microsandbox-mcp 0.5.7 → 0.5.10

package/README.md

@@ -123,50 +123,161 @@ For any MCP client that supports stdio transport:
 
 ## Available Tools
 
-**Sandbox Lifecycle:**
+Every tool returns a JSON envelope: `{ "ok": true, "data": ... }` on success or `{ "ok": false, "error": ... }` on failure. Large command output, logs, and file reads are capped by default and include truncation metadata when shortened.
+
+**Runtime**
+
+| Tool | Description |
+| ---- | ----------- |
+| `runtime_check` | Check whether the microsandbox runtime, `msb`, and `libkrunfw` are available |
+| `runtime_install` | Install runtime dependencies using the microsandbox SDK installer |
+
+**Sandbox Lifecycle**
+
+| Tool | Description |
+| ---- | ----------- |
+| `sandbox_run` | Create an ephemeral sandbox, run a shell command, return output, and remove it |
+| `sandbox_create` | Create and boot a persistent sandbox with rootfs, resources, process, mounts, patches, network, secrets, and lifecycle options |
+| `sandbox_start` | Start stopped sandboxes by name, labels, or status selector |
+| `sandbox_list` | List sandboxes with status, image, labels, and timestamps |
+| `sandbox_status` | Show status for one sandbox or a filtered sandbox set |
+| `sandbox_inspect` | Return full configuration and metadata for one sandbox |
+| `sandbox_stop` | Stop selected sandboxes gracefully or forcefully, with optional timeout |
+| `sandbox_drain` | Request graceful drain for selected sandboxes |
+| `sandbox_wait` | Wait until selected sandboxes reach a terminal state |
+| `sandbox_remove` | Remove selected stopped sandboxes, optionally force-stopping running ones first |
+
+**Command Execution**
+
+| Tool | Description |
+| ---- | ----------- |
+| `sandbox_exec` | Execute an argv command with env, cwd, user, TTY, timeout, rlimits, stdin, and output caps |
+| `sandbox_shell` | Execute a shell command string with the same execution controls |
+| `sandbox_exec_start` | Start a long-running command and return an in-memory exec session id |
+| `sandbox_exec_poll` | Poll output events and exit status for an exec session |
+| `sandbox_exec_write_stdin` | Write UTF-8 or base64 data to an exec session stdin |
+| `sandbox_exec_signal` | Send `hup`, `int`, `term`, `kill`, or a numeric signal to an exec session |
+| `sandbox_exec_close` | Close and forget an exec session |
+
+**Logs**
+
 | Tool | Description |
 | ---- | ----------- |
-| `sandbox_run` | Create an ephemeral sandbox, run a command, return the output, and destroy it |
-| `sandbox_create` | Create and boot a persistent named sandbox with full configuration |
-| `sandbox_list` | List all sandboxes with their current status |
-| `sandbox_inspect` | Get detailed sandbox information including full configuration |
-| `sandbox_stop` | Stop a running sandbox (graceful SIGTERM or force SIGKILL) |
-| `sandbox_remove` | Remove a stopped sandbox |
-
-**Command Execution:**
+| `sandbox_logs_read` | Read captured logs with tail, time, source, grep, session id, and output cap filters |
+| `sandbox_logs_stream` | Poll captured logs using cursors and a bounded follow timeout |
+
+**Filesystem**
+
 | Tool | Description |
 | ---- | ----------- |
-| `sandbox_exec` | Execute a command with arguments inside a running sandbox |
-| `sandbox_shell` | Execute a shell command string with pipes, redirects, and shell syntax |
+| `sandbox_fs_read` | Read a sandbox file as UTF-8 text or base64 bytes |
+| `sandbox_fs_write` | Write UTF-8 text or base64 bytes to a sandbox file |
+| `sandbox_fs_list` | List sandbox directory entries |
+| `sandbox_fs_mkdir` | Create a sandbox directory |
+| `sandbox_fs_remove` | Remove a sandbox file or directory |
+| `sandbox_fs_copy` | Copy a file within one sandbox or between two running sandboxes |
+| `sandbox_fs_rename` | Rename a sandbox file or directory |
+| `sandbox_fs_stat` | Get sandbox path metadata |
+| `sandbox_fs_exists` | Check whether a sandbox path exists |
+| `sandbox_fs_copy_from_host` | Copy an allowlisted host path into a sandbox |
+| `sandbox_fs_copy_to_host` | Copy a sandbox path to an allowlisted host destination |
+
+**Metrics**
 
