves the SDK package root directory.
+ * Uses require.resolve to find the package.json (works when the SDK is installed
+ * in node_modules, even if the consuming code is bundled by esbuild/webpack).
+ * Falls back to __dirname for local development (monorepo layout).
+ */
+function getSdkPackageRoot() {
+    try {
+        return path.dirname(require.resolve('@microsoft/mxc-sdk/package.json'));
+    }
+    catch {
+        // Fallback: __dirname is dist/, so parent is package root
+        return path.join(__dirname, '..');
+    }
+}
+/**
+ * Query Windows Registry for a value
+ * @param key - Registry key path (e.g., "HKLM\\Software\\...")
+ * @param valueName - Name of the value to query
+ * @returns The registry value as a string, or null if not found
+ */
+function queryWindowsRegistry(key, valueName) {
+    try {
+        const command = `reg query "${key}" /v "${valueName}"`;
+        const output = execSync(command, { encoding: 'utf-8', stdio: 'pipe' });
+        // Parse output - format is:
+        // HKEY_LOCAL_MACHINE\...
+        //     ValueName    REG_SZ    Value
+        const lines = output.split('\n');
+        for (const line of lines) {
+            if (line.includes(valueName)) {
+                // Extract value after REG_SZ or REG_DWORD
+                const match = line.match(/REG_\w+\s+(.+)/);
+                if (match) {
+                    return match[1].trim();
+                }
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Default implementation that reads `CurrentBuild` / `UBR` from the
+ * registry. Replaceable via {@link _setWindowsBuildQuery} in tests so we
+ * can exercise the IsolationSession version gate deterministically.
+ */
+function defaultWindowsBuildQuery() {
+    const registryPath = 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion';
+    const currentBuild = queryWindowsRegistry(registryPath, 'CurrentBuild');
+    const ubrValue = queryWindowsRegistry(registryPath, 'UBR');
+    if (!currentBuild || !ubrValue) {
+        return null;
+    }
+    const major = parseInt(currentBuild, 10);
+    const minor = Number(ubrValue);
+    if (isNaN(major) || isNaN(minor)) {
+        return null;
+    }
+    return { major, minor };
+}
+let windowsBuildQuery = defaultWindowsBuildQuery;
+/** @internal Test-only: override the Windows build lookup. */
+export function _setWindowsBuildQuery(fn) {
+    windowsBuildQuery = fn ?? defaultWindowsBuildQuery;
+}
+/**
+ * Check whether the host supports the IsolationSession backend.
+ * Requires Windows Insider Preview build 26300.8553 or later.
+ *
+ * No internal cache — `getPlatformSupport` memoizes the full result, and
+ * registry reads are cheap relative to the rest of the probe.
+ */
+function isIsoSessionSupported() {
+    const build = windowsBuildQuery();
+    if (!build) {
+        return false;
+    }
+    // Pin to the Windows Insider Preview build that introduced IsolationSession
+    // (26300.8553+). Other major builds are not yet supported.
+    return build.major === 26300 && build.minor >= 8553;
+}
+let windowsSandboxAvailableCache;
+/**
+ * Check if Windows Sandbox feature is enabled via DISM.
+ * @returns true if the Containers-DisposableClientVM feature is enabled
+ */
+function isWindowsSandboxAvailable() {
+    if (windowsSandboxAvailableCache !== undefined) {
+        return windowsSandboxAvailableCache;
+    }
+    try {
+        const output = execSync('dism /online /get-featureinfo /featurename:Containers-DisposableClientVM', { encoding: 'utf-8', stdio: 'pipe', timeout: 10000 });
+        windowsSandboxAvailableCache = /State\s*:\s*Enabled/i.test(output);
+    }
+    catch {
+        // `dism /online` typically requires elevation, so a non-elevated session
+        // throws here and we can't distinguish "disabled" from "no permission".
+        // Fall back to checking for the sandbox executable — Windows installs it
+        // under System32 only when the Containers-DisposableClientVM feature is
+        // enabled, and the path is readable without admin.
+        const sandboxExe = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsSandbox.exe');
+        windowsSandboxAvailableCache = fs.existsSync(sandboxExe);
+    }
+    return windowsSandboxAvailableCache;
+}
+/**
+ * Get platform support information.
