@openclaw/mxc-sandbox 0.0.0 → 2026.7.2-beta.2

package/node_modules/@microsoft/mxc-sdk/dist/sandbox.js

@@ -0,0 +1,515 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import pty from 'node-pty';
+import * as os from 'os';
+import { spawn } from 'child_process';
+import { randomBytes } from "crypto";
+import { parse as semverParse } from 'semver';
+import { prepareSpawn, diagLogVersion, applyLinuxNetworkPolicy } from './helper.js';
+import { diagLog } from './diagnostic.js';
+import { mxcErrorFromCode } from './errors.js';
+const SUPPORTED_VERSION = '0.8.0-alpha';
+const MIN_VERSION = '0.4.0-alpha';
+/**
+ * Generates a random 8-character alphanumeric string for the app container name.
+ */
+function generateRandomContainerName() {
+    return randomBytes(4).toString("hex");
+}
+function validatePolicyVersion(version) {
+    if (!version) {
+        throw new Error('Policy version is required');
+    }
+    const parsed = semverParse(version);
+    if (!parsed) {
+        throw new Error(`Invalid policy version '${version}': must be valid semver` +
+            ` (e.g., '0.5.0' or '0.5.0-alpha')`);
+    }
+    const supported = semverParse(SUPPORTED_VERSION);
+    const minimum = semverParse(MIN_VERSION);
+    if (parsed.major < minimum.major ||
+        (parsed.major === minimum.major &&
+            parsed.minor < minimum.minor)) {
+        throw new Error(`Policy version '${version}' is older than supported` +
+            ` (min: ${minimum.major}.${minimum.minor}.x).` +
+            ` Update your config.`);
+    }
+    if (parsed.major > supported.major ||
+        (parsed.major === supported.major &&
+            parsed.minor > supported.minor)) {
+        throw new Error(`Policy version '${version}' is newer than supported` +
+            ` (max: ${supported.major}.${supported.minor}.x).` +
+            ` Upgrade the SDK.`);
+    }
+}
+/**
+ * Builds the WSLC (WSL Container) portion of a ContainerConfig.
+ * WSLC runs Linux containers on Windows via the WSL Container SDK.
+ * Config goes under `experimental.wslc` since WSLC is experimental.
+ */
+function buildWslcContainerConfig(config, policy, containerId) {
+    config.containment = 'wslc';
+    config.containerId = containerId;
+    config.experimental = {
+        wslc: {
+            image: 'alpine:latest',
+        },
+    };
+    // WSLC uses its own networking mode (None/Bridged) derived from
+    // the network.defaultPolicy field — no firewall enforcement needed.
+    return config;
+}
+/**
+ * Builds the Bubblewrap (bwrap) portion of a ContainerConfig.
+ * Bubblewrap is Linux-only and uses shared cross-backend fields only —
+ * no backend-specific config block. Network enforcement via iptables
+ * reuses the same approach as LXC.
+ */
+function buildBubblewrapConfig(config) {
+    config.containment = 'bubblewrap';
+    applyLinuxNetworkPolicy(config);
+    return config;
+}
+/**
+ * Builds the Linux process container (LXC) portion of a ContainerConfig.
+ */
+function buildLinuxProcessConfig(config, containerId) {
+    config.lxc = {
+        containerName: containerId,
+        distribution: 'alpine',
+        release: '3.23',
+        destroyOnExit: true,
+    };
+    applyLinuxNetworkPolicy(config);
+    return config;
+}
+/**
+ * Builds the macOS process container (seatbelt) portion of a ContainerConfig.
+ *
+ * The seatbelt backend's `sandbox-exec` reads a TinyScheme profile
+ * generated server-side by `seatbelt_common::profile_builder`, so the SDK
+ * only needs to set the containment type and ensure the top-level `seatbelt`
+ * config block exists — the policy fields on `ContainerConfig` (filesystem /
+ * network / ui) drive the actual rules.
+ */
+function buildDarwinProcessConfig(config) {
+    config.containment = 'seatbelt';
+    config.seatbelt = config.seatbelt ?? {};
+    return config;
+}
+/**
+ * Builds the Windows process container portion of a ContainerConfig.