-**Filesystem:**
 | Tool | Description |
 | ---- | ----------- |
-| `sandbox_fs_read` | Read a file from the sandbox filesystem |
-| `sandbox_fs_write` | Write content to a file inside the sandbox |
-| `sandbox_fs_list` | List directory contents |
-| `sandbox_fs_mkdir` | Create a directory with parent directories |
-| `sandbox_fs_remove` | Remove a file or directory |
-| `sandbox_fs_stat` | Get file metadata (kind, size, mode, modified time) |
-
-**Volume Management:**
+| `sandbox_metrics` | Get point-in-time metrics for one running sandbox |
+| `sandbox_metrics_all` | Get point-in-time metrics for all running sandboxes |
+| `sandbox_metrics_stream` | Collect a bounded number of metrics samples from one sandbox |
+
+**Volumes**
+
 | Tool | Description |
 | ---- | ----------- |
-| `volume_create` | Create a named persistent volume that survives sandbox restarts |
-| `volume_list` | List all volumes |
-| `volume_remove` | Remove a named volume |
+| `volume_create` | Create a directory or disk-backed named volume with quota, capacity, and labels |
+| `volume_list` | List named volumes with kind, quota, capacity, usage, disk format, labels, and timestamps |
+| `volume_inspect` | Inspect one named volume |
+| `volume_remove` | Remove one or more named volumes |
+| `volume_fs_read` | Read a volume file as UTF-8 text or base64 bytes |
+| `volume_fs_write` | Write UTF-8 text or base64 bytes to a volume file |
+| `volume_fs_list` | List volume directory entries |
+| `volume_fs_mkdir` | Create a directory inside a volume |
+| `volume_fs_remove` | Remove a file or directory from a volume |
+| `volume_fs_copy` | Copy a file inside a volume |
+| `volume_fs_rename` | Rename a file or directory inside a volume |
+| `volume_fs_stat` | Get volume path metadata |
+| `volume_fs_exists` | Check whether a volume path exists |
+
+**Images**
 
