@cloudflare/sandbox 0.13.0-next.769.1 → 1.0.0-rc.0

package/dist/bridge/index.js

@@ -1,3053 +0,0 @@
-import "../errors-CXR0xBpw.js";
-import "../errors-QYlSkVGz.js";
-import "../dist-Duor5GbS.js";
-import { g as validateTunnelName, h as validatePort, m as SandboxSecurityError, n as getSandbox$1, x as streamFile } from "../sandbox-cmlgGVYX.js";
-import "../extensions-CFB2xHqY.js";
-import { DurableObject, env } from "cloudflare:workers";
-import { Hono } from "hono";
-
-//#region src/bridge/pool.ts
-/**
-* Prime the warm pool — pushes current configuration to the WarmPool
-* Durable Object so it starts its alarm loop.
-*
-* Called by the scheduled() handler and by POST /pool/prime.
-*/
-async function primePool(env$1, warmPoolBinding) {
-	const warmTarget = Number.parseInt(env$1.WARM_POOL_TARGET || "0", 10) || 0;
-	const refreshInterval = Number.parseInt(env$1.WARM_POOL_REFRESH_INTERVAL || "10000", 10) || 1e4;
-	const ns = env$1[warmPoolBinding];
-	const poolId = ns.idFromName("global-pool");
-	await ns.get(poolId).configure({
-		warmTarget,
-		refreshInterval
-	});
-}
-
-//#endregion
-//#region src/bridge/helpers.ts
-/**
-* Utility functions used by the bridge routes.
-*/
-/** RFC 4648 base32 encoding (lowercase). Returns only [a-z2-7]. */
-function base32Encode(data) {
-	const alphabet = "abcdefghijklmnopqrstuvwxyz234567";
-	let bits = 0;
-	let value = 0;
-	let out = "";
-	for (const byte of data) {
-		value = value << 8 | byte;
-		bits += 8;
-		while (bits >= 5) {
-			out += alphabet[value >>> bits - 5 & 31];
-			bits -= 5;
-		}
-	}
-	if (bits > 0) out += alphabet[value << 5 - bits & 31];
-	return out;
-}
-function errorJson(error, code, status) {
-	const body = {
-		error,
-		code
-	};
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "Content-Type": "application/json" }
-	});
-}
-/**
-* Shell-quote a single argv token so it is safe to embed in a sh command
-* string.  Tokens that contain only safe characters are returned unchanged
-* for readability.  All others are wrapped in ANSI-C $'...' quoting which
-* can represent newlines, tabs, and other control characters as escape
-* sequences — unlike plain single quotes which pass content literally and
-* break when the value contains a real newline.
-*/
-function shellQuote(arg) {
-	if (/^[A-Za-z0-9@%+=:,./-]+$/.test(arg)) return arg;
-	return `$'${arg.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")}'`;
-}
-/**
-* POSIX-normalise a path (resolve `.` / `..` segments) and verify it lives
-* under /workspace.  Returns the resolved absolute path on success, or null
-* if the path escapes the workspace.
-*/
-function resolveWorkspacePath(userPath) {
-	const abs = userPath.startsWith("/") ? userPath : `/workspace/${userPath}`;
-	const parts = [];
-	for (const seg of abs.split("/")) {
-		if (seg === "" || seg === ".") continue;
-		if (seg === "..") parts.pop();
-		else parts.push(seg);
-	}
-	const resolved = `/${parts.join("/")}`;
-	if (resolved === "/workspace" || resolved.startsWith("/workspace/")) return resolved;
-	return null;
-}
-/**
-* Validate a terminal ID. Rejects path traversal, control chars, and excessive length.
-* Returns the validated ID or null if invalid.
-*/
-function validateTerminalId(id) {
-	if (!/^[a-zA-Z0-9._-]{1,128}$/.test(id)) return null;
-	if (id.includes("..")) return null;
-	return id;
-}
-/**
-* Convert an SSE stream from readFileStream() into a raw byte stream.
-* Decodes base64 chunks for binary files and UTF-8-encodes text chunks.
-*/
-function sseToByteStream(sse) {
-	const encoder = new TextEncoder();
-	const iterator = streamFile(sse)[Symbol.asyncIterator]();
-	let finished = false;
-	async function finish(cancelSource) {
-		if (finished) return;
-		finished = true;
-		if (!cancelSource) return;
-		await iterator.return?.().catch(() => void 0);
-	}
-	return new ReadableStream({
-		async pull(controller) {
-			try {
-				const result = await iterator.next();
-				if (result.done) {
-					await finish(false);
-					controller.close();
-					return;
-				}
-				controller.enqueue(result.value instanceof Uint8Array ? result.value : encoder.encode(result.value));
-			} catch (error) {
-				await finish(true);
-				controller.error(error);
-			}
-		},
-		async cancel() {
-			await finish(true);
-		}
-	}, { highWaterMark: 0 });
-}
-function withStreamCleanup(source, cleanup) {
-	const reader = source.getReader();
-	let finished = false;
-	async function finish(cancelSource) {
-		if (finished) return;
-		finished = true;
-		if (cancelSource) await reader.cancel().catch(() => void 0);
-		reader.releaseLock();
-		await cleanup().catch(() => void 0);
-	}
-	return new ReadableStream({
-		async pull(controller) {
-			try {
-				const result = await reader.read();
-				if (result.done) {
-					await finish(false);
-					controller.close();
-					return;
-				}
-				controller.enqueue(result.value);
-			} catch (error) {
-				await finish(true);
-				controller.error(error);
-			}
-		},
-		async cancel() {
-			await finish(true);
-		}
-	}, { highWaterMark: 0 });
-}
-
-//#endregion
-//#region src/bridge/openapi/common.ts
-/**
-* OpenAPI 3.1 schema for the Cloudflare Sandbox Service API.
-*
-* Served at GET /v1/openapi.json (requires Bearer token auth).
-*/
-const OPENAPI_BASE = {
-	openapi: "3.1.0",
-	info: {
-		title: "Cloudflare Sandbox Service API",
-		version: "1.0.0",
-		description: "HTTP API consumed by the Python `CloudflareSandboxClient`. Forwards each operation to a named Cloudflare Sandbox Durable Object via the `@cloudflare/sandbox` SDK."
-	},
-	components: {
-		securitySchemes: { BearerAuth: {
-			type: "http",
-			scheme: "bearer",
-			description: "API token set via `wrangler secret put SANDBOX_API_KEY`. The /openapi.* routes also accept the token as a `?token=` query parameter."
-		} },
-		schemas: {
-			ProcessCreateRequest: {
-				type: "object",
-				required: ["argv"],
-				properties: {
-					argv: {
-						type: "array",
-						items: { type: "string" },
-						minItems: 1,
-						description: "Argv array to launch directly.",
-						example: [
-							"sh",
-							"-lc",
-							"echo hello"
-						]
-					},
-					timeout: {
-						type: "integer",
-						description: "Remote process lifetime deadline in milliseconds. When reached, the sandbox may stop the process and the process exit outcome reports `timedOut: true`; this is not caller-local observation cancellation.",
-						example: 3e4
-					},
-					cwd: {
-						type: "string",
-						description: "Working directory for the command (defaults to sandbox cwd).",
-						example: "/workspace"
-					},
-					env: {
-						type: "object",
-						additionalProperties: { type: "string" },
-						description: "Environment overrides for the process."
-					}
-				}
-			},
-			ProcessStatus: {
-				oneOf: [
-					{
-						type: "object",
-						required: [
-							"id",
-							"pid",
-							"command",
-							"state",
-							"startedAt"
-						],
-						properties: {
-							id: { type: "string" },
-							pid: { type: "integer" },
-							command: {
-								type: "array",
-								items: { type: "string" }
-							},
-							cwd: { type: "string" },
-							state: { const: "running" },
-							startedAt: { type: "string" }
-						}
-					},
-					{
-						type: "object",
-						required: [
-							"id",
-							"pid",
-							"command",
-							"state",
-							"startedAt",
-							"endedAt",
-							"exit"
-						],
-						properties: {
-							id: { type: "string" },
-							pid: { type: "integer" },
-							command: {
-								type: "array",
-								items: { type: "string" }
-							},
-							cwd: { type: "string" },
-							state: { const: "exited" },
-							startedAt: { type: "string" },
-							endedAt: { type: "string" },
-							exit: {
-								type: "object",
-								required: ["code", "timedOut"],
-								properties: {
-									code: { type: "integer" },
-									signal: { type: "integer" },
-									timedOut: { type: "boolean" }
-								}
-							}
-						}
-					},
-					{
-						type: "object",
-						required: [
-							"id",
-							"pid",
-							"command",
-							"state",
-							"startedAt",
-							"endedAt",
-							"error"
-						],
-						properties: {
-							id: { type: "string" },
-							pid: { type: "integer" },
-							command: {
-								type: "array",
-								items: { type: "string" }
-							},
-							cwd: { type: "string" },
-							state: { const: "error" },
-							startedAt: { type: "string" },
-							endedAt: { type: "string" },
-							error: {
-								type: "object",
-								required: ["code", "message"],
-								properties: {
-									code: { type: "string" },
-									message: { type: "string" }
-								}
-							}
-						}
-					}
-				],
-				discriminator: { propertyName: "state" }
-			},
-			WriteResponse: {
-				type: "object",
-				required: ["ok"],
-				properties: { ok: {
-					type: "boolean",
-					enum: [true],
-					description: "Always `true` on success."
