@cloudflare/sandbox 0.13.0-next.651.1 → 0.13.0-next.681.1

package/dist/{rpc-types-PBUY-xXM.d.ts → index-B7QgIs0N.d.ts}

@@ -1,254 +1,32 @@
-//#region ../shared/dist/interpreter-types.d.ts
-interface CreateContextOptions {
-  /**
-   * Programming language for the context
-   * @default 'python'
-   */
-  language?: 'python' | 'javascript' | 'typescript';
-  /**
-   * Working directory for the context
-   * @default '/workspace'
-   */
-  cwd?: string;
-  /**
-   * Environment variables for the context.
-   * Undefined values are skipped (treated as "not configured").
-   */
-  envVars?: Record<string, string | undefined>;
-  /**
-   * Request timeout in milliseconds
-   * @default 30000
-   */
-  timeout?: number;
-}
-interface CodeContext {
-  /**
-   * Unique identifier for the context
-   */
-  readonly id: string;
-  /**
-   * Programming language of the context
-   */
-  readonly language: string;
-  /**
-   * Current working directory
-   */
-  readonly cwd: string;
-  /**
-   * When the context was created
-   */
-  readonly createdAt: Date;
-  /**
-   * When the context was last used
-   */
-  readonly lastUsed: Date;
-}
-interface RunCodeOptions {
-  /**
-   * Context to run the code in. If not provided, uses default context for the language
-   */
-  context?: CodeContext;
-  /**
-   * Language to use if context is not provided
-   * @default 'python'
-   */
-  language?: 'python' | 'javascript' | 'typescript';
-  /**
-   * Environment variables for this execution.
-   * Undefined values are skipped (treated as "not configured").
-   */
-  envVars?: Record<string, string | undefined>;
-  /**
-   * Execution timeout in milliseconds
-   * @default 60000
-   */
-  timeout?: number;
-  /**
-   * AbortSignal for cancelling execution
-   */
-  signal?: AbortSignal;
-  /**
-   * Callback for stdout output
-   */
-  onStdout?: (output: OutputMessage) => void | Promise<void>;
-  /**
-   * Callback for stderr output
-   */
-  onStderr?: (output: OutputMessage) => void | Promise<void>;
-  /**
-   * Callback for execution results (charts, tables, etc)
-   */
-  onResult?: (result: Result) => void | Promise<void>;
-  /**
-   * Callback for execution errors
-   */
-  onError?: (error: ExecutionError) => void | Promise<void>;
-}
-interface OutputMessage {
-  /**
-   * The output text
-   */
-  text: string;
-  /**
-   * Timestamp of the output
-   */
-  timestamp: number;
-}
-interface Result {
-  /**
-   * Plain text representation
-   */
-  text?: string;
-  /**
-   * HTML representation (tables, formatted output)
-   */
-  html?: string;
-  /**
-   * PNG image data (base64 encoded)
-   */
-  png?: string;
-  /**
-   * JPEG image data (base64 encoded)
-   */
-  jpeg?: string;
-  /**
-   * SVG image data
-   */
-  svg?: string;
-  /**
-   * LaTeX representation
-   */
-  latex?: string;
-  /**
-   * Markdown representation
-   */
-  markdown?: string;
-  /**
-   * JavaScript code to execute
-   */
-  javascript?: string;
-  /**
-   * JSON data
-   */
-  json?: any;
-  /**
-   * Chart data if the result is a visualization
-   */
-  chart?: ChartData;
-  /**
-   * Raw data object
-   */
-  data?: any;
-  /**
-   * Available output formats
-   */
-  formats(): string[];
-}
-interface ChartData {
-  /**
-   * Type of chart
-   */
-  type: 'line' | 'bar' | 'scatter' | 'pie' | 'histogram' | 'heatmap' | 'unknown';
-  /**
-   * Chart title
-   */
-  title?: string;
-  /**
-   * Chart data (format depends on library)
-   */
-  data: any;
-  /**
-   * Chart layout/configuration
-   */
-  layout?: any;
-  /**
-   * Additional configuration
-   */
-  config?: any;
-  /**
-   * Library that generated the chart
-   */
-  library?: 'matplotlib' | 'plotly' | 'altair' | 'seaborn' | 'unknown';
-  /**
-   * Base64 encoded image if available
-   */
-  image?: string;
-}
-interface ExecutionError {
-  /**
-   * Error name/type (e.g., 'NameError', 'SyntaxError')
-   */
-  name: string;
-  /**
-   * Error message
-   */
-  message: string;
-  /**
-   * Stack trace
-   */
-  traceback: string[];
-  /**
-   * Line number where error occurred
-   */
-  lineNumber?: number;
-}
-interface ExecutionResult {
-  code: string;
-  logs: {
-    stdout: string[];
-    stderr: string[];
-  };
-  error?: ExecutionError;
-  executionCount?: number;
-  results: Array<{
-    text?: string;
-    html?: string;
-    png?: string;
-    jpeg?: string;
-    svg?: string;
-    latex?: string;
-    markdown?: string;
-    javascript?: string;
-    json?: any;
-    chart?: ChartData;
-    data?: any;
-  }>;
-}
-declare class Execution {
-  readonly code: string;
-  readonly context: CodeContext;
-  /**
-   * All results from the execution
-   */
-  results: Result[];
-  /**
-   * Accumulated stdout and stderr
-   */
-  logs: {
-    stdout: string[];
-    stderr: string[];
-  };
-  /**
-   * Execution error if any
-   */
-  error?: ExecutionError;
-  /**
-   * Execution count (for interpreter)
-   */
-  executionCount?: number;
-  constructor(code: string, context: CodeContext);
-  /**
-   * Convert to a plain object for serialization
-   */
-  toJSON(): ExecutionResult;
-}
-//#endregion
+import { RpcTarget } from "cloudflare:workers";
+
 //#region ../shared/dist/pty-types.d.ts
 interface PtyOptions {
   cols?: number;
   rows?: number;
   shell?: string;
 }
+interface TerminalOptions {
+  id?: string;
+  cwd?: string;
+  shell?: string;
+}
+interface TerminalCreateOptions {
+  id: string;
+  cwd?: string;
+  shell?: string;
+  cols?: number;
+  rows?: number;
+}
+interface TerminalConnectOptions {
+  cols?: number;
+  rows?: number;
+}
+interface SandboxTerminal {
+  readonly id: string;
+  connect(request: Request, options?: TerminalConnectOptions): Promise<Response>;
+  destroy(): Promise<void>;
+}
 //#endregion
 //#region ../shared/dist/types.d.ts
 interface BaseExecOptions {
@@ -272,6 +50,11 @@ interface BaseExecOptions {
    */
   encoding?: string;
 }
+/**
+ * @deprecated Use `SandboxExecOptions` instead. Will be removed in a future
+ * release once all callers migrate to `sandbox.exec(cmd, options)` returning
+ * a `SandboxProcessPromise`. See `docs/EXEC_MIGRATION.md`.