+ *
+ * On Windows, this also invokes `wxc-exec --probe` to populate
+ * `isolationTier`, the `isolationWarnings` array (if any), and portable UI
+ * capability facts. Linux and macOS currently do not expose native probe data,
+ * so `uiCapabilities` is omitted on those platforms. The result is cached for
+ * the lifetime of the SDK module — the underlying machine state is not
+ * expected to change at runtime.
+ *
+ * @returns Platform support details including available sandboxing methods
+ */
+export function getPlatformSupport() {
+    if (cachedSupport !== null) {
+        return cachedSupport;
+    }
+    const support = computeSupport();
+    cachedSupport = support;
+    return support;
+}
+let cachedSupport = null;
+/** @internal Test-only: clear the cached PlatformSupport. */
+export function _resetPlatformSupportCache() {
+    cachedSupport = null;
+}
+let probeRunner = defaultProbeRunner;
+/** @internal Test-only: override the probe runner. */
+export function _setProbeRunner(runner) {
+    probeRunner = runner ?? defaultProbeRunner;
+}
+function defaultProbeRunner() {
+    const wxcPath = findWxcExecutable();
+    if (!wxcPath) {
+        throw new Error('wxc-exec not found');
+    }
+    return execFileSync(wxcPath, ['--probe'], {
+        timeout: 5000,
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+}
+function isValidTier(s) {
+    return s === 'base-container' || s === 'appcontainer-bfs' || s === 'appcontainer-dacl';
+}
+const UI_CAPABILITY_FIELDS = [
+    'canBlockClipboardRead',
+    'canBlockClipboardWrite',
+    'canBlockInputInjection',
+    'canBlockInputMethodChanges',
+    'canBlockExternalUiObjects',
+    'canBlockGlobalUiNamespace',
+    'canBlockDesktopSwitching',
+    'canBlockLogoffOrShutdown',
+    'canBlockSystemParameterChanges',
+    'canBlockDisplaySettingsChanges',
+];
+function isUiCapabilitySupport(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const capabilities = value;
+    return UI_CAPABILITY_FIELDS.every((field) => typeof capabilities[field] === 'boolean');
+}
+/**
+ * Run the probe binary and merge its results into `support`. On any
+ * failure (binary missing, timeout, malformed JSON, unknown tier), the
+ * function silently leaves `support.isolationTier` and
+ * `support.isolationWarnings` unset — callers see the same contract as
+ * pre-Phase-5 SDKs.
+ */
+function populateIsolationFromProbe(support) {
+    try {
+        const stdout = probeRunner();
+        const probe = JSON.parse(stdout);
+        if (probe && typeof probe === 'object') {
+            if (isValidTier(probe.tier)) {
+                support.isolationTier = probe.tier;
+            }
+            if (Array.isArray(probe.warnings) && probe.warnings.length > 0) {
+                const warnings = probe.warnings.filter((w) => typeof w === 'string');
+                if (warnings.length > 0) {
+                    support.isolationWarnings = warnings;
+                }
+            }
+            const facts = probe.probes;
+            if (facts && typeof facts === 'object') {
+                if (isUiCapabilitySupport(facts.uiCapabilities)) {
+                    support.uiCapabilities = facts.uiCapabilities;
+                }
+            }
+        }
+    }
+    catch {
+        // Graceful degradation: leave isolation fields unset.
+    }
+}
+function computeSupport() {
+    const platform = os.platform();
+    const support = { isSupported: false, reason: '', availableMethods: [] };
+    // Non-Windows platforms do not currently have native probes, so fields that
+    // depend on probe data (including uiCapabilities) stay omitted.
+    if (platform === 'darwin') {
+        // seatbelt is the only containment backend on macOS.
+        // /usr/bin/sandbox-exec ships with every release of macOS so the check
+        // is effectively just confirming we're on a supported OS.