-**Monitoring:**
 | Tool | Description |
 | ---- | ----------- |
-| `sandbox_metrics` | Get live CPU, memory, disk I/O, and network metrics |
-| `check_installed` | Verify that the msb runtime and libkrunfw are available |
+| `image_list` | List cached images |
+| `image_inspect` | Inspect cached image config and layers |
+| `image_remove` | Remove one or more cached images, optionally forced with confirmation |
+| `image_prune` | Remove cached image artifacts unused by sandboxes, with confirmation |
+
+**Snapshots**
+
+| Tool | Description |
+| ---- | ----------- |
+| `snapshot_create` | Create a snapshot from a stopped sandbox by name or explicit host path |
+| `snapshot_list` | List indexed snapshots |
+| `snapshot_inspect` | Inspect snapshot metadata by name, digest, or path, optionally verifying integrity |
+| `snapshot_verify` | Verify recorded snapshot content integrity |
+| `snapshot_remove` | Remove one or more snapshots, optionally forced with confirmation |
+| `snapshot_reindex` | Rebuild the local snapshot index |
+| `snapshot_export` | Export a snapshot to an allowlisted host archive path |
+| `snapshot_import` | Import a snapshot archive from an allowlisted host path |
+
+**SSH and SFTP**
+
+| Tool | Description |
+| ---- | ----------- |
+| `sandbox_ssh_exec` | Execute a command through the sandbox SSH subsystem |
+| `sandbox_sftp_read` | Read a file through sandbox SFTP as UTF-8 text or base64 bytes |
+| `sandbox_sftp_write` | Write UTF-8 text or base64 bytes through sandbox SFTP |
+| `sandbox_sftp_mkdir` | Create a directory through sandbox SFTP |
+| `sandbox_sftp_remove` | Remove a file or directory through sandbox SFTP |
+| `sandbox_sftp_rename` | Rename a path through sandbox SFTP |
+| `sandbox_sftp_realpath` | Resolve a real path through sandbox SFTP |
+| `sandbox_sftp_readlink` | Read a symlink target through sandbox SFTP |
+| `sandbox_sftp_symlink` | Create a symlink through sandbox SFTP |
+
+## Resources
+
+| URI | Description |
+| --- | ----------- |
+| `microsandbox://runtime` | Runtime installation status and MCP configuration |
+| `microsandbox://sandboxes` | Current sandbox inventory |
+| `microsandbox://volumes` | Current volume inventory |
+| `microsandbox://images` | Current image cache inventory |
+| `microsandbox://snapshots` | Current snapshot index |
+| `microsandbox://schemas/sandbox-create` | JSON Schema for sandbox creation inputs |
+| `microsandbox://policy` | Effective host path and dangerous-operation policy |
+
+## Configuration
+
+| Env var | Default | Description |
+| ------- | ------- | ----------- |
+| `MICROSANDBOX_MCP_HOST_PATHS` | current working directory | Colon-separated allowlist for bind mounts, host copy, snapshot import/export, and other host path operations |
+| `MICROSANDBOX_MCP_HOST_PATH_POLICY` | `allowlist` | Set to `unrestricted` to allow any host path |
+| `MICROSANDBOX_MCP_ENABLE_DANGEROUS` | `0` | Enables future dangerous operations; destructive cache operations still require explicit `confirm: true` |
+| `MICROSANDBOX_MCP_MAX_OUTPUT_BYTES` | `1048576` | Default cap for command output, logs, and file reads |
+| `MICROSANDBOX_MCP_DEFAULT_TIMEOUT_MS` | `120000` | Default timeout budget for exec-style operations |
+| `MICROSANDBOX_MCP_SESSION_TTL_MS` | `900000` | Idle TTL for in-memory exec sessions |
+| `MSB_PATH` | unset | Optional path to the `msb` binary for SDK/runtime discovery |
+| `MSB_LIBKRUNFW_PATH` | unset | Optional path to `libkrunfw` |
+
+## SDK Gaps
+
+The server intentionally stays a thin TypeScript SDK adapter and does not shell out to `msb` for core behavior. Image pull/load/save, persistent registry login/logout/list, SSH authorization management, and managed SSH serving are not exposed until the TypeScript SDK provides first-class APIs for them. Command aliases (`msb install`/`msb uninstall`) and runtime self-update/uninstall are intentionally out of scope.
 
 ## Requirements
 
 macOS (Apple Silicon) or Linux (x86_64/ARM64 with KVM support).
 
-The `msb` runtime and `libkrunfw` are installed automatically on first run. If that fails, install manually:
+Use `runtime_check` to verify whether `msb` and `libkrunfw` are available. Use `runtime_install` to install them from the MCP server. If that fails, install manually:
 
 ```bash
 curl -fsSL https://install.microsandbox.dev | sh
@@ -179,9 +290,13 @@ git clone https://github.com/superradcompany/microsandbox-mcp.git
 cd microsandbox-mcp
 npm install
 npm run build
+npm test
+npm run test:e2e
 node dist/index.js
 ```
 
+`npm run test:e2e` launches the built MCP server over stdio and calls every registered tool and resource with live parameters. It creates temporary sandboxes, volumes, snapshots, and host files, then cleans them up. Global image cache deletion is guarded by default; set `MICROSANDBOX_MCP_E2E_DESTRUCTIVE_CACHE=1` to let the e2e script run destructive image prune behavior instead of the safe confirmation-error path.
+
 ## Links
 