-				} }
-			},
-			RunningResponse: {
-				type: "object",
-				required: ["running"],
-				properties: { running: {
-					type: "boolean",
-					description: "`true` if the sandbox container is alive and responding."
-				} }
-			},
-			OkResponse: {
-				type: "object",
-				required: ["ok"],
-				properties: { ok: {
-					type: "boolean",
-					enum: [true],
-					description: "Always `true` on success."
-				} }
-			},
-			MountBucketCredentials: {
-				type: "object",
-				required: ["accessKeyId", "secretAccessKey"],
-				properties: {
-					accessKeyId: {
-						type: "string",
-						description: "S3-compatible access key ID."
-					},
-					secretAccessKey: {
-						type: "string",
-						description: "S3-compatible secret access key."
-					}
-				}
-			},
-			MountBucketRequestOptions: {
-				type: "object",
-				properties: {
-					endpoint: {
-						type: "string",
-						description: "S3-compatible endpoint URL for remote mounts. Mutually exclusive with top-level `binding`.",
-						example: "https://YOUR_ACCOUNT_ID.r2.cloudflarestorage.com"
-					},
-					readOnly: {
-						type: "boolean",
-						description: "Mount filesystem as read-only (default: false).",
-						default: false
-					},
-					prefix: {
-						type: "string",
-						description: "Optional prefix/subdirectory within the bucket to mount. Must start with `/`. Trailing slashes are stripped automatically.",
-						example: "/uploads/images"
-					},
-					credentials: {
-						$ref: "#/components/schemas/MountBucketCredentials",
-						description: "Explicit credentials. When omitted, the SDK auto-detects from Worker secrets (R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY or AWS equivalents)."
-					},
-					credentialProxy: {
-						type: "boolean",
-						description: "Keep credentials in the Durable Object and sign intercepted s3fs requests from the Worker. Credentials may be explicit or auto-detected from Worker secrets.",
-						default: false
-					},
-					s3fsOptions: {
-						type: "array",
-						items: { type: "string" },
-						description: "Advanced: Override or extend s3fs mount options for both remote mounts and R2 binding mounts.",
-						example: ["nomultipart"]
-					}
-				}
-			},
-			MountBucketRequest: {
-				type: "object",
-				required: ["mountPath", "options"],
-				properties: {
-					bucket: {
-						type: "string",
-						description: "Remote bucket name for endpoint-based S3-compatible mounts.",
-						example: "my-r2-bucket"
-					},
-					binding: {
-						type: "string",
-						description: "Worker R2 binding name for credential-less R2 binding mounts. Mutually exclusive with `options.endpoint`.",
-						example: "MY_BUCKET"
-					},
-					mountPath: {
-						type: "string",
-						description: "Absolute path in the container to mount at.",
-						example: "/mnt/data"
-					},
-					options: { $ref: "#/components/schemas/MountBucketRequestOptions" }
-				}
-			},
-			UnmountBucketRequest: {
-				type: "object",
-				required: ["mountPath"],
-				properties: { mountPath: {
-					type: "string",
-					description: "Absolute path where the bucket is currently mounted.",
-					example: "/mnt/data"
-				} }
-			},
-			TunnelRequest: {
-				type: "object",
-				properties: { name: {
-					type: "string",
-					description: "Subdomain prefix for a named tunnel, such as `app`. Do not pass a full hostname. Omit to create or reuse an ephemeral tunnel.",
-					example: "app"
-				} }
-			},
-			Tunnel: {
-				type: "object",
-				required: [
-					"id",
-					"port",
-					"url",
-					"hostname",
-					"createdAt"
-				],
-				properties: {
-					id: { type: "string" },
-					port: {
-						type: "integer",
-						description: "Container port served by the tunnel.",
-						example: 8080
-					},
-					url: {
-						type: "string",
-						format: "uri",
-						example: "https://app.example.com"
-					},
-					hostname: {
-						type: "string",
-						example: "app.example.com"
-					},
-					createdAt: {
-						type: "string",
-						format: "date-time"
-					},
-					name: {
-						type: "string",
-						description: "Present for named tunnels only.",
-						example: "app"
-					}
-				}
-			},
-			ErrorResponse: {
-				type: "object",
-				required: ["error", "code"],
-				properties: {
-					error: {
-						type: "string",
-						description: "Human-readable error description."
-					},
-					code: {
-						type: "string",
-						description: "Stable machine-readable error code.",
-						enum: [
-							"unauthorized",
-							"invalid_request",
-							"exec_error",
-							"exec_transport_error",
-							"workspace_read_not_found",
-							"workspace_archive_read_error",
-							"workspace_archive_write_error",
-							"capacity_exceeded",
-							"pool_error",
-							"mount_error",
-							"unmount_error",
-							"tunnel_error"
-						]
-					}
-				}
-			},
-			PoolStats: {
-				type: "object",
-				required: [
-					"warm",
-					"assigned",
-					"total",
-					"config",
-					"maxInstances"
-				],
-				properties: {
-					warm: {
-						type: "integer",
-						description: "Number of warm (unassigned) containers ready for use."
-					},
-					assigned: {
-						type: "integer",
-						description: "Number of containers assigned to sandbox IDs."
-					},
-					total: {
-						type: "integer",
-						description: "Total containers tracked by the pool."
-					},
-					config: {
-						type: "object",
-						properties: {
-							warmTarget: { type: "integer" },
-							refreshInterval: { type: "integer" }
-						}
-					},
-					maxInstances: {
-						type: ["integer", "null"],
-						description: "Inferred max_instances limit, or null if not yet known."
-					}
-				}
-			}
-		},
-		responses: {
-			Unauthorized: {
-				description: "Missing or invalid Bearer token.",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "Unauthorized",
-						code: "unauthorized"
-					}
-				} }
-			},
-			InvalidRequest: {
-				description: "Malformed request body or missing required fields.",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "argv must be a non-empty array",
-						code: "invalid_request"
-					}
-				} }
-			},
-			NotFound: {
-				description: "Requested resource was not found.",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "Process not found",
-						code: "not_found"
-					}
-				} }
-			},
-			BadGateway: {
-				description: "Sandbox operation failed.",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "process launch failed",
-						code: "process_error"
-					}
-				} }
-			}
-		}
-	},
-	security: [{ BearerAuth: [] }]
-};
-
-//#endregion
-//#region src/bridge/openapi/files.ts
-const FILESPaths = {
-	"/v1/sandbox/{id}/file/{path}": {
-		get: {
-			operationId: "readFile",
-			summary: "Read a file from the sandbox filesystem",
-			"x-codeSamples": [{
-				lang: "curl",
-				label: "cURL",
-				source: "curl -X GET https://$HOST/v1/sandbox/my-sandbox/file/workspace/main.py \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\" \\\n  -o main.py"
-			}],
-			parameters: [{
-				name: "id",
-				in: "path",
-				required: true,
-				schema: { type: "string" },
-				description: "Sandbox instance name."
-			}, {
-				name: "path",
-				in: "path",
-				required: true,
-				schema: { type: "string" },
-				description: "File path inside the sandbox, without leading slash (e.g. workspace/main.py). Must resolve within /workspace."
-			}],
-			responses: {
-				"200": {
-					description: "Raw file bytes.",
-					content: { "application/octet-stream": { schema: {
-						type: "string",
-						format: "binary"
-					} } }
-				},
-				"400": { $ref: "#/components/responses/InvalidRequest" },
-				"401": { $ref: "#/components/responses/Unauthorized" },
-				"403": {
-					description: "Path resolves outside /workspace.",
-					content: { "application/json": {
-						schema: { $ref: "#/components/schemas/ErrorResponse" },
-						example: {
-							error: "path must resolve to a location within /workspace",
-							code: "invalid_request"
-						}
-					} }
-				},
-				"404": {
-					description: "File not found in the sandbox.",
-					content: { "application/json": {
-						schema: { $ref: "#/components/schemas/ErrorResponse" },
-						example: {
-							error: "File not found: /workspace/foo.txt",
-							code: "workspace_read_not_found"
-						}
-					} }
-				},
-				"502": {
-					description: "SDK read call failed.",
-					content: { "application/json": {
-						schema: { $ref: "#/components/schemas/ErrorResponse" },
-						example: {
-							error: "read failed: connection reset",
-							code: "exec_transport_error"
-						}
-					} }
-				}
-			}
-		},
-		put: {
-			operationId: "writeFile",
-			summary: "Write a file into the sandbox filesystem",
-			"x-codeSamples": [{
-				lang: "curl",
-				label: "cURL",
-				source: "curl -X PUT https://$HOST/v1/sandbox/my-sandbox/file/workspace/main.py \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\" \\\n  -H \"Content-Type: application/octet-stream\" \\\n  --data-binary @main.py"
-			}],
-			parameters: [{
-				name: "id",
-				in: "path",
-				required: true,
-				schema: { type: "string" },
-				description: "Sandbox instance name."
