zeitlich 0.2.24 → 0.2.25

package/dist/adapters/sandbox/bedrock/index.cjs

@@ -55,8 +55,31 @@ var BedrockSandboxFileSystem = class {
     this.workspaceBase = path.posix.resolve("/", workspaceBase);
   }
   workspaceBase;
+  /**
+   * Resolve a caller-supplied path to an absolute path within the workspace.
+   * Used for shell commands that need full paths.
+   */
   normalisePath(path$1) {
-    return path.posix.resolve(this.workspaceBase, path$1);
+    if (path.posix.isAbsolute(path$1) && !path$1.startsWith(this.workspaceBase + "/") && path$1 !== this.workspaceBase) {
+      path$1 = path$1.replace(/^\/+/, "");
+    }
+    const resolved = path.posix.resolve(this.workspaceBase, path$1);
+    if (!resolved.startsWith(this.workspaceBase + "/") && resolved !== this.workspaceBase) {
+      throw new Error(
+        `Invalid file path: "${resolved}" escapes workspace "${this.workspaceBase}"`
+      );
+    }
+    return resolved;
+  }
+  /**
+   * Return a workspace-relative path for Bedrock tool invocations
+   * (`writeFiles`, `readFiles`, `listFiles`, `removeFiles`), which
+   * reject absolute paths as "path traversal".
+   */
+  toToolPath(path) {
+    const abs = this.normalisePath(path);
+    const prefix = this.workspaceBase + "/";
+    return abs.startsWith(prefix) ? abs.slice(prefix.length) : abs;
   }
   async invoke(name, args) {
     const resp = await this.client.send(
@@ -81,9 +104,9 @@ var BedrockSandboxFileSystem = class {
     };
   }
   async readFile(path) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const result = await this.invoke("readFiles", {
-      paths: [norm]
+      paths: [rel]
     });
     for (const block of result.content ?? []) {
       if (block.resource?.text != null) return block.resource.text;
@@ -92,9 +115,9 @@ var BedrockSandboxFileSystem = class {
     return "";
   }
   async readFileBuffer(path) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const result = await this.invoke("readFiles", {
-      paths: [norm]
+      paths: [rel]
     });
     for (const block of result.content ?? []) {
       if (block.resource?.blob) return block.resource.blob;
@@ -106,12 +129,12 @@ var BedrockSandboxFileSystem = class {
     return new Uint8Array(0);
   }
   async writeFile(path, content) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const isText = typeof content === "string";
     const result = await this.invoke("writeFiles", {
       content: [
         {
-          path: norm,
+          path: rel,
           ...isText ? { text: content } : { blob: content }
         }
       ]
@@ -164,15 +187,16 @@ var BedrockSandboxFileSystem = class {
     if (exitCode !== 0) throw new Error(`mkdir failed: ${stderr}`);
   }
   async readdir(path) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const result = await this.invoke("listFiles", {
-      directoryPath: norm
+      directoryPath: rel
     });
     const names = [];
     for (const block of result.content ?? []) {
       if (block.name) names.push(block.name);
     }
     if (names.length > 0) return names;
+    const norm = this.normalisePath(path);
     const { stdout, exitCode, stderr } = await this.execShell(
       `ls -1A "${norm}"`
     );
@@ -208,8 +232,9 @@ var BedrockSandboxFileSystem = class {
         throw new Error(`rm failed: ${stderr}`);
       return;
     }
+    const rel = this.toToolPath(path);
     const result = await this.invoke("removeFiles", {
-      paths: [norm]
+      paths: [rel]
     });
     if (result.isError) {
       const msg = result.content?.map((b) => b.text).join("") ?? "rm failed";

package/dist/adapters/sandbox/bedrock/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/sandbox/types.ts","../../../../src/adapters/sandbox/bedrock/filesystem.ts","../../../../src/adapters/sandbox/bedrock/index.ts"],"names":["ApplicationFailure","posix","path","InvokeCodeInterpreterCommand","exports","StopCodeInterpreterSessionCommand","BedrockAgentCoreClient","StartCodeInterpreterSessionCommand","GetCodeInterpreterSessionCommand"],"mappings":";;;;;;;AAkLO,IAAM,wBAAA,GAAN,cAAuCA,yBAAA,CAAmB;AAAA,EAC/D,YAAY,SAAA,EAAmB;AAC7B,IAAA,KAAA;AAAA,MACE,6BAA6B,SAAS,CAAA,CAAA;AAAA,MACtC,0BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF,CAAA;AAEO,IAAM,oBAAA,GAAN,cAAmCA,yBAAA,CAAmB;AAAA,EAC3D,YAAY,SAAA,EAAmB;AAC7B,IAAA,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAS,CAAA,CAAA,EAAI,sBAAA,EAAwB,IAAI,CAAA;AAAA,EACvE;AACF,CAAA;AChLA,eAAe,cACb,MAAA,EACgC;AAChC,EAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,IAAA,IAAI,QAAA,IAAY,KAAA,IAAS,KAAA,CAAM,MAAA,SAAe,KAAA,CAAM,MAAA;AACpD,IAAA,IAAI,uBAAA,IAA2B,SAAS,KAAA,CAAM,qBAAA;AAC5C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,qBAAA,CAAsB,WAAW,eAAe,CAAA;AACxE,IAAA,IAAI,2BAAA,IAA+B,SAAS,KAAA,CAAM,yBAAA;AAChD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,0BAA0B,OAAA,IAAW;AAAA,OAC7C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,oBAAoB,OAAA,IAAW;AAAA,OACvC;AACF,IAAA,IAAI,yBAAA,IAA6B,SAAS,KAAA,CAAM,uBAAA;AAC9C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,wBAAwB,OAAA,IAAW;AAAA,OAC3C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,mBAAA,CAAoB,WAAW,WAAW,CAAA;AAClE,IAAA,IACE,+BAAA,IAAmC,SACnC,KAAA,CAAM,6BAAA;AAEN,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,8BAA8B,OAAA,IAAW;AAAA,OACjD;AACF,IAAA,IAAI,mBAAA,IAAuB,SAAS,KAAA,CAAM,iBAAA;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,iBAAA,CAAkB,WAAW,UAAU,CAAA;AAAA,EACjE;AACA,EAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AACnE;AASO,IAAM,2BAAN,MAA4D;AAAA,EAGjE,WAAA,CACU,MAAA,EACA,yBAAA,EACA,SAAA,EACR,gBAAgB,YAAA,EAChB;AAJQ,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,yBAAA,GAAA,yBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAGR,IAAA,IAAA,CAAK,aAAA,GAAgBC,UAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,aAAa,CAAA;AAAA,EACvD;AAAA,EATS,aAAA;AAAA,EAWD,cAAcC,MAAA,EAAsB;AAC1C,IAAA,OAAOD,UAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,aAAA,EAAeC,MAAI,CAAA;AAAA,EAC/C;AAAA,EAEA,MAAc,MAAA,CACZ,IAAA,EACA,IAAA,EACgC;AAChC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MAC7B,IAAIC,mDAAA,CAA6B;AAAA,QAC/B,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,IAAA;AAAA,QACA,SAAA,EAAW;AAAA,OACZ;AAAA,KACH;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAC1E,IAAA,OAAO,aAAA,CAAc,KAAK,MAAM,CAAA;AAAA,EAClC;AAAA,EAEA,MAAc,UAAU,OAAA,EAIrB;AACD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,gBAAA,EAAkC;AAAA,MACjE;AAAA,KACD,CAAA;AACD,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,MAAA,CAAO,iBAAA,EAAmB,MAAA,IAAU,EAAA;AAAA,MAC5C,MAAA,EAAQ,MAAA,CAAO,iBAAA,EAAmB,MAAA,IAAU,EAAA;AAAA,MAC5C,QAAA,EAAU,MAAA,CAAO,iBAAA,EAAmB,QAAA,IAAY;AAAA,KAClD;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,IAAA,EAA+B;AAC5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,EAA6B;AAAA,MAC5D,KAAA,EAAO,CAAC,IAAI;AAAA,KACb,CAAA;AAED,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IAAI,MAAM,QAAA,EAAU,IAAA,IAAQ,IAAA,EAAM,OAAO,MAAM,QAAA,CAAS,IAAA;AACxD,MAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,IAAA,EAAM,OAAO,KAAA,CAAM,IAAA;AAAA,IACvC;AACA,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEA,MAAM,eAAe,IAAA,EAAmC;AACtD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,EAA6B;AAAA,MAC5D,KAAA,EAAO,CAAC,IAAI;AAAA,KACb,CAAA;AAED,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IAAI,KAAA,CAAM,QAAA,EAAU,IAAA,EAAM,OAAO,MAAM,QAAA,CAAS,IAAA;AAChD,MAAA,IAAI,KAAA,CAAM,IAAA,EAAM,OAAO,KAAA,CAAM,IAAA;AAC7B,MAAA,IAAI,KAAA,CAAM,UAAU,IAAA,IAAQ,IAAA;AAC1B,QAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,SAAS,IAAI,CAAA;AACrD,MAAA,IAAI,KAAA,CAAM,QAAQ,IAAA,EAAM,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAI,WAAW,CAAC,CAAA;AAAA,EACzB;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,OAAA,EAA6C;AACzE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,OAAO,OAAA,KAAY,QAAA;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,YAAA,EAA8B;AAAA,MAC7D,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,IAAA;AAAA,UACN,GAAI,SACA,EAAE,IAAA,EAAM,SAAkB,GAC1B,EAAE,MAAM,OAAA;AAAsB;AACpC;AACF,KACD,CAAA;AACD,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,MAAM,GAAA,GACJ,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,IAAK,kBAAA;AACjD,MAAA,MAAM,IAAI,MAAM,GAAG,CAAA;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,UAAA,CAAW,IAAA,EAAc,OAAA,EAA6C;AAC1E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,QAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,UACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AACtC,IAAA,MAAM,OAAA,GAAU,QAAA,CAAS,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAC9C,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,aAAA,EAAgB,OAAO,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA;AAAA,KACtC;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAAA,EACpE;AAAA,EAEA,MAAM,OAAO,IAAA,EAAgC;AAC3C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,UAAS,GAAI,MAAM,KAAK,SAAA,CAAU,CAAA,SAAA,EAAY,IAAI,CAAA,CAAA,CAAG,CAAA;AAC7D,IAAA,OAAO,QAAA,KAAa,CAAA;AAAA,EACtB;AAAA,EAEA,MAAM,KAAK,IAAA,EAAiC;AAC1C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,uBAAuB,IAAI,CAAA,MAAA;AAAA,KAC7B;AACA,IAAA,IAAI,QAAA,KAAa,GAAG,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAEtE,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,EAAK,CAAE,MAAM,GAAG,CAAA;AACrC,IAAA,MAAM,WAAW,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,IAAK,GAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,IAAK,GAAA;AAC5C,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA;AACjC,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,QAAA,EAAU,EAAE,CAAA;AAExC,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,QAAA,KAAa,cAAA,IAAkB,QAAA,KAAa,oBAAA;AAAA,MACpD,aAAa,QAAA,KAAa,WAAA;AAAA,MAC1B,gBAAgB,QAAA,KAAa,eAAA;AAAA,MAC7B,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA,GAAI,CAAA,GAAI,IAAA;AAAA,MACxB,KAAA,EAAO,IAAI,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA,GAAI,CAAA,GAAI,aAAa,GAAI;AAAA,KAC3D;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAM,IAAA,EAAc,OAAA,EAAkD;AAC1E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,IAAA,GAAO,OAAA,EAAS,SAAA,GAAY,KAAA,GAAQ,EAAA;AAC1C,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAAA,KACvB;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAM,QAAQ,IAAA,EAAiC;AAC7C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,EAA6B;AAAA,MAC5D,aAAA,EAAe;AAAA,KAChB,CAAA;AAED,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IAAI,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACvC;AAEA,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,OAAO,KAAA;AAE7B,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,WAAW,IAAI,CAAA,CAAA;AAAA,KACjB;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AAC/D,IAAA,OAAO,MAAA,CACJ,IAAA,EAAK,CACL,KAAA,CAAM,IAAI,CAAA,CACV,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,qBAAqB,IAAA,EAAsC;AAC/D,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,SAAS,IAAI,CAAA,4CAAA;AAAA,KACf;AACA,IAAA,IAAI,QAAA,KAAa,CAAA;AACf,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,MAAM,CAAA,CAAE,CAAA;AAE1D,IAAA,OAAO,MAAA,CACJ,IAAA,EAAK,CACL,KAAA,CAAM,IAAI,CAAA,CACV,MAAA,CAAO,CAAC,CAAA,KAAM,EAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,IAAA,KAAS;AACb,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA;AAC1B,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AACzB,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,QAAQ,IAAA,KAAS,GAAA;AAAA,QACjB,aAAa,IAAA,KAAS,GAAA;AAAA,QACtB,gBAAgB,IAAA,KAAS;AAAA,OAC3B;AAAA,IACF,CAAC,CAAA;AAAA,EACL;AAAA,EAEA,MAAM,EAAA,CACJ,IAAA,EACA,OAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,IAAI,OAAA,EAAS,SAAA,IAAa,OAAA,EAAS,KAAA,EAAO;AACxC,MAAA,MAAM,KAAA,GAAQ,CAAA,EAAG,OAAA,EAAS,SAAA,GAAY,IAAA,GAAO,EAAE,CAAA,CAAA,EAAI,OAAA,EAAS,KAAA,GAAQ,IAAA,GAAO,EAAE,CAAA,CAAA,CAAG,IAAA,EAAK;AACrF,MAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,QACtC,CAAA,GAAA,EAAM,KAAK,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA;AAAA,OACtB;AACA,MAAA,IAAI,QAAA,KAAa,CAAA,IAAK,CAAC,OAAA,EAAS,KAAA;AAC9B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,MAAM,CAAA,CAAE,CAAA;AACxC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,aAAA,EAA+B;AAAA,MAC9D,KAAA,EAAO,CAAC,IAAI;AAAA,KACb,CAAA;AACD,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,MAAM,GAAA,GACJ,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,IAAK,WAAA;AACjD,MAAA,MAAM,IAAI,MAAM,GAAG,CAAA;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,EAAA,CACJ,GAAA,EACA,IAAA,EACA,OAAA,EACe;AACf,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AACtC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,OAAA,EAAS,SAAA,GAAY,KAAA,GAAQ,EAAA;AAC1C,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA,EAAI,OAAO,MAAM,QAAQ,CAAA,CAAA;AAAA,KACrC;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,MAAM,CAAA,CAAE,CAAA;AAAA,EAC5D;AAAA,EAEA,MAAM,EAAA,CAAG,GAAA,EAAa,IAAA,EAA6B;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AACtC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACxC,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,IAAA,EAAO,OAAO,CAAA,GAAA,EAAM,QAAQ,CAAA,CAAA;AAAA,KAC9B;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,MAAM,CAAA,CAAE,CAAA;AAAA,EAC5D;AAAA,EAEA,MAAM,SAAS,IAAA,EAA+B;AAC5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,aAAa,IAAI,CAAA,CAAA;AAAA,KACnB;AACA,IAAA,IAAI,QAAA,KAAa,CAAA;AACf,MAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,UAAA,EAAa,MAAM,CAAA,CAAE,CAAA;AAC1D,IAAA,OAAO,OAAO,IAAA,EAAK;AAAA,EACrB;AAAA,EAEA,WAAA,CAAY,MAAcD,MAAA,EAAsB;AAC9C,IAAA,OAAOD,WAAM,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,IAAI,GAAGC,MAAI,CAAA;AAAA,EACrD;AACF;;;ACxRA,eAAe,kBACb,MAAA,EACqB;AACrB,EAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,IAAA,IAAI,QAAA,IAAY,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ;AACrC,MAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,iBAAA;AACxB,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,IAAI,QAAA,IAAY,CAAA;AAAA,QAC1B,MAAA,EAAQ,IAAI,MAAA,IAAU,EAAA;AAAA,QACtB,MAAA,EAAQ,IAAI,MAAA,IAAU;AAAA,OACxB;AAAA,IACF;AACA,IAAA,IAAI,uBAAA,IAA2B,SAAS,KAAA,CAAM,qBAAA;AAC5C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,qBAAA,CAAsB,WAAW,eAAe,CAAA;AACxE,IAAA,IAAI,2BAAA,IAA+B,SAAS,KAAA,CAAM,yBAAA;AAChD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,0BAA0B,OAAA,IAAW;AAAA,OAC7C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,oBAAoB,OAAA,IAAW;AAAA,OACvC;AACF,IAAA,IAAI,yBAAA,IAA6B,SAAS,KAAA,CAAM,uBAAA;AAC9C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,wBAAwB,OAAA,IAAW;AAAA,OAC3C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,mBAAA,CAAoB,WAAW,WAAW,CAAA;AAClE,IAAA,IACE,+BAAA,IAAmC,SACnC,KAAA,CAAM,6BAAA;AAEN,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,8BAA8B,OAAA,IAAW;AAAA,OACjD;AACF,IAAA,IAAI,mBAAA,IAAuB,SAAS,KAAA,CAAM,iBAAA;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,iBAAA,CAAkB,WAAW,UAAU,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,CAAA,EAAG,MAAA,EAAQ,EAAA,EAAI,QAAQ,EAAA,EAAG;AAC/C;AAMA,IAAM,qBAAN,MAA4C;AAAA,EAS1C,YACW,EAAA,EACD,MAAA,EACA,yBAAA,EACA,SAAA,EACR,gBAAgB,YAAA,EAChB;AALS,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACD,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,yBAAA,GAAA,yBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAGR,IAAA,IAAA,CAAK,KAAK,IAAI,wBAAA;AAAA,MACZ,MAAA;AAAA,MACA,yBAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EArBS,YAAA,GAAoC;AAAA,IAC3C,UAAA,EAAY,IAAA;AAAA,IACZ,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa;AAAA,GACf;AAAA,EAES,EAAA;AAAA,EAiBT,MAAM,IAAA,CAAK,OAAA,EAAiB,OAAA,EAA4C;AACtE,IAAA,IAAI,GAAA,GAAM,OAAA;AACV,IAAA,IAAI,SAAS,GAAA,EAAK,GAAA,GAAM,OAAO,OAAA,CAAQ,GAAG,QAAQ,GAAG,CAAA,CAAA;AACrD,IAAA,IAAI,SAAS,GAAA,EAAK;AAChB,MAAA,MAAME,SAAA,GAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,OAAA,EAAU,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA,CACzD,IAAA,CAAK,MAAM,CAAA;AACd,MAAA,GAAA,GAAM,CAAA,EAAGA,SAAO,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA;AAAA,IAC5B;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MAC7B,IAAID,mDAAAA,CAA6B;AAAA,QAC/B,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,IAAA,EAAM,gBAAA;AAAA,QACN,SAAA,EAAW,EAAE,OAAA,EAAS,GAAA;AAAI,OAC3B;AAAA,KACH;AAEA,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA;AACR,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAC1D,IAAA,OAAO,iBAAA,CAAkB,KAAK,MAAM,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,IAAIE,wDAAA,CAAkC;AAAA,QACpC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,WAAW,IAAA,CAAK;AAAA,OACjB;AAAA,KACH;AAAA,EACF;AACF,CAAA;AAMO,IAAM,yBAAN,MAEP;AAAA,EACW,EAAA,GAAK,SAAA;AAAA,EACL,YAAA,GAAoC;AAAA,IAC3C,UAAA,EAAY,IAAA;AAAA,IACZ,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa;AAAA,GACf;AAAA,EAEQ,MAAA;AAAA,EACS,yBAAA;AAAA,EACA,oBAAA;AAAA,EAEjB,YAAY,MAAA,EAA8B;AACxC,IAAA,IAAA,CAAK,SAAS,IAAIC,6CAAA,CAAuB,MAAA,CAAO,YAAA,IAAgB,EAAE,CAAA;AAClE,IAAA,IAAA,CAAK,4BAA4B,MAAA,CAAO,yBAAA;AACxC,IAAA,IAAA,CAAK,oBAAA,GAAuB,OAAO,aAAA,IAAiB,YAAA;AAAA,EACtD;AAAA,EAEA,MAAM,OACJ,OAAA,EAC8B;AAC9B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MAC7B,IAAIC,yDAAA,CAAmC;AAAA,QACrC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,MAAM,OAAA,EAAS,IAAA;AAAA,QACf,uBAAuB,OAAA,EAAS;AAAA,OACjC;AAAA,KACH;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,EAAA;AACpC,IAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACpE,IAAA,MAAM,UAAU,IAAI,kBAAA;AAAA,MAClB,SAAA;AAAA,MACA,IAAA,CAAK,MAAA;AAAA,MACL,IAAA,CAAK,yBAAA;AAAA,MACL,SAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,IAAI,SAAS,YAAA,EAAc;AACzB,MAAA,KAAA,MAAW,CAAC,MAAM,OAAO,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,YAAY,CAAA,EAAG;AAClE,QAAA,MAAM,OAAA,CAAQ,EAAA,CAAG,SAAA,CAAU,IAAA,EAAM,OAAO,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,IAAI,SAAS,GAAA,EAAK;AAChB,MAAA,MAAMH,SAAA,GAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA,CAClD,IAAA,CAAK,GAAG,CAAA;AACX,MAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAA,MAAA,EAASA,SAAO,CAAA,cAAA,CAAgB,CAAA;AAAA,IACrD;AAEA,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB;AAAA,EAEA,MAAM,IAAI,SAAA,EAA4C;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,QAC7B,IAAII,uDAAA,CAAiC;AAAA,UACnC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,UAChC,SAAA,EAAW;AAAA,SACZ;AAAA,OACH;AAEA,MAAA,IAAI,IAAA,CAAK,WAAW,YAAA,EAAc;AAChC,QAAA,MAAM,IAAI,qBAAqB,SAAS,CAAA;AAAA,MAC1C;AAEA,MAAA,OAAO,IAAI,kBAAA;AAAA,QACT,SAAA;AAAA,QACA,IAAA,CAAK,MAAA;AAAA,QACL,IAAA,CAAK,yBAAA;AAAA,QACL,SAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,sBAAsB,MAAM,GAAA;AAC/C,MAAA,MAAM,IAAI,qBAAqB,SAAS,CAAA;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,SAAA,EAAkC;AAC9C,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,QAChB,IAAIH,wDAAA,CAAkC;AAAA,UACpC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,UAChC,SAAA,EAAW;AAAA,SACZ;AAAA,OACH;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAM,UAAA,EAAoB,WAAA,EAAqC;AACnE,IAAA,MAAM,IAAI,yBAAyB,OAAO,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,SAAS,UAAA,EAA8C;AAC3D,IAAA,MAAM,IAAI,yBAAyB,UAAU,CAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,QAAQ,SAAA,EAA4C;AACxD,IAAA,MAAM,IAAI,yBAAyB,SAAS,CAAA;AAAA,EAC9C;AAAA,EAEA,MAAM,KAAK,UAAA,EAAsC;AAC/C,IAAA,MAAM,IAAI,yBAAyB,MAAM,CAAA;AAAA,EAC3C;AACF","file":"index.cjs","sourcesContent":["// ============================================================================\n// Sandbox Filesystem\n// ============================================================================\n\nexport interface DirentEntry {\n  name: string;\n  isFile: boolean;\n  isDirectory: boolean;\n  isSymbolicLink: boolean;\n}\n\nexport interface FileStat {\n  isFile: boolean;\n  isDirectory: boolean;\n  isSymbolicLink: boolean;\n  size: number;\n  mtime: Date;\n}\n\n/**\n * Provider-agnostic filesystem interface.\n *\n * Implementations that don't support a method should throw\n * {@link SandboxNotSupportedError}.\n */\nexport interface SandboxFileSystem {\n  /** Base directory used when resolving relative paths. */\n  readonly workspaceBase: string;\n  readFile(path: string): Promise<string>;\n  readFileBuffer(path: string): Promise<Uint8Array>;\n  writeFile(path: string, content: string | Uint8Array): Promise<void>;\n  appendFile(path: string, content: string | Uint8Array): Promise<void>;\n  exists(path: string): Promise<boolean>;\n  stat(path: string): Promise<FileStat>;\n  mkdir(path: string, options?: { recursive?: boolean }): Promise<void>;\n  readdir(path: string): Promise<string[]>;\n  readdirWithFileTypes(path: string): Promise<DirentEntry[]>;\n  rm(\n    path: string,\n    options?: { recursive?: boolean; force?: boolean }\n  ): Promise<void>;\n  cp(\n    src: string,\n    dest: string,\n    options?: { recursive?: boolean }\n  ): Promise<void>;\n  mv(src: string, dest: string): Promise<void>;\n  readlink(path: string): Promise<string>;\n  resolvePath(base: string, path: string): string;\n}\n\n// ============================================================================\n// Execution\n// ============================================================================\n\nexport interface ExecOptions {\n  timeout?: number;\n  cwd?: string;\n  env?: Record<string, string>;\n}\n\nexport interface ExecResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\n// ============================================================================\n// Capabilities\n// ============================================================================\n\nexport interface SandboxCapabilities {\n  /** Sandbox supports filesystem operations */\n  filesystem: boolean;\n  /** Sandbox supports shell/command execution */\n  execution: boolean;\n  /** Sandbox state can be persisted and restored */\n  persistence: boolean;\n}\n\n// ============================================================================\n// Sandbox\n// ============================================================================\n\nexport interface Sandbox {\n  readonly id: string;\n  readonly capabilities: SandboxCapabilities;\n  readonly fs: SandboxFileSystem;\n\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n  destroy(): Promise<void>;\n}\n\n// ============================================================================\n// Snapshots\n// ============================================================================\n\nexport interface SandboxSnapshot {\n  sandboxId: string;\n  providerId: string;\n  /** Provider-specific serialised state */\n  data: unknown;\n  createdAt: string;\n}\n\n// ============================================================================\n// Provider\n// ============================================================================\n\nexport interface SandboxCreateOptions {\n  /** Preferred sandbox ID (provider may ignore) */\n  id?: string;\n  /** Seed the filesystem with these files */\n  initialFiles?: Record<string, string | Uint8Array>;\n  /** Environment variables available inside the sandbox */\n  env?: Record<string, string>;\n}\n\nexport interface SandboxCreateResult {\n  sandbox: Sandbox;\n  /** Optional state to merge into the workflow's `AgentState` via the session. */\n  stateUpdate?: Record<string, unknown>;\n}\n\nexport interface SandboxProvider<\n  TOptions extends SandboxCreateOptions = SandboxCreateOptions,\n  TSandbox extends Sandbox = Sandbox,\n> {\n  readonly id: string;\n  readonly capabilities: SandboxCapabilities;\n\n  create(options?: TOptions): Promise<SandboxCreateResult>;\n  get(sandboxId: string): Promise<TSandbox>;\n  destroy(sandboxId: string): Promise<void>;\n  pause(sandboxId: string, ttlSeconds?: number): Promise<void>;\n  snapshot(sandboxId: string): Promise<SandboxSnapshot>;\n  restore(snapshot: SandboxSnapshot): Promise<Sandbox>;\n  fork(sandboxId: string): Promise<Sandbox>;\n}\n\n// ============================================================================\n// SandboxOps — workflow-side activity interface (like ThreadOps)\n// ============================================================================\n\nexport interface SandboxOps<\n  TOptions extends SandboxCreateOptions = SandboxCreateOptions,\n> {\n  createSandbox(\n    options?: TOptions\n  ): Promise<{ sandboxId: string; stateUpdate?: Record<string, unknown> }>;\n  destroySandbox(sandboxId: string): Promise<void>;\n  pauseSandbox(sandboxId: string): Promise<void>;\n  snapshotSandbox(sandboxId: string): Promise<SandboxSnapshot>;\n  forkSandbox(sandboxId: string): Promise<string>;\n}\n\n/**\n * Maps generic {@link SandboxOps} method names to adapter-prefixed names.