@cloudflare/sandbox 0.13.0-next.724.1 → 0.13.0-next.748.1

package/dist/bridge/index.js

@@ -1,7 +1,7 @@
 import "../errors-CXR0xBpw.js";
 import "../errors-QYlSkVGz.js";
 import "../dist-Duor5GbS.js";
-import { g as validateTunnelName, h as validatePort, m as SandboxSecurityError, n as getSandbox$1, x as streamFile } from "../sandbox-Auuwfnur.js";
+import { g as validateTunnelName, h as validatePort, m as SandboxSecurityError, n as getSandbox$1, x as streamFile } from "../sandbox-CXc1T45U.js";
 import "../extensions-CFB2xHqY.js";
 import { DurableObject, env } from "cloudflare:workers";
 import { Hono } from "hono";

package/dist/index-Bs4bqXDR.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index-Bs4bqXDR.d.ts","names":["BackupCompressionOptions","ReadFileRequest","WriteFileRequest","DeleteFileRequest","RenameFileRequest","MoveFileRequest","MkdirRequest","FileExistsRequest","ListFilesRequest","CreateBackupRequest","UploadPart","UploadPartsRequest","UploadedPart","UploadPartsResponse","CreateBackupResponse","RestoreBackupRequest","RestoreBackupResponse","SandboxProcessesAPI","SandboxTerminalsAPI","CreateBackupResponse","RestoreBackupResponse","UploadedPart","UploadPartsResponse","BackupCompressionOptions","CheckChangesRequest","CheckChangesResult","DeleteFileResult","FileEncoding","FileExistsResult","ListFilesOptions","ListFilesResult","MkdirResult","MoveFileResult","PortWatchRPCOptions","PortWatchSubscriptionAPI","ReadFileResult","ReadFileStreamResult","RenameFileResult","WatchRequest","WriteFileResult","S3FSOptionValue","MountCommandResult","MountS3FSRequest","Record","RemoveMountDirectoryRequest","SandboxAPI","SandboxFilesAPI","SandboxPortsAPI","SandboxUtilsAPI","SandboxBackupAPI","SandboxWatchAPI","SandboxTunnelsAPI","SandboxMountsAPI","SandboxWorkspaceAPI","SandboxExtensionsAPI","ReadFileStreamOptions","ReadFileBinaryOptions","ReadFileOptions","Exclude","WriteFileOptions","MkdirOptions","Promise","Uint8Array","ReadableStream","RuntimeMetadata","CreateWorkspaceArchiveRequest","CreateWorkspaceArchiveResult","ExtractWorkspaceArchiveRequest","BackupUploadArchiveRequest","BackupDownloadArchiveRequest","Array","BackupPrepareRestoreRequest","BackupUploadPartsRequest","BackupCreateArchiveOptions","WatchSubscriptionAPI","TunnelInfo","QuickTunnelInfo","NamedTunnelInfo","TunnelOptions","TunnelRunMode","TunnelRunIdentity","TunnelRunRef","EnsureQuickTunnelRunRequest","EnsureNamedTunnelRunRequest","EnsureTunnelRunRequest","QuickTunnelRunSnapshot","NamedTunnelRunSnapshot","TunnelRunSnapshot","EnsureTunnelRunResult","StopTunnelRunRequest","StopTunnelRunResult","TunnelRunExitEvent","ExtensionPackage","ExtensionRegistration","ExtensionHealth","ExtensionConnectRequest","EXTENSION_TARBALL_REQUIRED","SandboxControlCallback"],"sources":["../../shared/dist/request-types.d.ts","../../shared/dist/rpc-types.d.ts","../src/processes/rpc-types.ts","../src/extensions/index.ts"],"sourcesContent":["import type { BackupCompressionOptions } from './types.js';\n/**\n * Request types for API calls to the container\n * Single source of truth for the contract between SDK clients and container handlers\n */\n/**\n * Request to read a file\n */\nexport interface ReadFileRequest {\n    path: string;\n    encoding?: string;\n}\n/**\n * Request to write a file\n */\nexport interface WriteFileRequest {\n    path: string;\n    content: string;\n    encoding?: string;\n}\n/**\n * Request to delete a file\n */\nexport interface DeleteFileRequest {\n    path: string;\n}\n/**\n * Request to rename a file\n */\nexport interface RenameFileRequest {\n    oldPath: string;\n    newPath: string;\n}\n/**\n * Request to move a file\n */\nexport interface MoveFileRequest {\n    sourcePath: string;\n    destinationPath: string;\n}\n/**\n * Request to create a directory\n */\nexport interface MkdirRequest {\n    path: string;\n    recursive?: boolean;\n}\n/**\n * Request to check if a file or directory exists\n */\nexport interface FileExistsRequest {\n    path: string;\n}\n/**\n * Request to list files in a directory\n */\nexport interface ListFilesRequest {\n    path: string;\n    options?: {\n        recursive?: boolean;\n        includeHidden?: boolean;\n    };\n}\n/**\n * Request to create a backup archive from a directory.\n * The container creates a squashfs archive at archivePath.\n * The DO then reads it and uploads to R2.\n */\nexport interface CreateBackupRequest {\n    /** Directory to back up */\n    dir: string;\n    /** Path where the container should write the archive */\n    archivePath: string;\n    /** Respect git ignore rules when the directory is inside a git repository */\n    gitignore?: boolean;\n    /** Glob patterns to exclude from the backup */\n    excludes?: string[];\n    compression?: BackupCompressionOptions;\n}\n/**\n * A single part to upload in a multipart upload.\n * The container reads the byte range from the local archive and PUTs it\n * to the presigned URL.\n */\nexport interface UploadPart {\n    partNumber: number;\n    /** Presigned PUT URL for this part */\n    url: string;\n    /** Byte offset within the archive file */\n    offset: number;\n    /** Number of bytes in this part */\n    size: number;\n}\n/**\n * Request to upload parts of a backup archive directly from the container to R2.\n * Used for parallel multipart upload of large archives.\n */\nexport interface UploadPartsRequest {\n    /** Path to the archive file in the container */\n    archivePath: string;\n    /** Parts to upload in parallel */\n    parts: UploadPart[];\n}\n/**\n * Result for a single uploaded part (ETag returned by R2).\n */\nexport interface UploadedPart {\n    partNumber: number;\n    etag: string;\n}\n/**\n * Response after the container has uploaded all parts.\n */\nexport interface UploadPartsResponse {\n    success: boolean;\n    parts: UploadedPart[];\n}\n/**\n * Response from the container after creating a backup archive\n */\nexport interface CreateBackupResponse {\n    success: boolean;\n    /** Size of the archive in bytes */\n    sizeBytes: number;\n    /** Path to the archive file in the container */\n    archivePath: string;\n}\n/**\n * Request to restore a backup from an archive file.\n * The DO writes the archive to archivePath first, then tells the container to extract it.\n */\nexport interface RestoreBackupRequest {\n    /** Directory to restore into */\n    dir: string;\n    /** Path to the archive file in the container */\n    archivePath: string;\n}\n/**\n * Response from the container after restoring a backup\n */\nexport interface RestoreBackupResponse {\n    success: boolean;\n    /** Directory that was restored */\n    dir: string;\n}\n//# sourceMappingURL=request-types.d.ts.map","/**\n * Shared interface types for the container-control path.\n *\n * Defines the contract between the SDK control client and the container\n * control-plane API. The current wire implementation uses capnweb RPC.\n */\nimport type { SandboxProcessesAPI } from './process-types.js';\nimport type { SandboxTerminalsAPI } from './pty-types.js';\nimport type { CreateBackupResponse, RestoreBackupResponse, UploadedPart, UploadPartsResponse } from './request-types.js';\nimport type { BackupCompressionOptions, CheckChangesRequest, CheckChangesResult, DeleteFileResult, FileEncoding, FileExistsResult, ListFilesOptions, ListFilesResult, MkdirResult, MoveFileResult, PortWatchRPCOptions, PortWatchSubscriptionAPI, ReadFileResult, ReadFileStreamResult, RenameFileResult, WatchRequest, WriteFileResult } from './types.js';\nexport type S3FSOptionValue = string | boolean;\nexport interface MountCommandResult {\n    success: boolean;\n    exitCode: number;\n    stdout: string;\n    stderr: string;\n}\nexport interface MountS3FSRequest {\n    source: string;\n    mountPath: string;\n    options: Record<string, S3FSOptionValue>;\n}\nexport interface RemoveMountDirectoryRequest {\n    path: string;\n    onlyIfNotMountpoint: boolean;\n}\nexport interface SandboxAPI {\n    files: SandboxFilesAPI;\n    ports: SandboxPortsAPI;\n    utils: SandboxUtilsAPI;\n    backup: SandboxBackupAPI;\n    watch: SandboxWatchAPI;\n    tunnels: SandboxTunnelsAPI;\n    terminals: SandboxTerminalsAPI;\n    processes: SandboxProcessesAPI;\n    mounts: SandboxMountsAPI;\n    workspace: SandboxWorkspaceAPI;\n    extensions: SandboxExtensionsAPI;\n}\nexport type ReadFileStreamOptions = object;\nexport interface ReadFileBinaryOptions {\n    encoding: 'none';\n}\nexport interface ReadFileOptions {\n    encoding?: Exclude<FileEncoding, 'none'>;\n}\nexport interface WriteFileOptions {\n    encoding?: string;\n    permissions?: string;\n}\nexport interface MkdirOptions {\n    recursive?: boolean;\n}\nexport interface SandboxFilesAPI {\n    readFile(path: string, options: ReadFileBinaryOptions): Promise<ReadFileStreamResult>;\n    readFile(path: string, options?: ReadFileOptions): Promise<ReadFileResult>;\n    readFileStream(path: string, options?: ReadFileStreamOptions): Promise<ReadableStream<Uint8Array>>;\n    writeFile(path: string, content: string, options?: WriteFileOptions): Promise<WriteFileResult>;\n    