aec-agent 1.0.3 → 1.0.4

package/dist/components/sandbox-hub/traced-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"traced-sandbox.js","sourceRoot":"","sources":["../../../src/components/sandbox-hub/traced-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAOpE;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,GAAgB,EAChB,SAA6B,EAC7B,OAAO,GAA6C,EAAE;IAEtD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,GAAG,CAAC,EAAE;QACjB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IAEF,KAAK,UAAU,MAAM,CACnB,SAAiB,EACjB,UAAmC,EACnC,GAAqB,EACrB,SAAiD;QAEjD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC;gBACP,KAAK,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;gBAC3D,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvB,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SACpD,CAAC,CAAC;QACL,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACjC,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;SACjD,CAAC,CAAC;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACnB,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACnB,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;QACL,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CACtB,MAAM,CACJ,MAAM,EACN;YACE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACjD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,EACD,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,iGAAiG;YACjG,MAAM,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;SACzB,CAAC,CACH;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"traced-sandbox.js","sourceRoot":"","sources":["../../../src/components/sandbox-hub/traced-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAOpE;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,GAAgB,EAChB,SAA6B,EAC7B,OAAO,GAA6C,EAAE;IAEtD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,GAAG,CAAC,EAAE;QACjB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;QACrB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IAEF,KAAK,UAAU,MAAM,CACnB,SAAiB,EACjB,UAAmC,EACnC,GAAqB,EACrB,SAAiD;QAEjD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC;gBACP,KAAK,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;gBAC3D,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvB,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SACpD,CAAC,CAAC;QACL,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACjC,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;SACjD,CAAC,CAAC;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACnB,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACnB,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;QACL,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CACtB,MAAM,CACJ,MAAM,EACN;YACE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACjD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,EACD,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,iGAAiG;YACjG,MAAM,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;SACzB,CAAC,CACH;QACH,mFAAmF;QACnF,mFAAmF;QACnF,GAAG,CAAC,GAAG,CAAC,UAAU;YAChB,CAAC,CAAC;gBACE,UAAU,EAAE,CAAC,IAAY,EAAE,IAA4D,EAAE,EAAE,CACzF,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxH,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;iBAC/D,CAAC,CAAC;aACN;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,WAAW;YACjB,CAAC,CAAC;gBACE,WAAW,EAAE,CAAC,IAAY,EAAE,IAA+B,EAAE,IAA4D,EAAE,EAAE,CAC3H,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpF,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;iBACjD,CAAC,CAAC;aACN;YACH,CAAC,CAAC,EAAE,CAAC;QACP,mGAAmG;QACnG,GAAG,CAAC,GAAG,CAAC,YAAY;YAClB,CAAC,CAAC;gBACE,YAAY,EAAE,CAAC,IAA6D,EAAE,IAA8D,EAAE,EAAE,CAC9I,MAAM,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAa,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;iBAC7C,CAAC,CAAC;aACN;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,WAAW;YACjB,CAAC,CAAC;gBACE,WAAW,EAAE,CAAC,IAAY,EAAE,IAA6D,EAAE,EAAE,CAC3F,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;aAC1H;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC"}

