@agimon-ai/doompi-sandbox 0.0.1-alpha.71 → 0.0.1-alpha.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agimon-ai/doompi-sandbox",
-  "version": "0.0.1-alpha.71",
+  "version": "0.0.1-alpha.74",
   "description": "Container sandbox for DoomPi launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host",
   "keywords": [
     "ai",
@@ -34,7 +34,8 @@
   ],
   "type": "module",
   "main": "./dist/index.cjs",
-  "types": "./dist/index.d.mts",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.cts",
   "jsnext:main": "./dist/index.mjs",
   "exports": {
     ".": {
@@ -42,15 +43,15 @@
       "import": "./dist/index.mjs",
       "require": "./dist/index.cjs"
     },
-    "./cockpit-harness": {
-      "types": "./dist/cockpitHarness.d.mts",
-      "import": "./dist/cockpitHarness.mjs",
-      "require": "./dist/cockpitHarness.cjs"
+    "./api-contracts": {
+      "types": "./dist/api-contracts.d.mts",
+      "import": "./dist/api-contracts.mjs",
+      "require": "./dist/api-contracts.cjs"
     },
-    "./sandbox-harness": {
-      "types": "./dist/sandboxHarness.d.mts",
-      "import": "./dist/sandboxHarness.mjs",
-      "require": "./dist/sandboxHarness.cjs"
+    "./cockpit-harness": {
+      "types": "./dist/cockpit-harness.d.mts",
+      "import": "./dist/cockpit-harness.mjs",
+      "require": "./dist/cockpit-harness.cjs"
     },
     "./extensions/pi": {
       "types": "./dist/extensions/pi.d.mts",
@@ -62,17 +63,23 @@
       "import": "./dist/extensions/server.mjs",
       "require": "./dist/extensions/server.cjs"
     },
+    "./sandbox-harness": {
+      "types": "./dist/sandbox-harness.d.mts",
+      "import": "./dist/sandbox-harness.mjs",
+      "require": "./dist/sandbox-harness.cjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@agimon-ai/doompi-core": "0.0.1-alpha.72",
+    "@agimon-ai/doompi-core": "0.0.1-alpha.75",
     "@deepseek-ai/cordis": "4.0.2"
   },
   "devDependencies": {
-    "@agimon-ai/vibe-lint-plugin-doom-extension": "0.0.1-alpha.67",
+    "@agimon-ai/doompi-build": "0.0.1-alpha.4",
+    "@agimon-ai/vibe-lint-plugin-doom-extension": "0.0.1-alpha.70",
     "@earendil-works/pi-coding-agent": "0.85.1",
     "@types/node": "26.5.1",
     "@vitest/coverage-v8": "5.0.0",
@@ -92,7 +99,7 @@
     "node": ">=22.19.0"
   },
   "doompiServer": {
-    "entry": "./src/extensions/server.ts",
+    "entry": "./generated/server.ts",
     "dist": "./dist/extensions/server.mjs",
     "scopes": [
       "session"

package/dist/_virtual/_rolldown/runtime.cjs

@@ -1 +0,0 @@
-var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,s)=>(s=n==null?{}:e(i(n)),o(r||!n||!n.__esModule||!a.call(n,`default`)?t(s,`default`,{value:n,enumerable:!0}):s,n));exports.__toESM=s;

package/dist/api-contracts.cjs

@@ -1 +0,0 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("./src/schemas/apiContracts.cjs");exports.apiContracts=e.apiContracts,exports.default=e.apiContracts;

package/dist/api-contracts.d.cts

@@ -1,2 +0,0 @@
-import { apiContracts } from "./src/schemas/apiContracts.cjs";
-export { apiContracts, apiContracts as default };

package/dist/api-contracts.d.mts

@@ -1,2 +0,0 @@
-import { apiContracts } from "./src/schemas/apiContracts.mjs";
-export { apiContracts, apiContracts as default };

package/dist/api-contracts.mjs

@@ -1 +0,0 @@
-import{apiContracts as e}from"./src/schemas/apiContracts.mjs";export{e as apiContracts,e as default};

package/dist/cockpitHarness.cjs

@@ -1 +0,0 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./src/services/cockpitHarness/index.cjs");exports.createCockpitHarness=e.createCockpitHarness,exports.reapCockpitContainer=e.reapCockpitContainer,exports.startCockpitContainer=e.startCockpitContainer;

package/dist/cockpitHarness.d.cts

@@ -1,2 +0,0 @@
-import { CockpitHarnessDependencies, createCockpitHarness, reapCockpitContainer, startCockpitContainer } from "./src/services/cockpitHarness/index.cjs";
-export { type CockpitHarnessDependencies, createCockpitHarness, reapCockpitContainer, startCockpitContainer };

package/dist/cockpitHarness.d.mts

@@ -1,2 +0,0 @@
-import { CockpitHarnessDependencies, createCockpitHarness, reapCockpitContainer, startCockpitContainer } from "./src/services/cockpitHarness/index.mjs";
-export { type CockpitHarnessDependencies, createCockpitHarness, reapCockpitContainer, startCockpitContainer };

package/dist/cockpitHarness.mjs

@@ -1 +0,0 @@
-import{createCockpitHarness as e,reapCockpitContainer as t,startCockpitContainer as n}from"./src/services/cockpitHarness/index.mjs";export{e as createCockpitHarness,t as reapCockpitContainer,n as startCockpitContainer};

package/dist/extensions/pi.cjs

@@ -1,2 +0,0 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../src/services/extensionService/index.cjs"),t=require("../src/controllers/doomSandboxCommand.cjs"),n=require("../src/services/brokerProviders/index.cjs"),r=(0,require("@agimon-ai/doompi-core/pi-extension").definePiExtension)(`@agimon-ai/doompi-sandbox`,({options:r})=>({commands:[t.createSandboxCommand(r?.service??new e.DefaultSandboxExtensionService(process.env))],providers:n.brokeredProviderOverrides(process.env).map(({provider:e,baseUrl:t})=>[e,{baseUrl:t}]),resources:[{source:`@agimon-ai/doompi-sandbox`,moduleUrl:require("url").pathToFileURL(__filename).href,skills:[{name:`doompi-use-sandbox`,description:`Use @agimon-ai/doompi-sandbox: Container sandbox for DoomPi launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host`}]}]}));exports.activateSandboxExtension=r,exports.default=r;
-//# sourceMappingURL=pi.cjs.map

package/dist/extensions/pi.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"pi.cjs","names":["definePiExtension","createSandboxCommand","DefaultSandboxExtensionService","brokeredProviderOverrides"],"sources":["../../src/extensions/pi.ts"],"sourcesContent":["import { definePiExtension } from '@agimon-ai/doompi-core/pi-extension';\n\nimport { createSandboxCommand } from '../controllers/doomSandboxCommand';\nimport { brokeredProviderOverrides } from '../services/brokerProviders';\nimport { DefaultSandboxExtensionService } from '../services/extensionService';\nimport type { SandboxExtensionDependencies } from '../types/extension';\nexport const activateSandboxExtension = definePiExtension<SandboxExtensionDependencies>(\n  '@agimon-ai/doompi-sandbox',\n  ({ options }) => ({\n    commands: [createSandboxCommand(options?.service ?? new DefaultSandboxExtensionService(process.env))],\n    providers: brokeredProviderOverrides(process.env).map(({ provider, baseUrl }) => [provider, { baseUrl }] as const),\n    resources: [\n      {\n        source: '@agimon-ai/doompi-sandbox',\n        moduleUrl: import.meta.url,\n        skills: [\n          {\n            name: 'doompi-use-sandbox',\n            description:\n              'Use @agimon-ai/doompi-sandbox: Container sandbox for DoomPi launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host',\n          },\n        ],\n      },\n    ],\n  }),\n);\nexport default activateSandboxExtension;\n"],"mappings":"2QAMa,GAAA,+CAA2BA,CAAAA,CAAAA,kBAAAA,CACtC,6BACC,CAAE,cAAe,CAChB,SAAU,CAACC,EAAAA,qBAAqB,GAAS,SAAW,IAAIC,EAAAA,+BAA+B,QAAQ,GAAG,CAAC,CAAC,EACpG,UAAWC,EAAAA,0BAA0B,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAE,WAAU,aAAc,CAAC,EAAU,CAAE,SAAQ,CAAC,CAAU,EACjH,UAAW,CACT,CACE,OAAQ,4BACR,UAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,KACA,OAAQ,CACN,CACE,KAAM,qBACN,YACE,yKACJ,CACF,CACF,CACF,CACF,EACF"}

package/dist/extensions/pi.d.cts

@@ -1,6 +0,0 @@
-import { SandboxExtensionDependencies } from "../src/types/extension.cjs";
-//#region src/extensions/pi.d.ts
-export declare const activateSandboxExtension: import("@agimon-ai/doompi-core/runtime-pi-extension").DefinedPiExtension<SandboxExtensionDependencies>;
-//#endregion
-export { activateSandboxExtension as default };
-//# sourceMappingURL=pi.d.cts.map

package/dist/extensions/pi.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pi.d.cts","names":[],"sources":["../../src/extensions/pi.ts"],"mappings":";;qBAMa,gFAAwB,mBAAA"}

package/dist/extensions/pi.d.mts

@@ -1,6 +0,0 @@
-import { SandboxExtensionDependencies } from "../src/types/extension.mjs";
-//#region src/extensions/pi.d.ts
-export declare const activateSandboxExtension: import("@agimon-ai/doompi-core/runtime-pi-extension").DefinedPiExtension<SandboxExtensionDependencies>;
-//#endregion
-export { activateSandboxExtension as default };
-//# sourceMappingURL=pi.d.mts.map

package/dist/extensions/pi.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pi.d.mts","names":[],"sources":["../../src/extensions/pi.ts"],"mappings":";;qBAMa,gFAAwB,mBAAA"}

