@torkbot/sandbox 0.1.0 → 0.2.0

package/README.md

@@ -1,108 +1,70 @@
 # Sandbox
 
-Sandbox is a TypeScript-first Node.js library for spawning libkrun-backed microVMs.
-
-The target shape is:
-
-- boot a guest from a prebuilt read-only rootfs artifact, likely EROFS,
-- mount host-implemented virtual filesystems,
-- intercept guest HTTP request headers through host TypeScript hooks,
-- communicate with guest init over a bidirectional transport,
-- ship as a statically linked host artifact.
+Sandbox is a TypeScript-first Node.js library for running work inside
+libkrun-backed microVMs with host-controlled filesystems and network policy.
 
 ```ts
 import {
-  acceptPublicInternet,
-  acceptTcp,
-  binding,
-  linuxOverlayFs,
-  mount,
-  prebuiltRootfs,
-  projectInit,
-  projectKernel,
-  scratchFs,
-  createSandbox,
-  type SandboxWritableFileSystem,
+  defineSandbox,
+  fs,
+  rootfs,
 } from "@torkbot/sandbox";
 
-declare const workspaceFs: SandboxWritableFileSystem;
-
-await using sandbox = createSandbox({
-  kernel: projectKernel(),
-  init: projectInit(),
-  rootfs: linuxOverlayFs({
-    lower: prebuiltRootfs("dist/rootfs/sandbox.erofs", { format: "erofs" }),
-    upper: scratchFs(),
-  }),
+const workspaceFs = fs.memory({
+  files: {
+    "/hello.txt": "hello from the host filesystem\n",
+  },
+});
 
-  mounts: [
-    mount("/sandbox", {
-      async stat(path) {
-        if (path === "/") {
-          return {
-            type: "directory",
-            sizeBytes: null,
-            mediaType: null,
-            modifiedAtMs: null,
-          };
-        }
-
-        if (path === "/status.json") {
-          const body = JSON.stringify({ ready: true });
-          return {
-            type: "file",
-            sizeBytes: Buffer.byteLength(body),
-            mediaType: "application/json",
-            modifiedAtMs: null,
-          };
-        }
-
-        throw new Error(`missing path ${path}`);
-      },
-
-      async list(path) {
-        if (path !== "/") throw new Error(`missing directory ${path}`);
-        return [{ name: "status.json", type: "file" }];
-      },
-
-      async read(input) {
-        if (input.path !== "/status.json") {
-          throw new Error(`unknown virtual file: ${input.path}`);
-        }
-
-        return Buffer.from(JSON.stringify({ ready: true }));
-      },
-    }),
-  ],
-
-  bindings: [
-    binding("/workspace", workspaceFs),
-  ],
-
-  network: {
-    outbound: {
-      policy: "deny",
-      rules: [
-        acceptTcp({ cidr: "127.0.0.1/32", ports: [8080] }),
-        acceptPublicInternet({ ports: [443] }),
-      ],
-    },
+const sandbox = defineSandbox({
+  rootfs: rootfs.builtIn("alpine:3.20"),
+  resources: {
+    cpus: 2,
+    memoryMiB: 2048,
   },
 });
 
-sandbox.http.onRequest({ origin: "https://api.github.com" }, (request) => {
-  request.headers.set("authorization", `Bearer ${process.env.GITHUB_TOKEN}`);
+await using lane = await sandbox.boot({
+  mounts: {
+    "/workspace": fs.virtual(workspaceFs),
+  },
+  cwd: "/workspace",
 });
 
-await using vm = await sandbox.run();
+const result = await lane.exec("cat", ["hello.txt"]);
+
+if (result.exitCode !== 0) {
+  throw new Error(result.stderr);
+}
 ```
 
