@torkbot/sandbox 0.1.0-pre.0 → 0.1.0

package/dist/index.js

@@ -0,0 +1,452 @@
+import { HostControlTransport } from "./control.js";
+import { HostProcessSandboxVm } from "./host-process.js";
+import { createSandboxHostFileSystemTools } from "./host-filesystem-tools.js";
+import { isSandboxWritableFileSystem } from "./vfs.js";
+export { HostControlTransport } from "./control.js";
+export function projectKernel(options = {}) {
+    return {
+        kind: "project-kernel",
+        ...options,
+    };
+}
+export function projectInit() {
+    return {
+        kind: "project-init",
+        crate: "sandbox-init",
+    };
+}
+export function prebuiltRootfs(path, options) {
+    return {
+        kind: "prebuilt-rootfs",
+        path,
+        readonly: options.readonly ?? true,
+        format: options.format,
+    };
+}
+export function scratchFs() {
+    return {
+        kind: "scratch-fs",
+    };
+}
+export function linuxOverlayFs(input) {
+    return {
+        kind: "linux-overlay-fs",
+        lower: input.lower,
+        upper: input.upper,
+    };
+}
+export function virtualFsMount(path, fileSystem) {
+    return {
+        kind: "virtual-fs",
+        path,
+        fileSystem,
+    };
+}
+export function mount(path, fileSystem) {
+    return virtualFsMount(path, fileSystem);
+}
+export function binding(path, fileSystem) {
+    return {
+        kind: "filesystem-binding",
+        path,
+        fileSystem,
+    };
+}
+export function acceptTcp(input) {
+    return {
+        action: "accept",
+        protocol: "tcp",
+        cidr: input.cidr,
+        ports: input.ports,
+    };
+}
+export function acceptUdp(input) {
+    return {
+        action: "accept",
+        protocol: "udp",
+        cidr: input.cidr,
+        ports: input.ports,
+    };
+}
+export function acceptPublicInternet(input = {}) {
+    return {
+        action: "accept",
+        scope: "public-internet",
+        ports: input.ports,
+    };
+}
+export async function spawnSandbox(options) {
+    validateSandboxOptions(options);
+    const hostOptions = toHostSpawnOptions(options, []);
+    const hostVm = await HostProcessSandboxVm.spawn(options, hostOptions, new Map());
+    return new HostBackedSandboxVm(hostVm, options);
+}
+export function createSandbox(options) {
+    validateSandboxOptions(options);
+    return new ConfiguredSandboxBuilder(options);
+}
+class ConfiguredSandboxBuilder {
+    http;
+    #options;
+    #requestHeaderHooks = new Set();
+    #nextRequestHeaderHookId = 1;
+    #runStarted = false;
+    #vm = null;
+    #closed = false;
+    constructor(options) {
+        this.#options = options;
+        this.http = {
+            onRequest: (selector, hook) => {
+                this.#assertOpen();
+                if (this.#runStarted) {
+                    throw new Error("sandbox has already been run");
+                }
+                const registration = {
+                    id: `http-request-headers-${this.#nextRequestHeaderHookId++}`,
+                    selector,
+                    hook,
+                    active: true,
+                };
+                this.#requestHeaderHooks.add(registration);
+                return new ConfiguredSandboxHttpHook(this, registration);
+            },
+        };
+    }
+    async run() {
+        this.#assertOpen();
+        if (this.#runStarted) {
+            throw new Error("sandbox has already been run");
+        }
+        this.#runStarted = true;
+        const registrations = Array.from(this.#requestHeaderHooks);
+        const hostOptions = toHostSpawnOptions(this.#options, registrations);
+        const hostVm = await HostProcessSandboxVm.spawn(this.#options, hostOptions, new Map(registrations.map((registration) => [registration.id, registration])));
+        this.#vm = new HostBackedSandboxVm(hostVm, this.#options);
+        return this.#vm;
+    }
+    async [Symbol.asyncDispose]() {
+        if (this.#closed) {
+            return;
+        }
+        this.#closed = true;
+        await this.#vm?.close();
+        this.#requestHeaderHooks.clear();
+    }
+    async removeHook(registration) {
+        registration.active = false;
+        this.#requestHeaderHooks.delete(registration);
+    }
+    #assertOpen() {
+        if (this.#closed) {
+            throw new Error("sandbox is closed");
+        }
+    }
+}
+class ConfiguredSandboxHttpHook {
+    #sandbox;
+    #registration;
+    #disposed = false;
+    constructor(sandbox, registration) {
+        this.#sandbox = sandbox;
+        this.#registration = registration;
+    }
+    async [Symbol.asyncDispose]() {
+        if (this.#disposed) {
+            return;
+        }
+        this.#disposed = true;
+        await this.#sandbox.removeHook(this.#registration);
+    }
+}
+class HostBackedSandboxVm {
+    mounts;
+    control;
+    diagnostics;
+    #hostVm;
+    #closed = false;
+    constructor(hostVm, options) {
+        this.#hostVm = hostVm;
+        this.mounts = new ConfiguredSandboxMounts(options.mounts ?? [], options.bindings ?? []);
+        this.control = new HostControlTransport({
+            connected: hostVm.hasControlSocket,
+            channel: hostVm,
+        });
+        if (hostVm.terminateHostForTest !== undefined) {
+            this.diagnostics = {
+                terminateHostForTest: () => hostVm.terminateHostForTest?.() ?? Promise.resolve(),
+            };
+        }
+    }
+    async close() {
+        if (this.#closed) {
