@openclaw/mxc-sandbox 0.0.0 → 2026.7.2-beta.2

package/node_modules/@microsoft/mxc-sdk/dist/types.d.ts

@@ -0,0 +1,439 @@
+/**
+ * MXC SDK Types
+ * These types match the wxc-exec JSON configuration schema
+ */
+/**
+ * Process execution settings
+ */
+export interface ProcessConfig {
+    /** Complete command line to execute (e.g., "python -c \"print('hello')\"") */
+    commandLine: string;
+    /** Working directory for the process */
+    cwd?: string;
+    /** Environment variables as KEY=VALUE strings */
+    env?: string[];
+    /** Execution timeout in milliseconds (default: 0 = no timeout) */
+    timeout?: number;
+}
+/**
+ * Container lifecycle settings shared across all backends
+ */
+export interface LifecycleConfig {
+    /** Destroy the container after execution completes (default: true) */
+    destroyOnExit?: boolean;
+    /** Retain filesystem and network policies after execution (default: false) */
+    preservePolicy?: boolean;
+}
+/**
+ * Abstract containment intent. Names the *kind* of isolation the caller
+ * wants; the native binary resolves it to a concrete
+ * {@link ContainmentBackend} per host capability.
+ *
+ * Today's intents:
+ * - "process": OS-native process-level isolation. Resolves to
+ *   `processcontainer` (Windows), `bubblewrap` (Linux), or `seatbelt`
+ *   (macOS). On Linux, `lxc` remains available as an explicit concrete
+ *   backend but is no longer the default for the abstract `"process"`
+ *   intent.
+ * - "vm": full hardware-virtualised VM isolation. Resolves to
+ *   `windows_sandbox` on Windows; no concrete VM backend exists on other
+ *   platforms today.
+ * - "microvm": lightweight-VM isolation. Resolves to the current MicroVM
+ *   runner (Windows only, experimental); intended to expand as additional
+ *   microvm backends (e.g. NanVix) are added.
+ *
+ * Concrete-only backends (such as `"wslc"`) live on
+ * {@link ContainmentBackend} until there is a meaningful abstraction over
+ * multiple implementations of the same kind.
+ */
+export type ContainmentType = "process" | "vm" | "microvm";
+/**
+ * Runtime list of {@link ContainmentType} values. Kept in sync with the
+ * `ContainmentType` union via the type annotation. Use this to recognise
+ * abstract intents at run time (the union itself only exists at compile
+ * time).
+ */
+export declare const ContainmentTypes: readonly ContainmentType[];
+/**
+ * Deprecated containment wire values, mapped to their canonical
+ * {@link ContainmentBackend} replacement. The native binary (wxc-exec) accepts
+ * the deprecated form via serde aliases; this map mirrors that behavior in
+ * the SDK validator so legacy configs are not rejected before reaching the
+ * binary.
+ *
+ * The map is intentionally partial: only deprecated keys appear. Use a
+ * presence check (e.g. `LegacyContainmentAliases[value] ?? value`) rather
+ * than indexing blindly.
+ *
+ * The wire payload is forwarded to wxc-exec unchanged — the Rust parser
+ * performs the final mapping at runtime. Resolution here is purely so the
+ * SDK's experimental-mode, platform-support, and availability checks see
+ * the canonical backend.
+ *
+ * Internal to the SDK; not part of the public API. Subject to removal in a
+ * future minor release once the deprecation window closes.
+ */
+export declare const LegacyContainmentAliases: Readonly<Partial<Record<string, ContainmentBackend>>>;
+/**
+ * Concrete containment backend. Each value names a specific runner
+ * implementation in the native binary. Prefer a {@link ContainmentType}
+ * value unless you specifically need to force a particular backend.
+ */
+export type ContainmentBackend = 'processcontainer' | 'windows_sandbox' | 'wslc' | 'lxc' | 'microvm' | 'hyperlight' | 'seatbelt' | 'isolation_session' | 'bubblewrap';
+/**
+ * Containment values (abstract intent or concrete backend) that require
+ * the `--experimental` flag.