+ */
 interface ExecOptions extends BaseExecOptions {
   /**
    * Enable real-time output streaming via callbacks
@@ -300,6 +83,10 @@ interface ExecOptions extends BaseExecOptions {
    */
   origin?: 'user' | 'internal';
 }
+/**
+ * @deprecated Use `SandboxExecOutput` (returned by
+ * `SandboxProcess.output()`) instead. Will be removed alongside `ExecOptions`.
+ */
 interface ExecResult {
   /**
    * Whether the command succeeded (exitCode === 0)
@@ -406,6 +193,17 @@ interface PortWatchRequest extends PortCheckRequest {
   /** Internal polling interval in ms (default: 500) */
   interval?: number;
 }
+interface ProcessQueryOptions {
+  /**
+   * Optional session ID used to bind returned process handles to an explicit session.
+   */
+  sessionId?: string;
+}
+/**
+ * @deprecated Use `SandboxExecOptions` with `processId` set instead. The
+ * unified `sandbox.exec()` returns the same `SandboxProcess` handle whether
+ * the caller wants a foreground or background process.
+ */
 interface ProcessOptions extends BaseExecOptions {
   /**
    * Optional session ID to run the background process in.
@@ -440,6 +238,12 @@ interface ProcessOptions extends BaseExecOptions {
   onError?: (error: Error) => void;
 }
 type ProcessStatus = 'starting' | 'running' | 'completed' | 'failed' | 'killed' | 'error';
+/**
+ * @deprecated Use `SandboxProcess` instead. The unified handle has the same
+ * `id`/`pid`/`command`/`status`/`startTime`/`sessionId` fields plus
+ * `stdin`/`stdout`/`stderr` streams, an `exitCode` promise, `output()` and
+ * `kill()` that mirror the `ctx.container.exec()` contract.
+ */
 interface Process {
   /**
    * Unique process identifier
@@ -522,6 +326,11 @@ interface Process {
    */
   waitForExit(timeout?: number): Promise<WaitForExitResult>;
 }
+/**
+ * @deprecated Internal SSE frame type. Consumers should read
+ * `SandboxProcess.stdout` / `.stderr` (raw byte streams) instead of parsing
+ * SSE frames. Retained while the legacy `execStream` HTTP route exists.
+ */
 interface ExecEvent {
   type: 'start' | 'stdout' | 'stderr' | 'complete' | 'error';
   timestamp: string;
@@ -533,6 +342,10 @@ interface ExecEvent {
   sessionId?: string;
   pid?: number;
 }
+/**
+ * @deprecated Internal SSE frame type for `streamProcessLogs`. Consumers
+ * should read `SandboxProcess.stdout` / `.stderr` instead.
+ */
 interface LogEvent {
   type: 'stdout' | 'stderr' | 'exit' | 'error';
   timestamp: string;
@@ -541,21 +354,231 @@ interface LogEvent {
   sessionId?: string;
   exitCode?: number;
 }
-interface StreamOptions extends BaseExecOptions {
+/**
+ * Options for `sandbox.exec(cmd, options)`.
+ *
+ * Mirrors `ContainerExecOptions` from
+ * `@cloudflare/workers-types/experimental` (`cwd`, `env`, `stdin`, `stdout`,
+ * `stderr`) with sandbox-specific extensions for sessions, named process
+ * ids, timeouts, and cancellation.
+ *
+ * Notable differences from the runtime contract:
+ * - `env` values may be `undefined` (treated as "not configured"). The
+ *   container API requires `Record<string, string>`; the SDK strips
+ *   `undefined` entries before forwarding.
+ * - `stdin` additionally accepts a plain `string` for convenience.
+ * - `user` is not yet supported (no session-backend story).
+ */
+interface SandboxExecOptions {
+  /** Working directory for command execution. */
+  cwd?: string;
   /**
-   * Optional session ID to run the streaming command in.
+   * Environment variables for this command invocation.
    *
-   * When omitted, the sandbox's default execution policy applies.
+   * Values temporarily override session-level/container-level env for the
+   * duration of the command but do not persist after it completes.
+   * Undefined values are skipped (treated as "not configured").
+   */
+  env?: Record<string, string | undefined>;
+  /**
+   * Standard input source.
+   *
+   * - `"pipe"` — `SandboxProcess.stdin` is a `WritableStream<Uint8Array>` the
+   *   caller can write to.
+   * - `ReadableStream<Uint8Array>` — the stream is piped into the command.
+   * - `string` — convenience: the string is utf-8 encoded and piped in.
+   * - omitted — stdin is closed.
+   */
+  stdin?: ReadableStream<Uint8Array> | string | 'pipe';
+  /**
+   * Standard output disposition.
+   *
+   * - `"pipe"` (default) — `SandboxProcess.stdout` exposes a
+   *   `ReadableStream<Uint8Array>` of the output.
+   * - `"ignore"` — output is discarded; `SandboxProcess.stdout` is `null`.
+   */
+  stdout?: 'pipe' | 'ignore';
+  /**
+   * Standard error disposition.
+   *
+   * - `"pipe"` (default) — `SandboxProcess.stderr` exposes a
+   *   `ReadableStream<Uint8Array>` of the error output.
+   * - `"ignore"` — stderr is discarded; `SandboxProcess.stderr` is `null`.
+   * - `"combined"` — stderr is merged into stdout; `SandboxProcess.stderr`
+   *   is `null`.
+   */
+  stderr?: 'pipe' | 'ignore' | 'combined';
+  /**
+   * Session ID providing working-directory and environment scope.
+   *
+   * When omitted, the sandbox's default execution policy applies (typically
+   * the persistent default session).
    */
   sessionId?: string;
   /**
-   * Buffer size for streaming output
+   * Client-chosen process id for later re-attach via
+   * `sandbox.getProcess(id)`.
+   *
+   * When omitted, a UUID is generated.