-			}, {
-				name: "path",
-				in: "path",
-				required: true,
-				schema: { type: "string" },
-				description: "File path inside the sandbox, without leading slash (e.g. workspace/main.py). Must resolve within /workspace."
-			}],
-			requestBody: {
-				required: true,
-				description: "Raw file content to write.",
-				content: { "application/octet-stream": { schema: {
-					type: "string",
-					format: "binary"
-				} } }
-			},
-			responses: {
-				"200": {
-					description: "File written successfully.",
-					content: { "application/json": { schema: { $ref: "#/components/schemas/WriteResponse" } } }
-				},
-				"400": { $ref: "#/components/responses/InvalidRequest" },
-				"401": { $ref: "#/components/responses/Unauthorized" },
-				"403": {
-					description: "Path resolves outside /workspace.",
-					content: { "application/json": {
-						schema: { $ref: "#/components/schemas/ErrorResponse" },
-						example: {
-							error: "path must resolve to a location within /workspace",
-							code: "invalid_request"
-						}
-					} }
-				},
-				"502": {
-					description: "SDK write call failed.",
-					content: { "application/json": {
-						schema: { $ref: "#/components/schemas/ErrorResponse" },
-						example: {
-							error: "write failed: connection reset",
-							code: "workspace_archive_write_error"
-						}
-					} }
-				}
-			}
-		}
-	},
-	"/v1/sandbox/{id}/persist": { post: {
-		operationId: "persistWorkspace",
-		summary: "Serialize the sandbox workspace to a tar archive",
-		description: "Archives the /workspace directory inside the sandbox and streams the resulting tar back as raw bytes.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X POST https://$HOST/v1/sandbox/my-sandbox/persist \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\" \\\n  -o workspace.tar"
-		}],
-		parameters: [{
-			name: "id",
-			in: "path",
-			required: true,
-			schema: { type: "string" },
-			description: "Sandbox instance name."
-		}, {
-			name: "excludes",
-			in: "query",
-			required: false,
-			schema: { type: "string" },
-			description: "Comma-separated list of relative paths to exclude from the archive.",
-			example: "__pycache__,.venv"
-		}],
-		responses: {
-			"200": {
-				description: "Raw tar archive bytes.",
-				content: { "application/octet-stream": { schema: {
-					type: "string",
-					format: "binary"
-				} } }
-			},
-			"400": {
-				description: "Invalid exclude paths (e.g. path traversal).",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "exclude paths must not contain \"..\"",
-						code: "invalid_request"
-					}
-				} }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" },
-			"502": {
-				description: "tar command failed inside the sandbox.",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "tar failed (exit 1): ...",
-						code: "workspace_archive_read_error"
-					}
-				} }
-			}
-		}
-	} },
-	"/v1/sandbox/{id}/hydrate": { post: {
-		operationId: "hydrateWorkspace",
-		summary: "Populate the sandbox workspace from a tar archive",
-		description: "Accepts a raw tar archive as the request body and extracts it into /workspace inside the sandbox.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X POST https://$HOST/v1/sandbox/my-sandbox/hydrate \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\" \\\n  -H \"Content-Type: application/octet-stream\" \\\n  --data-binary @workspace.tar"
-		}],
-		parameters: [{
-			name: "id",
-			in: "path",
-			required: true,
-			schema: { type: "string" },
-			description: "Sandbox instance name."
-		}],
-		requestBody: {
-			required: true,
-			description: "Raw tar archive bytes.",
-			content: { "application/octet-stream": { schema: {
-				type: "string",
-				format: "binary"
-			} } }
-		},
-		responses: {
-			"200": {
-				description: "Archive extracted successfully.",
-				content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } }
-			},
-			"400": { $ref: "#/components/responses/InvalidRequest" },
-			"401": { $ref: "#/components/responses/Unauthorized" },
-			"502": {
-				description: "tar extract failed inside the sandbox.",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "tar extract failed (exit 1): ...",
-						code: "workspace_archive_write_error"
-					}
-				} }
-			}
-		}
-	} },
-	"/v1/sandbox/{id}/mount": { post: {
-		operationId: "mountBucket",
-		summary: "Mount an S3-compatible bucket into the container",
-		description: "Mounts an S3-compatible bucket (R2, S3, GCS, etc.) as a local directory via s3fs-FUSE. Credentials are optional — the SDK auto-detects from Worker secrets when omitted.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X POST https://$HOST/v1/sandbox/my-sandbox/mount \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"bucket\":\"my-bucket\",\"mountPath\":\"/mnt/data\",\"options\":{\"endpoint\":\"https://ACCT.r2.cloudflarestorage.com\"}}'"
-		}],
-		parameters: [{
-			name: "id",
-			in: "path",
-			required: true,
-			schema: { type: "string" },
-			description: "Sandbox instance name."
-		}],
-		requestBody: {
-			required: true,
-			content: { "application/json": { schema: { $ref: "#/components/schemas/MountBucketRequest" } } }
-		},
-		responses: {
-			"200": {
-				description: "Bucket mounted successfully.",
-				content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } }
-			},
-			"400": { $ref: "#/components/responses/InvalidRequest" },
-			"401": { $ref: "#/components/responses/Unauthorized" },
-			"502": {
-				description: "SDK mount call failed (invalid config, duplicate mount, or s3fs error).",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "mount failed: Mount path already in use",
-						code: "mount_error"
-					}
-				} }
-			}
-		}
-	} },
-	"/v1/sandbox/{id}/unmount": { post: {
-		operationId: "unmountBucket",
-		summary: "Unmount a previously mounted bucket",
-		description: "Unmounts a bucket filesystem that was previously mounted via `/v1/sandbox/{id}/mount`.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X POST https://$HOST/v1/sandbox/my-sandbox/unmount \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"mountPath\":\"/mnt/data\"}'"
-		}],
-		parameters: [{
-			name: "id",
-			in: "path",
-			required: true,
-			schema: { type: "string" },
-			description: "Sandbox instance name."
-		}],
-		requestBody: {
-			required: true,
-			content: { "application/json": { schema: { $ref: "#/components/schemas/UnmountBucketRequest" } } }
-		},
-		responses: {
-			"200": {
-				description: "Bucket unmounted successfully.",
-				content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } }
-			},
-			"400": { $ref: "#/components/responses/InvalidRequest" },
-			"401": { $ref: "#/components/responses/Unauthorized" },
-			"502": {
-				description: "SDK unmount call failed (no active mount or unmount error).",
-				content: { "application/json": {
-					schema: { $ref: "#/components/schemas/ErrorResponse" },
-					example: {
-						error: "unmount failed: No active mount found",
-						code: "unmount_error"
-					}
-				} }
-			}
-		}
-	} }
-};
-
-//#endregion
-//#region src/bridge/openapi/lifecycle.ts
-const LIFECYCLEPaths = {
-	"/v1/sandbox": { post: {
-		operationId: "createSandbox",
-		summary: "Create a new sandbox",
-		description: "Generates a new unique sandbox ID. Use this ID with all `/v1/sandbox/{id}/*` routes.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X POST https://$HOST/v1/sandbox \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\""
-		}],
-		responses: {
-			"200": {
-				description: "New sandbox created.",
-				content: { "application/json": { schema: {
-					type: "object",
-					required: ["id"],
-					properties: { id: {
-						type: "string",
-						description: "Unique sandbox ID for use with `/v1/sandbox/{id}/*` routes.",
-						example: "mfrggzdfmy2tqnrzgezdgnbv"
-					} }
-				} } }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" }
-		}
-	} },
-	"/v1/sandbox/{id}": { delete: {
-		operationId: "deleteSandbox",
-		summary: "Destroy a sandbox instance (best-effort)",
-		description: "Calls destroy() on the sandbox Durable Object to release container resources. Best-effort: unknown sandbox IDs return 204 without allocating a container.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X DELETE https://$HOST/v1/sandbox/my-sandbox \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\""
-		}],
-		parameters: [{
-			name: "id",
-			in: "path",
-			required: true,
-			schema: { type: "string" },
-			description: "Sandbox instance name."