package/dist/components/sandbox-hub/types/sandbox.d.ts

@@ -1,7 +1,20 @@
+import type { Duplex } from "node:stream";
 export type SandboxKind = "docker" | "host" | "remote";
 export type SandboxCapability = "fs.read" | "fs.write" | "fs.search" | "exec"
 /** exec with `shell: true` (sh -c / cmd /c) — separate so sandboxes can offer argv-only exec. */
- | "exec.shell";
+ | "exec.shell"
+/**
+ * A-124: readStream / writeStream — raw bytes (images, fonts, wasm, models), byte
+ * ranges and files bigger than maxReadBytes / maxWriteBytes. Sandboxes without it
+ * leave both methods out.
+ */
+ | "fs.stream"
+/**
+ * A-124 phase 2: long-running services (dev servers) — startService / stopService /
+ * listServices / serviceLogs, and connect() to a port inside the sandbox. Sandboxes
+ * without it leave those methods out.
+ */
+ | "services";
 /** What kind of place this is — policy (e.g. approvals) decides from traits, not from the kind name. */
 export interface SandboxTraits {
     kind: SandboxKind;
@@ -105,6 +118,69 @@ export interface SearchResult {
     matches: SearchMatch[];
     truncated: boolean;
 }
+export interface ReadStreamOptions extends OpOptions {
+    /** First byte to read. Default 0. */
+    offset?: number;
+    /** Bytes to read at most. Default: to the end of the file. */
+    length?: number;
+}
+/**
+ * An open file read as raw bytes. Consume `body` to the end, or stop early by breaking
+ * out of the loop (or aborting the signal) — either releases the file / process.
+ */
+export interface ByteStream {
+    /** Canonical logical path. */
+    path: string;
+    /** Size of the whole file in bytes. */
+    size: number;
+    /** Epoch milliseconds. */
+    modifiedAt: number;
+    /** The first byte `body` yields, and how many it yields (the range actually read). */
+    offset: number;
+    length: number;
+    body: AsyncIterable<Uint8Array>;
+}
+export interface WriteStreamOptions extends OpOptions {
+    /** Required: more bytes than this fail with "too_large" and nothing is written. */
+    maxBytes: number;
+    /** Create missing parent directories. Default true. */
+    createDirs?: boolean;
+    /** Fail with "conflict" when the file already exists. Default false (replace it). */
+    exclusive?: boolean;
+}
+export interface ServiceSpec {
+    /** Unique per agent: lower-case letters, digits and dashes, at most 40. */
+    name: string;
+    /** Run through the sandbox's shell, e.g. "npm run dev -- --host 127.0.0.1 --port $PORT". */
+    command: string;
+    /** Logical directory. Default: workingDir. */
+    cwd?: string;
+    /** The port the service listens on inside the sandbox. Omitted = a free port is picked. Either way it is passed as PORT. */
+    port?: number;
+    /** Explicit variables only, like exec. */
+    env?: Record<string, string>;
+}
+export type ServiceStatus = "starting" | "listening" | "exited";
+export interface ServiceInfo {
+    name: string;
+    command: string;
+    /** Canonical logical path. */
+    cwd: string;
+    port: number;
+    /** "starting" until the port accepts connections; "exited" once the process ended. */
+    status: ServiceStatus;
+    /** The exit code once exited (null when unknown, e.g. killed). */
+    exitCode?: number | null;
+    /** Epoch milliseconds. */
+    startedAt: number;
+}
+export interface ServiceLogs {
+    name: string;
+    /** The end of the service's combined stdout + stderr. */
+    text: string;
+    /** true when older output was left out. */
+    truncated: boolean;
+}
 export interface ExecRequest {
     /** argv — no shell parsing unless `shell` is true. */
     command: string[];
@@ -163,6 +239,35 @@ export interface SandboxView {
     /** Runs where the files live (no bulk transfer for remote runners). */
     search(query: SearchQuery, opts?: OpOptions): Promise<SearchResult>;
     exec(request: ExecRequest, opts?: ExecOptions): Promise<ExecResult>;
+    /**
+     * A-124 ("fs.stream"): read a file as raw bytes, optionally one byte range — what an
+     * HTTP preview needs for binary assets and Range requests. Absent without the capability.
+     */
+    readStream?(path: string, opts?: ReadStreamOptions): Promise<ByteStream>;
+    /**
+     * A-124 ("fs.stream"): write raw bytes from a stream (an upload). The file is written
+     * to a temporary name and renamed, so readers never see a partial file; on any error
+     * (including too_large) nothing is left behind. Absent without the capability.
+     */
+    writeStream?(path: string, body: AsyncIterable<Uint8Array>, opts: WriteStreamOptions): Promise<WriteResult>;
+    /**
+     * A-124 phase 2 ("services"): start a long-running process (a dev server) that outlives
+     * the call. Fails with "conflict" when a service of that name runs or the port is taken,
+     * "policy_denied" past the sandbox's limit of services per agent.
+     */
+    startService?(spec: ServiceSpec, opts?: OpOptions): Promise<ServiceInfo>;
+    /** Stop a service (its whole process group). null when there is none of that name. */
+    stopService?(name: string, opts?: OpOptions): Promise<ServiceInfo | null>;
+    /** This agent's services, the exited ones too (until restarted or the sandbox restarts). */
+    listServices?(opts?: OpOptions): Promise<ServiceInfo[]>;
+    serviceLogs?(name: string, opts?: OpOptions & {
+        maxBytes?: number;
+    }): Promise<ServiceLogs>;
+    /**
+     * A TCP connection to 127.0.0.1:<port> inside the sandbox, as a byte stream — how a
+     * host proxies a preview to a service, also when the sandbox has no network.
+     */
+    connect?(port: number, opts?: OpOptions): Promise<Duplex>;
 }
 /** One running (or reconnectable) sandbox, shared by the agents bound to it. */
 export interface Sandbox {