+   */
+  processId?: string;
+  /**
+   * Whether to remove the process record on exit.
+   *
+   * Currently retained for compatibility with legacy process options. Process
+   * records are kept so `output()`, `getLogs()`, and re-attach can read logs;
+   * callers can use `cleanupCompletedProcesses()` to remove completed records.
+   */
+  autoCleanup?: boolean;
+  /**
+   * Wall-clock timeout in milliseconds. When the timeout fires the
+   * implementation sends `SIGTERM`; `exitCode` resolves with the resulting
+   * code (typically `143` / `-15`).
    */
-  bufferSize?: number;
+  timeout?: number;
   /**
-   * AbortSignal for cancelling stream
+   * External cancellation signal. Aborting triggers `kill()` and propagates
+   * to in-flight stream consumers.
    */
   signal?: AbortSignal;
+  /**
+   * Whether this command was initiated by the user or by internal
+   * infrastructure (backup, bucket mount, env setup, etc.).
+   *
+   * Sandbox-only; not part of the containers contract. Defaults to
+   * `'user'` when omitted.
+   */
+  origin?: 'user' | 'internal';
+}
+/**
+ * Buffered output returned by `SandboxProcess.output()`.
+ *
+ * Mirrors `ExecOutput` from the containers contract (`stdout`, `stderr`,
+ * `exitCode`) with sandbox-specific telemetry fields preserved from the
+ * legacy `ExecResult` so existing callers can migrate without losing
+ * information.
+ *
+ * `stdout` / `stderr` are `string` by default (utf-8) or `ArrayBuffer`
+ * when `output({ encoding: 'buffer' })` is requested.
+ */
+type SandboxOutputMode = 'pipe' | 'ignore';
+type SandboxStderrMode = 'pipe' | 'ignore' | 'combined';
+type SandboxOutputEncoding = 'utf8' | 'buffer';
+interface SandboxExecOutputBase<T> {
+  /** Standard output content. */
+  stdout: T;
+  /** Standard error content. */
+  stderr: T;
+  /** Process exit code. */
+  exitCode: number;
+  /** True iff `exitCode === 0`. */
+  success: boolean;
+  /** Execution duration in milliseconds, measured by the SDK. */
+  duration: number;
+  /** Command that was executed (display form). */
+  command: string;
+  /** ISO timestamp when the command started. */
+  timestamp: string;
+  /** Session ID, if the command ran in a session. */
+  sessionId?: string;
+}
+type SandboxExecStringOutput = SandboxExecOutputBase<string>;
+type SandboxExecBufferOutput = SandboxExecOutputBase<ArrayBuffer>;
+type SandboxExecOutput = SandboxExecStringOutput | SandboxExecBufferOutput;
+/**
+ * Unified process handle returned (resolved) by `sandbox.exec()`.
+ *
+ * The first nine members are a superset of `ExecProcess` from the
+ * containers runtime contract (`stdin`, `stdout`, `stderr`, `pid`,
+ * `exitCode`, `output()`, `kill()`). The remaining members are
+ * sandbox-specific extensions for log replay, named processes, and the
+ * existing `waitFor*` helpers.
+ *
+ * On re-attach (via `sandbox.getProcess(id)`):
+ * - `stdin` is `null` (the original writer owns the pipe).
+ * - `stdout`/`stderr` are replay-then-tail streams sourced from the
+ *   per-process log file.
+ */
+interface SandboxProcess {
+  readonly stdin: WritableStream<Uint8Array> | null;
+  readonly stdout: ReadableStream<Uint8Array> | null;
+  readonly stderr: ReadableStream<Uint8Array> | null;
+  readonly pid: number;
+  readonly exitCode: Promise<number>;
+  /**
+   * Drain stdout/stderr and await exit. Mirrors `ExecProcess.output()`.
+   *
+   * Default encoding is utf-8 strings; pass `{ encoding: 'buffer' }` to get
+   * `ArrayBuffer` instead (matches the containers contract).
+   */
+  output(options: {
+    encoding: 'buffer';
+  }): Promise<SandboxExecBufferOutput>;
+  output(options?: {
+    encoding?: 'utf8';
+  }): Promise<SandboxExecStringOutput>;
+  output(options?: {
+    encoding?: SandboxOutputEncoding;
+  }): Promise<SandboxExecOutput>;
+  /** Sugar for `(await this.output({ encoding: 'utf8' })).stdout` as a string. */
+  text(): Promise<string>;
+  /** Sugar for `JSON.parse(await this.text())`. */
+  json<T = unknown>(): Promise<T>;
+  /**
+   * Terminate the process.
+   *
+   * Defaults to `SIGTERM` (15).
+   */
+  kill(signal?: number | string): void;
+  /** Stable sandbox process id (survives re-attach). */
+  readonly id: string;
+  /** Command that was executed (display form). */
+  readonly command: string;
+  /** Session ID, if the command was scoped to a session. */
+  readonly sessionId?: string;
+  /** When the process started. */
+  readonly startTime: Date;
+  /** Current status snapshot. Cheap; uses local state where possible. */
+  status(): Promise<ProcessStatus>;
+  /** Replay buffered logs (post-exit or mid-flight). */
+  getLogs(): Promise<{
+    stdout: string;
+    stderr: string;
+  }>;
+  /** Wait for a log pattern to appear in stdout/stderr. */
+  waitForLog(pattern: string | RegExp, timeoutMs?: number): Promise<WaitForLogResult>;
+  /** Wait for a TCP port (or HTTP endpoint) to become ready. */
+  waitForPort(port: number, options?: WaitForPortOptions): Promise<void>;
+  /** Wait for the process to exit. */
+  waitForExit(timeoutMs?: number): Promise<WaitForExitResult>;
+}
+/**
+ * The thenable returned by `sandbox.exec(cmd, options)`.
+ *
+ * Resolves to a `SandboxProcess` (so `await sandbox.exec(cmd)` works as
+ * expected) and additionally exposes the convenience members directly so
+ * callers can write `await sandbox.exec(cmd).output()` / `.text()` /
+ * `.json()` / `.kill()` without an extra `await`.
+ *
+ * Modeled on `Bun.spawn()` / `Deno.Command`.
