@cloudflare/sandbox 0.13.0-next.681.1 → 0.13.0-next.709.1

package/dist/sandbox-DHNO89IF.d.ts

@@ -1,828 +0,0 @@
-import { $ as ReadFileStreamResult, B as ISandbox, D as CheckChangesResult, E as CheckChangesOptions, F as FileEncoding, G as MkdirResult, H as ListFilesResult, I as FileExistsResult, K as MountBucketOptions, M as ExecResult, N as ExecutionSession, O as DeleteFileResult, Q as ReadFileResult, S as BackupOptions, V as ListFilesOptions, X as ProcessQueryOptions, _ as SandboxTunnelsAPI, at as SandboxOptions, b as TunnelInfo, bt as TerminalCreateOptions, ct as SessionDeleteResult, d as SandboxControlCallback, f as SandboxExtensionsAPI, ft as WatchOptions, g as SandboxTerminalsAPI, h as SandboxProcessesAPI, j as ExecOptions, k as DirectoryBackup, l as SandboxBackupAPI, lt as SessionOptions, m as SandboxPortsAPI, n as HTTPAuthInterceptorParams, nt as RestoreBackupResult, ot as SandboxProcess, p as SandboxFilesAPI, pt as WriteFileResult, q as MoveFileResult, rt as SandboxExecOptions, st as SandboxProcessPromise, tt as RenameFileResult, u as SandboxCommandsAPI, v as SandboxUtilsAPI, vt as SandboxTerminal, x as TunnelOptions, xt as TerminalOptions, y as SandboxWatchAPI } from "./index-B7QgIs0N.js";
-import { t as ErrorCode } from "./codes-y-U76vnQ.js";
-import { Container, ContainerProxy } from "@cloudflare/containers";
-import { RpcTarget, RpcTransport } from "capnweb";
-
-//#region ../shared/dist/logger/types.d.ts
-
-type LogComponent = 'container' | 'sandbox-do' | 'executor';
-/**
- * Context metadata included in every log entry
- */
-interface LogContext {
-  /**
-   * Unique trace ID for request correlation across distributed components
-   * Format: "tr_" + 16 hex chars (e.g., "tr_7f3a9b2c4e5d6f1a")
-   */
-  traceId: string;
-  /**
-   * Component that generated the log
-   */
-  component: LogComponent;
-  /**
-   * Sandbox identifier (which sandbox instance)
-   */
-  sandboxId?: string;
-  /**
-   * Session identifier (which session within sandbox)
-   */
-  sessionId?: string;
-  /**
-   * Process identifier (which background process)
-   */
-  processId?: string;
-  /**
-   * Command identifier (which command execution)
-   */
-  commandId?: string;
-  /**
-   * Duration in milliseconds
-   */
-  durationMs?: number;
-  /**
-   * Service version (from SANDBOX_VERSION env var)
-   */
-  serviceVersion?: string;
-  /**
-   * Instance identifier (hostname or container ID)
-   */
-  instanceId?: string;
-  /**
-   * Extensible for additional metadata
-   */
-  [key: string]: unknown;
-}
-/**
- * Logger interface for structured logging
- *
- * All methods accept optional context that gets merged with the logger's base context.
- */
-interface Logger {
-  /**
-   * Log debug-level message (most verbose, typically disabled in production)
-   *
-   * @param message Human-readable message
-   * @param context Optional additional context
-   */
-  debug(message: string, context?: Partial<LogContext>): void;
-  /**
-   * Log info-level message (normal operational events)
-   *
-   * @param message Human-readable message
-   * @param context Optional additional context
-   */
-  info(message: string, context?: Partial<LogContext>): void;
-  /**
-   * Log warning-level message (recoverable issues, degraded state)
-   *
-   * @param message Human-readable message
-   * @param context Optional additional context
-   */
-  warn(message: string, context?: Partial<LogContext>): void;
-  /**
-   * Log error-level message (failures, exceptions)
-   *
-   * @param message Human-readable message
-   * @param error Optional Error object to include
-   * @param context Optional additional context
-   */
-  error(message: string, error?: Error, context?: Partial<LogContext>): void;
-  /**
-   * Create a child logger with additional context
-   *
-   * The child logger inherits all context from the parent and adds new context.
-   * This is useful for adding request-specific context without passing through parameters.
