@claxedo/sandbox-manager 0.7.0 → 0.10.0

package/dist/driver-billing.d.ts

@@ -0,0 +1,29 @@
+import type { SandboxMachineClass } from "@claxedo/sandbox-contract";
+/** One size a provider sells, as its own catalog names and prices it. */
+export type SandboxMachineRate = {
+    /** The provider's own name for the size. */
+    size: string;
+    vcpu: number;
+    memoryGb: number;
+    usdPerHour: number;
+};
+/**
+ * How a provider bills the machine a sandbox runs on, read from its published
+ * pricing. `rates.default` is also the one size of a driver that offers no
+ * choice. `excludes` names a component the hourly rate leaves out because the
+ * provider meters it on use rather than on time.
+ */
+export type SandboxDriverBilling = {
+    source: {
+        url: string;
+        readOn: string;
+    };
+    meter: string;
+    rates: Partial<Record<SandboxMachineClass, SandboxMachineRate>>;
+    excludes?: string;
+};
+export declare const boatBilling: SandboxDriverBilling;
+export declare const cloudflareBilling: SandboxDriverBilling;
+/** The rate a sandbox of this class runs at; a driver with one size answers it for the class it was not asked for. */
+export declare function sandboxMachineRate(billing: SandboxDriverBilling | undefined, machineClass: SandboxMachineClass | null): SandboxMachineRate | undefined;
+export declare function sandboxMachineCostUsd(rate: SandboxMachineRate, activeMs: number): number;

package/dist/driver-catalog.d.ts

@@ -1,68 +1,53 @@
-import { validateSandboxPersistenceCapabilities, type SandboxDriverMetadata } from "./index";
-export declare const sandboxDriverIds: readonly ["exe", "daytona", "modal", "vercel", "cloudflare", "box", "docker"];
-export type SandboxDriverID = (typeof sandboxDriverIds)[number];
-export type SandboxDriverAuth = {
-    exe?: {
-        api_token?: string;
-    };
-    daytona?: {
-        api_key?: string;
-    };
-    modal?: {
-        token_id?: string;
-        token_secret?: string;
-    };
-    vercel?: {
-        access_token?: string;
-        team_id?: string;
-        project_id?: string;
-    };
-    cloudflare?: {
-        api_token?: string;
-        worker_url?: string;
-    };
-    box?: {
-        api_key?: string;
-    };
-    docker?: {
-        image?: string;
-    };
-};
-export type SandboxDriverConfig = {
-    default_driver?: SandboxDriverID;
-    auth?: SandboxDriverAuth;
-};
-export type SandboxDriverCatalogEntry = {
-    id: SandboxDriverID;
+import { validateSandboxPersistenceCapabilities, type SandboxDriverMetadata } from "./contract";
+import { type SandboxDriverBilling } from "./driver-billing";
+import { sandboxDriverId, type SandboxDriverEnv, type SandboxDriverID } from "@claxedo/sandbox-contract";
+export { sandboxDriverId };
+export { sandboxMachineCostUsd, sandboxMachineRate, type SandboxDriverBilling, type SandboxMachineRate } from "./driver-billing";
+export type SandboxDriverCatalogEntry<ID extends string = SandboxDriverID> = {
+    id: ID;
     label: string;
     metadata: SandboxDriverMetadata;
-    credentialFields: Array<{
+    credentialFields: ReadonlyArray<{
         key: string;
         label: string;
         secret?: boolean;
     }>;
+    runtimeNetwork: {
+        controlPlane: "docker-host" | "direct";
+        relay: "configured" | "local";
+    };
+    runtimeEnv: "ensure" | "callback";
+    preparedImage: boolean;
+    /** Absent where no published rate for the machines this driver places on has been established. */
+    billing?: SandboxDriverBilling;
 };
 export { validateSandboxPersistenceCapabilities };
+export declare const localBrokeringTestDriverCatalogEntry: {
+    readonly id: "local-brokering-test";
+    readonly label: "Local brokering test driver";
+    readonly credentialFields: readonly [];