-		}],
-		responses: {
-			"204": { description: "Sandbox destroyed (best-effort). Container resources are released." },
-			"401": { $ref: "#/components/responses/Unauthorized" }
-		}
-	} },
-	"/health": { get: {
-		operationId: "healthCheck",
-		summary: "Worker health check",
-		description: "Simple liveness probe. Not protected by authentication.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl https://$HOST/health"
-		}],
-		security: [],
-		responses: { "200": {
-			description: "Worker is up.",
-			content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } }
-		} }
-	} },
-	"/v1/openapi.json": { get: {
-		operationId: "getOpenApiSchema",
-		summary: "OpenAPI schema",
-		description: "Returns this OpenAPI 3.1 schema document.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl https://$HOST/v1/openapi.json \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\""
-		}],
-		responses: {
-			"200": {
-				description: "OpenAPI schema document.",
-				content: { "application/json": { schema: { type: "object" } } }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" }
-		}
-	} },
-	"/v1/pool/stats": { get: {
-		operationId: "getPoolStats",
-		summary: "Pool statistics",
-		description: "Returns current warm pool statistics including warm/assigned counts and configuration.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl https://$HOST/v1/pool/stats \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\""
-		}],
-		responses: {
-			"200": {
-				description: "Pool statistics.",
-				content: { "application/json": { schema: { $ref: "#/components/schemas/PoolStats" } } }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" }
-		}
-	} },
-	"/v1/pool/shutdown-prewarmed": { post: {
-		operationId: "shutdownPrewarmed",
-		summary: "Shutdown pre-warmed containers",
-		description: "Destroys all idle (unassigned) warm containers. Does not affect containers assigned to sandbox instances.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X POST https://$HOST/v1/pool/shutdown-prewarmed \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\""
-		}],
-		responses: {
-			"200": {
-				description: "All pre-warmed containers destroyed.",
-				content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" }
-		}
-	} },
-	"/v1/pool/prime": { post: {
-		operationId: "primePool",
-		summary: "Prime the warm pool",
-		description: "Pushes the current pool configuration and starts the alarm loop. Called automatically by the cron trigger; can also be called manually after deploy.",
-		"x-codeSamples": [{
-			lang: "curl",
-			label: "cURL",
-			source: "curl -X POST https://$HOST/v1/pool/prime \\\n  -H \"Authorization: Bearer $SANDBOX_API_KEY\""
-		}],
-		responses: {
-			"200": {
-				description: "Pool primed successfully.",
-				content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" }
-		}
-	} }
-};
-
-//#endregion
-//#region src/bridge/openapi/processes.ts
-const sandboxIdParameter$1 = {
-	name: "id",
-	in: "path",
-	required: true,
-	schema: { type: "string" },
-	description: "Sandbox instance name."
-};
-const processIdParameter = {
-	name: "processId",
-	in: "path",
-	required: true,
-	schema: { type: "string" }
-};
-const processStatusResponse = {
-	description: "Process status.",
-	content: { "application/json": { schema: { $ref: "#/components/schemas/ProcessStatus" } } }
-};
-const PROCESSESPaths = {
-	"/v1/sandbox/{id}/processes": {
-		post: {
-			operationId: "createProcess",
-			summary: "Launch a sandbox process",
-			parameters: [sandboxIdParameter$1],
-			requestBody: {
-				required: true,
-				content: { "application/json": { schema: { $ref: "#/components/schemas/ProcessCreateRequest" } } }
-			},
-			responses: {
-				"200": processStatusResponse,
-				"400": { $ref: "#/components/responses/InvalidRequest" },
-				"401": { $ref: "#/components/responses/Unauthorized" },
-				"403": { $ref: "#/components/responses/InvalidRequest" },
-				"502": { $ref: "#/components/responses/BadGateway" }
-			}
-		},
-		get: {
-			operationId: "listProcesses",
-			summary: "List sandbox processes",
-			parameters: [sandboxIdParameter$1],
-			responses: {
-				"200": {
-					description: "Process statuses.",
-					content: { "application/json": { schema: {
-						type: "array",
-						items: { $ref: "#/components/schemas/ProcessStatus" }
-					} } }
-				},
-				"401": { $ref: "#/components/responses/Unauthorized" }
-			}
-		}
-	},
-	"/v1/sandbox/{id}/processes/{processId}": { get: {
-		operationId: "getProcess",
-		summary: "Get a sandbox process",
-		parameters: [sandboxIdParameter$1, processIdParameter],
-		responses: {
-			"200": processStatusResponse,
-			"401": { $ref: "#/components/responses/Unauthorized" },
-			"404": { $ref: "#/components/responses/NotFound" }
-		}
-	} },
-	"/v1/sandbox/{id}/processes/{processId}/logs": { get: {
-		operationId: "readProcessLogs",
-		summary: "Stream sandbox process logs",
-		description: "Returns Server-Sent Events. stdout/stderr event data is base64-encoded at the bridge boundary only.",
-		parameters: [
-			sandboxIdParameter$1,
-			processIdParameter,
-			{
-				name: "since",
-				in: "query",
-				schema: { type: "string" }
-			},
-			{
-				name: "replay",
-				in: "query",
-				schema: { type: "boolean" }
-			},
-			{
-				name: "follow",
-				in: "query",
-				schema: { type: "boolean" }
-			}
-		],
-		responses: {
-			"200": {
-				description: "SSE stream of process log events.",
-				content: { "text/event-stream": { schema: { type: "string" } } }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" },
-			"404": { $ref: "#/components/responses/NotFound" }
-		}
-	} },
-	"/v1/sandbox/{id}/processes/{processId}/kill": { post: {
-		operationId: "signalSandboxProcess",
-		summary: "Signal a sandbox process",
-		parameters: [sandboxIdParameter$1, processIdParameter],
-		requestBody: {
-			required: false,
-			content: { "application/json": { schema: {
-				type: "object",
-				properties: { signal: {
-					type: "integer",
-					minimum: 1,
-					maximum: 64,
-					default: 15
-				} }
-			} } }
-		},
-		responses: {
-			"204": { description: "Signal sent." },
-			"400": { $ref: "#/components/responses/InvalidRequest" },
-			"401": { $ref: "#/components/responses/Unauthorized" },
-			"404": { $ref: "#/components/responses/NotFound" }
-		}
-	} },
-	"/v1/sandbox/{id}/tunnel/{port}": {
-		post: {
-			operationId: "createTunnel",
-			summary: "Create or reuse a tunnel for a sandbox port",
-			parameters: [sandboxIdParameter$1, {
-				name: "port",
-				in: "path",
-				required: true,
-				schema: {
-					type: "integer",
-					minimum: 1024,
-					maximum: 65535
-				}
-			}],
-			responses: {
-				"200": { description: "Tunnel created or reused." },
-				"400": { $ref: "#/components/responses/InvalidRequest" },
-				"401": { $ref: "#/components/responses/Unauthorized" },
-				"502": { $ref: "#/components/responses/BadGateway" }
-			}
-		},
-		delete: {
-			operationId: "deleteTunnel",
-			summary: "Delete the tunnel for a sandbox port",
-			parameters: [sandboxIdParameter$1, {
-				name: "port",
-				in: "path",
-				required: true,
-				schema: {
-					type: "integer",
-					minimum: 1024,
-					maximum: 65535
-				}
-			}],
-			responses: {
-				"204": { description: "Tunnel deleted or already absent." },
-				"400": { $ref: "#/components/responses/InvalidRequest" },
-				"401": { $ref: "#/components/responses/Unauthorized" },
-				"502": { $ref: "#/components/responses/BadGateway" }
-			}
-		}
-	},
-	"/v1/sandbox/{id}/running": { get: {
-		operationId: "isSandboxRunning",
-		summary: "Check whether the sandbox container is alive",
-		parameters: [sandboxIdParameter$1],
-		responses: {
-			"200": {
-				description: "Liveness status.",
-				content: { "application/json": { schema: { $ref: "#/components/schemas/RunningResponse" } } }
-			},
-			"401": { $ref: "#/components/responses/Unauthorized" }
-		}
-	} }
-};
-
-//#endregion
-//#region src/bridge/openapi/terminals.ts
-const terminalSnapshotSchema = {
-	type: "object",
-	required: [
-		"id",
-		"command",
-		"status"
-	],
-	properties: {
-		id: { type: "string" },
-		pid: { type: "integer" },
-		command: {
-			type: "array",
-			items: { type: "string" }
-		},
-		cwd: { type: "string" },
-		status: {
-			type: "string",
-			enum: ["running", "exited"]
-		},
-		exit: {
-			type: "object",
-			properties: {
-				code: {
-					type: "integer",
-					nullable: true
-				},
-				signal: { oneOf: [{ type: "string" }, { type: "integer" }] },
-				timedOut: { type: "boolean" }
-			}
-		}
-	}
-};
-const terminalIdParameter = {
-	name: "terminalId",
-	in: "path",
-	required: true,
-	schema: {
-		type: "string",
-		pattern: "^[a-zA-Z0-9._-]{1,128}$"
-	}
-};
-const sandboxIdParameter = {
-	name: "id",
-	in: "path",
-	required: true,
-	schema: { type: "string" },
-	description: "Sandbox instance name."
