@cloudflare/sandbox 0.0.0-46eb4e6 → 0.0.0-485cf61

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (95) hide show
  1. package/CHANGELOG.md +0 -6
  2. package/Dockerfile +82 -18
  3. package/README.md +89 -824
  4. package/dist/chunk-3NEP4CNV.js +99 -0
  5. package/dist/chunk-3NEP4CNV.js.map +1 -0
  6. package/dist/chunk-6IYG2RIN.js +117 -0
  7. package/dist/chunk-6IYG2RIN.js.map +1 -0
  8. package/dist/chunk-HB44YO2A.js +2331 -0
  9. package/dist/chunk-HB44YO2A.js.map +1 -0
  10. package/dist/chunk-KPVMMMIP.js +105 -0
  11. package/dist/chunk-KPVMMMIP.js.map +1 -0
  12. package/dist/chunk-NNGBXDMY.js +89 -0
  13. package/dist/chunk-NNGBXDMY.js.map +1 -0
  14. package/dist/file-stream.d.ts +43 -0
  15. package/dist/file-stream.js +9 -0
  16. package/dist/file-stream.js.map +1 -0
  17. package/dist/index.d.ts +9 -0
  18. package/dist/index.js +55 -0
  19. package/dist/index.js.map +1 -0
  20. package/dist/interpreter.d.ts +33 -0
  21. package/dist/interpreter.js +8 -0
  22. package/dist/interpreter.js.map +1 -0
  23. package/dist/request-handler.d.ts +18 -0
  24. package/dist/request-handler.js +12 -0
  25. package/dist/request-handler.js.map +1 -0
  26. package/dist/sandbox-CtlKjZwf.d.ts +583 -0
  27. package/dist/sandbox.d.ts +4 -0
  28. package/dist/sandbox.js +12 -0
  29. package/dist/sandbox.js.map +1 -0
  30. package/dist/security.d.ts +35 -0
  31. package/dist/security.js +15 -0
  32. package/dist/security.js.map +1 -0
  33. package/dist/sse-parser.d.ts +28 -0
  34. package/dist/sse-parser.js +11 -0
  35. package/dist/sse-parser.js.map +1 -0
  36. package/package.json +11 -5
  37. package/src/clients/base-client.ts +297 -0
  38. package/src/clients/command-client.ts +118 -0
  39. package/src/clients/file-client.ts +272 -0
  40. package/src/clients/git-client.ts +95 -0
  41. package/src/clients/index.ts +63 -0
  42. package/src/{interpreter-client.ts → clients/interpreter-client.ts} +151 -171
  43. package/src/clients/port-client.ts +108 -0
  44. package/src/clients/process-client.ts +180 -0
  45. package/src/clients/sandbox-client.ts +41 -0
  46. package/src/clients/types.ts +81 -0
  47. package/src/clients/utility-client.ts +97 -0
  48. package/src/errors/adapter.ts +180 -0
  49. package/src/errors/classes.ts +469 -0
  50. package/src/errors/index.ts +105 -0
  51. package/src/file-stream.ts +119 -117
  52. package/src/index.ts +81 -69
  53. package/src/interpreter.ts +17 -8
  54. package/src/request-handler.ts +61 -7
  55. package/src/sandbox.ts +698 -495
  56. package/src/security.ts +20 -0
  57. package/startup.sh +7 -0
  58. package/tests/base-client.test.ts +328 -0
  59. package/tests/command-client.test.ts +407 -0
  60. package/tests/file-client.test.ts +643 -0
  61. package/tests/file-stream.test.ts +306 -0
  62. package/tests/git-client.test.ts +328 -0
  63. package/tests/port-client.test.ts +301 -0
  64. package/tests/process-client.test.ts +658 -0
  65. package/tests/sandbox.test.ts +465 -0
  66. package/tests/sse-parser.test.ts +291 -0
  67. package/tests/utility-client.test.ts +266 -0
  68. package/tests/wrangler.jsonc +35 -0
  69. package/tsconfig.json +9 -1
  70. package/vitest.config.ts +31 -0
  71. package/container_src/bun.lock +0 -76
  72. package/container_src/circuit-breaker.ts +0 -121
  73. package/container_src/control-process.ts +0 -784
  74. package/container_src/handler/exec.ts +0 -185
  75. package/container_src/handler/file.ts +0 -457
  76. package/container_src/handler/git.ts +0 -130
  77. package/container_src/handler/ports.ts +0 -314
  78. package/container_src/handler/process.ts +0 -568
  79. package/container_src/handler/session.ts +0 -92
  80. package/container_src/index.ts +0 -600
  81. package/container_src/interpreter-service.ts +0 -276
  82. package/container_src/isolation.ts +0 -1213