-Incremental guest operations are explicit:
+## Quick Start
+
+Create reusable machine configuration once, then boot one or more instances with
+the mounts each instance needs:
 
 ```ts
-const result = await vm.control.exec({
-  id: "tests",
-  argv: ["node", "--test", "test/**/*.test.ts"],
+import {
+  defineSandbox,
+  fs,
+  rootfs,
+} from "@torkbot/sandbox";
+
+const workspaceFs = fs.memory();
+
+const sandbox = defineSandbox({
+  rootfs: rootfs.builtIn("alpine:3.20"),
+});
+
+await using lane = await sandbox.boot({
+  mounts: {
+    "/workspace": fs.virtual(workspaceFs),
+  },
+  cwd: "/workspace",
+});
+
+const result = await lane.exec("sh", ["-lc", "printf 'ok\\n'"], {
+  env: { CI: "1" },
 });
 
 if (result.exitCode !== 0) {
@@ -110,70 +72,212 @@ if (result.exitCode !== 0) {
 }
 ```
 
-Mounted filesystems expose both the raw callback shape and a host-side tool surface for agent workflows:
+The public API is split into three layers:
+
+- `defineSandbox(...)` describes reusable machine configuration.
+- `sandbox.boot(...)` creates a runtime instance with per-instance mounts.
+- `lane.exec(...)` runs buffered work inside the booted instance.
+
+Expensive artifact preparation is intentionally outside `boot()`.
+`rootfs.builtIn("alpine:3.20")` selects a built-in rootfs artifact that must
+already be installed with Sandbox. It does not pull an image or build a rootfs
+at runtime.
+
+## API Overview
+
+### Configuration
 
 ```ts
-const sandboxProc = vm.mounts.virtualFs("/sandbox");
-const statusBytes = await sandboxProc.read({
-  path: "/status.json",
-  signal: AbortSignal.timeout(1_000),
-});
+type SandboxDefinition = {
+  rootfs: Rootfs;
+  resources?: {
+    cpus?: number;
+    memoryMiB?: number;
+  };
+  network?: NetworkPolicy;
+};
+```
+
+`rootfs` selects the guest root filesystem. The first public rootfs source is
+the read-only built-in catalog:
 
-console.log(JSON.parse(Buffer.from(statusBytes).toString("utf8")));
+```ts
+rootfs.builtIn("alpine:3.20");
+```
 
-const workspace = vm.mounts.host("/workspace");
+`resources` controls the VM shape used by every instance booted from the
+definition. Omitted values use Sandbox defaults.
 
-const notes = await workspace.read({
-  path: "notes.md",
-  offset: 1,
-  limit: 80,
+```ts
+defineSandbox({
+  rootfs: rootfs.builtIn("alpine:3.20"),
+  resources: {
+    cpus: 4,
+    memoryMiB: 4096,
+  },
 });
+```
+
+Use `rootfs.cow(...)` when rootfs mutations should persist. The sandbox library
+owns the COW block-device contract; user-space owns the block store's
+durability, compression, migration, and checkpoint policy. Built-in rootfs
+packages include a read-only EROFS image for normal boots and a writable ext4
+image used as the COW base.
 
-await workspace.write({
-  path: "plan.md",
-  content: "# Plan\n\nStart here.\n",
+```ts
+defineSandbox({
+  rootfs: rootfs.cow({
+    base: rootfs.builtIn("alpine:3.20"),
+    writable: laneBlockStore,
+  }),
 });
+```
+
+The block store interface is intentionally storage-agnostic:
+
+```ts
+interface SandboxBlockStore {
+  readonly blockSize: number;
+  list(context: SandboxBlockStoreContext): Promise<readonly bigint[]>;
+  read(
+    range: SandboxBlockRange,
+    context: SandboxBlockStoreContext,
+  ): Promise<readonly SandboxBlockChunk[]>;
+  write(
+    chunks: readonly SandboxBlockChunk[],
+    context: SandboxBlockStoreContext,
+  ): Promise<void>;
+  flush?(context: SandboxBlockStoreContext): Promise<void>;
+}
+```
+
+The `context.base` value identifies the exact built-in base image for this boot.
+The sandbox library passes it through to every block-store operation; user-space
+storage can use it to namespace blocks, reject mismatched snapshots, or migrate
+state. `list()` returns the block IDs currently present in the COW store. The
+Rust block backend reads that manifest once at boot, so clean base-image blocks
+are served without asking JavaScript. Dirty blocks are read lazily and writes are
+batched back through `write(...)` on flush.
 
-await workspace.patch({
-  path: "plan.md",
-  edits: [{ oldText: "Start here.", newText: "Ship the narrow slice." }],
+A writable COW block store must be attached to at most one running sandbox
+instance at a time. Concurrent sandboxes sharing the same writable store are
+undefined behavior; create one store per lane or enforce exclusivity in the
+storage driver.
+
+`network` is optional. When omitted, egress is denied. A network policy receives
+connection requests and grants only the traffic it explicitly allows:
+
+```ts
+const policy = network.policy(async (conn) => {
+  if (conn.host === "registry.npmjs.org") {
+    conn.allowHttp();
+  }
 });
+```
 
-const grep = await workspace.bash({
-  command: "grep \"Ship\" plan.md",
-  timeoutMs: 1_000,
+`conn.allow()` grants HTTP(S)-classified traffic without request middleware.
+`conn.allowHttp(...)` grants HTTP(S)-classified traffic and can apply request
+middleware:
+
+```ts
+const policy = network.policy(async (conn) => {
+  if (conn.host !== "api.example.com") return;
+
+  conn.allowHttp(async (request) => {
+    request.headers.set(
+      "authorization",
+      `Bearer ${await credentialBroker.authorizationFor(request)}`,
+    );
+  });
 });
 ```
 