-};
-const terminalErrorResponses = {
-	"400": {
-		description: "Invalid request.",
-		content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
-	},
-	"401": { $ref: "#/components/responses/Unauthorized" },
-	"502": {
-		description: "Terminal operation failed.",
-		content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
-	}
-};
-const TERMINALSPaths = {
-	"/v1/sandbox/{id}/terminals": {
-		post: {
-			operationId: "createTerminal",
-			summary: "Create a terminal",
-			requestBody: {
-				required: true,
-				content: { "application/json": { schema: {
-					type: "object",
-					required: ["argv"],
-					properties: {
-						argv: {
-							type: "array",
-							items: { type: "string" },
-							minItems: 1
-						},
-						cwd: { type: "string" },
-						env: {
-							type: "object",
-							additionalProperties: { type: "string" }
-						},
-						cols: { type: "integer" },
-						rows: { type: "integer" }
-					}
-				} } }
-			},
-			parameters: [sandboxIdParameter],
-			responses: {
-				"200": {
-					description: "Terminal created with a generated ID.",
-					content: { "application/json": { schema: terminalSnapshotSchema } }
-				},
-				...terminalErrorResponses
-			}
-		},
-		get: {
-			operationId: "listTerminals",
-			summary: "List terminals",
-			parameters: [sandboxIdParameter],
-			responses: {
-				"200": {
-					description: "Terminal snapshots.",
-					content: { "application/json": { schema: {
-						type: "array",
-						items: terminalSnapshotSchema
-					} } }
-				},
-				...terminalErrorResponses
-			}
-		}
-	},
-	"/v1/sandbox/{id}/terminals/{terminalId}": { get: {
-		operationId: "getTerminal",
-		summary: "Get a terminal snapshot",
-		parameters: [sandboxIdParameter, terminalIdParameter],
-		responses: {
-			"200": {
-				description: "Terminal snapshot.",
-				content: { "application/json": { schema: terminalSnapshotSchema } }
-			},
-			"404": { description: "Terminal not found." },
-			...terminalErrorResponses
-		}
-	} },
-	"/v1/sandbox/{id}/terminals/{terminalId}/connect": { get: {
-		operationId: "connectTerminal",
-		summary: "Connect to a terminal WebSocket",
-		description: "WebSocket binary client frames are terminal input bytes. JSON client controls are resize, interrupt, and terminate. Server output is a JSON chunk control immediately followed by one binary frame. Cursor advances after the binary frame is consumed.",
-		parameters: [
-			sandboxIdParameter,
-			terminalIdParameter,
-			{
-				name: "cursor",
-				in: "query",
-				required: false,
-				schema: { type: "string" }
-			},
-			{
-				name: "cols",
-				in: "query",
-				required: false,
-				schema: { type: "integer" }
-			},
-			{
-				name: "rows",
-				in: "query",
-				required: false,
-				schema: { type: "integer" }
-			}
-		],
-		responses: {
-			"101": { description: "WebSocket upgrade successful." },
-			"404": { description: "Terminal not found." },
-			...terminalErrorResponses
-		}
-	} },
-	"/v1/sandbox/{id}/terminals/{terminalId}/interrupt": { post: {
-		operationId: "interruptTerminal",
-		summary: "Interrupt a terminal",
-		parameters: [sandboxIdParameter, terminalIdParameter],
-		responses: {
-			"204": { description: "Interrupt signal sent." },
-			"404": { description: "Terminal not found." },
-			...terminalErrorResponses
-		}
-	} },
-	"/v1/sandbox/{id}/terminals/{terminalId}/terminate": { post: {
-		operationId: "terminateTerminal",
-		summary: "Terminate a terminal",
-		parameters: [sandboxIdParameter, terminalIdParameter],
-		responses: {
-			"204": { description: "Terminate signal sent." },
-			"404": { description: "Terminal not found." },
-			...terminalErrorResponses
-		}
-	} }
-};
-
-//#endregion
-//#region src/bridge/openapi.ts
-const OPENAPI_SCHEMA = {
-	...OPENAPI_BASE,
-	paths: {
-		...LIFECYCLEPaths,
-		...PROCESSESPaths,
-		...FILESPaths,
-		...TERMINALSPaths
-	}
-};
-
-//#endregion
-//#region src/bridge/openapi-html.ts
-/**
-* Renders an OpenAPI 3.x schema object as a self-contained HTML page.
-*
-* No external dependencies — pure HTML/CSS/JS generated server-side.
-* The schema is embedded as JSON and rendered client-side via a small
-* inline script.
-*/
-function renderOpenApiHtml(schema) {
-	const json = JSON.stringify(schema);
-	return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${esc(schema.info?.title ?? "API Reference")}</title>
-  <style>
-    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
-
-    :root {
-      --bg:        #0f1117;
-      --surface:   #1a1d27;
-      --border:    #2a2d3a;
-      --text:      #e2e8f0;
-      --muted:     #8892a4;
-      --accent:    #6366f1;
-      --get:       #22c55e;
-      --post:      #3b82f6;
-      --put:       #f59e0b;
-      --delete:    #ef4444;
-      --patch:     #a855f7;
-      --radius:    6px;
-      --font-mono: ui-monospace, "Cascadia Code", "Fira Code", monospace;
-    }
-
-    body {
-      background: var(--bg);
-      color: var(--text);
-      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-      font-size: 14px;
-      line-height: 1.6;
-      display: flex;
-      min-height: 100vh;
-    }
-
-    /* ── Sidebar ── */
-    #sidebar {
-      width: 260px;
-      min-width: 260px;
-      background: var(--surface);
-      border-right: 1px solid var(--border);
-      padding: 24px 0;
-      position: sticky;
-      top: 0;
-      height: 100vh;
-      overflow-y: auto;
-    }
-    #sidebar h1 {
-      font-size: 13px;
-      font-weight: 600;
-      color: var(--text);
-      padding: 0 20px 16px;
-      border-bottom: 1px solid var(--border);
-      margin-bottom: 12px;
-      white-space: nowrap;
-      overflow: hidden;
-      text-overflow: ellipsis;
-    }
-    #sidebar .version {
-      font-size: 11px;
-      color: var(--muted);
-      font-weight: 400;
-    }
-    .nav-item {
-      display: flex;
-      align-items: center;
-      gap: 10px;
-      padding: 6px 20px;
-      cursor: pointer;
-      border-left: 2px solid transparent;
-      transition: background 0.15s, border-color 0.15s;
-      text-decoration: none;
-      color: var(--muted);
-      font-size: 13px;
-    }
-    .nav-item:hover { background: rgba(255,255,255,0.04); color: var(--text); }
-    .nav-item.active { border-left-color: var(--accent); color: var(--text); background: rgba(99,102,241,0.08); }
-
-    /* ── Main ── */
-    #main {
-      flex: 1;
-      padding: 40px 48px;
-      max-width: 900px;
-    }
-
-    /* ── Info block ── */
-    #info { margin-bottom: 48px; }
-    #info h2 { font-size: 28px; font-weight: 700; margin-bottom: 8px; }
-    #info p  { color: var(--muted); max-width: 680px; }
-    #info .meta { display: flex; gap: 16px; margin-top: 12px; flex-wrap: wrap; }
-    #info .badge {
-      font-size: 11px;
-      padding: 2px 8px;
-      border-radius: 99px;
-      border: 1px solid var(--border);
-      color: var(--muted);
-      font-family: var(--font-mono);
-    }
-
-    /* ── Endpoint card ── */
-    .endpoint {
-      border: 1px solid var(--border);
-      border-radius: var(--radius);
-      margin-bottom: 16px;
-      overflow: hidden;
-    }
-    .endpoint-header {
-      display: flex;
-      align-items: center;
-      gap: 14px;
-      padding: 14px 18px;
-      cursor: pointer;
-      background: var(--surface);
-      user-select: none;
-      transition: background 0.15s;
-    }
-    .endpoint-header:hover { background: #1e2130; }
-    .endpoint-header.open  { background: #1e2130; border-bottom: 1px solid var(--border); }
-
-    .method {
-      font-family: var(--font-mono);
-      font-size: 11px;
-      font-weight: 700;
-      padding: 3px 8px;
-      border-radius: 4px;
-      min-width: 58px;
-      text-align: center;
-      text-transform: uppercase;
-      letter-spacing: 0.05em;
-    }
-    .method-get    { background: rgba(34,197,94,.15);  color: var(--get); }
-    .method-post   { background: rgba(59,130,246,.15); color: var(--post); }
-    .method-put    { background: rgba(245,158,11,.15); color: var(--put); }
-    .method-delete { background: rgba(239,68,68,.15);  color: var(--delete); }
-    .method-patch  { background: rgba(168,85,247,.15); color: var(--patch); }
-
-    .endpoint-path {
-      font-family: var(--font-mono);
-      font-size: 13px;
-      color: var(--text);
-      flex: 1;
-    }
-    .endpoint-summary { font-size: 13px; color: var(--muted); }
-    .chevron { color: var(--muted); font-size: 10px; transition: transform 0.2s; }
-    .endpoint-header.open .chevron { transform: rotate(90deg); }
-
-    /* ── Endpoint body ── */
-    .endpoint-body { padding: 20px 18px; display: none; }
-    .endpoint-body.open { display: block; }
-    .endpoint-desc { color: var(--muted); margin-bottom: 16px; font-size: 13px; }
-
-    /* ── Section labels ── */
-    .section-label {
-      font-size: 11px;
-      font-weight: 600;
-      text-transform: uppercase;
-      letter-spacing: 0.08em;
-      color: var(--muted);
-      margin: 20px 0 10px;
-    }
-    .section-label:first-child { margin-top: 0; }
-
-    /* ── Params table ── */
-    table { width: 100%; border-collapse: collapse; font-size: 13px; }
-    th {
-      text-align: left;
-      padding: 6px 10px;
-      font-weight: 600;
-      font-size: 11px;