+    readonly runtimeNetwork: {
+        readonly controlPlane: "direct";
+        readonly relay: "local";
+    };
+    readonly runtimeEnv: "ensure";
+    readonly preparedImage: false;
+    readonly metadata: {
+        readonly driverRunsIn: ["local"];
+        readonly hostStopBehavior: "terminates-host";
+        readonly hostResumeBehavior: "same-host";
+        readonly targetAccess: "loopback";
+        readonly secretBrokering: "native";
+        readonly egressControl: "hosts";
+        readonly persistence: {
+            readonly resume: "same-sandbox";
+            readonly capture: "none";
+            readonly clone: false;
+            readonly captureSource: "not-applicable";
+            readonly retention: "provider-managed";
+            readonly restoreMount: "same-resource";
+        };
+    };
+};
 export declare const sandboxDriverCatalog: Record<SandboxDriverID, SandboxDriverCatalogEntry>;
-export declare function isSandboxDriverID(input: string | undefined): input is SandboxDriverID;
-export declare function sandboxDriverId(input: string | undefined, cfg?: SandboxDriverConfig, env?: SandboxDriverEnv): "box" | "cloudflare" | "daytona" | "docker" | "exe" | "modal" | "vercel" | undefined;
-export declare function defaultSandboxDriverID(cfg?: SandboxDriverConfig, env?: SandboxDriverEnv): SandboxDriverID;
-export declare function sandboxDriverAuth<T extends SandboxDriverID>(cfg: SandboxDriverConfig | undefined, id: T, env?: SandboxDriverEnv): SandboxDriverAuth[T] | undefined;
-export declare function hasSandboxDriverAuth(cfg: SandboxDriverConfig | undefined, id: SandboxDriverID, env?: SandboxDriverEnv): boolean;
 export declare function dockerSandboxDriverEnabled(env?: SandboxDriverEnv): boolean;
-export declare function listSandboxDrivers(cfg?: SandboxDriverConfig, env?: SandboxDriverEnv, managedDriverIds?: ReadonlySet<string>): {
-    default_driver: "box" | "cloudflare" | "daytona" | "docker" | "exe" | "modal" | "vercel";
-    drivers: {
-        id: "box" | "cloudflare" | "daytona" | "docker" | "exe" | "modal" | "vercel";
-        label: string;
-        fields: {
-            key: string;
-            label: string;
-            secret?: boolean;
-        }[];
-        configured: boolean;
-        source: "config" | "managed" | "none";
-        default: boolean;
-    }[];
-};
-type SandboxDriverEnv = Record<string, string | undefined>;

package/dist/driver-catalog.mjs

@@ -1,30 +1,4 @@
-// src/hosted-network-policy.ts
-var SANDBOX_MODEL_PROVIDER_HOSTS = [
-  "api.anthropic.com",
-  "api.openai.com",
-  "generativelanguage.googleapis.com",
-  "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
-  "models.dev",
-  "opencode.ai"
-];
-var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
-  "registry.npmjs.org",
-  "nodejs.org",
-  "pypi.org",
-  "files.pythonhosted.org",
-  "crates.io",
-  "static.crates.io",
-  "index.crates.io",
-  "proxy.golang.org",
-  "sum.golang.org"
-];
-var SANDBOX_BASELINE_EGRESS_HOSTS = [
-  ...SANDBOX_MODEL_PROVIDER_HOSTS,
-  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
-];
-
-// src/index.ts
+// src/contract.ts
 function validateSandboxPersistenceCapabilities(input) {
   if (input.resume === "replacement-restore" && input.capture === "none") {
     return { valid: false, reason: "replacement restore requires a capture source" };
@@ -38,100 +12,176 @@ function validateSandboxPersistenceCapabilities(input) {
   if (input.capture === "same-resource" && input.restoreMount !== "same-resource") {
     return { valid: false, reason: "same-resource capture requires same-resource restore" };
   }
-  if (input.restoreMount === "copy-on-write" && input.capture !== "directories") {
-    return { valid: false, reason: "copy-on-write restore requires directory capture" };
-  }