+ */
+export declare const ExperimentalBackends: readonly (ContainmentType | ContainmentBackend)[];
+/**
+ * Clipboard access policy levels
+ */
+export type ClipboardPolicy = "none" | "read" | "write" | "all";
+/**
+ * Cross-platform UI configuration in ContainerConfig.
+ * Mapped from SandboxPolicy.ui by createConfigFromPolicy.
+ */
+export interface UiConfig {
+    /** Whether UI is disabled (no visible windows). Maps from !policy.ui.allowWindows. */
+    disable: boolean;
+    /** Clipboard access level */
+    clipboard: ClipboardPolicy;
+    /** Whether input injection is allowed */
+    injection: boolean;
+}
+/**
+ * BaseProcess-specific UI configuration (Windows only).
+ * Lives under processContainer.ui in ContainerConfig.
+ */
+export interface BaseProcessUiConfig {
+    /** UI isolation level for the desktop */
+    isolation: "desktop" | "handles" | "atoms" | "container";
+    /** Whether desktop system control is allowed */
+    desktopSystemControl: boolean;
+    /** System settings access level */
+    systemSettings: string;
+    /** Whether IME (Input Method Editor) is allowed */
+    ime: boolean;
+}
+/**
+ * ProcessContainer configuration for the Windows process-level backend.
+ *
+ * `processcontainer` is the abstraction layer; the runner picks between
+ * the legacy AppContainer implementation (which honors `capabilities`,
+ * `leastPrivilege`) and the newer BaseContainer implementation (which
+ * honors `ui`) at run time based on the host OS and the `--experimental`
+ * flag.
+ */
+export interface ProcessContainerConfig {
+    /** AppContainer profile name (default: "CLI"). Deprecated: use containerId instead. */
+    name?: string;
+    /** Use least privilege mode with PROCESS_CREATION_ALL_APPLICATION_PACKAGES_OPT_OUT (default: false) */
+    leastPrivilege?: boolean;
+    /** Additional AppContainer capabilities (e.g., "registryRead", "internetClient") */
+    capabilities?: string[];
+    /** BaseProcess-specific UI settings (Windows only) */
+    ui?: BaseProcessUiConfig;
+}
+/**
+ * Filesystem access configuration
+ */
+export interface FilesystemConfig {
+    /** Paths the script can read and write */
+    readwritePaths?: string[];
+    /** Paths the script can read but not write */
+    readonlyPaths?: string[];
+    /** Paths the script cannot access */
+    deniedPaths?: string[];
+    /** Automatically remove file access policy after execution (default: true) */
+    clearPolicyOnExit?: boolean;
+}
+/**
+ * Network access configuration
+ */
+export interface NetworkConfig {
+    /**
+     * Network enforcement mode:
+     * - "capabilities": Use AppContainer capabilities only (no admin required)
+     * - "firewall": Use Windows Firewall rules (requires admin)
+     * - "both": Use both capabilities and firewall rules (requires admin)
+     * (default: "both")
+     */
+    enforcementMode?: 'capabilities' | 'firewall' | 'both';
+    /** Default network policy: "allow" or "block" (default: "block") */
+    defaultPolicy?: 'allow' | 'block';
+    /**
+     * Whether to allow inbound connections to local IP listeners (i.e. the
+     * sandboxed process may call `bind()` + `listen()` and accept incoming
+     * TCP/UDP). Independent of `defaultPolicy`. (default: false)
+     */
+    allowLocalNetwork?: boolean;
+    /** Hostnames or IP addresses/CIDR blocks to allow (firewall mode only) */
+    allowedHosts?: string[];
+    /** Hostnames or IP addresses to block (firewall mode only) */
+    blockedHosts?: string[];
+    /** Proxy configuration (supported on Windows ProcessContainer and Linux Bubblewrap) */
+    proxy?: {
+        builtinTestServer: true;
+    } | {
+        localhost: number;
+    } | {
+        url: string;
+    };
+    /** Automatically remove firewall rules after execution (default: true). Deprecated: use lifecycle.preservePolicy. */
+    removeRulesOnExit?: boolean;
+}
+/**
+ * WSLC SDK configuration for Linux containers from Windows
+ */
+export interface WslcConfig {
+    /** OCI container image name (default: "alpine:latest") */
+    image?: string;
+    /** Storage path for WSLC session image store */