 - [microsandbox](https://github.com/microsandbox/microsandbox) — The microVM sandbox runtime

package/dist/config.d.ts

@@ -0,0 +1,10 @@
+export interface ServerConfig {
+    hostPathPolicy: "allowlist" | "unrestricted";
+    hostPaths: string[];
+    dangerousEnabled: boolean;
+    maxOutputBytes: number;
+    defaultTimeoutMs: number;
+    sessionTtlMs: number;
+}
+export declare function getServerConfig(): ServerConfig;
+export declare function resetServerConfigForTests(): void;

package/dist/config.js

@@ -0,0 +1,42 @@
+import path from "node:path";
+const DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 120_000;
+const DEFAULT_SESSION_TTL_MS = 900_000;
+let cachedConfig;
+export function getServerConfig() {
+    if (cachedConfig)
+        return cachedConfig;
+    const hostPathPolicy = parseHostPathPolicy(process.env.MICROSANDBOX_MCP_HOST_PATH_POLICY);
+    const hostPaths = parseHostPaths(process.env.MICROSANDBOX_MCP_HOST_PATHS);
+    cachedConfig = {
+        hostPathPolicy,
+        hostPaths,
+        dangerousEnabled: process.env.MICROSANDBOX_MCP_ENABLE_DANGEROUS === "1",
+        maxOutputBytes: parsePositiveInt(process.env.MICROSANDBOX_MCP_MAX_OUTPUT_BYTES, DEFAULT_MAX_OUTPUT_BYTES),
+        defaultTimeoutMs: parsePositiveInt(process.env.MICROSANDBOX_MCP_DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS),
+        sessionTtlMs: parsePositiveInt(process.env.MICROSANDBOX_MCP_SESSION_TTL_MS, DEFAULT_SESSION_TTL_MS),
+    };
+    return cachedConfig;
+}
+export function resetServerConfigForTests() {
+    cachedConfig = undefined;
+}
+function parseHostPathPolicy(value) {
+    if (value === "unrestricted")
+        return "unrestricted";
+    return "allowlist";
+}
+function parseHostPaths(value) {
+    const rawPaths = value && value.trim().length > 0 ? value.split(":") : [process.cwd()];
+    return rawPaths
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)
+        .map((entry) => path.resolve(entry));
+}
+function parsePositiveInt(value, fallback) {
+    if (!value)
+        return fallback;
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B,MAAM,wBAAwB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7C,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,IAAI,YAAsC,CAAC;AAE3C,MAAM,UAAU,eAAe;IAC7B,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAE1E,YAAY,GAAG;QACb,cAAc;QACd,SAAS;QACT,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,GAAG;QACvE,cAAc,EAAE,gBAAgB,CAC9B,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAC7C,wBAAwB,CACzB;QACD,gBAAgB,EAAE,gBAAgB,CAChC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAC/C,kBAAkB,CACnB;QACD,YAAY,EAAE,gBAAgB,CAC5B,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAC3C,sBAAsB,CACvB;KACF,CAAC;IAEF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IACpD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,QAAQ,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvF,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC"}

package/dist/index.js

@@ -1,19 +1,31 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { registerResources } from "./resources.js";
 import { registerSandboxTools } from "./tools/sandbox.js";
 import { registerExecTools } from "./tools/exec.js";
 import { registerFilesystemTools } from "./tools/filesystem.js";
+import { registerImageTools } from "./tools/image.js";
+import { registerLogTools } from "./tools/logs.js";
 import { registerVolumeTools } from "./tools/volume.js";
 import { registerMetricsTools } from "./tools/metrics.js";
+import { registerRuntimeTools } from "./tools/runtime.js";
+import { registerSnapshotTools } from "./tools/snapshot.js";
+import { registerSshTools } from "./tools/ssh.js";
 const server = new McpServer({
     name: "microsandbox",
-    version: "0.5.7",
+    version: "0.5.10",
 });
+registerResources(server);
+registerRuntimeTools(server);
 registerSandboxTools(server);
 registerExecTools(server);
+registerLogTools(server);
 registerFilesystemTools(server);
 registerVolumeTools(server);
 registerMetricsTools(server);
+registerImageTools(server);
+registerSnapshotTools(server);
+registerSshTools(server);
 const transport = new StdioServerTransport();
 await server.connect(transport);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAC7B,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC1B,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAChC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC5B,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,QAAQ;CAClB,CAAC,CAAC;AAEH,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC1B,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAC7B,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAC7B,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC1B,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACzB,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAChC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC5B,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAC7B,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC3B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAC9B,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAEzB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/resources.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerResources(server: McpServer): void;