  83. package/container_src/mime-processor.ts +0 -255
  84. package/container_src/package.json +0 -18
  85. package/container_src/runtime/executors/javascript/node_executor.ts +0 -123
  86. package/container_src/runtime/executors/python/ipython_executor.py +0 -338
  87. package/container_src/runtime/executors/typescript/ts_executor.ts +0 -138
  88. package/container_src/runtime/process-pool.ts +0 -464
  89. package/container_src/shell-escape.ts +0 -42
  90. package/container_src/startup.sh +0 -11
  91. package/container_src/types.ts +0 -131
  92. package/src/client.ts +0 -1048
  93. package/src/errors.ts +0 -219
  94. package/src/interpreter-types.ts +0 -390
  95. package/src/types.ts +0 -571
@@ -0,0 +1,583 @@
1
+ import * as _repo_shared from '@repo/shared';
2
+ import { MkdirResult, WriteFileResult, ReadFileResult, DeleteFileResult, RenameFileResult, MoveFileResult, ListFilesOptions, ListFilesResult, GitCheckoutResult, CreateContextOptions, CodeContext, OutputMessage, Result, ExecutionError, PortExposeResult, PortCloseResult, PortListResult, ProcessStartResult, ProcessListResult, ProcessInfoResult, ProcessKillResult, ProcessCleanupResult, ProcessLogsResult, ISandbox, ExecOptions, ExecResult, ProcessOptions, Process, StreamOptions, SessionOptions, ExecutionSession, RunCodeOptions, ExecutionResult } from '@repo/shared';
3
+ import { DurableObject } from 'cloudflare:workers';
4
+ import { Container } from '@cloudflare/containers';
5
+
6
+ /**
7
+ * Minimal interface for container fetch functionality
8
+ */
9
+ interface ContainerStub {
10
+ containerFetch(url: string, options: RequestInit, port?: number): Promise<Response>;
11
+ }
12
+ /**
13
+ * Shared HTTP client configuration options
14
+ */
15
+ interface HttpClientOptions {
16
+ baseUrl?: string;
17
+ port?: number;
18
+ stub?: ContainerStub;
19
+ onCommandComplete?: (success: boolean, exitCode: number, stdout: string, stderr: string, command: string) => void;
20
+ onError?: (error: string, command?: string) => void;
21
+ }
22
+ /**
23
+ * Base response interface for all API responses
24
+ */
25
+ interface BaseApiResponse {
26
+ success: boolean;
27
+ timestamp: string;
28
+ }
29
+ /**
30
+ * Legacy error response interface - deprecated, use ApiErrorResponse
31
+ */
32
+ interface ErrorResponse {
33
+ error: string;
34
+ details?: string;
35
+ code?: string;
36
+ }
37
+ /**
38
+ * HTTP request configuration
39
+ */
40
+ interface RequestConfig extends RequestInit {
41
+ endpoint: string;
42
+ data?: Record<string, any>;
43
+ }
44
+ /**
45
+ * Typed response handler
46
+ */
47
+ type ResponseHandler<T> = (response: Response) => Promise<T>;
48
+ /**
49
+ * Common session-aware request interface
50
+ */
51
+ interface SessionRequest {
52
+ sessionId?: string;
53
+ }
54
+
55
+ /**
56
+ * Abstract base class providing common HTTP functionality for all domain clients
57
+ */
58
+ declare abstract class BaseHttpClient {
59
+ protected baseUrl: string;
60
+ protected options: HttpClientOptions;
61
+ constructor(options?: HttpClientOptions);
62
+ /**
63
+ * Core HTTP request method with automatic retry for container provisioning delays
64
+ */
65
+ protected doFetch(path: string, options?: RequestInit): Promise<Response>;
66
+ /**
67
+ * Make a POST request with JSON body
68
+ */
69
+ protected post<T>(endpoint: string, data: Record<string, any>, responseHandler?: ResponseHandler<T>): Promise<T>;
70
+ /**
71
+ * Make a GET request
72
+ */
73
+ protected get<T>(endpoint: string, responseHandler?: ResponseHandler<T>): Promise<T>;
74
+ /**
75
+ * Make a DELETE request
76
+ */
77
+ protected delete<T>(endpoint: string, responseHandler?: ResponseHandler<T>): Promise<T>;
78
+ /**
79
+ * Handle HTTP response with error checking and parsing
80
+ */
81
+ protected handleResponse<T>(response: Response, customHandler?: ResponseHandler<T>): Promise<T>;