+            return;
+        }
+        this.#closed = true;
+        await this.control.close();
+        await this.#hostVm.close();
+    }
+    async [Symbol.asyncDispose]() {
+        await this.close();
+    }
+}
+class ConfiguredSandboxMounts {
+    #mounts = new Map();
+    #virtualMounts = new Map();
+    #hostTools = new Map();
+    constructor(mounts, bindings) {
+        for (const mount of mounts) {
+            this.#mounts.set(mount.path, mount.fileSystem);
+            this.#virtualMounts.set(mount.path, mount.fileSystem);
+            this.#hostTools.set(mount.path, createSandboxHostFileSystemTools(mount.fileSystem));
+        }
+        for (const binding of bindings) {
+            this.#hostTools.set(binding.path, createSandboxHostFileSystemTools(binding.fileSystem));
+        }
+    }
+    get(path) {
+        const mount = this.#mounts.get(path);
+        if (mount === undefined) {
+            throw new Error(`sandbox mount not found: ${path}`);
+        }
+        return mount;
+    }
+    virtualFs(path) {
+        const mount = this.#virtualMounts.get(path);
+        if (mount === undefined) {
+            throw new Error(`virtualFs mount not found: ${path}`);
+        }
+        return mount;
+    }
+    host(path) {
+        const tools = this.#hostTools.get(path);
+        if (tools === undefined) {
+            throw new Error(`host filesystem tools not found: ${path}`);
+        }
+        return tools;
+    }
+}
+function toHostSpawnOptions(options, requestHeaderHooks) {
+    const rootfs = lowerNativeRootfs(options.rootfs);
+    if ((requestHeaderHooks.length > 0 || options.network?.http !== undefined)
+        && options.network?.outbound === undefined) {
+        throw new Error("invalid spawnSandbox options: network.outbound is required when HTTP interception is configured");
+    }
+    const network = options.network === undefined && requestHeaderHooks.length === 0
+        ? undefined
+        : {
+            outbound: options.network?.outbound,
+            http: requestHeaderHooks.length === 0
+                && options.network?.http?.certificateAuthority === undefined
+                ? undefined
+                : {
+                    caCertificatePem: options.network?.http?.certificateAuthority?.certificatePem,
+                    caPrivateKeyPem: options.network?.http?.certificateAuthority?.privateKeyPem,
+                    requestHeaderHooks: requestHeaderHooks.map((hook) => ({
+                        id: hook.id,
+                        origin: hook.selector.origin,
+                    })),
+                },
+        };
+    return {
+        name: options.name,
+        cpu: options.cpu,
+        memory: options.memory,
+        kernel: {
+            format: options.kernel.format,
+        },
+        init: {
+            crateName: options.init.crate,
+        },
+        rootfs: {
+            path: rootfs.path,
+            readonly: rootfs.readonly,
+            format: rootfs.format,
+        },
+        rootfsOverlay: options.rootfs.kind === "linux-overlay-fs"
+            ? { mode: "writable" }
+            : undefined,
+        mounts: options.mounts?.map((mount) => {
+            return {
+                kind: mount.kind,
+                path: mount.path,
+                writable: isSandboxWritableFileSystem(mount.fileSystem),
+            };
+        }),
+        network,
+    };
+}
+function lowerNativeRootfs(rootfs) {
+    if (rootfs.kind === "prebuilt-rootfs") {
+        return rootfs;
+    }
+    if (rootfs.lower.kind !== "prebuilt-rootfs") {
+        throw new Error(`rootfs ${rootfs.kind} lower ${rootfs.lower.kind} is not implemented yet`);
+    }
+    if (rootfs.upper.kind !== "scratch-fs") {
+        throw new Error(`rootfs ${rootfs.kind} upper ${rootfs.upper.kind} is not implemented yet`);
+    }
+    return {
+        ...rootfs.lower,
+        readonly: true,
+    };
+}
+function validateSandboxOptions(options) {
+    if (options.cpu?.vcpus !== undefined && (!Number.isInteger(options.cpu.vcpus) || options.cpu.vcpus <= 0)) {
+        throw new Error("invalid spawnSandbox options: cpu.vcpus must be greater than zero");
+    }
+    if (options.cpu?.vcpus !== undefined && options.cpu.vcpus > 255) {
+        throw new Error("invalid spawnSandbox options: cpu.vcpus must be less than or equal to 255");
+    }
+    if (options.memory?.mib !== undefined && (!Number.isInteger(options.memory.mib) || options.memory.mib <= 0)) {
+        throw new Error("invalid spawnSandbox options: memory.mib must be greater than zero");
+    }
+    if (options.init.crate !== "sandbox-init") {
+        throw new Error(`invalid spawnSandbox options: unsupported init crate: ${options.init.crate}`);
+    }
+    validateRootfsConfig(options.rootfs, "rootfs");
+    const mountPaths = new Set();
+    for (const mount of options.mounts ?? []) {
+        validateGuestPath(mount.path, "mount.path");
+        if (mountPaths.has(mount.path)) {
+            throw new Error(`invalid spawnSandbox options: duplicate mount path: ${mount.path}`);
+        }
+        mountPaths.add(mount.path);
+    }
+    const bindingPaths = new Set();
+    for (const binding of options.bindings ?? []) {
+        validateGuestPath(binding.path, "binding.path");
+        if (mountPaths.has(binding.path)) {
+            throw new Error(`invalid spawnSandbox options: binding path conflicts with mount path: ${binding.path}`);
+        }