package/dist/extensions/pi.mjs

@@ -1,2 +0,0 @@
-import{DefaultSandboxExtensionService as e}from"../src/services/extensionService/index.mjs";import{createSandboxCommand as t}from"../src/controllers/doomSandboxCommand.mjs";import{brokeredProviderOverrides as n}from"../src/services/brokerProviders/index.mjs";import{definePiExtension as r}from"@agimon-ai/doompi-core/pi-extension";const i=r(`@agimon-ai/doompi-sandbox`,({options:r})=>({commands:[t(r?.service??new e(process.env))],providers:n(process.env).map(({provider:e,baseUrl:t})=>[e,{baseUrl:t}]),resources:[{source:`@agimon-ai/doompi-sandbox`,moduleUrl:import.meta.url,skills:[{name:`doompi-use-sandbox`,description:`Use @agimon-ai/doompi-sandbox: Container sandbox for DoomPi launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host`}]}]}));export{i as activateSandboxExtension,i as default};
-//# sourceMappingURL=pi.mjs.map

package/dist/extensions/pi.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"pi.mjs","names":[],"sources":["../../src/extensions/pi.ts"],"sourcesContent":["import { definePiExtension } from '@agimon-ai/doompi-core/pi-extension';\n\nimport { createSandboxCommand } from '../controllers/doomSandboxCommand';\nimport { brokeredProviderOverrides } from '../services/brokerProviders';\nimport { DefaultSandboxExtensionService } from '../services/extensionService';\nimport type { SandboxExtensionDependencies } from '../types/extension';\nexport const activateSandboxExtension = definePiExtension<SandboxExtensionDependencies>(\n  '@agimon-ai/doompi-sandbox',\n  ({ options }) => ({\n    commands: [createSandboxCommand(options?.service ?? new DefaultSandboxExtensionService(process.env))],\n    providers: brokeredProviderOverrides(process.env).map(({ provider, baseUrl }) => [provider, { baseUrl }] as const),\n    resources: [\n      {\n        source: '@agimon-ai/doompi-sandbox',\n        moduleUrl: import.meta.url,\n        skills: [\n          {\n            name: 'doompi-use-sandbox',\n            description:\n              'Use @agimon-ai/doompi-sandbox: Container sandbox for DoomPi launches: the agent, extensions, and tools run inside Docker or Podman while the terminal stays on the host',\n          },\n        ],\n      },\n    ],\n  }),\n);\nexport default activateSandboxExtension;\n"],"mappings":"2UAMA,MAAa,EAA2B,EACtC,6BACC,CAAE,cAAe,CAChB,SAAU,CAAC,EAAqB,GAAS,SAAW,IAAI,EAA+B,QAAQ,GAAG,CAAC,CAAC,EACpG,UAAW,EAA0B,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAE,WAAU,aAAc,CAAC,EAAU,CAAE,SAAQ,CAAC,CAAU,EACjH,UAAW,CACT,CACE,OAAQ,4BACR,UAAW,YAAY,IACvB,OAAQ,CACN,CACE,KAAM,qBACN,YACE,yKACJ,CACF,CACF,CACF,CACF,EACF"}

package/dist/extensions/server.cjs

@@ -1,2 +0,0 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../src/controllers/serverRuntime.cjs"),t=(0,require("@agimon-ai/doompi-core/server-facet").defineServerPlugin)({name:`@agimon-ai/doompi-sandbox`,session:({agent:t})=>t?e.createSandboxServerRuntime(t.context.environment):{}});exports.default=t,exports.sandboxServerFacet=t;
-//# sourceMappingURL=server.cjs.map

package/dist/extensions/server.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.cjs","names":["defineServerPlugin","createSandboxServerRuntime"],"sources":["../../src/extensions/server.ts"],"sourcesContent":["import { defineServerPlugin } from '@agimon-ai/doompi-core/server-facet';\n\nimport { createSandboxServerRuntime } from '../controllers/serverRuntime';\nexport const sandboxServerFacet = defineServerPlugin({\n  name: '@agimon-ai/doompi-sandbox',\n  session: ({ agent }) => (agent ? createSandboxServerRuntime(agent.context.environment) : {}),\n});\nexport default sandboxServerFacet;\n"],"mappings":"uJAGa,GAAA,+CAAqBA,CAAAA,CAAAA,mBAAAA,CAAmB,CACnD,KAAM,4BACN,SAAU,CAAE,WAAa,EAAQC,EAAAA,2BAA2B,EAAM,QAAQ,WAAW,EAAI,CAAC,CAC5F,CAAC"}

package/dist/extensions/server.d.cts

@@ -1,5 +0,0 @@
-//#region src/extensions/server.d.ts
-export declare const sandboxServerFacet: import("@agimon-ai/doompi-core/server-facet").DoomServerFacet;
-//#endregion
-export { sandboxServerFacet as default };
-//# sourceMappingURL=server.d.cts.map

package/dist/extensions/server.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.d.cts","names":[],"sources":["../../src/extensions/server.ts"],"mappings":";qBAGa,kEAAkB"}

package/dist/extensions/server.d.mts

@@ -1,5 +0,0 @@
-//#region src/extensions/server.d.ts
-export declare const sandboxServerFacet: import("@agimon-ai/doompi-core/server-facet").DoomServerFacet;
-//#endregion
-export { sandboxServerFacet as default };
-//# sourceMappingURL=server.d.mts.map

package/dist/extensions/server.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.d.mts","names":[],"sources":["../../src/extensions/server.ts"],"mappings":";qBAGa,kEAAkB"}

package/dist/extensions/server.mjs

@@ -1,2 +0,0 @@
-import{createSandboxServerRuntime as e}from"../src/controllers/serverRuntime.mjs";import{defineServerPlugin as t}from"@agimon-ai/doompi-core/server-facet";const n=t({name:`@agimon-ai/doompi-sandbox`,session:({agent:t})=>t?e(t.context.environment):{}});export{n as default,n as sandboxServerFacet};
-//# sourceMappingURL=server.mjs.map

package/dist/extensions/server.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.mjs","names":[],"sources":["../../src/extensions/server.ts"],"sourcesContent":["import { defineServerPlugin } from '@agimon-ai/doompi-core/server-facet';\n\nimport { createSandboxServerRuntime } from '../controllers/serverRuntime';\nexport const sandboxServerFacet = defineServerPlugin({\n  name: '@agimon-ai/doompi-sandbox',\n  session: ({ agent }) => (agent ? createSandboxServerRuntime(agent.context.environment) : {}),\n});\nexport default sandboxServerFacet;\n"],"mappings":"2JAGA,MAAa,EAAqB,EAAmB,CACnD,KAAM,4BACN,SAAU,CAAE,WAAa,EAAQ,EAA2B,EAAM,QAAQ,WAAW,EAAI,CAAC,CAC5F,CAAC"}

package/dist/index.cjs

@@ -1 +0,0 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./src/services/extensionService/index.cjs");exports.DefaultSandboxExtensionService=e.DefaultSandboxExtensionService;

package/dist/index.d.cts

@@ -1,3 +0,0 @@
-import { SandboxExtensionDependencies, SandboxExtensionResult, SandboxExtensionService } from "./src/types/extension.cjs";
-import { DefaultSandboxExtensionService } from "./src/services/extensionService/index.cjs";
-export { DefaultSandboxExtensionService, type SandboxExtensionDependencies, type SandboxExtensionResult, type SandboxExtensionService };

package/dist/index.d.mts

@@ -1,3 +0,0 @@
-import { SandboxExtensionDependencies, SandboxExtensionResult, SandboxExtensionService } from "./src/types/extension.mjs";
-import { DefaultSandboxExtensionService } from "./src/services/extensionService/index.mjs";
-export { DefaultSandboxExtensionService, type SandboxExtensionDependencies, type SandboxExtensionResult, type SandboxExtensionService };

package/dist/index.mjs

@@ -1 +0,0 @@
-import{DefaultSandboxExtensionService as e}from"./src/services/extensionService/index.mjs";export{e as DefaultSandboxExtensionService};

package/dist/sandboxHarness.cjs

@@ -1 +0,0 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./src/services/harness/index.cjs");exports.createSandboxLauncher=e.createSandboxLauncher,exports.launchSandbox=e.launchSandbox;

package/dist/sandboxHarness.d.cts

@@ -1,2 +0,0 @@
-import { SandboxLauncherDependencies, createSandboxLauncher, launchSandbox } from "./src/services/harness/index.cjs";
-export { type SandboxLauncherDependencies, createSandboxLauncher, launchSandbox };

package/dist/sandboxHarness.d.mts

@@ -1,2 +0,0 @@
-import { SandboxLauncherDependencies, createSandboxLauncher, launchSandbox } from "./src/services/harness/index.mjs";
-export { type SandboxLauncherDependencies, createSandboxLauncher, launchSandbox };

package/dist/sandboxHarness.mjs

@@ -1 +0,0 @@
-import{createSandboxLauncher as e,launchSandbox as t}from"./src/services/harness/index.mjs";export{e as createSandboxLauncher,t as launchSandbox};

package/dist/src/constants/sandbox.cjs

@@ -1,2 +0,0 @@
-exports.BROKER_DISABLED_ENV=`DOOMPI_SANDBOX_BROKER`,exports.BROKER_STATUS_SOURCE=`doompi-sandbox-broker`,exports.COMMAND_DESCRIPTION=`Show sandbox container status for this session`,exports.COMMAND_NAME=`doom-sandbox`;
-//# sourceMappingURL=sandbox.cjs.map

package/dist/src/constants/sandbox.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.cjs","names":[],"sources":["../../../src/constants/sandbox.ts"],"sourcesContent":["export const COMMAND_NAME = 'doom-sandbox';\nexport const COMMAND_DESCRIPTION = 'Show sandbox container status for this session';\n\nexport const BROKER_DISABLED_ENV = 'DOOMPI_SANDBOX_BROKER';\nexport const DISABLED_VALUE = '0';\nexport const BROKER_STATUS_SOURCE = 'doompi-sandbox-broker';\n"],"mappings":""}

package/dist/src/constants/sandbox.mjs

@@ -1,2 +0,0 @@
-const e=`doom-sandbox`,t=`Show sandbox container status for this session`,n=`DOOMPI_SANDBOX_BROKER`,r=`doompi-sandbox-broker`;export{n as BROKER_DISABLED_ENV,r as BROKER_STATUS_SOURCE,t as COMMAND_DESCRIPTION,e as COMMAND_NAME};
-//# sourceMappingURL=sandbox.mjs.map