82
+ /**
83
+ * Handle error responses with consistent error throwing
84
+ */
85
+ protected handleErrorResponse(response: Response): Promise<never>;
86
+ /**
87
+ * Create a streaming response handler for Server-Sent Events
88
+ */
89
+ protected handleStreamResponse(response: Response): Promise<ReadableStream<Uint8Array>>;
90
+ /**
91
+ * Utility method to log successful operations
92
+ */
93
+ protected logSuccess(operation: string, details?: string): void;
94
+ /**
95
+ * Utility method to log errors
96
+ */
97
+ protected logError(operation: string, error: unknown): void;
98
+ /**
99
+ * Check if 503 response is from container provisioning (retryable)
100
+ * vs user application (not retryable)
101
+ */
102
+ private isContainerProvisioningError;
103
+ private executeFetch;
104
+ }
105
+
106
+ /**
107
+ * Request interface for command execution
108
+ */
109
+ interface ExecuteRequest extends SessionRequest {
110
+ command: string;
111
+ timeoutMs?: number;
112
+ }
113
+ /**
114
+ * Response interface for command execution
115
+ */
116
+ interface ExecuteResponse extends BaseApiResponse {
117
+ stdout: string;
118
+ stderr: string;
119
+ exitCode: number;
120
+ command: string;
121
+ }
122
+ /**
123
+ * Client for command execution operations
124
+ */
125
+ declare class CommandClient extends BaseHttpClient {
126
+ constructor(options?: HttpClientOptions);
127
+ /**
128
+ * Execute a command and return the complete result
129
+ * @param command - The command to execute
130
+ * @param sessionId - The session ID for this command execution
131
+ * @param timeoutMs - Optional timeout in milliseconds (unlimited by default)
132
+ */
133
+ execute(command: string, sessionId: string, timeoutMs?: number): Promise<ExecuteResponse>;
134
+ /**
135
+ * Execute a command and return a stream of events
136
+ * @param command - The command to execute
137
+ * @param sessionId - The session ID for this command execution
138
+ */
139
+ executeStream(command: string, sessionId: string): Promise<ReadableStream<Uint8Array>>;
140
+ }
141
+
142
+ /**
143
+ * Request interface for creating directories
144
+ */
145
+ interface MkdirRequest extends SessionRequest {
146
+ path: string;
147
+ recursive?: boolean;
148
+ }
149
+ /**
150
+ * Request interface for writing files
151
+ */
152
+ interface WriteFileRequest extends SessionRequest {
153
+ path: string;
154
+ content: string;
155
+ encoding?: string;
156
+ }
157
+ /**
158
+ * Request interface for reading files
159
+ */
160
+ interface ReadFileRequest extends SessionRequest {
161
+ path: string;
162
+ encoding?: string;
163
+ }
164
+ /**
165
+ * Request interface for file operations (delete, rename, move)
166
+ */
167
+ interface FileOperationRequest extends SessionRequest {
168
+ path: string;
169
+ newPath?: string;
170
+ }
171
+ /**
172
+ * Client for file system operations
173
+ */
174
+ declare class FileClient extends BaseHttpClient {
175
+ constructor(options?: HttpClientOptions);
176
+ /**
177
+ * Create a directory
178
+ * @param path - Directory path to create
179
+ * @param sessionId - The session ID for this operation
180
+ * @param options - Optional settings (recursive)
181
+ */
182
+ mkdir(path: string, sessionId: string, options?: {
183
+ recursive?: boolean;
184
+ }): Promise<MkdirResult>;
185
+ /**
186
+ * Write content to a file
187
+ * @param path - File path to write to
188
+ * @param content - Content to write
189
+ * @param sessionId - The session ID for this operation
190
+ * @param options - Optional settings (encoding)
191
+ */
192
+ writeFile(path: string, content: string, sessionId: string, options?: {
193
+ encoding?: string;
194
+ }): Promise<WriteFileResult>;
195
+ /**
196
+ * Read content from a file
197
+ * @param path - File path to read from
198
