sandbox0 0.10.4 → 0.10.6

package/dist/resources/sandboxes.js

@@ -1,3 +1,8 @@
+import { validateMemoryRestorationTarget, validateMemoryRestoration } from "../memory_restoration.js";
+import { validateForkLaunchInput, validateForkLaunchWire, validateForkLaunchReceipt } from "../fork_launch.js";
+import { validateMemoryOperationLookup, validateMemoryOperation } from "../memory_operation.js";
+import { validateCaptureTarget, validateCaptureName, validateCaptureReceipt, validateFinalCapture, decodeFinalCaptureFile } from "../restart_final_capture.js";
+import { validateSandboxHealth, validateSandboxHealthWireTimes } from "../health.js";
 import { ensureData, ensureModel } from "../response.js";
 import { SandboxWaitTimeoutError, SandboxLifecycleFailedError, wrapApiCall } from "../errors.js";
 import { Sandbox as SandboxHandle } from "../sandbox.js";
@@ -122,13 +127,207 @@ export class Sandboxes {
         const response = await wrapApiCall(() => this.client.apispec.sandboxes.apiV1SandboxesIdStatusGet({ id: sandboxId }));
         return ensureData(response, "get sandbox status returned empty response");
     }
+    /** Explicitly restores one snapshot and discards processes. Retain every input after uncertainty. */
+    async restoreSnapshot(sandboxId, options) {
+        if (!Number.isSafeInteger(options.expectedRuntimeGeneration) || options.expectedRuntimeGeneration < 1 || options.expectedRuntimeGeneration >= Number.MAX_SAFE_INTEGER) {
+            throw new Error("expectedRuntimeGeneration must be nonnegative with a safe integer successor");
+        }
+        validateSnapshotRestoreIdentity(options.snapshotId);
+        validateSnapshotRestoreIdentity(options.snapshotGenerationId);
+        if (options.discardProcessState !== true)
+            throw new Error("explicit process-state discard required");
+        validateRestartKey(options.idempotencyKey);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.restoreSandboxSnapshot({
+            id: sandboxId, idempotencyKey: options.idempotencyKey,
+            sandboxSnapshotRestoreRequest: { expectedRuntimeGeneration: options.expectedRuntimeGeneration, snapshotId: options.snapshotId, snapshotGenerationId: options.snapshotGenerationId, discardProcessState: options.discardProcessState },
+        }));
+        const operation = validateSnapshotRestoreReceipt(ensureData(response, "snapshot restore returned empty response"), sandboxId);
+        if (operation.requestKey !== options.idempotencyKey || operation.fromRuntimeGeneration !== options.expectedRuntimeGeneration || operation.snapshotId !== options.snapshotId || operation.snapshotGenerationId !== options.snapshotGenerationId) {
+            throw new Error("snapshot restore receipt does not match request");
+        }
+        return operation;
+    }
+    /** Historical operation status; this does not report current application health. */
+    async getSnapshotRestoreOperation(sandboxId, operationId) {
+        if (!restartOperationIDPattern.test(operationId))
+            throw new Error("invalid snapshot restore operation ID");
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.getSandboxSnapshotRestoreOperation({ id: sandboxId, operationId }));
+        const operation = validateSnapshotRestoreReceipt(ensureData(response, "snapshot restore lookup returned empty response"), sandboxId);
+        if (operation.id !== operationId)
+            throw new Error("snapshot restore receipt does not match operation");
+        return operation;
+    }
+    /** Recovers a lost acknowledgement without submitting or retrying a mutation. */
+    async findSnapshotRestoreOperation(sandboxId, requestKey) {
+        validateRestartKey(requestKey);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.findSandboxSnapshotRestoreOperation({ id: sandboxId, requestKey }));
+        const operation = validateSnapshotRestoreReceipt(ensureData(response, "snapshot restore lookup returned empty response"), sandboxId);
+        if (operation.requestKey !== requestKey)
+            throw new Error("snapshot restore receipt does not match request key");
+        return operation;
+    }
+    /** Explicitly discards process state. Retain both inputs after an uncertain reply. */
+    async restart(sandboxId, options) {
+        if (!Number.isSafeInteger(options.expectedRuntimeGeneration) || options.expectedRuntimeGeneration < 0 || options.expectedRuntimeGeneration >= Number.MAX_SAFE_INTEGER) {
+            throw new Error("expectedRuntimeGeneration must be nonnegative with a safe integer successor");
+        }
+        validateRestartKey(options.idempotencyKey);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.restartSandbox({
+            id: sandboxId, idempotencyKey: options.idempotencyKey,
+            sandboxRestartRequest: { expectedRuntimeGeneration: options.expectedRuntimeGeneration },
+        }));
+        const operation = validateRestartReceipt(ensureData(response, "restart returned empty response"), sandboxId);
+        if (operation.requestKey !== options.idempotencyKey || operation.fromRuntimeGeneration !== options.expectedRuntimeGeneration) {
+            throw new Error("restart receipt does not match request");
+        }
+        return operation;
+    }
+    /** Historical operation status; this does not report current application health. */
+    async getRestartOperation(sandboxId, operationId) {
+        if (!restartOperationIDPattern.test(operationId))
+            throw new Error("invalid restart operation ID");
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.getSandboxRestartOperation({ id: sandboxId, operationId }));