-   *
-   * @param context Additional context to merge
-   * @returns New logger instance with merged context
-   *
-   * @example
-   * const logger = createLogger({ component: 'sandbox-do', traceId: 'tr_abc123' });
-   * const execLogger = logger.child({ commandId: 'cmd-456' });
-   * execLogger.info('Command started'); // Includes all context: component, traceId, commandId
-   */
-  child(context: Partial<LogContext>): Logger;
-}
-//#endregion
-//#region src/container-control/connection.d.ts
-/** Stub that can issue a WebSocket-upgrade fetch through the DO's Container base class. */
-interface ContainerFetchStub {
-  fetch(request: Request): Promise<Response>;
-}
-interface ContainerControlConnectionOptions {
-  stub: ContainerFetchStub;
-  port?: number;
-  logger?: Logger;
-  /**
-   * Total retry budget (ms) for retryable upgrade responses while the
-   * container is unavailable. Defaults to 120 000 (2 minutes). Set to 0 to
-   * disable retries.
-   */
-  retryTimeoutMs?: number;
-  /**
-   * Optional `localMain` exposed to the container side of the capnweb
-   * session. The container reaches it via
-   * `session.getRemoteMain()` and uses it for control-plane callbacks
-   * (e.g. notifying the DO when a tunnel's cloudflared process has
-   * exited). When omitted, the container sees an empty remote main.
-   */
-  localMain?: SandboxControlCallback & RpcTarget;
-  /**
-   * Invoked when an active WebSocket transitions to closed/errored.
-   * Fired at most once per successful connection from the WS event
-   * handlers in `doConnect`. Gives owners a synchronous teardown
-   * signal so recovery doesn't depend on a periodic poller running
-   * inside what may be an idle isolate.
-   *
-   * Also fired for `doConnect` failures after the deferred transport is
-   * aborted. A failed upgrade poisons the transport, so owners must discard
-   * the connection and create a fresh one for subsequent calls. Not fired for
-   * `disconnect()`.
-   */
-  onClose?: () => void;
-}
-//#endregion
-//#region src/container-control/client.d.ts
-
-interface ContainerControlClientOptions extends ContainerControlConnectionOptions {
-  /** Idle timeout before disconnecting the WebSocket (ms). Defaults to 1 000. */
-  idleDisconnectMs?: number;
-  /** Busy/idle poll interval (ms). Defaults to 1 000. */
-  busyPollIntervalMs?: number;
-  /**
-   * Renew the DO's activity timeout. Fires at the start of every RPC call
-   * and on every busy-poll tick while the session has work in flight.
-   * Mirrors what `containerFetch()` does at the top of each HTTP request.
-   */
-  onActivity?: () => void;
-  /**
-   * Fires once when the capnweb session transitions from idle to busy
-   * (an RPC call was started or a stream return is now in flight). The
-   * Sandbox DO wires this to increment the Container base class's
-   * in-flight request counter, which makes `isActivityExpired()` skip the
-   * sleepAfter comparison.
-   */
-  onSessionBusy?: () => void;
-  /**
-   * Fires once when the session transitions from busy back to idle
-   * (all RPC promises settled and all stream exports released). The
-   * Sandbox DO wires this to `inflightRequests = max(0, n-1)` and a
-   * final `renewActivityTimeout()`, matching containerFetch's finally
-   * block.
-   */
-  onSessionIdle?: () => void;
-}
-/**
- * Sandbox control facade backed by direct capnweb RPC.
- *
- * All operations call the container's SandboxAPI control interface directly
- * over capnweb, bypassing the HTTP handler/router layer entirely.
- *
- * Manages its own WebSocket lifecycle: a fresh `ContainerControlConnection` is
- * created on demand and torn down after `idleDisconnectMs` of inactivity.
- * Busy/idle detection relies on `RpcSession.getStats()` which tracks all
- * in-flight RPC calls and stream exports — including long-lived streaming
- * RPCs that would be invisible to a simple per-call request counter (see
- * the file-level comment for the full rationale).
- */
-declare class ContainerControlClient {
-  private readonly connOptions;
-  private readonly idleDisconnectMs;
-  private readonly busyPollIntervalMs;
-  private readonly logger;
-  private readonly onActivity;
-  private readonly onSessionBusy;
-  private readonly onSessionIdle;
-  private conn;
-  private idleTimer;
-  private busyPollTimer;
-  /** Tracks whether we currently believe the session is busy. */
-  private busy;
-  constructor(options: ContainerControlClientOptions);
-  /**
-   * Return the current connection, creating one when the client is disconnected.