+ * @param sessionId - The session ID for this operation
199
+ * @param options - Optional settings (encoding)
200
+ */
201
+ readFile(path: string, sessionId: string, options?: {
202
+ encoding?: string;
203
+ }): Promise<ReadFileResult>;
204
+ /**
205
+ * Stream a file using Server-Sent Events
206
+ * Returns a ReadableStream of SSE events containing metadata, chunks, and completion
207
+ * @param path - File path to stream
208
+ * @param sessionId - The session ID for this operation
209
+ */
210
+ readFileStream(path: string, sessionId: string): Promise<ReadableStream<Uint8Array>>;
211
+ /**
212
+ * Delete a file
213
+ * @param path - File path to delete
214
+ * @param sessionId - The session ID for this operation
215
+ */
216
+ deleteFile(path: string, sessionId: string): Promise<DeleteFileResult>;
217
+ /**
218
+ * Rename a file
219
+ * @param path - Current file path
220
+ * @param newPath - New file path
221
+ * @param sessionId - The session ID for this operation
222
+ */
223
+ renameFile(path: string, newPath: string, sessionId: string): Promise<RenameFileResult>;
224
+ /**
225
+ * Move a file
226
+ * @param path - Current file path
227
+ * @param newPath - Destination file path
228
+ * @param sessionId - The session ID for this operation
229
+ */
230
+ moveFile(path: string, newPath: string, sessionId: string): Promise<MoveFileResult>;
231
+ /**
232
+ * List files in a directory
233
+ * @param path - Directory path to list
234
+ * @param sessionId - The session ID for this operation
235
+ * @param options - Optional settings (recursive, includeHidden)
236
+ */
237
+ listFiles(path: string, sessionId: string, options?: ListFilesOptions): Promise<ListFilesResult>;
238
+ }
239
+
240
+ /**
241
+ * Request interface for Git checkout operations
242
+ */
243
+ interface GitCheckoutRequest extends SessionRequest {
244
+ repoUrl: string;
245
+ branch?: string;
246
+ targetDir?: string;
247
+ }
248
+ /**
249
+ * Client for Git repository operations
250
+ */
251
+ declare class GitClient extends BaseHttpClient {
252
+ constructor(options?: HttpClientOptions);
253
+ /**
254
+ * Clone a Git repository
255
+ * @param repoUrl - URL of the Git repository to clone
256
+ * @param sessionId - The session ID for this operation
257
+ * @param options - Optional settings (branch, targetDir)
258
+ */
259
+ checkout(repoUrl: string, sessionId: string, options?: {
260
+ branch?: string;
261
+ targetDir?: string;
262
+ }): Promise<GitCheckoutResult>;
263
+ /**
264
+ * Extract repository name from URL for default directory name
265
+ */
266
+ private extractRepoName;
267
+ }
268
+
269
+ interface ExecutionCallbacks {
270
+ onStdout?: (output: OutputMessage) => void | Promise<void>;
271
+ onStderr?: (output: OutputMessage) => void | Promise<void>;
272
+ onResult?: (result: Result) => void | Promise<void>;
273
+ onError?: (error: ExecutionError) => void | Promise<void>;
274
+ }
275
+ declare class InterpreterClient extends BaseHttpClient {
276
+ private readonly maxRetries;
277
+ private readonly retryDelayMs;
278
+ constructor(options?: HttpClientOptions);
279
+ createCodeContext(options?: CreateContextOptions): Promise<CodeContext>;
280
+ runCodeStream(contextId: string | undefined, code: string, language: string | undefined, callbacks: ExecutionCallbacks, timeoutMs?: number): Promise<void>;
281
+ listCodeContexts(): Promise<CodeContext[]>;
282
+ deleteCodeContext(contextId: string): Promise<void>;
283
+ /**
284
+ * Execute an operation with automatic retry for transient errors
285
+ */
286
+ private executeWithRetry;
287
+ private isRetryableError;
288
+ private parseErrorResponse;
289
+ private readLines;
290
+ private parseExecutionResult;
291
+ }
292
+
293
+ /**
294
+ * Request interface for exposing ports
295
+ */
296
+ interface ExposePortRequest {
297