+        const operation = validateRestartReceipt(ensureData(response, "restart lookup returned empty response"), sandboxId);
+        if (operation.id !== operationId)
+            throw new Error("restart receipt does not match operation");
+        return operation;
+    }
+    /** Recovers a lost acknowledgement without submitting or retrying a mutation. */
+    async findRestartOperation(sandboxId, requestKey) {
+        validateRestartKey(requestKey);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.findSandboxRestartOperation({ id: sandboxId, requestKey }));
+        const operation = validateRestartReceipt(ensureData(response, "restart lookup returned empty response"), sandboxId);
+        if (operation.requestKey !== requestKey)
+            throw new Error("restart receipt does not match request key");
+        return operation;
+    }
+    /** Durable stopped-source metadata, independent of guest execution. */
+    async getSnapshotRestoreFinalCapture(sandboxId, operationId) {
+        validateCaptureTarget(sandboxId, operationId);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.getSandboxSnapshotRestoreFinalCapture({ id: sandboxId, operationId }));
+        return validateFinalCapture(ensureData(response, "final capture status missing"), sandboxId, operationId);
+    }
+    /** Only found=false attests absence. Errors never become logout or trigger fallback. */
+    async readSnapshotRestoreFinalCaptureFile(sandboxId, operationId, captureId, namespace, name) {
+        validateCaptureTarget(sandboxId, operationId, captureId);
+        validateCaptureName(namespace);
+        validateCaptureName(name);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.readSandboxSnapshotRestoreFinalCaptureFile({ id: sandboxId, operationId, captureId, namespace, name }));
+        return decodeFinalCaptureFile(ensureData(response, "final capture file response missing"), operationId, captureId);
+    }
+    /** Call only after durable owner commit. Retry the identical receipt after uncertainty. */
+    async acknowledgeSnapshotRestoreFinalCapture(sandboxId, operationId, captureId, receiptId) {
+        validateCaptureTarget(sandboxId, operationId, captureId);
+        validateCaptureReceipt(receiptId);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.acknowledgeSandboxSnapshotRestoreFinalCapture({ id: sandboxId, operationId, sandboxRestartFinalCaptureAcknowledgement: { captureId, receiptId } }));
+        const result = validateFinalCapture(ensureData(response, "final capture acknowledgement missing"), sandboxId, operationId);
+        if (result.captureId !== captureId || result.receiptId !== receiptId || !["acknowledged", "released"].includes(result.state))
+            throw new Error("final capture acknowledgement changed receipt");
+        return result;
+    }
+    /** Independent observations. Guest evidence is advisory; never resumes or restarts. */
+    /** Durable stopped-source metadata, independent of guest execution. */
+    async getRestartFinalCapture(sandboxId, operationId) {
+        validateCaptureTarget(sandboxId, operationId);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.getSandboxRestartFinalCapture({ id: sandboxId, operationId }));
+        return validateFinalCapture(ensureData(response, "final capture status missing"), sandboxId, operationId);
+    }
+    /** Only found=false attests absence. Errors never become logout or trigger fallback. */
+    async readRestartFinalCaptureFile(sandboxId, operationId, captureId, namespace, name) {
+        validateCaptureTarget(sandboxId, operationId, captureId);
+        validateCaptureName(namespace);
+        validateCaptureName(name);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.readSandboxRestartFinalCaptureFile({ id: sandboxId, operationId, captureId, namespace, name }));
+        return decodeFinalCaptureFile(ensureData(response, "final capture file response missing"), operationId, captureId);
+    }
+    /** Call only after durable owner commit. Retry the identical receipt after uncertainty. */
+    async acknowledgeRestartFinalCapture(sandboxId, operationId, captureId, receiptId) {
+        validateCaptureTarget(sandboxId, operationId, captureId);
+        validateCaptureReceipt(receiptId);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.acknowledgeSandboxRestartFinalCapture({ id: sandboxId, operationId, sandboxRestartFinalCaptureAcknowledgement: { captureId, receiptId } }));
+        const result = validateFinalCapture(ensureData(response, "final capture acknowledgement missing"), sandboxId, operationId);
+        if (result.captureId !== captureId || result.receiptId !== receiptId || !["acknowledged", "released"].includes(result.state))
+            throw new Error("final capture acknowledgement changed receipt");
+        return result;
+    }
+    /** Independent observations. Guest evidence is advisory; never resumes or restarts. */
+    async getHealth(sandboxId, options) {
+        if (typeof sandboxId !== "string" || !sandboxId || sandboxId.trim() !== sandboxId)
+            throw new Error("invalid sandbox identity");
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.getSandboxHealthRaw({ id: sandboxId }, options?.signal ? { signal: options.signal } : undefined));
+        // The generated Date decoder normalizes missing/null and numeric dates.
+        // Inspect only their wire representation before the typed conversion.
+        validateSandboxHealthWireTimes(await response.raw.clone().json());
+        const health = ensureData(await response.value(), "health returned empty response");
+        return validateSandboxHealth(health, sandboxId);
+    }
+    /** Committed memory lineage; bind to owned history before adopting a restored session. */