writeFileStream(path: string, stream: ReadableStream<Uint8Array>, options?: Record<string, never>): Promise<{\n        success: boolean;\n        path: string;\n        bytesWritten: number;\n        timestamp: string;\n    }>;\n    deleteFile(path: string, options?: Record<string, never>): Promise<DeleteFileResult>;\n    renameFile(oldPath: string, newPath: string, options?: Record<string, never>): Promise<RenameFileResult>;\n    moveFile(sourcePath: string, destinationPath: string, options?: Record<string, never>): Promise<MoveFileResult>;\n    mkdir(path: string, options?: MkdirOptions): Promise<MkdirResult>;\n    listFiles(path: string, options?: ListFilesOptions): Promise<ListFilesResult>;\n    exists(path: string, options?: Record<string, never>): Promise<FileExistsResult>;\n}\nexport interface SandboxPortsAPI {\n    openWatch(port: number, options?: PortWatchRPCOptions): Promise<PortWatchSubscriptionAPI>;\n}\nexport interface RuntimeMetadata {\n    runtimeIncarnationID: string;\n    sandboxVersion: string;\n    controlProtocolVersion: 1;\n}\nexport interface SandboxUtilsAPI {\n    ping(): Promise<string>;\n    getRuntimeMetadata(): Promise<RuntimeMetadata>;\n    activateControlSession(expectedRuntimeIncarnationID: string): Promise<RuntimeMetadata>;\n}\nexport interface CreateWorkspaceArchiveRequest {\n    root: string;\n    excludes: readonly string[];\n}\nexport interface CreateWorkspaceArchiveResult {\n    archivePath: string;\n}\nexport interface ExtractWorkspaceArchiveRequest {\n    root: string;\n    archivePath: string;\n}\nexport interface SandboxWorkspaceAPI {\n    createArchive(request: CreateWorkspaceArchiveRequest): Promise<CreateWorkspaceArchiveResult>;\n    extractArchive(request: ExtractWorkspaceArchiveRequest): Promise<void>;\n    cleanupArchive(archivePath: string): Promise<void>;\n}\nexport interface SandboxMountsAPI {\n    pathExists(path: string): Promise<boolean>;\n    ensureDirectory(path: string): Promise<void>;\n    chmodOwnerOnly(path: string): Promise<void>;\n    deleteFile(path: string): Promise<void>;\n    mountS3FS(request: MountS3FSRequest): Promise<MountCommandResult>;\n    mountS3FSAndVerify(request: MountS3FSRequest): Promise<MountCommandResult>;\n    isMountpoint(path: string): Promise<boolean>;\n    unmountFuse(path: string): Promise<MountCommandResult>;\n    unmountFuseIfMounted(path: string): Promise<void>;\n    removeMountDirectory(request: RemoveMountDirectoryRequest): Promise<MountCommandResult>;\n}\nexport interface BackupUploadArchiveRequest {\n    archivePath: string;\n    url: string;\n    timeoutMs: number;\n}\nexport interface BackupDownloadArchiveRequest {\n    archivePath: string;\n    expectedSize: number;\n    parts: Array<{\n        url: string;\n        offset: number;\n        range?: string;\n    }>;\n    timeoutMs: number;\n}\nexport interface BackupPrepareRestoreRequest {\n    dir: string;\n    backupId: string;\n    archivePath: string;\n}\nexport interface BackupUploadPartsRequest {\n    archivePath: string;\n    parts: Array<{\n        partNumber: number;\n        url: string;\n        offset: number;\n        size: number;\n    }>;\n}\nexport interface BackupCreateArchiveOptions {\n    excludes?: string[];\n    gitignore?: boolean;\n    compression?: BackupCompressionOptions;\n}\nexport interface SandboxBackupAPI {\n    createArchive(dir: string, archivePath: string, options?: BackupCreateArchiveOptions): Promise<CreateBackupResponse>;\n    restoreArchive(dir: string, archivePath: string): Promise<RestoreBackupResponse>;\n    uploadArchive(request: BackupUploadArchiveRequest): Promise<void>;\n    uploadParts(request: BackupUploadPartsRequest): Promise<UploadPartsResponse>;\n    prepareRestore(request: BackupPrepareRestoreRequest): Promise<{\n        existingSize: number;\n    }>;\n    downloadArchive(request: BackupDownloadArchiveRequest): Promise<void>;\n    extractArchive(dir: string, archivePath: string): Promise<void>;\n    cleanupArchive(archivePath: string): Promise<void>;\n}\nexport type { UploadedPart, UploadPartsResponse };\nexport interface WatchSubscriptionAPI {\n    stream(): Promise<ReadableStream<Uint8Array>>;\n    cancel(): Promise<void>;\n    [Symbol.dispose](): void;\n}\nexport interface SandboxWatchAPI {\n    watch(request: WatchRequest): Promise<WatchSubscriptionAPI>;\n    checkChanges(request: CheckChangesRequest): Promise<CheckChangesResult>;\n}\n/**\n * Public-facing tunnel record. Discriminated on the presence of `name`:\n * quick tunnels (`*.trycloudflare.com`) omit it, named tunnels carry the\n * label that was passed to `get(port, { name })`.\n */\nexport type TunnelInfo = QuickTunnelInfo | NamedTunnelInfo;\nexport interface QuickTunnelInfo {\n    id: string;\n    port: number;\n    /** `https://<random>.trycloudflare.com`. */\n    url: string;\n    /** Hostname portion of `url`. */\n    hostname: string;\n    createdAt: string;\n    /** Absent on quick tunnels; narrows the union. */\n    name?: never;\n}\nexport interface NamedTunnelInfo {\n    /** Cloudflare tunnel UUID (8-4-4-4-12). */\n    id: string;\n    port: number;\n    /** `https://<hostname>`. */\n    url: string;\n    /** Full hostname bound to the tunnel (without scheme). */\n    hostname: string;\n    createdAt: string;\n    /** Label originally passed via `TunnelOptions.name`. */\n    name: string;\n}\n/**\n * Options accepted by `sandbox.tunnels.get(port, options)`. Omitting\n * `name` (or omitting the options object) selects the zero-config quick\n * tunnel; setting `name` selects the named-tunnel flow.\n */\nexport interface TunnelOptions {\n    /**\n     * Single DNS label under the configured zone. The full hostname is\n     * `<name>.<zone-name>`. See `validateTunnelName` for the format rules.\n     */\n    name?: string;\n}\nexport type TunnelRunMode = 'quick' | 'named';\nexport interface TunnelRunIdentity {\n    tunnelId: string;\n    runId: string;\n}\nexport type TunnelRunRef = TunnelRunIdentity;\nexport interface EnsureQuickTunnelRunRequest extends TunnelRunIdentity {\n    mode: 'quick';\n    port: number;\n    readyTimeoutMs?: number;\n    stopGraceMs?: number;\n}\nexport interface EnsureNamedTunnelRunRequest extends TunnelRunIdentity {\n    mode: 'named';\n    port: number;\n    cloudflaredToken: string;\n    readyTimeoutMs?: number;\n    stopGraceMs?: number;\n}\nexport type EnsureTunnelRunRequest = EnsureQuickTunnelRunRequest | EnsureNamedTunnelRunRequest;\nexport interface QuickTunnelRunSnapshot extends TunnelRunIdentity {\n    mode: 'quick';\n    port: number;\n    url: string;\n    hostname: string;\n    startedAt: string;\n}\nexport interface NamedTunnelRunSnapshot extends TunnelRunIdentity {\n    mode: 'named';\n    port: number;\n    startedAt: string;\n}\nexport type TunnelRunSnapshot = QuickTunnelRunSnapshot | NamedTunnelRunSnapshot;\nexport interface EnsureTunnelRunResult {\n    run: TunnelRunSnapshot;\n    started: boolean;\n}\nexport type StopTunnelRunRequest = TunnelRunRef;\nexport interface StopTunnelRunResult {\n    stopped: boolean;\n}\nexport interface TunnelRunExitEvent extends TunnelRunIdentity {\n    mode: TunnelRunMode;\n    port: number;\n    exitCode: number | null;\n}\nexport interface SandboxTunnelsAPI {\n    /** Ensure a runtime-local cloudflared process for a DO-issued run id. */\n    ensureTunnelRun(request: EnsureTunnelRunRequest): Promise<EnsureTunnelRunResult>;\n    /** Stop the matching runtime-local cloudflared process. */\n    stopTunnelRun(request: StopTunnelRunRequest): Promise<StopTunnelRunResult>;\n}\n/**\n * Author-facing description of a sidecar extension. An extension is an\n * npm-style package: an `.tgz` whose embedded `package.json` declares the\n * sidecar entrypoint (via `bin`) and any extension metadata (under the\n * `sandboxExtension` key).\n *\n * The SDK ships the tarball bytes; the container hashes them, provisions a\n * dedicated directory keyed by content hash, derives identity from the\n * embedded `package.json`, installs the package with `bun add`, and spawns\n * the declared bin under Bun.\n *\n * `ExtensionPackage` carries tarball bytes produced by an extension build.\n * The SDK sends those bytes only when the container has not provisioned the\n * package hash yet.\n */\nexport interface ExtensionPackage {\n    /** Raw `.tgz` bytes. */\n    tarball: Uint8Array;\n    /**\n     * Bin entry to run when the embedded `package.json` declares more than one.\n     * Defaults to the value of `sandboxExtension.bin` in `package.json`, then\n     * to the single bin entry if there is exactly one.\n     */\n    bin?: string;\n    /**\n     * Max time to wait for the sidecar to accept a capnweb connection on its\n     * unix socket. Falls back to `sandboxExtension.readinessTimeoutMs` in\n     * `package.json`, then to a host default.\n     */\n    readinessTimeoutMs?: number;\n    /**\n     * Run lifecycle scripts during `bun add`. Defaults to false — provisioning\n     * happens before the sidecar is supervised, so install-time side effects\n     * are deliberately opt-in.