+ */
+interface SandboxProcessPromise extends Promise<SandboxProcess> {
+  /** Equivalent to `(await this).output(options)`. */
+  output(options: {
+    encoding: 'buffer';
+  }): Promise<SandboxExecBufferOutput>;
+  output(options?: {
+    encoding?: 'utf8';
+  }): Promise<SandboxExecStringOutput>;
+  output(options?: {
+    encoding?: SandboxOutputEncoding;
+  }): Promise<SandboxExecOutput>;
+  /** Sugar for `(await this.output({ encoding: 'utf8' })).stdout` as a string. */
+  text(): Promise<string>;
+  /** Sugar for `JSON.parse(await this.text())`. */
+  json<T = unknown>(): Promise<T>;
+  /** Equivalent to `(await this).kill(signal)`. */
+  kill(signal?: number | string): Promise<void>;
 }
 interface SessionOptions {
   /**
@@ -804,14 +827,6 @@ interface ListFilesResult {
   timestamp: string;
   exitCode?: number;
 }
-interface GitCheckoutResult {
-  success: boolean;
-  repoUrl: string;
-  branch: string;
-  targetDir: string;
-  timestamp: string;
-  exitCode?: number;
-}
 /**
  * SSE events for file streaming
  */
@@ -961,6 +976,8 @@ interface ProcessListResult {
     startTime: string;
     endTime?: string;
     exitCode?: number;
+    stdout?: SandboxOutputMode;
+    stderr?: SandboxStderrMode;
   }>;
   timestamp: string;
 }
@@ -974,6 +991,8 @@ interface ProcessInfoResult {
     startTime: string;
     endTime?: string;
     exitCode?: number;
+    stdout?: SandboxOutputMode;
+    stderr?: SandboxStderrMode;
   };
   timestamp: string;
 }
@@ -1005,22 +1024,19 @@ interface SessionDeleteResult {
 interface ExecutionSession {
   /** Unique session identifier */
   readonly id: string;
-  exec(command: string, options?: ExecOptions): Promise<ExecResult>;
-  execStream(command: string, options?: StreamOptions): Promise<ReadableStream<Uint8Array>>;
-  startProcess(command: string, options?: ProcessOptions): Promise<Process>;
-  listProcesses(sessionId?: string): Promise<Process[]>;
-  getProcess(id: string, sessionId?: string): Promise<Process | null>;
-  killProcess(id: string, signal?: string): Promise<void>;
+  /**
+   * Session-scoped exec primitive. See `ISandbox.exec`.
+   *
+   * Caller-provided `options.sessionId` is ignored — this wrapper pins
+   * execution to the session that produced it.
+   */
+  exec(command: string | string[], options?: SandboxExecOptions): SandboxProcessPromise;
+  /** Session-scoped buffered execution helper. See `ISandbox.run`. */
+  run(command: string, options?: ExecOptions): Promise<ExecResult>;
+  getProcess(id: string): Promise<SandboxProcess | null>;
+  listProcesses(): Promise<SandboxProcess[]>;
   killAllProcesses(): Promise<number>;
   cleanupCompletedProcesses(): Promise<number>;
-  getProcessLogs(id: string): Promise<{
-    stdout: string;
-    stderr: string;
-    processId: string;
-  }>;
-  streamProcessLogs(processId: string, options?: {
-    signal?: AbortSignal;
-  }): Promise<ReadableStream<Uint8Array>>;
   writeFile(path: string, content: string | ReadableStream<Uint8Array>, options?: {
     encoding?: string;
   }): Promise<WriteFileResult>;
@@ -1041,20 +1057,7 @@ interface ExecutionSession {
   moveFile(sourcePath: string, destinationPath: string): Promise<MoveFileResult>;
   listFiles(path: string, options?: ListFilesOptions): Promise<ListFilesResult>;
   exists(path: string): Promise<FileExistsResult>;
-  gitCheckout(repoUrl: string, options?: {
-    branch?: string;
-    targetDir?: string;
-    /** Clone depth for shallow clones (e.g., 1 for latest commit only) */
-    depth?: number;
-    /** Maximum wall-clock time for the git clone subprocess in milliseconds */
-    cloneTimeoutMs?: number;
-  }): Promise<GitCheckoutResult>;
   setEnvVars(envVars: Record<string, string | undefined>): Promise<void>;
-  createCodeContext(options?: CreateContextOptions): Promise<CodeContext>;
-  runCode(code: string, options?: RunCodeOptions): Promise<ExecutionResult>;
-  runCodeStream(code: string, options?: RunCodeOptions): Promise<ReadableStream<Uint8Array>>;
-  listCodeContexts(): Promise<CodeContext[]>;
-  deleteCodeContext(contextId: string): Promise<void>;
   mountBucket(bucket: string, mountPath: string, options: MountBucketOptions): Promise<void>;
   unmountBucket(mountPath: string): Promise<void>;
   createBackup(options: BackupOptions): Promise<DirectoryBackup>;
@@ -1260,22 +1263,65 @@ interface R2BindingMountBucketOptions {
  */
 type MountBucketOptions = RemoteMountBucketOptions | LocalMountBucketOptions | R2BindingMountBucketOptions;
 interface ISandbox {
-  exec(command: string, options?: ExecOptions): Promise<ExecResult>;
-  startProcess(command: string, options?: ProcessOptions): Promise<Process>;
-  listProcesses(sessionId?: string): Promise<Process[]>;
-  getProcess(id: string, sessionId?: string): Promise<Process | null>;
-  killProcess(id: string, signal?: string): Promise<void>;
+  /**
+   * Execute a command in the sandbox.
+   *
+   * Mirrors the `ctx.container.exec()` contract from the Cloudflare
+   * Containers runtime, with sandbox-specific extensions for sessions,
+   * named process ids, and re-attach.
+   *
+   * Returns a `SandboxProcessPromise` — a thenable that resolves to a
+   * `SandboxProcess` (`stdin` / `stdout` / `stderr` / `exitCode` /
+   * `kill()` / `output()` plus sandbox extensions) and exposes
+   * `.output()` / `.text()` / `.json()` / `.kill()` directly for the
+   * common "run a command" case:
+   *
+   * @example
+   * // Buffered result
+   * const { stdout } = await sandbox.exec("npm test").output();
+   *
+   * @example
+   * // Long-running, with re-attach by id
+   * const dev = await sandbox.exec("npm run dev", { processId: "dev" });
+   * await dev.waitForPort(3000);
+   *
+   * @example
+   * // Stream stdout straight to the client
+   * const proc = await sandbox.exec(["python", "train.py"]);
+   * return new Response(proc.stdout);
+   */
+  exec(command: string | string[], options?: SandboxExecOptions): SandboxProcessPromise;
+  /**
+   * Buffered, session-state-preserving execution helper.