+    storagePath?: string;
+    /** Target OS for the container (default: "linux") */
+    targetOs?: string;
+    /** Number of CPUs allocated to the WSLC session */
+    cpuCount?: number;
+    /** Memory in MB allocated to the WSLC session */
+    memoryMb?: number;
+    /** Enable GPU passthrough to the container (default: false) */
+    gpu?: boolean;
+    /** Path to a local tar file to import as the container image */
+    imageTarPath?: string;
+    /** Host↔container port mappings (TCP only) */
+    portMappings?: PortMapping[];
+}
+/**
+ * Port mapping for host↔container port forwarding
+ */
+export interface PortMapping {
+    /** Port on the Windows host */
+    windowsPort: number;
+    /** Port inside the Linux container */
+    containerPort: number;
+    /** Protocol: "tcp" or "udp" (default: "tcp") */
+    protocol?: string;
+}
+/**
+ * Main WXC configuration
+ */
+export interface ContainerConfig {
+    /** MXC config schema version. Required. */
+    version: string;
+    /** Externally assigned container identifier */
+    containerId?: string;
+    /** Containment intent (preferred) or concrete backend (override). */
+    containment?: ContainmentType | ContainmentBackend;
+    /** Container lifecycle settings */
+    lifecycle?: LifecycleConfig;
+    /** Process execution settings (required) */
+    process?: ProcessConfig;
+    /** ProcessContainer configuration */
+    processContainer?: ProcessContainerConfig;
+    /**
+     * Legacy alias of {@link processContainer}. Retained so callers
+     * migrating from pre-0.6 SDK versions can keep their existing code
+     * compiling; the native binary parses both names into the same slot
+     * via a serde alias.
+     *
+     * @deprecated Use {@link processContainer} instead. This alias may be
+     * removed in a future minor release.
+     */
+    appContainer?: ProcessContainerConfig;
+    /** LXC container configuration (Linux only) */
+    lxc?: LxcConfig;
+    /** Filesystem access configuration */
+    filesystem?: FilesystemConfig;
+    /** Network access configuration */
+    network?: NetworkConfig;
+    /** Experimental features (only applied when --experimental flag is set) */
+    experimental?: {
+        /** WSLC SDK configuration for Linux containers from Windows */
+        wslc?: WslcConfig;
+    };
+    /** macOS Seatbelt sandbox configuration (macOS only) */
+    seatbelt?: SeatbeltConfig;
+    /** Cross-platform UI configuration */
+    ui?: UiConfig;
+}
+/**
+ * The main sandbox policy configuration interface for external consumers
+ * to define sandboxed execution environments.
+ *
+ * Policy describes *what* the caller wants restricted. Cross-platform.
+ * No OS-specific content. Omitted fields = most restrictive (default-deny).
+ */
+export type SandboxPolicy = {
+    /** Policy version (semver). Must match a supported schema version. */
+    version: string;
+    /** Filesystem access restrictions */
+    filesystem?: {
+        /** Paths that are granted read and write access */
+        readwritePaths?: string[];
+        /** Paths that are granted read-only access */
+        readonlyPaths?: string[];
+        /** Paths that are explicitly denied all access */
+        deniedPaths?: string[];
+        /** Whether to clear the filesystem policy when the shell exits. (default: true) */
+        clearPolicyOnExit?: boolean;
+    };
+    /** Network access restrictions. All flags default to false (no network access). */
+    network?: {
+        /** Whether to allow outbound connections to the Internet. (default: false) */
+        allowOutbound?: boolean;
+        /** Whether to allow connections to local networks. (default: false) */
+        allowLocalNetwork?: boolean;
+        /** When set, ONLY these outbound hosts are reachable. Requires allowOutbound. */
+        allowedHosts?: string[];
+        /** Hosts to block even when outbound is allowed. Requires allowOutbound. */
+        blockedHosts?: string[];
+        /**
+         * Proxy configuration. Routes all traffic through this proxy.
+         * Cannot be combined with other network flags.