\n *\n * @example\n * ```typescript\n * type InMemOps = PrefixedSandboxOps<\"inMemory\">;\n * // → { inMemoryCreateSandbox, inMemoryDestroySandbox, inMemorySnapshotSandbox }\n * ```\n */\nexport type PrefixedSandboxOps<\n  TPrefix extends string,\n  TOptions extends SandboxCreateOptions = SandboxCreateOptions,\n> = {\n  [K in keyof SandboxOps<TOptions> as `${TPrefix}${Capitalize<K & string>}`]: SandboxOps<TOptions>[K];\n};\n\n// ============================================================================\n// Errors\n// ============================================================================\n\nimport { ApplicationFailure } from \"@temporalio/common\";\n\nexport class SandboxNotSupportedError extends ApplicationFailure {\n  constructor(operation: string) {\n    super(\n      `Sandbox does not support: ${operation}`,\n      \"SandboxNotSupportedError\",\n      true\n    );\n  }\n}\n\nexport class SandboxNotFoundError extends ApplicationFailure {\n  constructor(sandboxId: string) {\n    super(`Sandbox not found: ${sandboxId}`, \"SandboxNotFoundError\", true);\n  }\n}\n","import type {\n  BedrockAgentCoreClient,\n  CodeInterpreterStreamOutput,\n  CodeInterpreterResult,\n  ToolName as ToolNameType,\n  ToolArguments,\n} from \"@aws-sdk/client-bedrock-agentcore\";\nimport { InvokeCodeInterpreterCommand } from \"@aws-sdk/client-bedrock-agentcore\";\nimport type {\n  SandboxFileSystem,\n  DirentEntry,\n  FileStat,\n} from \"../../../lib/sandbox/types\";\nimport { SandboxNotSupportedError } from \"../../../lib/sandbox/types\";\nimport { posix } from \"node:path\";\n\nasync function consumeStream(\n  stream: AsyncIterable<CodeInterpreterStreamOutput>\n): Promise<CodeInterpreterResult> {\n  for await (const event of stream) {\n    if (\"result\" in event && event.result) return event.result;\n    if (\"accessDeniedException\" in event && event.accessDeniedException)\n      throw new Error(event.accessDeniedException.message ?? \"Access denied\");\n    if (\"resourceNotFoundException\" in event && event.resourceNotFoundException)\n      throw new Error(\n        event.resourceNotFoundException.message ?? \"Resource not found\"\n      );\n    if (\"validationException\" in event && event.validationException)\n      throw new Error(\n        event.validationException.message ?? \"Validation error\"\n      );\n    if (\"internalServerException\" in event && event.internalServerException)\n      throw new Error(\n        event.internalServerException.message ?? \"Internal server error\"\n      );\n    if (\"throttlingException\" in event && event.throttlingException)\n      throw new Error(event.throttlingException.message ?? \"Throttled\");\n    if (\n      \"serviceQuotaExceededException\" in event &&\n      event.serviceQuotaExceededException\n    )\n      throw new Error(\n        event.serviceQuotaExceededException.message ?? \"Quota exceeded\"\n      );\n    if (\"conflictException\" in event && event.conflictException)\n      throw new Error(event.conflictException.message ?? \"Conflict\");\n  }\n  throw new Error(\"No result received from code interpreter stream\");\n}\n\n/**\n * {@link SandboxFileSystem} backed by AWS Bedrock AgentCore Code Interpreter.\n *\n * Maps zeitlich's filesystem interface to Code Interpreter's\n * `readFiles` / `writeFiles` / `listFiles` / `removeFiles` / `executeCommand`\n * tool invocations.\n */\nexport class BedrockSandboxFileSystem implements SandboxFileSystem {\n  readonly workspaceBase: string;\n\n  constructor(\n    private client: BedrockAgentCoreClient,\n    private codeInterpreterIdentifier: string,\n    private sessionId: string,\n    workspaceBase = \"/home/user\"\n  ) {\n    this.workspaceBase = posix.resolve(\"/\", workspaceBase);\n  }\n\n  private normalisePath(path: string): string {\n    return posix.resolve(this.workspaceBase, path);\n  }\n\n  private async invoke(\n    name: ToolNameType,\n    args: ToolArguments\n  ): Promise<CodeInterpreterResult> {\n    const resp = await this.client.send(\n      new InvokeCodeInterpreterCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        sessionId: this.sessionId,\n        name,\n        arguments: args,\n      })\n    );\n    if (!resp.stream) throw new Error(\"No stream in code interpreter response\");\n    return consumeStream(resp.stream);\n  }\n\n  private async execShell(command: string): Promise<{\n    stdout: string;\n    stderr: string;\n    exitCode: number;\n  }> {\n    const result = await this.invoke(\"executeCommand\" as ToolNameType, {\n      command,\n    });\n    return {\n      stdout: result.structuredContent?.stdout ?? \"\",\n      stderr: result.structuredContent?.stderr ?? \"\",\n      exitCode: result.structuredContent?.exitCode ?? 0,\n    };\n  }\n\n  async readFile(path: string): Promise<string> {\n    const norm = this.normalisePath(path);\n    const result = await this.invoke(\"readFiles\" as ToolNameType, {\n      paths: [norm],\n    });\n\n    for (const block of result.content ?? []) {\n      if (block.resource?.text != null) return block.resource.text;\n      if (block.text != null) return block.text;\n    }\n    return \"\";\n  }\n\n  async readFileBuffer(path: string): Promise<Uint8Array> {\n    const norm = this.normalisePath(path);\n    const result = await this.invoke(\"readFiles\" as ToolNameType, {\n      paths: [norm],\n    });\n\n    for (const block of result.content ?? []) {\n      if (block.resource?.blob) return block.resource.blob;\n      if (block.data) return block.data;\n      if (block.resource?.text != null)\n        return new TextEncoder().encode(block.resource.text);\n      if (block.text != null) return new TextEncoder().encode(block.text);\n    }\n    return new Uint8Array(0);\n  }\n\n  async writeFile(path: string, content: string | Uint8Array): Promise<void> {\n    const norm = this.normalisePath(path);\n    const isText = typeof content === \"string\";\n    const result = await this.invoke(\"writeFiles\" as ToolNameType, {\n      content: [\n        {\n          path: norm,\n          ...(isText\n            ? { text: content as string }\n            : { blob: content as Uint8Array }),\n        },\n      ],\n    });\n    if (result.isError) {\n      const msg =\n        result.content?.map((b) => b.text).join(\"\") ?? \"writeFile failed\";\n      throw new Error(msg);\n    }\n  }\n\n  async appendFile(path: string, content: string | Uint8Array): Promise<void> {\n    const norm = this.normalisePath(path);\n    const addition =\n      typeof content === \"string\"\n        ? content\n        : new TextDecoder().decode(content);\n    const escaped = addition.replace(/'/g, \"'\\\\''\");\n    const { exitCode, stderr } = await this.execShell(\n      `printf '%s' '${escaped}' >> \"${norm}\"`\n    );\n    if (exitCode !== 0) throw new Error(`appendFile failed: ${stderr}`);\n  }\n\n  async exists(path: string): Promise<boolean> {\n    const norm = this.normalisePath(path);\n    const { exitCode } = await this.execShell(`test -e \"${norm}\"`);\n    return exitCode === 0;\n  }\n\n  async stat(path: string): Promise<FileStat> {\n    const norm = this.normalisePath(path);\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `stat -c '%F %s %Y' \"${norm}\" 2>&1`\n    );\n    if (exitCode !== 0) throw new Error(`stat failed: ${stderr || stdout}`);\n\n    const parts = stdout.trim().split(\" \");\n    const fileType = parts.slice(0, -2).join(\" \");\n    const sizeStr = parts[parts.length - 2] ?? \"0\";\n    const mtimeStr = parts[parts.length - 1] ?? \"0\";\n    const size = parseInt(sizeStr, 10);\n    const mtimeEpoch = parseInt(mtimeStr, 10);\n\n    return {\n      isFile: fileType === \"regular file\" || fileType === \"regular empty file\",\n      isDirectory: fileType === \"directory\",\n      isSymbolicLink: fileType === \"symbolic link\",\n      size: isNaN(size) ? 0 : size,\n      mtime: new Date(isNaN(mtimeEpoch) ? 0 : mtimeEpoch * 1000),\n    };\n  }\n\n  async mkdir(path: string, options?: { recursive?: boolean }): Promise<void> {\n    const norm = this.normalisePath(path);\n    const flag = options?.recursive ? \"-p \" : \"\";\n    const { exitCode, stderr } = await this.execShell(\n      `mkdir ${flag}\"${norm}\"`\n    );\n    if (exitCode !== 0) throw new Error(`mkdir failed: ${stderr}`);\n  }\n\n  async readdir(path: string): Promise<string[]> {\n    const norm = this.normalisePath(path);\n    const result = await this.invoke(\"listFiles\" as ToolNameType, {\n      directoryPath: norm,\n    });\n\n    const names: string[] = [];\n    for (const block of result.content ?? []) {\n      if (block.name) names.push(block.name);\n    }\n\n    if (names.length > 0) return names;\n\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `ls -1A \"${norm}\"`\n    );\n    if (exitCode !== 0) throw new Error(`readdir failed: ${stderr}`);\n    return stdout\n      .trim()\n      .split(\"\\n\")\n      .filter((l) => l.length > 0);\n  }\n\n  async readdirWithFileTypes(path: string): Promise<DirentEntry[]> {\n    const norm = this.normalisePath(path);\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `find \"${norm}\" -maxdepth 1 -mindepth 1 -printf '%y %f\\\\n'`\n    );\n    if (exitCode !== 0)\n      throw new Error(`readdirWithFileTypes failed: ${stderr}`);\n\n    return stdout\n      .trim()\n      .split(\"\\n\")\n      .filter((l) => l.length > 0)\n      .map((line) => {\n        const type = line.charAt(0);\n        const name = line.slice(2);\n        return {\n          name,\n          isFile: type === \"f\",\n          isDirectory: type === \"d\",\n          isSymbolicLink: type === \"l\",\n        };\n      });\n  }\n\n  async rm(\n    path: string,\n    options?: { recursive?: boolean; force?: boolean }\n  ): Promise<void> {\n    const norm = this.normalisePath(path);\n    if (options?.recursive || options?.force) {\n      const flags = `${options?.recursive ? \"-r\" : \"\"} ${options?.force ? \"-f\" : \"\"}`.trim();\n      const { exitCode, stderr } = await this.execShell(\n        `rm ${flags} \"${norm}\"`\n      );\n      if (exitCode !