package/dist/resources.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+import { Image, isInstalled, Sandbox, Snapshot, Volume } from "microsandbox";
+import { getServerConfig } from "./config.js";
+import { sandboxCreateSchema } from "./tools/sandbox.js";
+import { imageHandleData, sandboxSummaryData, snapshotHandleData, volumeHandleData, } from "./utils/serialization.js";
+export function registerResources(server) {
+    server.registerResource("runtime", "microsandbox://runtime", {
+        title: "microsandbox runtime",
+        description: "Runtime installation and MCP server configuration.",
+        mimeType: "application/json",
+    }, async (uri) => jsonResource(uri, {
+        installed: isInstalled(),
+        nodeVersion: process.version,
+        platform: process.platform,
+        arch: process.arch,
+        msbPath: process.env.MSB_PATH ?? null,
+        libkrunfwPath: process.env.MSB_LIBKRUNFW_PATH ?? null,
+        policy: policyData(),
+    }));
+    server.registerResource("sandboxes", "microsandbox://sandboxes", {
+        title: "microsandbox sandboxes",
+        description: "Current sandbox inventory.",
+        mimeType: "application/json",
+    }, async (uri) => jsonResource(uri, (await Sandbox.list()).map(sandboxSummaryData)));
+    server.registerResource("volumes", "microsandbox://volumes", {
+        title: "microsandbox volumes",
+        description: "Current volume inventory.",
+        mimeType: "application/json",
+    }, async (uri) => jsonResource(uri, (await Volume.list()).map(volumeHandleData)));
+    server.registerResource("images", "microsandbox://images", {
+        title: "microsandbox images",
+        description: "Current cached image inventory.",
+        mimeType: "application/json",
+    }, async (uri) => jsonResource(uri, (await Image.list()).map(imageHandleData)));
+    server.registerResource("snapshots", "microsandbox://snapshots", {
+        title: "microsandbox snapshots",
+        description: "Current indexed snapshot inventory.",
+        mimeType: "application/json",
+    }, async (uri) => jsonResource(uri, (await Snapshot.list()).map(snapshotHandleData)));
+    server.registerResource("sandbox-create-schema", "microsandbox://schemas/sandbox-create", {
+        title: "sandbox create schema",
+        description: "JSON Schema for sandbox_create and sandbox_run creation fields.",
+        mimeType: "application/schema+json",
+    }, async (uri) => jsonResource(uri, z.toJSONSchema(sandboxCreateSchema)));
+    server.registerResource("policy", "microsandbox://policy", {
+        title: "microsandbox MCP policy",
+        description: "Effective host path and dangerous operation policy.",
+        mimeType: "application/json",
+    }, async (uri) => jsonResource(uri, policyData()));
+}
+function jsonResource(uri, data) {
+    return {
+        contents: [{
+                uri: uri.href,
+                mimeType: "application/json",
+                text: JSON.stringify(data, null, 2),
+            }],
+    };
+}
+function policyData() {
+    const config = getServerConfig();
+    return {
+        hostPathPolicy: config.hostPathPolicy,
+        hostPaths: config.hostPaths,
+        dangerousEnabled: config.dangerousEnabled,
+        maxOutputBytes: config.maxOutputBytes,
+        defaultTimeoutMs: config.defaultTimeoutMs,
+        sessionTtlMs: config.sessionTtlMs,
+    };
+}
+//# sourceMappingURL=resources.js.map