+ */
+function buildProcessBaseContainerConfig(config, policy, containerId) {
+    const capabilities = [];
+    if (policy.network?.allowOutbound) {
+        capabilities.push("internetClient");
+    }
+    if (policy.network?.allowLocalNetwork) {
+        capabilities.push("privateNetworkClientServer");
+    }
+    config.processContainer = {
+        name: containerId,
+        leastPrivilege: false,
+        capabilities,
+        ui: {
+            isolation: "container",
+            desktopSystemControl: false,
+            systemSettings: "none",
+            ime: false,
+        },
+    };
+    // Network enforcement: use firewall only when host filtering is needed (requires admin)
+    if (config.network) {
+        if (config.network.allowedHosts?.length || config.network.blockedHosts?.length) {
+            config.network.enforcementMode = 'both';
+        }
+        else {
+            config.network.enforcementMode = 'capabilities';
+        }
+    }
+    return config;
+}
+/**
+ * Builds the MicroVM (NanVix) portion of a ContainerConfig.
+ * MicroVM is Windows-only and does not support network or UI policies.
+ */
+function buildMicroVmConfig(config, policy) {
+    if (os.platform() !== 'win32') {
+        throw new Error('The microvm backend is only supported on Windows (requires WHP/Hyper-V).');
+    }
+    if (policy.network) {
+        throw new Error('The microvm backend does not support network policy enforcement. ' +
+            'Remove policy.network or use a different containment backend.');
+    }
+    if (policy.filesystem?.readwritePaths?.length ||
+        policy.filesystem?.readonlyPaths?.length ||
+        policy.filesystem?.deniedPaths?.length) {
+        config.filesystem = {
+            readwritePaths: policy.filesystem?.readwritePaths,
+            readonlyPaths: policy.filesystem?.readonlyPaths,
+            deniedPaths: policy.filesystem?.deniedPaths,
+            clearPolicyOnExit: policy.filesystem?.clearPolicyOnExit ?? true,
+        };
+    }
+    config.containment = 'microvm';
+    return config;
+}
+/**
+ * Creates a ContainerConfig from a SandboxPolicy and optional containment type.
+ *
+ * This is the primary API for translating user-facing security intent (SandboxPolicy)
+ * into a backend-specific configuration (ContainerConfig). The returned config
+ * can be modified before passing to spawnSandboxFromConfig().
+ *
+ * @param policy - The sandbox policy expressing security intent
+ * @param containment - Containment backend type (default: "process")
+ * @param containerName - Optional container name; auto-generated if omitted
+ * @returns A fully populated ContainerConfig ready for modification or spawning
+ *
+ * @example
+ * ```typescript
+ * const policy: SandboxPolicy = {
+ *   version: '0.5.0-alpha',
+ *   network: { allowOutbound: true },
+ *   ui: { allowWindows: true, clipboard: 'read' },
+ * };
+ *
+ * // Simple: use defaults
+ * const config = createConfigFromPolicy(policy);
+ *
+ * // Advanced: tweak backend-specific settings
+ * const config = createConfigFromPolicy(policy, "process");
+ * config.processContainer!.ui!.isolation = "atoms";
+ * ```
+ */
+export function createConfigFromPolicy(policy, containment = "process", containerName) {
+    diagLogVersion();
+    validatePolicyVersion(policy.version);
+    const platform = os.platform();
+    const containerId = containerName ?? generateRandomContainerName();
+    const clearPolicy = policy.filesystem?.clearPolicyOnExit ?? true;
+    const config = {
+        version: policy.version,
+        containerId,
+        lifecycle: {
+            destroyOnExit: true,
+            preservePolicy: !clearPolicy,
+        },
+        process: {
+            commandLine: '',
+            timeout: policy.timeoutMs ?? 0,
+        },
+    };
+    // Microvm: delegate to dedicated builder
+    if (containment === 'microvm') {
+        diagLog(`createConfigFromPolicy: containment=microvm, id=${containerId}`);
+        return buildMicroVmConfig(config, policy);
+    }
+    config.filesystem = {
+        readwritePaths: [...(policy.filesystem?.readwritePaths ?? [])],
+        readonlyPaths: [...(policy.filesystem?.readonlyPaths ?? [])],
+        deniedPaths: [...(policy.filesystem?.deniedPaths ?? [])],
+    };
+    // UI mapping (cross-platform)
+    config.ui = {
+        disable: !(policy.ui?.allowWindows ?? false),
+        clipboard: policy.ui?.clipboard ?? "none",
+        injection: policy.ui?.allowInputInjection ?? false,
+    };
+    // Network mapping (cross-platform) — default-deny: block if not explicitly allowed
+    if (policy.network) {
+        // Linux: only Bubblewrap supports network.proxy (cooperative env-var
+        // proxy, no privilege required). LXC and explicit non-bubblewrap
+        // containments do not. Abstract `'process'` on Linux resolves to
+        // Bubblewrap server-side so the proxy field is permitted there too.