package/dist/src/constants/sandbox.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.mjs","names":[],"sources":["../../../src/constants/sandbox.ts"],"sourcesContent":["export const COMMAND_NAME = 'doom-sandbox';\nexport const COMMAND_DESCRIPTION = 'Show sandbox container status for this session';\n\nexport const BROKER_DISABLED_ENV = 'DOOMPI_SANDBOX_BROKER';\nexport const DISABLED_VALUE = '0';\nexport const BROKER_STATUS_SOURCE = 'doompi-sandbox-broker';\n"],"mappings":"AAAA,MAAa,EAAe,eACf,EAAsB,iDAEtB,EAAsB,wBAEtB,EAAuB"}

package/dist/src/controllers/doomSandboxCommand.cjs

@@ -1,2 +0,0 @@
-const e=require("../constants/sandbox.cjs");let t=require("@agimon-ai/doompi-core/pi-extension");function n(n){return(0,t.defineCommand)({name:e.COMMAND_NAME,description:e.COMMAND_DESCRIPTION,async execute(e,t){let r=await n.execute();await t.notify({body:r.message,level:r.level})}})}exports.createSandboxCommand=n;
-//# sourceMappingURL=doomSandboxCommand.cjs.map

package/dist/src/controllers/doomSandboxCommand.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"doomSandboxCommand.cjs","names":["defineCommand","COMMAND_NAME","COMMAND_DESCRIPTION"],"sources":["../../../src/controllers/doomSandboxCommand.ts"],"sourcesContent":["import { defineCommand } from '@agimon-ai/doompi-core/pi-extension';\n\nimport { COMMAND_DESCRIPTION, COMMAND_NAME } from '../constants/sandbox';\nimport type { SandboxExtensionService } from '../types/extension';\nexport function createSandboxCommand(service: SandboxExtensionService) {\n  return defineCommand({\n    name: COMMAND_NAME,\n    description: COMMAND_DESCRIPTION,\n    async execute(_args, execution) {\n      const result = await service.execute();\n      await execution.notify({ body: result.message, level: result.level });\n    },\n  });\n}\n"],"mappings":"iGAIA,SAAgB,EAAqB,EAAkC,CACrE,OAAA,EAAOA,EAAAA,cAAAA,CAAc,CACnB,KAAMC,EAAAA,aACN,YAAaC,EAAAA,oBACb,MAAM,QAAQ,EAAO,EAAW,CAC9B,IAAM,EAAS,MAAM,EAAQ,QAAQ,EACrC,MAAM,EAAU,OAAO,CAAE,KAAM,EAAO,QAAS,MAAO,EAAO,KAAM,CAAC,CACtE,CACF,CAAC,CACH"}

package/dist/src/controllers/doomSandboxCommand.mjs

@@ -1,2 +0,0 @@
-import{COMMAND_DESCRIPTION as e,COMMAND_NAME as t}from"../constants/sandbox.mjs";import{defineCommand as n}from"@agimon-ai/doompi-core/pi-extension";function r(r){return n({name:t,description:e,async execute(e,t){let n=await r.execute();await t.notify({body:n.message,level:n.level})}})}export{r as createSandboxCommand};
-//# sourceMappingURL=doomSandboxCommand.mjs.map

package/dist/src/controllers/doomSandboxCommand.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"doomSandboxCommand.mjs","names":[],"sources":["../../../src/controllers/doomSandboxCommand.ts"],"sourcesContent":["import { defineCommand } from '@agimon-ai/doompi-core/pi-extension';\n\nimport { COMMAND_DESCRIPTION, COMMAND_NAME } from '../constants/sandbox';\nimport type { SandboxExtensionService } from '../types/extension';\nexport function createSandboxCommand(service: SandboxExtensionService) {\n  return defineCommand({\n    name: COMMAND_NAME,\n    description: COMMAND_DESCRIPTION,\n    async execute(_args, execution) {\n      const result = await service.execute();\n      await execution.notify({ body: result.message, level: result.level });\n    },\n  });\n}\n"],"mappings":"qJAIA,SAAgB,EAAqB,EAAkC,CACrE,OAAO,EAAc,CACnB,KAAM,EACN,YAAa,EACb,MAAM,QAAQ,EAAO,EAAW,CAC9B,IAAM,EAAS,MAAM,EAAQ,QAAQ,EACrC,MAAM,EAAU,OAAO,CAAE,KAAM,EAAO,QAAS,MAAO,EAAO,KAAM,CAAC,CACtE,CACF,CAAC,CACH"}

package/dist/src/controllers/serverRuntime.cjs

@@ -1,2 +0,0 @@
-const e=require("../services/brokerHost/index.cjs"),t=require("../services/extensionService/index.cjs"),n=require("../constants/sandbox.cjs"),r=require("./doomSandboxCommand.cjs"),i=require("../services/packageResource/index.cjs");function a(a){let o=new t.DefaultSandboxExtensionService(a),s=[{name:`doompi-sandbox`,kind:`context`,read:()=>i.readPackageResource(`llms.txt`)},{name:`doompi-use-sandbox`,kind:`skill`,read:()=>i.readPackageResource(`src/prompts/doompi-use-sandbox/SKILL.md`)},{name:`doompi-sandbox-readme`,kind:`context`,read:()=>i.readPackageResource(`README.md`)}],c;return{resources:s,activities:[{name:n.BROKER_STATUS_SOURCE,async start(t){if(t.environment.DOOMPI_SANDBOX_BROKER===`0`)return()=>void 0;let r=await e.startBroker({environment:t.environment,onDenied:e=>{t.client.notify({title:`DoomPi sandbox broker`,body:`Broker refused a call: ${e}`,level:`warning`})}});return c=r,r===void 0?()=>void 0:(t.client.setStatus(n.BROKER_STATUS_SOURCE,`provider broker: ${r.providers.join(`, `)}`),async()=>{c===r&&(c=void 0,t.client.setStatus(n.BROKER_STATUS_SOURCE,void 0),await r.stop())})}}],commands:[r.createSandboxCommand(o)]}}exports.createSandboxServerRuntime=a;
-//# sourceMappingURL=serverRuntime.cjs.map

package/dist/src/controllers/serverRuntime.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverRuntime.cjs","names":["DefaultSandboxExtensionService","readPackageResource","BROKER_STATUS_SOURCE","startBroker","createSandboxCommand"],"sources":["../../../src/controllers/serverRuntime.ts"],"sourcesContent":["import { type DoomHeadlessActivity, type DoomHeadlessResource } from '@agimon-ai/doompi-core/headless';\nimport type { DoomServerSessionPlugin } from '@agimon-ai/doompi-core/server-facet';\n\nimport { BROKER_DISABLED_ENV, DISABLED_VALUE, BROKER_STATUS_SOURCE } from '../constants/sandbox';\nimport { startBroker, type RunningBroker } from '../services/brokerHost';\nimport { DefaultSandboxExtensionService } from '../services/extensionService';\nimport { readPackageResource } from '../services/packageResource';\nimport { createSandboxCommand } from './doomSandboxCommand';\n\nexport function createSandboxServerRuntime(\n  environment: Readonly<Record<string, string | undefined>>,\n): DoomServerSessionPlugin {\n  const service = new DefaultSandboxExtensionService(environment);\n\n  const resources: DoomHeadlessResource[] = [\n    { name: 'doompi-sandbox', kind: 'context', read: () => readPackageResource('llms.txt') },\n    {\n      name: 'doompi-use-sandbox',\n      kind: 'skill',\n      read: () => readPackageResource('src/prompts/doompi-use-sandbox/SKILL.md'),\n    },\n    { name: 'doompi-sandbox-readme', kind: 'context', read: () => readPackageResource('README.md') },\n  ];\n\n  let broker: RunningBroker | undefined;\n  const activity: DoomHeadlessActivity = {\n    name: BROKER_STATUS_SOURCE,\n    async start(execution) {\n      if (execution.environment[BROKER_DISABLED_ENV] === DISABLED_VALUE) return () => undefined;\n      const started = await startBroker({\n        environment: execution.environment,\n        onDenied: (reason) => {\n          void execution.client.notify({\n            title: 'DoomPi sandbox broker',\n            body: `Broker refused a call: ${reason}`,\n            level: 'warning',\n          });\n        },\n      });\n      broker = started;\n      if (started === undefined) return () => undefined;\n      execution.client.setStatus(BROKER_STATUS_SOURCE, `provider broker: ${started.providers.join(', ')}`);\n      return async () => {\n        if (broker !== started) return;\n        broker = undefined;\n        execution.client.setStatus(BROKER_STATUS_SOURCE, undefined);\n        await started.stop();\n      };\n    },\n  };\n\n  return { resources, activities: [activity], commands: [createSandboxCommand(service)] };\n}\n"],"mappings":"uOASA,SAAgB,EACd,EACyB,CACzB,IAAM,EAAU,IAAIA,EAAAA,+BAA+B,CAAW,EAExD,EAAoC,CACxC,CAAE,KAAM,iBAAkB,KAAM,UAAW,SAAYC,EAAAA,oBAAoB,UAAU,CAAE,EACvF,CACE,KAAM,qBACN,KAAM,QACN,SAAYA,EAAAA,oBAAoB,yCAAyC,CAC3E,EACA,CAAE,KAAM,wBAAyB,KAAM,UAAW,SAAYA,EAAAA,oBAAoB,WAAW,CAAE,CACjG,EAEI,EA2BJ,MAAO,CAAE,YAAW,WAAY,CAAC,CAzB/B,KAAMC,EAAAA,qBACN,MAAM,MAAM,EAAW,CACrB,GAAI,EAAU,YAAA,wBAAA,IAAqD,UAAa,IAAA,GAChF,IAAM,EAAU,MAAMC,EAAAA,YAAY,CAChC,YAAa,EAAU,YACvB,SAAW,GAAW,CACpB,EAAe,OAAO,OAAO,CAC3B,MAAO,wBACP,KAAM,0BAA0B,IAChC,MAAO,SACT,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAS,EACL,IAAY,IAAA,OAAwB,IAAA,IACxC,EAAU,OAAO,UAAUD,EAAAA,qBAAsB,oBAAoB,EAAQ,UAAU,KAAK,IAAI,GAAG,EAC5F,SAAY,CACb,IAAW,IACf,EAAS,IAAA,GACT,EAAU,OAAO,UAAUA,EAAAA,qBAAsB,IAAA,EAAS,EAC1D,MAAM,EAAQ,KAAK,EACrB,EACF,CAGsC,CAAC,EAAG,SAAU,CAACE,EAAAA,qBAAqB,CAAO,CAAC,CAAE,CACxF"}

