sandbox0 0.10.4 → 0.10.6

package/README.md

@@ -2,6 +2,11 @@
 
 The official JavaScript/TypeScript SDK for Sandbox0, providing typed models and ergonomic high-level APIs for managing secure code execution sandboxes.
 
+> This SDK remains open source. Current Sandbox0 runtime development is closed source.
+> Sandbox0 Cloud is the supported service. Self-hosting is no longer supported.
+> Bring Your Own Cloud (BYOC) is planned and is not available yet.
+> See [deployment options](https://sandbox0.ai/docs/sandbox/deployment).
+
 ## Installation
 
 ```bash
@@ -18,6 +23,37 @@ pnpm add sandbox0
 
 Streaming APIs prefer a runtime-native `globalThis.WebSocket` when a Node-compatible host exposes one, and fall back to the `ws` package on older Node runtimes. This keeps the main SDK entry compatible with SandFunc-style runtimes that expose a standard outbound WebSocket client without requiring raw socket access in user code.
 
+## Files while compute is paused
+
+Use the existing file methods without starting or resuming compute:
+
+```typescript
+const sandbox = client.sandbox(sandboxId);
+const content = await sandbox.readFile('/workspace/output.txt');
+await sandbox.writeFile('/workspace/input.txt', 'next task');
+```
+
+Read, stat, and list work during filesystem-only and memory pauses. Write,
+mkdir, move, and delete work during filesystem-only pauses; retained memory
+checkpoints reject offline edits with a conflict. File calls do not trigger
+`auto_resume`, and no SDK upgrade or new endpoint is needed. Watch and SSH
+still require a running runtime. See [file access](https://sandbox0.ai/docs/sandbox/files).
+
+
+## RootFS capacity
+
+Template `resources.ephemeralStorage` sets the initial RootFS filesystem capacity
+for image imports: the default is `8Gi`, and supported values are `300Mi` through
+`1Ti`, aligned to 4096 bytes. On deployments with automatic growth enabled, XFS
+expands online within the configured sparse-device ceiling while the sandbox's
+processes continue running. Existing generations retain their committed geometry.
+
+Persistent blocks reside in regional object storage. Compute nodes retain bounded
+caches and write journals; slow or unavailable storage can apply write backpressure.
+The initial size is distinct from stored data usage and service storage quotas.
+Automatic growth requires operator enablement; see the
+[deployment guide](https://github.com/sandbox0-ai/sandbox0/blob/main/deploy/nomad/rootfs-autogrow.md).
+
 ## Configuration
 
 | Environment Variable | Required | Default                   | Description          |
@@ -184,6 +220,29 @@ The token needs `usage:read`, and the Sandbox0 region must have metering and
 its ClickHouse query projection enabled. `GET /api/v1/quotas` reports current
 operational quota status; it is not a cumulative usage API.
 
+## Independent sandbox health (unreleased)
+
+```typescript
+const health = await client.sandboxes.getHealth(sandboxId, {
+  signal: AbortSignal.timeout(10_000),
+});
+console.log(health.runtime.liveness.state, health.execution.state, health.terminal.state);
+```
+
+Generations outside JavaScript's safe integer range are rejected rather than rounded.
+
+Health is returned as separate runtime launch/liveness, execution, terminal,
+and storage identity/writer/I/O observations. Each includes `state`, a fixed
+`reason`, its evidence `source`, and the original observation time (null when
+unobserved). Guest evidence is advisory. A storage identity or writer lease does
+not prove current storage I/O; that check currently remains `unknown`.
+
+The query may run bounded fixed guest diagnostics, but never resumes or restarts
+a sandbox. Paused sandboxes and active lifecycle transitions skip those probes.
+Unavailable guest diagnostics are a successful observation response, not an API
+failure or a reason to retry a lifecycle mutation. This API requires a server
+version with the health endpoint; SDKs do not fall back to guest commands.
+
 ## Links
 
 - [Documentation](https://sandbox0.ai/docs)
@@ -193,3 +252,78 @@ operational quota status; it is not a cumulative usage API.
 ## License
 
 Apache-2.0
+
+
+Conditional session receipts can be read without auto-resume or process creation:
+`sandbox.findConditionalSession(originalKey, generation)`.
+This uses the distinct `/sessions/conditional/lookup` route and checks the original
+generation. Errors never fall back to ordinary lookup or creation. A missing
+receipt does not authorize replay: an earlier create may still be in flight.
+The result is process information, not credential/storage qualification or proof
+that the process is still running when a later action begins.
+
+### Conditional Session attachment
+
+`sandbox.connectConditionalSession(sessionId, key, generation, attemptId, options)` opens the distinct `/sessions/{session_id}/conditional/ws` endpoint, bound to the original conditional creation key, runtime generation and attempt. It accepts the existing Session WebSocket replay options. Every control message is checked against that binding, and generation handover revokes the connection. Errors never trigger an ordinary attachment, retry or auto-resume. Closing the connection detaches without stopping the process. This is not lifecycle, storage or credential qualification.
+
+### Reconnect an explicitly memory-restored original attempt
+
+```typescript
+const session = await sandbox.findRestoredConditionalSession(originalKey, currentGeneration, creationGeneration);
+const connection = await sandbox.connectRestoredConditionalSession(session.id, originalKey, currentGeneration, creationGeneration, originalAttemptId, {after});
+```
+
+Verify the external memory-restoration lineage and your owned credential/session
+history first. These helpers explicitly send `creation_runtime_generation`, which
+must precede the current generation. They require the original still-running
+attempt and never create a session, restart an attempt, resume the sandbox or
+retry through ordinary endpoints. Existing same-generation helpers remain strict.