+        if (isSeatbeltAvailable()) {
+            support.isSupported = true;
+            support.availableMethods = ['seatbelt'];
+        }
+        else {
+            support.reason = '/usr/bin/sandbox-exec not found; macOS install is incomplete';
+        }
+        return support;
+    }
+    if (platform === 'linux') {
+        // LXC and Bubblewrap are both supported on Linux. Report whichever
+        // are installed; callers pick via the containment field.
+        const methods = [];
+        if (isLxcAvailable())
+            methods.push('lxc');
+        if (isBubblewrapAvailable())
+            methods.push('bubblewrap');
+        if (methods.length > 0) {
+            support.isSupported = true;
+            support.availableMethods = methods;
+        }
+        else {
+            support.reason = 'Neither LXC nor Bubblewrap is available on this system';
+        }
+        return support;
+    }
+    if (platform !== 'win32') {
+        support.reason = 'MXC is not supported on this platform';
+        return support;
+    }
+    support.isSupported = true;
+    support.availableMethods = ['processcontainer'];
+    if (isWindowsSandboxAvailable()) {
+        support.availableMethods.push('windows_sandbox');
+    }
+    if (isIsoSessionSupported()) {
+        support.availableMethods.push('isolation_session');
+    }
+    populateIsolationFromProbe(support);
+    return support;
+}
+/**
+ * Check if LXC is available on the system
+ */
+function isLxcAvailable() {
+    try {
+        execSync('lxc-ls --version', { encoding: 'utf-8', stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if Bubblewrap (bwrap) is available on the system
+ */
+function isBubblewrapAvailable() {
+    try {
+        execSync('bwrap --version', { encoding: 'utf-8', stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if the macOS sandbox is available. `/usr/bin/sandbox-exec` is part
+ * of the macOS base install and present on every shipping version of macOS,
+ * so this is effectively a sanity check for a corrupted install.
+ */
+function isSeatbeltAvailable() {
+    try {
+        return fs.existsSync('/usr/bin/sandbox-exec');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Get the simplified architecture name used for SDK bin directory layout.
+ * @returns 'arm64' or 'x64'
+ */
+function getSdkArch() {
+    return os.arch() === 'arm64' ? 'arm64' : 'x64';
+}
+/**
+ * Get the Rust target triple for the current machine architecture.
+ * @returns The Rust target triple string
+ */
+function getRustTargetTriple() {
+    const arch = os.arch();
+    const platform = os.platform();
+    if (platform === 'linux') {
+        return arch === 'arm64' ? 'aarch64-unknown-linux-gnu' : 'x86_64-unknown-linux-gnu';
+    }
+    // Windows
+    return arch === 'arm64' ? 'aarch64-pc-windows-msvc' : 'x86_64-pc-windows-msvc';
+}
+/**
+ * Get the Rust target triple for the current Linux machine architecture.
+ */
+function getLinuxRustTargetTriple() {
+    const arch = os.arch();
+    switch (arch) {
+        case 'arm64':
+            return 'aarch64-unknown-linux-gnu';
+        case 'x64':
+        default:
+            return 'x86_64-unknown-linux-gnu';
+    }
+}
+/**
+ * Get the Rust target triple for the current macOS machine architecture.
+ */
+function getDarwinRustTargetTriple() {
+    const arch = os.arch();
+    return arch === 'arm64' ? 'aarch64-apple-darwin' : 'x86_64-apple-darwin';
+}
+/**
+ * Find the wxc-exec executable
+ * Searches in common locations relative to the SDK package,
+ * selecting the build matching the current machine architecture.