-   * Starts the busy-poll timer the first time a connection is materialized.
-   */
-  private getConnection;
-  /**
-   * Called synchronously at the start of each RPC method invocation.
-   * Renews the DO activity timeout so the sleepAfter alarm is pushed
-   * forward before the container processes the call.
-   */
-  private renewActivity;
-  /**
-   * Sample `getStats()` and update busy/idle state. While busy, renews the
-   * activity timeout each tick so an in-flight stream keeps pushing the
-   * sleepAfter deadline forward. On the busy → idle edge, fires
-   * `onSessionIdle` and schedules the WebSocket disconnect.
-   *
-   * If the WebSocket has dropped underneath us (container crash, network
-   * blip) we tear the connection down here. `destroyConnection()` fires
-   * `onSessionIdle` if we were busy, so the DO's inflight counter doesn't
-   * stay pinned forever waiting for a peer that's never going to reply.
-   */
-  private pollBusyState;
-  private startBusyPoll;
-  private stopBusyPoll;
-  private scheduleIdleDisconnect;
-  private clearIdleTimer;
-  private destroyConnection;
-  get commands(): SandboxCommandsAPI;
-  get files(): SandboxFilesAPI;
-  get processes(): SandboxProcessesAPI;
-  get ports(): SandboxPortsAPI;
-  get utils(): SandboxUtilsAPI;
-  get backup(): SandboxBackupAPI;
-  get watch(): SandboxWatchAPI;
-  get tunnels(): SandboxTunnelsAPI;
-  get terminals(): SandboxTerminalsAPI;
-  get extensions(): SandboxExtensionsAPI;
-  /**
-   * Update the upgrade retry budget. Applies to the current connection
-   * (if any) and is remembered for any future connections created after the
-   * client is torn down and reconnected.
-   */
-  setRetryTimeoutMs(ms: number): void;
-  isWebSocketConnected(): boolean;
-  connect(): Promise<void>;
-  disconnect(): void;
-}
-//#endregion
-//#region src/backup/restore-fault-injection.d.ts
-type BackupRestoreFaultPhase = 'after_archive_ready';
-type BackupRestoreTestFault = {
-  phase: BackupRestoreFaultPhase;
-  mode: 'transport_disposed';
-  times: number;
-};
-//#endregion
-//#region src/storage-mount/errors.d.ts
-/**
- * Base error for bucket mounting operations
- */
-declare class BucketMountError extends Error {
-  readonly code: ErrorCode;
-  constructor(message: string, code?: ErrorCode);
-}
-/**
- * Thrown when S3FS mount command fails
- */
-declare class S3FSMountError extends BucketMountError {
-  constructor(message: string);
-}
-/**
- * Thrown when fusermount -u fails to unmount a FUSE filesystem
- */
-declare class BucketUnmountError extends BucketMountError {
-  constructor(message: string);
-}
-/**
- * Thrown when no credentials found in environment
- */
-declare class MissingCredentialsError extends BucketMountError {
-  constructor(message: string);
-}
-/**
- * Thrown when bucket name, mount path, or options are invalid
- */
-declare class InvalidMountConfigError extends BucketMountError {
-  constructor(message: string);
-}
-//#endregion
-//#region src/storage-mount/outbound/container-proxy.d.ts
-declare class ContainerProxy$1 extends ContainerProxy {
-  fetch(request: Request): Promise<Response>;
-}
-//#endregion
-//#region src/tunnels/tunnel-service.d.ts
-interface TunnelsHandler {
-  get(port: number, options?: TunnelOptions): Promise<TunnelInfo>;
-  list(): Promise<TunnelInfo[]>;
-  destroy(portOrInfo: number | TunnelInfo): Promise<void>;
-}
-//#endregion
-//#region src/sandbox.d.ts
-type SandboxConfiguration = {
-  sandboxName?: {
-    name: string;
-    normalizeId?: boolean;
-  };
-  sleepAfter?: string | number;
-  keepAlive?: boolean;
-  containerTimeouts?: NonNullable<SandboxOptions['containerTimeouts']>;
-};
-declare function getSandbox<T extends Sandbox<any>>(ns: DurableObjectNamespace<T>, id: string, options?: SandboxOptions): T;
-declare class Sandbox<Env = unknown> extends Container<Env> implements ISandbox {
-  defaultPort: number;
-  sleepAfter: string | number;
-  client: ContainerControlClient;
-  private sandboxName;
-  private tunnelServiceHandle;
-  private tunnelsHandler;