+The restored socket can replay the original attempt's earlier-generation events;
+its controls are bound to the current generation and the original attempt ID.
+A subsequent handover revokes the socket. Old gateways that discard the optional
+origin cannot authorize a restored original creation and must return an error.
+
+## Explicit snapshot recovery
+
+Use `client.sandboxes.restoreSnapshot(sandboxId, { expectedRuntimeGeneration: 7, snapshotId, snapshotGenerationId, discardProcessState: true, idempotencyKey })` to explicitly end old processes and replace writable RootFS. Keep every field and the key after an uncertain reply. `findSnapshotRestoreOperation` and `getSnapshotRestoreOperation` observe the original operation without submitting work. Only `succeeded` proves fresh runtime launch; `restoredRootfsGenerationId` alone proves the head change committed.
+
+The `getSnapshotRestoreFinalCapture`, `readSnapshotRestoreFinalCaptureFile` and `acknowledgeSnapshotRestoreFinalCapture` methods preserve stopped-source credential custody. Acknowledge only after durable encrypted owner commit. Helpers never retry, refresh coordinates or fall back to guest execution or disk-only memory recovery. Source and successor generations must be safe integers.
+
+## Read original RootFS fork provenance
+
+```typescript
+const receipt = await client.sandboxes.getRootFSFork(sourceSandboxId, {
+  expectedRuntimeGeneration: 7, idempotencyKey: "original-fork",
+});
+```
+
+Keep the original source sandbox, generation (including zero), key and
+authenticated identity. This performs one GET and never retries or submits a
+fork. Missing, conflicting and pending results remain errors; a 404 is not
+proof of cancellation. The receipt requires the original unchanged, never-run
+paused child and retained storage evidence. Memory forks are excluded. It is
+not a credential-safety attestation or a state reservation; later mutations
+need their own identity conditions.
+
+## Conditional first launch of a RootFS fork
+
+```typescript
+const original = {
+  forkOperationId: receipt.operationId, filesystemId: receipt.targetFilesystemId,
+  headGenerationId: receipt.targetHeadGenerationId, writerEpoch: receipt.writerEpoch,
+  idempotencyKey: "original-child-launch",
+}; // Persist these conditions before submitting.
+const launch = await client.sandboxes.launchRootFSFork(receipt.targetSandboxId, original);
+const observation = await client.sandboxes.getRootFSForkLaunch(receipt.targetSandboxId, {
+  ...original, expectedOperationId: launch.operationId,
+});
+```
+
+Each method sends exactly one request. After a lost reply, query with the same
+original conditions and key, omitting `expectedOperationId` if no receipt was
+received. Never refresh the original writer epoch or fall back to ordinary
+resume. A completed receipt retains its digest and time even when `current` is
+false after later lifecycle changes. `current` is an owner snapshot, not a live
+lease, health check or credential authorization. Pending has no completion
+proof; neither aborted nor 404 proves physical absence. Helpers validate the
+returned identity and state-specific evidence and never poll or retry for you.

package/dist/apispec/src/apis/FilesApi.d.ts

@@ -46,68 +46,72 @@ export interface ApiV1SandboxesIdFilesWatchGetRequest {
  */
 export declare class FilesApi extends runtime.BaseAPI {
     /**
+     * Works during filesystem-only pauses without starting compute. Offline deletion returns 409 conflict while a memory checkpoint is retained.
      * Delete file or directory
      */
     apiV1SandboxesIdFilesDeleteRaw(requestParameters: ApiV1SandboxesIdFilesDeleteRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessDeletedResponse>>;
     /**
+     * Works during filesystem-only pauses without starting compute. Offline deletion returns 409 conflict while a memory checkpoint is retained.
      * Delete file or directory
      */
     apiV1SandboxesIdFilesDelete(requestParameters: ApiV1SandboxesIdFilesDeleteRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessDeletedResponse>;
     /**
-     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload.
+     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload. Reads the persistent RootFS while paused without starting or resuming compute, including memory-paused sandboxes.
      * Read file content
      */
     apiV1SandboxesIdFilesGetRaw(requestParameters: ApiV1SandboxesIdFilesGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Blob>>;
     /**
-     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload.
+     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload. Reads the persistent RootFS while paused without starting or resuming compute, including memory-paused sandboxes.
      * Read file content
      */
     apiV1SandboxesIdFilesGet(requestParameters: ApiV1SandboxesIdFilesGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Blob>;
     /**
-     * Use query params: - path=/tmp: target directory path
+     * Use query params: - path=/workspace: target directory path Also works on the committed RootFS while paused, without resuming compute.
      * List directory entries
      */
     apiV1SandboxesIdFilesListGetRaw(requestParameters: ApiV1SandboxesIdFilesListGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessFileListResponse>>;
     /**
-     * Use query params: - path=/tmp: target directory path
+     * Use query params: - path=/workspace: target directory path Also works on the committed RootFS while paused, without resuming compute.
      * List directory entries
      */
     apiV1SandboxesIdFilesListGet(requestParameters: ApiV1SandboxesIdFilesListGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessFileListResponse>;
     /**
+     * Works during a filesystem-only pause without starting compute. A retained memory checkpoint prevents offline mutations (409 conflict).
      * Move a file or directory
      */
     apiV1SandboxesIdFilesMovePostRaw(requestParameters: ApiV1SandboxesIdFilesMovePostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessMovedResponse>>;
     /**
+     * Works during a filesystem-only pause without starting compute. A retained memory checkpoint prevents offline mutations (409 conflict).