package/dist/src/controllers/serverRuntime.mjs

@@ -1,2 +0,0 @@
-import{startBroker as e}from"../services/brokerHost/index.mjs";import{DefaultSandboxExtensionService as t}from"../services/extensionService/index.mjs";import{BROKER_STATUS_SOURCE as n}from"../constants/sandbox.mjs";import{createSandboxCommand as r}from"./doomSandboxCommand.mjs";import{readPackageResource as i}from"../services/packageResource/index.mjs";function a(a){let o=new t(a),s=[{name:`doompi-sandbox`,kind:`context`,read:()=>i(`llms.txt`)},{name:`doompi-use-sandbox`,kind:`skill`,read:()=>i(`src/prompts/doompi-use-sandbox/SKILL.md`)},{name:`doompi-sandbox-readme`,kind:`context`,read:()=>i(`README.md`)}],c;return{resources:s,activities:[{name:n,async start(t){if(t.environment.DOOMPI_SANDBOX_BROKER===`0`)return()=>void 0;let r=await e({environment:t.environment,onDenied:e=>{t.client.notify({title:`DoomPi sandbox broker`,body:`Broker refused a call: ${e}`,level:`warning`})}});return c=r,r===void 0?()=>void 0:(t.client.setStatus(n,`provider broker: ${r.providers.join(`, `)}`),async()=>{c===r&&(c=void 0,t.client.setStatus(n,void 0),await r.stop())})}}],commands:[r(o)]}}export{a as createSandboxServerRuntime};
-//# sourceMappingURL=serverRuntime.mjs.map

package/dist/src/controllers/serverRuntime.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverRuntime.mjs","names":[],"sources":["../../../src/controllers/serverRuntime.ts"],"sourcesContent":["import { type DoomHeadlessActivity, type DoomHeadlessResource } from '@agimon-ai/doompi-core/headless';\nimport type { DoomServerSessionPlugin } from '@agimon-ai/doompi-core/server-facet';\n\nimport { BROKER_DISABLED_ENV, DISABLED_VALUE, BROKER_STATUS_SOURCE } from '../constants/sandbox';\nimport { startBroker, type RunningBroker } from '../services/brokerHost';\nimport { DefaultSandboxExtensionService } from '../services/extensionService';\nimport { readPackageResource } from '../services/packageResource';\nimport { createSandboxCommand } from './doomSandboxCommand';\n\nexport function createSandboxServerRuntime(\n  environment: Readonly<Record<string, string | undefined>>,\n): DoomServerSessionPlugin {\n  const service = new DefaultSandboxExtensionService(environment);\n\n  const resources: DoomHeadlessResource[] = [\n    { name: 'doompi-sandbox', kind: 'context', read: () => readPackageResource('llms.txt') },\n    {\n      name: 'doompi-use-sandbox',\n      kind: 'skill',\n      read: () => readPackageResource('src/prompts/doompi-use-sandbox/SKILL.md'),\n    },\n    { name: 'doompi-sandbox-readme', kind: 'context', read: () => readPackageResource('README.md') },\n  ];\n\n  let broker: RunningBroker | undefined;\n  const activity: DoomHeadlessActivity = {\n    name: BROKER_STATUS_SOURCE,\n    async start(execution) {\n      if (execution.environment[BROKER_DISABLED_ENV] === DISABLED_VALUE) return () => undefined;\n      const started = await startBroker({\n        environment: execution.environment,\n        onDenied: (reason) => {\n          void execution.client.notify({\n            title: 'DoomPi sandbox broker',\n            body: `Broker refused a call: ${reason}`,\n            level: 'warning',\n          });\n        },\n      });\n      broker = started;\n      if (started === undefined) return () => undefined;\n      execution.client.setStatus(BROKER_STATUS_SOURCE, `provider broker: ${started.providers.join(', ')}`);\n      return async () => {\n        if (broker !== started) return;\n        broker = undefined;\n        execution.client.setStatus(BROKER_STATUS_SOURCE, undefined);\n        await started.stop();\n      };\n    },\n  };\n\n  return { resources, activities: [activity], commands: [createSandboxCommand(service)] };\n}\n"],"mappings":"mWASA,SAAgB,EACd,EACyB,CACzB,IAAM,EAAU,IAAI,EAA+B,CAAW,EAExD,EAAoC,CACxC,CAAE,KAAM,iBAAkB,KAAM,UAAW,SAAY,EAAoB,UAAU,CAAE,EACvF,CACE,KAAM,qBACN,KAAM,QACN,SAAY,EAAoB,yCAAyC,CAC3E,EACA,CAAE,KAAM,wBAAyB,KAAM,UAAW,SAAY,EAAoB,WAAW,CAAE,CACjG,EAEI,EA2BJ,MAAO,CAAE,YAAW,WAAY,CAAC,CAzB/B,KAAM,EACN,MAAM,MAAM,EAAW,CACrB,GAAI,EAAU,YAAA,wBAAA,IAAqD,UAAa,IAAA,GAChF,IAAM,EAAU,MAAM,EAAY,CAChC,YAAa,EAAU,YACvB,SAAW,GAAW,CACpB,EAAe,OAAO,OAAO,CAC3B,MAAO,wBACP,KAAM,0BAA0B,IAChC,MAAO,SACT,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAS,EACL,IAAY,IAAA,OAAwB,IAAA,IACxC,EAAU,OAAO,UAAU,EAAsB,oBAAoB,EAAQ,UAAU,KAAK,IAAI,GAAG,EAC5F,SAAY,CACb,IAAW,IACf,EAAS,IAAA,GACT,EAAU,OAAO,UAAU,EAAsB,IAAA,EAAS,EAC1D,MAAM,EAAQ,KAAK,EACrB,EACF,CAGsC,CAAC,EAAG,SAAU,CAAC,EAAqB,CAAO,CAAC,CAAE,CACxF"}

package/dist/src/schemas/apiContracts.cjs

@@ -1,2 +0,0 @@
-const e=(0,require("@agimon-ai/doompi-core/api-contracts").defineApiContract)({version:1,http:[],sockets:[],dynamic:[]});exports.apiContracts=e,exports.default=e;
-//# sourceMappingURL=apiContracts.cjs.map

package/dist/src/schemas/apiContracts.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"apiContracts.cjs","names":["defineApiContract"],"sources":["../../../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract } from '@agimon-ai/doompi-core/api-contracts';\n\n/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */\nexport const apiContracts = defineApiContract({ version: 1, http: [], sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":"AAGA,MAAa,GAAA,gDAAeA,CAAAA,CAAAA,kBAAAA,CAAkB,CAAE,QAAS,EAAG,KAAM,CAAC,EAAG,QAAS,CAAC,EAAG,QAAS,CAAC,CAAE,CAAC"}

package/dist/src/schemas/apiContracts.d.cts

@@ -1,53 +0,0 @@
-//#region src/schemas/apiContracts.d.ts
-/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
-export declare const apiContracts: {
-  version: 1;
-  protocols?: Record<string, string> | undefined;
-  schemas?: Record<string, boolean | object> | undefined;
-  http: {
-    id: string;
-    scope: "global" | "session" | "workspace";
-    basePath?: string | undefined;
-    path: string;
-    method: "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PUT";
-    description: string;
-    availability?: string | undefined;
-    authentication: "device" | "none" | "owner";
-    parameters?: {
-      name: string;
-      in: "header" | "path" | "query";
-      required: boolean;
-      schema: boolean | object;
-    }[] | undefined;
-    body?: {
-      contentType: string;
-      contentTypes?: string[] | undefined;
-      required: boolean;
-      schema: boolean | object;
-    } | undefined;
-    responses: Record<string, {
-      description: string;
-      contentType?: string | undefined;
-      schema?: boolean | object | undefined;
-      events?: Record<string, boolean | object> | undefined;
-    }>;
-  }[];
-  sockets: {
-    id: string;
-    scope: "global" | "session" | "workspace";
-    description: string;
-    availability?: string | undefined;
-    service: string;
-    member: string;
-    direction: "client-to-server" | "server-to-client";
-    kind: "channel" | "method" | "state";
-    input: boolean | object;
-    output?: boolean | object | undefined;
-    errors?: boolean | object | undefined;
-  }[];
-  dynamic: string[];
-  gaps?: string[] | undefined;
-};
-//#endregion
-export { apiContracts as default };
-//# sourceMappingURL=apiContracts.d.cts.map

package/dist/src/schemas/apiContracts.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"apiContracts.d.cts","names":[],"sources":["../../../src/schemas/apiContracts.ts"],"mappings":";;qBAGa"}

package/dist/src/schemas/apiContracts.d.mts

@@ -1,53 +0,0 @@
-//#region src/schemas/apiContracts.d.ts
-/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */
-export declare const apiContracts: {
-  version: 1;
-  protocols?: Record<string, string> | undefined;
-  schemas?: Record<string, boolean | object> | undefined;
-  http: {
-    id: string;
-    scope: "global" | "session" | "workspace";
-    basePath?: string | undefined;
-    path: string;
-    method: "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PUT";
-    description: string;
-    availability?: string | undefined;
-    authentication: "device" | "none" | "owner";
-    parameters?: {
-      name: string;
-      in: "header" | "path" | "query";
-      required: boolean;
-      schema: boolean | object;
-    }[] | undefined;
-    body?: {
-      contentType: string;
-      contentTypes?: string[] | undefined;
-      required: boolean;
-      schema: boolean | object;
-    } | undefined;
-    responses: Record<string, {
-      description: string;
-      contentType?: string | undefined;
-      schema?: boolean | object | undefined;
-      events?: Record<string, boolean | object> | undefined;
-    }>;
-  }[];
-  sockets: {
-    id: string;
-    scope: "global" | "session" | "workspace";
-    description: string;
-    availability?: string | undefined;
-    service: string;
-    member: string;
-    direction: "client-to-server" | "server-to-client";
-    kind: "channel" | "method" | "state";
-    input: boolean | object;
-    output?: boolean | object | undefined;
-    errors?: boolean | object | undefined;
-  }[];
-  dynamic: string[];
-  gaps?: string[] | undefined;
-};
-//#endregion
-export { apiContracts as default };
-//# sourceMappingURL=apiContracts.d.mts.map