+ * @returns Path to wxc-exec.exe if found, null otherwise
+ */
+export function findWxcExecutable() {
+    // Allow override for bundled deployments (debugging/testing)
+    if (process.env.MXC_BIN_DIR) {
+        const overridePath = path.join(process.env.MXC_BIN_DIR, getSdkArch(), 'wxc-exec.exe');
+        if (verifyWxcExecutable(overridePath)) {
+            return overridePath;
+        }
+    }
+    const pkgRoot = getSdkPackageRoot();
+    const targetTriple = getRustTargetTriple();
+    const targetDir = path.join(pkgRoot, '..', 'src', 'target');
+    const possiblePaths = [
+        // Bundled in the SDK package (e.g. when installed via npm)
+        path.join(pkgRoot, 'bin', getSdkArch(), 'wxc-exec.exe'),
+        // Architecture-specific release build output (monorepo dev)
+        path.join(targetDir, targetTriple, 'release', 'wxc-exec.exe'),
+        // Architecture-specific debug build output (monorepo dev)
+        path.join(targetDir, targetTriple, 'debug', 'wxc-exec.exe'),
+        // Fallback: default Cargo release build output (no explicit --target)
+        path.join(targetDir, 'release', 'wxc-exec.exe'),
+        // Fallback: default Cargo debug build output (no explicit --target)
+        path.join(targetDir, 'debug', 'wxc-exec.exe'),
+    ];
+    for (const wxcPath of possiblePaths) {
+        if (verifyWxcExecutable(wxcPath)) {
+            return wxcPath;
+        }
+    }
+    return null;
+}
+/**
+ * Verify that an executable exists at the given path
+ * @param execPath - Path to verify
+ * @returns true if the executable exists and is a file, false otherwise
+ */
+function verifyExecutable(execPath) {
+    try {
+        // Paths inside Electron's app.asar exist to fs but can't be executed
+        if (execPath.includes('.asar')) {
+            return false;
+        }
+        if (!fs.existsSync(execPath) || !fs.statSync(execPath).isFile()) {
+            return false;
+        }
+        // On non-Windows platforms, also verify execute permission
+        if (process.platform !== 'win32') {
+            fs.accessSync(execPath, fs.constants.X_OK);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify that a wxc-exec executable exists at the given path
+ * @param wxcPath - Path to verify
+ * @returns true if the executable exists and is a file, false otherwise
+ */
+function verifyWxcExecutable(wxcPath) {
+    return verifyExecutable(wxcPath);
+}
+/**
+ * Find the lxc-exec executable on Linux
+ * Searches in common locations relative to the SDK package.
+ * @returns Path to lxc-exec if found, null otherwise
+ */
+export function findLxcExecutable() {
+    // Allow override for bundled deployments (debugging/testing)
+    if (process.env.MXC_BIN_DIR) {
+        const overridePath = path.join(process.env.MXC_BIN_DIR, getSdkArch(), 'lxc-exec');
+        if (verifyExecutable(overridePath)) {
+            return overridePath;
+        }
+    }
+    const pkgRoot = getSdkPackageRoot();
+    const targetTriple = getLinuxRustTargetTriple();
+    const targetDir = path.join(pkgRoot, '..', 'src', 'target');
+    const possiblePaths = [
+        // Bundled in the SDK package
+        path.join(pkgRoot, 'bin', getSdkArch(), 'lxc-exec'),
+        // Architecture-specific release build
+        path.join(targetDir, targetTriple, 'release', 'lxc-exec'),
+        // Architecture-specific debug build
+        path.join(targetDir, targetTriple, 'debug', 'lxc-exec'),
+        // Default Cargo release build
+        path.join(targetDir, 'release', 'lxc-exec'),
+        // Default Cargo debug build
+        path.join(targetDir, 'debug', 'lxc-exec'),
+    ];
+    for (const lxcPath of possiblePaths) {
+        if (verifyExecutable(lxcPath)) {
+            return lxcPath;
+        }
+    }
+    return null;
+}
+/**
+ * Find the mxc-exec-mac executable on macOS.
+ * Searches in the SDK bin directory (npm install path) and Cargo build
+ * output directories (monorepo dev path).