   return { valid: true };
 }
 
-// src/runtime-version.ts
-var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-function workspaceRuntimeVersion() {
-  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
+// src/driver-billing.ts
+var HOUR_SECONDS = 3600;
+var boatBilling = {
+  source: { url: "https://docs.boat.dev/pricing", readOn: "2026-10-12" },
+  meter: "Boat bills machine time per second while a sandbox runs, at an hourly rate per size; a stopped sandbox costs nothing.",
+  rates: {
+    small: { size: "small", vcpu: 2, memoryGb: 4, usdPerHour: 0.018 },
+    default: { size: "default", vcpu: 4, memoryGb: 8, usdPerHour: 0.036 },
+    large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
+  }
+};
+var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
+var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
+var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
+var CLOUDFLARE_STANDARD_1 = { size: "standard-1", vcpu: 0.5, memoryGb: 4, diskGb: 8 };
+var cloudflareBilling = {
+  source: { url: "https://developers.cloudflare.com/containers/pricing/", readOn: "2026-10-12" },
+  meter: "Cloudflare bills a container for every 10 ms it runs: memory at $0.0000025 per GiB-second and disk at $0.00000007 per GB-second for the whole run, plus CPU at $0.00002 per vCPU-second of active use.",
+  rates: {
+    default: {
+      size: CLOUDFLARE_STANDARD_1.size,
+      vcpu: CLOUDFLARE_STANDARD_1.vcpu,
+      memoryGb: CLOUDFLARE_STANDARD_1.memoryGb,
+      usdPerHour: (CLOUDFLARE_STANDARD_1.memoryGb * CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY + CLOUDFLARE_STANDARD_1.diskGb * CLOUDFLARE_USD_PER_GB_SECOND_DISK) * HOUR_SECONDS
+    }
+  },
+  excludes: `active CPU, billed at $${CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE} per vCPU-second and not measured by Claxedo, and the monthly allowance a Workers Paid plan includes`
+};
+function sandboxMachineRate(billing, machineClass) {
+  if (!billing) return void 0;
+  return billing.rates[machineClass ?? "default"] ?? (Object.keys(billing.rates).length === 1 ? billing.rates.default : void 0);
+}
+function sandboxMachineCostUsd(rate, activeMs) {
+  return rate.usdPerHour * activeMs / (HOUR_SECONDS * 1e3);
 }
 
-// src/image-name.ts
-var SNAPSHOT_SCHEMA_VERSION = 8;
-var DEFAULT_SANDBOX_IMAGE_REPOSITORY = "ghcr.io/kyashrathore/claxedo-sandbox";
-function snapshotVersion(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+// ../sandbox-contract/dist/index.mjs
+function isString(value) {
+  return typeof value === "string";
+}
+function trimToUndefined(value) {
+  if (!isString(value))
+    return;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+var sandboxDriverIds = ["modal", "vercel", "cloudflare", "boat", "docker"];
+var sandboxDriverCredentialFields = {
+  modal: [
+    { key: "token_id", label: "Token ID", secret: true },
+    { key: "token_secret", label: "Token Secret", secret: true }
+  ],
+  vercel: [
+    { key: "access_token", label: "Access Token", secret: true },
+    { key: "team_id", label: "Team ID" },
+    { key: "project_id", label: "Project ID" }
+  ],
+  cloudflare: [
+    { key: "api_token", label: "API Token", secret: true },
+    { key: "worker_url", label: "Worker URL" }
+  ],
+  boat: [{ key: "api_key", label: "API Key", secret: true }],
+  docker: [{ key: "image", label: "Image" }]
+};
+var sandboxDriverLabels = {
+  modal: "Modal",
+  vercel: "Vercel",
+  cloudflare: "Cloudflare",
+  boat: "Boat",
+  docker: "Docker"
+};
+function isSandboxDriverID(input) {
+  return !!input && sandboxDriverIds.includes(input);
 }
-function sandboxImageRepository(env = process.env) {
-  const repository = env.CLAXEDO_SANDBOX_IMAGE_REPOSITORY?.trim();
-  return repository ? repository : DEFAULT_SANDBOX_IMAGE_REPOSITORY;
+function enabled(input) {