+        if (policy.network.proxy && platform === 'linux') {
+            const linuxProxySupported = containment === 'bubblewrap' || containment === 'process';
+            if (!linuxProxySupported) {
+                throw new Error(`Proxy configuration is not supported on Linux containment='${containment}'. ` +
+                    `Use containment 'bubblewrap' (or the abstract 'process') for proxy-based host filtering.`);
+            }
+        }
+        if (policy.network.proxy && platform === 'darwin') {
+            throw new Error('Proxy configuration is not supported on macOS');
+        }
+        // WSLC supports block + allowedHosts via iptables (Bridged networking
+        // with per-host filtering). macOS sandbox supports it natively via
+        // per-host Seatbelt rules. Bubblewrap and LXC support it via iptables.
+        // Abstract `'process'` on Linux resolves to Bubblewrap server-side, and
+        // on macOS resolves to Seatbelt, so treat both the same as their
+        // explicit backend counterparts here.
+        // Other backends require allowOutbound for host filtering since it
+        // maps to AppContainer capabilities.
+        const resolvesToHostFilteringBackend = containment === 'wslc' ||
+            containment === 'seatbelt' ||
+            containment === 'bubblewrap' ||
+            containment === 'lxc' ||
+            (containment === 'process' && platform === 'linux') ||
+            (containment === 'process' && platform === 'darwin');
+        if (!resolvesToHostFilteringBackend) {
+            if ((policy.network.allowedHosts?.length || policy.network.blockedHosts?.length) && !policy.network.allowOutbound) {
+                throw new Error('allowedHosts/blockedHosts require allowOutbound to be true');
+            }
+        }
+        config.network = {
+            defaultPolicy: policy.network.allowOutbound ? 'allow' : 'block',
+            allowLocalNetwork: policy.network.allowLocalNetwork,
+            allowedHosts: policy.network.allowedHosts,
+            blockedHosts: policy.network.blockedHosts,
+            proxy: policy.network.proxy,
+        };
+    }
+    else {
+        config.network = {
+            defaultPolicy: 'block',
+        };
+    }
+    // Backend-specific config based on containment type
+    if (containment === 'wslc') {
+        return buildWslcContainerConfig(config, policy, containerId);
+    }
+    if (containment === 'bubblewrap') {
+        diagLog(`createConfigFromPolicy: containment=bubblewrap, id=${containerId}`);
+        return buildBubblewrapConfig(config);
+    }
+    if (containment === 'lxc') {
+        diagLog(`createConfigFromPolicy: containment=lxc, id=${containerId}`);
+        config.containment = 'lxc';
+        return buildLinuxProcessConfig(config, containerId);
+    }
+    if (containment === 'process') {
+        config.containment = 'process';
+        if (platform === 'linux') {
+            // Abstract `'process'` on Linux is resolved to Bubblewrap by the
+            // native binary (see `wxc_common::config_parser`). The wire-format
+            // payload intentionally omits any backend-specific block so the
+            // config reflects the abstract intent. Callers who explicitly want
+            // LXC must pass `containment: 'lxc'`.
+            //
+            // Network enforcement still needs the same iptables firewall mode
+            // as explicit `'bubblewrap'` when host filtering is in play.