+    async getMemoryRestoration(sandboxId, runtimeGeneration) {
+        validateMemoryRestorationTarget(sandboxId, runtimeGeneration);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.getSandboxMemoryRestorationRaw({ id: sandboxId, runtimeGeneration }));
+        const wire = await response.raw.clone().json();
+        if (typeof wire?.data?.observed_at !== "string" || !/^\d{4}-\d{2}-\d{2}T.*(?:Z|[+-]\d{2}:\d{2})$/.test(wire.data.observed_at))
+            throw new Error("invalid memory restoration observation time");
+        return validateMemoryRestoration(ensureData(await response.value(), "memory restoration returned empty response"), sandboxId, runtimeGeneration);
+    }
+    /** Read the original request without dispatching it. current is a snapshot, never a lease. */
+    async lookupMemoryOperation(sandboxId, options) {
+        validateMemoryOperationLookup(sandboxId, options);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.lookupSandboxMemoryOperationRaw({
+            id: sandboxId, action: options.action, expectedRuntimeGeneration: options.expectedRuntimeGeneration,
+            idempotencyKey: options.idempotencyKey, checkpointId: options.checkpointId,
+        }));
+        // Optional nulls are normalized away by the generated decoder; they are not
+        // valid absent evidence in this contract.
+        const wire = await response.raw.clone().json();
+        if (wire?.data?.reason === null || wire?.data?.result_runtime_generation === null)
+            throw new Error("invalid memory operation observation");
+        return validateMemoryOperation(ensureData(await response.value(), "memory operation lookup returned empty response"), sandboxId, options);
+    }
+    /** External provenance only; never a credential-clean or storage-liveness attestation. */
+    async getRootFSIdentity(sandboxId) {
+        if (typeof sandboxId !== "string" || !sandboxId || sandboxId.trim() !== sandboxId)
+            throw new Error("invalid sandbox identity");
+        const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.getSandboxRootFSIdentity({ id: sandboxId }));
+        const identity = ensureData(response, "RootFS identity returned empty response");
+        if (identity.sandboxId !== sandboxId ||
+            [identity.runtimeGeneration, identity.lifecycleEpoch, identity.writerEpoch, identity.managedFilesSizeBytes].some(value => !Number.isSafeInteger(value) || value < 0) ||
+            [identity.filesystemId, identity.headGenerationId, identity.baseArtifactDigest, identity.sourceOciDigest].some(value => typeof value !== "string" || !value) ||
+            [identity.observedAt, identity.sandboxCreatedAt, identity.filesystemCreatedAt].some(value => !(value instanceof Date) || !Number.isFinite(value.getTime())) ||
+            typeof identity.hasImportedFilesystem !== "boolean" || typeof identity.activeLifecycle !== "boolean" ||
+            !["active", "paused", "terminated"].includes(identity.desiredState))
+            throw new Error("invalid external RootFS identity");
+        for (const digest of [identity.runtimeCompatibilityDigest, identity.retainedRuntimeCompatibilityDigest]) {
+            if (digest !== undefined && (typeof digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(digest) ||
+                identity.desiredState !== "active" || identity.activeLifecycle || identity.runtimeGeneration <= 0))
+                throw new Error("invalid external runtime compatibility");
+        }
+        return identity;
+    }
     async pause(sandboxId, options) {
         const response = await wrapApiCall(() => this.client.apispec.sandboxes.apiV1SandboxesIdPausePost({
             id: sandboxId,
-            sandboxExecutionStateRequest: options === undefined ? undefined : { memory: options.memory ?? false },
+            sandboxPauseRequest: options === undefined ? undefined : { memory: options.memory ?? false },
         }));
         return ensureData(response, "pause sandbox returned empty response");
     }
+    /** Bind memory pause to one source generation. Retry with the same inputs after an uncertain reply. */
+    async pauseMemoryForOperation(sandboxId, options) {
+        if (!Number.isSafeInteger(options.expectedRuntimeGeneration) || options.expectedRuntimeGeneration <= 0 ||
+            typeof options.idempotencyKey !== "string" || !/^[A-Za-z0-9._:-]{1,255}$/.test(options.idempotencyKey)) {
+            throw new Error("invalid conditional memory pause generation or idempotency key");
+        }
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.apiV1SandboxesIdPausePost({
+            id: sandboxId, idempotencyKey: options.idempotencyKey,
+            sandboxPauseRequest: { memory: true, expectedRuntimeGeneration: options.expectedRuntimeGeneration },
+        }));
+        const result = ensureData(response, "conditional memory pause returned empty response");
+        if (result.sandboxId !== sandboxId || result.runtimeGeneration !== options.expectedRuntimeGeneration ||
+            typeof result.operationId !== "string" || !/^idem-[a-f0-9]{64}$/.test(result.operationId) || typeof result.paused !== "boolean") {
+            throw new Error("conditional memory pause response does not match request");
+        }
+        return result;
+    }
     /** Requests a pause and waits for its durable checkpoint to commit. */
     async pauseAndWait(sandboxId, options) {
         throwIfAborted(options?.signal, "sandbox lifecycle wait was aborted");
@@ -147,6 +346,25 @@ export class Sandboxes {
         }));
         return ensureData(response, "resume sandbox returned empty response");
     }