+  return ["1", "true", "yes", "on"].includes(input?.trim().toLowerCase() ?? "");
 }
-function buildIdSuffix(buildId, env) {
-  const id = (buildId ?? env.CLAXEDO_SANDBOX_BUILD_ID)?.trim();
-  return id ? `-${snapshotVersion(id)}` : "";
+function dockerSandboxDriverEnabled(env = process.env) {
+  return enabled(env.CLAXEDO_ENABLE_DOCKER_SANDBOX) || enabled(env.CLAXEDO_DEV_DOCKER_SANDBOX);
 }
-function defaultSandboxImage(version = workspaceRuntimeVersion(), buildId, env = process.env) {
-  return `${sandboxImageRepository(env)}:workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
+function sandboxDriverAuthValues(cfg, id, env = process.env) {
+  if (id === "modal") {
+    const token_id = trimToUndefined(cfg?.auth?.modal?.token_id) ?? trimToUndefined(env.MODAL_TOKEN_ID);
+    const token_secret = trimToUndefined(cfg?.auth?.modal?.token_secret) ?? trimToUndefined(env.MODAL_TOKEN_SECRET);
+    return token_id && token_secret ? { token_id, token_secret } : void 0;
+  }
+  if (id === "vercel") {
+    const access_token = trimToUndefined(cfg?.auth?.vercel?.access_token) ?? trimToUndefined(env.VERCEL_TOKEN);
+    const team_id = trimToUndefined(cfg?.auth?.vercel?.team_id) ?? trimToUndefined(env.VERCEL_TEAM_ID);
+    const project_id = trimToUndefined(cfg?.auth?.vercel?.project_id) ?? trimToUndefined(env.VERCEL_PROJECT_ID);
+    return access_token && team_id && project_id ? { access_token, team_id, project_id } : void 0;
+  }
+  if (id === "cloudflare") {
+    const api_token = trimToUndefined(cfg?.auth?.cloudflare?.api_token) ?? trimToUndefined(env.CLOUDFLARE_API_TOKEN);
+    const configuredUrl = trimToUndefined(cfg?.auth?.cloudflare?.worker_url) ?? trimToUndefined(env.CLOUDFLARE_SANDBOX_WORKER_URL);
+    const worker_url = configuredUrl ? cloudflareWorkerBaseUrl(configuredUrl) : void 0;
+    return api_token && worker_url ? { api_token, worker_url } : void 0;
+  }
+  if (id === "boat") {
+    const api_key = trimToUndefined(cfg?.auth?.boat?.api_key) ?? trimToUndefined(env.BOAT_API_KEY);
+    return api_key ? { api_key } : void 0;
+  }
+  if (!dockerSandboxDriverEnabled(env))
+    return;
+  const image = trimToUndefined(cfg?.auth?.docker?.image) ?? trimToUndefined(env.CLAXEDO_DOCKER_SANDBOX_IMAGE) ?? trimToUndefined(env.CLAXEDO_SANDBOX_IMAGE);
+  return image ? { image } : {};
+}
+function cloudflareWorkerBaseUrl(input) {
+  let url;
+  try {
+    url = new URL(input.trim());
+  } catch {
+    throw new Error("Cloudflare Worker URL must be a valid HTTPS endpoint");
+  }
+  if (url.protocol !== "https:" || url.username || url.password || input.includes("?") || input.includes("#")) {
+    throw new Error("Cloudflare Worker URL requires HTTPS without credentials, query or fragment");
+  }
+  return url.origin + url.pathname.replace(/\/+$/, "");
+}
+function sandboxDriverId(input, cfg, env = process.env) {
+  if (!isSandboxDriverID(input))
+    return;
+  if (input === "docker" && !sandboxDriverAuthValues(cfg, input, env))
+    return;
+  return input;
 }
 
 // src/driver-catalog.ts
-var sandboxDriverIds = ["exe", "daytona", "modal", "vercel", "cloudflare", "box", "docker"];
-var sandboxDriverCatalog = {
-  exe: {
-    id: "exe",
-    label: "exe.dev",
-    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "not-supported",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "none",
-        clone: true,
-        captureSource: "not-applicable",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  },
-  daytona: {
-    id: "daytona",
-    label: "Daytona",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // Daytona is the only driver that can filter egress by NAME as well as
-      // by address: `domainAllowList` (names) alongside `networkAllowList`
-      // (CIDRs), with `networkBlockAll` as the deny-all floor.