package/dist/src/schemas/apiContracts.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../../../src/schemas/apiContracts.ts"],"mappings":";;qBAGa"}

package/dist/src/schemas/apiContracts.mjs

@@ -1,2 +0,0 @@
-import{defineApiContract as e}from"@agimon-ai/doompi-core/api-contracts";const t=e({version:1,http:[],sockets:[],dynamic:[]});export{t as apiContracts,t as default};
-//# sourceMappingURL=apiContracts.mjs.map

package/dist/src/schemas/apiContracts.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../../../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract } from '@agimon-ai/doompi-core/api-contracts';\n\n/** This facet contributes agent tools, commands or lifecycle only, with no separate HTTP or socket surface. */\nexport const apiContracts = defineApiContract({ version: 1, http: [], sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":"yEAGA,MAAa,EAAe,EAAkB,CAAE,QAAS,EAAG,KAAM,CAAC,EAAG,QAAS,CAAC,EAAG,QAAS,CAAC,CAAE,CAAC"}

package/dist/src/services/brokerHost/index.cjs

@@ -1,2 +0,0 @@
-const e=require("../../../_virtual/_rolldown/runtime.cjs"),t=require("../brokerRoutes/index.cjs"),n=require("../brokerServer/index.cjs");let r=require("node:crypto"),i=require("node:fs");i=e.__toESM(i,1);let a=require("node:os");a=e.__toESM(a,1);let o=require("node:path");o=e.__toESM(o,1);async function s(e){let i=t.resolveBrokeredCredentials(e.environment);if(i.length===0)return;let a=(0,r.randomBytes)(32).toString(`base64url`),o=new Map(i.map(e=>[e.route.provider,e])),s=n.createBrokerServer({credentials:o,token:a,onDenied:e.onDenied}),{endpoint:d,dispose:f}=(e.platform??process.platform)===`linux`&&e.forceLoopback!==!0?await c(s,e.socketDirectory):await l(s);return{endpoint:d,token:a,providers:i.map(e=>e.route.provider),withheldEnv:i.map(e=>e.envName),stop:()=>u(s,f)}}async function c(e,t){let n=t??i.default.mkdtempSync(o.default.join(a.default.tmpdir(),`doompi-broker-`));i.default.mkdirSync(n,{recursive:!0}),i.default.chmodSync(n,448);let r=o.default.join(n,`broker.sock`);return i.default.rmSync(r,{force:!0}),await new Promise((t,n)=>{e.once(`error`,n),e.listen(r,()=>t())}),{endpoint:{transport:`unix`,socketDirectory:n},dispose:()=>t?i.default.rmSync(r,{force:!0}):i.default.rmSync(n,{recursive:!0,force:!0})}}async function l(e){await new Promise((t,n)=>{e.once(`error`,n),e.listen(0,`127.0.0.1`,()=>t())});let t=e.address();if(t===null||typeof t==`string`)throw Error(`The broker did not report a listening port.`);return{endpoint:{transport:`tcp`,port:t.port},dispose:()=>void 0}}async function u(e,t){await new Promise(t=>{e.close(()=>t()),e.closeAllConnections()}),t()}exports.startBroker=s;
-//# sourceMappingURL=index.cjs.map

package/dist/src/services/brokerHost/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.cjs","names":["resolveBrokeredCredentials","randomBytes","createBrokerServer","fs","path","os"],"sources":["../../../../src/services/brokerHost/index.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport fs from 'node:fs';\nimport type http from 'node:http';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport type { BrokerEndpoint } from '../../types/sandboxHarness';\nimport { resolveBrokeredCredentials } from '../brokerRoutes';\nimport { createBrokerServer } from '../brokerServer';\n\nconst SOCKET_DIRECTORY_PREFIX = 'doompi-broker-';\nconst SOCKET_FILE_NAME = 'broker.sock';\nconst OWNER_ONLY_DIRECTORY = 0o700;\nconst TOKEN_BYTES = 32;\nconst LOOPBACK = '127.0.0.1';\nconst LINUX_PLATFORM = 'linux';\nconst EPHEMERAL_PORT = 0;\n\nexport interface RunningBroker {\n  /** How a container reaches this broker. */\n  endpoint: BrokerEndpoint;\n  /** Secret the container presents instead of any real credential. */\n  token: string;\n  /** Pi provider names the session may reach. */\n  providers: string[];\n  /** Host environment variables whose value the container receives as the token. */\n  withheldEnv: string[];\n  stop(): Promise<void>;\n}\n\nexport interface StartBrokerOptions {\n  environment: Readonly<Record<string, string | undefined>>;\n  onDenied?: (reason: string) => void;\n  /** Seam for tests; defaults to this host's platform. */\n  platform?: string;\n  /**\n   * Fixed directory to hold the socket instead of a fresh temporary one.\n   *\n   * A reused container keeps the mounts it was created with, so a dev\n   * container has to find the socket at the same path on every launch.\n   */\n  socketDirectory?: string;\n  /** Forces the loopback transport even where a socket would work. */\n  forceLoopback?: boolean;\n}\n\n/**\n * Starts the host-side provider broker for one sandboxed session.\n *\n * Answers undefined when the host holds no brokerable credential, which keeps\n * a session that authenticates some other way on the unbrokered path instead\n * of failing it.\n */\nexport async function startBroker(options: StartBrokerOptions): Promise<RunningBroker | undefined> {\n  const resolved = resolveBrokeredCredentials(options.environment);\n  if (resolved.length === 0) return undefined;\n\n  const token = randomBytes(TOKEN_BYTES).toString('base64url');\n  const credentials = new Map(resolved.map((credential) => [credential.route.provider, credential]));\n  const server = createBrokerServer({ credentials, token, onDenied: options.onDenied });\n  const platform = options.platform ?? process.platform;\n\n  const useSocket = platform === LINUX_PLATFORM && options.forceLoopback !== true;\n  const { endpoint, dispose } = useSocket\n    ? await listenOnSocket(server, options.socketDirectory)\n    : await listenOnLoopback(server);\n\n  return {\n    endpoint,\n    token,\n    providers: resolved.map((credential) => credential.route.provider),\n    withheldEnv: resolved.map((credential) => credential.envName),\n    stop: () => stopBroker(server, dispose),\n  };\n}\n\n/**\n * Native Linux shares a kernel with the container, so a bind-mounted socket\n * needs no port and is reachable as an ordinary file.\n */\nasync function listenOnSocket(\n  server: http.Server,\n  fixedDirectory?: string,\n): Promise<{ endpoint: BrokerEndpoint; dispose: () => void }> {\n  const socketDirectory = fixedDirectory ?? fs.mkdtempSync(path.join(os.tmpdir(), SOCKET_DIRECTORY_PREFIX));\n  fs.mkdirSync(socketDirectory, { recursive: true });\n  fs.chmodSync(socketDirectory, OWNER_ONLY_DIRECTORY);\n  const socketPath = path.join(socketDirectory, SOCKET_FILE_NAME);\n  // A previous session that died without closing leaves the node behind, and\n  // bind fails on an existing path.\n  fs.rmSync(socketPath, { force: true });\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(socketPath, () => resolve());\n  });\n  return {\n    endpoint: { transport: 'unix', socketDirectory },\n    // A fixed directory outlives the session that borrowed it.\n    dispose: () =>\n      fixedDirectory\n        ? fs.rmSync(socketPath, { force: true })\n        : fs.rmSync(socketDirectory, { recursive: true, force: true }),\n  };\n}\n\n/**\n * Everywhere else the container runs in its own virtual machine, which cannot\n * connect to a host unix socket even when the file is shared through: the\n * connect fails with ENOTSUP. Loopback keeps the broker off the network while\n * still being reachable through the engine's host gateway, and the session\n * token is what stops another local process from using it.\n */\nasync function listenOnLoopback(server: http.Server): Promise<{ endpoint: BrokerEndpoint; dispose: () => void }> {\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(EPHEMERAL_PORT, LOOPBACK, () => resolve());\n  });\n  const address = server.address();\n  if (address === null || typeof address === 'string') throw new Error('The broker did not report a listening port.');\n  return { endpoint: { transport: 'tcp', port: address.port }, dispose: () => undefined };\n}\n\nasync function stopBroker(server: http.Server, dispose: () => void): Promise<void> {\n  await new Promise<void>((resolve) => {\n    server.close(() => resolve());\n    // An in-flight provider stream would otherwise hold the listener open past\n    // the session that owns it.\n    server.closeAllConnections();\n  });\n  dispose();\n}\n"],"mappings":"kSAqDA,eAAsB,EAAY,EAAiE,CACjG,IAAM,EAAWA,EAAAA,2BAA2B,EAAQ,WAAW,EAC/D,GAAI,EAAS,SAAW,EAAG,OAE3B,IAAM,GAAA,EAAQC,EAAAA,YAAAA,CAAY,EAAW,CAAC,CAAC,SAAS,WAAW,EACrD,EAAc,IAAI,IAAI,EAAS,IAAK,GAAe,CAAC,EAAW,MAAM,SAAU,CAAU,CAAC,CAAC,EAC3F,EAASC,EAAAA,mBAAmB,CAAE,cAAa,QAAO,SAAU,EAAQ,QAAS,CAAC,EAI9E,CAAE,WAAU,YAHD,EAAQ,UAAY,QAAQ,YAEd,SAAkB,EAAQ,gBAAkB,GAEvE,MAAM,EAAe,EAAQ,EAAQ,eAAe,EACpD,MAAM,EAAiB,CAAM,EAEjC,MAAO,CACL,WACA,QACA,UAAW,EAAS,IAAK,GAAe,EAAW,MAAM,QAAQ,EACjE,YAAa,EAAS,IAAK,GAAe,EAAW,OAAO,EAC5D,SAAY,EAAW,EAAQ,CAAO,CACxC,CACF,CAMA,eAAe,EACb,EACA,EAC4D,CAC5D,IAAM,EAAkB,GAAkBC,EAAAA,QAAG,YAAYC,EAAAA,QAAK,KAAKC,EAAAA,QAAG,OAAO,EAAG,gBAAuB,CAAC,EACxG,EAAA,QAAG,UAAU,EAAiB,CAAE,UAAW,EAAK,CAAC,EACjD,EAAA,QAAG,UAAU,EAAiB,GAAoB,EAClD,IAAM,EAAaD,EAAAA,QAAK,KAAK,EAAiB,aAAgB,EAQ9D,OALA,EAAA,QAAG,OAAO,EAAY,CAAE,MAAO,EAAK,CAAC,EACrC,MAAM,IAAI,SAAe,EAAS,IAAW,CAC3C,EAAO,KAAK,QAAS,CAAM,EAC3B,EAAO,OAAO,MAAkB,EAAQ,CAAC,CAC3C,CAAC,EACM,CACL,SAAU,CAAE,UAAW,OAAQ,iBAAgB,EAE/C,YACE,EACID,EAAAA,QAAG,OAAO,EAAY,CAAE,MAAO,EAAK,CAAC,EACrCA,EAAAA,QAAG,OAAO,EAAiB,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CACnE,CACF,CASA,eAAe,EAAiB,EAAiF,CAC/G,MAAM,IAAI,SAAe,EAAS,IAAW,CAC3C,EAAO,KAAK,QAAS,CAAM,EAC3B,EAAO,OAAO,EAAgB,gBAAgB,EAAQ,CAAC,CACzD,CAAC,EACD,IAAM,EAAU,EAAO,QAAQ,EAC/B,GAAI,IAAY,MAAQ,OAAO,GAAY,SAAU,MAAU,MAAM,6CAA6C,EAClH,MAAO,CAAE,SAAU,CAAE,UAAW,MAAO,KAAM,EAAQ,IAAK,EAAG,YAAe,IAAA,EAAU,CACxF,CAEA,eAAe,EAAW,EAAqB,EAAoC,CACjF,MAAM,IAAI,QAAe,GAAY,CACnC,EAAO,UAAY,EAAQ,CAAC,EAG5B,EAAO,oBAAoB,CAC7B,CAAC,EACD,EAAQ,CACV"}