      * Move a file or directory
      */
     apiV1SandboxesIdFilesMovePost(requestParameters: ApiV1SandboxesIdFilesMovePostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessMovedResponse>;
     /**
-     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content.
+     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content (maximum 100 MiB). Works during filesystem-only pauses without starting compute. Offline mutations return 409 conflict while a memory checkpoint is retained.
      * Write file or create directory
      */
     apiV1SandboxesIdFilesPostRaw(requestParameters: ApiV1SandboxesIdFilesPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessWrittenResponse>>;
     /**
-     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content.
+     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content (maximum 100 MiB). Works during filesystem-only pauses without starting compute. Offline mutations return 409 conflict while a memory checkpoint is retained.
      * Write file or create directory
      */
     apiV1SandboxesIdFilesPost(requestParameters: ApiV1SandboxesIdFilesPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessWrittenResponse>;
     /**
-     * Use query params: - path=/tmp/a.txt: target file path
+     * Use query params: - path=/workspace/a.txt: target file path Also works on the committed RootFS while paused, without resuming compute.
      * Stat a file
      */
     apiV1SandboxesIdFilesStatGetRaw(requestParameters: ApiV1SandboxesIdFilesStatGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessFileStatResponse>>;
     /**
-     * Use query params: - path=/tmp/a.txt: target file path
+     * Use query params: - path=/workspace/a.txt: target file path Also works on the committed RootFS while paused, without resuming compute.
      * Stat a file
      */
     apiV1SandboxesIdFilesStatGet(requestParameters: ApiV1SandboxesIdFilesStatGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessFileStatResponse>;
     /**
-     * Upgrades to WebSocket for file watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
+     * Upgrades to WebSocket for file watch events. Requires a running guest and follows auto_resume; offline file access does not provide watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
      * File watch WebSocket
      */
     apiV1SandboxesIdFilesWatchGetRaw(requestParameters: ApiV1SandboxesIdFilesWatchGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
     /**
-     * Upgrades to WebSocket for file watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
+     * Upgrades to WebSocket for file watch events. Requires a running guest and follows auto_resume; offline file access does not provide watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
      * File watch WebSocket
      */
     apiV1SandboxesIdFilesWatchGet(requestParameters: ApiV1SandboxesIdFilesWatchGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;

package/dist/apispec/src/apis/FilesApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FilesApi.d.ts","sourceRoot":"","sources":["../../../../src/apispec/src/apis/FilesApi.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,OAAO,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAGV,eAAe,EAEf,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AAsBzB,MAAM,WAAW,kCAAkC;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oCAAoC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,mCAAmC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oCAAoC;IACjD,EAAE,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBAAa,QAAS,SAAQ,OAAO,CAAC,OAAO;IAEzC;;OAEG;IACG,8BAA8B,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IA6C7M;;OAEG;IACG,2BAA2B,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKrL;;;OAGG;IACG,2BAA2B,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IA6CrL;;;OAGG;IACG,wBAAwB,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7J;;;OAGG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IA6ChN;;;OAGG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAKxL;;OAEG;IACG,gCAAgC,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;IA4C/M;;OAEG;IACG,6BAA6B,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAKvL;;;OAGG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,gCAAgC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAwDzM;;;OAGG;IACG,yBAAyB,CAAC,iBAAiB,EAAE,gCAAgC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKjL;;;OAGG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IA6ChN;;;OAGG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAKxL;;;OAGG;IACG,gCAAgC,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAkC/L;;;OAGG;IACG,6BAA6B,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;CAI1K"}
+{"version":3,"file":"FilesApi.d.ts","sourceRoot":"","sources":["../../../../src/apispec/src/apis/FilesApi.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,OAAO,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAGV,eAAe,EAEf,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AAsBzB,MAAM,WAAW,kCAAkC;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oCAAoC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,gCAAgC;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,mCAAmC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oCAAoC;IACjD,EAAE,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBAAa,QAAS,SAAQ,OAAO,CAAC,OAAO;IAEzC;;;OAGG;IACG,8BAA8B,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IA6C7M;;;OAGG;IACG,2BAA2B,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKrL;;;OAGG;IACG,2BAA2B,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IA6CrL;;;OAGG;IACG,wBAAwB,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7J;;;OAGG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IA6ChN;;;OAGG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAKxL;;;OAGG;IACG,gCAAgC,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;IA4C/M;;;OAGG;IACG,6BAA6B,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAKvL;;;OAGG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,gCAAgC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAwDzM;;;OAGG;IACG,yBAAyB,CAAC,iBAAiB,EAAE,gCAAgC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKjL;;;OAGG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IA6ChN;;;OAGG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAKxL;;;OAGG;IACG,gCAAgC,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAkC/L;;;OAGG;IACG,6BAA6B,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;CAI1K"}

package/dist/apispec/src/apis/FilesApi.js

@@ -18,6 +18,7 @@ import { MoveFileRequestToJSON, SuccessDeletedResponseFromJSON, SuccessFileListR
  */
 export class FilesApi extends runtime.BaseAPI {
     /**
+     * Works during filesystem-only pauses without starting compute. Offline deletion returns 409 conflict while a memory checkpoint is retained.
      * Delete file or directory
      */
     async apiV1SandboxesIdFilesDeleteRaw(requestParameters, initOverrides) {
@@ -50,6 +51,7 @@ export class FilesApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => SuccessDeletedResponseFromJSON(jsonValue));
     }
     /**
+     * Works during filesystem-only pauses without starting compute. Offline deletion returns 409 conflict while a memory checkpoint is retained.