+    /** Restore one retained checkpoint. Retain all inputs after an uncertain reply. */
+    async resumeMemoryForOperation(sandboxId, options) {
+        if (!Number.isSafeInteger(options.expectedRuntimeGeneration) || options.expectedRuntimeGeneration < 0 || options.expectedRuntimeGeneration >= Number.MAX_SAFE_INTEGER ||
+            typeof options.checkpointId !== "string" || !/^[!-~]{1,256}$/.test(options.checkpointId) ||
+            typeof options.idempotencyKey !== "string" || !/^[A-Za-z0-9._:-]{1,255}$/.test(options.idempotencyKey)) {
+            throw new Error("invalid conditional memory resume generation, checkpoint or idempotency key");
+        }
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.apiV1SandboxesIdResumePost({
+            id: sandboxId, idempotencyKey: options.idempotencyKey,
+            sandboxExecutionStateRequest: { memory: true, expectedRuntimeGeneration: options.expectedRuntimeGeneration, checkpointId: options.checkpointId },
+        }));
+        const result = ensureData(response, "conditional memory resume returned empty response");
+        if (result.sandboxId !== sandboxId || result.resumed !== true || result.checkpointId !== options.checkpointId ||
+            result.fromRuntimeGeneration !== options.expectedRuntimeGeneration || result.runtimeGeneration !== options.expectedRuntimeGeneration + 1 ||
+            typeof result.operationId !== "string" || !/^idem-[a-f0-9]{64}$/.test(result.operationId)) {
+            throw new Error("conditional memory resume response does not match request");
+        }
+        return result;
+    }
     /** Requests a resume and waits for the committed running generation. */
     async resumeAndWait(sandboxId, options) {
         throwIfAborted(options?.signal, "sandbox lifecycle wait was aborted");
@@ -178,6 +396,80 @@ export class Sandboxes {
         }));
         return ensureData(response, "create sandbox rootfs snapshot returned empty response");
     }
+    /** One conditional capture. Retry uncertainty with the same key and metadata. */
+    async captureRootFSSnapshot(sandboxId, options) {
+        const { idempotencyKey, ...request } = options;
+        if (!sandboxId || !Number.isSafeInteger(request.expectedRuntimeGeneration) || request.expectedRuntimeGeneration <= 0 ||
+            !/^[A-Za-z0-9._:-]{1,255}$/.test(idempotencyKey))
+            throw new Error("conditional snapshot requires a source, positive safe generation and canonical key");
+        const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.captureSandboxRootFSSnapshot({
+            id: sandboxId, idempotencyKey, captureSandboxRootFSSnapshotRequest: request,
+        }));
+        const snapshot = ensureData(response, "conditional snapshot returned no receipt");
+        if (!snapshot.id || snapshot.sandboxId !== sandboxId || !Number.isFinite(snapshot.createdAt.getTime())) {
+            throw new Error("conditional snapshot returned mismatched identity");
+        }
+        return snapshot;
+    }
+    /** Read only the original capture. Missing/pending results remain errors and never authorize a replacement. */
+    async getCapturedRootFSSnapshot(sandboxId, options) {
+        if (!sandboxId || !Number.isSafeInteger(options.expectedRuntimeGeneration) || options.expectedRuntimeGeneration <= 0 ||
+            !/^[A-Za-z0-9._:-]{1,255}$/.test(options.idempotencyKey))
+            throw new Error("snapshot observation requires a source, positive safe generation and canonical key");
+        const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.getCapturedSandboxRootFSSnapshot({ id: sandboxId, ...options }));
+        const snapshot = ensureData(response, "snapshot observation returned no receipt");
+        if (!snapshot.id || snapshot.sandboxId !== sandboxId || !Number.isFinite(snapshot.createdAt.getTime())) {
+            throw new Error("snapshot observation returned mismatched identity");
+        }
+        return snapshot;
+    }
+    /** Reads original fork provenance without retrying or submitting work. Not a state reservation or credential-safety attestation. */
+    async getRootFSFork(sandboxId, options) {
+        if (!sandboxId || !Number.isSafeInteger(options.expectedRuntimeGeneration) || options.expectedRuntimeGeneration < 0 ||
+            typeof options.idempotencyKey !== "string" || !/^[A-Za-z0-9._:-]{1,255}$/.test(options.idempotencyKey)) {
+            throw new Error("fork observation requires a source, nonnegative safe generation and canonical key");
+        }
+        const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.getSandboxRootFSFork({ id: sandboxId, ...options }));
+        const r = ensureData(response, "fork observation returned no receipt");
+        if (r.sourceSandboxId !== sandboxId || r.sourceRuntimeGeneration !== options.expectedRuntimeGeneration || r.targetSandboxId === sandboxId ||
+            r.targetFilesystemId !== r.targetSandboxId ||
+            [r.operationId, r.targetSandboxId, r.sourceFilesystemId, r.sourceHeadGenerationId, r.targetHeadGenerationId, r.baseArtifactDigest, r.sourceOciDigest].some(v => typeof v !== "string" || !v) ||
+            !Number.isSafeInteger(r.writerEpoch) || r.writerEpoch <= 0 || !Number.isSafeInteger(r.managedFilesSizeBytes) || r.managedFilesSizeBytes < 0 ||
+            typeof r.autoResume !== "boolean" || typeof r.automaticRoutes !== "boolean" ||
+            [r.sandboxCreatedAt, r.filesystemCreatedAt, r.observedAt].some(v => !(v instanceof Date) || !Number.isFinite(v.getTime()))) {
+            throw new Error("fork observation returned mismatched identity");
+        }
+        return r;
+    }