\n     */\n    allowInstallScripts?: boolean;\n}\n/**\n * Container-derived identity for a provisioned extension package. Not\n * authored — produced by the host after extracting the embedded\n * `package.json` from a tarball.\n */\nexport interface ExtensionRegistration {\n    /** Slugified package name (e.g. `@acme/foo` → `acme-foo`). */\n    id: string;\n    packageName: string;\n    version: string;\n    /** Hex sha256 of the tarball bytes. */\n    packageHash: string;\n    /** Resolved bin entry the host spawns. */\n    bin: string;\n    readinessTimeoutMs: number;\n}\n/** Health snapshot for a provisioned extension. */\nexport interface ExtensionHealth {\n    packageHash: string;\n    id: string;\n    version: string;\n    /** Tarball is on disk and the package.json has been read. */\n    provisioned: boolean;\n    /** Sidecar process is currently running. */\n    running: boolean;\n    pid: number | null;\n    /** Whether a `__ping__` round-tripped over capnweb. */\n    responsive: boolean;\n}\n/**\n * Connect request payload. The SDK hashes the tarball locally and first sends\n * only the hash. If the current host process has not provisioned that hash,\n * it responds with an `ExtensionTarballRequired` error and the SDK retries\n * with `tarball` populated.\n */\nexport interface ExtensionConnectRequest {\n    packageHash: string;\n    /** Only sent when the host has not seen this hash yet. */\n    tarball?: Uint8Array;\n    bin?: string;\n    readinessTimeoutMs?: number;\n    allowInstallScripts?: boolean;\n}\n/**\n * Error name thrown by the host's `connect` when it has not yet provisioned\n * the requested hash and the request did not carry tarball bytes. The SDK\n * recognises this name via `Error.name` and retries the connect with the\n * bytes attached. Kept as a string constant so it survives capnweb\n * cross-realm error reconstruction.\n */\nexport declare const EXTENSION_TARBALL_REQUIRED = \"ExtensionTarballRequired\";\n/**\n * Control surface for container sidecar extensions.\n *\n * `connect` is the only entry point: it provisions on first use, supervises\n * lazily, and returns the sidecar's capnweb remote main as a stub. Calls on\n * the stub are proxied through the container's capnweb session to the\n * sidecar's capnweb session — callback parameters (including streaming\n * handlers) round-trip across both hops.\n */\nexport interface SandboxExtensionsAPI {\n    /**\n     * Provision the package (if new) and return the sidecar's typed remote\n     * main. The result is a capnweb stub whose methods correspond to the\n     * sidecar's `RpcTarget` surface.\n     */\n    connect(req: ExtensionConnectRequest): Promise<unknown>;\n    /** Health snapshot, probing the sidecar with a `__ping__` when running. */\n    health(packageHash: string): Promise<ExtensionHealth>;\n    /** Stop a sidecar and release its capnweb session. */\n    stop(packageHash: string): Promise<void>;\n}\n/**\n * RPC surface the Sandbox DO exposes to the container over the existing\n * capnweb session. The container reaches it via\n * `session.getRemoteMain<SandboxControlCallback>()` and invokes methods\n * to push control-plane events (today: tunnel exits) back to the DO.\n *\n * One stable target per sandbox; not per-tunnel. Reusable seam for\n * future container→DO events.\n */\nexport interface SandboxControlCallback {\n    /** Called by the container when a runtime-local tunnel run exits. */\n    onTunnelRunExit(event: TunnelRunExitEvent): Promise<void>;\n}\n//# sourceMappingURL=rpc-types.d.ts.map"],"mappings":";;;;;;;AC6KA;AACA;AAWiB6E,UD/EAjE,YAAAA,CC+Ee;EAiBfkE,UAAAA,EAAAA,MAAa;EAQbE,IAAAA,EAAAA,MAAAA;AAIjB;AACA;AAMA;AAOA;AACiBK,UDpHAxE,mBAAAA,CCoHsB;EAOtByE,OAAAA,EAAAA,OAAAA;EAKLC,KAAAA,ED9HD3E,YC8HC2E,EAAiB;AAC7B;AAIA;AACA;AAQA;AAE6BH,UDzIZtE,oBAAAA,CCyIYsE;EAAiCI,OAAAA,EAAAA,OAAAA;EAAR3B;EAE3B4B,SAAAA,EAAAA,MAAAA;EAA+BC;EAAR7B,WAAAA,EAAAA,MAAAA;;;;;ACjPjC,UF0HA7C,qBAAAA,CE1H0B;EACA,OAAA,EAAA,OAAA;EAAzB;EAAR,GAAA,EAAA,MAAA;;;;;AD8CiFqB,KA1B/EkB,qBAAAA,GA0B+ElB,MAAAA;AAARwB,UAzBlEL,qBAAAA,CAyBkEK;EACflB,QAAAA,EAAAA,MAAAA;;AAAwBkB,UAvB3EJ,eAAAA,CAuB2EI;EAC1DD,QAAAA,CAAAA,EAvBnBF,OAuBmBE,CAvBXjC,YAuBWiC,EAAAA,MAAAA,CAAAA;;AAAeC,UArBhCF,gBAAAA,CAqBgCE;EACXhC,QAAAA,CAAAA,EAAAA,MAAAA;EAA2BC,WAAAA,CAAAA,EAAAA,MAAAA;;AAC9Ba,UAnBlBiB,YAAAA,CAmBkBjB;EAAgCf,SAAAA,CAAAA,EAAAA,OAAAA;;AAAD,UAhBjDkB,eAAAA,CAgBiD;EAEjDC,QAAAA,CAAAA,IAAAA,EAAAA,MAAe,EAAA,OAAA,EAjBIS,qBAiBJ,CAAA,EAjB4BK,OAiB5B,CAjBoCzB,oBAiBpC,CAAA;EACMH,QAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAjBDwB,eAiBCxB,CAAAA,EAjBiB4B,OAiBjB5B,CAjByBE,cAiBzBF,CAAAA;EAA8BC,cAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAhBzBqB,qBAgByBrB,CAAAA,EAhBD2B,OAgBC3B,CAhBO6B,cAgBP7B,CAhBsB4B,UAgBtB5B,CAAAA,CAAAA;EAAR2B,SAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAfLF,gBAeKE,CAAAA,EAfcA,OAedA,CAfsBtB,eAetBsB,CAAAA;EAAO,eAAA,CAAA,IAAA,EAAA,MAAA,EAAA,MAAA,EAdzBE,cAcyB,CAdVD,UAcU,CAAA,EAAA,OAAA,CAAA,EAdanB,MAcb,CAAA,MAAA,EAAA,KAAA,CAAA,CAAA,EAdqCkB,OAcrC,CAAA;IAElDG,OAAAA,EAAAA,OAAe;IAKfhB,IAAAA,EAAAA,MAAAA;IACLa,YAAAA,EAAAA,MAAAA;IACsBG,SAAAA,EAAAA,MAAAA;EAARH,CAAAA,CAAAA;EACgDG,UAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAlBnCrB,MAkBmCqB,CAAAA,MAAAA,EAAAA,KAAAA,CAAAA,CAAAA,EAlBXH,OAkBWG,CAlBHtC,gBAkBGsC,CAAAA;EAARH,UAAAA,CAAAA,OAAAA,EAAAA,MAAAA,EAAAA,OAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAjBPlB,MAiBOkB,CAAAA,MAAAA,EAAAA,KAAAA,CAAAA,CAAAA,EAjBiBA,OAiBjBA,CAjByBxB,gBAiBzBwB,CAAAA;EAAO,QAAA,CAAA,UAAA,EAAA,MAAA,EAAA,eAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EAhBLlB,MAgBK,CAAA,MAAA,EAAA,KAAA,CAAA,CAAA,EAhBmBkB,OAgBnB,CAhB2B7B,cAgB3B,CAAA;EA8BxDoC,KAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAA0B,CAA1BA,EA7CiBR,YA6CS,CAAA,EA7CMC,OA6CN,CA7Cc9B,WA6Cd,CAAA;EAK1BsC,SAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAGD,CAH6B,EAjDPxC,gBAoDtB,CAAA,EApDyCgC,OAoDzC,CApDiD/B,eAoDjD,CAAA;EAOCyC,MAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAA2B,CAA3BA,EA1DkB5B,MA0DS,CAAA,MAAA,EAAA,KAAA,CAAA,CAAA,EA1DekB,OA0Df,CA1DuBjC,gBA0DvB,CAAA;AAK5C;AASiB6C,UAtEA1B,eAAAA,CAsE0B;EAK1BE,SAAAA,CAAAA,IAAAA,EAAAA,MAAgB,EAAA,OAAA,CAAA,EA1EKhB,mBA0EL,CAAA,EA1E2B4B,OA0E3B,CA1EmC3B,wBA0EnC,CAAA;;AACkEf,UAzElF6C,eAAAA,CAyEkF7C;EAAR0C,oBAAAA,EAAAA,MAAAA;EAC7BzC,cAAAA,EAAAA,MAAAA;EAARyC,sBAAAA,EAAAA,CAAAA;;AACEA,UAtEvCb,eAAAA,CAsEuCa;EAC/BW,IAAAA,EAAAA,EAtEbX,OAsEaW,CAAAA,MAAAA,CAAAA;EAAmClD,kBAAAA,EAAAA,EArElCuC,OAqEkCvC,CArE1B0C,eAqE0B1C,CAAAA;EAARuC,sBAAAA,CAAAA,4BAAAA,EAAAA,MAAAA,CAAAA,EApEcA,OAoEdA,CApEsBG,eAoEtBH,CAAAA;;AA8ExCuB,UApHKhB,0BAAAA,CAoHoBc;EACpBG,WAAAA,EAAAA,MAAAA;EAOAC,GAAAA,EAAAA,MAAAA;EAKLC,SAAAA,EAAAA,MAAAA;AACZ;AAIYE,UAjIKpB,4BAAAA,CAiIkBY;EAClBS,WAAAA,EAAAA,MAAAA;EAQAvC,YAAAA,EAAAA,MAAiB;EAELiC,KAAAA,EAzIlBd,KAyIkBc,CAAAA;IAAiCI,GAAAA,EAAAA,MAAAA;IAAR3B,MAAAA,EAAAA,MAAAA;IAE3B4B,KAAAA,CAAAA,EAAAA,MAAAA;EAA+BC,CAAAA,CAAAA;EAAR7B,SAAAA,EAAAA,MAAAA;;AAiBjC+B,UArJArB,2BAAAA,CAuJJT;EAqCIgC,GAAAA,EAAAA,MAAAA;EAkBAC,QAAAA,EAAAA,MAAAA;EAyBAzC,WAAAA,EAAAA,MAAAA;;AAM0BO,UAxO1BW,wBAAAA,CAwO0BX;EAEFiC,WAAAA,EAAAA,MAAAA;EAARjC,KAAAA,EAxOtBS,KAwOsBT,CAAAA;IAEFA,UAAAA,EAAAA,MAAAA;IAAO,GAAA,EAAA,MAAA;;;;AC9VtC;AAC2C,UD0H1BY,0BAAAA,CC1H0B;EAAzB,QAAA,CAAA,EAAA,MAAA,EAAA;EAAR,SAAA,CAAA,EAAA,OAAA;EACE,WAAA,CAAA,ED4HMlD,wBC5HN;;AAIK,UD0HA0B,gBAAAA,CC1HoB;EACjB,aAAA,CAAA,GAAA,EAAA,MAAA,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,ED0H0CwB,0BC1H1C,CAAA,ED0HuEZ,OC1HvE,CD0H+E1C,oBC1H/E,CAAA;EAAR,cAAA,CAAA,GAAA,EAAA,MAAA,EAAA,WAAA,EAAA,MAAA,CAAA,ED2H0C0C,OC3H1C,CD2HkDzC,qBC3HlD,CAAA;EAEE,aAAA,CAAA,OAAA,ED0HagD,0BC1Hb,CAAA,ED0H0CP,OC1H1C,CAAA,IAAA,CAAA;EAC0B,WAAA,CAAA,OAAA,ED0HfW,wBC1He,CAAA,ED0HYX,OC1HZ,CD0HoBvC,mBC1HpB,CAAA;EAA3B,cAAA,CAAA,OAAA,ED2HeiD,2BC3Hf,CAAA,ED2H6CV,OC3H7C,CAAA;IAAR,YAAA,EAAA,MAAA;EAGS,CAAA,CAAA;EAC0B,eAAA,CAAA,OAAA,ED0HXQ,4BC1HW,CAAA,ED0HoBR,OC1HpB,CAAA,IAAA,CAAA;EAA3B,cAAA,CAAA,GAAA,EAAA,MAAA,EAAA,WAAA,EAAA,MAAA,CAAA,ED2HyCA,OC3HzC,CAAA,IAAA,CAAA;EAAR,cAAA,CAAA,WAAA,EAAA,MAAA,CAAA,ED4HoCA,OC5HpC,CAAA,IAAA,CAAA;;AAIY,UD2HAa,oBAAAA,CC3HoB;YD4HvBb,QAAQE,eAAeD;YACvBD;;AEpHd;AACkB,UFsHDX,eAAAA,CEtHC;EACA,KAAA,CAAA,OAAA,EFsHCZ,YEtHD,CAAA,EFsHgBuB,OEtHhB,CFsHwBa,oBEtHxB,CAAA;EACC,YAAA,CAAA,OAAA,EFsHOlD,mBEtHP,CAAA,EFsH6BqC,OEtH7B,CFsHqCpC,kBEtHrC,CAAA;;;;;;;AAQd,KFqHOkD,UAAAA,GAAaC,eEpHvB,GFoHyCC,eEpHzC;AAEU,UFmHKD,eAAAA,CEnHmB;EAI/B,EAAA,EAAA,MAAA;EAA4B,IAAA,EAAA,MAAA;EAC7B;EACA,GAAA,EAAA,MAAA;EAEA;EAAC,QAAA,EAAA,MAAA;EAEO,SAAA,EAAA,MAAA;EACG;EACQ,IAAA,CAAA,EAAA,KAAA;;AAAnB,UFkHaC,eAAAA,CElHb;EAAO;EAEN,EAAA,EAAA,MAAA;EAA2C,IAAA,EAAA,MAAA;EACf;EAA/B,GAAA,EAAA,MAAA;EACI;EACA,QAAA,EAAA,MAAA;EAAsB,SAAA,EAAA,MAAA;EAIhB;EAAqC,IAAA,EAAA,MAAA;;;;;;;AAGrC,UFuHKC,aAAAA,CEvHL;EAEC;AAEb;AAMA;AAIA;EACiC,IAAA,CAAA,EAAA,MAAA;;AAGnB,UF6GGE,iBAAAA,CE7GH;EACC,QAAA,EAAA,MAAA;EAAiB,KAAA,EAAA,MAAA;;AAGjB,KF6GHC,YAAAA,GAAeD,iBE7GZ;AAAiB,UF8GfE,2BAAAA,SAAoCF,iBE9GrB,CAAA;EAAzB,IAAA,EAAA,OAAA;EACkC,IAAA,EAAA,MAAA;EAAR,cAAA,CAAA,EAAA,MAAA;EACZ,WAAA,CAAA,EAAA,MAAA;;AAGd,UF+GUG,2BAAAA,SAAoCH,iBE/G9C,CAAA;EAAO,IAAA,EAAA,OAAA;EAGG,IAAA,EAAA,MAAA;EACD,gBAAA,EAAA,MAAA;EAA0B,cAAA,CAAA,EAAA,MAAA;EAAsB,WAAA,CAAA,EAAA,MAAA;;AACvB,KFiH7BI,sBAAAA,