package/dist/components/sandbox-hub/types/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../../src/components/sandbox-hub/types/sandbox.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,UAAU,GACV,WAAW,GACX,MAAM;AACR,iGAAiG;GAC/F,YAAY,CAAC;AAEjB,wGAAwG;AACxG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,6FAA6F;IAC7F,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACvC,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,gEAAgE;IAChE,OAAO,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC1B,kEAAkE;IAClE,EAAE,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAID,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAID,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,iEAAiE;IACjE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3E;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpF,yCAAyC;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,uEAAuE;IACvE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrE;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,IAAI,OAAO,CAAC,OAAO,GAAG,UAAU,GAAG,aAAa,CAAC,CAAC;IACxD,qEAAqE;IACrE,eAAe,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,oEAAoE;IACpE,OAAO,CAAC,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../../src/components/sandbox-hub/types/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgB1C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,UAAU,GACV,WAAW,GACX,MAAM;AACR,iGAAiG;GAC/F,YAAY;AACd;;;;GAIG;GACD,WAAW;AACb;;;;GAIG;GACD,UAAU,CAAC;AAEf,wGAAwG;AACxG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,6FAA6F;IAC7F,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACvC,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,gEAAgE;IAChE,OAAO,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC1B,kEAAkE;IAClE,EAAE,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAID,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAID,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qFAAqF;IACrF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4HAA4H;IAC5H,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,aAAa,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAC;CACpB;AAID,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,iEAAiE;IACjE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3E;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpF,yCAAyC;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,uEAAuE;IACvE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE;;;OAGG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE;;;;OAIG;IACH,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5G;;;;OAIG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE,sFAAsF;IACtF,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1E,4FAA4F;IAC5F,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3F;;;OAGG;IACH,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,IAAI,OAAO,CAAC,OAAO,GAAG,UAAU,GAAG,aAAa,CAAC,CAAC;IACxD,qEAAqE;IACrE,eAAe,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,oEAAoE;IACpE,OAAO,CAAC,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD"}

package/dist/components/sandbox-hub/types/sandbox.js

@@ -1,15 +1,2 @@
-// ---------------------------------------------------------------------------
-// SandboxView — the only thing file/terminal tools ever see (A-59).
-//
-// One contract for every place an agent can work:
-//   docker  — the shared sandbox or an agent's own container (A-60)
-//   host    — an allowlisted folder on the server machine, Claude Code-style (later)
-//   remote  — a runner on another machine: Windows/Revit box, CI (later)
-//
-// Tools never import node:fs or child_process. Paths are logical POSIX paths
-// ("src/app.ts", "/workspace/shared/x.csv"); each sandbox maps them to its
-// real storage, so tools behave the same on Windows hosts, Linux containers
-// and remote runners. Every method fails closed with a SandboxError.
-// ---------------------------------------------------------------------------
 export {};
 //# sourceMappingURL=sandbox.js.map

package/dist/components/sandbox-hub/types/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../src/components/sandbox-hub/types/sandbox.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oEAAoE;AACpE,EAAE;AACF,kDAAkD;AAClD,oEAAoE;AACpE,qFAAqF;AACrF,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../src/components/sandbox-hub/types/sandbox.ts"],"names":[],"mappings":""}

package/dist/components/secret-hub/envelope.d.ts

@@ -0,0 +1,48 @@
+import { type SecretHubProvider } from "./secret-hub-provider.js";
+export type SealedFormat = {
+    format: "v2";
+    keyId: string;
+} | {
+    format: "v1";
+} | {
+    format: "plain";
+};
+export interface SecretSealerOptions {
+    /** Extra keys for the enc:v1 format, beyond the provider's legacyKeys(). */
+    legacyKeys?: () => Uint8Array[];
+    /** How long an unwrapped data key is kept in memory (default 5 min; 0 = no cache). */
+    cacheTtlMs?: number;
+    /** Most data keys kept at once (default 1000). */
+    cacheMax?: number;
+}
+/** What a sealed value's prefix says about it. */
+export declare function sealedFormat(stored: string): SealedFormat;
+/**
+ * Seals and opens values with the current SecretHubProvider (resolved on every call, so
+ * AgentCore.useSecretHubProvider applies at once). Without a provider values are stored as
+ * plain text and a warning is logged once — hosts that must not do that refuse to start
+ * without one (see the servers' AEC_REQUIRE_ENCRYPTION).
+ */
+export declare class SecretSealer {
+    private readonly getProvider;
+    private readonly options;
+    private cache;
+    private warned;
+    private readonly ttl;
+    private readonly max;
+    constructor(getProvider: () => SecretHubProvider | undefined, options?: SecretSealerOptions);
+    /** The provider in use, if any. */
+    get provider(): SecretHubProvider | undefined;
+    /** Seal `plain` under the current master key. `aad` binds the value to where it is stored. */
+    seal(plain: string, aad?: string): Promise<string>;
+    /** Open a value written by seal (or the enc:v1 format, or plain text). Throws SecretError. */
+    open(stored: string, aad?: string): Promise<string>;
+    /** True when the value is not sealed with the current master key (rotation re-seals it). */
+    needsReseal(stored: string): boolean;
+    /** Forget unwrapped data keys (after a rotation, or to drop them from memory). */
+    clearCache(): void;
+    private openV2;
+    private unwrap;
+    private openV1;
+}
+//# sourceMappingURL=envelope.d.ts.map