package/dist/src/services/brokerHost/index.d.cts

@@ -1,15 +0,0 @@
-import { BrokerEndpoint } from "../../types/sandboxHarness.cjs";
-//#region src/services/brokerHost/index.d.ts
-export interface RunningBroker {
-  /** How a container reaches this broker. */
-  endpoint: BrokerEndpoint;
-  /** Secret the container presents instead of any real credential. */
-  token: string;
-  /** Pi provider names the session may reach. */
-  providers: string[];
-  /** Host environment variables whose value the container receives as the token. */
-  withheldEnv: string[];
-  stop(): Promise<void>;
-}
-//#endregion
-//# sourceMappingURL=index.d.cts.map

package/dist/src/services/brokerHost/index.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../../../src/services/brokerHost/index.ts"],"mappings":";;iBAkBiB;;EAEf,UAAU;;EAEV;;EAEA;;EAEA;EACA,QAAQ"}

package/dist/src/services/brokerHost/index.d.mts

@@ -1,15 +0,0 @@
-import { BrokerEndpoint } from "../../types/sandboxHarness.mjs";
-//#region src/services/brokerHost/index.d.ts
-export interface RunningBroker {
-  /** How a container reaches this broker. */
-  endpoint: BrokerEndpoint;
-  /** Secret the container presents instead of any real credential. */
-  token: string;
-  /** Pi provider names the session may reach. */
-  providers: string[];
-  /** Host environment variables whose value the container receives as the token. */
-  withheldEnv: string[];
-  stop(): Promise<void>;
-}
-//#endregion
-//# sourceMappingURL=index.d.mts.map

package/dist/src/services/brokerHost/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/brokerHost/index.ts"],"mappings":";;iBAkBiB;;EAEf,UAAU;;EAEV;;EAEA;;EAEA;EACA,QAAQ"}

package/dist/src/services/brokerHost/index.mjs

@@ -1,2 +0,0 @@
-import{resolveBrokeredCredentials as e}from"../brokerRoutes/index.mjs";import{createBrokerServer as t}from"../brokerServer/index.mjs";import{randomBytes as n}from"node:crypto";import r from"node:fs";import i from"node:os";import a from"node:path";async function o(r){let i=e(r.environment);if(i.length===0)return;let a=n(32).toString(`base64url`),o=new Map(i.map(e=>[e.route.provider,e])),u=t({credentials:o,token:a,onDenied:r.onDenied}),{endpoint:d,dispose:f}=(r.platform??process.platform)===`linux`&&r.forceLoopback!==!0?await s(u,r.socketDirectory):await c(u);return{endpoint:d,token:a,providers:i.map(e=>e.route.provider),withheldEnv:i.map(e=>e.envName),stop:()=>l(u,f)}}async function s(e,t){let n=t??r.mkdtempSync(a.join(i.tmpdir(),`doompi-broker-`));r.mkdirSync(n,{recursive:!0}),r.chmodSync(n,448);let o=a.join(n,`broker.sock`);return r.rmSync(o,{force:!0}),await new Promise((t,n)=>{e.once(`error`,n),e.listen(o,()=>t())}),{endpoint:{transport:`unix`,socketDirectory:n},dispose:()=>t?r.rmSync(o,{force:!0}):r.rmSync(n,{recursive:!0,force:!0})}}async function c(e){await new Promise((t,n)=>{e.once(`error`,n),e.listen(0,`127.0.0.1`,()=>t())});let t=e.address();if(t===null||typeof t==`string`)throw Error(`The broker did not report a listening port.`);return{endpoint:{transport:`tcp`,port:t.port},dispose:()=>void 0}}async function l(e,t){await new Promise(t=>{e.close(()=>t()),e.closeAllConnections()}),t()}export{o as startBroker};
-//# sourceMappingURL=index.mjs.map

package/dist/src/services/brokerHost/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/brokerHost/index.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport fs from 'node:fs';\nimport type http from 'node:http';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport type { BrokerEndpoint } from '../../types/sandboxHarness';\nimport { resolveBrokeredCredentials } from '../brokerRoutes';\nimport { createBrokerServer } from '../brokerServer';\n\nconst SOCKET_DIRECTORY_PREFIX = 'doompi-broker-';\nconst SOCKET_FILE_NAME = 'broker.sock';\nconst OWNER_ONLY_DIRECTORY = 0o700;\nconst TOKEN_BYTES = 32;\nconst LOOPBACK = '127.0.0.1';\nconst LINUX_PLATFORM = 'linux';\nconst EPHEMERAL_PORT = 0;\n\nexport interface RunningBroker {\n  /** How a container reaches this broker. */\n  endpoint: BrokerEndpoint;\n  /** Secret the container presents instead of any real credential. */\n  token: string;\n  /** Pi provider names the session may reach. */\n  providers: string[];\n  /** Host environment variables whose value the container receives as the token. */\n  withheldEnv: string[];\n  stop(): Promise<void>;\n}\n\nexport interface StartBrokerOptions {\n  environment: Readonly<Record<string, string | undefined>>;\n  onDenied?: (reason: string) => void;\n  /** Seam for tests; defaults to this host's platform. */\n  platform?: string;\n  /**\n   * Fixed directory to hold the socket instead of a fresh temporary one.\n   *\n   * A reused container keeps the mounts it was created with, so a dev\n   * container has to find the socket at the same path on every launch.\n   */\n  socketDirectory?: string;\n  /** Forces the loopback transport even where a socket would work. */\n  forceLoopback?: boolean;\n}\n\n/**\n * Starts the host-side provider broker for one sandboxed session.\n *\n * Answers undefined when the host holds no brokerable credential, which keeps\n * a session that authenticates some other way on the unbrokered path instead\n * of failing it.\n */\nexport async function startBroker(options: StartBrokerOptions): Promise<RunningBroker | undefined> {\n  const resolved = resolveBrokeredCredentials(options.environment);\n  if (resolved.length === 0) return undefined;\n\n  const token = randomBytes(TOKEN_BYTES).toString('base64url');\n  const credentials = new Map(resolved.map((credential) => [credential.route.provider, credential]));\n  const server = createBrokerServer({ credentials, token, onDenied: options.onDenied });\n  const platform = options.platform ?? process.platform;\n\n  const useSocket = platform === LINUX_PLATFORM && options.forceLoopback !== true;\n  const { endpoint, dispose } = useSocket\n    ? await listenOnSocket(server, options.socketDirectory)\n    : await listenOnLoopback(server);\n\n  return {\n    endpoint,\n    token,\n    providers: resolved.map((credential) => credential.route.provider),\n    withheldEnv: resolved.map((credential) => credential.envName),\n    stop: () => stopBroker(server, dispose),\n  };\n}\n\n/**\n * Native Linux shares a kernel with the container, so a bind-mounted socket\n * needs no port and is reachable as an ordinary file.\n */\nasync function listenOnSocket(\n  server: http.Server,\n  fixedDirectory?: string,\n): Promise<{ endpoint: BrokerEndpoint; dispose: () => void }> {\n  const socketDirectory = fixedDirectory ?? fs.mkdtempSync(path.join(os.tmpdir(), SOCKET_DIRECTORY_PREFIX));\n  fs.mkdirSync(socketDirectory, { recursive: true });\n  fs.chmodSync(socketDirectory, OWNER_ONLY_DIRECTORY);\n  const socketPath = path.join(socketDirectory, SOCKET_FILE_NAME);\n  // A previous session that died without closing leaves the node behind, and\n  // bind fails on an existing path.\n  fs.rmSync(socketPath, { force: true });\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(socketPath, () => resolve());\n  });\n  return {\n    endpoint: { transport: 'unix', socketDirectory },\n    // A fixed directory outlives the session that borrowed it.\n    dispose: () =>\n      fixedDirectory\n        ? fs.rmSync(socketPath, { force: true })\n        : fs.rmSync(socketDirectory, { recursive: true, force: true }),\n  };\n}\n\n/**\n * Everywhere else the container runs in its own virtual machine, which cannot\n * connect to a host unix socket even when the file is shared through: the\n * connect fails with ENOTSUP. Loopback keeps the broker off the network while\n * still being reachable through the engine's host gateway, and the session\n * token is what stops another local process from using it.\n */\nasync function listenOnLoopback(server: http.Server): Promise<{ endpoint: BrokerEndpoint; dispose: () => void }> {\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(EPHEMERAL_PORT, LOOPBACK, () => resolve());\n  });\n  const address = server.address();\n  if (address === null || typeof address === 'string') throw new Error('The broker did not report a listening port.');\n  return { endpoint: { transport: 'tcp', port: address.port }, dispose: () => undefined };\n}\n\nasync function stopBroker(server: http.Server, dispose: () => void): Promise<void> {\n  await new Promise<void>((resolve) => {\n    server.close(() => resolve());\n    // An in-flight provider stream would otherwise hold the listener open past\n    // the session that owns it.\n    server.closeAllConnections();\n  });\n  dispose();\n}\n"],"mappings":"uPAqDA,eAAsB,EAAY,EAAiE,CACjG,IAAM,EAAW,EAA2B,EAAQ,WAAW,EAC/D,GAAI,EAAS,SAAW,EAAG,OAE3B,IAAM,EAAQ,EAAY,EAAW,CAAC,CAAC,SAAS,WAAW,EACrD,EAAc,IAAI,IAAI,EAAS,IAAK,GAAe,CAAC,EAAW,MAAM,SAAU,CAAU,CAAC,CAAC,EAC3F,EAAS,EAAmB,CAAE,cAAa,QAAO,SAAU,EAAQ,QAAS,CAAC,EAI9E,CAAE,WAAU,YAHD,EAAQ,UAAY,QAAQ,YAEd,SAAkB,EAAQ,gBAAkB,GAEvE,MAAM,EAAe,EAAQ,EAAQ,eAAe,EACpD,MAAM,EAAiB,CAAM,EAEjC,MAAO,CACL,WACA,QACA,UAAW,EAAS,IAAK,GAAe,EAAW,MAAM,QAAQ,EACjE,YAAa,EAAS,IAAK,GAAe,EAAW,OAAO,EAC5D,SAAY,EAAW,EAAQ,CAAO,CACxC,CACF,CAMA,eAAe,EACb,EACA,EAC4D,CAC5D,IAAM,EAAkB,GAAkB,EAAG,YAAY,EAAK,KAAK,EAAG,OAAO,EAAG,gBAAuB,CAAC,EACxG,EAAG,UAAU,EAAiB,CAAE,UAAW,EAAK,CAAC,EACjD,EAAG,UAAU,EAAiB,GAAoB,EAClD,IAAM,EAAa,EAAK,KAAK,EAAiB,aAAgB,EAQ9D,OALA,EAAG,OAAO,EAAY,CAAE,MAAO,EAAK,CAAC,EACrC,MAAM,IAAI,SAAe,EAAS,IAAW,CAC3C,EAAO,KAAK,QAAS,CAAM,EAC3B,EAAO,OAAO,MAAkB,EAAQ,CAAC,CAC3C,CAAC,EACM,CACL,SAAU,CAAE,UAAW,OAAQ,iBAAgB,EAE/C,YACE,EACI,EAAG,OAAO,EAAY,CAAE,MAAO,EAAK,CAAC,EACrC,EAAG,OAAO,EAAiB,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CACnE,CACF,CASA,eAAe,EAAiB,EAAiF,CAC/G,MAAM,IAAI,SAAe,EAAS,IAAW,CAC3C,EAAO,KAAK,QAAS,CAAM,EAC3B,EAAO,OAAO,EAAgB,gBAAgB,EAAQ,CAAC,CACzD,CAAC,EACD,IAAM,EAAU,EAAO,QAAQ,EAC/B,GAAI,IAAY,MAAQ,OAAO,GAAY,SAAU,MAAU,MAAM,6CAA6C,EAClH,MAAO,CAAE,SAAU,CAAE,UAAW,MAAO,KAAM,EAAQ,IAAK,EAAG,YAAe,IAAA,EAAU,CACxF,CAEA,eAAe,EAAW,EAAqB,EAAoC,CACjF,MAAM,IAAI,QAAe,GAAY,CACnC,EAAO,UAAY,EAAQ,CAAC,EAG5B,EAAO,oBAAoB,CAC7B,CAAC,EACD,EAAQ,CACV"}