package/dist/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,MAAM,CAAC,gBAAgB,CACrB,SAAS,EACT,wBAAwB,EACxB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE;QAC/B,SAAS,EAAE,WAAW,EAAE;QACxB,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI;QACrC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI;QACrD,MAAM,EAAE,UAAU,EAAE;KACrB,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,WAAW,EACX,0BAA0B,EAC1B;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,4BAA4B;QACzC,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CACjF,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,SAAS,EACT,wBAAwB,EACxB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAC9E,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,QAAQ,EACR,uBAAuB,EACvB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAC5E,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,WAAW,EACX,0BAA0B,EAC1B;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,qCAAqC;QAClD,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAClF,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,uBAAuB,EACvB,uCAAuC,EACvC;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,iEAAiE;QAC9E,QAAQ,EAAE,yBAAyB;KACpC,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,QAAQ,EACR,uBAAuB,EACvB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,qDAAqD;QAClE,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ,EAAE,IAAa;IAC3C,OAAO;QACL,QAAQ,EAAE,CAAC;gBACT,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;aACpC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC;AACJ,CAAC"}

package/dist/schemas/common.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export declare const emptySchema: z.ZodObject<{}, z.core.$strip>;
+export declare const sandboxNameSchema: z.ZodString;
+export declare const volumeNameSchema: z.ZodString;
+export declare const outputLimitsSchema: z.ZodOptional<z.ZodObject<{
+    maxBytes: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>>;

package/dist/schemas/common.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+export const emptySchema = z.object({});
+export const sandboxNameSchema = z.string().min(1).max(128).describe("Sandbox name");
+export const volumeNameSchema = z.string().min(1).max(128).describe("Volume name");
+export const outputLimitsSchema = z.object({
+    maxBytes: z.number().int().positive().optional().describe("Maximum bytes to return."),
+}).optional();
+//# sourceMappingURL=common.js.map

package/dist/schemas/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/schemas/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAExC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CACtF,CAAC,CAAC,QAAQ,EAAE,CAAC"}

package/dist/state/exec-sessions.d.ts

@@ -0,0 +1,19 @@
+import type { ExecHandle, ExitStatus } from "microsandbox";
+export interface StoredExecEvent {
+    index: number;
+    event: Record<string, unknown>;
+}
+export declare function createExecSession(handle: ExecHandle, options?: {
+    stopSandboxOnExit?: string | null;
+}): Promise<string>;
+export declare function pollExecSession(id: string, cursor?: number, limit?: number): {
+    events: StoredExecEvent[];
+    nextCursor: number;
+    done: boolean;
+    exitStatus: ExitStatus | null;
+    error: string | null;
+};
+export declare function writeExecSessionStdin(id: string, data: string | Uint8Array, close?: boolean): Promise<void>;
+export declare function signalExecSession(id: string, signal: number): Promise<void>;
+export declare function killExecSession(id: string): Promise<void>;
+export declare function closeExecSession(id: string): Promise<void>;