+            applyLinuxNetworkPolicy(config);
+            diagLog(`createConfigFromPolicy: containment=process (linux, resolves to bubblewrap), id=${containerId}`);
+            return config;
+        }
+        if (platform === 'darwin') {
+            // The seatbelt backend has no container abstraction
+            // (per-process fork+exec sandbox), so containerId is intentionally
+            // not threaded through.
+            return buildDarwinProcessConfig(config);
+        }
+        diagLog(`createConfigFromPolicy: containment=process (BaseContainer), id=${containerId}`);
+        return buildProcessBaseContainerConfig(config, policy, containerId);
+    }
+    throw new Error(`Containment type '${containment}' is not yet supported.`);
+}
+/**
+ * Builds a sandbox payload JSON object from the sandbox policy.
+ * @param script The command line script to execute
+ * @param policy The sandbox policy configuration
+ * @param workingDirectory Optional working directory path
+ * @param containerName Optional container name; if not provided, a random name will be generated
+ * @param containment Optional containment backend type
+ * @returns The sandbox payload object
+ */
+export function buildSandboxPayload(script, policy, workingDirectory, containerName, containment = "process") {
+    const config = createConfigFromPolicy(policy, containment, containerName);
+    config.process.commandLine = script;
+    config.process.cwd = workingDirectory;
+    return config;
+}
+/**
+ * Inject environment variables into the config's `process.env` field as
+ * `KEY=VALUE` strings.  This is the explicit channel for passing env vars
+ * to the sandboxed child -- the parent process environment is NOT inherited
+ * by the sandbox (security: prevents secret leakage).
+ */
+function injectEnvIntoConfig(config, env) {
+    if (!config.process) {
+        config.process = { commandLine: '' };
+    }
+    const entries = config.process.env ? [...config.process.env] : [];
+    for (const [key, value] of Object.entries(env)) {
+        if (value !== undefined) {
+            entries.push(`${key}=${value}`);
+        }
+    }
+    config.process.env = entries;
+}
+/**
+ * Internal helper: resolves the executor binary path and spawns a PTY process.
+ */
+function spawnWithConfig(config, options, workingDirectory, env) {
+    // Inject env vars into config.process.env so they are passed explicitly to
+    // the sandboxed child via the JSON config (not via process inheritance).
+    if (env) {
+        injectEnvIntoConfig(config, env);
+    }
+    const { executablePath, args, logger, startTime } = prepareSpawn(config, options);
+    try {
+        const ptyOpts = {
+            name: "xterm-color",
+            cols: 120,
+            rows: 80,
+            ...options.ptyOptions,
+            cwd: workingDirectory || process.cwd(),
+        };
+        diagLog(`spawnWithConfig: spawning PTY process, cwd=${ptyOpts.cwd}`);
+        const ptyProcess = pty.spawn(executablePath, args, ptyOpts);
+        ptyProcess.onExit((event) => {
+            logger?.log('info', 'mxc.spawn.exit', {
+                exitCode: event.exitCode,
+                durationMs: Date.now() - startTime,
+            });
+            logger?.close();
+        });
+        return ptyProcess;
+    }
+    catch (err) {
+        logger?.close();
+        throw err;
+    }
+}
+/**
+ * Spawn a sandboxed process using wxc-exec with a PTY (node-pty) for
+ * interactive terminal I/O (colors, input forwarding).
+ *
+ * @param script The command line script to execute
+ * @param policy The sandbox policy
+ * @param options - Spawn options
+ * @param workingDirectory Optional working directory path
+ * @param containerName Optional container name; if not provided, a random name will be generated
+ * @param env Optional environment variables
+ * @returns IPty object for interacting with the sandboxed process
+ * @throws Error if platform is not supported or wxc-exec is not found
+ *
+ * @example
+ * ```typescript
+ * const script = 'python -c "import sys; print(sys.version)"';
+ * const policy: SandboxPolicy = { version: '0.4.0-alpha' };
+ *
+ * const ptyProcess = spawnSandbox(script, policy);
+ * ptyProcess.onData((data) => console.log(data));
+ * ptyProcess.onExit((e) => console.log('Exit code:', e.exitCode));
+ * ```
+ */
+export function spawnSandbox(script, policy, options = {}, workingDirectory, containerName, env) {
+    const config = buildSandboxPayload(script, policy, workingDirectory, containerName);
+    return spawnWithConfig(config, options, workingDirectory, env);
+}
+export function spawnSandboxFromConfig(config, options = {}, workingDirectory, env) {
+    if (options.usePty === false) {
+        // Inject env vars into config.process.env so they are passed explicitly to
+        // the sandboxed child via the JSON config (not via process inheritance).