GAAyBF,2BEjHI,GFiH0BC,2BEjH1B;AAAR,UFkHhBE,sBAAAA,SAA+BL,iBElHf,CAAA;EACN,IAAA,EAAA,OAAA;EAAR,IAAA,EAAA,MAAA;EAAO,GAAA,EAAA,MAAA;EAUV,QAAA,EAAA,MAAA;EA4EM,SAAA,EAAA,MAAA;;AAK8B,UF6BnCM,sBAAAA,SAA+BN,iBE7BI,CAAA;EAMf,IAAA,EAAA,OAAA;EAE3B,IAAA,EAAA,MAAA;EAAqC,SAAA,EAAA,MAAA;;AACoB,KFyBvDO,iBAAAA,GAAoBF,sBEzBmC,GFyBVC,sBEzBU;AAA/B,UF0BnBE,qBAAAA,CE1BmB;EAAvB,GAAA,EF2BJD,iBE3BI;EAAR,OAAA,EAAA,OAAA;;AAoBS,KFUFE,oBAAAA,GAAuBR,YEVrB;AACD,UFUIS,mBAAAA,CEVJ;EAAR,OAAA,EAAA,OAAA;;AA2BQ,UFTIvC,iBAAAA,CESJ;EAAR;EAyBsC,eAAA,CAAA,OAAA,EFhCdiC,sBEgCc,CAAA,EFhCWvB,OEgCX,CFhCmB2B,qBEgCnB,CAAA;EAAR;EAWF,aAAA,CAAA,OAAA,EFzCNC,oBEyCM,CAAA,EFzCiB5B,OEyCjB,CFzCyB6B,mBEyCzB,CAAA;;;;;;;;;;;;;;;;;UFxBhBE,gBAAAA;;WAEJ9B;;;;;;;;;;;;;;;;;;;;;UAqCIgC,eAAAA;;;;;;;;;;;;;;;;;;UAkBAC,uBAAAA;;;YAGHjC;;;;;;;;;;;;;;UAsBGR,oBAAAA;;;;;;eAMAyC,0BAA0BlC;;+BAEVA,QAAQiC;;6BAEVjC;;;;ADpOd7C,UE1HA,0BF0HqB,CAAA,CAAA,CAAA,CAAA;UEzH5B,QAAQ,yBAAyB;YAC/B;;ADmBZ;AACiBwC,UChBA,oBAAA,CDgBqB;EAGrBC,MAAAA,EAAAA,EClBL,ODkBKA,CClBG,aDmBG9B,CAAAA;EAENgC,QAAAA,CAAAA,OAAgB,CAAhBA,ECnBH,qBDmBmB,CAAA,EClB5B,ODkB4B,CClBpB,0BDkBoB,CClBO,eDkBP,CAAA,CAAA;EAIhBC,aAAAA,CAAAA,IAAY,EAAA,MAAA,EAAA,OAAA,CAAA,ECnBf,mBDmBe,CAAA,EClBxB,ODkBwB,CClBhB,0BDkBgB,CClBW,cDkBX,CAAA,CAAA;EAGZd,IAAAA,CAAAA,MAAAA,EAAAA,MAAe,CAAA,ECpBR,ODoBQ,CAAA,IAAA,CAAA;;AACoCV,UClBnD,oBAAA,CDkBmDA;EAARyB,EAAAA,EAAAA,MAAAA;EACvBJ,GAAAA,EAAAA,MAAAA;EAA0BtB,UAAAA,EChBjD,oBDgBiDA;;;;AAAR0B,KEV3C,uBAAA,GFU2CA;EACZN,SAAAA,KAAAA,EEVzB,eFUyBA;EAA+CO,SAAAA,KAAAA,EETxE,eFSwEA;EAAfC,SAAAA,MAAAA,EERxD,gBFQwDA;EAARF,SAAAA,KAAAA,EEPjD,eFOiDA;EACZF,SAAAA,OAAAA,EEPnC,iBFOmCA;EAA2BpB,SAAAA,SAAAA,EEN5D,mBFM4DA;EAARsB,SAAAA,UAAAA,EELnD,oBFKmDA;EACjBC,SAAAA,KAAAA,EELvC,eFKuCA;CAAfC;KEFrC,sBAAA,GACH,uBFC8EpB,CAAAA,MEDhD,uBFCgDA,CAAAA;AAAwBkB,KEC5F,wBAAA,GFD4FA,CAAAA,OAAAA,EEE7F,uBFF6FA,EAAAA,GEGnG,OFHmGA,CAAAA,OAAAA,CAAAA;KEKnG,sBFCkClB,CAAAA,CAAAA,CAAAA,GEDN,CFCMA,SEAnC,uBFAmCA,GECnC,sBFDmCA,GAAAA,KAAAA,GEGnC,CFHmCA;AAAgCjB,KEK3D,8BFL2DA,CAAAA,aEMxD,wBFNwDA,CAAAA,GEOnE,OFPmEA,CEO3D,UFP2DA,CEOhD,IFPgDA,CAAAA,CAAAA;KESlE,6BFT0DmC,CAAAA,aESf,wBFTeA,CAAAA,GEU7D,8BFV6DA,CEU9B,IFV8BA,CAAAA,SEWzD,uBFXyDA,GEYzD,sBFZyDA,GAAAA,KAAAA,GAAAA,OAAAA;AACJlB,KEe/C,oBAAA,GFf+CA,CAAAA,aEeV,wBFfUA,CAAAA,CAAAA,SAAAA,EAAAA,MAAAA,EAAAA,IAAAA,EEiBnD,IFjBmDA,GEiB5C,6BFjB4CA,CEiBd,IFjBcA,CAAAA,EAAAA,GEkBtD,OFlBsDA,CEkB9C,8BFlB8CA,CEkBf,IFlBeA,CAAAA,CAAAA;AAAgCN,cEoB9E,kBFpB8EA,EAAAA,OAAAA,MAAAA;AAARwB,UEsBlE,kBAAA,CFtBkEA;EACflB,KAAAA,EAAAA,MAAAA;EAAgCX,QAAAA,CAAAA,EAAAA,MAAAA;EAAR6B,IAAAA,CAAAA,EAAAA,OAAAA,GAAAA,QAAAA;;AACnC9B,UE0BxC,yBAAA,CF1BwCA;EAAR8B,KAAAA,EE2BxC,MF3BwCA,CAAAA,MAAAA,EE2BzB,kBF3ByBA,CAAAA;;AACgB/B,KE6BrD,WAAA,GF7BqDA;EAAR+B,UE8B7C,kBAAA,CF9B6CA,EE8BxB,oBF9BwBA;EACtBlB,SAAAA,IAAAA,CAAAA,EAAAA,CAAAA,OAAAA,EE+BtB,cF/BsBA,EAAAA,OAAAA,CAAAA,EEgCrB,WFhCqBA,EAAAA,GEiC5B,OFjC4BA,CEiCpB,cFjCoBA,GEiCH,oBFjCGA,CAAAA;EAAgCf,SAAAA,UAAAA,CAAAA,EAAAA,CAAAA,SAAAA,EAAAA,MAAAA,EAAAA,GEoC5D,OFpC4DA,CEoCpD,cFpCoDA,GEoCnC,oBFpCmCA,GAAAA,IAAAA,CAAAA;EAARiC,SAAAA,aAAAA,CAAAA,EAAAA,GAAAA,GEqC1B,OFrC0BA,CEqClB,aFrCkBA,EAAAA,CAAAA;EAAO,SAAA,OAAA,CAAA,EEsC7C,MFtC6C,CAAA,MAAA,EAAA,MAAA,CAAA;EAEjDd,0BAAe,CAAA,EAAA,CAAA,MAAA,EEsCpB,yBFtCoB,EAAA,GEuCzB,OFvCyB,CAAA,IAAA,CAAA;CACMd;AAA8BC,UEyCnD,uBAAA,CFzCmDA;EAAR2B,IAAAA,CAAAA,OAAAA,EE0C5C,cF1C4CA,EAAAA,OAAAA,CAAAA,EE0ClB,WF1CkBA,CAAAA,EE0CJ,OF1CIA,CE0CI,cF1CJA,CAAAA;EAAO,UAAA,CAAA,SAAA,EAAA,MAAA,CAAA,EE2ClC,OF3CkC,CE2C1B,cF3C0B,GAAA,IAAA,CAAA;EAElDG,aAAAA,EAAAA,EE0CE,OF1Ca,CE0CL,aF1CK,EAAA,CAAA;AAKhC;;AAEkCA,iBE6ClB,6BAAA,CF7CkBA,OAAAA,EE8CvB,WF9CuBA,CAAAA,EE+C/B,uBF/C+BA;;;;;AA+BlC;AAKA;AAUA;AAKA;AASA;AAKA;;;;;;;;;;;;;;;;;;AAaA;;;;;;AAKA;;;;;AAEwDvC,uBEoClC,gBAAA,SAAyB,SAAA,CFpCSA;EAARoC,CAAAA,OAAAA;EAAO,UAAA,WAAA,CAAA,OAAA,EEyCtB,WFzCsB,EAAA,GAAA,CAAA,EEyCH,gBFzCG;EAO3Cc,UAAAA,WAAU,CAAA,aEwCe,wBFxCqB,CAAA,CAAA,SAAA,EAAA,MAAA,EAAA,IAAA,EE0ChD,IF1CgD,GE0CzC,6BF1CyC,CE0CX,IF1CW,CAAA,CAAA,EE2CrD,OF3CqD,CE2C7C,sBF3C6C,CE2CtB,8BF3CsB,CE2CS,IF3CT,CAAA,CAAA,CAAA;EACzCC;EAWAC,UAAAA,IAAAA,CAAAA,OAAe,EEkDnB,cFlDmB,EAAA,OAAA,CAAA,EEmDlB,WFnDkB,CAAA,EEoD3B,OFpD2B,CEoDnB,cFpDmB,CAAA;EAiBfC;EAQAE,cAAAA,OAAiB,CAAA,CAAA,EEgCP,MFhCO,CAAA,MAAA,EAAA,MAAA,CAAA;EAItBC,cAAAA,mBAAeD,CAAAA,CAAAA,EAAAA,CAAAA,CAAAA,MAAAA,EEiCX,yBFjC4B,EAAA,GEiCE,OFjCF,CAAA,IAAA,CAAA,CAAA,GAAA,SAAA;EAC3BE;AAMjB;AAOA;AACA;AAOA;AAKA;EACiBM,UAAAA,WAAAA,CAAAA,UAAqB,MAC7BD,EAAAA,MAAAA,CAAAA,CAAAA,SAAiB,EAAA,MAAA,EAAA,IAAA,EAAA,CAAA,GAAA,EEoBV,CFpBU,EAAA,GEoBJ,OFpBI,CEoBI,MFpBJ,CAAA,CAAA,EEqBrB,OFrBqB,CEqBb,MFrBa,CAAA;EAGdE;EACKC,UAAAA,aAAmB,CAAA,CAAA,EE0CD,OF1CC,CE0CO,eF1CP,CAAA;EAQnBvC;;;;EAIUsC,UAAAA,WAAAA,CAAAA,CAAAA,EEyCM,OFzCNA,CAAAA,IAAAA,CAAAA"}
+{"version":3,"file":"index-Bs4bqXDR.d.ts","names":["BackupCompressionOptions","ReadFileRequest","WriteFileRequest","DeleteFileRequest","RenameFileRequest","MoveFileRequest","MkdirRequest","FileExistsRequest","ListFilesRequest","CreateBackupRequest","UploadPart","UploadPartsRequest","UploadedPart","UploadPartsResponse","CreateBackupResponse","RestoreBackupRequest","RestoreBackupResponse","SandboxProcessesAPI","SandboxTerminalsAPI","CreateBackupResponse","RestoreBackupResponse","UploadedPart","UploadPartsResponse","BackupCompressionOptions","CheckChangesRequest","CheckChangesResult","DeleteFileResult","FileEncoding","FileExistsResult","ListFilesOptions","ListFilesResult","MkdirResult","MoveFileResult","PortWatchRPCOptions","PortWatchSubscriptionAPI","ReadFileResult","ReadFileStreamResult","RenameFileResult","WatchRequest","WriteFileResult","S3FSOptionValue","MountCommandResult","MountS3FSRequest","Record","RemoveMountDirectoryRequest","SandboxAPI","SandboxFilesAPI","SandboxPortsAPI","SandboxUtilsAPI","SandboxBackupAPI","SandboxWatchAPI","SandboxTunnelsAPI","SandboxMountsAPI","SandboxWorkspaceAPI","SandboxExtensionsAPI","ReadFileStreamOptions","ReadFileBinaryOptions","ReadFileOptions","Exclude","WriteFileOptions","MkdirOptions","Promise","Uint8Array","ReadableStream","RuntimeMetadata","CreateWorkspaceArchiveRequest","CreateWorkspaceArchiveResult","ExtractWorkspaceArchiveRequest","BackupUploadArchiveRequest","BackupDownloadArchiveRequest","Array","BackupPrepareRestoreRequest","BackupUploadPartsRequest","BackupCreateArchiveOptions","WatchSubscriptionAPI","TunnelInfo","QuickTunnelInfo","NamedTunnelInfo","TunnelOptions","TunnelRunMode","TunnelRunIdentity","TunnelRunRef","EnsureQuickTunnelRunRequest","EnsureNamedTunnelRunRequest","EnsureTunnelRunRequest","QuickTunnelRunSnapshot","NamedTunnelRunSnapshot","TunnelRunSnapshot","EnsureTunnelRunResult","StopTunnelRunRequest","StopTunnelRunResult","TunnelRunExitEvent","ExtensionPackage","ExtensionRegistration","ExtensionHealth","ExtensionConnectRequest","EXTENSION_TARBALL_REQUIRED","SandboxControlCallback"],"sources":["../../shared/dist/request-types.d.ts","../../shared/dist/rpc-types.d.ts","../src/processes/rpc-types.ts","../src/extensions/index.ts"],"sourcesContent":["import type { BackupCompressionOptions } from './types.js';\n/**\n * Request types for API calls to the container\n * Single source of truth for the contract between SDK clients and container handlers\n */\n/**\n * Request to read a file\n */\nexport interface ReadFileRequest {\n    path: string;\n    encoding?: string;\n}\n/**\n * Request to write a file\n */\nexport interface WriteFileRequest {\n    path: string;\n    content: string;\n    encoding?: string;\n}\n/**\n * Request to delete a file\n */\nexport interface DeleteFileRequest {\n    path: string;\n}\n/**\n * Request to rename a file\n */\nexport interface RenameFileRequest {\n    oldPath: string;\n    newPath: string;\n}\n/**\n * Request to move a file\n */\nexport interface MoveFileRequest {\n    sourcePath: string;\n    destinationPath: string;\n}\n/**\n * Request to create a directory\n */\nexport interface MkdirRequest {\n    path: string;\n    recursive?: boolean;\n}\n/**\n * Request to check if a file or directory exists\n */\nexport interface FileExistsRequest {\n    path: string;\n}\n/**\n * Request to list files in a directory\n */\nexport interface ListFilesRequest {\n    path: string;\n    options?: {\n        recursive?: boolean;\n        includeHidden?: boolean;\n    };\n}\n/**\n * Request to create a backup archive from a directory.\n * The container creates a squashfs archive at archivePath.\n * The DO then reads it and uploads to R2.\n */\nexport interface CreateBackupRequest {\n    /** Directory to back up */\n    dir: string;\n    /** Path where the container should write the archive */\n    archivePath: string;\n    /** Respect git ignore rules when the directory is inside a git repository */\n    gitignore?: boolean;\n    /** Glob patterns to exclude from the backup */\n    excludes?: string[];\n    compression?: BackupCompressionOptions;\n}\n/**\n * A single part to upload in a multipart upload.\n * The container reads the byte range from the local archive and PUTs it\n * to the presigned URL.\n */\nexport interface UploadPart {\n    partNumber: number;\n    /** Presigned PUT URL for this part */\n    url: string;\n    /** Byte offset within the archive file */\n    offset: number;\n    /** Number of bytes in this part */\n    size: number;\n}\n/**\n * Request to upload parts of a backup archive directly from the container to R2.