-      egressControl: "hosts-and-cidrs",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "new-resource"
-      }
+var localBrokeringTestDriverCatalogEntry = {
+  id: "local-brokering-test",
+  label: "Local brokering test driver",
+  credentialFields: [],
+  runtimeNetwork: { controlPlane: "direct", relay: "local" },
+  runtimeEnv: "ensure",
+  preparedImage: false,
+  metadata: {
+    driverRunsIn: ["local"],
+    hostStopBehavior: "terminates-host",
+    hostResumeBehavior: "same-host",
+    targetAccess: "loopback",
+    secretBrokering: "native",
+    egressControl: "hosts",
+    persistence: {
+      resume: "same-sandbox",
+      capture: "none",
+      clone: false,
+      captureSource: "not-applicable",
+      retention: "provider-managed",
+      restoreMount: "same-resource"
     }
-  },
+  }
+};
+var sandboxDriverCatalog = {
   modal: {
     id: "modal",
-    label: "Modal",
-    credentialFields: [
-      { key: "token_id", label: "Token ID", secret: true },
-      { key: "token_secret", label: "Token Secret", secret: true }
-    ],
+    label: sandboxDriverLabels.modal,
+    credentialFields: sandboxDriverCredentialFields.modal,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
       secretBrokering: "none",
-      // Modal can cut the network entirely (`blockNetwork`) but cannot express
-      // an allowlist, and its driver throws on a host policy. A blackout is
-      // not containment for a workspace that has to clone and reach a model.
+      // The driver does not install Modal's domain allowlist or alpha sidecar.
       egressControl: "none",
       persistence: {
         resume: "replacement-restore",
@@ -145,20 +195,18 @@ var sandboxDriverCatalog = {
   },
   vercel: {
     id: "vercel",
-    label: "Vercel",
-    credentialFields: [
-      { key: "access_token", label: "Access Token", secret: true },
-      { key: "team_id", label: "Team ID" },
-      { key: "project_id", label: "Project ID" }
-    ],
+    label: sandboxDriverLabels.vercel,
+    credentialFields: sandboxDriverCredentialFields.vercel,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: false,
     metadata: {
       driverRunsIn: ["node"],
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
       secretBrokering: "native",
-      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
-      // never CIDRs.
+      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
       egressControl: "hosts",
       persistence: {
         resume: "replacement-restore",
@@ -172,40 +220,42 @@ var sandboxDriverCatalog = {
   },
   cloudflare: {
     id: "cloudflare",
-    label: "Cloudflare",
-    credentialFields: [
-      { key: "api_token", label: "API Token", secret: true },
-      { key: "worker_url", label: "Worker URL" }
-    ],
+    label: sandboxDriverLabels.cloudflare,
+    credentialFields: sandboxDriverCredentialFields.cloudflare,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: false,
+    billing: cloudflareBilling,
     metadata: {
       driverRunsIn: ["worker"],
-      hostStopBehavior: "not-supported",
+      hostStopBehavior: "terminates-host",
       hostResumeBehavior: "same-host",
+      hostWatchesIdle: true,
       targetAccess: "relay",
-      secretBrokering: "proxy",
-      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
-      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
-      // to route brokered-credential requests through, not a boundary. The
-      // driver therefore drops `net` entirely — which is exactly why this
-      // must be declared, so the manager refuses instead of provisioning a
-      // sandbox the caller believes is contained.