package/dist/components/secret-hub/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../src/components/secret-hub/envelope.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAoBpF,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,UAAU,EAAE,CAAC;IAChC,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,kDAAkD;AAClD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAOzD;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IAOrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,KAAK,CAA2D;IACxE,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YACmB,WAAW,EAAE,MAAM,iBAAiB,GAAG,SAAS,EAChD,OAAO,GAAE,mBAAwB,EAInD;IAED,mCAAmC;IACnC,IAAI,QAAQ,IAAI,iBAAiB,GAAG,SAAS,CAE5C;IAED,8FAA8F;IACxF,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBnD;IAED,8FAA8F;IACxF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpD;IAED,4FAA4F;IAC5F,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKnC;IAED,kFAAkF;IAClF,UAAU,IAAI,IAAI,CAEjB;YAEa,MAAM;YAaN,MAAM;IAmBpB,OAAO,CAAC,MAAM;CAaf"}

package/dist/components/secret-hub/envelope.js

@@ -0,0 +1,157 @@
+import { randomBytes } from "node:crypto";
+import { SecretError } from "../../kernel/errors/secret-error.js";
+import { gcmOpen, gcmSeal } from "./secret-hub-provider.js";
+// ---------------------------------------------------------------------------
+// Envelope encryption (A-101). A sealed value is
+//
+//   "enc:v2:" + base64url(keyId) + ":" + base64(wrapped data key) + ":" + base64(iv | ciphertext | tag)
+//
+// The value is encrypted with a fresh 32-byte data key (AES-256-GCM, the caller's AAD
+// bound in, so a value can't be moved to another secret); the data key is wrapped by the
+// provider's current master key. server/go and core/go read and write the same format.
+//
+// Also read: "enc:v1:" + base64(iv | ciphertext | tag) — the A-100 single-key format
+// (key = SHA-256(AEC_SECRET_KEY), no AAD) — and plain text (no "enc:" prefix), so values
+// written before A-101 open until a rotation re-seals them.
+// ---------------------------------------------------------------------------
+const V2 = "enc:v2:";
+const V1 = "enc:v1:";
+const DATA_KEY_BYTES = 32;
+/** What a sealed value's prefix says about it. */
+export function sealedFormat(stored) {
+    if (stored.startsWith(V2)) {
+        const keyPart = stored.slice(V2.length).split(":", 1)[0] ?? "";
+        return { format: "v2", keyId: Buffer.from(keyPart, "base64url").toString("utf8") };
+    }
+    if (stored.startsWith(V1))
+        return { format: "v1" };
+    return { format: "plain" };
+}
+/**
+ * Seals and opens values with the current SecretHubProvider (resolved on every call, so
+ * AgentCore.useSecretHubProvider applies at once). Without a provider values are stored as
+ * plain text and a warning is logged once — hosts that must not do that refuse to start
+ * without one (see the servers' AEC_REQUIRE_ENCRYPTION).
+ */
+export class SecretSealer {
+    getProvider;
+    options;
+    cache = new Map();
+    warned = false;
+    ttl;
+    max;
+    constructor(getProvider, options = {}) {
+        this.getProvider = getProvider;
+        this.options = options;
+        this.ttl = options.cacheTtlMs ?? 5 * 60_000;
+        this.max = options.cacheMax ?? 1000;
+    }
+    /** The provider in use, if any. */
+    get provider() {
+        return this.getProvider();
+    }
+    /** Seal `plain` under the current master key. `aad` binds the value to where it is stored. */
+    async seal(plain, aad = "") {
+        const provider = this.getProvider();
+        if (!provider) {
+            if (!this.warned) {
+                this.warned = true;
+                console.warn("[secrets] no SecretHub provider is set — secrets are stored unencrypted");
+            }
+            return plain;
+        }
+        const dataKey = randomBytes(DATA_KEY_BYTES);
+        let wrapped;
+        try {
+            wrapped = await provider.wrapKey(dataKey);