+         */
+        proxy?: {
+            builtinTestServer: true;
+        } | {
+            localhost: number;
+        } | {
+            url: string;
+        };
+    };
+    /** UI access restrictions. All flags default to denied. */
+    ui?: {
+        /** Whether the sandbox may create visible windows. (default: false) */
+        allowWindows?: boolean;
+        /** Clipboard access level. (default: "none") */
+        clipboard?: ClipboardPolicy;
+        /** Whether the sandbox may inject keyboard/mouse input. (default: false) */
+        allowInputInjection?: boolean;
+    };
+    /** Execution timeout in milliseconds. Omitted = no timeout. */
+    timeoutMs?: number;
+};
+/**
+ * LXC container configuration for Linux sandbox
+ */
+export interface LxcConfig {
+    /** Container name (default: auto-generated) */
+    containerName?: string;
+    /** Linux distribution for container rootfs (default: "alpine") */
+    distribution?: string;
+    /** Distribution release version (default: "3.19") */
+    release?: string;
+    /** Whether to destroy the container after execution (default: true) */
+    destroyOnExit?: boolean;
+}
+/**
+ * macOS Seatbelt sandbox configuration. Used under the top-level
+ * `seatbelt` key when `containment == "seatbelt"`.
+ */
+export interface SeatbeltConfig {
+    /**
+     * Optional override of the generated TinyScheme sandbox profile.
+     */
+    profileOverride?: string;
+    /**
+     * Allow the inner process to allocate its own pseudo-terminals via
+     * `posix_openpt` (needed by tests, `git`, `gh`, REPLs, and any tool
+     * that wraps commands in a pty). Adds `(allow pseudo-tty)` and
+     * read/write/ioctl on `/dev/ptmx` to the generated profile. Defaults
+     * to `true`; set to `false` for the tightest possible sandbox when
+     * the inner command does not need to allocate new ttys.
+     */
+    nestedPty?: boolean;
+    /**
+     * Allow the inner process to use the macOS Keychain (e.g. via
+     * `keytar` or `Security.framework`) end-to-end. Adds Mach lookup for
+     * `securityd`, `trustd`, `ocspd`, `cfprefsd`, `xpcd`, and the
+     * `com.apple.lsd.*` family; read access to `/private/var/db/mds` and
+     * `/private/var/protected/trustd`; and read+write access to
+     * `~/Library/Keychains` and `/private/var/folders` (XPC cache).
+     * Defaults to `false`; opt in only when the inner workload genuinely
+     * needs Keychain access.
+     */
+    keychainAccess?: boolean;
+    /**
+     * Additional Mach service global-names to allow `mach-lookup` for.
+     * Escape hatch for callers that need a specific system service the
+     * baseline doesn't cover (e.g. opt-in agent integrations). Each entry
+     * is rendered as `(global-name "...")` inside a single
+     * `(allow mach-lookup ...)` form.
+     */
+    extraMachLookups?: string[];
+}
+/**
+ * Sandboxing methods available on the platform
+ *
+ * @deprecated Prefer {@link ContainmentBackend} (concrete) or
+ * {@link ContainmentType} (abstract). This alias is retained for
+ * backward compatibility and may be removed in a future minor release.
+ */
+export type SandboxingMethod = ContainmentType | ContainmentBackend;
+/**
+ * Isolation tier selected by the runtime fallback detector.
+ *
+ * - `base-container`: full BaseContainer (Experimental_CreateProcessInSandbox)
+ * - `appcontainer-bfs`: AppContainer + BFS filesystem isolation
+ * - `appcontainer-dacl`: AppContainer + host DACL augmentation (last-resort fallback)
+ */
+export type IsolationTier = 'base-container' | 'appcontainer-bfs' | 'appcontainer-dacl';
+/**
+ * Host support for enforcing sandbox UI restrictions.
+ *
+ * The fields describe platform-agnostic restriction intents, not the
+ * OS-specific primitive used to enforce them. For example, Windows derives
+ * these values from `JOB_OBJECT_UILIMIT_*` support. The SDK currently
+ * receives this object only from the Windows native probe; other platforms
+ * omit `PlatformSupport.uiCapabilities` until they expose equivalent probe
+ * data.