+      secretBrokering: "native",
+      // Credential handlers do not restrict unrelated destinations.
       egressControl: "none",
+      // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
-        capture: "directories",
+        capture: "filesystem",
         clone: false,
         captureSource: "preserved",
         retention: "provider-managed",
-        restoreMount: "copy-on-write"
+        restoreMount: "new-resource"
       }
     }
   },
-  box: {
-    id: "box",
-    label: "Box",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+  boat: {
+    id: "boat",
+    label: sandboxDriverLabels.boat,
+    credentialFields: sandboxDriverCredentialFields.boat,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: boatBilling,
     metadata: {
-      driverRunsIn: ["node"],
+      driverRunsIn: ["worker", "node"],
       hostStopBehavior: "suspends-host",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
@@ -218,13 +268,17 @@ var sandboxDriverCatalog = {
         captureSource: "not-applicable",
         retention: "provider-managed",
         restoreMount: "same-resource"
-      }
+      },
+      machineClasses: ["small", "default", "large"]
     }
   },
   docker: {
     id: "docker",
-    label: "Docker",
-    credentialFields: [{ key: "image", label: "Image" }],
+    label: sandboxDriverLabels.docker,
+    credentialFields: sandboxDriverCredentialFields.docker,
+    runtimeNetwork: { controlPlane: "docker-host", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
     metadata: {
       driverRunsIn: ["local"],
       hostStopBehavior: "terminates-host",
@@ -243,106 +297,15 @@ var sandboxDriverCatalog = {
     }
   }
 };
-function isSandboxDriverID(input) {
-  return !!input && sandboxDriverIds.includes(input);
-}
-function sandboxDriverId(input, cfg, env = process.env) {
-  if (!isSandboxDriverID(input)) return;
-  if (input === "docker" && !sandboxDriverAuth(cfg, input, env)) return;
-  return input;
-}
-function defaultSandboxDriverID(cfg, env = process.env) {
-  return sandboxDriverId(cfg?.default_driver, cfg, env) ?? (dockerSandboxDefault(env) && sandboxDriverAuth(cfg, "docker", env) ? "docker" : "daytona");
-}
-function sandboxDriverAuth(cfg, id, env = process.env) {
-  if (id === "daytona") return authDaytona(cfg);
-  if (id === "exe") return authExe(cfg, env);
-  if (id === "modal") return authModal(cfg, env);
-  if (id === "vercel") return authVercel(cfg, env);
-  if (id === "cloudflare") return authCloudflare(cfg, env);
-  if (id === "box") return authBox(cfg, env);
-  return authDocker(cfg, env);
-}
-function hasSandboxDriverAuth(cfg, id, env = process.env) {
-  return !!sandboxDriverAuth(cfg, id, env);
-}
-function dockerSandboxDriverEnabled(env = process.env) {
-  return dockerSandboxEnabled(env);
-}
-function listSandboxDrivers(cfg, env = process.env, managedDriverIds = /* @__PURE__ */ new Set()) {
-  const def = defaultSandboxDriverID(cfg, env);
-  return {
-    default_driver: def,
-    drivers: sandboxDriverIds.filter((id) => id !== "docker" || !!sandboxDriverAuth(cfg, "docker", env)).map((id) => {
-      const configuredFromConfigOrEnv = !!sandboxDriverAuth(cfg, id, env);