+    /** Exactly one conditional first launch; no waiting, retry or ordinary resume fallback. */
+    async launchRootFSFork(sandboxId, options) {
+        const q = { ...options };
+        validateForkLaunchInput(sandboxId, q);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.launchSandboxRootFSForkRaw({
+            id: sandboxId, idempotencyKey: q.idempotencyKey,
+            sandboxRootFSForkLaunchRequest: { forkOperationId: q.forkOperationId, filesystemId: q.filesystemId, headGenerationId: q.headGenerationId, writerEpoch: q.writerEpoch },
+        }));
+        if (![200, 202].includes(response.raw.status))
+            throw new Error("unexpected fork launch response status");
+        validateForkLaunchWire(await response.raw.clone().json());
+        const r = validateForkLaunchReceipt(ensureData(await response.value(), "fork launch returned no receipt"), sandboxId, q);
+        if (response.raw.status === 202 && r.state !== "pending")
+            throw new Error("accepted fork launch returned terminal evidence");
+        return r;
+    }
+    /** Original-condition lookup, including completed history with current=false. Never submits work. */
+    async getRootFSForkLaunch(sandboxId, options) {
+        const q = { ...options };
+        validateForkLaunchInput(sandboxId, q);
+        const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.getSandboxRootFSForkLaunchRaw({
+            id: sandboxId, idempotencyKey: q.idempotencyKey, forkOperationId: q.forkOperationId,
+            filesystemId: q.filesystemId, headGenerationId: q.headGenerationId, writerEpoch: q.writerEpoch,
+        }));
+        if (response.raw.status !== 200)
+            throw new Error("unexpected fork launch lookup status");
+        validateForkLaunchWire(await response.raw.clone().json());
+        return validateForkLaunchReceipt(ensureData(await response.value(), "fork launch lookup returned no receipt"), sandboxId, q);
+    }
     async listRootFSSnapshots(sandboxId) {
         const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.apiV1SandboxesIdSnapshotsGet({ id: sandboxId }));
         const data = ensureData(response, "list sandbox rootfs snapshots returned empty response");
@@ -210,8 +502,12 @@ export class Sandboxes {
         return ensureData(response, "rebase sandbox rootfs returned empty response");
     }
     async fork(sandboxId, request, options = {}) {
-        if (request?.memory && (!options.idempotencyKey?.trim() || new TextEncoder().encode(options.idempotencyKey).length > 255)) {
-            throw new Error("memory fork requires a stable idempotencyKey of at most 255 bytes");
+        const generation = request?.expectedRuntimeGeneration;
+        if (generation !== undefined && (!Number.isSafeInteger(generation) || generation < 0 || (request?.memory && generation === Number.MAX_SAFE_INTEGER))) {
+            throw new Error("invalid expected runtime generation for fork");
+        }
+        if ((request?.memory || generation !== undefined) && (!options.idempotencyKey?.trim() || new TextEncoder().encode(options.idempotencyKey).length > 255)) {
+            throw new Error("conditional or memory fork requires a stable idempotencyKey of at most 255 bytes");
         }
         const response = await wrapApiCall(() => this.client.apispec.sandboxRootfs.apiV1SandboxesIdForkPost({
             id: sandboxId,
@@ -224,3 +520,40 @@ export class Sandboxes {
         return new SandboxHandle({ id: sandboxId, client: this.client });
     }
 }
+const restartOperationIDPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function validateRestartKey(key) {
+    if (typeof key !== "string" || !/^[A-Za-z0-9._:-]{1,255}$/.test(key))
+        throw new Error("invalid restart request key");
+}
+function validateRestartReceipt(operation, sandboxId) {
+    validateRestartKey(operation.requestKey);
+    if (operation.sandboxId !== sandboxId || !restartOperationIDPattern.test(operation.id) ||
+        !Number.isSafeInteger(operation.fromRuntimeGeneration) || operation.fromRuntimeGeneration < 0 || operation.fromRuntimeGeneration >= Number.MAX_SAFE_INTEGER ||
+        !["pausing", "paused", "resuming", "succeeded", "failed", "superseded"].includes(operation.state)) {
+        throw new Error("invalid restart receipt");
+    }
+    if (operation.state === "succeeded") {
+        if (!Number.isSafeInteger(operation.resultRuntimeGeneration) || operation.resultRuntimeGeneration !== operation.fromRuntimeGeneration + 1) {
+            throw new Error("invalid restart result generation");
+        }
+    }
+    else if (operation.resultRuntimeGeneration !== undefined)
+        throw new Error("uncommitted restart result generation");
+    return operation;
+}
+function validateSnapshotRestoreIdentity(value) {
+    if (typeof value !== "string" || !value || value.trim() !== value || new TextEncoder().encode(value).length > 512 || value.includes("\0"))
+        throw new Error("invalid snapshot identity");
+}
+function validateSnapshotRestoreReceipt(operation, sandboxId) {
+    validateRestartReceipt(operation, sandboxId);
+    validateSnapshotRestoreIdentity(operation.snapshotId);
+    validateSnapshotRestoreIdentity(operation.snapshotGenerationId);
+    if (operation.discardProcessState !== true || operation.fromRuntimeGeneration < 1)
+        throw new Error("invalid snapshot restore receipt");
+    if (operation.restoredRootfsGenerationId !== undefined)
+        validateSnapshotRestoreIdentity(operation.restoredRootfsGenerationId);
+    if (["resuming", "succeeded"].includes(operation.state) && !operation.restoredRootfsGenerationId)
+        throw new Error("restored head receipt missing");
+    return operation;
+}