+ */
+export interface UiCapabilitySupport {
+    /** Whether the host can block reads from the clipboard. */
+    canBlockClipboardRead: boolean;
+    /** Whether the host can block writes to the clipboard. */
+    canBlockClipboardWrite: boolean;
+    /** Whether the host can block synthetic keyboard/mouse input. */
+    canBlockInputInjection: boolean;
+    /** Whether the host can block input method / IME changes. */
+    canBlockInputMethodChanges: boolean;
+    /** Whether the host can block access to external UI object handles. */
+    canBlockExternalUiObjects: boolean;
+    /** Whether the host can block access to global UI namespaces. */
+    canBlockGlobalUiNamespace: boolean;
+    /** Whether the host can block desktop switching. */
+    canBlockDesktopSwitching: boolean;
+    /** Whether the host can block logoff or shutdown requests. */
+    canBlockLogoffOrShutdown: boolean;
+    /** Whether the host can block system parameter changes. */
+    canBlockSystemParameterChanges: boolean;
+    /** Whether the host can block display settings changes. */
+    canBlockDisplaySettingsChanges: boolean;
+}
+/**
+ * Platform support information
+ */
+export interface PlatformSupport {
+    /** Whether WXC is supported on the current platform */
+    isSupported: boolean;
+    /** Reason why the platform is not supported (if applicable) */
+    reason?: string;
+    /** Available sandboxing methods on this platform */
+    availableMethods: ContainmentBackend[];
+    /**
+     * Tier that would be selected for an empty policy on this system.
+     * Omitted on non-Windows platforms or when the probe fails.
+     */
+    isolationTier?: IsolationTier;
+    /**
+     * Tier degradation warnings (one per fall-through during selection).
+     * Omitted on non-Windows platforms or when the probe fails.
+     */
+    isolationWarnings?: string[];
+    /**
+     * Host UI-restriction capabilities. Omitted when the backend probe cannot
+     * determine them, including on Linux and macOS today.
+     */
+    uiCapabilities?: UiCapabilitySupport;
+}
+//# sourceMappingURL=types.d.ts.map

package/node_modules/@microsoft/mxc-sdk/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;GAGG;AAGH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAiC,CAAC;AAEzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAG1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B,kBAAkB,GAClB,iBAAiB,GACjB,MAAM,GACN,KAAK,GACL,SAAS,GACT,YAAY,GACZ,UAAU,GACV,mBAAmB,GACnB,YAAY,CAAC;AAEjB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAA8E,CAAC;AAEjK;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,SAAS,EAAE,eAAe,CAAC;IAC3B,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,CAAC;IACzD,gDAAgD;IAChD,oBAAoB,EAAE,OAAO,CAAC;IAC9B,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sDAAsD;IACtD,EAAE,CAAC,EAAE,mBAAmB,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,cAAc,GAAG,UAAU,GAAG,MAAM,CAAC;IACvD,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uFAAuF;IACvF,KAAK,CAAC,EAAE;QAAE,iBAAiB,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,qHAAqH;IACrH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,WAAW,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACnD,mCAAmC;IACnC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,sCAAsC;IACtC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,mCAAmC;IACnC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2EAA2E;IAC3E,YAAY,CAAC,EAAE;QACb,+DAA+D;QAC/D,IAAI,CAAC,EAAE,UAAU,CAAC;KACnB,CAAC;IACF,wDAAwD;IACxD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,sCAAsC;IACtC,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE;QACT,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,8CAA8C;QAC9C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,kDAAkD;QAClD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,mFAAmF;QACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF,mFAAmF;IACnF,OAAO,CAAC,EAAE;QACN,8EAA8E;QAC9E,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,uEAAuE;QACvE,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,4EAA4E;QAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB;;;WAGG;QACH,KAAK,CAAC,EAAE;YAAE,iBAAiB,EAAE,IAAI,CAAA;SAAE,GAAG;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;KACjF,CAAC;IACF,2DAA2D;IAC3D,EAAE,CAAC,EAAE;QACD,uEAAuE;QACvE,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,gDAAgD;QAChD,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,4EAA4E;QAC5E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,0DAA0D;IAC1D,sBAAsB,EAAE,OAAO,CAAC;IAChC,iEAAiE;IACjE,sBAAsB,EAAE,OAAO,CAAC;IAChC,6DAA6D;IAC7D,0BAA0B,EAAE,OAAO,CAAC;IACpC,uEAAuE;IACvE,yBAAyB,EAAE,OAAO,CAAC;IACnC,iEAAiE;IACjE,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,wBAAwB,EAAE,OAAO,CAAC;IAClC,8DAA8D;IAC9D,wBAAwB,EAAE,OAAO,CAAC;IAClC,2DAA2D;IAC3D,8BAA8B,EAAE,OAAO,CAAC;IACxC,2DAA2D;IAC3D,8BAA8B,EAAE,OAAO,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC"}

package/node_modules/@microsoft/mxc-sdk/dist/types.js

@@ -0,0 +1,38 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+/**
+ * Runtime list of {@link ContainmentType} values. Kept in sync with the
+ * `ContainmentType` union via the type annotation. Use this to recognise
+ * abstract intents at run time (the union itself only exists at compile
+ * time).