\n * Used for parallel multipart upload of large archives.\n */\nexport interface UploadPartsRequest {\n    /** Path to the archive file in the container */\n    archivePath: string;\n    /** Parts to upload in parallel */\n    parts: UploadPart[];\n}\n/**\n * Result for a single uploaded part (ETag returned by R2).\n */\nexport interface UploadedPart {\n    partNumber: number;\n    etag: string;\n}\n/**\n * Response after the container has uploaded all parts.\n */\nexport interface UploadPartsResponse {\n    success: boolean;\n    parts: UploadedPart[];\n}\n/**\n * Response from the container after creating a backup archive\n */\nexport interface CreateBackupResponse {\n    success: boolean;\n    /** Size of the archive in bytes */\n    sizeBytes: number;\n    /** Path to the archive file in the container */\n    archivePath: string;\n}\n/**\n * Request to restore a backup from an archive file.\n * The DO writes the archive to archivePath first, then tells the container to extract it.\n */\nexport interface RestoreBackupRequest {\n    /** Directory to restore into */\n    dir: string;\n    /** Path to the archive file in the container */\n    archivePath: string;\n}\n/**\n * Response from the container after restoring a backup\n */\nexport interface RestoreBackupResponse {\n    success: boolean;\n    /** Directory that was restored */\n    dir: string;\n}\n//# sourceMappingURL=request-types.d.ts.map","/**\n * Shared interface types for the container-control path.\n *\n * Defines the contract between the SDK control client and the container\n * control-plane API. The current wire implementation uses capnweb RPC.\n */\nimport type { SandboxProcessesAPI } from './process-types.js';\nimport type { SandboxTerminalsAPI } from './pty-types.js';\nimport type { CreateBackupResponse, RestoreBackupResponse, UploadedPart, UploadPartsResponse } from './request-types.js';\nimport type { BackupCompressionOptions, CheckChangesRequest, CheckChangesResult, DeleteFileResult, FileEncoding, FileExistsResult, ListFilesOptions, ListFilesResult, MkdirResult, MoveFileResult, PortWatchRPCOptions, PortWatchSubscriptionAPI, ReadFileResult, ReadFileStreamResult, RenameFileResult, WatchRequest, WriteFileResult } from './types.js';\nexport type S3FSOptionValue = string | boolean;\nexport interface MountCommandResult {\n    success: boolean;\n    exitCode: number;\n    stdout: string;\n    stderr: string;\n}\nexport interface MountS3FSRequest {\n    source: string;\n    mountPath: string;\n    options: Record<string, S3FSOptionValue>;\n}\nexport interface RemoveMountDirectoryRequest {\n    path: string;\n    onlyIfNotMountpoint: boolean;\n}\nexport interface SandboxAPI {\n    files: SandboxFilesAPI;\n    ports: SandboxPortsAPI;\n    utils: SandboxUtilsAPI;\n    backup: SandboxBackupAPI;\n    watch: SandboxWatchAPI;\n    tunnels: SandboxTunnelsAPI;\n    terminals: SandboxTerminalsAPI;\n    processes: SandboxProcessesAPI;\n    mounts: SandboxMountsAPI;\n    workspace: SandboxWorkspaceAPI;\n    extensions: SandboxExtensionsAPI;\n}\nexport type ReadFileStreamOptions = object;\nexport interface ReadFileBinaryOptions {\n    encoding: 'none';\n}\nexport interface ReadFileOptions {\n    encoding?: Exclude<FileEncoding, 'none'>;\n}\nexport interface WriteFileOptions {\n    encoding?: string;\n    permissions?: string;\n}\nexport interface MkdirOptions {\n    recursive?: boolean;\n}\nexport interface SandboxFilesAPI {\n    readFile(path: string, options: ReadFileBinaryOptions): Promise<ReadFileStreamResult>;\n    readFile(path: string, options?: ReadFileOptions): Promise<ReadFileResult>;\n    readFileStream(path: string, options?: ReadFileStreamOptions): Promise<ReadableStream<Uint8Array>>;\n    writeFile(path: string, content: string, options?: WriteFileOptions): Promise<WriteFileResult>;\n    writeFileStream(path: string, stream: ReadableStream<Uint8Array>, options?: Record<string, never>): Promise<{\n        success: boolean;\n        path: string;\n        bytesWritten: number;\n        timestamp: string;\n    }>;\n    deleteFile(path: string, options?: Record<string, never>): Promise<DeleteFileResult>;\n    renameFile(oldPath: string, newPath: string, options?: Record<string, never>): Promise<RenameFileResult>;\n    moveFile(sourcePath: string, destinationPath: string, options?: Record<string, never>): Promise<MoveFileResult>;\n    mkdir(path: string, options?: MkdirOptions): Promise<MkdirResult>;\n    listFiles(path: string, options?: ListFilesOptions): Promise<ListFilesResult>;\n    exists(path: string, options?: Record<string, never>): Promise<FileExistsResult>;\n}\nexport interface SandboxPortsAPI {\n    openWatch(port: number, options?: PortWatchRPCOptions): Promise<PortWatchSubscriptionAPI>;\n}\nexport interface RuntimeMetadata {\n    runtimeIncarnationID: string;\n    sandboxVersion: string;\n    controlProtocolVersion: 1;\n}\nexport interface SandboxUtilsAPI {\n    ping(): Promise<string>;\n    getRuntimeMetadata(): Promise<RuntimeMetadata>;\n    activateControlSession(expectedRuntimeIncarnationID: string): Promise<RuntimeMetadata>;\n}\nexport interface CreateWorkspaceArchiveRequest {\n    root: string;\n    excludes: readonly string[];\n}\nexport interface CreateWorkspaceArchiveResult {\n    archivePath: string;\n}\nexport interface ExtractWorkspaceArchiveRequest {\n    root: string;\n    archivePath: string;\n}\nexport interface SandboxWorkspaceAPI {\n    createArchive(request: CreateWorkspaceArchiveRequest): Promise<CreateWorkspaceArchiveResult>;\n    extractArchive(request: ExtractWorkspaceArchiveRequest): Promise<void>;\n    cleanupArchive(archivePath: string): Promise<void>;\n}\nexport interface SandboxMountsAPI {\n    pathExists(path: string): Promise<boolean>;\n    ensureDirectory(path: string): Promise<void>;\n    chmodOwnerOnly(path: string): Promise<void>;\n    deleteFile(path: string): Promise<void>;\n    mountS3FS(request: MountS3FSRequest): Promise<MountCommandResult>;\n    mountS3FSAndVerify(request: MountS3FSRequest): Promise<MountCommandResult>;\n    isMountpoint(path: string): Promise<boolean>;\n    unmountFuse(path: string): Promise<MountCommandResult>;\n    unmountFuseIfMounted(path: string): Promise<void>;\n    removeMountDirectory(request: RemoveMountDirectoryRequest): Promise<MountCommandResult>;\n}\nexport interface BackupUploadArchiveRequest {\n    archivePath: string;\n    url: string;\n    timeoutMs: number;\n}\nexport interface BackupDownloadArchiveRequest {\n    archivePath: string;\n    expectedSize: number;\n    parts: Array<{\n        url: string;\n        offset: number;\n        range?: string;\n    }>;\n    timeoutMs: number;\n}\nexport interface BackupPrepareRestoreRequest {\n    dir: string;\n    backupId: string;\n    archivePath: string;\n}\nexport interface BackupUploadPartsRequest {\n    archivePath: string;\n    parts: Array<{\n        partNumber: number;\n        url: string;\n        offset: number;\n        size: number;\n    }>;\n}\nexport interface BackupCreateArchiveOptions {\n    excludes?: string[];\n    gitignore?: boolean;\n    compression?: BackupCompressionOptions;\n}\nexport interface SandboxBackupAPI {\n    createArchive(dir: string, archivePath: string, options?: BackupCreateArchiveOptions): Promise<CreateBackupResponse>;\n    restoreArchive(dir: string, archivePath: string): Promise<RestoreBackupResponse>;\n    uploadArchive(request: BackupUploadArchiveRequest): Promise<void>;\n    uploadParts(request: BackupUploadPartsRequest): Promise<UploadPartsResponse>;\n    prepareRestore(request: BackupPrepareRestoreRequest): Promise<{\n        existingSize: number;\n    }>;\n    downloadArchive(request: BackupDownloadArchiveRequest): Promise<void>;\n    extractArchive(dir: string, archivePath: string): Promise<void>;\n    cleanupArchive(archivePath: string): Promise<void>;\n}\nexport type { UploadedPart, UploadPartsResponse };\nexport interface WatchSubscriptionAPI {\n    stream(): Promise<ReadableStream<Uint8Array>>;\n    cancel(): Promise<void>;\n    [Symbol.dispose](): void;\n}\nexport interface SandboxWatchAPI {\n    watch(request: WatchRequest): Promise<WatchSubscriptionAPI>;\n    checkChanges(request: CheckChangesRequest): Promise<CheckChangesResult>;\n}\n/**\n * Public-facing tunnel record. Discriminated on the presence of `name`:\n * quick tunnels (`*.trycloudflare.com`) omit it, named tunnels carry the\n * label that was passed to `get(port, { name })`.\n */\nexport type TunnelInfo = QuickTunnelInfo | NamedTunnelInfo;\nexport interface QuickTunnelInfo {\n    id: string;\n    port: number;\n    /** `https://<random>.trycloudflare.com`. */\n    url: string;\n    /** Hostname portion of `url`. */\n    hostname: string;\n    createdAt: string;\n    /** Absent on quick tunnels; narrows the union. */\n    name?: never;\n}\nexport interface NamedTunnelInfo {\n    /** Cloudflare tunnel UUID (8-4-4-4-12). */\n    id: string;\n    port: number;\n    /** `https://<hostname>`. */\n    url: string;\n    /** Full hostname bound to the tunnel (without scheme). */\n    hostname: string;\n    createdAt: string;\n    /** Label originally passed via `TunnelOptions.name`. */\n    name: string;\n}\n/**\n * Options accepted by `sandbox.tunnels.get(port, options)`. Omitting\n * `name` (or omitting the options object) selects the zero-config quick\n * tunnel; setting `name` selects the named-tunnel flow.