+ port: number;
298
+ name?: string;
299
+ }
300
+ /**
301
+ * Request interface for unexposing ports
302
+ */
303
+ interface UnexposePortRequest {
304
+ port: number;
305
+ }
306
+ /**
307
+ * Client for port management and preview URL operations
308
+ */
309
+ declare class PortClient extends BaseHttpClient {
310
+ constructor(options?: HttpClientOptions);
311
+ /**
312
+ * Expose a port and get a preview URL
313
+ * @param port - Port number to expose
314
+ * @param sessionId - The session ID for this operation
315
+ * @param name - Optional name for the port
316
+ */
317
+ exposePort(port: number, sessionId: string, name?: string): Promise<PortExposeResult>;
318
+ /**
319
+ * Unexpose a port and remove its preview URL
320
+ * @param port - Port number to unexpose
321
+ * @param sessionId - The session ID for this operation
322
+ */
323
+ unexposePort(port: number, sessionId: string): Promise<PortCloseResult>;
324
+ /**
325
+ * Get all currently exposed ports
326
+ * @param sessionId - The session ID for this operation
327
+ */
328
+ getExposedPorts(sessionId: string): Promise<PortListResult>;
329
+ }
330
+
331
+ /**
332
+ * Client for background process management
333
+ */
334
+ declare class ProcessClient extends BaseHttpClient {
335
+ constructor(options?: HttpClientOptions);
336
+ /**
337
+ * Start a background process
338
+ * @param command - Command to execute as a background process
339
+ * @param sessionId - The session ID for this operation
340
+ * @param options - Optional settings (processId)
341
+ */
342
+ startProcess(command: string, sessionId: string, options?: {
343
+ processId?: string;
344
+ }): Promise<ProcessStartResult>;
345
+ /**
346
+ * List all processes (sandbox-scoped, not session-scoped)
347
+ */
348
+ listProcesses(): Promise<ProcessListResult>;
349
+ /**
350
+ * Get information about a specific process (sandbox-scoped, not session-scoped)
351
+ * @param processId - ID of the process to retrieve
352
+ */
353
+ getProcess(processId: string): Promise<ProcessInfoResult>;
354
+ /**
355
+ * Kill a specific process (sandbox-scoped, not session-scoped)
356
+ * @param processId - ID of the process to kill
357
+ */
358
+ killProcess(processId: string): Promise<ProcessKillResult>;
359
+ /**
360
+ * Kill all running processes (sandbox-scoped, not session-scoped)
361
+ */
362
+ killAllProcesses(): Promise<ProcessCleanupResult>;
363
+ /**
364
+ * Get logs from a specific process (sandbox-scoped, not session-scoped)
365
+ * @param processId - ID of the process to get logs from
366
+ */
367
+ getProcessLogs(processId: string): Promise<ProcessLogsResult>;
368
+ /**
369
+ * Stream logs from a specific process (sandbox-scoped, not session-scoped)
370
+ * @param processId - ID of the process to stream logs from
371
+ */
372
+ streamProcessLogs(processId: string): Promise<ReadableStream<Uint8Array>>;
373
+ }
374
+
375
+ /**
376
+ * Response interface for ping operations
377
+ */
378
+ interface PingResponse extends BaseApiResponse {
379
+ message: string;
380
+ uptime?: number;
381
+ }
382
+ /**
383
+ * Response interface for getting available commands
384
+ */
385
+ interface CommandsResponse extends BaseApiResponse {
386
+ availableCommands: string[];
387
+ count: number;
388
+ }
389
+ /**
390
+ * Request interface for creating sessions
391
+ */
392
+ interface CreateSessionRequest {
393
+ id: string;
394
+ env?: Record<string, string>;
395
+ cwd?: string;
396
+ }
397
+ /**
398
+ * Response interface for creating sessions
399
+ */
400
+ interface CreateSessionResponse extends BaseApiResponse {
401
+ id: string;
402
+ message: string;
403
+ }
404
+ /**
405
+ * Client for health checks and utility operations
406
+ */
407
+ declare class UtilityClient extends BaseHttpClient {
408
+ constructor(options?: HttpClientOptions);
409
+ /**
410