-Root filesystems are immutable by default. A writable root is expressed as an explicit Linux overlayfs composition:
+Deny remains the default. If the policy callback does not create a grant, the
+connection is blocked. The `NetworkGrant` returned by `allow()` and
+`allowHttp()` is reserved as the future extension point for instance-local
+state, such as remembering a grant for a time window.
+
+The runtime uses this policy shape to keep the JavaScript boundary explicit.
+Native rules can be added under the same model later without changing the
+caller-facing API.
+
+### Boot Options
+
+Mounts are per-instance because different sandbox instances often need
+different filesystems over the same reusable machine configuration:
 
 ```ts
-await using sandbox = createSandbox({
-  kernel: projectKernel(),
-  init: projectInit(),
-  rootfs: linuxOverlayFs({
-    lower: prebuiltRootfs("dist/rootfs/base.erofs", { format: "erofs" }),
-    upper: scratchFs(),
-  }),
+await using lane = await sandbox.boot({
+  mounts: {
+    "/workspace": fs.virtual(workspaceFs),
+    "/tmp": fs.virtual(privateFs),
+    "/mnt": fs.virtual(sharedFs),
+  },
+  cwd: "/workspace",
 });
+```
 
-await using vm = await sandbox.run();
+Sandbox does not special-case `/workspace`. Mount paths are just guest-visible
+paths backed by user-supplied filesystems. The target path must already exist
+in the selected rootfs; the built-in Alpine rootfs includes `/workspace`,
+`/tmp`, and `/mnt`.
 
-await vm.control.exec({
-  id: "install-toolchain",
-  argv: ["/bin/sh", "-lc", "apk add --no-cache git nodejs"],
+### Filesystems
+
+`fs.memory(...)` creates a real in-memory POSIX filesystem that can be mounted:
+
+```ts
+const workspaceFs = fs.memory({
+  files: {
+    "/README.md": "# Example\n",
+  },
 });
 ```
 
-`mount(...)` means a guest-visible mount boundary. `binding(...)` means a host-side attachment point into the same filesystem abstraction and does not create a guest mount.
+`fs.virtual(...)` adapts any compatible user-space JavaScript filesystem to
+Sandbox mounts:
 