+        }
+        catch (err) {
+            throw new SecretError(`the SecretHub provider "${provider.id}" could not wrap a key: ${message(err)}`, "unavailable");
+        }
+        const body = gcmSeal(dataKey, Buffer.from(plain, "utf8"), aadBytes(aad));
+        return (V2 +
+            Buffer.from(wrapped.keyId, "utf8").toString("base64url") +
+            ":" +
+            Buffer.from(wrapped.wrapped).toString("base64") +
+            ":" +
+            body.toString("base64"));
+    }
+    /** Open a value written by seal (or the enc:v1 format, or plain text). Throws SecretError. */
+    async open(stored, aad = "") {
+        if (stored.startsWith(V2))
+            return this.openV2(stored, aad);
+        if (stored.startsWith(V1))
+            return this.openV1(stored);
+        return stored;
+    }
+    /** True when the value is not sealed with the current master key (rotation re-seals it). */
+    needsReseal(stored) {
+        const provider = this.getProvider();
+        if (!provider)
+            return false;
+        const f = sealedFormat(stored);
+        return f.format !== "v2" || f.keyId !== provider.currentKeyId();
+    }
+    /** Forget unwrapped data keys (after a rotation, or to drop them from memory). */
+    clearCache() {
+        this.cache.clear();
+    }
+    async openV2(stored, aad) {
+        const parts = stored.slice(V2.length).split(":");
+        if (parts.length !== 3)
+            throw new SecretError("a stored secret is malformed", "decrypt_failed");
+        const [keyPart, wrappedPart, bodyPart] = parts;
+        const keyId = Buffer.from(keyPart, "base64url").toString("utf8");
+        const dataKey = await this.unwrap(keyId, wrappedPart);
+        try {
+            return gcmOpen(dataKey, Buffer.from(bodyPart, "base64"), aadBytes(aad)).toString("utf8");
+        }
+        catch {
+            throw new SecretError("a stored secret could not be decrypted (it was moved, or the data is damaged)", "decrypt_failed");
+        }
+    }
+    async unwrap(keyId, wrappedPart) {
+        const cacheKey = keyId + ":" + wrappedPart;
+        const hit = this.cache.get(cacheKey);
+        if (hit && hit.expires > Date.now())
+            return hit.key;
+        const provider = this.getProvider();
+        if (!provider)
+            throw new SecretError(`a SecretHub provider holding master key "${keyId}" is needed to read this secret`, "decrypt_failed");
+        let key;
+        try {
+            key = await provider.unwrapKey(Buffer.from(wrappedPart, "base64"), keyId);
+        }
+        catch (err) {
+            throw new SecretError(`master key "${keyId}" could not unwrap this secret's key: ${message(err)}`, "decrypt_failed");
+        }
+        if (this.ttl > 0) {
+            if (this.cache.size >= this.max)
+                this.cache.delete(this.cache.keys().next().value);
+            this.cache.set(cacheKey, { key, expires: Date.now() + this.ttl });
+        }
+        return key;
+    }
+    openV1(stored) {
+        const keys = [...(this.getProvider()?.legacyKeys?.() ?? []), ...(this.options.legacyKeys?.() ?? [])];
+        if (!keys.length)
+            throw new SecretError("AEC_SECRET_KEY is needed to read a secret stored before A-101 (enc:v1)", "decrypt_failed");
+        const raw = Buffer.from(stored.slice(V1.length), "base64");
+        for (const key of keys) {
+            try {
+                return gcmOpen(key, raw).toString("utf8");
+            }
+            catch {
+                // try the next key
+            }
+        }
+        throw new SecretError("a stored secret (enc:v1) could not be decrypted — AEC_SECRET_KEY differs from the one that wrote it", "decrypt_failed");
+    }
+}
+function aadBytes(aad) {
+    return aad ? Buffer.from(aad, "utf8") : undefined;
+}
+function message(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=envelope.js.map