+        if (bindingPaths.has(binding.path)) {
+            throw new Error(`invalid spawnSandbox options: duplicate binding path: ${binding.path}`);
+        }
+        bindingPaths.add(binding.path);
+    }
+    if (options.network?.outbound?.policy !== undefined && options.network.outbound.policy !== "deny") {
+        throw new Error("invalid spawnSandbox options: network.outbound.policy must be deny");
+    }
+    for (const rule of options.network?.outbound?.rules ?? []) {
+        if ("cidr" in rule) {
+            validateCidr(rule.cidr);
+        }
+        validateOutboundPorts(rule.ports);
+    }
+}
+function validateRootfsConfig(rootfs, field) {
+    if (rootfs.kind === "prebuilt-rootfs") {
+        if (rootfs.path.length === 0) {
+            throw new Error(`invalid spawnSandbox options: ${field}.path must not be empty`);
+        }
+        if (rootfs.format === "directory") {
+            const prefix = field === "rootfs" ? "" : `${field} `;
+            throw new Error(`invalid spawnSandbox options: ${prefix}directory rootfs is not supported for sandboxed VM launch; use an EROFS rootfs`);
+        }
+        return;
+    }
+    if (rootfs.kind === "linux-overlay-fs") {
+        validateRootfsConfig(rootfs.lower, `${field}.lower`);
+        validateRootfsConfig(rootfs.upper, `${field}.upper`);
+        return;
+    }
+    if (rootfs.kind === "scratch-fs") {
+        return;
+    }
+    throw new Error(`invalid spawnSandbox options: unsupported ${field} kind`);
+}
+function validateGuestPath(path, field) {
+    if (!path.startsWith("/")) {
+        throw new Error(`invalid spawnSandbox options: ${field} must be absolute`);
+    }
+    if (path === "/") {
+        throw new Error(`invalid spawnSandbox options: ${field} must not be root`);
+    }
+    if (path.includes("\0")) {
+        throw new Error(`invalid spawnSandbox options: ${field} must not contain NUL bytes`);
+    }
+    if (path.split("/").some((component) => component === "." || component === "..")) {
+        throw new Error(`invalid spawnSandbox options: ${field} must not contain '.' or '..' components`);
+    }
+}
+function validateOutboundPorts(ports) {
+    for (const port of ports ?? []) {
+        if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+            throw new Error(`invalid spawnSandbox options: invalid outbound network port: ${port}`);
+        }
+    }
+}
+function validateCidr(range) {
+    const [address, prefixText, extra] = range.split("/");
+    if (address === undefined || prefixText === undefined || extra !== undefined) {
+        throw new Error(`invalid spawnSandbox options: invalid CIDR range: ${range}`);
+    }
+    const prefix = Number(prefixText);
+    if (!Number.isInteger(prefix)) {
+        throw new Error(`invalid spawnSandbox options: invalid CIDR prefix: ${range}`);
+    }
+    if (address.includes(":")) {
+        if (prefix < 0 || prefix > 128) {
+            throw new Error(`invalid spawnSandbox options: invalid CIDR prefix: ${range}`);
+        }
+        if (parseIpv6Address(address) === null) {
+            throw new Error(`invalid spawnSandbox options: invalid CIDR address: ${range}`);
+        }
+        throw new Error(`invalid spawnSandbox options: IPv6 outbound CIDR ranges are not supported yet: ${range}`);
+    }
+    if (prefix < 0 || prefix > 32) {
+        throw new Error(`invalid spawnSandbox options: invalid CIDR prefix: ${range}`);
+    }
+    if (parseIpv4Address(address) === null) {
+        throw new Error(`invalid spawnSandbox options: invalid CIDR address: ${range}`);
+    }
+}
+function parseIpv4Address(address) {
+    const parts = address.split(".");
+    if (parts.length !== 4) {
+        return null;
+    }
+    let value = 0;
+    for (const part of parts) {
+        if (!/^\d+$/.test(part)) {
+            return null;
+        }
+        const octet = Number(part);
+        if (octet < 0 || octet > 255) {
+            return null;
+        }
+        value = ((value << 8) | octet) >>> 0;
+    }
+    return value;
+}
+function parseIpv6Address(address) {
+    const zoneIndex = address.indexOf("%");
+    if (zoneIndex !== -1) {
+        return null;
+    }
+    const doubleColonParts = address.split("::");
+    if (doubleColonParts.length > 2) {
+        return null;
+    }
+    const head = doubleColonParts[0] === "" ? [] : doubleColonParts[0]?.split(":") ?? [];
+    const tail = doubleColonParts.length === 1 || doubleColonParts[1] === ""
+        ? []
+        : doubleColonParts[1]?.split(":") ?? [];
+    const hasCompression = doubleColonParts.length === 2;
+    const missing = 8 - head.length - tail.length;
+    if ((!hasCompression && missing !== 0) || (hasCompression && missing < 1)) {
+        return null;
+    }
+    const groups = [...head, ...Array(hasCompression ? missing : 0).fill("0"), ...tail];
+    if (groups.length !== 8) {
+        return null;
+    }
+    let value = 0n;
+    for (const group of groups) {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(group)) {
+            return null;
+        }
+        value = (value << 16n) | BigInt(Number.parseInt(group, 16));
+    }