-The guest contract is intentionally narrow:
+```ts
+const workspace = fs.virtual(workspaceFs);
+```
+
+### Processes
+
+`exec` is the simple buffered process API:
+
+```ts
+const result = await lane.exec("npm", ["test"], {
+  cwd: "/workspace",
+  env: { CI: "1" },
+});
+```
 
-- `/` is read-only unless the rootfs is a `linuxOverlayFs(...)` composition.
-- `/sandbox` is implemented by the host.
-- HTTP request-header hooks are registered in TypeScript and enforced by the Rust host data plane.
-- Network egress starts from deny; outbound rules opt in the exact protocols, ranges, and ports the guest can reach.
-- The HTTP interception CA is generated and injected by Sandbox. Callers provide request-header hooks, not certificate plumbing.
+`exec` is intentionally small: it buffers stdout and stderr and returns when the
+process exits. Streaming stdin/stdout/stderr belongs in the future
+`lane.spawn(...)` API.
+
+## Internal Architecture
+
+Sandbox hides the kernel, init, transport, and host helper behind a small
+TypeScript API:
+
+- The runtime boots a libkrun-backed guest from a prebuilt rootfs artifact:
+  read-only EROFS by default, or writable ext4 when a COW rootfs is used.
+- Kernel and init artifacts are implementation details owned by Sandbox.
+- A signed `sandbox-host` helper owns the Node/Rust/libkrun boundary.
+- Guest control traffic uses an implicit fd-backed transport between the host
+  and Sandbox init.
+- Host-implemented virtual filesystems are mounted into the guest.
+- Rootfs mutation persistence is modeled as block-level copy-on-write rootfs,
+  not as a guest-visible POSIX filesystem.
+- Network egress is default-deny. Native code should enforce fast-path policy
+  decisions and delegate to JavaScript only when a policy callback is required.
+- HTTP request middleware is caller-provided JavaScript, but Sandbox owns the
+  interception machinery and certificate plumbing.
+
+The intended boundary is that Sandbox knows how to launch, isolate, mount,
+intercept, and enforce. User-space owns artifact selection, filesystem
+durability, network policy state, confirmation flows, and credential brokering.
 
 ## Design Targets
 
@@ -182,12 +286,12 @@ The guest contract is intentionally narrow:
 - custom guest init owned by this repo,
 - implicit fd-backed host control sockets owned by Sandbox,
 - avoid host filesystem coordination unless it is intrinsic to the artifact; prefer file descriptors, database handles, bytes, and async iterables over paths,
-- build-time rootfs shaping, with prebuilt rootfs artifacts supplied at VM instantiation,
-- root filesystem composition through small explicit primitives such as `linuxOverlayFs(...)` and `scratchFs()`, with lower and upper expressed as filesystem values,
-- `mount(...)` only for guest-visible mounts; `binding(...)` only for host-side attachment points,
+- build-time rootfs shaping, with built-in rootfs artifacts selected by typed logical names at VM instantiation,
+- immutable rootfs by default, with copy-on-write rootfs supplied by a user-space block store when requested,
+- generic guest-visible mounts backed by the same user-space filesystem abstraction,
 - programmable virtual filesystems backed by TypeScript callbacks,
 - transparent HTTP interception with TypeScript request-header hooks,
-- default-deny outbound networking with explicit accept rules for protocols, CIDR ranges, public internet reachability, and ports,
+- default-deny outbound networking with JavaScript policy callbacks only where native rules cannot decide,
 - Rust-native or statically linkable networking components; sidecar network daemons are references, not default runtime dependencies,
 - macOS HVF entitlement signing verified as part of the integration test flow.
 