package/dist/components/secret-hub/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/components/secret-hub/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAA0B,MAAM,0BAA0B,CAAC;AAEpF,8EAA8E;AAC9E,iDAAiD;AACjD,EAAE;AACF,wGAAwG;AACxG,EAAE;AACF,sFAAsF;AACtF,yFAAyF;AACzF,uFAAuF;AACvF,EAAE;AACF,qFAAqF;AACrF,yFAAyF;AACzF,4DAA4D;AAC5D,8EAA8E;AAE9E,MAAM,EAAE,GAAG,SAAS,CAAC;AACrB,MAAM,EAAE,GAAG,SAAS,CAAC;AACrB,MAAM,cAAc,GAAG,EAAE,CAAC;AAa1B,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IAOJ,WAAW;IACX,OAAO;IAPlB,KAAK,GAAG,IAAI,GAAG,EAAgD,CAAC;IAChE,MAAM,GAAG,KAAK,CAAC;IACN,GAAG,CAAS;IACZ,GAAG,CAAS;IAE7B,YACmB,WAAgD,EAChD,OAAO,GAAwB,EAAE;2BADjC,WAAW;uBACX,OAAO;QAExB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,MAAM,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,OAA+C,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,2BAA2B,QAAQ,CAAC,EAAE,2BAA2B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,OAAO,CACL,EAAE;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxD,GAAG;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,GAAG;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,GAAG,GAAG,EAAE;QACjC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4FAA4F;IAC5F,WAAW,CAAC,MAAc;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;IAClE,CAAC;IAED,kFAAkF;IAClF,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAW;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,8BAA8B,EAAE,gBAAgB,CAAC,CAAC;QAChG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,KAAiC,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,+EAA+E,EAAE,gBAAgB,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,WAAmB;QACrD,MAAM,QAAQ,GAAG,KAAK,GAAG,GAAG,GAAG,WAAW,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,4CAA4C,KAAK,iCAAiC,EAAE,gBAAgB,CAAC,CAAC;QAC3I,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,eAAe,KAAK,yCAAyC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;YACpF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,WAAW,CAAC,wEAAwE,EAAE,gBAAgB,CAAC,CAAC;QACpI,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB;YACrB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qGAAqG,EAAE,gBAAgB,CAAC,CAAC;IACjJ,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/components/secret-hub/rules.d.ts

@@ -0,0 +1,33 @@
+import { type SecretDefinition, type SecretInfo, type SecretUse } from "./types.js";
+/** {{secret:NAME}} — what the model writes where a tool should put a secret's value. */
+export declare const SECRET_PLACEHOLDER: RegExp;
+/** The names a text refers to with {{secret:NAME}}, without duplicates. */
+export declare function placeholderNames(text: string): string[];
+/** Replace each {{secret:NAME}} with its value; a name missing from `values` is left as it is. */
+export declare function fillPlaceholders(text: string, values: Record<string, string>): string;
+/** Throws SecretError("invalid_argument") unless `name` is a valid secret name. */
+export declare function checkSecretName(name: unknown): string;
+/** Throws SecretError("invalid_argument") unless `value` can be stored. */
+export declare function checkSecretValue(value: unknown): string;
+/** A definition's metadata checked and normalised (defaults filled in for a new secret). */
+export declare function normalizeDefinition(definition: Partial<SecretDefinition>, base?: Pick<SecretInfo, "description" | "allowedHosts" | "allowedTools">): Pick<SecretInfo, "description" | "allowedHosts" | "allowedTools">;
+/** Does `host` match one of the patterns? "*.example.com" matches subdomains, not example.com. */
+export declare function hostAllowed(host: string, patterns: readonly string[]): boolean;
+/** Throws SecretError("not_allowed") unless the secret may be used this way. */
+export declare function checkUse(secret: Pick<SecretInfo, "name" | "allowedHosts" | "allowedTools">, use: SecretUse): void;
+/**
+ * Remembers the secret values used in this process and removes them from text — tool
+ * output, errors — before it reaches the model, a store, a trace or the UI. A value is
+ * also caught URL-encoded and base64-encoded (e.g. in a Basic auth header echoed back).
+ */
+export declare class SecretRedactor {
+    private values;
+    /** Remember a value (and its encodings) under its secret's name. */
+    add(name: string, value: string): void;
+    /** Forget the values of a secret (deleted, or given a new value). */
+    forget(name: string): void;
+    get size(): number;
+    /** `text` with every known value replaced by [secret:NAME]. */
+    redact(text: string): string;
+}
+//# sourceMappingURL=rules.d.ts.map

package/dist/components/secret-hub/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/components/secret-hub/rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAWzH,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,QAA4C,CAAC;AAE5E,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAED,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAErF;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CASrD;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMvD;AAED,4FAA4F;AAC5F,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,EACrC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,cAAc,GAAG,cAAc,CAAC,GACvE,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,cAAc,GAAG,cAAc,CAAC,CAwBnE;AAiBD,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG9E;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CAejH;AAKD;;;;GAIG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAA6B;IAE3C,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAKrC;IAED,qEAAqE;IACrE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEzB;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ3B;CACF"}