package/dist/state/exec-sessions.js

@@ -0,0 +1,151 @@
+import crypto from "node:crypto";
+import { Sandbox } from "microsandbox";
+import { getServerConfig } from "../config.js";
+const sessions = new Map();
+export async function createExecSession(handle, options = {}) {
+    cleanupExecSessions();
+    const id = crypto.randomUUID();
+    const stdin = await handle.takeStdin();
+    const session = {
+        id,
+        handle,
+        stdin,
+        stopSandboxOnExit: options.stopSandboxOnExit ?? null,
+        events: [],
+        done: false,
+        exitStatus: null,
+        error: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+    };
+    sessions.set(id, session);
+    void readEvents(session);
+    return id;
+}
+export function pollExecSession(id, cursor = 0, limit = 100) {
+    const session = requireExecSession(id);
+    touch(session);
+    const events = session.events
+        .filter((entry) => entry.index >= cursor)
+        .slice(0, limit);
+    const nextCursor = events.length > 0 ? events[events.length - 1].index + 1 : cursor;
+    return {
+        events,
+        nextCursor,
+        done: session.done,
+        exitStatus: session.exitStatus,
+        error: session.error,
+    };
+}
+export async function writeExecSessionStdin(id, data, close = false) {
+    const session = requireExecSession(id);
+    touch(session);
+    if (!session.stdin) {
+        throw new Error("stdin is not available for this exec session");
+    }
+    await session.stdin.write(data);
+    if (close) {
+        await session.stdin.close();
+        session.stdin = null;
+    }
+}
+export async function signalExecSession(id, signal) {
+    const session = requireExecSession(id);
+    touch(session);
+    await session.handle.signal(signal);
+}
+export async function killExecSession(id) {
+    const session = requireExecSession(id);
+    touch(session);
+    await session.handle.kill();
+}
+export async function closeExecSession(id) {
+    const session = requireExecSession(id);
+    sessions.delete(id);
+    if (session.stdin)
+        await session.stdin.close();
+    await session.handle[Symbol.asyncDispose]();
+}
+function requireExecSession(id) {
+    cleanupExecSessions();
+    const session = sessions.get(id);
+    if (!session)
+        throw new Error(`exec session not found: ${id}`);
+    return session;
+}
+async function readEvents(session) {
+    try {
+        for (;;) {
+            const event = await session.handle.recv();
+            if (event === null) {
+                session.done = true;
+                session.updatedAt = new Date();
+                await stopSandboxIfNeeded(session);
+                return;
+            }
+            if (event.kind === "exited") {
+                session.exitStatus = {
+                    code: event.code,
+                    success: event.code === 0,
+                };
+            }
+            session.events.push({
+                index: session.events.length,
+                event: serializeExecEvent(event),
+            });
+            session.updatedAt = new Date();
+        }
+    }
+    catch (error) {
+        session.error = error instanceof Error ? error.message : String(error);
+        session.done = true;
+        session.updatedAt = new Date();
+        await stopSandboxIfNeeded(session);
+    }
+}
+function serializeExecEvent(event) {
+    switch (event.kind) {
+        case "stdout":
+        case "stderr":
+            return {
+                kind: event.kind,
+                data: Buffer.from(event.data).toString("utf8"),
+            };
+        default:
+            return event;
+    }
+}
+function touch(session) {
+    session.updatedAt = new Date();
+}
+function cleanupExecSessions() {
+    const ttl = getServerConfig().sessionTtlMs;
+    const now = Date.now();
+    for (const [id, session] of sessions) {
+        if (now - session.updatedAt.getTime() > ttl) {
+            sessions.delete(id);
+            if (session.stopSandboxOnExit) {
+                void stopSandboxByName(session.stopSandboxOnExit);
+            }
+            void session.handle[Symbol.asyncDispose]();
+        }
+    }
+}
+async function stopSandboxIfNeeded(session) {
+    if (!session.stopSandboxOnExit)
+        return;
+    const name = session.stopSandboxOnExit;
+    session.stopSandboxOnExit = null;
+    await stopSandboxByName(name);
+}
+async function stopSandboxByName(name) {
+    try {
+        const handle = await Sandbox.get(name);
+        if (handle.status === "running")
+            await handle.stop();
+    }
+    catch {
+        // Best-effort cleanup for sandboxes started only to host an exec session.
+    }
+}
+//# sourceMappingURL=exec-sessions.js.map

package/dist/state/exec-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-sessions.js","sourceRoot":"","sources":["../../src/state/exec-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAoB/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAkB,EAClB,UAAiD,EAAE;IAEnD,mBAAmB,EAAE,CAAC;IAEtB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,MAAM,OAAO,GAAgB;QAC3B,EAAE;QACF,MAAM;QACN,KAAK;QACL,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;QACpD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1B,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG;IAOjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;SAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;SACxC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAErF,OAAO;QACL,MAAM;QACN,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAU,EAAE,IAAyB,EAAE,KAAK,GAAG,KAAK;IAC9F,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU,EAAE,MAAc;IAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU;IAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpB,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/C,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU;IACpC,mBAAmB,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAoB;IAC5C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC/B,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,UAAU,GAAG;oBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC;iBAC1B,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;gBAC5B,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;aACjC,CAAC,CAAC;YACH,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC/C,CAAC;QACJ;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,OAAoB;IACjC,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC,YAAY,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;YAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC9B,KAAK,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAoB;IACrD,IAAI,CAAC,OAAO,CAAC,iBAAiB;QAAE,OAAO;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACvC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IACjC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC"}