+   *
+   * Uses the foreground session execution path, so shell state changes
+   * (`cd`, aliases, functions, exports) persist across calls. Prefer
+   * `exec()` for the containers-compatible process handle; use `run()`
+   * when you explicitly want buffered session-shell semantics.
+   */
+  run(command: string, options?: ExecOptions & {
+    sessionId?: string;
+  }): Promise<ExecResult>;
+  /**
+   * Re-attach to an existing process by id.
+   *
+   * The returned `SandboxProcess`'s `stdin` is `null` and `stdout`/`stderr`
+   * are replay-then-tail streams sourced from the per-process log file.
+   * Mirrors `ExecProcess` ownership semantics where a non-owner has
+   * nullable pipes.
+   *
+   * Returns `null` if no such process exists.
+   */
+  getProcess(id: string, options?: ProcessQueryOptions): Promise<SandboxProcess | null>;
+  /**
+   * Snapshot of all known processes.
+   *
+   * Snapshot entries have `stdin`/`stdout`/`stderr` set to `null`; call
+   * `getProcess(id)` to acquire a re-attached handle with live streams.
+   */
+  listProcesses(options?: ProcessQueryOptions): Promise<SandboxProcess[]>;
   killAllProcesses(): Promise<number>;
-  execStream(command: string, options?: StreamOptions): Promise<ReadableStream<Uint8Array>>;
-  streamProcessLogs(processId: string, options?: {
-    signal?: AbortSignal;
-  }): Promise<ReadableStream<Uint8Array>>;
   cleanupCompletedProcesses(): Promise<number>;
-  getProcessLogs(id: string): Promise<{
-    stdout: string;
-    stderr: string;
-    processId: string;
-  }>;
   writeFile(path: string, content: string | ReadableStream<Uint8Array>, options?: {
     encoding?: string;
   }): Promise<WriteFileResult>;
@@ -1295,16 +1341,9 @@ interface ISandbox {
   renameFile(oldPath: string, newPath: string): Promise<RenameFileResult>;
   moveFile(sourcePath: string, destinationPath: string): Promise<MoveFileResult>;
   listFiles(path: string, options?: ListFilesOptions): Promise<ListFilesResult>;
-  exists(path: string, sessionId?: string): Promise<FileExistsResult>;
-  gitCheckout(repoUrl: string, options?: {
-    branch?: string;
-    targetDir?: string;
+  exists(path: string, options?: {
     sessionId?: string;
-    /** Clone depth for shallow clones (e.g., 1 for latest commit only) */
-    depth?: number;
-    /** Maximum wall-clock time for the git clone subprocess in milliseconds */
-    cloneTimeoutMs?: number;
-  }): Promise<GitCheckoutResult>;
+  }): Promise<FileExistsResult>;
   setEnvVars(envVars: Record<string, string | undefined>): Promise<void>;
   mountBucket(bucket: string, mountPath: string, options: MountBucketOptions): Promise<void>;
   unmountBucket(mountPath: string): Promise<void>;
@@ -1317,11 +1356,6 @@ interface ISandbox {
    * when no handshake has been observed yet on this sandbox.
    */
   getContainerPlacementId(): Promise<string | null | undefined>;
-  createCodeContext(options?: CreateContextOptions): Promise<CodeContext>;
-  runCode(code: string, options?: RunCodeOptions): Promise<ExecutionResult>;
-  runCodeStream(code: string, options?: RunCodeOptions): Promise<ReadableStream>;
-  listCodeContexts(): Promise<CodeContext[]>;
-  deleteCodeContext(contextId: string): Promise<void>;
   createBackup(options: BackupOptions): Promise<DirectoryBackup>;
   restoreBackup(backup: DirectoryBackup): Promise<RestoreBackupResult>;
   wsConnect(request: Request, port: number): Promise<Response>;
@@ -1370,21 +1404,22 @@ interface SandboxAPI {
   files: SandboxFilesAPI;
   processes: SandboxProcessesAPI;
   ports: SandboxPortsAPI;
-  git: SandboxGitAPI;
-  interpreter: SandboxInterpreterAPI;
   utils: SandboxUtilsAPI;
   backup: SandboxBackupAPI;
   watch: SandboxWatchAPI;
   tunnels: SandboxTunnelsAPI;
+  terminals: SandboxTerminalsAPI;
   extensions: SandboxExtensionsAPI;
 }
+interface CommandExecuteOptions {
+  sessionId?: string;
+  timeoutMs?: number;
+  env?: Record<string, string | undefined>;
+  cwd?: string;
+  origin?: 'user' | 'internal';
+}
 interface SandboxCommandsAPI {
-  execute(command: string, sessionId: string, options?: {
-    timeoutMs?: number;
-    env?: Record<string, string | undefined>;
-    cwd?: string;
-    origin?: 'user' | 'internal';
-  }): Promise<{
+  execute(command: string, options?: CommandExecuteOptions): Promise<{
     success: boolean;
     exitCode: number;
     stdout: string;
@@ -1392,48 +1427,59 @@ interface SandboxCommandsAPI {
     command: string;
     timestamp: string;
   }>;
-  executeStream(command: string, sessionId: string, options?: {
-    timeoutMs?: number;
-    env?: Record<string, string | undefined>;
-    cwd?: string;
-    origin?: 'user' | 'internal';
-  }): Promise<ReadableStream<Uint8Array>>;
+}
+interface FileSessionOptions {
+  sessionId?: string;
+}
+interface ReadFileStreamOptions extends FileSessionOptions {}
+interface ReadFileBinaryOptions extends FileSessionOptions {
+  encoding: 'none';
+}
+interface ReadFileOptions extends FileSessionOptions {
+  encoding?: Exclude<FileEncoding, 'none'>;
+}
+interface WriteFileOptions extends FileSessionOptions {
+  encoding?: string;
+  permissions?: string;
+}
+interface MkdirOptions extends FileSessionOptions {
+  recursive?: boolean;
 }
 interface SandboxFilesAPI {
-  readFile(path: string, sessionId: string, options: {
-    encoding: 'none';
-  }): Promise<ReadFileStreamResult>;
-  readFile(path: string, sessionId: string, options?: {
-    encoding?: Exclude<FileEncoding, 'none'>;
-  }): Promise<ReadFileResult>;
-  readFileStream(path: string, sessionId: string): Promise<ReadableStream<Uint8Array>>;
-  writeFile(path: string, content: string, sessionId: string, options?: {
-    encoding?: string;
-    permissions?: string;
-  }): Promise<WriteFileResult>;