      * Delete file or directory
      */
     async apiV1SandboxesIdFilesDelete(requestParameters, initOverrides) {
@@ -57,7 +59,7 @@ export class FilesApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload.
+     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload. Reads the persistent RootFS while paused without starting or resuming compute, including memory-paused sandboxes.
      * Read file content
      */
     async apiV1SandboxesIdFilesGetRaw(requestParameters, initOverrides) {
@@ -90,7 +92,7 @@ export class FilesApi extends runtime.BaseAPI {
         return new runtime.BlobApiResponse(response);
     }
     /**
-     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload.
+     * Use query params: - path=/tmp/a.txt: target file path When `Accept` or `Content-Type` is `application/json`, returns a base64 JSON payload. Reads the persistent RootFS while paused without starting or resuming compute, including memory-paused sandboxes.
      * Read file content
      */
     async apiV1SandboxesIdFilesGet(requestParameters, initOverrides) {
@@ -98,7 +100,7 @@ export class FilesApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Use query params: - path=/tmp: target directory path
+     * Use query params: - path=/workspace: target directory path Also works on the committed RootFS while paused, without resuming compute.
      * List directory entries
      */
     async apiV1SandboxesIdFilesListGetRaw(requestParameters, initOverrides) {
@@ -131,7 +133,7 @@ export class FilesApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => SuccessFileListResponseFromJSON(jsonValue));
     }
     /**
-     * Use query params: - path=/tmp: target directory path
+     * Use query params: - path=/workspace: target directory path Also works on the committed RootFS while paused, without resuming compute.
      * List directory entries
      */
     async apiV1SandboxesIdFilesListGet(requestParameters, initOverrides) {
@@ -139,6 +141,7 @@ export class FilesApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
+     * Works during a filesystem-only pause without starting compute. A retained memory checkpoint prevents offline mutations (409 conflict).
      * Move a file or directory
      */
     async apiV1SandboxesIdFilesMovePostRaw(requestParameters, initOverrides) {
@@ -170,6 +173,7 @@ export class FilesApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => SuccessMovedResponseFromJSON(jsonValue));
     }
     /**
+     * Works during a filesystem-only pause without starting compute. A retained memory checkpoint prevents offline mutations (409 conflict).
      * Move a file or directory
      */
     async apiV1SandboxesIdFilesMovePost(requestParameters, initOverrides) {
@@ -177,7 +181,7 @@ export class FilesApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content.
+     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content (maximum 100 MiB). Works during filesystem-only pauses without starting compute. Offline mutations return 409 conflict while a memory checkpoint is retained.
      * Write file or create directory
      */
     async apiV1SandboxesIdFilesPostRaw(requestParameters, initOverrides) {
@@ -218,7 +222,7 @@ export class FilesApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => SuccessWrittenResponseFromJSON(jsonValue));
     }
     /**
-     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content.
+     * Use `path` query param and `mkdir=true` to create directories, otherwise writes file content (maximum 100 MiB). Works during filesystem-only pauses without starting compute. Offline mutations return 409 conflict while a memory checkpoint is retained.
      * Write file or create directory
      */
     async apiV1SandboxesIdFilesPost(requestParameters, initOverrides) {
@@ -226,7 +230,7 @@ export class FilesApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Use query params: - path=/tmp/a.txt: target file path
+     * Use query params: - path=/workspace/a.txt: target file path Also works on the committed RootFS while paused, without resuming compute.
      * Stat a file
      */
     async apiV1SandboxesIdFilesStatGetRaw(requestParameters, initOverrides) {
@@ -259,7 +263,7 @@ export class FilesApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => SuccessFileStatResponseFromJSON(jsonValue));
     }
     /**
-     * Use query params: - path=/tmp/a.txt: target file path
+     * Use query params: - path=/workspace/a.txt: target file path Also works on the committed RootFS while paused, without resuming compute.