== 0 && !options?.force)\n        throw new Error(`rm failed: ${stderr}`);\n      return;\n    }\n\n    const result = await this.invoke(\"removeFiles\" as ToolNameType, {\n      paths: [norm],\n    });\n    if (result.isError) {\n      const msg =\n        result.content?.map((b) => b.text).join(\"\") ?? \"rm failed\";\n      throw new Error(msg);\n    }\n  }\n\n  async cp(\n    src: string,\n    dest: string,\n    options?: { recursive?: boolean }\n  ): Promise<void> {\n    const normSrc = this.normalisePath(src);\n    const normDest = this.normalisePath(dest);\n    const flag = options?.recursive ? \"-r \" : \"\";\n    const { exitCode, stderr } = await this.execShell(\n      `cp ${flag}\"${normSrc}\" \"${normDest}\"`\n    );\n    if (exitCode !== 0) throw new Error(`cp failed: ${stderr}`);\n  }\n\n  async mv(src: string, dest: string): Promise<void> {\n    const normSrc = this.normalisePath(src);\n    const normDest = this.normalisePath(dest);\n    const { exitCode, stderr } = await this.execShell(\n      `mv \"${normSrc}\" \"${normDest}\"`\n    );\n    if (exitCode !== 0) throw new Error(`mv failed: ${stderr}`);\n  }\n\n  async readlink(path: string): Promise<string> {\n    const norm = this.normalisePath(path);\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `readlink \"${norm}\"`\n    );\n    if (exitCode !== 0)\n      throw new SandboxNotSupportedError(`readlink: ${stderr}`);\n    return stdout.trim();\n  }\n\n  resolvePath(base: string, path: string): string {\n    return posix.resolve(this.normalisePath(base), path);\n  }\n}\n","import {\n  BedrockAgentCoreClient,\n  StartCodeInterpreterSessionCommand,\n  GetCodeInterpreterSessionCommand,\n  StopCodeInterpreterSessionCommand,\n  InvokeCodeInterpreterCommand,\n} from \"@aws-sdk/client-bedrock-agentcore\";\nimport type { CodeInterpreterStreamOutput } from \"@aws-sdk/client-bedrock-agentcore\";\nimport type {\n  Sandbox,\n  SandboxCapabilities,\n  SandboxCreateResult,\n  SandboxProvider,\n  SandboxSnapshot,\n  ExecOptions,\n  ExecResult,\n} from \"../../../lib/sandbox/types\";\nimport {\n  SandboxNotFoundError,\n  SandboxNotSupportedError,\n} from \"../../../lib/sandbox/types\";\nimport { BedrockSandboxFileSystem } from \"./filesystem\";\nimport type {\n  BedrockSandbox,\n  BedrockSandboxConfig,\n  BedrockSandboxCreateOptions,\n} from \"./types\";\n\n// ============================================================================\n// Stream helpers\n// ============================================================================\n\nasync function consumeExecStream(\n  stream: AsyncIterable<CodeInterpreterStreamOutput>\n): Promise<ExecResult> {\n  for await (const event of stream) {\n    if (\"result\" in event && event.result) {\n      const sc = event.result.structuredContent;\n      return {\n        exitCode: sc?.exitCode ?? 0,\n        stdout: sc?.stdout ?? \"\",\n        stderr: sc?.stderr ?? \"\",\n      };\n    }\n    if (\"accessDeniedException\" in event && event.accessDeniedException)\n      throw new Error(event.accessDeniedException.message ?? \"Access denied\");\n    if (\"resourceNotFoundException\" in event && event.resourceNotFoundException)\n      throw new Error(\n        event.resourceNotFoundException.message ?? \"Resource not found\"\n      );\n    if (\"validationException\" in event && event.validationException)\n      throw new Error(\n        event.validationException.message ?? \"Validation error\"\n      );\n    if (\"internalServerException\" in event && event.internalServerException)\n      throw new Error(\n        event.internalServerException.message ?? \"Internal server error\"\n      );\n    if (\"throttlingException\" in event && event.throttlingException)\n      throw new Error(event.throttlingException.message ?? \"Throttled\");\n    if (\n      \"serviceQuotaExceededException\" in event &&\n      event.serviceQuotaExceededException\n    )\n      throw new Error(\n        event.serviceQuotaExceededException.message ?? \"Quota exceeded\"\n      );\n    if (\"conflictException\" in event && event.conflictException)\n      throw new Error(event.conflictException.message ?? \"Conflict\");\n  }\n  return { exitCode: 0, stdout: \"\", stderr: \"\" };\n}\n\n// ============================================================================\n// BedrockSandboxImpl\n// ============================================================================\n\nclass BedrockSandboxImpl implements Sandbox {\n  readonly capabilities: SandboxCapabilities = {\n    filesystem: true,\n    execution: true,\n    persistence: false,\n  };\n\n  readonly fs: BedrockSandboxFileSystem;\n\n  constructor(\n    readonly id: string,\n    private client: BedrockAgentCoreClient,\n    private codeInterpreterIdentifier: string,\n    private sessionId: string,\n    workspaceBase = \"/home/user\"\n  ) {\n    this.fs = new BedrockSandboxFileSystem(\n      client,\n      codeInterpreterIdentifier,\n      sessionId,\n      workspaceBase\n    );\n  }\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    let cmd = command;\n    if (options?.cwd) cmd = `cd \"${options.cwd}\" && ${cmd}`;\n    if (options?.env) {\n      const exports = Object.entries(options.env)\n        .map(([k, v]) => `export ${k}=\"${v.replace(/\"/g, '\\\\\"')}\"`)\n        .join(\" && \");\n      cmd = `${exports} && ${cmd}`;\n    }\n\n    const resp = await this.client.send(\n      new InvokeCodeInterpreterCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        sessionId: this.sessionId,\n        name: \"executeCommand\",\n        arguments: { command: cmd },\n      })\n    );\n\n    if (!resp.stream)\n      throw new Error(\"No stream in code interpreter response\");\n    return consumeExecStream(resp.stream);\n  }\n\n  async destroy(): Promise<void> {\n    await this.client.send(\n      new StopCodeInterpreterSessionCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        sessionId: this.sessionId,\n      })\n    );\n  }\n}\n\n// ============================================================================\n// BedrockSandboxProvider\n// ============================================================================\n\nexport class BedrockSandboxProvider\n  implements SandboxProvider<BedrockSandboxCreateOptions, BedrockSandbox>\n{\n  readonly id = \"bedrock\";\n  readonly capabilities: SandboxCapabilities = {\n    filesystem: true,\n    execution: true,\n    persistence: false,\n  };\n\n  private client: BedrockAgentCoreClient;\n  private readonly codeInterpreterIdentifier: string;\n  private readonly defaultWorkspaceBase: string;\n\n  constructor(config: BedrockSandboxConfig) {\n    this.client = new BedrockAgentCoreClient(config.clientConfig ?? {});\n    this.codeInterpreterIdentifier = config.codeInterpreterIdentifier;\n    this.defaultWorkspaceBase = config.workspaceBase ?? \"/home/user\";\n  }\n\n  async create(\n    options?: BedrockSandboxCreateOptions\n  ): Promise<SandboxCreateResult> {\n    const resp = await this.client.send(\n      new StartCodeInterpreterSessionCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        name: options?.name,\n        sessionTimeoutSeconds: options?.sessionTimeoutSeconds,\n      })\n    );\n\n    const sessionId = resp.sessionId ?? \"\";\n    if (!sessionId) throw new Error(\"No sessionId returned from Bedrock\");\n    const sandbox = new BedrockSandboxImpl(\n      sessionId,\n      this.client,\n      this.codeInterpreterIdentifier,\n      sessionId,\n      this.defaultWorkspaceBase\n    );\n\n    if (options?.initialFiles) {\n      for (const [path, content] of Object.entries(options.initialFiles)) {\n        await sandbox.fs.writeFile(path, content);\n      }\n    }\n\n    if (options?.env) {\n      const exports = Object.entries(options.env)\n        .map(([k, v]) => `${k}=\"${v.replace(/\"/g, '\\\\\"')}\"`)\n        .join(\" \");\n      await sandbox.exec(`echo '${exports}' >> ~/.bashrc`);\n    }\n\n    return { sandbox };\n  }\n\n  async get(sandboxId: string): Promise<BedrockSandbox> {\n    try {\n      const resp = await this.client.send(\n        new GetCodeInterpreterSessionCommand({\n          codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n          sessionId: sandboxId,\n        })\n      );\n\n      if (resp.status === \"TERMINATED\") {\n        throw new SandboxNotFoundError(sandboxId);\n      }\n\n      return new BedrockSandboxImpl(\n        sandboxId,\n        this.client,\n        this.codeInterpreterIdentifier,\n        sandboxId,\n        this.defaultWorkspaceBase\n      );\n    } catch (err) {\n      if (err instanceof SandboxNotFoundError) throw err;\n      throw new SandboxNotFoundError(sandboxId);\n    }\n  }\n\n  async destroy(sandboxId: string): Promise<void> {\n    try {\n      await this.client.send(\n        new StopCodeInterpreterSessionCommand({\n          codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n          sessionId: sandboxId,\n        })\n      );\n    } catch {\n      // Already stopped or not found\n    }\n  }\n\n  async pause(_sandboxId: string, _ttlSeconds?: number): Promise<void> {\n    throw new SandboxNotSupportedError(\"pause\");\n  }\n\n  async snapshot(_sandboxId: string): Promise<SandboxSnapshot> {\n    throw new SandboxNotSupportedError(\"snapshot\");\n  }\n\n  async restore(_snapshot: SandboxSnapshot): Promise<never> {\n    throw new SandboxNotSupportedError(\"restore\");\n  }\n\n  async fork(_sandboxId: string): Promise<Sandbox> {\n    throw new SandboxNotSupportedError(\"fork\");\n  }\n}\n\n// Re-exports\nexport { BedrockSandboxFileSystem } from \"./filesystem\";\nexport type {\n  BedrockSandbox,\n  BedrockSandboxConfig,\n  BedrockSandboxCreateOptions,\n} from \"./types\";\n"]}