+ */
+export const ContainmentTypes = ['process', 'vm', 'microvm'];
+/**
+ * Deprecated containment wire values, mapped to their canonical
+ * {@link ContainmentBackend} replacement. The native binary (wxc-exec) accepts
+ * the deprecated form via serde aliases; this map mirrors that behavior in
+ * the SDK validator so legacy configs are not rejected before reaching the
+ * binary.
+ *
+ * The map is intentionally partial: only deprecated keys appear. Use a
+ * presence check (e.g. `LegacyContainmentAliases[value] ?? value`) rather
+ * than indexing blindly.
+ *
+ * The wire payload is forwarded to wxc-exec unchanged — the Rust parser
+ * performs the final mapping at runtime. Resolution here is purely so the
+ * SDK's experimental-mode, platform-support, and availability checks see
+ * the canonical backend.
+ *
+ * Internal to the SDK; not part of the public API. Subject to removal in a
+ * future minor release once the deprecation window closes.
+ */
+export const LegacyContainmentAliases = {
+    appcontainer: 'processcontainer',
+    macos_sandbox: 'seatbelt',
+};
+/**
+ * Containment values (abstract intent or concrete backend) that require
+ * the `--experimental` flag.
+ */
+export const ExperimentalBackends = ['microvm', 'windows_sandbox', 'hyperlight', 'wslc', 'isolation_session'];
+//# sourceMappingURL=types.js.map

package/node_modules/@microsoft/mxc-sdk/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAwDlC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA+B,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAEzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA0D;IAC7F,YAAY,EAAE,kBAAkB;IAChC,aAAa,EAAE,UAAU;CAC1B,CAAC;AAkBF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsD,CAAC,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC"}

package/node_modules/@microsoft/mxc-sdk/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@microsoft/mxc-sdk",
+  "version": "0.7.0",
+  "description": "TypeScript SDK for MXC (Microsoft eXecution Containers)",
+  "type": "module",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "bin/",
+    "dist/",
+    "LICENSE.md",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "build:test-unit": "cd tests/unit && npx tsc",
+    "watch": "tsc --watch",
+    "clean": "rimraf dist",
+    "test": "npm run test:unit",
+    "test:unit": "npm run build:test-unit && node --test dist-tests/tests/unit/sandbox.test.js dist-tests/tests/unit/policy.test.js dist-tests/tests/unit/logger.test.js dist-tests/tests/unit/errors.test.js dist-tests/tests/unit/state-aware-types.test.js dist-tests/tests/unit/state-aware.test.js dist-tests/tests/unit/platform.test.js",
+    "test:integration": "cd tests/integration && npm install && npm run build && npm test",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "wxc",
+    "sandbox",
+    "security",
+    "processcontainer",
+    "windows",
+    "node-pty"
+  ],
+  "author": "Microsoft Corporation",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^20.10.0",
+    "@types/semver": "^7.7.1",
+    "node-gyp": "^12.2.0",
+    "rimraf": "^6.1.3",
+    "typescript": "^5.3.3"
+  },
+  "dependencies": {
+    "node-pty": "^1.2.0-beta.12",
+    "semver": "^7.7.4"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/node_modules/node-addon-api/LICENSE.md

@@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 [Node.js API collaborators](https://github.com/nodejs/node-addon-api#collaborators)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.