+    return value;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAkSpD,MAAM,UAAU,aAAa,CAAC,OAAO,GAA+B,EAAE;IACpE,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,cAAc;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAoD;IAC/F,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,IAAI;QACJ,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,IAAI,EAAE,YAAY;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAG9B;IACC,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAoC;IAC/E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,IAAI;QACJ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,UAAoC;IACtE,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,UAAoC;IACxE,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,IAAI;QACJ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAGzB;IACC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAGzB;IACC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAK,GAEtC,EAAE;IACJ,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAuB;IACxD,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAcD,MAAM,wBAAwB;IACnB,IAAI,CAAmB;IAEvB,QAAQ,CAAiB;IACzB,mBAAmB,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3E,wBAAwB,GAAG,CAAC,CAAC;IAC7B,WAAW,GAAG,KAAK,CAAC;IACpB,GAAG,GAAqB,IAAI,CAAC;IAC7B,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,OAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG;YACV,SAAS,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,CAAC;gBACD,MAAM,YAAY,GAAqC;oBACrD,EAAE,EAAE,wBAAwB,IAAI,CAAC,wBAAwB,EAAE,EAAE;oBAC7D,QAAQ;oBACR,IAAI;oBACJ,MAAM,EAAE,IAAI;iBACb,CAAC;gBACF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3C,OAAO,IAAI,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC3D,CAAC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAC7C,IAAI,CAAC,QAAQ,EACb,WAAW,EACX,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAC9E,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,YAA8C;QAC7D,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;CACF;AAED,MAAM,yBAAyB;IACpB,QAAQ,CAA2B;IACnC,aAAa,CAAmC;IACzD,SAAS,GAAG,KAAK,CAAC;IAElB,YACE,OAAiC,EACjC,YAA8C;QAE9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,mBAAmB;IACd,MAAM,CAAgB;IACtB,OAAO,CAAiB;IACxB,WAAW,CAAsB;IAEjC,OAAO,CAMd;IACF,OAAO,GAAG,KAAK,CAAC;IAEhB,YACE,MAMC,EACD,OAAuB;QAEvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,IAAI,oBAAoB,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC,WAAW,GAAG;gBACjB,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF;AAED,MAAM,uBAAuB;IAClB,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IACtD,cAAc,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC7D,UAAU,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEpE,YACE,MAA8B,EAC9B,QAA4C;QAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,gCAAgC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAY;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,IAAY;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,kBAAkB,CACzB,OAAuB,EACvB,kBAA0D;IAE1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,IACE,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC;WACnE,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAC9E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACA,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ;YACnC,IAAI,EAAE,kBAAkB,CAAC,MAAM,KAAK,CAAC;mBAChC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,oBAAoB,KAAK,SAAS;gBAC5D,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACA,gBAAgB,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,cAAc;oBAC7E,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,aAAa;oBAC3E,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBACpD,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;qBAC7B,CAAC,CAAC;iBACJ;SACJ,CAAC;IAEJ,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE;YACN,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;SAC9B;QACD,IAAI,EAAE;YACJ,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC9B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;QACD,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;YACvD,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;YACtB,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC;aACxD,CAAC;QACJ,CAAC,CAAC;QACF,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoB;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,GAAG,MAAM,CAAC,KAAK;QACf,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAuB;IACrD,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yDAAyD,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uDAAuD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC7C,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,yEAAyE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,yDAAyD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAuB,EAAE,KAAa;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,yBAAyB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,gFAAgF,CAAC,CAAC;QAC3I,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACvC,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;QACrD,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAoC;IAC3E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,mBAAmB,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,mBAAmB,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,0CAA0C,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAoC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,gEAAgE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,qDAAqD,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,uDAAuD,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kFAAkF,KAAK,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uDAAuD,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE;QACtE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,IAAI,CAAC,CAAC,cAAc,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/spawn-options.d.ts