package/dist/components/secret-hub/rules.js

@@ -0,0 +1,142 @@
+import { SecretError } from "../../kernel/errors/secret-error.js";
+import { DEFAULT_SECRET_TOOLS, SECRET_LIMITS } from "./types.js";
+// ---------------------------------------------------------------------------
+// A-101: secret names, allowed uses, placeholders and redaction — shared by the
+// SecretHub, each agent's SecretManager and the tools.
+// ---------------------------------------------------------------------------
+const NAME = /^[A-Z][A-Z0-9_]*$/;
+const HOST = /^(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+const TOOL = /^[a-z][a-z0-9_]*$/;
+/** {{secret:NAME}} — what the model writes where a tool should put a secret's value. */
+export const SECRET_PLACEHOLDER = /\{\{\s*secret:([A-Z][A-Z0-9_]*)\s*\}\}/g;
+/** The names a text refers to with {{secret:NAME}}, without duplicates. */
+export function placeholderNames(text) {
+    return [...new Set([...text.matchAll(SECRET_PLACEHOLDER)].map((m) => m[1]))];
+}
+/** Replace each {{secret:NAME}} with its value; a name missing from `values` is left as it is. */
+export function fillPlaceholders(text, values) {
+    return text.replace(SECRET_PLACEHOLDER, (whole, name) => values[name] ?? whole);
+}
+/** Throws SecretError("invalid_argument") unless `name` is a valid secret name. */
+export function checkSecretName(name) {
+    const n = typeof name === "string" ? name.trim() : "";
+    if (!NAME.test(n) || n.length > SECRET_LIMITS.name) {
+        throw new SecretError(`secret name "${n}" must be upper-case letters, digits and underscores, starting with a letter (max ${SECRET_LIMITS.name})`, "invalid_argument");
+    }
+    return n;
+}
+/** Throws SecretError("invalid_argument") unless `value` can be stored. */
+export function checkSecretValue(value) {
+    if (typeof value !== "string" || !value.length)
+        throw new SecretError("a secret needs a value", "invalid_argument");
+    if (Buffer.byteLength(value, "utf8") > SECRET_LIMITS.value) {
+        throw new SecretError(`a secret's value is larger than ${SECRET_LIMITS.value} bytes`, "invalid_argument");
+    }
+    return value;
+}
+/** A definition's metadata checked and normalised (defaults filled in for a new secret). */
+export function normalizeDefinition(definition, base) {
+    const fail = (m) => {
+        throw new SecretError(m, "invalid_argument");
+    };
+    let description = base?.description;
+    if (definition.description !== undefined) {
+        if (definition.description !== null && typeof definition.description !== "string")
+            fail("description must be text");
+        description = definition.description?.trim() || undefined;
+        if (description && description.length > SECRET_LIMITS.description)
+            fail(`description is longer than ${SECRET_LIMITS.description} characters`);
+    }
+    let allowedHosts = base?.allowedHosts ?? [];
+    if (definition.allowedHosts !== undefined && definition.allowedHosts !== null) {
+        if (!Array.isArray(definition.allowedHosts))
+            fail("allowedHosts must be a list of host names");
+        allowedHosts = [...new Set(definition.allowedHosts.map((h) => normalizeHost(h, fail)))];
+        if (allowedHosts.length > SECRET_LIMITS.hosts)
+            fail(`at most ${SECRET_LIMITS.hosts} hosts`);
+    }
+    let allowedTools = base?.allowedTools ?? [...DEFAULT_SECRET_TOOLS];
+    if (definition.allowedTools !== undefined && definition.allowedTools !== null) {
+        if (!Array.isArray(definition.allowedTools))
+            fail("allowedTools must be a list of tool names");
+        allowedTools = [...new Set(definition.allowedTools.map((t) => (typeof t === "string" ? t.trim() : "")))];
+        if (allowedTools.some((t) => !TOOL.test(t)))
+            fail("allowedTools must be tool names (lower-case letters, digits, underscores)");
+        if (allowedTools.length > SECRET_LIMITS.tools)
+            fail(`at most ${SECRET_LIMITS.tools} tools`);
+    }
+    return { ...(description ? { description } : {}), allowedHosts, allowedTools };
+}
+function normalizeHost(host, fail) {
+    let h = typeof host === "string" ? host.trim().toLowerCase() : "";
+    // Accept a pasted URL ("https://api.example.com/v1") — keep the host.
+    if (/^[a-z]+:\/\//.test(h)) {
+        try {
+            h = new URL(h).hostname;
+        }
+        catch {
+            fail(`"${String(host)}" is not a host name`);
+        }
+    }
+    h = h.replace(/\.$/, "");
+    if (!HOST.test(h) || h.length > 253)
+        fail(`"${String(host)}" is not a host name (e.g. api.example.com or *.example.com)`);
+    return h;
+}
+/** Does `host` match one of the patterns? "*.example.com" matches subdomains, not example.com. */
+export function hostAllowed(host, patterns) {
+    const h = host.toLowerCase().replace(/\.$/, "");
+    return patterns.some((p) => (p.startsWith("*.") ? h.endsWith(p.slice(1)) && h.length > p.length - 1 : h === p));
+}
+/** Throws SecretError("not_allowed") unless the secret may be used this way. */
+export function checkUse(secret, use) {
+    if (!secret.allowedTools.includes(use.tool)) {
+        throw new SecretError(`secret ${secret.name} may not be used by ${use.tool} (allowed: ${secret.allowedTools.join(", ") || "no tool"})`, "not_allowed");
+    }
+    if (use.host !== undefined && !hostAllowed(use.host, secret.allowedHosts)) {
+        throw new SecretError(secret.allowedHosts.length
+            ? `secret ${secret.name} may not be sent to ${use.host} (allowed hosts: ${secret.allowedHosts.join(", ")})`
+            : `secret ${secret.name} has no allowed hosts yet — the user has to set them before it can be sent anywhere`, "not_allowed");
+    }
+}
+/** Values shorter than this are not redacted (they would mangle ordinary text). */
+const MIN_REDACT_LENGTH = 6;
+/**
+ * Remembers the secret values used in this process and removes them from text — tool
+ * output, errors — before it reaches the model, a store, a trace or the UI. A value is
+ * also caught URL-encoded and base64-encoded (e.g. in a Basic auth header echoed back).
+ */
+export class SecretRedactor {
+    values = new Map();
+    /** Remember a value (and its encodings) under its secret's name. */
+    add(name, value) {
+        if (value.length < MIN_REDACT_LENGTH)
+            return;
+        for (const v of new Set([value, encodeURIComponent(value), Buffer.from(value, "utf8").toString("base64")])) {
+            if (v.length >= MIN_REDACT_LENGTH)
+                this.values.set(v, name);
+        }
+    }
+    /** Forget the values of a secret (deleted, or given a new value). */
+    forget(name) {
+        for (const [v, n] of this.values)
+            if (n === name)
+                this.values.delete(v);
+    }
+    get size() {
+        return this.values.size;
+    }
+    /** `text` with every known value replaced by [secret:NAME]. */
+    redact(text) {
+        if (!text || !this.values.size)
+            return text;
+        let out = text;
+        // Longest first, so a value that contains another is replaced whole.
+        for (const [value, name] of [...this.values].sort((a, b) => b[0].length - a[0].length)) {
+            if (out.includes(value))
+                out = out.split(value).join(`[secret:${name}]`);
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=rules.js.map