      * Stat a file
      */
     async apiV1SandboxesIdFilesStatGet(requestParameters, initOverrides) {
@@ -267,7 +271,7 @@ export class FilesApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Upgrades to WebSocket for file watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
+     * Upgrades to WebSocket for file watch events. Requires a running guest and follows auto_resume; offline file access does not provide watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
      * File watch WebSocket
      */
     async apiV1SandboxesIdFilesWatchGetRaw(requestParameters, initOverrides) {
@@ -294,7 +298,7 @@ export class FilesApi extends runtime.BaseAPI {
         return new runtime.VoidApiResponse(response);
     }
     /**
-     * Upgrades to WebSocket for file watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
+     * Upgrades to WebSocket for file watch events. Requires a running guest and follows auto_resume; offline file access does not provide watch events. Client messages: - { \"action\": \"subscribe\", \"path\": \"/tmp\", \"recursive\": false } - { \"action\": \"unsubscribe\", \"watch_id\": \"watch-id\" } Server messages: - { \"type\": \"subscribed\", \"watch_id\": \"watch-id\", \"path\": \"/tmp\" } - { \"type\": \"event\", \"watch_id\": \"watch-id\", \"event\": \"write\", \"path\": \"/tmp/a.txt\" } - { \"type\": \"unsubscribed\", \"watch_id\": \"watch-id\" } - { \"type\": \"error\", \"error\": \"message\" }
      * File watch WebSocket
      */
     async apiV1SandboxesIdFilesWatchGet(requestParameters, initOverrides) {

package/dist/apispec/src/apis/SandboxRootfsApi.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime.js';
-import type { CreateSandboxRootFSSnapshotRequest, ForkSandboxRequest, RebaseSandboxRootFSRequest, RestoreSandboxRootFSRequest, SuccessDeletedResponse, SuccessForkSandboxResponse, SuccessRebaseSandboxRootFSResponse, SuccessRestoreSandboxRootFSResponse, SuccessSandboxRootFSSnapshotListResponse, SuccessSandboxRootFSSnapshotResponse } from '../models/index.js';
+import type { CaptureSandboxRootFSSnapshotRequest, CreateSandboxRootFSSnapshotRequest, ForkSandboxRequest, RebaseSandboxRootFSRequest, RestoreSandboxRootFSRequest, SandboxRootFSForkLaunchRequest, SuccessDeletedResponse, SuccessForkSandboxResponse, SuccessRebaseSandboxRootFSResponse, SuccessRestoreSandboxRootFSResponse, SuccessSandboxRootFSForkLaunchResponse, SuccessSandboxRootFSForkObservationResponse, SuccessSandboxRootFSIdentityResponse, SuccessSandboxRootFSSnapshotListResponse, SuccessSandboxRootFSSnapshotResponse } from '../models/index.js';
 export interface ApiV1SandboxRootfsSnapshotsSnapshotIdDeleteRequest {
     snapshotId: string;
 }
@@ -37,6 +37,37 @@ export interface ApiV1SandboxesIdSnapshotsPostRequest {
     id: string;
     createSandboxRootFSSnapshotRequest?: CreateSandboxRootFSSnapshotRequest;
 }
+export interface CaptureSandboxRootFSSnapshotOperationRequest {
+    id: string;
+    idempotencyKey: string;
+    captureSandboxRootFSSnapshotRequest: CaptureSandboxRootFSSnapshotRequest;
+}
+export interface GetCapturedSandboxRootFSSnapshotRequest {
+    id: string;
+    idempotencyKey: string;
+    expectedRuntimeGeneration: number;
+}
+export interface GetSandboxRootFSForkRequest {
+    id: string;
+    idempotencyKey: string;
+    expectedRuntimeGeneration: number;
+}
+export interface GetSandboxRootFSForkLaunchRequest {
+    id: string;
+    idempotencyKey: string;
+    forkOperationId: string;
+    filesystemId: string;
+    headGenerationId: string;
+    writerEpoch: number;
+}
+export interface GetSandboxRootFSIdentityRequest {
+    id: string;
+}
+export interface LaunchSandboxRootFSForkRequest {
+    id: string;
+    idempotencyKey: string;
+    sandboxRootFSForkLaunchRequest: SandboxRootFSForkLaunchRequest;
+}
 /**
  *
  */
@@ -58,12 +89,12 @@ export declare class SandboxRootfsApi extends runtime.BaseAPI {
      */
     apiV1SandboxRootfsSnapshotsSnapshotIdGet(requestParameters: ApiV1SandboxRootfsSnapshotsSnapshotIdGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSSnapshotResponse>;
     /**
-     * Forks the source sandbox writable rootfs into a new paused sandbox. A paused source is forked from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the fork operation completes. Set memory=true to retain execution state as well. Memory forks require a stable Idempotency-Key. While capture or parent restoration is pending, retry 503 responses with that same key and request. A successful response always contains a committed paused child.
+     * Forks the source sandbox writable rootfs into a new paused sandbox. A paused source is forked from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the fork operation completes. Set memory=true to retain execution state as well. Memory forks and requests with expected_runtime_generation require a stable Idempotency-Key. While capture or parent restoration is pending, retry 503 responses with that same key and request. A successful response always contains a committed paused child.
      * Fork a sandbox
      */
     apiV1SandboxesIdForkPostRaw(requestParameters: ApiV1SandboxesIdForkPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessForkSandboxResponse>>;
     /**
-     * Forks the source sandbox writable rootfs into a new paused sandbox. A paused source is forked from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the fork operation completes. Set memory=true to retain execution state as well. Memory forks require a stable Idempotency-Key. While capture or parent restoration is pending, retry 503 responses with that same key and request. A successful response always contains a committed paused child.
+     * Forks the source sandbox writable rootfs into a new paused sandbox. A paused source is forked from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the fork operation completes. Set memory=true to retain execution state as well. Memory forks and requests with expected_runtime_generation require a stable Idempotency-Key. While capture or parent restoration is pending, retry 503 responses with that same key and request. A successful response always contains a committed paused child.
      * Fork a sandbox
      */
     apiV1SandboxesIdForkPost(requestParameters: ApiV1SandboxesIdForkPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessForkSandboxResponse>;
@@ -94,14 +125,74 @@ export declare class SandboxRootfsApi extends runtime.BaseAPI {
      */
     apiV1SandboxesIdSnapshotsGet(requestParameters: ApiV1SandboxesIdSnapshotsGetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSSnapshotListResponse>;
     /**
-     * Creates an immutable snapshot record from the source sandbox writable rootfs. A paused source is snapshotted from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the snapshot operation completes.
+     * Creates an immutable snapshot record from the source sandbox writable rootfs. A paused source is snapshotted from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the snapshot operation completes. Each sandbox retains at most its team\'s snapshots_per_sandbox quota (default 10). Creating a snapshot automatically removes the oldest excess public snapshots. Internal template-build snapshots are excluded.
      * Create sandbox rootfs snapshot
      */
     apiV1SandboxesIdSnapshotsPostRaw(requestParameters: ApiV1SandboxesIdSnapshotsPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessSandboxRootFSSnapshotResponse>>;
     /**
-     * Creates an immutable snapshot record from the source sandbox writable rootfs. A paused source is snapshotted from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the snapshot operation completes.