@@ -0,0 +1,44 @@
+import type { OutboundNetworkRule } from "./index.ts";
+export type HostSpawnSandboxOptions = {
+    readonly name?: string;
+    readonly cpu?: {
+        readonly vcpus?: number;
+    };
+    readonly memory?: {
+        readonly mib?: number;
+    };
+    readonly kernel: {
+        readonly format?: "auto" | "raw" | "elf" | "pe-gz" | "image-gz" | "image-zstd";
+    };
+    readonly init: {
+        readonly crateName: "sandbox-init";
+    };
+    readonly rootfs: {
+        readonly path: string;
+        readonly readonly?: boolean;
+        readonly format: "directory" | "erofs";
+    };
+    readonly rootfsOverlay?: {
+        readonly mode: "writable";
+    };
+    readonly mounts?: readonly {
+        readonly kind: "virtual-fs";
+        readonly path: string;
+        readonly writable?: boolean;
+    }[];
+    readonly network?: {
+        readonly outbound?: {
+            readonly policy: "deny";
+            readonly rules: readonly OutboundNetworkRule[];
+        };
+        readonly http?: {
+            readonly caCertificatePem?: string;
+            readonly caPrivateKeyPem?: string;
+            readonly requestHeaderHooks?: readonly {
+                readonly id: string;
+                readonly origin: string;
+            }[];
+        };
+    };
+};
+//# sourceMappingURL=spawn-options.d.ts.map