package/dist/components/secret-hub/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/components/secret-hub/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAA0D,MAAM,YAAY,CAAC;AAEzH,8EAA8E;AAC9E,gFAAgF;AAChF,uDAAuD;AACvD,8EAA8E;AAE9E,MAAM,IAAI,GAAG,mBAAmB,CAAC;AACjC,MAAM,IAAI,GAAG,4EAA4E,CAAC;AAC1F,MAAM,IAAI,GAAG,mBAAmB,CAAC;AAEjC,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,yCAAyC,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAA8B;IAC3E,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CACnB,gBAAgB,CAAC,qFAAqF,aAAa,CAAC,IAAI,GAAG,EAC3H,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;IACpH,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,WAAW,CAAC,mCAAmC,aAAa,CAAC,KAAK,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CACjC,UAAqC,EACrC,IAAwE;IAExE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAS,EAAE;QAChC,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC/C,CAAC,CAAC;IACF,IAAI,WAAW,GAAG,IAAI,EAAE,WAAW,CAAC;IACpC,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;YAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACpH,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC1D,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,aAAa,CAAC,WAAW;YAAE,IAAI,CAAC,8BAA8B,aAAa,CAAC,WAAW,aAAa,CAAC,CAAC;IAChJ,CAAC;IACD,IAAI,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IAC5C,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC/F,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,YAAY,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK;YAAE,IAAI,CAAC,WAAW,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC/F,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC/H,IAAI,YAAY,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK;YAAE,IAAI,CAAC,WAAW,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa,EAAE,IAA0B;IAC9D,IAAI,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,sEAAsE;IACtE,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC1H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA2B;IACnE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,MAAkE,EAAE,GAAc;IACzG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CACnB,UAAU,MAAM,CAAC,IAAI,uBAAuB,GAAG,CAAC,IAAI,cAAc,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,EAChH,aAAa,CACd,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,WAAW,CACnB,MAAM,CAAC,YAAY,CAAC,MAAM;YACxB,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,uBAAuB,GAAG,CAAC,IAAI,oBAAoB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3G,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,qFAAqF,EAC9G,aAAa,CACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,oEAAoE;IACpE,GAAG,CAAC,IAAY,EAAE,KAAa;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;YAAE,OAAO;QAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3G,IAAI,CAAC,CAAC,MAAM,IAAI,iBAAiB;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,IAAY;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,qEAAqE;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}