-  writeFileStream(path: string, stream: ReadableStream<Uint8Array>, sessionId: string): Promise<{
+  readFile(path: string, options: ReadFileBinaryOptions): Promise<ReadFileStreamResult>;
+  readFile(path: string, options?: ReadFileOptions): Promise<ReadFileResult>;
+  readFileStream(path: string, options?: ReadFileStreamOptions): Promise<ReadableStream<Uint8Array>>;
+  writeFile(path: string, content: string, options?: WriteFileOptions): Promise<WriteFileResult>;
+  writeFileStream(path: string, stream: ReadableStream<Uint8Array>, options?: FileSessionOptions): Promise<{
     success: boolean;
     path: string;
     bytesWritten: number;
     timestamp: string;
   }>;
-  deleteFile(path: string, sessionId: string): Promise<DeleteFileResult>;
-  renameFile(oldPath: string, newPath: string, sessionId: string): Promise<RenameFileResult>;
-  moveFile(sourcePath: string, destinationPath: string, sessionId: string): Promise<MoveFileResult>;
-  mkdir(path: string, sessionId: string, options?: {
-    recursive?: boolean;
-  }): Promise<MkdirResult>;
-  listFiles(path: string, sessionId: string, options?: ListFilesOptions): Promise<ListFilesResult>;
-  exists(path: string, sessionId: string): Promise<FileExistsResult>;
+  deleteFile(path: string, options?: FileSessionOptions): Promise<DeleteFileResult>;
+  renameFile(oldPath: string, newPath: string, options?: FileSessionOptions): Promise<RenameFileResult>;
+  moveFile(sourcePath: string, destinationPath: string, options?: FileSessionOptions): Promise<MoveFileResult>;
+  mkdir(path: string, options?: MkdirOptions): Promise<MkdirResult>;
+  listFiles(path: string, options?: ListFilesOptions): Promise<ListFilesResult>;
+  exists(path: string, options?: FileSessionOptions): Promise<FileExistsResult>;
+}
+interface ProcessStartOptions {
+  sessionId?: string;
+  processId?: string;
+  timeoutMs?: number;
+  env?: Record<string, string | undefined>;
+  cwd?: string;
+  encoding?: string;
+  autoCleanup?: boolean;
+  origin?: 'user' | 'internal';
+  stdout?: 'pipe' | 'ignore';
+  stderr?: 'pipe' | 'ignore' | 'combined';
 }
 interface SandboxProcessesAPI {
-  startProcess(command: string, sessionId: string, options?: {
-    processId?: string;
-    timeoutMs?: number;
-  }): Promise<ProcessStartResult>;
+  startProcess(command: string, options?: ProcessStartOptions, stdin?: ReadableStream<Uint8Array>): Promise<ProcessStartResult>;
   listProcesses(): Promise<ProcessListResult>;
   getProcess(id: string): Promise<ProcessInfoResult>;
-  killProcess(id: string): Promise<ProcessKillResult>;
+  killProcess(id: string, signal?: number): Promise<ProcessKillResult>;
   killAllProcesses(): Promise<ProcessCleanupResult>;
   getProcessLogs(id: string): Promise<ProcessLogsResult>;
   streamProcessLogs(id: string): Promise<ReadableStream<Uint8Array>>;
@@ -1441,35 +1487,17 @@ interface SandboxProcessesAPI {
 interface SandboxPortsAPI {
   watchPort(request: PortWatchRequest): Promise<ReadableStream<Uint8Array>>;
 }
-interface SandboxGitAPI {
-  checkout(repoUrl: string, sessionId: string, options?: {
-    branch?: string;
-    targetDir?: string;
-    depth?: number;
-    timeoutMs?: number;
-  }): Promise<GitCheckoutResult>;
-}
-interface SandboxInterpreterAPI {
-  createCodeContext(options?: CreateContextOptions): Promise<CodeContext>;
-  streamCode(contextId: string, code: string, language?: string): Promise<ReadableStream<Uint8Array>>;
-  runCodeStream(contextId: string | undefined, code: string, language: string | undefined, callbacks: {
-    onStdout?: (output: OutputMessage) => void | Promise<void>;
-    onStderr?: (output: OutputMessage) => void | Promise<void>;
-    onResult?: (result: Result) => void | Promise<void>;
-    onError?: (error: ExecutionError) => void | Promise<void>;
-  }, timeoutMs?: number): Promise<void>;
-  listCodeContexts(): Promise<CodeContext[]>;
-  deleteCodeContext(contextId: string): Promise<void>;
+interface SessionCreateOptions {
+  id: string;
+  env?: Record<string, string | undefined>;
+  cwd?: string;
+  commandTimeoutMs?: number;
 }
 interface SandboxUtilsAPI {
   ping(): Promise<string>;
   getVersion(): Promise<string>;
   getCommands(): Promise<string[]>;
-  createSession(options: {
-    id: string;
-    env?: Record<string, string | undefined>;
-    cwd?: string;
-  }): Promise<{
+  createSession(options: SessionCreateOptions): Promise<{
     success: boolean;
     id: string;
     message: string;
@@ -1485,13 +1513,18 @@ interface SandboxUtilsAPI {
     sessions: string[];
   }>;
 }
+interface BackupCreateArchiveOptions {
+  sessionId?: string;
+  excludes?: string[];
+  gitignore?: boolean;
+  compression?: BackupCompressionOptions;
+}
+interface BackupRestoreArchiveOptions {
+  sessionId?: string;
+}
 interface SandboxBackupAPI {
-  createArchive(dir: string, archivePath: string, sessionId: string, options?: {
-    excludes?: string[];
-    gitignore?: boolean;
-    compression?: BackupCompressionOptions;
-  }): Promise<CreateBackupResponse>;
-  restoreArchive(dir: string, archivePath: string, sessionId: string): Promise<RestoreBackupResponse>;
+  createArchive(dir: string, archivePath: string, options?: BackupCreateArchiveOptions): Promise<CreateBackupResponse>;
+  restoreArchive(dir: string, archivePath: string, options?: BackupRestoreArchiveOptions): Promise<RestoreBackupResponse>;
   uploadParts(request: {
     archivePath: string;
     parts: Array<{
@@ -1548,28 +1581,67 @@ interface TunnelOptions {
    */
   name?: string;
 }
-interface SandboxTunnelsAPI {
-  /** Spawn `cloudflared tunnel --url`. No credentials required. */
-  runQuickTunnel(id: string, port: number): Promise<TunnelInfo>;
-  /**
-   * Spawn `cloudflared tunnel run --token <token> --url http://localhost:<port>`.