+     * Creates an immutable snapshot record from the source sandbox writable rootfs. A paused source is snapshotted from its current rootfs head. A running source is briefly barriered and checkpointed first; the source sandbox remains running after the snapshot operation completes. Each sandbox retains at most its team\'s snapshots_per_sandbox quota (default 10). Creating a snapshot automatically removes the oldest excess public snapshots. Internal template-build snapshots are excluded.
      * Create sandbox rootfs snapshot
      */
     apiV1SandboxesIdSnapshotsPost(requestParameters: ApiV1SandboxesIdSnapshotsPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSSnapshotResponse>;
+    /**
+     * Captures one immutable RootFS snapshot from the expected running runtime generation without stopping its processes. Admission checks the generation while locking the external source and exact writer. Reuse the same key, generation and metadata after uncertainty: an accepted capture retains its original transaction and returns its original snapshot when completed, even if the source subsequently changes generation or pauses. A new capture of a paused or mismatched source is rejected. No guest execution, automatic resume, process restart or memory checkpoint fallback is performed. This distinct endpoint fails closed on servers without conditional capture.
+     * Capture a generation-conditioned running RootFS snapshot
+     */
+    captureSandboxRootFSSnapshotRaw(requestParameters: CaptureSandboxRootFSSnapshotOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessSandboxRootFSSnapshotResponse>>;
+    /**
+     * Captures one immutable RootFS snapshot from the expected running runtime generation without stopping its processes. Admission checks the generation while locking the external source and exact writer. Reuse the same key, generation and metadata after uncertainty: an accepted capture retains its original transaction and returns its original snapshot when completed, even if the source subsequently changes generation or pauses. A new capture of a paused or mismatched source is rejected. No guest execution, automatic resume, process restart or memory checkpoint fallback is performed. This distinct endpoint fails closed on servers without conditional capture.
+     * Capture a generation-conditioned running RootFS snapshot
+     */
+    captureSandboxRootFSSnapshot(requestParameters: CaptureSandboxRootFSSnapshotOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSSnapshotResponse>;
+    /**
+     * Reads only the capture identified by the authenticated caller, original Idempotency-Key and expected runtime generation. Does not admit, dispatch, retry, cancel or repair work. Completed receipts can be read after the source changes generation or pauses. A 404 is not proof of cancellation and must not clear an outstanding operation fence. A missing, expired or deleted retained snapshot is never replaced with a new capture.
+     * Read the original generation-conditioned snapshot receipt
+     */
+    getCapturedSandboxRootFSSnapshotRaw(requestParameters: GetCapturedSandboxRootFSSnapshotRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessSandboxRootFSSnapshotResponse>>;
+    /**
+     * Reads only the capture identified by the authenticated caller, original Idempotency-Key and expected runtime generation. Does not admit, dispatch, retry, cancel or repair work. Completed receipts can be read after the source changes generation or pauses. A 404 is not proof of cancellation and must not clear an outstanding operation fence. A missing, expired or deleted retained snapshot is never replaced with a new capture.
+     * Read the original generation-conditioned snapshot receipt
+     */
+    getCapturedSandboxRootFSSnapshot(requestParameters: GetCapturedSandboxRootFSSnapshotRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSSnapshotResponse>;
+    /**
+     * Reads one external database observation for the original authenticated caller, Idempotency-Key and source runtime generation, including zero. Does not submit, retry, cancel or repair work, contact the guest or resume a runtime. Requires sandbox:read. A 404 is not proof of cancellation. Only RootFS forks qualify: memory forks are rejected. The child must remain paused, never run, and retain its original claim and durable head. Configuration must match birth or the one externally committed credential-free network isolation preparation; other changes are rejected. Running-source forks must retain their checkpoint proof; paused-source forks must retain the source filesystem binding. Later source generations or a retained source tombstone do not create a new capture. This is not a credential-safety attestation or a state reservation; subsequent mutations require their own identity conditions.
+     * Read original RootFS fork destination provenance
+     */
+    getSandboxRootFSForkRaw(requestParameters: GetSandboxRootFSForkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessSandboxRootFSForkObservationResponse>>;
+    /**
+     * Reads one external database observation for the original authenticated caller, Idempotency-Key and source runtime generation, including zero. Does not submit, retry, cancel or repair work, contact the guest or resume a runtime. Requires sandbox:read. A 404 is not proof of cancellation. Only RootFS forks qualify: memory forks are rejected. The child must remain paused, never run, and retain its original claim and durable head. Configuration must match birth or the one externally committed credential-free network isolation preparation; other changes are rejected. Running-source forks must retain their checkpoint proof; paused-source forks must retain the source filesystem binding. Later source generations or a retained source tombstone do not create a new capture. This is not a credential-safety attestation or a state reservation; subsequent mutations require their own identity conditions.
+     * Read original RootFS fork destination provenance
+     */
+    getSandboxRootFSFork(requestParameters: GetSandboxRootFSForkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSForkObservationResponse>;
+    /**
+     * Binds the original authenticated caller and Idempotency-Key to a first cold launch of the child at generation zero. Supply the original fork operation and the child\'s observed filesystem, head and writer epoch. The child must retain its original birth configuration, or its one externally committed credential-free network isolation preparation; all other fields and automatic-wake disablement must remain unchanged. Memory forks and ordinary resumes are excluded. Retries must keep the same key and conditions; never refresh them after uncertainty. Requires sandbox:read. This is a read-only historical lookup and never admits, retries, wakes or contacts a guest. A 404 is not cancellation. Completed history survives later lifecycles. Current only compares the owner/lifecycle snapshot, not runtime health or a lease. Aborted does not prove physical absence. This is not credential admission.