+        if (env) {
+            injectEnvIntoConfig(config, env);
+        }
+        const { executablePath, args, logger, startTime } = prepareSpawn(config, options);
+        try {
+            const child = spawn(executablePath, args, {
+                cwd: workingDirectory || process.cwd(),
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            child.on('close', (code) => {
+                logger?.log('info', 'mxc.spawn.exit', {
+                    exitCode: code ?? -1,
+                    durationMs: Date.now() - startTime,
+                });
+                logger?.close();
+            });
+            child.on('error', () => {
+                logger?.close();
+            });
+            return child;
+        }
+        catch (err) {
+            logger?.close();
+            throw err;
+        }
+    }
+    diagLogVersion();
+    return spawnWithConfig(config, options, workingDirectory, env);
+}
+/**
+ * Spawn a sandboxed process and return a promise that resolves with output.
+ * Convenience wrapper around spawnSandbox for non-interactive use cases.
+ *
+ * @param script The command line script to execute
+ * @param policy The sandbox policy
+ * @param options - Spawn options
+ * @param workingDirectory Optional working directory path
+ * @param containerName Optional container name; if not provided, a random name will be generated
+ *
+ * @returns Promise that resolves with stdout/stderr and exit code
+ *
+ * @example
+ * ```typescript
+ * const policy: SandboxPolicy = {
+ *   version: '0.4.0-alpha',
+ *   filesystem: { readwritePaths: ['/workspace'] },
+ * };
+ *
+ * const result = await spawnSandboxAsync('echo hello', policy);
+ * console.log('Output:', result.stdout);
+ * console.log('Exit code:', result.exitCode);
+ * ```
+ */
+export function spawnSandboxAsync(script, policy, options = {}, workingDirectory, containerName) {
+    return new Promise((resolve, reject) => {
+        try {
+            const ptyProcess = spawnSandbox(script, policy, options, workingDirectory, containerName);
+            let output = '';
+            ptyProcess.onData((data) => {
+                output += data;
+            });
+            ptyProcess.onExit((event) => {
+                // Note: wxc-exec doesn't separate stdout/stderr when using PTY
+                // All output is combined
+                //
+                // Check for structured error envelopes from wxc-exec on failure.
+                if (event.exitCode !== 0) {
+                    const mxcError = tryParseErrorEnvelopeFromLines(output);
+                    if (mxcError) {
+                        reject(mxcError);
+                        return;
+                    }
+                }
+                resolve({
+                    stdout: output,
+                    stderr: '',
+                    exitCode: event.exitCode
+                });
+            });
+        }
+        catch (error) {
+            reject(error);
+        }
+    });
+}
+/**
+ * Scans a multi-line string for a JSON error envelope emitted by wxc-exec
+ * on stderr. Returns the first matching envelope, or null if none found.
+ * The envelope format is: `{"error": {"code": "...", "message": "...", ...}}`
+ */
+function tryParseErrorEnvelopeFromLines(output) {
+    for (const line of output.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{'))
+            continue;
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (parsed && typeof parsed === 'object' && 'error' in parsed) {
+                const env = parsed.error;
+                if (env && typeof env.code === 'string' && typeof env.message === 'string') {
+                    return mxcErrorFromCode(env.code, env.message, env.details);
+                }
+            }
+        }
+        catch {
+            // Not valid JSON on this line, continue scanning.