-   *
-   * The SDK is the source of truth for the hostname this tunnel binds to;
-   * the container only sees the opaque token and the local port. The
-   * returned `TunnelInfo` carries empty `url`/`hostname` fields — the SDK
-   * enriches them with the values from the Cloudflare API before handing
-   * the record to user code.
-   *
-   * The token must never be logged, persisted, or echoed back to callers.
-   */
-  runNamedTunnel(id: string, token: string, port: number): Promise<TunnelInfo>;
-  /** Stop the cloudflared process for the given tunnel id. */
-  destroyTunnel(id: string): Promise<{
+type TunnelRunMode = 'quick' | 'named';
+interface TunnelRunIdentity {
+  tunnelId: string;
+  runId: string;
+}
+type TunnelRunRef = TunnelRunIdentity;
+interface EnsureQuickTunnelRunRequest extends TunnelRunIdentity {
+  mode: 'quick';
+  port: number;
+  readyTimeoutMs?: number;
+  stopGraceMs?: number;
+}
+interface EnsureNamedTunnelRunRequest extends TunnelRunIdentity {
+  mode: 'named';
+  port: number;
+  cloudflaredToken: string;
+  readyTimeoutMs?: number;
+  stopGraceMs?: number;
+}
+type EnsureTunnelRunRequest = EnsureQuickTunnelRunRequest | EnsureNamedTunnelRunRequest;
+interface QuickTunnelRunSnapshot extends TunnelRunIdentity {
+  mode: 'quick';
+  port: number;
+  url: string;
+  hostname: string;
+  startedAt: string;
+}
+interface NamedTunnelRunSnapshot extends TunnelRunIdentity {
+  mode: 'named';
+  port: number;
+  startedAt: string;
+}
+type TunnelRunSnapshot = QuickTunnelRunSnapshot | NamedTunnelRunSnapshot;
+interface EnsureTunnelRunResult {
+  run: TunnelRunSnapshot;
+  started: boolean;
+}
+type StopTunnelRunRequest = TunnelRunRef;
+interface StopTunnelRunResult {
+  stopped: boolean;
+}
+interface TunnelRunExitEvent extends TunnelRunIdentity {
+  mode: TunnelRunMode;
+  port: number;
+  exitCode: number | null;
+}
+interface SandboxTerminalsAPI {
+  createTerminal(options: TerminalCreateOptions): Promise<{
+    success: true;
+    id: string;
+  }>;
+  destroyTerminal(id: string): Promise<{
     success: true;
     id: string;
   }>;
-  /** List tunnels currently running inside the container. */
-  listTunnels(): Promise<TunnelInfo[]>;
+}
+interface SandboxTunnelsAPI {
+  /** Ensure a runtime-local cloudflared process for a DO-issued run id. */
+  ensureTunnelRun(request: EnsureTunnelRunRequest): Promise<EnsureTunnelRunResult>;
+  /** Stop the matching runtime-local cloudflared process. */
+  stopTunnelRun(request: StopTunnelRunRequest): Promise<StopTunnelRunResult>;
 }
 /**
  * Author-facing description of a sidecar extension. An extension is an
@@ -1666,14 +1738,104 @@ interface SandboxExtensionsAPI {
  * future container→DO events.
  */
 interface SandboxControlCallback {
+  /** Called by the container when a runtime-local tunnel run exits. */
+  onTunnelRunExit(event: TunnelRunExitEvent): Promise<void>;
+}
+//#endregion
+//#region src/extensions/index.d.ts
+interface HTTPAuthHostConfig {
+  token: string;
+  username?: string;
+  type?: 'basic' | 'bearer';
+}
+interface HTTPAuthInterceptorParams {
+  hosts: Record<string, HTTPAuthHostConfig>;
+}
+/**
+ * The slice of the Sandbox an extension captures: its control `client`, unified
+ * `exec()` surface, and sandbox-level environment variables. Narrow on purpose
+ * \u2014 an extension never holds the whole instance.
+ *
+ * `envVars` mirrors what the Sandbox applies to sessionless execution, so an
+ * extension that drives commands through `client` directly can still honour
+ * sandbox-level env (tokens, proxy settings) without an explicit session.
+ */
+type SandboxLike = {
+  readonly client: SandboxAPI;
+  readonly exec?: (command: string | string[], options?: SandboxExecOptions) => SandboxProcessPromise;
+  readonly envVars?: Record<string, string>;
+  registerGitAuthInterceptor?: (params: HTTPAuthInterceptorParams) => Promise<void>;
+};
+/**
+ * The one base class for *every* extension.
+ *
+ * - SDK-only: just drives existing sub-APIs.
+ * - Sidecar: pass an {@link ExtensionPackage} to `super(sandbox, pkg)` and
+ *   call `this.sidecar<T>()` to get a typed capnweb stub of the sidecar.
+ *
+ * The sidecar accessor throws a clear error if no package was supplied, so an
+ * extension only "becomes" a sidecar extension when it opts in.
+ *
+ * ```ts
+ * // SDK-only
+ * class Git extends SandboxExtension {
+ *   constructor(s: SandboxLike) { super(s); }
+ *   async status(sid: string) {
+ *     return this.exec('git status', { sessionId: sid }).output();
+ *   }
+ * }
+ *
+ * // Sidecar
+ * import sidecarTarballBytes from './sidecar-package.tgz';
+ * import type { MyAPI } from './shared';
+ *
+ * class MyExt extends SandboxExtension {
+ *   constructor(s: SandboxLike) { super(s, { tarball: new Uint8Array(sidecarTarballBytes) }); }
+ *   async run(input: string): Promise<string> {
+ *     const api = await this.sidecar<MyAPI>();
+ *     return api.run(input);
+ *   }
+ * }
+ * ```
+ *
+ * RPC-safety: the sandbox lives in `#sandbox` and is reached only through the
+ * `protected` `client` getter (a prototype accessor, not an own property),
+ * so it is never serialised across RPC. Only the public methods you add form
+ * the extension's RPC surface.