\n */\nexport interface TunnelOptions {\n    /**\n     * Single DNS label under the configured zone. The full hostname is\n     * `<name>.<zone-name>`. See `validateTunnelName` for the format rules.\n     */\n    name?: string;\n}\nexport type TunnelRunMode = 'quick' | 'named';\nexport interface TunnelRunIdentity {\n    tunnelId: string;\n    runId: string;\n}\nexport type TunnelRunRef = TunnelRunIdentity;\nexport interface EnsureQuickTunnelRunRequest extends TunnelRunIdentity {\n    mode: 'quick';\n    port: number;\n    readyTimeoutMs?: number;\n    stopGraceMs?: number;\n}\nexport interface EnsureNamedTunnelRunRequest extends TunnelRunIdentity {\n    mode: 'named';\n    port: number;\n    cloudflaredToken: string;\n    readyTimeoutMs?: number;\n    stopGraceMs?: number;\n}\nexport type EnsureTunnelRunRequest = EnsureQuickTunnelRunRequest | EnsureNamedTunnelRunRequest;\nexport interface QuickTunnelRunSnapshot extends TunnelRunIdentity {\n    mode: 'quick';\n    port: number;\n    url: string;\n    hostname: string;\n    startedAt: string;\n}\nexport interface NamedTunnelRunSnapshot extends TunnelRunIdentity {\n    mode: 'named';\n    port: number;\n    startedAt: string;\n}\nexport type TunnelRunSnapshot = QuickTunnelRunSnapshot | NamedTunnelRunSnapshot;\nexport interface EnsureTunnelRunResult {\n    run: TunnelRunSnapshot;\n    started: boolean;\n}\nexport type StopTunnelRunRequest = TunnelRunRef;\nexport interface StopTunnelRunResult {\n    stopped: boolean;\n}\nexport interface TunnelRunExitEvent extends TunnelRunIdentity {\n    mode: TunnelRunMode;\n    port: number;\n    exitCode: number | null;\n}\nexport interface SandboxTunnelsAPI {\n    /** Ensure a runtime-local cloudflared process for a DO-issued run id. */\n    ensureTunnelRun(request: EnsureTunnelRunRequest): Promise<EnsureTunnelRunResult>;\n    /** Stop the matching runtime-local cloudflared process. */\n    stopTunnelRun(request: StopTunnelRunRequest): Promise<StopTunnelRunResult>;\n}\n/**\n * Author-facing description of a sidecar extension. An extension is an\n * npm-style package: an `.tgz` whose embedded `package.json` declares the\n * sidecar entrypoint (via `bin`) and any extension metadata (under the\n * `sandboxExtension` key).\n *\n * The SDK ships the tarball bytes; the container hashes them, provisions a\n * dedicated directory keyed by content hash, derives identity from the\n * embedded `package.json`, installs the package with `bun add`, and spawns\n * the declared bin under Bun.\n *\n * `ExtensionPackage` carries tarball bytes produced by an extension build.\n * The SDK sends those bytes only when the container has not provisioned the\n * package hash yet.\n */\nexport interface ExtensionPackage {\n    /** Raw `.tgz` bytes. */\n    tarball: Uint8Array;\n    /**\n     * Bin entry to run when the embedded `package.json` declares more than one.\n     * Defaults to the value of `sandboxExtension.bin` in `package.json`, then\n     * to the single bin entry if there is exactly one.\n     */\n    bin?: string;\n    /**\n     * Max time to wait for the sidecar to accept a capnweb connection on its\n     * unix socket. Falls back to `sandboxExtension.readinessTimeoutMs` in\n     * `package.json`, then to a host default.\n     */\n    readinessTimeoutMs?: number;\n    /**\n     * Run lifecycle scripts during `bun add`. Defaults to false — provisioning\n     * happens before the sidecar is supervised, so install-time side effects\n     * are deliberately opt-in.\n     */\n    allowInstallScripts?: boolean;\n}\n/**\n * Container-derived identity for a provisioned extension package. Not\n * authored — produced by the host after extracting the embedded\n * `package.json` from a tarball.\n */\nexport interface ExtensionRegistration {\n    /** Slugified package name (e.g. `@acme/foo` → `acme-foo`). */\n    id: string;\n    packageName: string;\n    version: string;\n    /** Hex sha256 of the tarball bytes. */\n    packageHash: string;\n    /** Resolved bin entry the host spawns. */\n    bin: string;\n    readinessTimeoutMs: number;\n}\n/** Health snapshot for a provisioned extension. */\nexport interface ExtensionHealth {\n    packageHash: string;\n    id: string;\n    version: string;\n    /** Tarball is on disk and the package.json has been read. */\n    provisioned: boolean;\n    /** Sidecar process is currently running. */\n    running: boolean;\n    pid: number | null;\n    /** Whether a `__ping__` round-tripped over capnweb. */\n    responsive: boolean;\n}\n/**\n * Connect request payload. The SDK hashes the tarball locally and first sends\n * only the hash. If the current host process has not provisioned that hash,\n * it responds with an `ExtensionTarballRequired` error and the SDK retries\n * with `tarball` populated.\n */\nexport interface ExtensionConnectRequest {\n    packageHash: string;\n    /** Only sent when the host has not seen this hash yet. */\n    tarball?: Uint8Array;\n    bin?: string;\n    readinessTimeoutMs?: number;\n    allowInstallScripts?: boolean;\n}\n/**\n * Error name thrown by the host's `connect` when it has not yet provisioned\n * the requested hash and the request did not carry tarball bytes. The SDK\n * recognises this name via `Error.name` and retries the connect with the\n * bytes attached. Kept as a string constant so it survives capnweb\n * cross-realm error reconstruction.\n */\nexport declare const EXTENSION_TARBALL_REQUIRED = \"ExtensionTarballRequired\";\n/**\n * Control surface for container sidecar extensions.\n *\n * `connect` is the only entry point: it provisions on first use, supervises\n * lazily, and returns the sidecar's capnweb remote main as a stub. Calls on\n * the stub are proxied through the container's capnweb session to the\n * sidecar's capnweb session — callback parameters (including streaming\n * handlers) round-trip across both hops.\n */\nexport interface SandboxExtensionsAPI {\n    /**\n     * Provision the package (if new) and return the sidecar's typed remote\n     * main. The result is a capnweb stub whose methods correspond to the\n     * sidecar's `RpcTarget` surface.\n     */\n    connect(req: ExtensionConnectRequest): Promise<unknown>;\n    /** Health snapshot, probing the sidecar with a `__ping__` when running. */\n    health(packageHash: string): Promise<ExtensionHealth>;\n    /** Stop a sidecar and release its capnweb session. */\n    stop(packageHash: string): Promise<void>;\n}\n/**\n * RPC surface the Sandbox DO exposes to the container over the existing\n * capnweb session. The container reaches it via\n * `session.getRemoteMain<SandboxControlCallback>()` and invokes methods\n * to push control-plane events (today: tunnel exits) back to the DO.\n *\n * One stable target per sandbox; not per-tunnel. Reusable seam for\n * future container→DO events.\n */\nexport interface SandboxControlCallback {\n    /** Called by the container when a runtime-local tunnel run exits. */\n    onTunnelRunExit(event: TunnelRunExitEvent): Promise<void>;\n}\n//# sourceMappingURL=rpc-types.d.ts.map"],"mappings":";;;;;;;AC6KA;AACA;AAWiB6E,UD/EAjE,YAAAA,CC+Ee;EAiBfkE,UAAAA,EAAAA,MAAa;EAQbE,IAAAA,EAAAA,MAAAA;AAIjB;AACA;AAMA;AAOA;AACiBK,UDpHAxE,mBAAAA,CCoHsB;EAOtByE,OAAAA,EAAAA,OAAAA;EAKLC,KAAAA,ED9HD3E,YC8HC2E,EAAiB;AAC7B;AAIA;AACA;AAQA;AAE6BH,UDzIZtE,oBAAAA,CCyIYsE;EAAiCI,OAAAA,EAAAA,OAAAA;EAAR3B;EAE3B4B,SAAAA,EAAAA,MAAAA;EAA+BC;EAAR7B,WAAAA,EAAAA,MAAAA;;;;;ACjPjC,UF0HA7C,qBAAAA,CE1H0B;EACA,OAAA,EAAA,OAAA;EAAzB;EAAR,GAAA,EAAA,MAAA;;;;;AD8CiFqB,KA1B/EkB,qBAAAA,GA0B+ElB,MAAAA;AAARwB,UAzBlEL,qBAAAA,CAyBkEK;EACflB,QAAAA,EAAAA,MAAAA;;AAAwBkB,UAvB3EJ,eAAAA,CAuB2EI;EAC1DD,QAAAA,CAAAA,EAvBnBF,OAuBmBE,CAvBXjC,YAuBWiC,EAAAA,MAAAA,CAAAA;;AAAeC,UArBhCF,gBAAAA,CAqBgCE;EACXhC,QAAAA,CAAAA,EAAAA,MAAAA;EAA2BC,WAAAA,CAAAA,EAAAA,MAAAA;;AAC9Ba,UAnBlBiB,YAAAA,CAmBkBjB;EAAgCf,SAAAA,CAAAA,EAAAA,OAAAA;;AAAD,UAhBjDkB,eAAAA,CAgBiD;EAEjDC,QAAAA,CAAAA,IAAAA,EAAAA,MAAe,EAAA,OAAA,EAjBIS,qBAiBJ,CAAA,EAjB4BK,OAiB5B,CAjBoCzB,oBAiBpC,CAAA;EACMH,QAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAjBDwB,eAiBCxB,CAAAA,EAjBiB4B,OAiBjB5B,CAjByBE,cAiBzBF,CAAAA;EAA8BC,cAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAhBzBqB,qBAgByBrB,CAAAA,EAhBD2B,OAgBC3B,CAhBO6B,cAgBP7B,CAhBsB4B,UAgBtB5B,CAAAA,CAAAA;EAAR2B,SAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAfLF,gBAeKE,CAAAA,EAfcA,OAedA,CAfsBtB,eAetBsB,CAAAA;EAAO,eAAA,CAAA,IAAA,EAAA,MAAA,EAAA,MAAA,EAdzBE,cAcyB,CAdVD,UAcU,CAAA,EAAA,OAAA,CAAA,EAdanB,MAcb,CAAA,MAAA,EAAA,KAAA,CAAA,CAAA,EAdqCkB,OAcrC,CAAA;IAElDG,OAAAA,EAAAA,OAAe;IAKfhB,IAAAA,EAAAA,MAAAA;IACLa,YAAAA,EAAAA,MAAAA;IACsBG,SAAAA,EAAAA,MAAAA;EAARH,CAAAA,CAAAA;EACgDG,UAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAlBnCrB,MAkBmCqB,CAAAA,MAAAA,EAAAA,KAAAA,CAAAA,CAAAA,EAlBXH,OAkBWG,CAlBHtC,gBAkBGsC,CAAAA;EAARH,UAAAA,CAAAA,OAAAA,EAAAA,MAAAA,EAAAA,OAAAA,EAAAA,MAAAA,EAAAA,OAAAA,CAAAA,EAjBPlB,MAiBOkB,CAAAA,MAAAA,EAAAA,KAAAA,CAAAA,CAAAA,EAjBiBA,OAiBjBA,CAjByBxB,gBAiBzBwB,CAAAA;EAAO,QAAA,CAAA,UAAA,EAAA,MAAA,EAAA,eAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EAhBLlB,MAgBK,CAAA,MAAA,EAAA,KAAA,CAAA,CAAA,EAhBmBkB,OAgBnB,CAhB2B7B,cAgB3B,CAAA;EA8BxDoC,KAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAA0B,CAA1BA,EA7CiBR,YA6CS,CAAA,EA7CMC,OA6CN,CA7Cc9B,WA6Cd,CAAA;EAK1BsC,SAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAGD,CAH6B,EAjDPxC,gBAoDtB,CAAA,EApDyCgC,OAoDzC,CApDiD/B,eAoDjD,CAAA;EAOCyC,MAAAA,CAAAA,IAAAA,EAAAA,MAAAA,EAAAA,OAA2B,CAA3BA,EA1DkB5B,MA0DS,CAAA,MAAA,EAAA,KAAA,CAAA,CAAA,EA1DekB,OA0Df,CA1DuBjC,gBA0DvB,CAAA;AAK5C;AASiB6C,UAtEA1B,eAAAA,CAsE0B;EAK1BE,SAAAA,CAAAA,IAAAA,EAAAA,MAAgB,EAAA,OAAA,CAAA,EA1EKhB,mBA0EL,CAAA,EA1E2B4B,OA0E3B,CA1EmC3B,wBA0EnC,CAAA;;AACkEf,UAzElF6C,eAAAA,CAyEkF7C;EAAR0C,oBAAAA,EAAAA,MAAAA;EAC7BzC,cAAAA,EAAAA,MAAAA;EAARyC,sBAAAA,EAAAA,CAAAA;;AACEA,UAtEvCb,eAAAA,CAsEuCa;EAC/BW,IAAAA,EAAAA,EAtEbX,OAsEaW,CAAAA,MAAAA,CAAAA;EAAmClD,kBAAAA,EAAAA,EArElCuC,OAqEkCvC,CArE1B0C,eAqE0B1C,CAAAA;EAARuC,sBAAAA,CAAAA,4BAAAA,EAAAA,MAAAA,CAAAA,EApEcA,OAoEdA,CApEsBG,eAoEtBH,CAAAA;;AA8ExCuB,UApHKhB,0BAAAA,CAoHoBc;EACpBG,WAAAA,EAAAA,MAAAA;EAOAC,GAAAA,EAAAA,MAAAA;EAKLC,SAAAA,EAAAA,MAAAA;AACZ;AAIYE,UAjIKpB,4BAAAA,CAiIkBY;EAClBS,WAAAA,EAAAA,MAAAA;EAQAvC,YAAAA,EAAAA,MAAiB;EAELiC,KAAAA,EAzIlBd,KAyIkBc,CAAAA;IAAiCI,GAAAA,EAAAA,MAAAA;IAAR3B,MAAAA,EAAAA,MAAAA;IAE3B4B,KAAAA,CAAAA,EAAAA,MAAAA;EAA+BC,CAAAA,CAAAA;EAAR7B,SAAAA,EAAAA,MAAAA;;AAiBjC+B,UArJArB,2BAAAA,CAuJJT;EAqCIgC,GAAAA,EAAAA,MAAAA;EAkBAC,QAAAA,EAAAA,MAAAA;EAyBAzC,WAAAA,EAAAA,MAAAA;;AAM0BO,UAxO1BW,wBAAAA,CAwO0BX;EAEFiC,WAAAA,EAAAA,MAAAA;EAARjC,KAAAA,EAxOtBS,KAwOsBT,CAAAA;IAEFA,UAAAA,EAAAA,MAAAA;IAAO,GAAA,EAAA,MAAA;;;;AC9VtC;AAC2C,UD0H1BY,0BAAAA,CC1H0B;EAAzB,QAAA,CAAA,EAAA,MAAA,EAAA;EAAR,SAAA,CAAA,EAAA,OAAA;EACE,WAAA,CAAA,ED4HMlD,wBC5HN;;AAIK,UD0HA0B,gBAAAA,CC1HoB;EACjB,aAAA,CAAA,GAAA,EAAA,MAAA,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,ED0H0CwB,0BC1H1C,CAAA,ED0HuEZ,OC1HvE,CD0H+E1C,oBC1H/E,CAAA;EAAR,cAAA,CAAA,GAAA,EAAA,MAAA,EAAA,WAAA,EAAA,MAAA,CAAA,ED2H0C0C,OC3H1C,CD2HkDzC,qBC3HlD,CAAA;EAEE,aAAA,CAAA,OAAA,ED0HagD,0BC1Hb,CAAA,ED0H0CP,OC1H1C,CAAA,IAAA,CAAA;EAC0B,WAAA,CAAA,OAAA,ED0HfW,wBC1He,CAAA,ED0HYX,OC1HZ,CD0HoBvC,mBC1HpB,CAAA;EAA3B,cAAA,CAAA,OAAA,ED2HeiD,2BC3Hf,CAAA,ED2H6CV,OC3H7C,CAAA;IAAR,YAAA,EAAA,MAAA;EAGS,CAAA,CAAA;EAC0B,eAAA,CAAA,OAAA,ED0HXQ,4BC1HW,CAAA,ED0HoBR,OC1HpB,CAAA,IAAA,CAAA;EAA3B,cAAA,CAAA,GAAA,EAAA,MAAA,EAAA,WAAA,EAAA,MAAA,CAAA,ED2HyCA,OC3HzC,CAAA,IAAA,CAAA;EAAR,cAAA,CAAA,WAAA,EAAA,MAAA,CAAA,ED4HoCA,OC5HpC,CAAA,IAAA,CAAA;;AAIY,UD2HAa,oBAAAA,CC3HoB;YD4HvBb,QAAQE,eAAeD;YACvBD;;AEpHd;AACkB,UFsHDX,eAAAA,CEtHC;EACA,KAAA,CAAA,OAAA,EFsHCZ,YEtHD,CAAA,EFsHgBuB,OEtHhB,CFsHwBa,oBEtHxB,CAAA;EACC,YAAA,CAAA,OAAA,EFsHOlD,mBEtHP,CAAA,EFsH6BqC,OEtH7B,CFsHqCpC,kBEtHrC,CAAA;;;;;;;AAQd,KFqHOkD,UAAAA,GAAaC,eErHE,GFqHgBC,eEpHzC;AAEU,UFmHKD,eAAAA,CEnHmB;EAI/B,EAAA,EAAA,MAAA;EAA4B,IAAA,EAAA,MAAA;EAC7B;EACA,GAAA,EAAA,MAAA;EAEA;EAAC,QAAA,EAAA,MAAA;EAEO,SAAA,EAAA,MAAA;EACG;EACQ,IAAA,CAAA,EAAA,KAAA;;AAAnB,UFkHaC,eAAAA,CElHb;EAAO;EAEN,EAAA,EAAA,MAAA;EAA2C,IAAA,EAAA,MAAA;EACf;EAA/B,GAAA,EAAA,MAAA;EACI;EACA,QAAA,EAAA,MAAA;EAAsB,SAAA,EAAA,MAAA;EAIhB;EAAqC,IAAA,EAAA,MAAA;;;;;;;AAGrC,UFuHKC,aAAAA,CEvHL;EAEC;AAEb;AAMA;AAIA;EACiC,IAAA,CAAA,EAAA,MAAA;;AAGnB,UF6GGE,iBAAAA,CE7GH;EACC,QAAA,EAAA,MAAA;EAAiB,KAAA,EAAA,MAAA;;AAGjB,KF6GHC,YAAAA,GAAeD,iBE7GZ;AAAiB,UF8GfE,2BAAAA,SAAoCF,iBE9GrB,CAAA;EAAzB,IAAA,EAAA,OAAA;EACkC,IAAA,EAAA,MAAA;EAAR,cAAA,CAAA,EAAA,MAAA;EACZ,WAAA,CAAA,EAAA,MAAA;;AAGd,UF+GUG,2BAAAA,SAAoCH,iBE/G9C,CAAA;EAAO,IAAA,EAAA,OAAA;EAGG,IAAA,EAAA,MAAA;EACD,gBAAA,EAAA,MAAA;EAA0B,cAAA,CAAA,EAAA,MAAA;EAAsB,WAAA,CAAA,EAAA,MAAA;;AACvB,KFiH7BI,sBAAAA,GAAyBF,2BEjHI,GFiH0BC,2BEjH1B;AAAR,UFkHhBE,sBAAAA,SAA+BL,iBElHf,CAAA;EACN,IAAA,EAAA,OAAA;EAAR,IAAA,EAAA,MAAA;EAAO,GAAA,EAAA,MAAA;EAUV,QAAA,EAAA,MAAA;EA4EM,SAAA,EAAA,MAAA;;AAK8B,UF6BnCM,sBAAAA,SAA+BN,iBE7BI,CAAA;EAMf,IAAA,EAAA,OAAA;EAE3B,IAAA,EAAA,MAAA;EAAqC,SAAA,EAAA,MAAA;;AACoB,KFyBvDO,iBAAAA,GAAoBF,sBEzBmC,GFyBVC,sBEzBU;AAA/B,UF0BnBE,qBAAAA,CE1BmB;EAAvB,GAAA,EF2BJD,iBE3BI;EAAR,OAAA,EAAA,OAAA;;AAoBS,KFUFE,oBAAAA,GAAuBR,YEVrB;AACD,UFUIS,mBAAAA,CEVJ;EAAR,OAAA,EAAA,OAAA;;AA2BQ,UFTIvC,iBAAAA,CESJ;EAAR;EAyBsC,eAAA,CAAA,OAAA,EFhCdiC,sBEgCc,CAAA,EFhCWvB,OEgCX,CFhCmB2B,qBEgCnB,CAAA;EAAR;EAWF,aAAA,CAAA,OAAA,EFzCNC,oBEyCM,CAAA,EFzCiB5B,OEyCjB,CFzCyB6B,mBEyCzB,CAAA;;;;;;;;;;;;;;;;;UFxBhBE,gBAAAA;;WAEJ9B;;;;;;;;;;;;;;;;;;;;;UAqCIgC,eAAAA;;;;;;;;;;;;;;;;;;UAkBAC,uBAAAA;;;YAGHjC;;;;;;;;;;;;;;UAsBGR,oBAAAA;;;;;;eAMAyC,0BAA0BlC;;+BAEVA,QAAQiC;;6BAEVjC;;;;ADpOd7C,UE1HA,0BF0HqB,CAAA,CAAA,CAAA,CAAA;UEzH5B,QAAQ,yBAAyB;YAC/B;;ADmBZ;AACiBwC,UChBA,oBAAA,CDgBqB;EAGrBC,MAAAA,EAAAA,EClBL,ODkBKA,CClBG,aDmBG9B,CAAAA;EAENgC,QAAAA,CAAAA,OAAgB,CAAhBA,ECnBH,qBDmBmB,CAAA,EClB5B,ODkB4B,CClBpB,0BDkBoB,CClBO,eDkBP,CAAA,CAAA;EAIhBC,aAAAA,CAAAA,IAAY,EAAA,MAAA,EAAA,OAAA,CAAA,ECnBf,mBDmBe,CAAA,EClBxB,ODkBwB,CClBhB,0BDkBgB,CClBW,cDkBX,CAAA,CAAA;EAGZd,IAAAA,CAAAA,MAAAA,EAAAA,MAAe,CAAA,ECpBR,ODoBQ,CAAA,IAAA,CAAA;;AACoCV,UClBnD,oBAAA,CDkBmDA;EAARyB,EAAAA,EAAAA,MAAAA;EACvBJ,GAAAA,EAAAA,MAAAA;EAA0BtB,UAAAA,EChBjD,oBDgBiDA;;;;AAAR0B,KEV3C,uBAAA,GFU2CA;EACZN,SAAAA,KAAAA,EEVzB,eFUyBA;EAA+CO,SAAAA,KAAAA,EETxE,eFSwEA;EAAfC,SAAAA,MAAAA,EERxD,gBFQwDA;EAARF,SAAAA,KAAAA,EEPjD,eFOiDA;EACZF,SAAAA,OAAAA,EEPnC,iBFOmCA;EAA2BpB,SAAAA,SAAAA,EEN5D,mBFM4DA;EAARsB,SAAAA,UAAAA,EELnD,oBFKmDA;EACjBC,SAAAA,KAAAA,EELvC,eFKuCA;CAAfC;KEFrC,sBAAA,GACH,uBFC8EpB,CAAAA,MEDhD,uBFCgDA,CAAAA;AAAwBkB,KEC5F,wBAAA,GFD4FA,CAAAA,OAAAA,EEE7F,uBFF6FA,EAAAA,GEGnG,OFHmGA,CAAAA,OAAAA,CAAAA;KEKnG,sBFCkClB,CAAAA,CAAAA,CAAAA,GEDN,CFCMA,SEAnC,uBFAmCA,GECnC,sBFDmCA,GAAAA,KAAAA,GEGnC,CFHmCA;AAAgCjB,KEK3D,8BFL2DA,CAAAA,aEMxD,wBFNwDA,CAAAA,GEOnE,OFPmEA,CEO3D,UFP2DA,CEOhD,IFPgDA,CAAAA,CAAAA;KESlE,6BFT0DmC,CAAAA,aESf,wBFTeA,CAAAA,GEU7D,8BFV6DA,CEU9B,IFV8BA,CAAAA,SEWzD,uBFXyDA,GEYzD,sBFZyDA,GAAAA,KAAAA,GAAAA,OAAAA;AACJlB,KEe/C,oBAAA,GFf+CA,CAAAA,aEeV,wBFfUA,CAAAA,CAAAA,SAAAA,EAAAA,MAAAA,EAAAA,IAAAA,EEiBnD,IFjBmDA,GEiB5C,6BFjB4CA,CEiBd,IFjBcA,CAAAA,EAAAA,GEkBtD,OFlBsDA,CEkB9C,8BFlB8CA,CEkBf,IFlBeA,CAAAA,CAAAA;AAAgCN,cEoB9E,kBFpB8EA,EAAAA,OAAAA,MAAAA;AAARwB,UEsBlE,kBAAA,CFtBkEA;EACflB,KAAAA,EAAAA,MAAAA;EAAgCX,QAAAA,CAAAA,EAAAA,MAAAA;EAAR6B,IAAAA,CAAAA,EAAAA,OAAAA,GAAAA,QAAAA;;AACnC9B,UE0BxC,yBAAA,CF1BwCA;EAAR8B,KAAAA,EE2BxC,MF3BwCA,CAAAA,MAAAA,EE2BzB,kBF3ByBA,CAAAA;;AACgB/B,KE6BrD,WAAA,GF7BqDA;EAAR+B,UE8B7C,kBAAA,CF9B6CA,EE8BxB,oBF9BwBA;EACtBlB,SAAAA,IAAAA,CAAAA,EAAAA,CAAAA,OAAAA,EE+BtB,cF/BsBA,EAAAA,OAAAA,CAAAA,EEgCrB,WFhCqBA,EAAAA,GEiC5B,OFjC4BA,CEiCpB,cFjCoBA,GEiCH,oBFjCGA,CAAAA;EAAgCf,SAAAA,UAAAA,CAAAA,EAAAA,CAAAA,SAAAA,EAAAA,MAAAA,EAAAA,GEoC5D,OFpC4DA,CEoCpD,cFpCoDA,GEoCnC,oBFpCmCA,GAAAA,IAAAA,CAAAA;EAARiC,SAAAA,aAAAA,CAAAA,EAAAA,GAAAA,GEqC1B,OFrC0BA,CEqClB,aFrCkBA,EAAAA,CAAAA;EAAO,SAAA,OAAA,CAAA,EEsC7C,MFtC6C,CAAA,MAAA,EAAA,MAAA,CAAA;EAEjDd,0BAAe,CAAA,EAAA,CAAA,MAAA,EEsCpB,yBFtCoB,EAAA,GEuCzB,OFvCyB,CAAA,IAAA,CAAA;CACMd;AAA8BC,UEyCnD,uBAAA,CFzCmDA;EAAR2B,IAAAA,CAAAA,OAAAA,EE0C5C,cF1C4CA,EAAAA,OAAAA,CAAAA,EE0ClB,WF1CkBA,CAAAA,EE0CJ,OF1CIA,CE0CI,cF1CJA,CAAAA;EAAO,UAAA,CAAA,SAAA,EAAA,MAAA,CAAA,EE2ClC,OF3CkC,CE2C1B,cF3C0B,GAAA,IAAA,CAAA;EAElDG,aAAAA,EAAAA,EE0CE,OF1Ca,CE0CL,aF1CK,EAAA,CAAA;AAKhC;;AAEkCA,iBE6ClB,6BAAA,CF7CkBA,OAAAA,EE8CvB,WF9CuBA,CAAAA,EE+C/B,uBF/C+BA;;;;;AA+BlC;AAKA;AAUA;AAKA;AASA;AAKA;;;;;;;;;;;;;;;;;;AAaA;;;;;;AAKA;;;;;AAEwDvC,uBEoClC,gBAAA,SAAyB,SAAA,CFpCSA;EAARoC,CAAAA,OAAAA;EAAO,UAAA,WAAA,CAAA,OAAA,EEyCtB,WFzCsB,EAAA,GAAA,CAAA,EEyCH,gBFzCG;EAO3Cc,UAAAA,WAAU,CAAA,aEwCe,wBFxCqB,CAAA,CAAA,SAAA,EAAA,MAAA,EAAA,IAAA,EE0ChD,IF1CgD,GE0CzC,6BF1CyC,CE0CX,IF1CW,CAAA,CAAA,EE2CrD,OF3CqD,CE2C7C,sBF3C6C,CE2CtB,8BF3CsB,CE2CS,IF3CT,CAAA,CAAA,CAAA;EACzCC;EAWAC,UAAAA,IAAAA,CAAAA,OAAe,EEkDnB,cFlDmB,EAAA,OAAA,CAAA,EEmDlB,WFnDkB,CAAA,EEoD3B,OFpD2B,CEoDnB,cFpDmB,CAAA;EAiBfC;EAQAE,cAAAA,OAAiB,CAAA,CAAA,EEgCP,MFhCO,CAAA,MAAA,EAAA,MAAA,CAAA;EAItBC,cAAAA,mBAAeD,CAAAA,CAAAA,EAAAA,CAAAA,CAAAA,MAAAA,EEiCX,yBFjC4B,EAAA,GEiCE,OFjCF,CAAA,IAAA,CAAA,CAAA,GAAA,SAAA;EAC3BE;AAMjB;AAOA;AACA;AAOA;AAKA;EACiBM,UAAAA,WAAAA,CAAAA,UAAqB,MAC7BD,EAAAA,MAAAA,CAAAA,CAAAA,SAAiB,EAAA,MAAA,EAAA,IAAA,EAAA,CAAA,GAAA,EEoBV,CFpBU,EAAA,GEoBJ,OFpBI,CEoBI,MFpBJ,CAAA,CAAA,EEqBrB,OFrBqB,CEqBb,MFrBa,CAAA;EAGdE;EACKC,UAAAA,aAAmB,CAAA,CAAA,EE0CD,OF1CC,CE0CO,eF1CP,CAAA;EAQnBvC;;;;EAIUsC,UAAAA,WAAAA,CAAAA,CAAAA,EEyCM,OFzCNA,CAAAA,IAAAA,CAAAA"}

package/dist/index.js

@@ -1,7 +1,7 @@
 import "./errors-CXR0xBpw.js";
 import { $ as TerminalControlError, G as BackupRestoreError, H as BackupCreateError, J as InvalidTerminalCursorError, K as ContainerUnavailableError, Q as StaleTerminalHandleError, U as BackupExpiredError, W as BackupNotFoundError, X as OperationInterruptedError, Y as InvalidTerminalCwdError, Z as RPCTransportError, _ as StaleProcessHandleError, c as InvalidProcessEnvironmentError, d as ProcessExitedBeforeLogError, et as TerminalNotFoundError, f as ProcessExitedBeforeReadyError, g as ProcessWaitTimeoutError, h as ProcessSpawnFailedError, l as ProcessAbortedError, m as ProcessReadyTimeoutError, n as RuntimeIdentityInactiveError, o as InvalidProcessCursorError, p as ProcessNotFoundError, q as InvalidBackupConfigError, r as RuntimeControlProtocolError, s as InvalidProcessCwdError, u as ProcessError } from "./errors-QYlSkVGz.js";