@@ -211,7 +315,7 @@ The npm package is published as `@torkbot/sandbox`. It does not use post-install
 - `@torkbot/sandbox-darwin-arm64`
 - `@torkbot/sandbox-linux-x64-gnu`
 
-Each platform package contains the N-API binding and the `sandbox-host` helper for that target. Runtime artifact resolution only loads the installed optional dependency for the current platform. Local development uses the same layout by materializing the current platform package under `node_modules`.
+Each platform package contains the `sandbox-host` helper and built-in rootfs artifacts for that target. Runtime artifact resolution only loads the installed optional dependency for the current platform. Local development uses the same layout by materializing the current platform package under `node_modules`.
 
 ### macOS signing setup
 

package/dist/artifacts.d.ts

@@ -1,12 +1,18 @@
 type SandboxTarget = {
     readonly packageName: string;
     readonly hostBinaryName: string;
+    readonly rootfsNames: Record<BuiltInRootfsFormat, string>;
     readonly platform: NodeJS.Platform;
     readonly arch: NodeJS.Architecture;
     readonly libc?: "glibc";
 };
+type BuiltInRootfsFormat = "erofs" | "ext4";
 export declare function currentSandboxTarget(): SandboxTarget;
 export declare function hostBinaryPath(): string;
+export declare function builtInRootfsPath(name: "alpine:3.20", format?: BuiltInRootfsFormat): string;
+export declare function builtInRootfsIdentity(name: "alpine:3.20", format: BuiltInRootfsFormat): string;
 export declare function rawHostBinaryPath(): string;
+export declare function assertMacosHostIsSigned(path: string): void;
+export declare function macosHostSigningError(path: string): Error | null;
 export {};
 //# sourceMappingURL=artifacts.d.ts.map

package/dist/artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAKA,KAAK,aAAa,GAAG;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAkBF,wBAAgB,oBAAoB,IAAI,aAAa,CAYpD;AAED,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C"}
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAKA,KAAK,aAAa,GAAG;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,KAAK,mBAAmB,GAAG,OAAO,GAAG,MAAM,CAAC;AA0B5C,wBAAgB,oBAAoB,IAAI,aAAa,CAYpD;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,GAAE,mBAA6B,GAAG,MAAM,CAMpG;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAiB9F;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AA2BD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAuB1D;AAcD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAWhE"}

package/dist/artifacts.js

@@ -5,12 +5,20 @@ const targets = [
     {
         packageName: "@torkbot/sandbox-darwin-arm64",
         hostBinaryName: "sandbox-host",
+        rootfsNames: {
+            erofs: "rootfs/alpine-3.20.erofs",
+            ext4: "rootfs/alpine-3.20.ext4",
+        },
         platform: "darwin",
         arch: "arm64",
     },
     {
         packageName: "@torkbot/sandbox-linux-x64-gnu",
         hostBinaryName: "sandbox-host",
+        rootfsNames: {
+            erofs: "rootfs/alpine-3.20.erofs",
+            ext4: "rootfs/alpine-3.20.ext4",
+        },
         platform: "linux",
         arch: "x64",
         libc: "glibc",
@@ -26,9 +34,32 @@ export function currentSandboxTarget() {
     return target;
 }
 export function hostBinaryPath() {
-    const path = rawHostBinaryPath();
-    assertMacosHostIsSigned(path);
-    return path;
+    return rawHostBinaryPath();
+}
+export function builtInRootfsPath(name, format = "erofs") {
+    if (name === "alpine:3.20") {
+        const target = currentSandboxTarget();
+        return resolveArtifactPath(target, target.rootfsNames[format]);
+    }
+    throw new Error(`unsupported built-in rootfs: ${name}`);
+}
+export function builtInRootfsIdentity(name, format) {
+    if (name === "alpine:3.20") {
+        const target = currentSandboxTarget();
+        const packageVersion = platformPackageVersion(target);
+        return [
+            "built-in",
+            name,
+            format,
+            target.platform,
+            target.arch,
+            target.libc ?? "none",
+            target.packageName,
+            packageVersion,
+            target.rootfsNames[format],
+        ].join(":");
+    }
+    throw new Error(`unsupported built-in rootfs: ${name}`);
 }
 export function rawHostBinaryPath() {
     const target = currentSandboxTarget();
@@ -43,7 +74,18 @@ function resolveArtifactPath(target, artifactName) {
         throw new Error(`missing ${target.packageName} artifact ${artifactName}; reinstall @torkbot/sandbox for ${process.platform}-${process.arch}, or run npm run artifacts:link-current after building local artifacts. ${installError}`);
     }
 }
-function assertMacosHostIsSigned(path) {
+function platformPackageVersion(target) {
+    try {
+        const packageJson = require(`${target.packageName}/package.json`);
+        if (typeof packageJson.version === "string" && packageJson.version.length > 0) {
+            return packageJson.version;
+        }
+    }
+    catch {
+    }
+    return "unknown";
+}
+export function assertMacosHostIsSigned(path) {
     if (process.platform !== "darwin") {
         return;
     }
@@ -74,4 +116,16 @@ function macosSigningError(path, detail) {
         `Reason: ${detail}`,
     ].join("\n");
 }
+export function macosHostSigningError(path) {
+    if (process.platform !== "darwin") {
+        return null;
+    }
+    try {
+        assertMacosHostIsSigned(path);
+        return null;
+    }
+    catch (error) {
+        return error instanceof Error ? error : new Error(String(error));
+    }
+}
 //# sourceMappingURL=artifacts.js.map