-      const configured = id === "docker" ? configuredFromConfigOrEnv : configuredFromConfigOrEnv || managedDriverIds.has(id);
-      return {
-        id,
-        label: sandboxDriverCatalog[id].label,
-        fields: sandboxDriverCatalog[id].credentialFields,
-        configured,
-        source: configuredFromConfigOrEnv ? "config" : configured ? "managed" : "none",
-        default: id === def
-      };
-    })
-  };
-}
-function clean(input) {
-  const txt = input?.trim();
-  return txt ? txt : void 0;
-}
-function enabled(input) {
-  return ["1", "true", "yes", "on"].includes(input?.trim().toLowerCase() ?? "");
-}
-function dockerSandboxEnabled(env) {
-  return enabled(env.CLAXEDO_ENABLE_DOCKER_SANDBOX) || enabled(env.CLAXEDO_DEV_DOCKER_SANDBOX);
-}
-function dockerSandboxDefault(env) {
-  return enabled(env.CLAXEDO_DOCKER_SANDBOX_DEFAULT);
-}
-function authDaytona(cfg) {
-  const api_key = clean(cfg?.auth?.daytona?.api_key);
-  return api_key ? { api_key } : void 0;
-}
-function authExe(cfg, env) {
-  const api_token = clean(cfg?.auth?.exe?.api_token) ?? clean(env.EXE_DEV_API_TOKEN);
-  return api_token ? { api_token } : void 0;
-}
-function authModal(cfg, env) {
-  const token_id = clean(cfg?.auth?.modal?.token_id) ?? clean(env.MODAL_TOKEN_ID);
-  const token_secret = clean(cfg?.auth?.modal?.token_secret) ?? clean(env.MODAL_TOKEN_SECRET);
-  return token_id && token_secret ? { token_id, token_secret } : void 0;
-}
-function authVercel(cfg, env) {
-  const access_token = clean(cfg?.auth?.vercel?.access_token) ?? clean(env.VERCEL_TOKEN);
-  const team_id = clean(cfg?.auth?.vercel?.team_id) ?? clean(env.VERCEL_TEAM_ID);
-  const project_id = clean(cfg?.auth?.vercel?.project_id) ?? clean(env.VERCEL_PROJECT_ID);
-  return access_token && team_id && project_id ? { access_token, team_id, project_id } : void 0;
-}
-function authCloudflare(cfg, env) {
-  const api_token = clean(cfg?.auth?.cloudflare?.api_token) ?? clean(env.CLOUDFLARE_API_TOKEN);
-  const worker_url = clean(cfg?.auth?.cloudflare?.worker_url) ?? clean(env.CLOUDFLARE_SANDBOX_WORKER_URL);
-  return api_token && worker_url ? { api_token, worker_url } : void 0;
-}
-function authBox(cfg, env) {
-  const api_key = clean(cfg?.auth?.box?.api_key) ?? clean(env.BOX_API_KEY);
-  return api_key ? { api_key } : void 0;
-}
-function authDocker(cfg, env) {
-  if (!dockerSandboxEnabled(env)) return;
-  return {
-    image: clean(cfg?.auth?.docker?.image) ?? clean(env.CLAXEDO_DOCKER_SANDBOX_IMAGE) ?? clean(env.CLAXEDO_SANDBOX_IMAGE) ?? defaultSandboxImage(workspaceRuntimeVersion(), void 0, env)
-  };
+function dockerSandboxDriverEnabled2(env = process.env) {
+  return dockerSandboxDriverEnabled(env);
 }
 export {
-  defaultSandboxDriverID,
-  dockerSandboxDriverEnabled,
-  hasSandboxDriverAuth,
-  isSandboxDriverID,
-  listSandboxDrivers,
-  sandboxDriverAuth,
+  dockerSandboxDriverEnabled2 as dockerSandboxDriverEnabled,
+  localBrokeringTestDriverCatalogEntry,
   sandboxDriverCatalog,
   sandboxDriverId,
-  sandboxDriverIds,
+  sandboxMachineCostUsd,
+  sandboxMachineRate,
   validateSandboxPersistenceCapabilities
 };