+{"version":3,"sources":["../../../../src/lib/sandbox/types.ts","../../../../src/adapters/sandbox/bedrock/filesystem.ts","../../../../src/adapters/sandbox/bedrock/index.ts"],"names":["ApplicationFailure","posix","path","InvokeCodeInterpreterCommand","exports","StopCodeInterpreterSessionCommand","BedrockAgentCoreClient","StartCodeInterpreterSessionCommand","GetCodeInterpreterSessionCommand"],"mappings":";;;;;;;AAkLO,IAAM,wBAAA,GAAN,cAAuCA,yBAAA,CAAmB;AAAA,EAC/D,YAAY,SAAA,EAAmB;AAC7B,IAAA,KAAA;AAAA,MACE,6BAA6B,SAAS,CAAA,CAAA;AAAA,MACtC,0BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF,CAAA;AAEO,IAAM,oBAAA,GAAN,cAAmCA,yBAAA,CAAmB;AAAA,EAC3D,YAAY,SAAA,EAAmB;AAC7B,IAAA,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAS,CAAA,CAAA,EAAI,sBAAA,EAAwB,IAAI,CAAA;AAAA,EACvE;AACF,CAAA;AChLA,eAAe,cACb,MAAA,EACgC;AAChC,EAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,IAAA,IAAI,QAAA,IAAY,KAAA,IAAS,KAAA,CAAM,MAAA,SAAe,KAAA,CAAM,MAAA;AACpD,IAAA,IAAI,uBAAA,IAA2B,SAAS,KAAA,CAAM,qBAAA;AAC5C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,qBAAA,CAAsB,WAAW,eAAe,CAAA;AACxE,IAAA,IAAI,2BAAA,IAA+B,SAAS,KAAA,CAAM,yBAAA;AAChD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,0BAA0B,OAAA,IAAW;AAAA,OAC7C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,oBAAoB,OAAA,IAAW;AAAA,OACvC;AACF,IAAA,IAAI,yBAAA,IAA6B,SAAS,KAAA,CAAM,uBAAA;AAC9C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,wBAAwB,OAAA,IAAW;AAAA,OAC3C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,mBAAA,CAAoB,WAAW,WAAW,CAAA;AAClE,IAAA,IACE,+BAAA,IAAmC,SACnC,KAAA,CAAM,6BAAA;AAEN,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,8BAA8B,OAAA,IAAW;AAAA,OACjD;AACF,IAAA,IAAI,mBAAA,IAAuB,SAAS,KAAA,CAAM,iBAAA;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,iBAAA,CAAkB,WAAW,UAAU,CAAA;AAAA,EACjE;AACA,EAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AACnE;AASO,IAAM,2BAAN,MAA4D;AAAA,EAGjE,WAAA,CACU,MAAA,EACA,yBAAA,EACA,SAAA,EACR,gBAAgB,YAAA,EAChB;AAJQ,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,yBAAA,GAAA,yBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAGR,IAAA,IAAA,CAAK,aAAA,GAAgBC,UAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,aAAa,CAAA;AAAA,EACvD;AAAA,EATS,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeD,cAAcC,MAAA,EAAsB;AAC1C,IAAA,IACED,UAAA,CAAM,UAAA,CAAWC,MAAI,CAAA,IACrB,CAACA,MAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,GAAgB,GAAG,CAAA,IACzCA,MAAA,KAAS,KAAK,aAAA,EACd;AACA,MAAAA,MAAA,GAAOA,MAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAAA,IAChC;AACA,IAAA,MAAM,QAAA,GAAWD,UAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,eAAeC,MAAI,CAAA;AACvD,IAAA,IACE,CAAC,SAAS,UAAA,CAAW,IAAA,CAAK,gBAAgB,GAAG,CAAA,IAC7C,QAAA,KAAa,IAAA,CAAK,aAAA,EAClB;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,oBAAA,EAAuB,QAAQ,CAAA,qBAAA,EAAwB,IAAA,CAAK,aAAa,CAAA,CAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,WAAW,IAAA,EAAsB;AACvC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,KAAK,aAAA,GAAgB,GAAA;AACpC,IAAA,OAAO,GAAA,CAAI,WAAW,MAAM,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA,GAAI,GAAA;AAAA,EAC7D;AAAA,EAEA,MAAc,MAAA,CACZ,IAAA,EACA,IAAA,EACgC;AAChC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MAC7B,IAAIC,mDAAA,CAA6B;AAAA,QAC/B,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,IAAA;AAAA,QACA,SAAA,EAAW;AAAA,OACZ;AAAA,KACH;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAC1E,IAAA,OAAO,aAAA,CAAc,KAAK,MAAM,CAAA;AAAA,EAClC;AAAA,EAEA,MAAc,UAAU,OAAA,EAIrB;AACD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,gBAAA,EAAkC;AAAA,MACjE;AAAA,KACD,CAAA;AACD,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,MAAA,CAAO,iBAAA,EAAmB,MAAA,IAAU,EAAA;AAAA,MAC5C,MAAA,EAAQ,MAAA,CAAO,iBAAA,EAAmB,MAAA,IAAU,EAAA;AAAA,MAC5C,QAAA,EAAU,MAAA,CAAO,iBAAA,EAAmB,QAAA,IAAY;AAAA,KAClD;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,IAAA,EAA+B;AAC5C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,EAA6B;AAAA,MAC5D,KAAA,EAAO,CAAC,GAAG;AAAA,KACZ,CAAA;AAED,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IAAI,MAAM,QAAA,EAAU,IAAA,IAAQ,IAAA,EAAM,OAAO,MAAM,QAAA,CAAS,IAAA;AACxD,MAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,IAAA,EAAM,OAAO,KAAA,CAAM,IAAA;AAAA,IACvC;AACA,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEA,MAAM,eAAe,IAAA,EAAmC;AACtD,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,EAA6B;AAAA,MAC5D,KAAA,EAAO,CAAC,GAAG;AAAA,KACZ,CAAA;AAED,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IAAI,KAAA,CAAM,QAAA,EAAU,IAAA,EAAM,OAAO,MAAM,QAAA,CAAS,IAAA;AAChD,MAAA,IAAI,KAAA,CAAM,IAAA,EAAM,OAAO,KAAA,CAAM,IAAA;AAC7B,MAAA,IAAI,KAAA,CAAM,UAAU,IAAA,IAAQ,IAAA;AAC1B,QAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,SAAS,IAAI,CAAA;AACrD,MAAA,IAAI,KAAA,CAAM,QAAQ,IAAA,EAAM,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAI,WAAW,CAAC,CAAA;AAAA,EACzB;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,OAAA,EAA6C;AACzE,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,OAAO,OAAA,KAAY,QAAA;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,YAAA,EAA8B;AAAA,MAC7D,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,GAAA;AAAA,UACN,GAAI,SACA,EAAE,IAAA,EAAM,SAAkB,GAC1B,EAAE,MAAM,OAAA;AAAsB;AACpC;AACF,KACD,CAAA;AACD,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,MAAM,GAAA,GACJ,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,IAAK,kBAAA;AACjD,MAAA,MAAM,IAAI,MAAM,GAAG,CAAA;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,UAAA,CAAW,IAAA,EAAc,OAAA,EAA6C;AAC1E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,QAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,UACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AACtC,IAAA,MAAM,OAAA,GAAU,QAAA,CAAS,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAC9C,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,aAAA,EAAgB,OAAO,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA;AAAA,KACtC;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAAA,EACpE;AAAA,EAEA,MAAM,OAAO,IAAA,EAAgC;AAC3C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,UAAS,GAAI,MAAM,KAAK,SAAA,CAAU,CAAA,SAAA,EAAY,IAAI,CAAA,CAAA,CAAG,CAAA;AAC7D,IAAA,OAAO,QAAA,KAAa,CAAA;AAAA,EACtB;AAAA,EAEA,MAAM,KAAK,IAAA,EAAiC;AAC1C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,uBAAuB,IAAI,CAAA,MAAA;AAAA,KAC7B;AACA,IAAA,IAAI,QAAA,KAAa,GAAG,MAAM,IAAI,MAAM,CAAA,aAAA,EAAgB,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAEtE,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,EAAK,CAAE,MAAM,GAAG,CAAA;AACrC,IAAA,MAAM,WAAW,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,IAAK,GAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,IAAK,GAAA;AAC5C,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA;AACjC,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,QAAA,EAAU,EAAE,CAAA;AAExC,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,QAAA,KAAa,cAAA,IAAkB,QAAA,KAAa,oBAAA;AAAA,MACpD,aAAa,QAAA,KAAa,WAAA;AAAA,MAC1B,gBAAgB,QAAA,KAAa,eAAA;AAAA,MAC7B,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA,GAAI,CAAA,GAAI,IAAA;AAAA,MACxB,KAAA,EAAO,IAAI,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA,GAAI,CAAA,GAAI,aAAa,GAAI;AAAA,KAC3D;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAM,IAAA,EAAc,OAAA,EAAkD;AAC1E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,IAAA,GAAO,OAAA,EAAS,SAAA,GAAY,KAAA,GAAQ,EAAA;AAC1C,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAAA,KACvB;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAM,QAAQ,IAAA,EAAiC;AAC7C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,EAA6B;AAAA,MAC5D,aAAA,EAAe;AAAA,KAChB,CAAA;AAED,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IAAI,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACvC;AAEA,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,OAAO,KAAA;AAE7B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,WAAW,IAAI,CAAA,CAAA;AAAA,KACjB;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AAC/D,IAAA,OAAO,MAAA,CACJ,IAAA,EAAK,CACL,KAAA,CAAM,IAAI,CAAA,CACV,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,qBAAqB,IAAA,EAAsC;AAC/D,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,SAAS,IAAI,CAAA,4CAAA;AAAA,KACf;AACA,IAAA,IAAI,QAAA,KAAa,CAAA;AACf,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,MAAM,CAAA,CAAE,CAAA;AAE1D,IAAA,OAAO,MAAA,CACJ,IAAA,EAAK,CACL,KAAA,CAAM,IAAI,CAAA,CACV,MAAA,CAAO,CAAC,CAAA,KAAM,EAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,CAAC,IAAA,KAAS;AACb,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA;AAC1B,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AACzB,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,QAAQ,IAAA,KAAS,GAAA;AAAA,QACjB,aAAa,IAAA,KAAS,GAAA;AAAA,QACtB,gBAAgB,IAAA,KAAS;AAAA,OAC3B;AAAA,IACF,CAAC,CAAA;AAAA,EACL;AAAA,EAEA,MAAM,EAAA,CACJ,IAAA,EACA,OAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,IAAI,OAAA,EAAS,SAAA,IAAa,OAAA,EAAS,KAAA,EAAO;AACxC,MAAA,MAAM,KAAA,GAAQ,CAAA,EAAG,OAAA,EAAS,SAAA,GAAY,IAAA,GAAO,EAAE,CAAA,CAAA,EAAI,OAAA,EAAS,KAAA,GAAQ,IAAA,GAAO,EAAE,CAAA,CAAA,CAAG,IAAA,EAAK;AACrF,MAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,QACtC,CAAA,GAAA,EAAM,KAAK,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA;AAAA,OACtB;AACA,MAAA,IAAI,QAAA,KAAa,CAAA,IAAK,CAAC,OAAA,EAAS,KAAA;AAC9B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,MAAM,CAAA,CAAE,CAAA;AACxC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,aAAA,EAA+B;AAAA,MAC9D,KAAA,EAAO,CAAC,GAAG;AAAA,KACZ,CAAA;AACD,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,MAAM,GAAA,GACJ,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,IAAK,WAAA;AACjD,MAAA,MAAM,IAAI,MAAM,GAAG,CAAA;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,EAAA,CACJ,GAAA,EACA,IAAA,EACA,OAAA,EACe;AACf,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AACtC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,OAAA,EAAS,SAAA,GAAY,KAAA,GAAQ,EAAA;AAC1C,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA,EAAI,OAAO,MAAM,QAAQ,CAAA,CAAA;AAAA,KACrC;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,MAAM,CAAA,CAAE,CAAA;AAAA,EAC5D;AAAA,EAEA,MAAM,EAAA,CAAG,GAAA,EAAa,IAAA,EAA6B;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AACtC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACxC,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MACtC,CAAA,IAAA,EAAO,OAAO,CAAA,GAAA,EAAM,QAAQ,CAAA,CAAA;AAAA,KAC9B;AACA,IAAA,IAAI,aAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,MAAM,CAAA,CAAE,CAAA;AAAA,EAC5D;AAAA,EAEA,MAAM,SAAS,IAAA,EAA+B;AAC5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACpC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,SAAA;AAAA,MAC9C,aAAa,IAAI,CAAA,CAAA;AAAA,KACnB;AACA,IAAA,IAAI,QAAA,KAAa,CAAA;AACf,MAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,UAAA,EAAa,MAAM,CAAA,CAAE,CAAA;AAC1D,IAAA,OAAO,OAAO,IAAA,EAAK;AAAA,EACrB;AAAA,EAEA,WAAA,CAAY,MAAcD,MAAA,EAAsB;AAC9C,IAAA,OAAOD,WAAM,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,IAAI,GAAGC,MAAI,CAAA;AAAA,EACrD;AACF;;;ACzTA,eAAe,kBACb,MAAA,EACqB;AACrB,EAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,IAAA,IAAI,QAAA,IAAY,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ;AACrC,MAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,iBAAA;AACxB,MAAA,OAAO;AAAA,QACL,QAAA,EAAU,IAAI,QAAA,IAAY,CAAA;AAAA,QAC1B,MAAA,EAAQ,IAAI,MAAA,IAAU,EAAA;AAAA,QACtB,MAAA,EAAQ,IAAI,MAAA,IAAU;AAAA,OACxB;AAAA,IACF;AACA,IAAA,IAAI,uBAAA,IAA2B,SAAS,KAAA,CAAM,qBAAA;AAC5C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,qBAAA,CAAsB,WAAW,eAAe,CAAA;AACxE,IAAA,IAAI,2BAAA,IAA+B,SAAS,KAAA,CAAM,yBAAA;AAChD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,0BAA0B,OAAA,IAAW;AAAA,OAC7C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,oBAAoB,OAAA,IAAW;AAAA,OACvC;AACF,IAAA,IAAI,yBAAA,IAA6B,SAAS,KAAA,CAAM,uBAAA;AAC9C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,wBAAwB,OAAA,IAAW;AAAA,OAC3C;AACF,IAAA,IAAI,qBAAA,IAAyB,SAAS,KAAA,CAAM,mBAAA;AAC1C,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,mBAAA,CAAoB,WAAW,WAAW,CAAA;AAClE,IAAA,IACE,+BAAA,IAAmC,SACnC,KAAA,CAAM,6BAAA;AAEN,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,KAAA,CAAM,8BAA8B,OAAA,IAAW;AAAA,OACjD;AACF,IAAA,IAAI,mBAAA,IAAuB,SAAS,KAAA,CAAM,iBAAA;AACxC,MAAA,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,iBAAA,CAAkB,WAAW,UAAU,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,CAAA,EAAG,MAAA,EAAQ,EAAA,EAAI,QAAQ,EAAA,EAAG;AAC/C;AAMA,IAAM,qBAAN,MAA4C;AAAA,EAS1C,YACW,EAAA,EACD,MAAA,EACA,yBAAA,EACA,SAAA,EACR,gBAAgB,YAAA,EAChB;AALS,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACD,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,yBAAA,GAAA,yBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAGR,IAAA,IAAA,CAAK,KAAK,IAAI,wBAAA;AAAA,MACZ,MAAA;AAAA,MACA,yBAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EArBS,YAAA,GAAoC;AAAA,IAC3C,UAAA,EAAY,IAAA;AAAA,IACZ,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa;AAAA,GACf;AAAA,EAES,EAAA;AAAA,EAiBT,MAAM,IAAA,CAAK,OAAA,EAAiB,OAAA,EAA4C;AACtE,IAAA,IAAI,GAAA,GAAM,OAAA;AACV,IAAA,IAAI,SAAS,GAAA,EAAK,GAAA,GAAM,OAAO,OAAA,CAAQ,GAAG,QAAQ,GAAG,CAAA,CAAA;AACrD,IAAA,IAAI,SAAS,GAAA,EAAK;AAChB,MAAA,MAAME,SAAA,GAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,OAAA,EAAU,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA,CACzD,IAAA,CAAK,MAAM,CAAA;AACd,MAAA,GAAA,GAAM,CAAA,EAAGA,SAAO,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA;AAAA,IAC5B;