-      text-transform: uppercase;
-      letter-spacing: 0.06em;
-      color: var(--muted);
-      border-bottom: 1px solid var(--border);
-    }
-    td {
-      padding: 8px 10px;
-      border-bottom: 1px solid var(--border);
-      vertical-align: top;
-    }
-    tr:last-child td { border-bottom: none; }
-    .param-name  { font-family: var(--font-mono); color: var(--text); }
-    .param-in    { font-size: 11px; color: var(--muted); }
-    .param-type  { font-family: var(--font-mono); font-size: 11px; color: var(--accent); }
-    .required    { color: var(--delete); font-size: 10px; font-weight: 700; margin-left: 4px; }
-
-    /* ── Response rows ── */
-    .response-group { margin-bottom: 4px; border: 1px solid var(--border); border-radius: var(--radius); overflow: hidden; }
-    .response-header {
-      display: flex;
-      align-items: center;
-      gap: 14px;
-      padding: 10px 14px;
-      cursor: pointer;
-      background: var(--surface);
-      user-select: none;
-      transition: background 0.15s;
-      font-size: 13px;
-    }
-    .response-header:hover { background: #1e2130; }
-    .response-header.open { border-bottom: 1px solid var(--border); }
-    .response-detail { padding: 12px 14px; display: none; font-size: 13px; }
-    .response-detail.open { display: block; }
-    .response-detail .section-label { margin-top: 14px; }
-    .response-detail .section-label:first-child { margin-top: 0; }
-    .status-code {
-      font-family: var(--font-mono);
-      font-size: 12px;
-      font-weight: 700;
-      min-width: 40px;
-    }
-    .s2xx { color: var(--get); }
-    .s4xx { color: var(--put); }
-    .s5xx { color: var(--delete); }
-    .response-desc { color: var(--muted); flex: 1; }
-    .response-content-type { font-size: 11px; color: var(--muted); font-family: var(--font-mono); }
-    .resp-chevron { color: var(--muted); font-size: 10px; transition: transform 0.2s; margin-left: auto; }
-    .response-header.open .resp-chevron { transform: rotate(90deg); }
-
-    /* ── Code block ── */
-    pre {
-      background: #0a0c12;
-      border: 1px solid var(--border);
-      border-radius: var(--radius);
-      padding: 14px 16px;
-      font-family: var(--font-mono);
-      font-size: 12px;
-      overflow-x: auto;
-      color: var(--text);
-      margin-top: 8px;
-    }
-    pre.example-block { margin-top: 4px; }
-
-    /* ── Code samples ── */
-    .code-samples { margin-top: 4px; }
-    .code-sample-label {
-      font-size: 11px;
-      font-weight: 600;
-      color: var(--muted);
-      font-family: var(--font-mono);
-      margin-bottom: 2px;
-    }
-  </style>
-</head>
-<body>
-  <nav id="sidebar"><h1 id="nav-title"></h1></nav>
-  <main id="main"><div id="info"></div><div id="endpoints"></div></main>
-
-  <script>
-    const schema = ${json};
-
-    // ── helpers ──────────────────────────────────────────────────────
-    function esc(s) {
-      return String(s ?? '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
-    }
-    function el(tag, attrs, ...children) {
-      const e = document.createElement(tag);
-      for (const [k, v] of Object.entries(attrs ?? {})) {
-        if (k === 'class') e.className = v;
-        else if (k === 'html') e.innerHTML = v;
-        else e.setAttribute(k, v);
-      }
-      for (const c of children) {
-        if (c == null) continue;
-        e.append(typeof c === 'string' ? document.createTextNode(c) : c);
-      }
-      return e;
-    }
-    function statusClass(code) {
-      const n = parseInt(code);
-      if (n >= 500) return 's5xx';
-      if (n >= 400) return 's4xx';
-      return 's2xx';
-    }
-    function schemaType(s) {
-      if (!s) return '';
-      if (s.$ref) return s.$ref.split('/').pop();
-      if (s.type === 'array') return s.items ? schemaType(s.items) + '[]' : 'array';
-      return s.format ? s.type + '<' + s.format + '>' : (s.type ?? '');
-    }
-    function resolveRef(ref) {
-      const parts = ref.replace(/^#\\//, '').split('/');
-      return parts.reduce((o, k) => o?.[k], schema);
-    }
-    function resolveResponse(resp) {
-      return resp?.$ref ? resolveRef(resp.$ref) : resp;
-    }
-
-    // ── info ─────────────────────────────────────────────────────────
-    const info = schema.info ?? {};
-    document.title = info.title ?? 'API Reference';
-    document.getElementById('nav-title').innerHTML =
-      esc(info.title ?? 'API Reference') +
-      (info.version ? \` <span class="version">v\${esc(info.version)}</span>\` : '');
-
-    const infoEl = document.getElementById('info');
-    infoEl.append(
-      el('h2', {}, info.title ?? 'API Reference'),
-      el('div', {class:'meta'},
-        info.version ? el('span', {class:'badge'}, 'v' + info.version) : null,
-        el('span', {class:'badge'}, 'OpenAPI ' + (schema.openapi ?? '3.x')),
-      ),
-      info.description ? el('p', {html: esc(info.description).replace(/\`([^\`]+)\`/g, '<code>$1</code>')}) : null,
-    );
-
-    // ── endpoints ────────────────────────────────────────────────────
-    const container = document.getElementById('endpoints');
-    const nav = document.getElementById('sidebar');
-    const methods = ['get','post','put','patch','delete'];
-
-    for (const [path, pathItem] of Object.entries(schema.paths ?? {})) {
-      for (const method of methods) {
-        const op = pathItem[method];
-        if (!op) continue;
-
-        const id = method + '_' + path.replace(/[^a-z0-9]/gi, '_');
-
-        // nav link
-        const navLink = el('a', {class:'nav-item', href:'#'+id});
-        navLink.append(
-          el('span', {class:'method method-'+method}, method),
-          el('span', {}, path),
-        );
-        nav.append(navLink);
-
-        // card header
-        const header = el('div', {class:'endpoint-header', id});
-        header.append(
-          el('span', {class:'method method-'+method}, method),
-          el('span', {class:'endpoint-path'}, path),
-          op.summary ? el('span', {class:'endpoint-summary'}, op.summary) : null,
-          el('span', {class:'chevron'}, '▶'),
-        );
-
-        // card body
-        const body = el('div', {class:'endpoint-body'});
-
-        if (op.description) {
-          body.append(el('p', {class:'endpoint-desc', html:
-            esc(op.description).replace(/\`([^\`]+)\`/g,'<code>$1</code>')}));
-        }
-
-        // parameters
-        const params = op.parameters ?? [];
-        if (params.length) {
-          body.append(el('div', {class:'section-label'}, 'Parameters'));
-          const tbl = el('table', {});
-          tbl.append(el('thead', {}, el('tr', {},
-            el('th',{},'Name'), el('th',{},'In'), el('th',{},'Type'), el('th',{},'Description')
-          )));
-          const tbody = el('tbody', {});
-          for (const p of params) {
-            const nameCell = el('td', {class:'param-name'}, p.name);
-            if (p.required) nameCell.append(el('span', {class:'required'}, '*'));
-            tbody.append(el('tr', {},
-              nameCell,
-              el('td', {class:'param-in'}, p.in),
-              el('td', {class:'param-type'}, schemaType(p.schema)),
-              el('td', {class:'response-desc'}, p.description ?? ''),
-            ));
-          }
-          tbl.append(tbody);
-          body.append(tbl);
-        }
-
-        // request body
-        if (op.requestBody) {
-          body.append(el('div', {class:'section-label'}, 'Request Body'));
-          const content = op.requestBody.content ?? {};
-          for (const [ct, media] of Object.entries(content)) {
-            body.append(el('div', {class:'param-in'}, ct));
-            if (media.schema) {
-              const resolved = media.schema.$ref ? resolveRef(media.schema.$ref) : media.schema;
-              if (resolved?.properties) {
-                const tbl = el('table', {});
-                tbl.append(el('thead', {}, el('tr', {},
-                  el('th',{},'Field'), el('th',{},'Type'), el('th',{},'Description')
-                )));
-                const tbody = el('tbody', {});
-                const required = new Set(resolved.required ?? []);
-                for (const [name, prop] of Object.entries(resolved.properties)) {
-                  const nameCell = el('td', {class:'param-name'}, name);
-                  if (required.has(name)) nameCell.append(el('span', {class:'required'}, '*'));
-                  tbody.append(el('tr', {},
-                    nameCell,
-                    el('td', {class:'param-type'}, schemaType(prop)),
-                    el('td', {class:'response-desc'}, prop.description ?? ''),
-                  ));
-                }
-                tbl.append(tbody);
-                body.append(tbl);
-              }
-            }
-          }
-        }
-
-        // responses
-        if (op.responses) {
-          body.append(el('div', {class:'section-label'}, 'Responses'));
-          const wrap = el('div', {});
-          for (const [code, resp] of Object.entries(op.responses)) {
-            const resolved = resolveResponse(resp);
-            const hasContent = resolved?.content && Object.keys(resolved.content).length > 0;
-
-            const group = el('div', {class:'response-group'});