-  private tunnelExitHandler;
-  private readonly controlCallback;
-  private normalizeId;
-  envVars: Record<string, string>;
-  private logger;
-  private keepAliveEnabled;
-  private bucketMounts;
-  private currentRuntime;
-  private currentLifetime;
-  private backupService;
-  private previewService;
-  private r2AccessKeyId;
-  private r2SecretAccessKey;
-  private namedTunnelConfigResolver;
-  /**
-   * Default container startup timeouts (conservative for production)
-   * Based on Cloudflare docs: "Containers take several minutes to provision"
-   */
-  private readonly DEFAULT_CONTAINER_TIMEOUTS;
-  /**
-   * Active container timeout configuration
-   * Can be set via options, env vars, or defaults
-   */
-  private containerTimeouts;
-  /**
-   * True once containerTimeouts has been written to storage at least once
-   * (either via setContainerTimeouts or restored on cold start). Gates the
-   * idempotency check in setContainerTimeouts so a first explicit call
-   * persists even when the requested values already equal the in-memory
-   * defaults, distinguishing "user intent recorded" from "running on
-   * env/SDK defaults".
-   */
-  private hasStoredContainerTimeouts;
-  /**
-   * Dispatch method for tunnel operations.
-   * Called by the client-side proxy created in getSandbox() to provide
-   * the `sandbox.tunnels` API without relying on RPC pipelining through
-   * property getters, which vite-plugin does not currently support. This
-   * local method dispatch uses standard function application, so new
-   * Workers RPC pipelining traits on `TunnelsRpcTarget` also need an
-   * explicit path here before the proxy can expose them.
-   */
-  callTunnels(method: string, args: unknown[]): Promise<unknown>;
-  callExtension(extensionName: string, method: string, args: unknown[]): Promise<unknown>;
-  /**
-   * Compute the control-channel upgrade retry budget from current container
-   * timeouts.
-   *
-   * The budget covers the full container startup window (instance provisioning
-   * + port readiness) plus a 30s margin for the maximum single backoff delay.
-   * The 120s floor preserves the default for short timeout configurations.
-   */
-  private computeRetryTimeoutMs;
-  /**
-   * Create the single control-plane client used for all SDK operations.
-   */
-  private createClient;
-  constructor(ctx: DurableObjectState<{}>, env: Env);
-  setSandboxName(name: string, normalizeId?: boolean): Promise<void>;
-  configure(configuration: SandboxConfiguration): Promise<void>;
-  setSleepAfter(sleepAfter: string | number): Promise<void>;
-  setKeepAlive(keepAlive: boolean): Promise<void>;
-  setEnvVars(envVars: Record<string, string | undefined>): Promise<void>;
-  setContainerTimeouts(timeouts: NonNullable<SandboxOptions['containerTimeouts']>): Promise<void>;
-  private validateTimeout;
-  private getDefaultTimeouts;
-  /**
-   * Mount an S3-compatible bucket as a local directory.
-   */
-  mountBucket(bucket: string, mountPath: string, options: MountBucketOptions): Promise<void>;
-  /**
-   * Manually unmount a bucket filesystem.
-   */
-  unmountBucket(mountPath: string): Promise<void>;
-  /**
-   * In-flight `destroy()` promise. While set, concurrent callers coalesce
-   * onto the same teardown instead of triggering a second one. Cleared when
-   * the underlying work settles, so a later call that genuinely needs to
-   * recreate a destroyed sandbox still runs.
-   *
-   * If the underlying teardown hangs (e.g. `super.destroy()` never resolves
-   * because the Containers control plane is unresponsive), every coalesced
-   * caller hangs on the same promise until the Durable Object is evicted.
-   * This is deliberate: a second concurrent teardown would not make a stuck
-   * control plane unstuck, and spawning one would defeat the point of
-   * coalescing. Callers that need bounded waits must apply their own
-   * timeout around `destroy()`.
-   */
-  private inflightDestroy;
-  /**
-   * Cleanup and destroy the sandbox container.