+ * @returns Path to mxc-exec-mac if found, null otherwise
+ */
+export function findSeatbeltExecutable() {
+    // Allow override for bundled deployments (debugging/testing)
+    if (process.env.MXC_BIN_DIR) {
+        const overridePath = path.join(process.env.MXC_BIN_DIR, getSdkArch(), 'mxc-exec-mac');
+        if (verifyExecutable(overridePath)) {
+            return overridePath;
+        }
+    }
+    const targetTriple = getDarwinRustTargetTriple();
+    const targetDir = path.join(__dirname, '..', '..', 'src', 'target');
+    const possiblePaths = [
+        // Bundled in the SDK package
+        path.join(__dirname, '..', 'bin', getSdkArch(), 'mxc-exec-mac'),
+        // Architecture-specific release build
+        path.join(targetDir, targetTriple, 'release', 'mxc-exec-mac'),
+        // Architecture-specific debug build
+        path.join(targetDir, targetTriple, 'debug', 'mxc-exec-mac'),
+        // Default Cargo release build
+        path.join(targetDir, 'release', 'mxc-exec-mac'),
+        // Default Cargo debug build
+        path.join(targetDir, 'debug', 'mxc-exec-mac'),
+    ];
+    for (const darwinPath of possiblePaths) {
+        if (verifyExecutable(darwinPath)) {
+            return darwinPath;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=platform.js.map

package/node_modules/@microsoft/mxc-sdk/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,SAAiB;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,cAAc,GAAG,SAAS,SAAS,GAAG,CAAC;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvE,4BAA4B;QAC5B,yBAAyB;QACzB,mCAAmC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,0CAA0C;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,YAAY,GAAG,uDAAuD,CAAC;IAC7E,MAAM,YAAY,GAAG,oBAAoB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,IAAI,iBAAiB,GAAuB,wBAAwB,CAAC;AAErE,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CAAC,EAA+B;IACnE,iBAAiB,GAAG,EAAE,IAAI,wBAAwB,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB;IAC5B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,2DAA2D;IAC3D,OAAO,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,IAAI,4BAAiD,CAAC;AAEtD;;;GAGG;AACH,SAAS,yBAAyB;IAChC,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,4BAA4B,CAAC;IACtC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,0EAA0E,EAC1E,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CACrD,CAAC;QACF,4BAA4B,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EACvC,UAAU,EACV,oBAAoB,CACrB,CAAC;QACF,4BAA4B,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,4BAA4B,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,aAAa,GAAG,OAAO,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,aAAa,GAA2B,IAAI,CAAC;AAEjD,6DAA6D;AAC7D,MAAM,UAAU,0BAA0B;IACxC,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAQD,IAAI,WAAW,GAAgB,kBAAkB,CAAC;AAElD,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,WAAW,GAAG,MAAM,IAAI,kBAAkB,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;QACxC,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CAAC,KAAK,gBAAgB,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,mBAAmB,CAAC;AACzF,CAAC;AAED,MAAM,oBAAoB,GAA2C;IACnE,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,4BAA4B;IAC5B,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;IAC1B,0BAA0B;IAC1B,gCAAgC;IAChC,gCAAgC;CACjC,CAAC;AAEF,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,KAAmD,CAAC;IACzE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,OAAwB;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;YACrC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;gBAC3F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC,iBAAiB,GAAG,QAAQ,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;YAC3B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,IAAI,qBAAqB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;oBAChD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;IAE1F,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,qDAAqD;QACrD,uEAAuE;QACvE,0DAA0D;QAC1D,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,gBAAgB,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,GAAG,8DAA8D,CAAC;QAClF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,mEAAmE;QACnE,yDAAyD;QACzD,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,IAAI,cAAc,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,qBAAqB,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,gBAAgB,GAAG,OAAO,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,GAAG,wDAAwD,CAAC;QAC5E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,uCAAuC,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,gBAAgB,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChD,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC;IACD,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,QAAQ,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB;IAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACrF,CAAC;IACD,UAAU;IACV,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACjF,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IACvB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;QACrC,KAAK,KAAK,CAAC;QACX;YACE,OAAO,0BAA0B,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB;IAChC,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,cAAc,CAAC,CAAC;QACtF,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAE5D,MAAM,aAAa,GAAG;QACpB,2DAA2D;QAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,cAAc,CAAC;QACvD,4DAA4D;QAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC;QAC7D,0DAA0D;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC;QAC3D,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC;QAC/C,oEAAoE;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC;KAC9C,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,qEAAqE;QACrE,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,2DAA2D;QAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;QAClF,IAAI,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAE5D,MAAM,aAAa,GAAG;QACpB,6BAA6B;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,UAAU,CAAC;QACnD,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;QACzD,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC;QACvD,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC;QAC3C,4BAA4B;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC;KAC1C,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB;IACpC,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,cAAc,CAAC,CAAC;QACtF,IAAI,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEpE,MAAM,aAAa,GAAG;QACpB,6BAA6B;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,cAAc,CAAC;QAC/D,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC;QAC7D,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC;QAC3D,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC;QAC/C,4BAA4B;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC;KAC9C,CAAC;IAEF,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;QACvC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/policy.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Policy discovery APIs for building sandbox filesystem policy.