-            const respHeader = el('div', {class:'response-header'});
-            respHeader.append(
-              el('span', {class:'status-code ' + statusClass(code)}, code),
-              el('span', {class:'response-desc'}, resolved?.description ?? ''),
-              hasContent ? el('span', {class:'resp-chevron'}, '\u25B6') : null,
-            );
-            group.append(respHeader);
-
-            if (hasContent) {
-              const detail = el('div', {class:'response-detail'});
-              for (const [ct, media] of Object.entries(resolved.content)) {
-                detail.append(el('div', {class:'response-content-type'}, ct));
-
-                // Render response schema fields
-                if (media.schema) {
-                  const resolvedSchema = media.schema.$ref ? resolveRef(media.schema.$ref) : media.schema;
-                  if (resolvedSchema?.properties) {
-                    detail.append(el('div', {class:'section-label'}, 'Schema'));
-                    const tbl = el('table', {});
-                    tbl.append(el('thead', {}, el('tr', {},
-                      el('th',{},'Field'), el('th',{},'Type'), el('th',{},'Description')
-                    )));
-                    const tbody = el('tbody', {});
-                    const required = new Set(resolvedSchema.required ?? []);
-                    for (const [name, prop] of Object.entries(resolvedSchema.properties)) {
-                      const nameCell = el('td', {class:'param-name'}, name);
-                      if (required.has(name)) nameCell.append(el('span', {class:'required'}, '*'));
-                      tbody.append(el('tr', {},
-                        nameCell,
-                        el('td', {class:'param-type'}, schemaType(prop)),
-                        el('td', {class:'response-desc'}, prop.description ?? ''),
-                      ));
-                    }
-                    tbl.append(tbody);
-                    detail.append(tbl);
-                  }
-                }
-
-                // Render response example
-                if (media.example !== undefined) {
-                  detail.append(el('div', {class:'section-label'}, 'Example'));
-                  detail.append(el('pre', {class:'example-block'}, JSON.stringify(media.example, null, 2)));
-                }
-                if (media.examples) {
-                  detail.append(el('div', {class:'section-label'}, 'Examples'));
-                  for (const [exName, exObj] of Object.entries(media.examples)) {
-                    const val = exObj?.value ?? exObj;
-                    detail.append(el('pre', {class:'example-block'}, '// ' + exName + '\\n' + JSON.stringify(val, null, 2)));
-                  }
-                }
-              }
-
-              respHeader.addEventListener('click', () => {
-                const open = respHeader.classList.toggle('open');
-                detail.classList.toggle('open', open);
-              });
-              group.append(detail);
-            }
-
-            wrap.append(group);
-          }
-          body.append(wrap);
-        }
-
-        // x-codeSamples
-        const samples = op['x-codeSamples'];
-        if (samples && samples.length) {
-          body.append(el('div', {class:'section-label'}, 'Example'));
-          const samplesWrap = el('div', {class:'code-samples'});
-          for (const sample of samples) {
-            samplesWrap.append(
-              el('div', {class:'code-sample-label'}, sample.label ?? sample.lang ?? 'Example'),
-              el('pre', {}, sample.source),
-            );
-          }
-          body.append(samplesWrap);
-        }
-
-        // toggle
-        header.addEventListener('click', () => {
-          const open = header.classList.toggle('open');
-          body.classList.toggle('open', open);
-          // sync nav highlight
-          document.querySelectorAll('.nav-item').forEach(n => n.classList.remove('active'));
-          if (open) navLink.classList.add('active');
-        });
-
-        const card = el('div', {class:'endpoint'});
-        card.append(header, body);
-        container.append(card);
-      }
-    }
-
-    // highlight nav on scroll
-    const observer = new IntersectionObserver(entries => {
-      for (const entry of entries) {
-        if (entry.isIntersecting) {
-          const id = entry.target.id;
-          document.querySelectorAll('.nav-item').forEach(n => {
-            n.classList.toggle('active', n.getAttribute('href') === '#' + id);
-          });
-        }
-      }
-    }, { threshold: 0.5 });
-    document.querySelectorAll('.endpoint-header[id]').forEach(h => observer.observe(h));
-  <\/script>
-</body>
-</html>`;
-}
-function esc(s) {
-	return String(s ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-
-//#endregion
-//#region src/bridge/routes/common.ts
-function getSandbox(ns, containerUUID) {
-	return getSandbox$1(ns, containerUUID);
-}
-function getSandboxNs(env$1, sandboxBinding) {
-	return env$1[sandboxBinding];
-}
-function getWarmPoolNs(env$1, warmPoolBinding) {
-	return env$1[warmPoolBinding];
-}
-function getWarmPoolStub(env$1, warmPoolBinding) {
-	const poolNs = getWarmPoolNs(env$1, warmPoolBinding);
-	const poolId = poolNs.idFromName("global-pool");
-	return poolNs.get(poolId);
-}
-function hasEndpoint(options) {
-	return "endpoint" in options && typeof options.endpoint === "string";
-}
-function hasEndpointProperty(options) {
-	return "endpoint" in options && options.endpoint !== void 0;
-}
-function hasCredentials(options) {
-	return "credentials" in options && options.credentials !== void 0;
-}
-function isStringArray(value) {
-	return Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function parseTunnelOptions(rawBody) {
-	if (!rawBody.trim()) return void 0;
-	let body;
-	try {
-		body = JSON.parse(rawBody);
-	} catch {
-		return errorJson("Invalid JSON body", "invalid_request", 400);
-	}
-	if (!body || typeof body !== "object" || Array.isArray(body) || body.name === void 0) return;
-	if (typeof body.name !== "string") return errorJson("name must be a string when provided", "invalid_request", 400);
-	try {
-		validateTunnelName(body.name);
-	} catch (err) {
-		if (err instanceof SandboxSecurityError) return errorJson(err.message, "invalid_request", 400);
-		throw err;
-	}
-	return { name: body.name };
-}
-function validateMountOptions(options, binding) {
-	if ("endpoint" in options && !hasEndpoint(options)) return errorJson("options.endpoint must be a string when provided", "invalid_request", 400);
-	if (binding !== void 0 && typeof binding !== "string") return errorJson("binding must be a string when provided", "invalid_request", 400);
-	if (binding === "") return errorJson("binding must be a non-empty string when provided", "invalid_request", 400);
-	if (binding !== void 0 && hasEndpointProperty(options)) return errorJson("Provide either binding or options.endpoint, not both", "invalid_request", 400);
-	if (options.s3fsOptions !== void 0 && !isStringArray(options.s3fsOptions)) return errorJson("options.s3fsOptions must be an array of strings when provided", "invalid_request", 400);
-	if (options.readOnly !== void 0 && typeof options.readOnly !== "boolean") return errorJson("options.readOnly must be a boolean when provided", "invalid_request", 400);
-	if (options.prefix !== void 0 && typeof options.prefix !== "string") return errorJson("options.prefix must be a string when provided", "invalid_request", 400);
-	if ("credentialProxy" in options && options.credentialProxy !== void 0 && typeof options.credentialProxy !== "boolean") return errorJson("options.credentialProxy must be a boolean when provided", "invalid_request", 400);
-	if ("credentials" in options && options.credentials !== void 0 && (typeof options.credentials !== "object" || options.credentials === null || typeof options.credentials.accessKeyId !== "string" || typeof options.credentials.secretAccessKey !== "string")) return errorJson("options.credentials must include string accessKeyId and secretAccessKey", "invalid_request", 400);
-	return null;
-}
-function resolveMountBucketName(body) {
-	if (hasEndpoint(body.options)) {
-		if (body.bucket && typeof body.bucket === "string") return body.bucket;
-		return errorJson("bucket must be a non-empty string for remote mounts", "invalid_request", 400);
-	}
-	if (body.binding !== void 0) return body.binding;
-	return errorJson("binding must be a non-empty string for R2 binding mounts", "invalid_request", 400);
-}
-function toSDKMountOptions(options) {
-	if (hasEndpoint(options)) {
-		const remoteOptions = { endpoint: options.endpoint };
-		if (options.readOnly !== void 0) remoteOptions.readOnly = options.readOnly;
-		if (options.prefix !== void 0) remoteOptions.prefix = options.prefix;
-		if (hasCredentials(options)) remoteOptions.credentials = {
-			accessKeyId: options.credentials.accessKeyId,
-			secretAccessKey: options.credentials.secretAccessKey
-		};
-		if (options.s3fsOptions !== void 0) remoteOptions.s3fsOptions = options.s3fsOptions;
-		if ("credentialProxy" in options && typeof options.credentialProxy === "boolean") remoteOptions.credentialProxy = options.credentialProxy;