+ * Ping the sandbox to check if it's responsive
411
+ */
412
+ ping(): Promise<string>;
413
+ /**
414
+ * Get list of available commands in the sandbox environment
415
+ */
416
+ getCommands(): Promise<string[]>;
417
+ /**
418
+ * Create a new execution session
419
+ * @param options - Session configuration (id, env, cwd)
420
+ */
421
+ createSession(options: CreateSessionRequest): Promise<CreateSessionResponse>;
422
+ }
423
+
424
+ /**
425
+ * Main sandbox client that composes all domain-specific clients
426
+ * Provides organized access to all sandbox functionality
427
+ */
428
+ declare class SandboxClient {
429
+ readonly commands: CommandClient;
430
+ readonly files: FileClient;
431
+ readonly processes: ProcessClient;
432
+ readonly ports: PortClient;
433
+ readonly git: GitClient;
434
+ readonly interpreter: InterpreterClient;
435
+ readonly utils: UtilityClient;
436
+ constructor(options?: HttpClientOptions);
437
+ }
438
+
439
+ declare function getSandbox(ns: DurableObjectNamespace<Sandbox>, id: string): DurableObjectStub<Sandbox<unknown>>;
440
+ declare class Sandbox<Env = unknown> extends Container<Env> implements ISandbox {
441
+ defaultPort: number;
442
+ sleepAfter: string;
443
+ client: SandboxClient;
444
+ private codeInterpreter;
445
+ private sandboxName;
446
+ private portTokens;
447
+ private defaultSession;
448
+ envVars: Record<string, string>;
449
+ constructor(ctx: DurableObject['ctx'], env: Env);
450
+ setSandboxName(name: string): Promise<void>;
451
+ setEnvVars(envVars: Record<string, string>): Promise<void>;
452
+ /**
453
+ * Cleanup and destroy the sandbox container
454
+ */
455
+ destroy(): Promise<void>;
456
+ onStart(): void;
457
+ onStop(): void;
458
+ onError(error: unknown): void;
459
+ fetch(request: Request): Promise<Response>;
460
+ private determinePort;
461
+ /**
462
+ * Ensure default session exists - lazy initialization
463
+ * This is called automatically by all public methods that need a session
464
+ */
465
+ private ensureDefaultSession;
466
+ exec(command: string, options?: ExecOptions): Promise<ExecResult>;
467
+ /**
468
+ * Internal session-aware exec implementation
469
+ * Used by both public exec() and session wrappers
470
+ */
471
+ private execWithSession;
472
+ private executeWithStreaming;
473
+ private mapExecuteResponseToExecResult;
474
+ /**
475
+ * Create a Process domain object from HTTP client DTO
476
+ * Centralizes process object creation with bound methods
477
+ * This eliminates duplication across startProcess, listProcesses, getProcess, and session wrappers
478
+ */
479
+ private createProcessFromDTO;
480
+ startProcess(command: string, options?: ProcessOptions, sessionId?: string): Promise<Process>;
481
+ listProcesses(sessionId?: string): Promise<Process[]>;
482
+ getProcess(id: string, sessionId?: string): Promise<Process | null>;
483
+ killProcess(id: string, signal?: string, sessionId?: string): Promise<void>;
484
+ killAllProcesses(sessionId?: string): Promise<number>;
485
+ cleanupCompletedProcesses(sessionId?: string): Promise<number>;
486
+ getProcessLogs(id: string, sessionId?: string): Promise<{
487
+ stdout: string;
488
+ stderr: string;
489
+ processId: string;
490
+ }>;
491
+ execStream(command: string, options?: StreamOptions): Promise<ReadableStream<Uint8Array>>;
492
+ /**
493
+ * Internal session-aware execStream implementation
494
+ */
495
+ private execStreamWithSession;
496
+ streamProcessLogs(processId: string, options?: {
497
+ signal?: AbortSignal;
498
+ }): Promise<ReadableStream<Uint8Array>>;
499
+ /**
500
+ * Internal session-aware streamProcessLogs implementation
501
+ */
502
+ private streamProcessLogsWithSession;
503
+ gitCheckout(repoUrl: string, options: {
504
+ branch?: string;
505
+ targetDir?: string;
506
+ sessionId?: string;
507