package/dist/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAU/C,MAAM,OAAO,GAAG;IACd;QACE,WAAW,EAAE,+BAA+B;QAC5C,cAAc,EAAE,cAAc;QAC9B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,OAAO;KACd;IACD;QACE,WAAW,EAAE,gCAAgC;QAC7C,cAAc,EAAE,cAAc;QAC9B,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,OAAO;KACd;CAC0C,CAAC;AAE9C,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACxC,OAAO,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,sCAAsC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAqB,EACrB,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,CAAC,WAAW,aAAa,YAAY,oCAAoC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,2EAA2E,YAAY,EAAE,CACpN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACzE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,YAAY,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,0CAA0C,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,mDAAmD,CAAC,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAc;IACrD,OAAO;QACL,mEAAmE;QACnE,EAAE;QACF,kDAAkD;QAClD,oCAAoC;QACpC,EAAE;QACF,aAAa,IAAI,EAAE;QACnB,WAAW,MAAM,EAAE;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAa/C,MAAM,OAAO,GAAG;IACd;QACE,WAAW,EAAE,+BAA+B;QAC5C,cAAc,EAAE,cAAc;QAC9B,WAAW,EAAE;YACX,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,yBAAyB;SAChC;QACD,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,OAAO;KACd;IACD;QACE,WAAW,EAAE,gCAAgC;QAC7C,cAAc,EAAE,cAAc;QAC9B,WAAW,EAAE;YACX,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,yBAAyB;SAChC;QACD,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,OAAO;KACd;CAC0C,CAAC;AAE9C,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACxC,OAAO,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,sCAAsC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAmB,EAAE,MAAM,GAAwB,OAAO;IAC1F,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACtC,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAoB,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAmB,EAAE,MAA2B;IACpF,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACtC,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO;YACL,UAAU;YACV,IAAI;YACJ,MAAM;YACN,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,IAAI,IAAI,MAAM;YACrB,MAAM,CAAC,WAAW;YAClB,cAAc;YACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;SAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAoB,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAqB,EACrB,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,CAAC,WAAW,aAAa,YAAY,oCAAoC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,2EAA2E,YAAY,EAAE,CACpN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAqB;IACnD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,eAAe,CAA0B,CAAC;QAC3F,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,OAAO,WAAW,CAAC,OAAO,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;IACT,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACzE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,YAAY,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,0CAA0C,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,mDAAmD,CAAC,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAc;IACrD,OAAO;QACL,mEAAmE;QACnE,EAAE;QACF,kDAAkD;QAClD,oCAAoC;QACpC,EAAE;QACF,aAAa,IAAI,EAAE;QACnB,WAAW,MAAM,EAAE;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/cli.js