+ *
+ * These functions enumerate the host environment to discover tool paths,
+ * user profile locations, and temporary storage — returning policy fragments
+ * that callers can merge into a {@link SandboxPolicy}.
+ */
+/**
+ * A composable fragment of filesystem policy.
+ * Callers merge one or more fragments into {@link SandboxPolicy.filesystem}.
+ */
+export interface FilesystemPolicyResult {
+    /** Paths that should be granted read-only access inside the container */
+    readonlyPaths: string[];
+    /** Paths that should be granted read-write access inside the container */
+    readwritePaths: string[];
+}
+/**
+ * Options for {@link getAvailableToolsPolicy}.
+ */
+export interface ToolsPolicyOptions {
+    /**
+     * When set to `'processcontainer'`, directories whose ACLs already grant
+     * access to ALL_APPLICATION_PACKAGES are excluded from the result
+     * because AppContainer processes can already see them implicitly.
+     */
+    containerType?: 'processcontainer';
+}
+/**
+ * Discover tool and SDK directories from the environment and return them as
+ * policy paths.
+ *
+ * Reads the `PATH` variable and a set of well-known tool / SDK environment
+ * variables, enumerates the directories they reference, then applies filters:
+ *
+ * 1. Directories that do not exist on disk are removed.
+ * 2. System-critical directories (under `%WINDIR%`) are removed.
+ * 3. When `options.containerType` is `'processcontainer'`, directories whose ACLs
+ *    already grant access to `ALL_APPLICATION_PACKAGES` are removed because
+ *    AppContainer processes can see them without explicit brokering.
+ *
+ * Additionally, if PowerShell (`pwsh.exe`) is found on PATH, the drive root
+ * (`C:\`) is added to `readonlyPaths` and the PSReadLine history directory
+ * is added to `readwritePaths` so that interactive PowerShell sessions work
+ * correctly inside the container.
+ *
+ * @param env - Environment variable map. Defaults to `process.env`.
+ * @param options - Filtering options.
+ * @returns A policy fragment with discovered paths.
+ */
+export declare function getAvailableToolsPolicy(env?: {
+    [key: string]: string | undefined;
+}, options?: ToolsPolicyOptions): FilesystemPolicyResult;
+/**
+ * Build read-only policy for standard user profile application data locations.
+ *
+ * Enumerates immediate subdirectories of `%LOCALAPPDATA%\Programs`
+ * (per-user installed developer tools) as additional read-only paths.
+ *
+ * @returns A policy fragment with user profile paths in `readonlyPaths`.
+ */
+export declare function getUserProfilePolicy(): FilesystemPolicyResult;
+/**
+ * Generate a dedicated temporary directory for a container and return it as
+ * read-write policy.
+ *
+ * If the provided environment contains a `TEMP` (or `TMP`) variable, a
+ * uniquely-named subdirectory is created beneath that path and returned in
+ * `tempDirectory` and `readwritePaths`. If neither variable is set the
+ * container is assumed to manage its own temp directory, so the returned
+ * policy is empty.
+ *
+ * @param env - Environment variable map. Defaults to `process.env`.
+ * @returns Policy fragment with the temp directory in both `tempDirectory`
+ *          and `readwritePaths`, or empty values when no TEMP path is found.
+ */
+export declare function getTemporaryFilesPolicy(env?: {
+    [key: string]: string | undefined;
+}): FilesystemPolicyResult;
+//# sourceMappingURL=policy.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACnC,yEAAyE;IACzE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACtC;AA+MD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CACnC,GAAG,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,EAC3C,OAAO,CAAC,EAAE,kBAAkB,GAC7B,sBAAsB,CAyCxB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,sBAAsB,CA+C7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACnC,GAAG,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAAE,GAC5C,sBAAsB,CAmBxB"}