+ }): Promise<_repo_shared.GitCheckoutResult>;
508
+ mkdir(path: string, options?: {
509
+ recursive?: boolean;
510
+ sessionId?: string;
511
+ }): Promise<_repo_shared.MkdirResult>;
512
+ writeFile(path: string, content: string, options?: {
513
+ encoding?: string;
514
+ sessionId?: string;
515
+ }): Promise<_repo_shared.WriteFileResult>;
516
+ deleteFile(path: string, sessionId?: string): Promise<_repo_shared.DeleteFileResult>;
517
+ renameFile(oldPath: string, newPath: string, sessionId?: string): Promise<_repo_shared.RenameFileResult>;
518
+ moveFile(sourcePath: string, destinationPath: string, sessionId?: string): Promise<_repo_shared.MoveFileResult>;
519
+ readFile(path: string, options?: {
520
+ encoding?: string;
521
+ sessionId?: string;
522
+ }): Promise<_repo_shared.ReadFileResult>;
523
+ /**
524
+ * Stream a file from the sandbox using Server-Sent Events
525
+ * Returns a ReadableStream that can be consumed with streamFile() or collectFile() utilities
526
+ * @param path - Path to the file to stream
527
+ * @param options - Optional session ID
528
+ */
529
+ readFileStream(path: string, options?: {
530
+ sessionId?: string;
531
+ }): Promise<ReadableStream<Uint8Array>>;
532
+ listFiles(path: string, options?: {
533
+ recursive?: boolean;
534
+ includeHidden?: boolean;
535
+ }): Promise<_repo_shared.ListFilesResult>;
536
+ exposePort(port: number, options: {
537
+ name?: string;
538
+ hostname: string;
539
+ }): Promise<{
540
+ url: string;
541
+ port: number;
542
+ name: string | undefined;
543
+ }>;
544
+ unexposePort(port: number): Promise<void>;
545
+ getExposedPorts(hostname: string): Promise<{
546
+ url: string;
547
+ port: number;
548
+ status: "active" | "inactive";
549
+ }[]>;
550
+ isPortExposed(port: number): Promise<boolean>;
551
+ validatePortToken(port: number, token: string): Promise<boolean>;
552
+ private generatePortToken;
553
+ private persistPortTokens;
554
+ private constructPreviewUrl;
555
+ /**
556
+ * Create isolated execution session for advanced use cases
557
+ * Returns ExecutionSession with full sandbox API bound to specific session
558
+ */
559
+ createSession(options?: SessionOptions): Promise<ExecutionSession>;
560
+ /**
561
+ * Get an existing session by ID
562
+ * Returns ExecutionSession wrapper bound to the specified session
563
+ *
564
+ * This is useful for retrieving sessions across different requests/contexts
565
+ * without storing the ExecutionSession object (which has RPC lifecycle limitations)
566
+ *
567
+ * @param sessionId - The ID of an existing session
568
+ * @returns ExecutionSession wrapper bound to the session
569
+ */
570
+ getSession(sessionId: string): Promise<ExecutionSession>;
571
+ /**
572
+ * Internal helper to create ExecutionSession wrapper for a given sessionId
573
+ * Used by both createSession and getSession
574
+ */
575
+ private getSessionWrapper;
576
+ createCodeContext(options?: CreateContextOptions): Promise<CodeContext>;
577
+ runCode(code: string, options?: RunCodeOptions): Promise<ExecutionResult>;
578
+ runCodeStream(code: string, options?: RunCodeOptions): Promise<ReadableStream>;
579
+ listCodeContexts(): Promise<CodeContext[]>;
580
+ deleteCodeContext(contextId: string): Promise<void>;
581
+ }
582
+
583
+ export { type BaseApiResponse as B, CommandClient as C, type ErrorResponse as E, FileClient as F, GitClient as G, type HttpClientOptions as H, InterpreterClient as I, type MkdirRequest as M, PortClient as P, type ReadFileRequest as R, SandboxClient as S, UtilityClient as U, type WriteFileRequest as W, ProcessClient as a, Sandbox as b, type CommandsResponse as c, type ContainerStub as d, type ExecuteRequest as e, type ExecuteResponse as f, getSandbox as g, type ExposePortRequest as h, type FileOperationRequest as i, type GitCheckoutRequest as j, type PingResponse as k, type RequestConfig as l, type ResponseHandler as m, type SessionRequest as n, type UnexposePortRequest as o, type ExecutionCallbacks as p };