-   *
-   * Concurrent calls coalesce: if a previous `destroy()` is still in flight,
-   * subsequent calls await the same underlying work instead of starting a
-   * second teardown. A canonical `sandbox.destroy.coalesced` event is logged
-   * per coalesced call so repeated destroy traffic is observable.
-   */
-  destroy(): Promise<void>;
-  private doDestroy;
-  onStart(): Promise<void>;
-  stop(signal?: Parameters<Container<Env>['stop']>[0]): Promise<void>;
-  /**
-   * Check if the container version matches the SDK version
-   * Logs a warning if there's a mismatch
-   */
-  private checkVersionCompatibility;
-  onStop(): Promise<void>;
-  onError(error: unknown): void;
-  /**
-   * Override Container.containerFetch to use production-friendly timeouts
-   * Automatically starts container with longer timeouts if not running
-   */
-  containerFetch(requestOrUrl: Request | string | URL, portOrInit?: number | RequestInit, portParam?: number): Promise<Response>;
-  /**
-   * Helper: Check if error is "no container instance available"
-   * This indicates the container VM is still being provisioned.
-   */
-  private isNoInstanceError;
-  /**
-   * Helper: Check if error is a transient startup error that should trigger retry
-   *
-   * These errors occur during normal container startup and are recoverable:
-   * - Port not yet mapped (container starting, app not listening yet)
-   * - Connection refused (port mapped but app not ready)
-   * - Timeouts during startup (recoverable with retry)
-   * - Network transients (temporary connectivity issues)
-   *
-   * Errors NOT included (permanent failures):
-   * - "no such image" - missing Docker image
-   * - "container already exists" - name collision
-   * - Configuration errors
-   */
-  private isTransientStartupError;
-  /**
-   * Helper: Check if error is a permanent startup failure that will never recover
-   *
-   * These errors indicate resource exhaustion, misconfiguration, or missing images.
-   * Retrying will never succeed, so the SDK should fail fast with HTTP 500.
-   *
-   * Error sources (traced from platform internals):
-   *   - Container runtime: OOM, PID limit
-   *   - Scheduling/provisioning: no matching app, no namespace configured
-   *   - workerd container-client.c++: no such image
-   *   - @cloudflare/containers: did not call start
-   */
-  private isPermanentStartupError;
-  /**
-   * Helper: Parse containerFetch arguments (supports multiple signatures)
-   */
-  private parseContainerFetchArgs;
-  /**
-   * Override onActivityExpired to prevent automatic shutdown when keepAlive is enabled
-   * When keepAlive is disabled, calls parent implementation which stops the container
-   */
-  onActivityExpired(): Promise<void>;
-  private getPreviewForwardingContainer;
-  private beginPreviewForward;
-  fetch(request: Request): Promise<Response>;
-  wsConnect(request: Request, port: number): Promise<Response>;
-  terminal(_options?: TerminalOptions): SandboxTerminal;
-  createTerminal(options: TerminalCreateOptions): Promise<void>;
-  destroyTerminal(id: string): Promise<void>;
-  private determinePort;
-  /**
-   
-   * Persist the container's placement ID in DO storage.
-   *
-   * Called from the session-create handshake so subsequent reads via
-   * `getContainerPlacementId()` do not require a round-trip to the container. The value
-   * is overwritten on every handshake so that container replacements (which
-   * assign a new placement ID) are reflected on the next session-create.
-   *
-   * A value of `undefined` means the handshake response omitted the field
-   * (older container, unexpected error shape) and the stored value is left
-   * untouched. `null` means the env var is not set in the container and is
-   * stored as-is so callers can distinguish "observed and absent" from "not
-   * yet observed."
-   */
-  private capturePlacementId;
-  private validateExplicitSessionId;
-  /**
-   * Validate an optional explicit session id without creating a session.
-   *
-   * Top-level process reads are sandbox-scoped, so they only carry a public
-   * session annotation when the caller provides an explicit session id. The
-   * resolved value is only used to populate `Process.sessionId` on the returned
-   * object — it is never sent to the container API.
-   */
-  private validateOptionalSessionId;
-  private resolveExecutionEnv;
-  private buildExecutionRequestOptions;
-  exec(command: string | string[], options?: SandboxExecOptions): SandboxProcessPromise;
-  /**
-   * Buffered, session-state-preserving execution helper. Uses the foreground
-   * session command path, preserving shell state such as cwd, aliases,
-   * functions, and exported variables.