+     * Read the original first fork launch result
+     */
+    getSandboxRootFSForkLaunchRaw(requestParameters: GetSandboxRootFSForkLaunchRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessSandboxRootFSForkLaunchResponse>>;
+    /**
+     * Binds the original authenticated caller and Idempotency-Key to a first cold launch of the child at generation zero. Supply the original fork operation and the child\'s observed filesystem, head and writer epoch. The child must retain its original birth configuration, or its one externally committed credential-free network isolation preparation; all other fields and automatic-wake disablement must remain unchanged. Memory forks and ordinary resumes are excluded. Retries must keep the same key and conditions; never refresh them after uncertainty. Requires sandbox:read. This is a read-only historical lookup and never admits, retries, wakes or contacts a guest. A 404 is not cancellation. Completed history survives later lifecycles. Current only compares the owner/lifecycle snapshot, not runtime health or a lease. Aborted does not prove physical absence. This is not credential admission.
+     * Read the original first fork launch result
+     */
+    getSandboxRootFSForkLaunch(requestParameters: GetSandboxRootFSForkLaunchRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSForkLaunchResponse>;
+    /**
+     * Requires sandbox:read. Reads one owner-scoped control-plane database snapshot without guest execution, node probing or automatic resume. Binds runtime coordinates to the durable filesystem, committed head and immutable image digest. This is provenance, not current storage liveness, an uncommitted-write guarantee or credential-clean attestation. A later lifecycle can invalidate the observation; mutations must still condition on the expected runtime generation and their own admission evidence.
+     * Read external runtime and RootFS identity
+     */
+    getSandboxRootFSIdentityRaw(requestParameters: GetSandboxRootFSIdentityRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessSandboxRootFSIdentityResponse>>;
+    /**
+     * Requires sandbox:read. Reads one owner-scoped control-plane database snapshot without guest execution, node probing or automatic resume. Binds runtime coordinates to the durable filesystem, committed head and immutable image digest. This is provenance, not current storage liveness, an uncommitted-write guarantee or credential-clean attestation. A later lifecycle can invalidate the observation; mutations must still condition on the expected runtime generation and their own admission evidence.
+     * Read external runtime and RootFS identity
+     */
+    getSandboxRootFSIdentity(requestParameters: GetSandboxRootFSIdentityRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSIdentityResponse>;
+    /**
+     * Binds the original authenticated caller and Idempotency-Key to a first cold launch of the child at generation zero. Supply the original fork operation and the child\'s observed filesystem, head and writer epoch. The child must retain its original birth configuration, or its one externally committed credential-free network isolation preparation; all other fields and automatic-wake disablement must remain unchanged. Memory forks and ordinary resumes are excluded. Retries must keep the same key and conditions; never refresh them after uncertainty. Requires sandbox:write. Admission is durable before node dispatch; manager recovery continues the exact lifecycle after a timeout or lost reply. No guest command or terminal is required. A 503 does not prove that admission failed; use GET with the original key and conditions. Completed history survives later lifecycles. Current only compares the owner/lifecycle snapshot, not runtime health or a lease. Aborted does not prove physical absence. This is not credential admission.
+     * Launch the original never-run RootFS fork
+     */
+    launchSandboxRootFSForkRaw(requestParameters: LaunchSandboxRootFSForkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessSandboxRootFSForkLaunchResponse>>;
+    /**
+     * Binds the original authenticated caller and Idempotency-Key to a first cold launch of the child at generation zero. Supply the original fork operation and the child\'s observed filesystem, head and writer epoch. The child must retain its original birth configuration, or its one externally committed credential-free network isolation preparation; all other fields and automatic-wake disablement must remain unchanged. Memory forks and ordinary resumes are excluded. Retries must keep the same key and conditions; never refresh them after uncertainty. Requires sandbox:write. Admission is durable before node dispatch; manager recovery continues the exact lifecycle after a timeout or lost reply. No guest command or terminal is required. A 503 does not prove that admission failed; use GET with the original key and conditions. Completed history survives later lifecycles. Current only compares the owner/lifecycle snapshot, not runtime health or a lease. Aborted does not prove physical absence. This is not credential admission.