package/dist/restart_final_capture.d.ts

@@ -0,0 +1,10 @@
+import type { SandboxRestartFinalCapture, SandboxRestartFinalCaptureFile } from "./apispec/src/models/index.js";
+export type RestartFinalCaptureFile = Omit<SandboxRestartFinalCaptureFile, "content"> & {
+    content: Uint8Array;
+};
+export declare function validateCaptureTarget(sandbox: string, operation: string, capture?: string): void;
+export declare function validateCaptureName(name: string): void;
+export declare function validateCaptureReceipt(receipt: string): void;
+export declare function validateFinalCapture(value: SandboxRestartFinalCapture, sandbox: string, operation: string): SandboxRestartFinalCapture;
+export declare function decodeFinalCaptureFile(value: SandboxRestartFinalCaptureFile, operation: string, capture: string): RestartFinalCaptureFile;
+//# sourceMappingURL=restart_final_capture.d.ts.map

package/dist/restart_final_capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restart_final_capture.d.ts","sourceRoot":"","sources":["../src/restart_final_capture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAI7G,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,8BAA8B,EAAE,SAAS,CAAC,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAGhG;AACD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD;AACD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE5D;AACD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,0BAA0B,CAYtI;AACD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,8BAA8B,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAUzI"}

package/dist/restart_final_capture.js

@@ -0,0 +1,52 @@
+const operationPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const capturePattern = /^[a-f0-9]{64}$/;
+export function validateCaptureTarget(sandbox, operation, capture) {
+    if (typeof sandbox !== "string" || !sandbox || sandbox.trim() !== sandbox || sandbox === "." || sandbox === ".." || typeof operation !== "string" || !operationPattern.test(operation) ||
+        (arguments.length >= 3 && (typeof capture !== "string" || !capturePattern.test(capture))))
+        throw new Error("invalid restart final capture identity");
+}
+export function validateCaptureName(name) {
+    if (typeof name !== "string" || !/^[A-Za-z0-9._-]{1,128}$/.test(name) || name === "." || name === ".." || name.startsWith(".s0-write-"))
+        throw new Error("invalid final capture file name or namespace");
+}
+export function validateCaptureReceipt(receipt) {
+    if (typeof receipt !== "string" || !/^[A-Za-z0-9._:-]{1,255}$/.test(receipt))
+        throw new Error("invalid final capture receipt");
+}
+export function validateFinalCapture(value, sandbox, operation) {
+    if (value.sandboxId !== sandbox || value.operationId !== operation || !Number.isSafeInteger(value.fromRuntimeGeneration) || value.fromRuntimeGeneration < 1 ||
+        !["pending", "stopped", "acknowledged", "released"].includes(value.state))
+        throw new Error("invalid final capture status");
+    if (value.state === "pending") {
+        if (value.captureId !== undefined || value.stoppedAt !== undefined || value.receiptId !== undefined)
+            throw new Error("pending final capture has a receipt");
+    }
+    else {
+        if (typeof value.captureId !== "string" || !capturePattern.test(value.captureId) || !(value.stoppedAt instanceof Date) || !Number.isFinite(value.stoppedAt.getTime()))
+            throw new Error("invalid stopped capture identity");
+        if (value.state === "stopped") {
+            if (value.receiptId !== undefined)
+                throw new Error("unacknowledged capture has a receipt");
+        }
+        else
+            validateCaptureReceipt(value.receiptId);
+    }
+    return value;
+}
+export function decodeFinalCaptureFile(value, operation, capture) {
+    if (value.operationId !== operation || value.captureId !== capture || !Number.isSafeInteger(value.runtimeGeneration) || value.runtimeGeneration < 1 ||
+        typeof value.found !== "boolean" || !Number.isSafeInteger(value.sizeBytes) || value.sizeBytes < 1048576 || value.sizeBytes > 67108864 ||
+        typeof value.mutationSequence !== "string" || !/^(0|[1-9][0-9]{0,19})$/.test(value.mutationSequence) || BigInt(value.mutationSequence) > 18446744073709551615n)
+        throw new Error("invalid final capture file authority");
+    try {
+        if (typeof value.content !== "string" || value.content.length > 4 * Math.ceil(4194304 / 3))
+            throw new Error();
+        const binary = atob(value.content);
+        if (binary.length > 4194304 || btoa(binary) !== value.content || (!value.found && binary.length !== 0))
+            throw new Error();
+        return { ...value, content: Uint8Array.from(binary, c => c.charCodeAt(0)) };
+    }
+    catch {
+        throw new Error("invalid final capture file content");
+    }
+}