@@ -4,7 +4,7 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
-import { hostBinaryPath, rawHostBinaryPath } from "./artifacts.js";
+import { assertMacosHostIsSigned, rawHostBinaryPath } from "./artifacts.js";
 const execFileAsync = promisify(execFile);
 const macosHypervisorEntitlements = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -41,7 +41,7 @@ async function setupMacos() {
             entitlementsPath,
             hostPath,
         ]);
-        hostBinaryPath();
+        assertMacosHostIsSigned(hostPath);
         console.log(`Signed sandbox-host for macOS Hypervisor.framework access: ${hostPath}`);
     }
     finally {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,2BAA2B,GAAG;;;;;;;;CAQnC,CAAC;AAEF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEhC,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,EAAE,CAAC;AACrB,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAC/E,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,SAAS;YACT,QAAQ;YACR,GAAG;YACH,gBAAgB;YAChB,gBAAgB;YAChB,QAAQ;SACT,CAAC,CAAC;QAEH,cAAc,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,8DAA8D,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,2BAA2B,GAAG;;;;;;;;CAQnC,CAAC;AAEF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEhC,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,EAAE,CAAC;AACrB,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAC/E,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,SAAS;YACT,QAAQ;YACR,GAAG;YACH,gBAAgB;YAChB,gBAAgB;YAChB,QAAQ;SACT,CAAC,CAAC;QAEH,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,8DAA8D,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/control-codec.d.ts

@@ -1,4 +1,26 @@
-import type { SandboxControlCommand, SandboxControlEvent } from "./index.ts";
+export type SandboxControlEvent = {
+    readonly type: "init.ready";
+    readonly guest: {
+        readonly root: {
+            readonly readonly: boolean;
+        };
+        readonly init: {
+            readonly name: string;
+        };
+    };
+} | {
+    readonly type: "guest.exec.complete";
+    readonly id: string;
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+};
+export type SandboxControlCommand = {
+    readonly type: "guest.exec";
+    readonly id: string;
+    readonly argv: readonly string[];
+    readonly env?: Record<string, string>;
+};
 export declare function encodeControlCommand(command: SandboxControlCommand): Uint8Array;
 export declare function decodeControlEvent(packet: Uint8Array): SandboxControlEvent;
 //# sourceMappingURL=control-codec.d.ts.map

package/dist/control-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-codec.d.ts","sourceRoot":"","sources":["../src/control-codec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE7E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,UAAU,CAU/E;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,mBAAmB,CAwB1E"}
+{"version":3,"file":"control-codec.d.ts","sourceRoot":"","sources":["../src/control-codec.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1C,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,UAAU,CAU/E;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,mBAAmB,CAwB1E"}

package/dist/control-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-codec.js","sourceRoot":"","sources":["../src/control-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGpC,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;gBACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/E,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE/C,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE;oBACzD,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACjD;aACF,CAAC;QACJ,KAAK,qBAAqB;YACxB,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC;gBAC9B,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;gBAC1C,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC/D,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAChE,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAiC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,GAAG,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAA4B,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,QAAiC,EAAE,GAAW;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,QAAiC,EAAE,GAAW;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,QAAiC,EAAE,GAAW;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,QAAiC,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"control-codec.js","sourceRoot":"","sources":["../src/control-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAyBpC,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;gBACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/E,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE/C,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE;oBACzD,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACjD;aACF,CAAC;QACJ,KAAK,qBAAqB;YACxB,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC;gBAC9B,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;gBAC1C,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC/D,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAChE,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAiC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,GAAG,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAA4B,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,QAAiC,EAAE,GAAW;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,QAAiC,EAAE,GAAW;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,QAAiC,EAAE,GAAW;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,QAAiC,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC"}