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MAC7B,IAAID,mDAAAA,CAA6B;AAAA,QAC/B,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,IAAA,EAAM,gBAAA;AAAA,QACN,SAAA,EAAW,EAAE,OAAA,EAAS,GAAA;AAAI,OAC3B;AAAA,KACH;AAEA,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA;AACR,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAC1D,IAAA,OAAO,iBAAA,CAAkB,KAAK,MAAM,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,IAAIE,wDAAA,CAAkC;AAAA,QACpC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,WAAW,IAAA,CAAK;AAAA,OACjB;AAAA,KACH;AAAA,EACF;AACF,CAAA;AAMO,IAAM,yBAAN,MAEP;AAAA,EACW,EAAA,GAAK,SAAA;AAAA,EACL,YAAA,GAAoC;AAAA,IAC3C,UAAA,EAAY,IAAA;AAAA,IACZ,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa;AAAA,GACf;AAAA,EAEQ,MAAA;AAAA,EACS,yBAAA;AAAA,EACA,oBAAA;AAAA,EAEjB,YAAY,MAAA,EAA8B;AACxC,IAAA,IAAA,CAAK,SAAS,IAAIC,6CAAA,CAAuB,MAAA,CAAO,YAAA,IAAgB,EAAE,CAAA;AAClE,IAAA,IAAA,CAAK,4BAA4B,MAAA,CAAO,yBAAA;AACxC,IAAA,IAAA,CAAK,oBAAA,GAAuB,OAAO,aAAA,IAAiB,YAAA;AAAA,EACtD;AAAA,EAEA,MAAM,OACJ,OAAA,EAC8B;AAC9B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MAC7B,IAAIC,yDAAA,CAAmC;AAAA,QACrC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,QAChC,MAAM,OAAA,EAAS,IAAA;AAAA,QACf,uBAAuB,OAAA,EAAS;AAAA,OACjC;AAAA,KACH;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,EAAA;AACpC,IAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACpE,IAAA,MAAM,UAAU,IAAI,kBAAA;AAAA,MAClB,SAAA;AAAA,MACA,IAAA,CAAK,MAAA;AAAA,MACL,IAAA,CAAK,yBAAA;AAAA,MACL,SAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,IAAI,SAAS,YAAA,EAAc;AACzB,MAAA,KAAA,MAAW,CAAC,MAAM,OAAO,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,YAAY,CAAA,EAAG;AAClE,QAAA,MAAM,OAAA,CAAQ,EAAA,CAAG,SAAA,CAAU,IAAA,EAAM,OAAO,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,IAAI,SAAS,GAAA,EAAK;AAChB,MAAA,MAAMH,SAAA,GAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA,CAClD,IAAA,CAAK,GAAG,CAAA;AACX,MAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAA,MAAA,EAASA,SAAO,CAAA,cAAA,CAAgB,CAAA;AAAA,IACrD;AAEA,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB;AAAA,EAEA,MAAM,IAAI,SAAA,EAA4C;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,QAC7B,IAAII,uDAAA,CAAiC;AAAA,UACnC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,UAChC,SAAA,EAAW;AAAA,SACZ;AAAA,OACH;AAEA,MAAA,IAAI,IAAA,CAAK,WAAW,YAAA,EAAc;AAChC,QAAA,MAAM,IAAI,qBAAqB,SAAS,CAAA;AAAA,MAC1C;AAEA,MAAA,OAAO,IAAI,kBAAA;AAAA,QACT,SAAA;AAAA,QACA,IAAA,CAAK,MAAA;AAAA,QACL,IAAA,CAAK,yBAAA;AAAA,QACL,SAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,sBAAsB,MAAM,GAAA;AAC/C,MAAA,MAAM,IAAI,qBAAqB,SAAS,CAAA;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,SAAA,EAAkC;AAC9C,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,QAChB,IAAIH,wDAAA,CAAkC;AAAA,UACpC,2BAA2B,IAAA,CAAK,yBAAA;AAAA,UAChC,SAAA,EAAW;AAAA,SACZ;AAAA,OACH;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAM,UAAA,EAAoB,WAAA,EAAqC;AACnE,IAAA,MAAM,IAAI,yBAAyB,OAAO,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,SAAS,UAAA,EAA8C;AAC3D,IAAA,MAAM,IAAI,yBAAyB,UAAU,CAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,QAAQ,SAAA,EAA4C;AACxD,IAAA,MAAM,IAAI,yBAAyB,SAAS,CAAA;AAAA,EAC9C;AAAA,EAEA,MAAM,KAAK,UAAA,EAAsC;AAC/C,IAAA,MAAM,IAAI,yBAAyB,MAAM,CAAA;AAAA,EAC3C;AACF","file":"index.cjs","sourcesContent":["// ============================================================================\n// Sandbox Filesystem\n// ============================================================================\n\nexport interface DirentEntry {\n  name: string;\n  isFile: boolean;\n  isDirectory: boolean;\n  isSymbolicLink: boolean;\n}\n\nexport interface FileStat {\n  isFile: boolean;\n  isDirectory: boolean;\n  isSymbolicLink: boolean;\n  size: number;\n  mtime: Date;\n}\n\n/**\n * Provider-agnostic filesystem interface.\n *\n * Implementations that don't support a method should throw\n * {@link SandboxNotSupportedError}.\n */\nexport interface SandboxFileSystem {\n  /** Base directory used when resolving relative paths. */\n  readonly workspaceBase: string;\n  readFile(path: string): Promise<string>;\n  readFileBuffer(path: string): Promise<Uint8Array>;\n  writeFile(path: string, content: string | Uint8Array): Promise<void>;\n  appendFile(path: string, content: string | Uint8Array): Promise<void>;\n  exists(path: string): Promise<boolean>;\n  stat(path: string): Promise<FileStat>;\n  mkdir(path: string, options?: { recursive?: boolean }): Promise<void>;\n  readdir(path: string): Promise<string[]>;\n  readdirWithFileTypes(path: string): Promise<DirentEntry[]>;\n  rm(\n    path: string,\n    options?: { recursive?: boolean; force?: boolean }\n  ): Promise<void>;\n  cp(\n    src: string,\n    dest: string,\n    options?: { recursive?: boolean }\n  ): Promise<void>;\n  mv(src: string, dest: string): Promise<void>;\n  readlink(path: string): Promise<string>;\n  resolvePath(base: string, path: string): string;\n}\n\n// ============================================================================\n// Execution\n// ============================================================================\n\nexport interface ExecOptions {\n  timeout?: number;\n  cwd?: string;\n  env?: Record<string, string>;\n}\n\nexport interface ExecResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\n// ============================================================================\n// Capabilities\n// ============================================================================\n\nexport interface SandboxCapabilities {\n  /** Sandbox supports filesystem operations */\n  filesystem: boolean;\n  /** Sandbox supports shell/command execution */\n  execution: boolean;\n  /** Sandbox state can be persisted and restored */\n  persistence: boolean;\n}\n\n// ============================================================================\n// Sandbox\n// ============================================================================\n\nexport interface Sandbox {\n  readonly id: string;\n  readonly capabilities: SandboxCapabilities;\n  readonly fs: SandboxFileSystem;\n\n  exec(command: string, options?: ExecOptions): Promise<ExecResult>;\n  destroy(): Promise<void>;\n}\n\n// ============================================================================\n// Snapshots\n// ============================================================================\n\nexport interface SandboxSnapshot {\n  sandboxId: string;\n  providerId: string;\n  /** Provider-specific serialised state */\n  data: unknown;\n  createdAt: string;\n}\n\n// ============================================================================\n// Provider\n// ============================================================================\n\nexport interface SandboxCreateOptions {\n  /** Preferred sandbox ID (provider may ignore) */\n  id?: string;\n  /** Seed the filesystem with these files */\n  initialFiles?: Record<string, string | Uint8Array>;\n  /** Environment variables available inside the sandbox */\n  env?: Record<string, string>;\n}\n\nexport interface SandboxCreateResult {\n  sandbox: Sandbox;\n  /** Optional state to merge into the workflow's `AgentState` via the session. */\n  stateUpdate?: Record<string, unknown>;\n}\n\nexport interface SandboxProvider<\n  TOptions extends SandboxCreateOptions = SandboxCreateOptions,\n  TSandbox extends Sandbox = Sandbox,\n> {\n  readonly id: string;\n  readonly capabilities: SandboxCapabilities;\n\n  create(options?: TOptions): Promise<SandboxCreateResult>;\n  get(sandboxId: string): Promise<TSandbox>;\n  destroy(sandboxId: string): Promise<void>;\n  pause(sandboxId: string, ttlSeconds?: number): Promise<void>;\n  snapshot(sandboxId: string): Promise<SandboxSnapshot>;\n  restore(snapshot: SandboxSnapshot): Promise<Sandbox>;\n  fork(sandboxId: string): Promise<Sandbox>;\n}\n\n// ============================================================================\n// SandboxOps — workflow-side activity interface (like ThreadOps)\n// ============================================================================\n\nexport interface SandboxOps<\n  TOptions extends SandboxCreateOptions = SandboxCreateOptions,\n> {\n  createSandbox(\n    options?: TOptions\n  ): Promise<{ sandboxId: string; stateUpdate?: Record<string, unknown> }>;\n  destroySandbox(sandboxId: string): Promise<void>;\n  pauseSandbox(sandboxId: string): Promise<void>;\n  snapshotSandbox(sandboxId: string): Promise<SandboxSnapshot>;\n  forkSandbox(sandboxId: string): Promise<string>;\n}\n\n/**\n * Maps generic {@link SandboxOps} method names to adapter-prefixed names.\n *\n * @example\n * ```typescript\n * type InMemOps = PrefixedSandboxOps<\"inMemory\">;\n * // → { inMemoryCreateSandbox, inMemoryDestroySandbox, inMemorySnapshotSandbox }\n * ```\n */\nexport type PrefixedSandboxOps<\n  TPrefix extends string,\n  TOptions extends SandboxCreateOptions = SandboxCreateOptions,\n> = {\n  [K in keyof SandboxOps<TOptions> as `${TPrefix}${Capitalize<K & string>}`]: SandboxOps<TOptions>[K];\n};\n\n// ============================================================================\n// Errors\n// ============================================================================\n\nimport { ApplicationFailure } from \"@temporalio/common\";\n\nexport class SandboxNotSupportedError extends ApplicationFailure {\n  constructor(operation: string) {\n    super(\n      `Sandbox does not support: ${operation}`,\n      \"SandboxNotSupportedError\",\n      true\n    );\n  }\n}\n\nexport class SandboxNotFoundError extends ApplicationFailure {\n  constructor(sandboxId: string) {\n    super(`Sandbox not found: ${sandboxId}`, \"SandboxNotFoundError\", true);\n  }\n}\n","import type {\n  BedrockAgentCoreClient,\n  CodeInterpreterStreamOutput,\n  CodeInterpreterResult,\n  ToolName as ToolNameType,\n  ToolArguments,\n} from \"@aws-sdk/client-bedrock-agentcore\";\nimport { InvokeCodeInterpreterCommand } from \"@aws-sdk/client-bedrock-agentcore\";\nimport type {\n  SandboxFileSystem,\n  DirentEntry,\n  FileStat,\n} from \"../../../lib/sandbox/types\";\nimport { SandboxNotSupportedError } from \"../../../lib/sandbox/types\";\nimport { posix } from \"node:path\";\n\nasync function consumeStream(\n  stream: AsyncIterable<CodeInterpreterStreamOutput>\n): Promise<CodeInterpreterResult> {\n  for await (const event of stream) {\n    if (\"result\" in event && event.result) return event.result;\n    if (\"accessDeniedException\" in event && event.accessDeniedException)\n      throw new Error(event.accessDeniedException.message ?? \"Access denied\");\n    if (\"resourceNotFoundException\" in event && event.resourceNotFoundException)\n      throw new Error(\n        event.resourceNotFoundException.message ?? \"Resource not found\"\n      );\n    if (\"validationException\" in event && event.validationException)\n      throw new Error(\n        event.validationException.message ?? \"Validation error\"\n      );\n    if (\"internalServerException\" in event && event.internalServerException)\n      throw new Error(\n        event.internalServerException.message ?? \"Internal server error\"\n      );\n    if (\"throttlingException\" in event && event.throttlingException)\n      throw new Error(event.throttlingException.message ?? \"Throttled\");\n    if (\n      \"serviceQuotaExceededException\" in event &&\n      event.serviceQuotaExceededException\n    )\n      throw new Error(\n        event.serviceQuotaExceededException.message ?? \"Quota exceeded\"\n      );\n    if (\"conflictException\" in event && event.conflictException)\n      throw new Error(event.conflictException.message ?? \"Conflict\");\n  }\n  throw new Error(\"No result received from code interpreter stream\");\n}\n\n/**\n * {@link SandboxFileSystem} backed by AWS Bedrock AgentCore Code Interpreter.