package/dist/sandbox_managed_files.d.ts

@@ -0,0 +1,34 @@
+import type { ManagedFileReadResponse, ManagedFilesState } from "./apispec/src/models/index.js";
+import type { Client } from "./client.js";
+export interface ManagedFilesOptions {
+    runtimeGeneration: number;
+    /** Omit to use the projection root. */
+    namespace?: string;
+}
+export type ManagedFileRead = Omit<ManagedFileReadResponse, "content"> & {
+    content: Uint8Array;
+};
+/** Fixed-generation access to node-owned files, independent of guest execution.
+ * No automatic resume, generation discovery, fallback or write retry is performed.
+ * Sequences are shared across namespaces and do not track native guest refreshes.
+ */
+export declare class ManagedFiles {
+    private readonly client;
+    private readonly id;
+    private readonly generation;
+    private readonly namespace?;
+    constructor(client: Client, id: string, options: ManagedFilesOptions);
+    private state;
+    /** Describes projection state; does not attest historical RootFS credential safety. */
+    inspect(): Promise<ManagedFilesState>;
+    read(name: string): Promise<ManagedFileRead>;
+    /** On an ambiguous error, inspect/read to reconcile; never blindly fetch a new sequence and repeat. */
+    write(name: string, content: Uint8Array, expectedMutationSequence: string): Promise<ManagedFilesState>;
+    delete(name: string, expectedMutationSequence: string): Promise<ManagedFilesState>;
+}
+declare module "./sandbox.js" {
+    interface Sandbox {
+        managedFiles(options: ManagedFilesOptions): ManagedFiles;
+    }
+}
+//# sourceMappingURL=sandbox_managed_files.d.ts.map

package/dist/sandbox_managed_files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox_managed_files.d.ts","sourceRoot":"","sources":["../src/sandbox_managed_files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAKvC,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AA2BjG;;;GAGG;AACH,qBAAa,YAAY;IAIX,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAU,OAAO,CAAC,QAAQ,CAAC,EAAE;IAHhE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;gBAEP,MAAM,EAAE,MAAM,EAAmB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB;IAOtG,OAAO,CAAC,KAAK;IAMb,uFAAuF;IACjF,OAAO,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAKrC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAUlD,uGAAuG;IACjG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAUtG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CASzF;AAED,OAAO,QAAQ,WAAW,CAAC;IAAE,UAAU,OAAO;QAAG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAAC;KAAE;CAAE"}

package/dist/sandbox_managed_files.js

@@ -0,0 +1,96 @@
+import { wrapApiCall } from "./errors.js";
+import { ensureData } from "./response.js";
+import { Sandbox } from "./sandbox.js";
+function validateName(name) {
+    if (!/^[A-Za-z0-9._-]{1,128}$/.test(name) || name === "." || name === ".." || name.startsWith(".s0-write-")) {
+        throw new Error("invalid managed file name or namespace");
+    }
+}
+function validateSequence(value) {
+    if (typeof value !== "string" || !/^(0|[1-9][0-9]{0,19})$/.test(value) || BigInt(value) > 18446744073709551615n) {
+        throw new Error("invalid managed file mutation sequence");
+    }
+}
+function encode(content) {
+    if (!(content instanceof Uint8Array) || content.byteLength > 4 * 1024 * 1024)
+        throw new Error("invalid managed file content size or type");
+    let binary = "";
+    for (let i = 0; i < content.length; i += 8192)
+        binary += String.fromCharCode(...content.subarray(i, i + 8192));
+    return btoa(binary);
+}
+function decode(content) {
+    try {
+        if (typeof content !== "string" || content.length > 4 * Math.ceil((4 * 1024 * 1024) / 3))
+            throw new Error();
+        const binary = atob(content);
+        if (binary.length > 4 * 1024 * 1024 || btoa(binary) !== content)
+            throw new Error();
+        return Uint8Array.from(binary, c => c.charCodeAt(0));
+    }
+    catch {
+        throw new Error("invalid managed file response content");
+    }
+}
+/** Fixed-generation access to node-owned files, independent of guest execution.
+ * No automatic resume, generation discovery, fallback or write retry is performed.
+ * Sequences are shared across namespaces and do not track native guest refreshes.
+ */
+export class ManagedFiles {
+    client;
+    id;
+    generation;
+    namespace;
+    constructor(client, id, options) {
+        this.client = client;
+        this.id = id;
+        if (!Number.isSafeInteger(options.runtimeGeneration) || options.runtimeGeneration <= 0)
+            throw new Error("invalid managed file runtime generation");
+        if (options.namespace !== undefined)
+            validateName(options.namespace);
+        this.generation = options.runtimeGeneration;
+        this.namespace = options.namespace;
+    }
+    state(value) {
+        if (value.runtimeGeneration !== this.generation)
+            throw new Error("managed file response generation changed");
+        validateSequence(value.mutationSequence);
+        return value;
+    }
+    /** Describes projection state; does not attest historical RootFS credential safety. */
+    async inspect() {
+        const response = await wrapApiCall(() => this.client.apispec.sandboxes.inspectSandboxManagedFiles({ id: this.id, runtimeGeneration: this.generation }));
+        return this.state(ensureData(response, "managed file response missing"));
+    }
+    async read(name) {
+        validateName(name);
+        const params = { id: this.id, runtimeGeneration: this.generation, name };
+        const response = await wrapApiCall(() => this.namespace === undefined
+            ? this.client.apispec.sandboxes.readSandboxManagedFile(params)
+            : this.client.apispec.sandboxes.readSandboxNamespacedManagedFile({ ...params, namespace: this.namespace }));
+        const value = this.state(ensureData(response, "managed file response missing"));
+        return { ...value, content: decode(value.content) };
+    }
+    /** On an ambiguous error, inspect/read to reconcile; never blindly fetch a new sequence and repeat. */
+    async write(name, content, expectedMutationSequence) {
+        validateName(name);
+        validateSequence(expectedMutationSequence);
+        const params = { id: this.id, runtimeGeneration: this.generation, name, managedFileWriteRequest: { content: encode(content), expectedMutationSequence } };
+        const response = await wrapApiCall(() => this.namespace === undefined
+            ? this.client.apispec.sandboxes.writeSandboxManagedFile(params)
+            : this.client.apispec.sandboxes.writeSandboxNamespacedManagedFile({ ...params, namespace: this.namespace }));
+        return this.state(ensureData(response, "managed file response missing"));
+    }
+    async delete(name, expectedMutationSequence) {
+        validateName(name);
+        validateSequence(expectedMutationSequence);
+        const params = { id: this.id, runtimeGeneration: this.generation, name, expectedMutationSequence };
+        const response = await wrapApiCall(() => this.namespace === undefined
+            ? this.client.apispec.sandboxes.deleteSandboxManagedFile(params)
+            : this.client.apispec.sandboxes.deleteSandboxNamespacedManagedFile({ ...params, namespace: this.namespace }));
+        return this.state(ensureData(response, "managed file response missing"));
+    }
+}
+Sandbox.prototype.managedFiles = function (options) {
+    return new ManagedFiles(this.client, this.id, options);
+};