+ */
+declare abstract class SandboxExtension extends RpcTarget {
+  #private;
+  protected constructor(sandbox: SandboxLike, pkg?: ExtensionPackage);
+  /** The container control client. Use inside your own methods, lazily. */
+  protected get client(): SandboxAPI;
+  /** Unified process-handle exec surface from the owning Sandbox. */
+  protected exec(command: string | string[], options?: SandboxExecOptions): SandboxProcessPromise;
+  /**
+   * Sandbox-level environment variables. Apply these to sessionless execution
+   * so commands driven straight through `client` still inherit sandbox env
+   * (tokens, proxy settings) the way the Sandbox's own sessionless path does.
+   */
+  protected get envVars(): Record<string, string>;
+  protected get httpAuthInterceptor(): ((params: HTTPAuthInterceptorParams) => Promise<void>) | undefined;
+  /**
+   * Return the sidecar's capnweb remote main, provisioning + spawning on
+   * demand. `T` is the typed interface the sidecar exposes (its
+   * `SandboxSidecar` subclass shape). Each call reconnects through the host
+   * so a crashed sidecar can be restarted transparently on the next use.
+   *
+   * Streaming is just a method that takes a callback parameter: capnweb
+   * stubs the callback and routes invocations back through the SDK\u2192container
+   * \u2192sidecar hops.
+   */
+  protected sidecar<T extends object>(): Promise<T>;
+  /** Health snapshot for this extension's sidecar. */
+  protected sidecarHealth(): Promise<ExtensionHealth>;
   /**
-   * Called by the container when a `cloudflared` process exits for any
-   * reason — SIGTERM from `destroyTunnel`, container-initiated SIGKILL,
-   * network failure, segfault. `exitCode` is `null` if the process was
-   * signalled rather than exited cleanly.
+   * Stop this extension's sidecar. The next `sidecar()` call will respawn on
+   * demand.
    */
-  onTunnelExit(id: string, port: number, exitCode: number | null): Promise<void>;
+  protected stopSidecar(): Promise<void>;
 }
 //#endregion
-export { RenameFileResult as $, ExecResult as A, ListFilesOptions as B, BucketProvider as C, DirectoryBackup as D, DeleteFileResult as E, FileMetadata as F, MountBucketOptions as G, LocalMountBucketOptions as H, FileStreamEvent as I, ProcessOptions as J, MoveFileResult as K, FileWatchSSEEvent as L, FileChunk as M, FileEncoding as N, ExecEvent as O, FileExistsResult as P, RemoteMountBucketOptions as Q, GitCheckoutResult as R, BucketCredentials as S, CheckChangesResult as T, LogEvent as U, ListFilesResult as V, MkdirResult as W, ReadFileResult as X, ProcessStatus as Y, ReadFileStreamResult as Z, SandboxWatchAPI as _, RunCodeOptions as _t, SandboxAPI as a, WaitForLogResult as at, BackupOptions as b, SandboxControlCallback as c, WriteFileResult as ct, SandboxGitAPI as d, isProcessStatus as dt, RestoreBackupResult as et, SandboxInterpreterAPI as f, PtyOptions as ft, SandboxUtilsAPI as g, ExecutionResult as gt, SandboxTunnelsAPI as h, Execution as ht, QuickTunnelInfo as i, StreamOptions as it, ExecutionSession as j, ExecOptions as k, SandboxExtensionsAPI as l, isExecResult as lt, SandboxProcessesAPI as m, CreateContextOptions as mt, ExtensionPackage as n, SessionDeleteResult as nt, SandboxBackupAPI as o, WaitForPortOptions as ot, SandboxPortsAPI as p, CodeContext as pt, Process as q, NamedTunnelInfo as r, SessionOptions as rt, SandboxCommandsAPI as s, WatchOptions as st, ExtensionHealth as t, SandboxOptions as tt, SandboxFilesAPI as u, isProcess as ut, TunnelInfo as v, CheckChangesOptions as w, BaseExecOptions as x, TunnelOptions as y, ISandbox as z };
-//# sourceMappingURL=rpc-types-PBUY-xXM.d.ts.map
+export { ReadFileStreamResult as $, ExecEvent as A, ISandbox as B, BaseExecOptions as C, CheckChangesResult as D, CheckChangesOptions as E, FileEncoding as F, MkdirResult as G, ListFilesResult as H, FileExistsResult as I, Process as J, MountBucketOptions as K, FileMetadata as L, ExecResult as M, ExecutionSession as N, DeleteFileResult as O, FileChunk as P, ReadFileResult as Q, FileStreamEvent as R, BackupOptions as S, BucketProvider as T, LocalMountBucketOptions as U, ListFilesOptions as V, LogEvent as W, ProcessQueryOptions as X, ProcessOptions as Y, ProcessStatus as Z, SandboxTunnelsAPI as _, PtyOptions as _t, ExtensionHealth as a, SandboxOptions as at, TunnelInfo as b, TerminalCreateOptions as bt, QuickTunnelInfo as c, SessionDeleteResult as ct, SandboxControlCallback as d, WaitForPortOptions as dt, RemoteMountBucketOptions as et, SandboxExtensionsAPI as f, WatchOptions as ft, SandboxTerminalsAPI as g, isProcessStatus as gt, SandboxProcessesAPI as h, isProcess as ht, SandboxLike as i, SandboxExecOutput as it, ExecOptions as j, DirectoryBackup as k, SandboxBackupAPI as l, SessionOptions as lt, SandboxPortsAPI as m, isExecResult as mt, HTTPAuthInterceptorParams as n, RestoreBackupResult as nt, ExtensionPackage as o, SandboxProcess as ot, SandboxFilesAPI as p, WriteFileResult as pt, MoveFileResult as q, SandboxExtension as r, SandboxExecOptions as rt, NamedTunnelInfo as s, SandboxProcessPromise as st, HTTPAuthHostConfig as t, RenameFileResult as tt, SandboxCommandsAPI as u, WaitForLogResult as ut, SandboxUtilsAPI as v, SandboxTerminal as vt, BucketCredentials as w, TunnelOptions as x, TerminalOptions as xt, SandboxWatchAPI as y, TerminalConnectOptions as yt, FileWatchSSEEvent as z };
+//# sourceMappingURL=index-B7QgIs0N.d.ts.map