package/dist/src/services/brokerProviders/index.cjs

@@ -1,2 +0,0 @@
-const e=require("../sandboxBridge/index.cjs");function t(t){let n=t[e.BROKER_PROVIDERS_ENV]?.trim();if(!n)return[];let r=t.DOOMPI_BROKER_SOCKET?.trim()?`127.0.0.1:${e.BROKER_CONTAINER_PORT}`:t[e.BROKER_ADDRESS_ENV]?.trim();return r?n.split(`,`).map(e=>e.trim()).filter(e=>e.length>0).map(e=>({provider:e,baseUrl:`http://${r}/${e}`})):[]}exports.brokeredProviderOverrides=t;
-//# sourceMappingURL=index.cjs.map

package/dist/src/services/brokerProviders/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.cjs","names":["BROKER_PROVIDERS_ENV","BROKER_CONTAINER_PORT","BROKER_ADDRESS_ENV"],"sources":["../../../../src/services/brokerProviders/index.ts"],"sourcesContent":["import { BROKER_ADDRESS_ENV, BROKER_CONTAINER_PORT, BROKER_PROVIDERS_ENV, BROKER_SOCKET_ENV } from '../sandboxBridge';\n\nexport interface BrokeredProviderOverride {\n  provider: string;\n  baseUrl: string;\n}\n\n/**\n * Points brokered providers at whichever route the launch granted.\n *\n * Pi reads base URLs from package-internal provider data, so redirecting a\n * session means overriding the provider rather than setting an environment\n * variable. The credential is left alone: the launch already replaced it with\n * the session token the broker expects.\n *\n * A broker on a host port is addressed directly. Only a mounted socket needs\n * the loopback bridge, because no SDK can dial a socket path.\n */\nexport function brokeredProviderOverrides(\n  environment: Readonly<Record<string, string | undefined>>,\n): BrokeredProviderOverride[] {\n  const configured = environment[BROKER_PROVIDERS_ENV]?.trim();\n  if (!configured) return [];\n  const authority = environment[BROKER_SOCKET_ENV]?.trim()\n    ? `127.0.0.1:${BROKER_CONTAINER_PORT}`\n    : environment[BROKER_ADDRESS_ENV]?.trim();\n  if (!authority) return [];\n  return configured\n    .split(',')\n    .map((provider) => provider.trim())\n    .filter((provider) => provider.length > 0)\n    .map((provider) => ({ provider, baseUrl: `http://${authority}/${provider}` }));\n}\n"],"mappings":"8CAkBA,SAAgB,EACd,EAC4B,CAC5B,IAAM,EAAa,EAAYA,EAAAA,qBAAqB,EAAE,KAAK,EAC3D,GAAI,CAAC,EAAY,MAAO,CAAC,EACzB,IAAM,EAAY,EAAA,sBAAgC,KAAK,EACnD,aAAaC,EAAAA,wBACb,EAAYC,EAAAA,mBAAmB,EAAE,KAAK,EAE1C,OADK,EACE,EACJ,MAAM,GAAG,CAAC,CACV,IAAK,GAAa,EAAS,KAAK,CAAC,CAAC,CAClC,OAAQ,GAAa,EAAS,OAAS,CAAC,CAAC,CACzC,IAAK,IAAc,CAAE,WAAU,QAAS,UAAU,EAAU,GAAG,GAAW,EAAE,EALxD,CAAC,CAM1B"}

package/dist/src/services/brokerProviders/index.mjs

@@ -1,2 +0,0 @@
-import{BROKER_ADDRESS_ENV as e,BROKER_CONTAINER_PORT as t,BROKER_PROVIDERS_ENV as n}from"../sandboxBridge/index.mjs";function r(r){let i=r[n]?.trim();if(!i)return[];let a=r.DOOMPI_BROKER_SOCKET?.trim()?`127.0.0.1:${t}`:r[e]?.trim();return a?i.split(`,`).map(e=>e.trim()).filter(e=>e.length>0).map(e=>({provider:e,baseUrl:`http://${a}/${e}`})):[]}export{r as brokeredProviderOverrides};
-//# sourceMappingURL=index.mjs.map

package/dist/src/services/brokerProviders/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/brokerProviders/index.ts"],"sourcesContent":["import { BROKER_ADDRESS_ENV, BROKER_CONTAINER_PORT, BROKER_PROVIDERS_ENV, BROKER_SOCKET_ENV } from '../sandboxBridge';\n\nexport interface BrokeredProviderOverride {\n  provider: string;\n  baseUrl: string;\n}\n\n/**\n * Points brokered providers at whichever route the launch granted.\n *\n * Pi reads base URLs from package-internal provider data, so redirecting a\n * session means overriding the provider rather than setting an environment\n * variable. The credential is left alone: the launch already replaced it with\n * the session token the broker expects.\n *\n * A broker on a host port is addressed directly. Only a mounted socket needs\n * the loopback bridge, because no SDK can dial a socket path.\n */\nexport function brokeredProviderOverrides(\n  environment: Readonly<Record<string, string | undefined>>,\n): BrokeredProviderOverride[] {\n  const configured = environment[BROKER_PROVIDERS_ENV]?.trim();\n  if (!configured) return [];\n  const authority = environment[BROKER_SOCKET_ENV]?.trim()\n    ? `127.0.0.1:${BROKER_CONTAINER_PORT}`\n    : environment[BROKER_ADDRESS_ENV]?.trim();\n  if (!authority) return [];\n  return configured\n    .split(',')\n    .map((provider) => provider.trim())\n    .filter((provider) => provider.length > 0)\n    .map((provider) => ({ provider, baseUrl: `http://${authority}/${provider}` }));\n}\n"],"mappings":"qHAkBA,SAAgB,EACd,EAC4B,CAC5B,IAAM,EAAa,EAAY,EAAqB,EAAE,KAAK,EAC3D,GAAI,CAAC,EAAY,MAAO,CAAC,EACzB,IAAM,EAAY,EAAA,sBAAgC,KAAK,EACnD,aAAa,IACb,EAAY,EAAmB,EAAE,KAAK,EAE1C,OADK,EACE,EACJ,MAAM,GAAG,CAAC,CACV,IAAK,GAAa,EAAS,KAAK,CAAC,CAAC,CAClC,OAAQ,GAAa,EAAS,OAAS,CAAC,CAAC,CACzC,IAAK,IAAc,CAAE,WAAU,QAAS,UAAU,EAAU,GAAG,GAAW,EAAE,EALxD,CAAC,CAM1B"}