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=sandbox.js.map

package/node_modules/@microsoft/mxc-sdk/dist/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAY,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC;;GAEG;AACH,SAAS,2BAA2B;IAChC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,2BAA2B,OAAO,yBAAyB;YAC3D,mCAAmC,CACtC,CAAC;IACN,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,IACI,MAAM,CAAC,KAAK,GAAG,OAAQ,CAAC,KAAK;QAC7B,CAAC,MAAM,CAAC,KAAK,KAAK,OAAQ,CAAC,KAAK;YAC5B,MAAM,CAAC,KAAK,GAAG,OAAQ,CAAC,KAAK,CAAC,EACpC,CAAC;QACC,MAAM,IAAI,KAAK,CACX,mBAAmB,OAAO,2BAA2B;YACrD,UAAU,OAAQ,CAAC,KAAK,IAAI,OAAQ,CAAC,KAAK,MAAM;YAChD,sBAAsB,CACzB,CAAC;IACN,CAAC;IACD,IACI,MAAM,CAAC,KAAK,GAAG,SAAU,CAAC,KAAK;QAC/B,CAAC,MAAM,CAAC,KAAK,KAAK,SAAU,CAAC,KAAK;YAC9B,MAAM,CAAC,KAAK,GAAG,SAAU,CAAC,KAAK,CAAC,EACtC,CAAC;QACC,MAAM,IAAI,KAAK,CACX,mBAAmB,OAAO,2BAA2B;YACrD,UAAU,SAAU,CAAC,KAAK,IAAI,SAAU,CAAC,KAAK,MAAM;YACpD,mBAAmB,CACtB,CAAC;IACN,CAAC;AACL,CAAC;AAGD;;;;GAIG;AACH,SAAS,wBAAwB,CAC7B,MAAuB,EACvB,MAAqB,EACrB,WAAmB;IAEnB,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;IAEjC,MAAM,CAAC,YAAY,GAAG;QAClB,IAAI,EAAE;YACF,KAAK,EAAE,eAAe;SACzB;KACJ,CAAC;IAEF,gEAAgE;IAChE,oEAAoE;IAEpE,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC1B,MAAuB;IAEvB,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC;IAClC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC5B,MAAuB,EACvB,WAAmB;IAEnB,MAAM,CAAC,GAAG,GAAG;QACT,aAAa,EAAE,WAAW;QAC1B,YAAY,EAAE,QAAQ;QACtB,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,IAAI;KACtB,CAAC;IACF,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC7B,MAAuB;IAEvB,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,+BAA+B,CACpC,MAAuB,EACvB,MAAqB,EACrB,WAAmB;IAEnB,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QAChC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACpC,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,gBAAgB,GAAG;QACtB,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,KAAK;QACrB,YAAY;QACZ,EAAE,EAAE;YACA,SAAS,EAAE,WAAW;YACtB,oBAAoB,EAAE,KAAK;YAC3B,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,KAAK;SACb;KACJ,CAAC;IAEF,wFAAwF;IACxF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YAC7E,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC;QAC5C,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC;QACpD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACvB,MAAuB,EACvB,MAAqB;IAErB,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACX,mEAAmE;YACnE,+DAA+D,CAClE,CAAC;IACN,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM;QACzC,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM;QACxC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,UAAU,GAAG;YAChB,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc;YACjD,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa;YAC/C,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW;YAC3C,iBAAiB,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,IAAI,IAAI;SAClE,CAAC;IACN,CAAC;IACD,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IAC/B,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CAClC,MAAqB,EACrB,cAAoD,SAAS,EAC7D,aAAsB;IAEtB,cAAc,EAAE,CAAC;IACjB,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,aAAa,IAAI,2BAA2B,EAAE,CAAC;IAEnE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,iBAAiB,IAAI,IAAI,CAAC;IACjE,MAAM,MAAM,GAAoB;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW;QACX,SAAS,EAAE;YACP,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,CAAC,WAAW;SAC/B;QACD,OAAO,EAAE;YACL,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC;SACjC;KACJ,CAAC;IAEF,yCAAyC;IACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,mDAAmD,WAAW,EAAE,CAAC,CAAC;QAC1E,OAAO,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,UAAU,GAAG;QAChB,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAC9D,aAAa,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QAC5D,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;KAC3D,CAAC;IAEF,8BAA8B;IAC9B,MAAM,CAAC,EAAE,GAAG;QACR,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,IAAI,KAAK,CAAC;QAC5C,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,IAAI,MAAM;QACzC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,mBAAmB,IAAI,KAAK;KACrD,CAAC;IAEF,mFAAmF;IACnF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,qEAAqE;QACrE,iEAAiE;QACjE,iEAAiE;QACjE,oEAAoE;QACpE,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,mBAAmB,GACrB,WAAW,KAAK,YAAY,IAAI,WAAW,KAAK,SAAS,CAAC;YAC9D,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACX,8DAA8D,WAAW,KAAK;oBAC9E,0FAA0F,CAC7F,CAAC;YACN,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,iEAAiE;QACjE,sCAAsC;QACtC,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,8BAA8B,GAChC,WAAW,KAAK,MAAM;YACtB,WAAW