-   */
-  run(command: string, options?: ExecOptions & {
-    sessionId?: string;
-  }): Promise<ExecResult>;
-  runWithSessionToken(command: string, sessionId: string, options?: ExecOptions): Promise<ExecResult>;
-  /**
-   * Internal: start a process via `client.processes.startProcess` and
-   * construct a `SandboxProcess` handle that demultiplexes the log stream
-   * into `stdout` / `stderr` and resolves `exitCode` on the `exit` event.
-   */
-  private spawnSandboxProcess;
-  private buildSandboxProcessDeps;
-  /**
-   * Execute an infrastructure command (backup, mount, env setup, etc.)
-   * tagged with origin: 'internal' so logging demotes it to debug level.
-   */
-  private execInternal;
-  private execWithSession;
-  /**
-   * Internal command execution implementation used by public exec() and
-   * explicit session wrappers.
-   */
-  private executeCommand;
-  private mapExecuteResponseToExecResult;
-  /**
-   * Wait for a log pattern to appear in process output
-   */
-  private waitForLogPattern;
-  /**
-   * Wait for a port to become available (for process readiness checking)
-   */
-  private waitForPortReady;
-  /**
-   * Wait for a process to exit
-   * Returns the exit code
-   */
-  private waitForProcessExit;
-  /**
-   * Match a pattern against text
-   */
-  private matchPattern;
-  /**
-   * Convert a log pattern to a human-readable string
-   */
-  private conditionToString;
-  /**
-   * Create a ProcessReadyTimeoutError
-   */
-  private createReadyTimeoutError;
-  /**
-   * Create a ProcessExitedBeforeReadyError
-   */
-  private createExitedBeforeReadyError;
-  /** Re-attach to an existing process by id. */
-  getProcess(id: string, options?: ProcessQueryOptions): Promise<SandboxProcess | null>;
-  /** Return lightweight process snapshots. */
-  listProcesses(options?: ProcessQueryOptions): Promise<SandboxProcess[]>;
-  killAllProcesses(): Promise<number>;
-  cleanupCompletedProcesses(): Promise<number>;
-  getProcessLogs(id: string): Promise<{
-    stdout: string;
-    stderr: string;
-    processId: string;
-  }>;
-  /**
-   * Stream logs from a background process as a ReadableStream.
-   */
-  streamProcessLogs(processId: string, options?: {
-    signal?: AbortSignal;
-  }): Promise<ReadableStream<Uint8Array>>;
-  mkdir(path: string, options?: {
-    recursive?: boolean;
-    sessionId?: string;
-  }): Promise<MkdirResult>;
-  writeFile(path: string, content: string | ReadableStream<Uint8Array>, options?: {
-    encoding?: string;
-    sessionId?: string;
-  }): Promise<{
-    success: boolean;
-    path: string;
-    bytesWritten: number;
-    timestamp: string;
-  } | WriteFileResult>;
-  deleteFile(path: string, options?: {
-    sessionId?: string;
-  }): Promise<DeleteFileResult>;
-  renameFile(oldPath: string, newPath: string, options?: {
-    sessionId?: string;
-  }): Promise<RenameFileResult>;
-  moveFile(sourcePath: string, destinationPath: string, options?: {
-    sessionId?: string;
-  }): Promise<MoveFileResult>;
-  /**
-   * Read a file from the sandbox.
-   *
-   * @param encoding - How to encode the returned content:
-   *   - `undefined` (default): auto-detect from MIME type (text → UTF-8 string, binary → base64 string)
-   *   - `'utf-8'` / `'utf8'`: always return as UTF-8 string
-   *   - `'base64'`: always return as base64-encoded string
-   *   - `'none'`: return a result whose `content` is a raw binary `ReadableStream<Uint8Array>`
-   *              with no encoding overhead.