package/dist/src/services/brokerRoutes/index.cjs

@@ -1,2 +0,0 @@
-const e=[{provider:`anthropic`,upstream:`https://api.anthropic.com`,hostKeyEnv:[`ANTHROPIC_API_KEY`]},{provider:`openai`,upstream:`https://api.openai.com/v1`,hostKeyEnv:[`OPENAI_API_KEY`]},{provider:`google`,upstream:`https://generativelanguage.googleapis.com/v1beta`,hostKeyEnv:[`GEMINI_API_KEY`]},{provider:`groq`,upstream:`https://api.groq.com/openai/v1`,hostKeyEnv:[`GROQ_API_KEY`]},{provider:`xai`,upstream:`https://api.x.ai/v1`,hostKeyEnv:[`XAI_API_KEY`]},{provider:`openrouter`,upstream:`https://openrouter.ai/api/v1`,hostKeyEnv:[`OPENROUTER_API_KEY`]},{provider:`deepseek`,upstream:`https://api.deepseek.com`,hostKeyEnv:[`DEEPSEEK_API_KEY`]},{provider:`mistral`,upstream:`https://api.mistral.ai`,hostKeyEnv:[`MISTRAL_API_KEY`]},{provider:`together`,upstream:`https://api.together.ai/v1`,hostKeyEnv:[`TOGETHER_API_KEY`]},{provider:`cerebras`,upstream:`https://api.cerebras.ai/v1`,hostKeyEnv:[`CEREBRAS_API_KEY`]},{provider:`moonshotai`,upstream:`https://api.moonshot.ai/v1`,hostKeyEnv:[`MOONSHOT_API_KEY`]},{provider:`zai`,upstream:`https://api.z.ai/api/coding/paas/v4`,hostKeyEnv:[`ZAI_API_KEY`]}];function t(t){let n=[];for(let r of e)for(let e of r.hostKeyEnv){let i=t[e]?.trim();if(i){n.push({route:r,envName:e,value:i});break}}return n}exports.resolveBrokeredCredentials=t;
-//# sourceMappingURL=index.cjs.map

package/dist/src/services/brokerRoutes/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/brokerRoutes/index.ts"],"sourcesContent":["export interface BrokerRoute {\n  /** Pi provider name, which is also the broker's first path segment. */\n  provider: string;\n  /** Upstream origin plus any base path Pi's own provider data carries. */\n  upstream: string;\n  /** Host environment variables that may hold the real credential, in priority order. */\n  hostKeyEnv: readonly string[];\n}\n\n/**\n * Providers the broker can terminate, mirroring Pi's own provider data.\n *\n * Curated rather than derived: Pi keeps base URLs in package-internal JSON that\n * carries no stability promise. A provider missing here is simply not brokered,\n * and its credential stays on the host.\n */\nconst ROUTES: readonly BrokerRoute[] = [\n  { provider: 'anthropic', upstream: 'https://api.anthropic.com', hostKeyEnv: ['ANTHROPIC_API_KEY'] },\n  { provider: 'openai', upstream: 'https://api.openai.com/v1', hostKeyEnv: ['OPENAI_API_KEY'] },\n  { provider: 'google', upstream: 'https://generativelanguage.googleapis.com/v1beta', hostKeyEnv: ['GEMINI_API_KEY'] },\n  { provider: 'groq', upstream: 'https://api.groq.com/openai/v1', hostKeyEnv: ['GROQ_API_KEY'] },\n  { provider: 'xai', upstream: 'https://api.x.ai/v1', hostKeyEnv: ['XAI_API_KEY'] },\n  { provider: 'openrouter', upstream: 'https://openrouter.ai/api/v1', hostKeyEnv: ['OPENROUTER_API_KEY'] },\n  { provider: 'deepseek', upstream: 'https://api.deepseek.com', hostKeyEnv: ['DEEPSEEK_API_KEY'] },\n  { provider: 'mistral', upstream: 'https://api.mistral.ai', hostKeyEnv: ['MISTRAL_API_KEY'] },\n  { provider: 'together', upstream: 'https://api.together.ai/v1', hostKeyEnv: ['TOGETHER_API_KEY'] },\n  { provider: 'cerebras', upstream: 'https://api.cerebras.ai/v1', hostKeyEnv: ['CEREBRAS_API_KEY'] },\n  { provider: 'moonshotai', upstream: 'https://api.moonshot.ai/v1', hostKeyEnv: ['MOONSHOT_API_KEY'] },\n  { provider: 'zai', upstream: 'https://api.z.ai/api/coding/paas/v4', hostKeyEnv: ['ZAI_API_KEY'] },\n];\n\nexport function brokerRoutes(): readonly BrokerRoute[] {\n  return ROUTES;\n}\n\nexport function findBrokerRoute(provider: string): BrokerRoute | undefined {\n  return ROUTES.find((route) => route.provider === provider);\n}\n\nexport interface ResolvedCredential {\n  route: BrokerRoute;\n  /** Environment variable the container would otherwise have received. */\n  envName: string;\n  value: string;\n}\n\n/** Selects the providers this host can actually broker for a session. */\nexport function resolveBrokeredCredentials(\n  environment: Readonly<Record<string, string | undefined>>,\n): ResolvedCredential[] {\n  const resolved: ResolvedCredential[] = [];\n  for (const route of ROUTES) {\n    for (const envName of route.hostKeyEnv) {\n      const value = environment[envName]?.trim();\n      if (value) {\n        resolved.push({ route, envName, value });\n        break;\n      }\n    }\n  }\n  return resolved;\n}\n"],"mappings":"AAgBA,MAAM,EAAiC,CACrC,CAAE,SAAU,YAAa,SAAU,4BAA6B,WAAY,CAAC,mBAAmB,CAAE,EAClG,CAAE,SAAU,SAAU,SAAU,4BAA6B,WAAY,CAAC,gBAAgB,CAAE,EAC5F,CAAE,SAAU,SAAU,SAAU,mDAAoD,WAAY,CAAC,gBAAgB,CAAE,EACnH,CAAE,SAAU,OAAQ,SAAU,iCAAkC,WAAY,CAAC,cAAc,CAAE,EAC7F,CAAE,SAAU,MAAO,SAAU,sBAAuB,WAAY,CAAC,aAAa,CAAE,EAChF,CAAE,SAAU,aAAc,SAAU,+BAAgC,WAAY,CAAC,oBAAoB,CAAE,EACvG,CAAE,SAAU,WAAY,SAAU,2BAA4B,WAAY,CAAC,kBAAkB,CAAE,EAC/F,CAAE,SAAU,UAAW,SAAU,yBAA0B,WAAY,CAAC,iBAAiB,CAAE,EAC3F,CAAE,SAAU,WAAY,SAAU,6BAA8B,WAAY,CAAC,kBAAkB,CAAE,EACjG,CAAE,SAAU,WAAY,SAAU,6BAA8B,WAAY,CAAC,kBAAkB,CAAE,EACjG,CAAE,SAAU,aAAc,SAAU,6BAA8B,WAAY,CAAC,kBAAkB,CAAE,EACnG,CAAE,SAAU,MAAO,SAAU,sCAAuC,WAAY,CAAC,aAAa,CAAE,CAClG,EAkBA,SAAgB,EACd,EACsB,CACtB,IAAM,EAAiC,CAAC,EACxC,IAAK,IAAM,KAAS,EAClB,IAAK,IAAM,KAAW,EAAM,WAAY,CACtC,IAAM,EAAQ,EAAY,EAAQ,EAAE,KAAK,EACzC,GAAI,EAAO,CACT,EAAS,KAAK,CAAE,QAAO,UAAS,OAAM,CAAC,EACvC,KACF,CACF,CAEF,OAAO,CACT"}

package/dist/src/services/brokerRoutes/index.mjs

@@ -1,2 +0,0 @@
-const e=[{provider:`anthropic`,upstream:`https://api.anthropic.com`,hostKeyEnv:[`ANTHROPIC_API_KEY`]},{provider:`openai`,upstream:`https://api.openai.com/v1`,hostKeyEnv:[`OPENAI_API_KEY`]},{provider:`google`,upstream:`https://generativelanguage.googleapis.com/v1beta`,hostKeyEnv:[`GEMINI_API_KEY`]},{provider:`groq`,upstream:`https://api.groq.com/openai/v1`,hostKeyEnv:[`GROQ_API_KEY`]},{provider:`xai`,upstream:`https://api.x.ai/v1`,hostKeyEnv:[`XAI_API_KEY`]},{provider:`openrouter`,upstream:`https://openrouter.ai/api/v1`,hostKeyEnv:[`OPENROUTER_API_KEY`]},{provider:`deepseek`,upstream:`https://api.deepseek.com`,hostKeyEnv:[`DEEPSEEK_API_KEY`]},{provider:`mistral`,upstream:`https://api.mistral.ai`,hostKeyEnv:[`MISTRAL_API_KEY`]},{provider:`together`,upstream:`https://api.together.ai/v1`,hostKeyEnv:[`TOGETHER_API_KEY`]},{provider:`cerebras`,upstream:`https://api.cerebras.ai/v1`,hostKeyEnv:[`CEREBRAS_API_KEY`]},{provider:`moonshotai`,upstream:`https://api.moonshot.ai/v1`,hostKeyEnv:[`MOONSHOT_API_KEY`]},{provider:`zai`,upstream:`https://api.z.ai/api/coding/paas/v4`,hostKeyEnv:[`ZAI_API_KEY`]}];function t(t){let n=[];for(let r of e)for(let e of r.hostKeyEnv){let i=t[e]?.trim();if(i){n.push({route:r,envName:e,value:i});break}}return n}export{t as resolveBrokeredCredentials};
-//# sourceMappingURL=index.mjs.map