,KAAK,UAAU;YAC1B,WAAW,KAAK,YAAY;YAC5B,WAAW,KAAK,KAAK;YACrB,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,CAAC;YACnD,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAChH,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAClF,CAAC;QACL,CAAC;QAED,MAAM,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;YAC/D,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB;YACnD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACzC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACzC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;SAC9B,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,MAAM,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO;SACzB,CAAC;IACN,CAAC;IAED,oDAAoD;IACpD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,CAAC,sDAAsD,WAAW,EAAE,CAAC,CAAC;QAC7E,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,OAAO,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvB,iEAAiE;YACjE,mEAAmE;YACnE,gEAAgE;YAChE,mEAAmE;YACnE,sCAAsC;YACtC,EAAE;YACF,kEAAkE;YAClE,6DAA6D;YAC7D,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,CAAC,mFAAmF,WAAW,EAAE,CAAC,CAAC;YAC1G,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,oDAAoD;YACpD,mEAAmE;YACnE,wBAAwB;YACxB,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,mEAAmE,WAAW,EAAE,CAAC,CAAC;QAC1F,OAAO,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,yBAAyB,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAC/B,MAAc,EACd,MAAqB,EACrB,gBAAyB,EACzB,aAAsB,EACtB,cAAoD,SAAS;IAE7D,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAQ,CAAC,WAAW,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,OAAQ,CAAC,GAAG,GAAG,gBAAgB,CAAC;IAEvC,OAAO,MAAM,CAAC;AAClB,CAAC;AAoED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,MAAuB,EACvB,GAA0C;IAE1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAa,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,MAAuB,EACvB,OAA4B,EAC5B,gBAAyB,EACzB,GAA2C;IAE3C,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,GAAG,EAAE,CAAC;QACR,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElF,IAAI,CAAC;QACH,MAAM,OAAO,GAAwB;YACnC,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,EAAE;YACR,GAAG,OAAO,CAAC,UAAU;YACrB,GAAG,EAAE,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE;SACvC,CAAC;QAEF,OAAO,CAAC,8CAA8C,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAErE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE5D,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE;gBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,MAAqB,EACrB,UAA+B,EAAE,EACjC,gBAAyB,EACzB,aAAsB,EACtB,GAA2C;IAE3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACpF,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAwCD,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,UAA+B,EAAE,EACjC,gBAAyB,EACzB,GAA2C;IAE3C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,GAAG,EAAE,CAAC;YACR,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE;gBACxC,GAAG,EAAE,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE;gBACtC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE;oBACpC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;oBACpB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,cAAc,EAAE,CAAC;IACjB,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAAqB,EACrB,UAA+B,EAAE,EACjC,gBAAyB,EACzB,aAAsB;IAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC1F,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,UAAU,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;gBACjC,MAAM,IAAI,IAAI,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,UAAU,CAAC,MAAM,CAAC,CAAC,KAA4C,EAAE,EAAE;gBACjE,+DAA+D;gBAC/D,yBAAyB;gBACzB,EAAE;gBACF,iEAAiE;gBACjE,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;oBACxD,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,CAAC,QAAQ,CAAC,CAAC;wBACjB,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC;oBACN,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,MAAc;IACpD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;gBACzB,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC3E,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-helper.d.ts

@@ -0,0 +1,70 @@
+import { SandboxSpawnOptions } from './sandbox.js';
+import { Phase, StateAwareContainmentBackend } from './state-aware-types.js';
+export declare const STATE_AWARE_VERSION = "0.6.0-alpha";
+export declare const CROSS_CUTTING_FIELDS: readonly ["filesystem", "network", "ui", "process"];
+export declare const ISOLATION_SESSION_ID_PREFIX = "iso";
+export declare const PREFIX_TO_BACKEND: Record<string, StateAwareContainmentBackend>;
+/**
+ * Resolves the wire-format backend key for a sandbox id by reading its
+ * leading prefix segment. Throws an `MxcError` with `code: 'malformed_id'`
+ * when the id has no recognised prefix.