package/dist/spawn-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-options.d.ts","sourceRoot":"","sources":["../src/spawn-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,UAAU,GAAG,YAAY,CAAC;KAChF,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;KACxC,CAAC;IACF,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;SAChD,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,EAAE;YACd,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;YACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;YAClC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS;gBACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;aACzB,EAAE,CAAC;SACL,CAAC;KACH,CAAC;CACH,CAAC"}

package/dist/spawn-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spawn-options.js.map

package/dist/spawn-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-options.js","sourceRoot":"","sources":["../src/spawn-options.ts"],"names":[],"mappings":""}

package/dist/vfs.d.ts

@@ -0,0 +1,3 @@
+import type { SandboxWritableFileSystem } from "./index.ts";
+export declare function isSandboxWritableFileSystem(fileSystem: unknown): fileSystem is SandboxWritableFileSystem;
+//# sourceMappingURL=vfs.d.ts.map

package/dist/vfs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vfs.d.ts","sourceRoot":"","sources":["../src/vfs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,OAAO,GAClB,UAAU,IAAI,yBAAyB,CAMzC"}

package/dist/vfs.js

@@ -0,0 +1,8 @@
+export function isSandboxWritableFileSystem(fileSystem) {
+    return typeof fileSystem === "object"
+        && fileSystem !== null
+        && "createFile" in fileSystem
+        && "write" in fileSystem
+        && "truncate" in fileSystem;
+}
+//# sourceMappingURL=vfs.js.map

package/dist/vfs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vfs.js","sourceRoot":"","sources":["../src/vfs.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,2BAA2B,CACzC,UAAmB;IAEnB,OAAO,OAAO,UAAU,KAAK,QAAQ;WAChC,UAAU,KAAK,IAAI;WACnB,YAAY,IAAI,UAAU;WAC1B,OAAO,IAAI,UAAU;WACrB,UAAU,IAAI,UAAU,CAAC;AAChC,CAAC"}

package/package.json

@@ -1,18 +1,40 @@
 {
   "name": "@torkbot/sandbox",
-  "version": "0.1.0-pre.0",
+  "version": "0.1.0",
   "private": false,
-  "description": "Bootstrap placeholder for npm trusted publishing setup.",
+  "type": "module",
+  "description": "A TypeScript-first Node.js library for spawning libkrun-backed microVMs.",
   "license": "MIT OR Apache-2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/torkbot/sandbox"
   },
   "publishConfig": {
-    "access": "public",
-    "tag": "trusted-publishing-bootstrap"
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "sandbox": "./dist/cli.js"
   },
   "files": [
+    "dist",
     "README.md"
-  ]
+  ],
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "bson": "^7.2.0",
+    "just-bash": "^2.14.5"
+  },
+  "optionalDependencies": {
+    "@torkbot/sandbox-darwin-arm64": "0.1.0",
+    "@torkbot/sandbox-linux-x64-gnu": "0.1.0"
+  }
 }