package/dist/sandbox_sessions.d.ts

@@ -5,6 +5,10 @@ declare module "./sandbox.js" {
     interface Sandbox {
         listSessions(): Promise<ExecutionSession[]>;
         createSession(spec: ExecutionSessionSpec, options?: SessionCreateOptions): Promise<ExecutionSession>;
+        /** Read-only original creation receipt; never auto-resumes or creates. */
+        findConditionalSession(creationKey: string, runtimeGeneration: number): Promise<ExecutionSession>;
+        findRestoredConditionalSession(creationKey: string, runtimeGeneration: number, creationRuntimeGeneration: number): Promise<ExecutionSession>;
+        connectRestoredConditionalSession(sessionId: string, creationKey: string, runtimeGeneration: number, creationRuntimeGeneration: number, attemptId: string, options?: SessionWebSocketOptions): Promise<ExecutionSessionConnection>;
         getSession(sessionId: string): Promise<ExecutionSession>;
         updateSession(sessionId: string, spec: ExecutionSessionSpec): Promise<ExecutionSession>;
         deleteSession(sessionId: string): Promise<SuccessDeletedResponse>;
@@ -15,6 +19,7 @@ declare module "./sandbox.js" {
         resizeSessionTerminal(sessionId: string, request: ExecutionSessionTerminalResizeRequest): Promise<SuccessResizedResponse>;
         listSessionEvents(sessionId: string, options?: SessionEventOptions): Promise<ExecutionSessionEventPage>;
         watchSessionEvents(sessionId: string, options?: SessionEventStreamOptions): Promise<SessionEventStream>;
+        connectConditionalSession(sessionId: string, creationKey: string, runtimeGeneration: number, attemptId: string, options?: SessionWebSocketOptions): Promise<ExecutionSessionConnection>;
         connectSession(sessionId: string, options?: SessionWebSocketOptions): Promise<ExecutionSessionConnection>;
     }
 }

package/dist/sandbox_sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox_sessions.d.ts","sourceRoot":"","sources":["../src/sandbox_sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,oBAAoB,EACpB,qCAAqC,EACrC,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,eAAe,EAAyB,MAAM,aAAa,CAAC;AAMrE,OAAO,QAAQ,WAAW,CAAC;IACzB,UAAU,OAAO;QACf,YAAY,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACrG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAClE,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC1G,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC7F,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC/G,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC1H,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACxG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;KAC3G;CACF;AA8LD,qBAAa,2BAA4B,YAAW,kBAAkB;IACpE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,MAAM,CAAC,CAA0C;IACzD,OAAO,CAAC,QAAQ,CAAS;gBAEb,QAAQ,EAAE,QAAQ;IAYvB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,qBAAqB,CAAC;IAgChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAS7B;AAED,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,uBAAuB,CAAC,CAAC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,MAAM,EAAE,eAAe;IAyBnC,IAAI,CAAC,OAAO,EAAE,gCAAgC,GAAG,IAAI;IAI9C,QAAQ,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAa1D,0EAA0E;IAC1E,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"sandbox_sessions.d.ts","sourceRoot":"","sources":["../src/sandbox_sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,oBAAoB,EACpB,qCAAqC,EACrC,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,eAAe,EAAgD,MAAM,aAAa,CAAC;AAM5F,OAAO,QAAQ,WAAW,CAAC;IACzB,UAAU,OAAO;QACf,YAAY,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACrG,0EAA0E;QAC1E,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAClG,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC7I,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACnO,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAClE,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC1G,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC7F,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC/G,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC1H,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACxG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxG,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACxL,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;KAC3G;CACF;AAoSD,qBAAa,2BAA4B,YAAW,kBAAkB;IACpE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,MAAM,CAAC,CAA0C;IACzD,OAAO,CAAC,QAAQ,CAAS;gBAEb,QAAQ,EAAE,QAAQ;IAYvB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,qBAAqB,CAAC;IAgChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAS7B;AAED,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,uBAAuB,CAAC,CAAC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,MAAM,EAAE,eAAe;IAyBnC,IAAI,CAAC,OAAO,EAAE,gCAAgC,GAAG,IAAI;IAI9C,QAAQ,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAa1D,0EAA0E;IAC1E,KAAK,IAAI,IAAI;CAGd"}