+     * Launch the original never-run RootFS fork
+     */
+    launchSandboxRootFSFork(requestParameters: LaunchSandboxRootFSForkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessSandboxRootFSForkLaunchResponse>;
 }
 //# sourceMappingURL=SandboxRootfsApi.d.ts.map

package/dist/apispec/src/apis/SandboxRootfsApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SandboxRootfsApi.d.ts","sourceRoot":"","sources":["../../../../src/apispec/src/apis/SandboxRootfsApi.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,OAAO,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EACV,kCAAkC,EAElC,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,kCAAkC,EAClC,mCAAmC,EACnC,wCAAwC,EACxC,oCAAoC,EACrC,MAAM,iBAAiB,CAAC;AA0BzB,MAAM,WAAW,kDAAkD;IAC/D,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,+CAA+C;IAC5D,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAC3C;AAED,MAAM,WAAW,sCAAsC;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B,EAAE,0BAA0B,CAAC;CAC1D;AAED,MAAM,WAAW,wCAAwC;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B,EAAE,2BAA2B,CAAC;CAC5D;AAED,MAAM,WAAW,mCAAmC;IAChD,EAAE,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oCAAoC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC,CAAC,EAAE,kCAAkC,CAAC;CAC3E;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,OAAO,CAAC,OAAO;IAEjD;;OAEG;IACG,8CAA8C,CAAC,iBAAiB,EAAE,kDAAkD,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAkC7O;;OAEG;IACG,2CAA2C,CAAC,iBAAiB,EAAE,kDAAkD,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKrN;;OAEG;IACG,2CAA2C,CAAC,iBAAiB,EAAE,+CAA+C,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAkCrP;;OAEG;IACG,wCAAwC,CAAC,iBAAiB,EAAE,+CAA+C,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oCAAoC,CAAC;IAK7N;;;OAGG;IACG,2BAA2B,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;IAyC3M;;;OAGG;IACG,wBAAwB,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAKnL;;;OAGG;IACG,kCAAkC,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;IA4CjO;;;OAGG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,kCAAkC,CAAC;IAKzM;;OAEG;IACG,oCAAoC,CAAC,iBAAiB,EAAE,wCAAwC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IA4CtO;;OAEG;IACG,iCAAiC,CAAC,iBAAiB,EAAE,wCAAwC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,mCAAmC,CAAC;IAK9M;;OAEG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;IAkCjO;;OAEG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,wCAAwC,CAAC;IAKzM;;;OAGG;IACG,gCAAgC,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAqC/N;;;OAGG;IACG,6BAA6B,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oCAAoC,CAAC;CAK1M"}
+{"version":3,"file":"SandboxRootfsApi.d.ts","sourceRoot":"","sources":["../../../../src/apispec/src/apis/SandboxRootfsApi.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,OAAO,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EACV,mCAAmC,EACnC,kCAAkC,EAElC,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,kCAAkC,EAClC,mCAAmC,EACnC,sCAAsC,EACtC,2CAA2C,EAC3C,oCAAoC,EACpC,wCAAwC,EACxC,oCAAoC,EACrC,MAAM,iBAAiB,CAAC;AAoCzB,MAAM,WAAW,kDAAkD;IAC/D,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,+CAA+C;IAC5D,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAC3C;AAED,MAAM,WAAW,sCAAsC;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B,EAAE,0BAA0B,CAAC;CAC1D;AAED,MAAM,WAAW,wCAAwC;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B,EAAE,2BAA2B,CAAC;CAC5D;AAED,MAAM,WAAW,mCAAmC;IAChD,EAAE,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oCAAoC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC,CAAC,EAAE,kCAAkC,CAAC;CAC3E;AAED,MAAM,WAAW,4CAA4C;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,mCAAmC,EAAE,mCAAmC,CAAC;CAC5E;AAED,MAAM,WAAW,uCAAuC;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,iCAAiC;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC5C,EAAE,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,8BAA8B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,8BAA8B,EAAE,8BAA8B,CAAC;CAClE;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,OAAO,CAAC,OAAO;IAEjD;;OAEG;IACG,8CAA8C,CAAC,iBAAiB,EAAE,kDAAkD,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAkC7O;;OAEG;IACG,2CAA2C,CAAC,iBAAiB,EAAE,kDAAkD,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKrN;;OAEG;IACG,2CAA2C,CAAC,iBAAiB,EAAE,+CAA+C,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAkCrP;;OAEG;IACG,wCAAwC,CAAC,iBAAiB,EAAE,+CAA+C,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oCAAoC,CAAC;IAK7N;;;OAGG;IACG,2BAA2B,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;IAyC3M;;;OAGG;IACG,wBAAwB,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAKnL;;;OAGG;IACG,kCAAkC,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;IA4CjO;;;OAGG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,kCAAkC,CAAC;IAKzM;;OAEG;IACG,oCAAoC,CAAC,iBAAiB,EAAE,wCAAwC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IA4CtO;;OAEG;IACG,iCAAiC,CAAC,iBAAiB,EAAE,wCAAwC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,mCAAmC,CAAC;IAK9M;;OAEG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;IAkCjO;;OAEG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,mCAAmC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,wCAAwC,CAAC;IAKzM;;;OAGG;IACG,gCAAgC,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAqC/N;;;OAGG;IACG,6BAA6B,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oCAAoC,CAAC;IAKvM;;;OAGG;IACG,+BAA+B,CAAC,iBAAiB,EAAE,4CAA4C,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAuDtO;;;OAGG;IACG,4BAA4B,CAAC,iBAAiB,EAAE,4CAA4C,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oCAAoC,CAAC;IAK9M;;;OAGG;IACG,mCAAmC,CAAC,iBAAiB,EAAE,uCAAuC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAwDrO;;;OAGG;IACG,gCAAgC,CAAC,iBAAiB,EAAE,uCAAuC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oCAAoC,CAAC;IAK7M;;;OAGG;IACG,uBAAuB,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC;IAwDpN;;;OAGG;IACG,oBAAoB,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,2CAA2C,CAAC;IAK5L;;;OAGG;IACG,6BAA6B,CAAC,iBAAiB,EAAE,iCAAiC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAyF3N;;;OAGG;IACG,0BAA0B,CAAC,iBAAiB,EAAE,iCAAiC,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sCAAsC,CAAC;IAKnM;;;OAGG;IACG,2BAA2B,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAkCrN;;;OAGG;IACG,wBAAwB,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,oCAAoC,CAAC;IAK7L;;;OAGG;IACG,0BAA0B,CAAC,iBAAiB,EAAE,8BAA8B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAuDrN;;;OAGG;IACG,uBAAuB,CAAC,iBAAiB,EAAE,8BAA8B,EAAE,aAAa,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC,sCAAsC,CAAC;CAKhM"}