 import { a as TraceContext, r as createLogger } from "./dist-Duor5GbS.js";
-import { _ as proxyTerminal, a as responseToAsyncIterable, b as collectFile, c as BucketUnmountError, d as S3FSMountError, f as parsePreviewRoute, i as parseSSEStream, l as InvalidMountConfigError, n as getSandbox, o as ContainerProxy, p as withPreviewProxyMetadata, r as asyncIterableToSSEStream, s as BucketMountError, t as Sandbox, u as MissingCredentialsError, v as isDurableObjectCodeUpdateReset, x as streamFile, y as isPlatformTransientError } from "./sandbox-Auuwfnur.js";
+import { _ as proxyTerminal, a as responseToAsyncIterable, b as collectFile, c as BucketUnmountError, d as S3FSMountError, f as parsePreviewRoute, i as parseSSEStream, l as InvalidMountConfigError, n as getSandbox, o as ContainerProxy, p as withPreviewProxyMetadata, r as asyncIterableToSSEStream, s as BucketMountError, t as Sandbox, u as MissingCredentialsError, v as isDurableObjectCodeUpdateReset, x as streamFile, y as isPlatformTransientError } from "./sandbox-CXc1T45U.js";
 import "./extensions-CFB2xHqY.js";
 
 //#region src/request-handler.ts

package/dist/{sandbox-Auuwfnur.js → sandbox-CXc1T45U.js}

@@ -719,6 +719,10 @@ function trimTrailingSlashes(s) {
 	while (end > 0 && s[end - 1] === "/") end--;
 	return s.slice(0, end);
 }
+function normalizeMountPrefix(prefix) {
+	if (!prefix) return void 0;
+	return trimTrailingSlashes(normalizeObjectKey(prefix)) || void 0;
+}
 function parsePath(pathname) {
 	const stripped = pathname.startsWith("/") ? pathname.slice(1) : pathname;
 	if (!stripped) return null;
@@ -916,15 +920,17 @@ async function handleGetObject(r2, key, request) {
 		headers
 	});
 }
-async function handlePutObject(r2, bucketName, key, request, env$1, permitted, mountPrefix) {
+async function handlePutObject(r2, bucketName, key, request, env$1, buckets) {
 	const copySourceHeader = request.headers.get("x-amz-copy-source");
 	if (copySourceHeader) {
 		const copySource = parseCopySource(copySourceHeader);
 		if (!copySource || !copySource.key) return new Response("Bad Request: invalid x-amz-copy-source", { status: 400 });
-		if (!permitted.has(copySource.bucket)) return new Response(`Access to R2 bucket "${copySource.bucket}" is not permitted. Call mountBucket() with this bucket before accessing it.`, { status: 403 });
+		if (!Object.hasOwn(buckets, copySource.bucket)) return new Response(`Access to R2 bucket "${copySource.bucket}" is not permitted. Call mountBucket() with this bucket before accessing it.`, { status: 403 });
+		const sourceParams = buckets[copySource.bucket];
 		const sourceBucket = copySource.bucket === bucketName ? r2 : resolveR2Bucket(env$1, copySource.bucket);
 		if (!sourceBucket) return new Response(`R2 binding "${copySource.bucket}" not found in Worker env. Ensure the binding name matches the bucket name passed to mountBucket().`, { status: 500 });
-		const sourceKey = mountPrefix && copySource.bucket === bucketName ? `${mountPrefix}/${copySource.key}` : copySource.key;
+		const sourcePrefix = normalizeMountPrefix(sourceParams.prefix);
+		const sourceKey = sourcePrefix ? `${sourcePrefix}/${copySource.key}` : copySource.key;
 		const sourceObject = await sourceBucket.get(sourceKey);
 		if (!sourceObject) return new Response(null, { status: 404 });
 		const httpMetadata = request.headers.get("x-amz-metadata-directive")?.toUpperCase() === "REPLACE" ? extractHttpMetadata(request) : sourceObject.httpMetadata;
@@ -998,8 +1004,7 @@ const r2EgressHandler = async (request, env$1, ctx) => {
 	const { bucket: bucketName, key } = parsed;
 	if (!ctx.params?.buckets || !(bucketName in ctx.params.buckets)) return new Response(`Access to R2 bucket "${bucketName}" is not permitted. Call mountBucket() with this bucket before accessing it.`, { status: 403 });
 	const bucketParams = ctx.params.buckets[bucketName];
-	const rawPrefix = bucketParams.prefix;
-	const mountPrefix = rawPrefix ? trimTrailingSlashes(normalizeObjectKey(rawPrefix)) : void 0;
+	const mountPrefix = normalizeMountPrefix(bucketParams.prefix);
 	const readOnly = bucketParams.readOnly ?? false;
 	const r2 = resolveR2Bucket(env$1, bucketName);
 	if (!r2) return new Response(`R2 binding "${bucketName}" not found in Worker env. Ensure the binding name matches the bucket name passed to mountBucket().`, { status: 500 });
@@ -1011,7 +1016,6 @@ const r2EgressHandler = async (request, env$1, ctx) => {
 		return new Response("Method Not Allowed", { status: 405 });
 	}
 	const fullKey = mountPrefix ? `${mountPrefix}/${key}` : key;
-	const permitted = new Set(Object.keys(ctx.params.buckets));
 	if (readOnly && (method === "PUT" || method === "DELETE" || method === "POST" && (url.searchParams.has("uploads") || url.searchParams.has("uploadId")))) return new Response("Forbidden: bucket mount is read-only", { status: 403 });
 	if (method === "POST" && url.searchParams.has("uploads")) return handleCreateMultipartUpload(r2, bucketName, fullKey, request);
 	if (method === "POST" && url.searchParams.has("uploadId")) return handleCompleteMultipartUpload(r2, bucketName, fullKey, url, request);
@@ -1020,7 +1024,7 @@ const r2EgressHandler = async (request, env$1, ctx) => {
 	switch (method) {
 		case "HEAD": return handleHeadObject(r2, fullKey);
 		case "GET": return handleGetObject(r2, fullKey, request);
-		case "PUT": return handlePutObject(r2, bucketName, fullKey, request, env$1, permitted, mountPrefix);
+		case "PUT": return handlePutObject(r2, bucketName, fullKey, request, env$1, ctx.params.buckets);
 		case "DELETE": return handleDeleteObject(r2, fullKey);
 		default: return new Response("Method Not Allowed", { status: 405 });
 	}
@@ -1256,6 +1260,33 @@ function isObjectKeyWithinPrefix(objectKey, prefix) {
 	if (!normalizedPrefix) return true;
 	return objectKey === normalizedPrefix || objectKey.startsWith(`${normalizedPrefix}/`);
 }
+function parseCopySourceHeader(value) {
+	const encodedPath = value.split("?", 1)[0];
+	if (!encodedPath) return null;
+	let decodedPath;
+	try {
+		decodedPath = decodeURIComponent(encodedPath);
+	} catch {
+		return null;
+	}
+	const path$1 = decodedPath.startsWith("/") ? decodedPath.slice(1) : decodedPath;
+	const separatorIndex = path$1.indexOf("/");
+	if (separatorIndex <= 0 || separatorIndex === path$1.length - 1) return null;
+	return {
+		bucket: path$1.slice(0, separatorIndex),
+		objectKey: path$1.slice(separatorIndex + 1)
+	};
+}
+function validateCopySourceWithinMountScope(headers, bucket, prefix) {
+	const copySources = [["x-amz-copy-source", headers.get("x-amz-copy-source")], ["x-goog-copy-source", headers.get("x-goog-copy-source")]].filter((entry) => entry[1] !== null);
+	if (copySources.length > 1) return new Response("Bad Request: multiple copy source headers", { status: 400 });
+	if (copySources.length === 0) return null;
+	const [headerName, value] = copySources[0];
+	const copySource = parseCopySourceHeader(value);
+	if (!copySource) return new Response(`Bad Request: invalid ${headerName}`, { status: 400 });
+	if (copySource.bucket !== bucket || !isObjectKeyWithinPrefix(copySource.objectKey, prefix)) return new Response("Forbidden: copy source is outside mounted scope", { status: 403 });
+	return null;
+}
 function isRequestWithinMountScope(realPath, url, bucket, prefix) {
 	const objectKey = getObjectKeyForPath(realPath, bucket);
 	if (objectKey === null) return false;
@@ -1393,6 +1424,8 @@ const s3CredentialProxyHandler = async (request, env$1, ctx) => {
 	const realUrl = new URL(realPath + (url.search || ""), mount.endpoint);
 	if (isBucketRootProbe(request, realPath, url, mount.bucket)) return new Response(null, { status: 200 });
 	if (!isRequestWithinMountScope(realPath, url, mount.bucket, mount.prefix)) return new Response("Forbidden: request is outside mounted bucket scope", { status: 403 });
+	const copySourceError = validateCopySourceWithinMountScope(request.headers, mount.bucket, mount.prefix);
+	if (copySourceError) return copySourceError;
 	const cleanHeaders = buildCleanHeaders(request.headers);
 	const cleanRequest = new Request(realUrl.toString(), {
 		method: request.method,
@@ -10007,4 +10040,4 @@ var Sandbox = class extends Container {
 
 //#endregion
 export { proxyTerminal as _, responseToAsyncIterable as a, collectFile as b, BucketUnmountError as c, S3FSMountError as d, parsePreviewRoute as f, validateTunnelName as g, validatePort as h, parseSSEStream as i, InvalidMountConfigError as l, SandboxSecurityError as m, getSandbox as n, ContainerProxy$1 as o, withPreviewProxyMetadata as p, asyncIterableToSSEStream as r, BucketMountError as s, Sandbox as t, MissingCredentialsError as u, isDurableObjectCodeUpdateReset as v, streamFile as x, isPlatformTransientError as y };
-//# sourceMappingURL=sandbox-Auuwfnur.js.map
+//# sourceMappingURL=sandbox-CXc1T45U.js.map