\n *\n * Maps zeitlich's filesystem interface to Code Interpreter's\n * `readFiles` / `writeFiles` / `listFiles` / `removeFiles` / `executeCommand`\n * tool invocations.\n */\nexport class BedrockSandboxFileSystem implements SandboxFileSystem {\n  readonly workspaceBase: string;\n\n  constructor(\n    private client: BedrockAgentCoreClient,\n    private codeInterpreterIdentifier: string,\n    private sessionId: string,\n    workspaceBase = \"/home/user\"\n  ) {\n    this.workspaceBase = posix.resolve(\"/\", workspaceBase);\n  }\n\n  /**\n   * Resolve a caller-supplied path to an absolute path within the workspace.\n   * Used for shell commands that need full paths.\n   */\n  private normalisePath(path: string): string {\n    if (\n      posix.isAbsolute(path) &&\n      !path.startsWith(this.workspaceBase + \"/\") &&\n      path !== this.workspaceBase\n    ) {\n      path = path.replace(/^\\/+/, \"\");\n    }\n    const resolved = posix.resolve(this.workspaceBase, path);\n    if (\n      !resolved.startsWith(this.workspaceBase + \"/\") &&\n      resolved !== this.workspaceBase\n    ) {\n      throw new Error(\n        `Invalid file path: \"${resolved}\" escapes workspace \"${this.workspaceBase}\"`\n      );\n    }\n    return resolved;\n  }\n\n  /**\n   * Return a workspace-relative path for Bedrock tool invocations\n   * (`writeFiles`, `readFiles`, `listFiles`, `removeFiles`), which\n   * reject absolute paths as \"path traversal\".\n   */\n  private toToolPath(path: string): string {\n    const abs = this.normalisePath(path);\n    const prefix = this.workspaceBase + \"/\";\n    return abs.startsWith(prefix) ? abs.slice(prefix.length) : abs;\n  }\n\n  private async invoke(\n    name: ToolNameType,\n    args: ToolArguments\n  ): Promise<CodeInterpreterResult> {\n    const resp = await this.client.send(\n      new InvokeCodeInterpreterCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        sessionId: this.sessionId,\n        name,\n        arguments: args,\n      })\n    );\n    if (!resp.stream) throw new Error(\"No stream in code interpreter response\");\n    return consumeStream(resp.stream);\n  }\n\n  private async execShell(command: string): Promise<{\n    stdout: string;\n    stderr: string;\n    exitCode: number;\n  }> {\n    const result = await this.invoke(\"executeCommand\" as ToolNameType, {\n      command,\n    });\n    return {\n      stdout: result.structuredContent?.stdout ?? \"\",\n      stderr: result.structuredContent?.stderr ?? \"\",\n      exitCode: result.structuredContent?.exitCode ?? 0,\n    };\n  }\n\n  async readFile(path: string): Promise<string> {\n    const rel = this.toToolPath(path);\n    const result = await this.invoke(\"readFiles\" as ToolNameType, {\n      paths: [rel],\n    });\n\n    for (const block of result.content ?? []) {\n      if (block.resource?.text != null) return block.resource.text;\n      if (block.text != null) return block.text;\n    }\n    return \"\";\n  }\n\n  async readFileBuffer(path: string): Promise<Uint8Array> {\n    const rel = this.toToolPath(path);\n    const result = await this.invoke(\"readFiles\" as ToolNameType, {\n      paths: [rel],\n    });\n\n    for (const block of result.content ?? []) {\n      if (block.resource?.blob) return block.resource.blob;\n      if (block.data) return block.data;\n      if (block.resource?.text != null)\n        return new TextEncoder().encode(block.resource.text);\n      if (block.text != null) return new TextEncoder().encode(block.text);\n    }\n    return new Uint8Array(0);\n  }\n\n  async writeFile(path: string, content: string | Uint8Array): Promise<void> {\n    const rel = this.toToolPath(path);\n    const isText = typeof content === \"string\";\n    const result = await this.invoke(\"writeFiles\" as ToolNameType, {\n      content: [\n        {\n          path: rel,\n          ...(isText\n            ? { text: content as string }\n            : { blob: content as Uint8Array }),\n        },\n      ],\n    });\n    if (result.isError) {\n      const msg =\n        result.content?.map((b) => b.text).join(\"\") ?? \"writeFile failed\";\n      throw new Error(msg);\n    }\n  }\n\n  async appendFile(path: string, content: string | Uint8Array): Promise<void> {\n    const norm = this.normalisePath(path);\n    const addition =\n      typeof content === \"string\"\n        ? content\n        : new TextDecoder().decode(content);\n    const escaped = addition.replace(/'/g, \"'\\\\''\");\n    const { exitCode, stderr } = await this.execShell(\n      `printf '%s' '${escaped}' >> \"${norm}\"`\n    );\n    if (exitCode !== 0) throw new Error(`appendFile failed: ${stderr}`);\n  }\n\n  async exists(path: string): Promise<boolean> {\n    const norm = this.normalisePath(path);\n    const { exitCode } = await this.execShell(`test -e \"${norm}\"`);\n    return exitCode === 0;\n  }\n\n  async stat(path: string): Promise<FileStat> {\n    const norm = this.normalisePath(path);\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `stat -c '%F %s %Y' \"${norm}\" 2>&1`\n    );\n    if (exitCode !== 0) throw new Error(`stat failed: ${stderr || stdout}`);\n\n    const parts = stdout.trim().split(\" \");\n    const fileType = parts.slice(0, -2).join(\" \");\n    const sizeStr = parts[parts.length - 2] ?? \"0\";\n    const mtimeStr = parts[parts.length - 1] ?? \"0\";\n    const size = parseInt(sizeStr, 10);\n    const mtimeEpoch = parseInt(mtimeStr, 10);\n\n    return {\n      isFile: fileType === \"regular file\" || fileType === \"regular empty file\",\n      isDirectory: fileType === \"directory\",\n      isSymbolicLink: fileType === \"symbolic link\",\n      size: isNaN(size) ? 0 : size,\n      mtime: new Date(isNaN(mtimeEpoch) ? 0 : mtimeEpoch * 1000),\n    };\n  }\n\n  async mkdir(path: string, options?: { recursive?: boolean }): Promise<void> {\n    const norm = this.normalisePath(path);\n    const flag = options?.recursive ? \"-p \" : \"\";\n    const { exitCode, stderr } = await this.execShell(\n      `mkdir ${flag}\"${norm}\"`\n    );\n    if (exitCode !== 0) throw new Error(`mkdir failed: ${stderr}`);\n  }\n\n  async readdir(path: string): Promise<string[]> {\n    const rel = this.toToolPath(path);\n    const result = await this.invoke(\"listFiles\" as ToolNameType, {\n      directoryPath: rel,\n    });\n\n    const names: string[] = [];\n    for (const block of result.content ?? []) {\n      if (block.name) names.push(block.name);\n    }\n\n    if (names.length > 0) return names;\n\n    const norm = this.normalisePath(path);\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `ls -1A \"${norm}\"`\n    );\n    if (exitCode !== 0) throw new Error(`readdir failed: ${stderr}`);\n    return stdout\n      .trim()\n      .split(\"\\n\")\n      .filter((l) => l.length > 0);\n  }\n\n  async readdirWithFileTypes(path: string): Promise<DirentEntry[]> {\n    const norm = this.normalisePath(path);\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `find \"${norm}\" -maxdepth 1 -mindepth 1 -printf '%y %f\\\\n'`\n    );\n    if (exitCode !== 0)\n      throw new Error(`readdirWithFileTypes failed: ${stderr}`);\n\n    return stdout\n      .trim()\n      .split(\"\\n\")\n      .filter((l) => l.length > 0)\n      .map((line) => {\n        const type = line.charAt(0);\n        const name = line.slice(2);\n        return {\n          name,\n          isFile: type === \"f\",\n          isDirectory: type === \"d\",\n          isSymbolicLink: type === \"l\",\n        };\n      });\n  }\n\n  async rm(\n    path: string,\n    options?: { recursive?: boolean; force?: boolean }\n  ): Promise<void> {\n    const norm = this.normalisePath(path);\n    if (options?.recursive || options?.force) {\n      const flags = `${options?.recursive ? \"-r\" : \"\"} ${options?.force ? \"-f\" : \"\"}`.trim();\n      const { exitCode, stderr } = await this.execShell(\n        `rm ${flags} \"${norm}\"`\n      );\n      if (exitCode !== 0 && !options?.force)\n        throw new Error(`rm failed: ${stderr}`);\n      return;\n    }\n\n    const rel = this.toToolPath(path);\n    const result = await this.invoke(\"removeFiles\" as ToolNameType, {\n      paths: [rel],\n    });\n    if (result.isError) {\n      const msg =\n        result.content?.map((b) => b.text).join(\"\") ?? \"rm failed\";\n      throw new Error(msg);\n    }\n  }\n\n  async cp(\n    src: string,\n    dest: string,\n    options?: { recursive?: boolean }\n  ): Promise<void> {\n    const normSrc = this.normalisePath(src);\n    const normDest = this.normalisePath(dest);\n    const flag = options?.recursive ? \"-r \" : \"\";\n    const { exitCode, stderr } = await this.execShell(\n      `cp ${flag}\"${normSrc}\" \"${normDest}\"`\n    );\n    if (exitCode !== 0) throw new Error(`cp failed: ${stderr}`);\n  }\n\n  async mv(src: string, dest: string): Promise<void> {\n    const normSrc = this.normalisePath(src);\n    const normDest = this.normalisePath(dest);\n    const { exitCode, stderr } = await this.execShell(\n      `mv \"${normSrc}\" \"${normDest}\"`\n    );\n    if (exitCode !== 0) throw new Error(`mv failed: ${stderr}`);\n  }\n\n  async readlink(path: string): Promise<string> {\n    const norm = this.normalisePath(path);\n    const { stdout, exitCode, stderr } = await this.execShell(\n      `readlink \"${norm}\"`\n    );\n    if (exitCode !== 0)\n      throw new SandboxNotSupportedError(`readlink: ${stderr}`);\n    return stdout.trim();\n  }\n\n  resolvePath(base: string, path: string): string {\n    return posix.resolve(this.normalisePath(base), path);\n  }\n}\n","import {\n  BedrockAgentCoreClient,\n  StartCodeInterpreterSessionCommand,\n  GetCodeInterpreterSessionCommand,\n  StopCodeInterpreterSessionCommand,\n  InvokeCodeInterpreterCommand,\n} from \"@aws-sdk/client-bedrock-agentcore\";\nimport type { CodeInterpreterStreamOutput } from \"@aws-sdk/client-bedrock-agentcore\";\nimport type {\n  Sandbox,\n  SandboxCapabilities,\n  SandboxCreateResult,\n  SandboxProvider,\n  SandboxSnapshot,\n  ExecOptions,\n  ExecResult,\n} from \"../../../lib/sandbox/types\";\nimport {\n  SandboxNotFoundError,\n  SandboxNotSupportedError,\n} from \"../../../lib/sandbox/types\";\nimport { BedrockSandboxFileSystem } from \"./filesystem\";\nimport type {\n  BedrockSandbox,\n  BedrockSandboxConfig,\n  BedrockSandboxCreateOptions,\n} from \"./types\";\n\n// ============================================================================\n// Stream helpers\n// ============================================================================\n\nasync function consumeExecStream(\n  stream: AsyncIterable<CodeInterpreterStreamOutput>\n): Promise<ExecResult> {\n  for await (const event of stream) {\n    if (\"result\" in event && event.result) {\n      const sc = event.result.structuredContent;\n      return {\n        exitCode: sc?.exitCode ?? 