-   */
-  readFile(path: string, options: {
-    encoding: 'none';
-    sessionId?: string;
-  }): Promise<ReadFileStreamResult>;
-  readFile(path: string, options?: {
-    encoding?: Exclude<FileEncoding, 'none'>;
-    sessionId?: string;
-  }): Promise<ReadFileResult>;
-  /**
-   * Stream a file from the sandbox using Server-Sent Events
-   * Returns a ReadableStream that can be consumed with streamFile() or collectFile() utilities
-   * @param path - Path to the file to stream
-   * @param options - Optional session ID
-   */
-  readFileStream(path: string, options?: {
-    sessionId?: string;
-  }): Promise<ReadableStream<Uint8Array>>;
-  listFiles(path: string, options?: ListFilesOptions): Promise<ListFilesResult>;
-  exists(path: string, options?: {
-    sessionId?: string;
-  }): Promise<FileExistsResult>;
-  /**
-   * Watch a directory for file system changes using native inotify.
-   *
-   * The returned promise resolves only after the watcher is established on the
-   * filesystem, so callers can immediately perform actions that depend on the
-   * watch being active. The returned stream contains the full event sequence
-   * starting with the `watching` event.
-   *
-   * Consume the stream with `parseSSEStream<FileWatchSSEEvent>(stream)`.
-   *
-   * @param path - Path to watch (absolute or relative to /workspace)
-   * @param options - Watch options
-   */
-  watch(path: string, options?: WatchOptions): Promise<ReadableStream<Uint8Array>>;
-  /**
-   * Check whether a path changed while this caller was disconnected.
-   *
-   * Pass the `version` returned from a prior call in `options.since` to learn
-   * whether the path is unchanged, changed, or needs a full resync because the
-   * retained change state was reset.
-   *
-   * @param path - Path to check (absolute or relative to /workspace)
-   * @param options - Change-check options
-   */
-  checkChanges(path: string, options?: CheckChangesOptions): Promise<CheckChangesResult>;
-  private ensureRuntimeActiveForPreview;
-  /**
-   * Expose a port and get a preview URL for accessing services running in the sandbox
-   *
-   * Preview URL authorization survives transient container restarts, but
-   * forwarding is active only for the runtime where `exposePort()` was last
-   * called. Call `exposePort()` again after a restart to reactivate an
-   * existing URL for the current runtime.
-   *
-   * @param port - Port number to expose (1024-65535)
-   * @param options - Configuration options
-   * @param options.hostname - Your Worker's domain name (required for preview URL construction)
-   * @param options.name - Optional friendly name for the port
-   * @param options.token - Optional custom token for the preview URL (1-16 characters: lowercase letters, numbers, underscores)
-   *                       If not provided, a random 16-character token will be generated automatically
-   * @returns Preview URL information including the full URL, port number, and optional name
-   *
-   * @example
-   * // With auto-generated token
-   * const { url } = await sandbox.exposePort(8080, { hostname: 'example.com' });
-   * // url: https://8080-sandbox-id-abc123random4567.example.com
-   *
-   * @example
-   * // With custom token for stable URLs across deployments
-   * const { url } = await sandbox.exposePort(8080, {
-   *   hostname: 'example.com',
-   *   token: 'my_token_v1'
-   * });
-   * // url: https://8080-sandbox-id-my_token_v1.example.com
-   */
-  exposePort(port: number, options: {
-    name?: string;
-    hostname: string;
-    token?: string;
-  }): Promise<{
-    url: string;
-    port: number;
-    name?: string;
-  }>;
-  /**
-   * Revoke preview URL authorization and current-runtime activation for a port.
-   *
-   * Revocation is idempotent: calling this for a port with no preview state is
-   * still successful. The operation clears Durable Object-owned preview state
-   * only and does not contact, probe, wake, or clean up the container runtime.
-   */
-  unexposePort(port: number): Promise<void>;
-  /**
-   * Returns preview URLs that are currently forwardable in the active runtime.
-   * Durable authorization without current-runtime activation is omitted.
-   */
-  getExposedPorts(hostname: string): Promise<{
-    url: string;
-    port: number;
-    status: "active";
-  }[]>;
-  /**
-   * Returns whether a port is currently preview-forwardable.
-   * This checks Durable Object-owned auth and runtime activation without
-   * contacting or waking the container.
-   */
-  isPortExposed(port: number): Promise<boolean>;
-  /**
-   * Checks durable preview URL authorization for a port/token pair.
-   *
-   * This does not check whether the port is activated for the current runtime
-   * and is not sufficient to decide whether preview traffic may forward.
-   */
-  validatePortToken(port: number, token: string): Promise<boolean>;
-  /**
-   * Namespaced tunnel API. Quick tunnels are zero-config preview URLs
-   * backed by Cloudflare's trycloudflare service. Named tunnels bind a
-   * stable hostname under the configured Cloudflare zone.