@@ -0,0 +1,4 @@
1
+ import '@repo/shared';
2
+ import 'cloudflare:workers';
3
+ import '@cloudflare/containers';
4
+ export { b as Sandbox, g as getSandbox } from './sandbox-CtlKjZwf.js';
@@ -0,0 +1,12 @@
1
+ import {
2
+ Sandbox,
3
+ getSandbox
4
+ } from "./chunk-HB44YO2A.js";
5
+ import "./chunk-6IYG2RIN.js";
6
+ import "./chunk-3NEP4CNV.js";
7
+ import "./chunk-NNGBXDMY.js";
8
+ export {
9
+ Sandbox,
10
+ getSandbox
11
+ };
12
+ //# sourceMappingURL=sandbox.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
@@ -0,0 +1,35 @@
1
+ /**
2
+ * Security utilities for URL construction and input validation
3
+ *
4
+ * This module contains critical security functions to prevent:
5
+ * - URL injection attacks
6
+ * - SSRF (Server-Side Request Forgery) attacks
7
+ * - DNS rebinding attacks
8
+ * - Host header injection
9
+ * - Open redirect vulnerabilities
10
+ */
11
+ declare class SecurityError extends Error {
12
+ readonly code?: string | undefined;
13
+ constructor(message: string, code?: string | undefined);
14
+ }
15
+ /**
16
+ * Validates port numbers for sandbox services
17
+ * Only allows non-system ports to prevent conflicts and security issues
18
+ */
19
+ declare function validatePort(port: number): boolean;
20
+ /**
21
+ * Sanitizes and validates sandbox IDs for DNS compliance and security
22
+ * Only enforces critical requirements - allows maximum developer flexibility
23
+ */
24
+ declare function sanitizeSandboxId(id: string): string;
25
+ /**
26
+ * Validates language for code interpreter
27
+ * Only allows supported languages
28
+ */
29
+ declare function validateLanguage(language: string | undefined): void;
30
+ /**
31
+ * Logs security events for monitoring
32
+ */
33
+ declare function logSecurityEvent(event: string, details: Record<string, any>, severity?: 'low' | 'medium' | 'high' | 'critical'): void;
34
+
35
+ export { SecurityError, logSecurityEvent, sanitizeSandboxId, validateLanguage, validatePort };
@@ -0,0 +1,15 @@
1
+ import {
2
+ SecurityError,
3
+ logSecurityEvent,
4
+ sanitizeSandboxId,
5
+ validateLanguage,
6
+ validatePort
7
+ } from "./chunk-3NEP4CNV.js";
8
+ export {
9
+ SecurityError,
10
+ logSecurityEvent,
11
+ sanitizeSandboxId,
12
+ validateLanguage,
13
+ validatePort
14
+ };
15
+ //# sourceMappingURL=security.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
@@ -0,0 +1,28 @@
1
+ /**
2
+ * Server-Sent Events (SSE) parser for streaming responses
3
+ * Converts ReadableStream<Uint8Array> to typed AsyncIterable<T>
4
+ */
5
+ /**
6
+ * Parse a ReadableStream of SSE events into typed AsyncIterable
7
+ * @param stream - The ReadableStream from fetch response
8
+ * @param signal - Optional AbortSignal for cancellation
9
+ */
10
+ declare function parseSSEStream<T>(stream: ReadableStream<Uint8Array>, signal?: AbortSignal): AsyncIterable<T>;
11
+ /**
12
+ * Helper to convert a Response with SSE stream directly to AsyncIterable
13
+ * @param response - Response object with SSE stream
14
+ * @param signal - Optional AbortSignal for cancellation
15
+ */
16
+ declare function responseToAsyncIterable<T>(response: Response, signal?: AbortSignal): AsyncIterable<T>;
17
+ /**
18
+ * Create an SSE-formatted ReadableStream from an AsyncIterable
19
+ * (Useful for Worker endpoints that need to forward AsyncIterable as SSE)
20
+ * @param events - AsyncIterable of events
21
+ * @param options - Stream options
22
+ */
23
+ declare function asyncIterableToSSEStream<T>(events: AsyncIterable<T>, options?: {
24
+ signal?: AbortSignal;
25
+ serialize?: (event: T) => string;
26
+ }): ReadableStream<Uint8Array>;
27
+
28
+ export { asyncIterableToSSEStream, parseSSEStream, responseToAsyncIterable };