0,\n        stdout: sc?.stdout ?? \"\",\n        stderr: sc?.stderr ?? \"\",\n      };\n    }\n    if (\"accessDeniedException\" in event && event.accessDeniedException)\n      throw new Error(event.accessDeniedException.message ?? \"Access denied\");\n    if (\"resourceNotFoundException\" in event && event.resourceNotFoundException)\n      throw new Error(\n        event.resourceNotFoundException.message ?? \"Resource not found\"\n      );\n    if (\"validationException\" in event && event.validationException)\n      throw new Error(\n        event.validationException.message ?? \"Validation error\"\n      );\n    if (\"internalServerException\" in event && event.internalServerException)\n      throw new Error(\n        event.internalServerException.message ?? \"Internal server error\"\n      );\n    if (\"throttlingException\" in event && event.throttlingException)\n      throw new Error(event.throttlingException.message ?? \"Throttled\");\n    if (\n      \"serviceQuotaExceededException\" in event &&\n      event.serviceQuotaExceededException\n    )\n      throw new Error(\n        event.serviceQuotaExceededException.message ?? \"Quota exceeded\"\n      );\n    if (\"conflictException\" in event && event.conflictException)\n      throw new Error(event.conflictException.message ?? \"Conflict\");\n  }\n  return { exitCode: 0, stdout: \"\", stderr: \"\" };\n}\n\n// ============================================================================\n// BedrockSandboxImpl\n// ============================================================================\n\nclass BedrockSandboxImpl implements Sandbox {\n  readonly capabilities: SandboxCapabilities = {\n    filesystem: true,\n    execution: true,\n    persistence: false,\n  };\n\n  readonly fs: BedrockSandboxFileSystem;\n\n  constructor(\n    readonly id: string,\n    private client: BedrockAgentCoreClient,\n    private codeInterpreterIdentifier: string,\n    private sessionId: string,\n    workspaceBase = \"/home/user\"\n  ) {\n    this.fs = new BedrockSandboxFileSystem(\n      client,\n      codeInterpreterIdentifier,\n      sessionId,\n      workspaceBase\n    );\n  }\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    let cmd = command;\n    if (options?.cwd) cmd = `cd \"${options.cwd}\" && ${cmd}`;\n    if (options?.env) {\n      const exports = Object.entries(options.env)\n        .map(([k, v]) => `export ${k}=\"${v.replace(/\"/g, '\\\\\"')}\"`)\n        .join(\" && \");\n      cmd = `${exports} && ${cmd}`;\n    }\n\n    const resp = await this.client.send(\n      new InvokeCodeInterpreterCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        sessionId: this.sessionId,\n        name: \"executeCommand\",\n        arguments: { command: cmd },\n      })\n    );\n\n    if (!resp.stream)\n      throw new Error(\"No stream in code interpreter response\");\n    return consumeExecStream(resp.stream);\n  }\n\n  async destroy(): Promise<void> {\n    await this.client.send(\n      new StopCodeInterpreterSessionCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        sessionId: this.sessionId,\n      })\n    );\n  }\n}\n\n// ============================================================================\n// BedrockSandboxProvider\n// ============================================================================\n\nexport class BedrockSandboxProvider\n  implements SandboxProvider<BedrockSandboxCreateOptions, BedrockSandbox>\n{\n  readonly id = \"bedrock\";\n  readonly capabilities: SandboxCapabilities = {\n    filesystem: true,\n    execution: true,\n    persistence: false,\n  };\n\n  private client: BedrockAgentCoreClient;\n  private readonly codeInterpreterIdentifier: string;\n  private readonly defaultWorkspaceBase: string;\n\n  constructor(config: BedrockSandboxConfig) {\n    this.client = new BedrockAgentCoreClient(config.clientConfig ?? {});\n    this.codeInterpreterIdentifier = config.codeInterpreterIdentifier;\n    this.defaultWorkspaceBase = config.workspaceBase ?? \"/home/user\";\n  }\n\n  async create(\n    options?: BedrockSandboxCreateOptions\n  ): Promise<SandboxCreateResult> {\n    const resp = await this.client.send(\n      new StartCodeInterpreterSessionCommand({\n        codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n        name: options?.name,\n        sessionTimeoutSeconds: options?.sessionTimeoutSeconds,\n      })\n    );\n\n    const sessionId = resp.sessionId ?? \"\";\n    if (!sessionId) throw new Error(\"No sessionId returned from Bedrock\");\n    const sandbox = new BedrockSandboxImpl(\n      sessionId,\n      this.client,\n      this.codeInterpreterIdentifier,\n      sessionId,\n      this.defaultWorkspaceBase\n    );\n\n    if (options?.initialFiles) {\n      for (const [path, content] of Object.entries(options.initialFiles)) {\n        await sandbox.fs.writeFile(path, content);\n      }\n    }\n\n    if (options?.env) {\n      const exports = Object.entries(options.env)\n        .map(([k, v]) => `${k}=\"${v.replace(/\"/g, '\\\\\"')}\"`)\n        .join(\" \");\n      await sandbox.exec(`echo '${exports}' >> ~/.bashrc`);\n    }\n\n    return { sandbox };\n  }\n\n  async get(sandboxId: string): Promise<BedrockSandbox> {\n    try {\n      const resp = await this.client.send(\n        new GetCodeInterpreterSessionCommand({\n          codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n          sessionId: sandboxId,\n        })\n      );\n\n      if (resp.status === \"TERMINATED\") {\n        throw new SandboxNotFoundError(sandboxId);\n      }\n\n      return new BedrockSandboxImpl(\n        sandboxId,\n        this.client,\n        this.codeInterpreterIdentifier,\n        sandboxId,\n        this.defaultWorkspaceBase\n      );\n    } catch (err) {\n      if (err instanceof SandboxNotFoundError) throw err;\n      throw new SandboxNotFoundError(sandboxId);\n    }\n  }\n\n  async destroy(sandboxId: string): Promise<void> {\n    try {\n      await this.client.send(\n        new StopCodeInterpreterSessionCommand({\n          codeInterpreterIdentifier: this.codeInterpreterIdentifier,\n          sessionId: sandboxId,\n        })\n      );\n    } catch {\n      // Already stopped or not found\n    }\n  }\n\n  async pause(_sandboxId: string, _ttlSeconds?: number): Promise<void> {\n    throw new SandboxNotSupportedError(\"pause\");\n  }\n\n  async snapshot(_sandboxId: string): Promise<SandboxSnapshot> {\n    throw new SandboxNotSupportedError(\"snapshot\");\n  }\n\n  async restore(_snapshot: SandboxSnapshot): Promise<never> {\n    throw new SandboxNotSupportedError(\"restore\");\n  }\n\n  async fork(_sandboxId: string): Promise<Sandbox> {\n    throw new SandboxNotSupportedError(\"fork\");\n  }\n}\n\n// Re-exports\nexport { BedrockSandboxFileSystem } from \"./filesystem\";\nexport type {\n  BedrockSandbox,\n  BedrockSandboxConfig,\n  BedrockSandboxCreateOptions,\n} from \"./types\";\n"]}

package/dist/adapters/sandbox/bedrock/index.d.cts

@@ -1,6 +1,6 @@
 import { b as SandboxProvider, c as SandboxCapabilities, e as SandboxCreateResult, f as SandboxSnapshot, S as Sandbox } from '../../../types-ChAMwU3q.cjs';
-import { B as BedrockSandboxCreateOptions, a as BedrockSandbox, b as BedrockSandboxConfig } from '../../../types-DhTCEMhr.cjs';
-export { c as BedrockSandboxFileSystem } from '../../../types-DhTCEMhr.cjs';
+import { B as BedrockSandboxCreateOptions, a as BedrockSandbox, b as BedrockSandboxConfig } from '../../../types-ZHs2v9Ap.cjs';
+export { c as BedrockSandboxFileSystem } from '../../../types-ZHs2v9Ap.cjs';
 import '@temporalio/common';
 import '@aws-sdk/client-bedrock-agentcore';
 

package/dist/adapters/sandbox/bedrock/index.d.ts

@@ -1,6 +1,6 @@
 import { b as SandboxProvider, c as SandboxCapabilities, e as SandboxCreateResult, f as SandboxSnapshot, S as Sandbox } from '../../../types-ChAMwU3q.js';
-import { B as BedrockSandboxCreateOptions, a as BedrockSandbox, b as BedrockSandboxConfig } from '../../../types-d9NznUqd.js';
-export { c as BedrockSandboxFileSystem } from '../../../types-d9NznUqd.js';
+import { B as BedrockSandboxCreateOptions, a as BedrockSandbox, b as BedrockSandboxConfig } from '../../../types-BdCdR41N.js';
+export { c as BedrockSandboxFileSystem } from '../../../types-BdCdR41N.js';
 import '@temporalio/common';
 import '@aws-sdk/client-bedrock-agentcore';
 

package/dist/adapters/sandbox/bedrock/index.js

@@ -53,8 +53,31 @@ var BedrockSandboxFileSystem = class {
     this.workspaceBase = posix.resolve("/", workspaceBase);
   }
   workspaceBase;
+  /**
+   * Resolve a caller-supplied path to an absolute path within the workspace.
+   * Used for shell commands that need full paths.
+   */
   normalisePath(path) {
-    return posix.resolve(this.workspaceBase, path);
+    if (posix.isAbsolute(path) && !path.startsWith(this.workspaceBase + "/") && path !== this.workspaceBase) {
+      path = path.replace(/^\/+/, "");
+    }
+    const resolved = posix.resolve(this.workspaceBase, path);
+    if (!resolved.startsWith(this.workspaceBase + "/") && resolved !== this.workspaceBase) {
+      throw new Error(
+        `Invalid file path: "${resolved}" escapes workspace "${this.workspaceBase}"`
+      );
+    }
+    return resolved;
+  }
+  /**
+   * Return a workspace-relative path for Bedrock tool invocations
+   * (`writeFiles`, `readFiles`, `listFiles`, `removeFiles`), which
+   * reject absolute paths as "path traversal".
+   */
+  toToolPath(path) {
+    const abs = this.normalisePath(path);
+    const prefix = this.workspaceBase + "/";
+    return abs.startsWith(prefix) ? abs.slice(prefix.length) : abs;
   }
   async invoke(name, args) {
     const resp = await this.client.send(
@@ -79,9 +102,9 @@ var BedrockSandboxFileSystem = class {
     };
   }
   async readFile(path) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const result = await this.invoke("readFiles", {
-      paths: [norm]
+      paths: [rel]
     });
     for (const block of result.content ?? []) {
       if (block.resource?.text != null) return block.resource.text;
@@ -90,9 +113,9 @@ var BedrockSandboxFileSystem = class {
     return "";
   }
   async readFileBuffer(path) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const result = await this.invoke("readFiles", {
-      paths: [norm]
+      paths: [rel]
     });
     for (const block of result.content ?? []) {
       if (block.resource?.blob) return block.resource.blob;
@@ -104,12 +127,12 @@ var BedrockSandboxFileSystem = class {
     return new Uint8Array(0);
   }
   async writeFile(path, content) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const isText = typeof content === "string";
     const result = await this.invoke("writeFiles", {
       content: [
         {
-          path: norm,
+          path: rel,
           ...isText ? { text: content } : { blob: content }
         }
       ]
@@ -162,15 +185,16 @@ var BedrockSandboxFileSystem = class {
     if (exitCode !== 0) throw new Error(`mkdir failed: ${stderr}`);
   }
   async readdir(path) {
-    const norm = this.normalisePath(path);
+    const rel = this.toToolPath(path);
     const result = await this.invoke("listFiles", {
-      directoryPath: norm
+      directoryPath: rel
     });
     const names = [];
     for (const block of result.content ?? []) {
       if (block.name) names.push(block.name);
     }
     if (names.length > 0) return names;
+    const norm = this.normalisePath(path);
     const { stdout, exitCode, stderr } = await this.execShell(
       `ls -1A "${norm}"`
     );
@@ -206,8 +230,9 @@ var BedrockSandboxFileSystem = class {
         throw new Error(`rm failed: ${stderr}`);
       return;
     }
+    const rel = this.toToolPath(path);
     const result = await this.invoke("removeFiles", {
-      paths: [norm]
+      paths: [rel]
     });
     if (result.isError) {
       const msg = result.content?.map((b) => b.text).join("") ?? "rm failed";