-   *
-   * - `tunnels.get(port)` — idempotent. Returns the cached tunnel for
-   *   `port` if one exists in DO storage, otherwise spawns a fresh
-   *   cloudflared process and persists the record.
-   * - `tunnels.list()` — returns tunnels currently usable through this
-   *   sandbox runtime.
-   * - `tunnels.destroy(portOrInfo)` — tear down by port number or by
-   *   the record returned from `get()`.
-   *
-   * Container restarts drop quick-tunnel records because their
-   * `*.trycloudflare.com` URLs are tied to the dead cloudflared process.
-   * Named-tunnel records stay in storage and are marked for respawn so the
-   * next `get(port, { name })` call reuses the Cloudflare tunnel and DNS
-   * record while starting a fresh cloudflared process.
-   */
-  get tunnels(): TunnelsHandler;
-  /**
-   * Lazily construct the tunnel subsystem handle. Called from the
-   * `tunnels` getter on first access and from sandbox lifecycle hooks
-   * when tunnel reconciliation or cleanup is needed.
-   */
-  private ensureTunnelsBuilt;
-  /**
-   * Create isolated execution session for advanced use cases
-   * Returns ExecutionSession with full sandbox API bound to specific session
-   */
-  createSession(options?: SessionOptions): Promise<ExecutionSession>;
-  /**
-   * Get an existing session by ID
-   * Returns ExecutionSession wrapper bound to the specified session
-   *
-   * This is useful for retrieving sessions across different requests/contexts
-   * without storing the ExecutionSession object (which has RPC lifecycle limitations)
-   *
-   * @param sessionId - The ID of an existing session
-   * @returns ExecutionSession wrapper bound to the session
-   */
-  getSession(sessionId: string): Promise<ExecutionSession>;
-  /**
-   * Delete an execution session.
-   *
-   * Cleans up explicit session resources and removes them from the container.
-   *
-   * @param sessionId - The ID of the session to delete
-   * @returns Result with success status, sessionId, and timestamp
-   */
-  deleteSession(sessionId: string): Promise<SessionDeleteResult>;
-  /**
-   * Get the Cloudflare placement ID observed for the underlying container.
-   *
-   * The placement ID is captured during the first session-create handshake
-   * after a container start and stored in Durable Object storage, so this
-   * method returns the cached value without contacting the container. A new
-   * placement ID is captured on each subsequent session-create handshake,
-   * which occurs whenever the container has been replaced.
-   *
-   * Returns `null` when a handshake has completed but the container's
-   * `CLOUDFLARE_PLACEMENT_ID` environment variable is not set (for example,
-   * in local development).
-   *
-   * Returns `undefined` when no explicit session-create handshake has been
-   * observed yet on this sandbox. Call `createSession()` to populate the value.
-   */
-  getContainerPlacementId(): Promise<string | null | undefined>;
-  private getSessionWrapper;
-  /**
-   * Create a backup of a directory and upload it to R2.
-   *
-   * The returned DirectoryBackup handle is serializable. Store it anywhere
-   * (KV, D1, DO storage) and pass it to restoreBackup() later.
-   *
-   * Concurrent backup/restore calls on the same sandbox are serialized.
-   */
-  createBackup(options: BackupOptions): Promise<DirectoryBackup>;
-  /**
-   * Restore a backup from R2 into a directory.
-   *
-   * Production restores use a FUSE overlay mount. Local-bucket restores stream
-   * the archive through the R2 binding and extract it with unsquashfs.
-   *
-   * Concurrent backup/restore calls on the same sandbox are serialized.
-   */
-  restoreBackup(backup: DirectoryBackup): Promise<RestoreBackupResult>;
-  __setBackupRestoreFaultForTesting(fault: BackupRestoreTestFault | null): Promise<void>;
-  registerGitAuthInterceptor(params: HTTPAuthInterceptorParams): Promise<void>;
-  private getMountOutboundHost;
-}
-//#endregion
-export { BucketUnmountError as a, S3FSMountError as c, BucketMountError as i, getSandbox as n, InvalidMountConfigError as o, ContainerProxy$1 as r, MissingCredentialsError as s, Sandbox as t };
-//# sourceMappingURL=sandbox-DHNO89IF.d.ts.map