+ */
+export declare function backendForSandboxId(sandboxId: string): StateAwareContainmentBackend;
+export interface BuildEnvelopeArgs {
+    phase: Phase;
+    backendKey: StateAwareContainmentBackend;
+    containment?: StateAwareContainmentBackend;
+    sandboxId?: string;
+    config?: Record<string, unknown>;
+}
+/**
+ * Constructs the wire-format JSON-shaped envelope for a state-aware request
+ * from a per-(backend, phase) Config. Lifts cross-cutting fields
+ * (filesystem, network, ui, process) to envelope top-level; nests any
+ * remaining backend-specific fields under `experimental.<backend>.<phase>`.
+ */
+export declare function buildStateAwareEnvelope(args: BuildEnvelopeArgs): Record<string, unknown>;
+export interface WireErrorEnvelope {
+    error: {
+        code: string;
+        message: string;
+        details?: Record<string, unknown>;
+    };
+}
+export interface WireResultEnvelope<T> {
+    result: T;
+}
+/**
+ * Parses the single-envelope JSON stdout produced by non-exec state-aware
+ * phases. Throws the corresponding `MxcError` on `{error}`, returns the
+ * unwrapped `result` on `{result}`.
+ */
+export declare function parseNonExecResponse<T>(stdout: string): T;
+/**
+ * Attempts to parse stdout as an `{error}` envelope. Returns the parsed
+ * envelope when stdout is exactly that, or `null` otherwise (script output
+ * mistaken for an envelope is suppressed). Used by exec to discriminate
+ * dispatch failure from script failure.
+ */
+export declare function tryParseErrorEnvelope(stdout: string): WireErrorEnvelope | null;
+export type SpawnImpl = (cmd: string, args: string[], opts: unknown) => unknown;
+/**
+ * Test-only hook: replace the `child_process.spawn` implementation used by
+ * non-exec state-aware calls and the buffered `execInSandboxAsync`. Not
+ * exported from `index.ts` — production code uses the real `spawn`.
+ */
+export declare function _setSpawnImpl(fn: SpawnImpl): void;
+/** Test-only hook: restore the default `child_process.spawn`. */
+export declare function _resetSpawnImpl(): void;
+export interface CollectedOutput {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+/**
+ * Spawns the executor with the given envelope, captures stdout/stderr,
+ * and resolves on close. Honors `options.signal` for cancellation.
+ */
+export declare function spawnAndCollect(envelope: Record<string, unknown>, options: SandboxSpawnOptions): Promise<CollectedOutput>;
+export declare function nonExecCall<T>(envelope: Record<string, unknown>, options: SandboxSpawnOptions): Promise<T>;
+//# sourceMappingURL=state-aware-helper.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/state-aware-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-aware-helper.d.ts","sourceRoot":"","sources":["../src/state-aware-helper.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAE7E,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAKjD,eAAO,MAAM,oBAAoB,qDAAsD,CAAC;AAMxF,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAIjD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAE1E,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,4BAA4B,CAWnF;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,4BAA4B,CAAC;IACzC,WAAW,CAAC,EAAE,4BAA4B,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BxF;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC;CACX;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAiBzD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAa9E;AAID,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;AAGhF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAEjD;AAED,iEAAiE;AACjE,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC,CAGZ"}