-		return remoteOptions;
-	}
-	const r2BindingOptions = {};
-	if (options.readOnly !== void 0) r2BindingOptions.readOnly = options.readOnly;
-	if (options.prefix !== void 0) r2BindingOptions.prefix = options.prefix;
-	if (options.s3fsOptions !== void 0) r2BindingOptions.s3fsOptions = options.s3fsOptions;
-	return r2BindingOptions;
-}
-
-//#endregion
-//#region src/bridge/routes/files.ts
-function registerFileRoutes(app, apiPrefix, sandboxBinding) {
-	app.get(`${apiPrefix}/sandbox/:id/file/*`, async (c) => {
-		const sandboxId = c.req.param("id");
-		const fullPath = c.req.path;
-		const marker = `${apiPrefix}/sandbox/${sandboxId}/file/`;
-		const relativePath = fullPath.slice(marker.length);
-		if (!relativePath) return errorJson("file path must not be empty", "invalid_request", 400);
-		const resolvedPath = resolveWorkspacePath(`/${relativePath}`);
-		if (!resolvedPath) return errorJson("path must resolve to a location within /workspace", "invalid_request", 403);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const stream = await sandbox.readFileStream(resolvedPath);
-			return new Response(sseToByteStream(stream), {
-				status: 200,
-				headers: { "Content-Type": "application/octet-stream" }
-			});
-		} catch (err) {
-			if (err.code === "FILE_NOT_FOUND") return errorJson(`File not found: ${resolvedPath}`, "workspace_read_not_found", 404);
-			return errorJson(`read failed: ${err instanceof Error ? err.message : String(err)}`, "exec_transport_error", 502);
-		}
-	});
-	app.put(`${apiPrefix}/sandbox/:id/file/*`, async (c) => {
-		const sandboxId = c.req.param("id");
-		const fullPath = c.req.path;
-		const marker = `${apiPrefix}/sandbox/${sandboxId}/file/`;
-		const relativePath = fullPath.slice(marker.length);
-		if (!relativePath) return errorJson("file path must not be empty", "invalid_request", 400);
-		const resolvedPath = resolveWorkspacePath(`/${relativePath}`);
-		if (!resolvedPath) return errorJson("path must resolve to a location within /workspace", "invalid_request", 403);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const buffer = await c.req.arrayBuffer();
-			const MAX_WRITE_BYTES = 32 * 1024 * 1024;
-			if (buffer.byteLength > MAX_WRITE_BYTES) return errorJson(`payload too large: ${buffer.byteLength} bytes exceeds the ${MAX_WRITE_BYTES}-byte limit`, "payload_too_large", 413);
-			const bytes = new Uint8Array(buffer);
-			let b64 = "";
-			const CHUNK = 6144;
-			for (let i = 0; i < bytes.length; i += CHUNK) b64 += btoa(String.fromCharCode(...bytes.subarray(i, i + CHUNK)));
-			await sandbox.writeFile(resolvedPath, b64, { encoding: "base64" });
-			return c.json({ ok: true });
-		} catch (err) {
-			return errorJson(`write failed: ${err instanceof Error ? err.message : String(err)}`, "workspace_archive_write_error", 502);
-		}
-	});
-}
-
-//#endregion
-//#region src/bridge/routes/lifecycle.ts
-function registerLifecycleRoutes(app, apiPrefix, healthPath, sandboxBinding, warmPoolBinding) {
-	app.post(`${apiPrefix}/sandbox`, (c) => {
-		const bytes = new Uint8Array(15);
-		crypto.getRandomValues(bytes);
-		return c.json({ id: base32Encode(bytes) });
-	});
-	app.post(`${apiPrefix}/sandbox/:id/persist`, async (c) => {
-		const root = "/workspace";
-		const excludesParam = c.req.query("excludes") ?? "";
-		const excludes = excludesParam ? excludesParam.split(",").filter((s) => s.length > 0) : [];
-		for (const ex of excludes) if (ex.includes("..")) return errorJson("exclude paths must not contain \"..\"", "invalid_request", 400);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const archivePath = await sandbox.createWorkspaceArchive({
-				root,
-				excludes
-			});
-			let stream;
-			try {
-				stream = await sandbox.readFileStream(archivePath);
-			} catch (error) {
-				await sandbox.cleanupWorkspaceArchive(archivePath).catch(() => void 0);
-				throw error;
-			}
-			const cleanupPath = archivePath;
-			const responseStream = withStreamCleanup(sseToByteStream(stream), () => sandbox.cleanupWorkspaceArchive(cleanupPath));
-			return new Response(responseStream, {
-				status: 200,
-				headers: { "Content-Type": "application/octet-stream" }
-			});
-		} catch (err) {
-			return errorJson(`persist failed: ${err instanceof Error ? err.message : String(err)}`, "workspace_archive_read_error", 502);
-		}
-	});
-	app.post(`${apiPrefix}/sandbox/:id/hydrate`, async (c) => {
-		const root = "/workspace";
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		let tarBytes;
-		try {
-			const buffer = await c.req.arrayBuffer();
-			tarBytes = new Uint8Array(buffer);
-		} catch {
-			return errorJson("Could not read request body", "invalid_request", 400);
-		}
-		if (tarBytes.byteLength === 0) return errorJson("Empty tar payload", "invalid_request", 400);
-		const MAX_HYDRATE_BYTES = 32 * 1024 * 1024;
-		if (tarBytes.byteLength > MAX_HYDRATE_BYTES) return errorJson(`tar payload too large: ${tarBytes.byteLength} bytes exceeds the ${MAX_HYDRATE_BYTES}-byte limit`, "invalid_request", 400);
-		const tmpPath = `/tmp/sandbox-hydrate-${Date.now()}-${crypto.randomUUID()}.tar`;
-		try {
-			let b64 = "";
-			const CHUNK = 6144;
-			for (let i = 0; i < tarBytes.length; i += CHUNK) b64 += btoa(String.fromCharCode(...tarBytes.subarray(i, i + CHUNK)));
-			await sandbox.writeFile(tmpPath, b64, { encoding: "base64" });
-			await sandbox.extractWorkspaceArchive({
-				root,
-				archivePath: tmpPath
-			});
-			return c.json({ ok: true });
-		} catch (err) {
-			return errorJson(`hydrate failed: ${err instanceof Error ? err.message : String(err)}`, "workspace_archive_write_error", 502);
-		} finally {
-			await sandbox.cleanupWorkspaceArchive(tmpPath).catch(() => void 0);
-		}
-	});
-	app.post(`${apiPrefix}/sandbox/:id/mount`, async (c) => {
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return errorJson("Invalid JSON body", "invalid_request", 400);
-		}
-		if (body.bucket !== void 0 && (typeof body.bucket !== "string" || body.bucket === "")) return errorJson("bucket must be a non-empty string", "invalid_request", 400);
-		if (!body.mountPath || typeof body.mountPath !== "string") return errorJson("mountPath must be a non-empty string", "invalid_request", 400);
-		if (!body.mountPath.startsWith("/")) return errorJson("mountPath must be an absolute path (start with /)", "invalid_request", 400);
-		if (!body.options || typeof body.options !== "object" || Array.isArray(body.options)) return errorJson("options must be an object", "invalid_request", 400);
-		const optionsError = validateMountOptions(body.options, body.binding);
-		if (optionsError) return optionsError;
-		const bucketName = resolveMountBucketName(body);
-		if (bucketName instanceof Response) return bucketName;
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		const sdkOptions = toSDKMountOptions(body.options);
-		try {
-			await sandbox.mountBucket(bucketName, body.mountPath, sdkOptions);
-			return c.json({ ok: true });
-		} catch (err) {
-			return errorJson(`mount failed: ${err instanceof Error ? err.message : String(err)}`, "mount_error", 502);
-		}
-	});
-	app.post(`${apiPrefix}/sandbox/:id/unmount`, async (c) => {
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return errorJson("Invalid JSON body", "invalid_request", 400);
-		}
-		if (!body.mountPath || typeof body.mountPath !== "string") return errorJson("mountPath must be a non-empty string", "invalid_request", 400);
-		if (!body.mountPath.startsWith("/")) return errorJson("mountPath must be an absolute path (start with /)", "invalid_request", 400);
-		const normalizedPath = new URL(body.mountPath, "file:///").pathname;
-		if (normalizedPath === "/") return errorJson("mountPath must not resolve to / (filesystem root)", "invalid_request", 400);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			await sandbox.unmountBucket(normalizedPath);
-			try {
-				await sandbox.cleanupMountDirectory(normalizedPath);
-			} catch {}
-			return c.json({ ok: true });
-		} catch (err) {
-			return errorJson(`unmount failed: ${err instanceof Error ? err.message : String(err)}`, "unmount_error", 502);
-		}
-	});
-	app.delete(`${apiPrefix}/sandbox/:id`, async (c) => {
-		const containerUUID = c.get("containerUUID");
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), containerUUID);
-		try {
-			await sandbox.destroy();
-		} catch {}
-		try {
-			await getWarmPoolStub(c.env, warmPoolBinding).reportStopped(containerUUID);
-		} catch {}
-		return new Response(null, { status: 204 });
-	});
-	app.get(healthPath, (c) => {
-		const errors = [];
-		if (!c.env[sandboxBinding]) errors.push(`Missing required Durable Object binding "${sandboxBinding}". Ensure your wrangler.jsonc has a binding named "${sandboxBinding}".`);
-		if (!c.env[warmPoolBinding]) errors.push(`Missing required Durable Object binding "${warmPoolBinding}". Ensure your wrangler.jsonc has a binding named "${warmPoolBinding}".`);
-		if (errors.length > 0) return c.json({
-			ok: false,
-			errors
-		}, 503);
-		return c.json({ ok: true });
-	});
-	app.use(`${apiPrefix}/pool/*`, async (c, next) => {
-		const token = c.env.SANDBOX_API_KEY;
-		if (token) {
-			const authHeader = c.req.header("Authorization") ?? "";
-			if ((authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "") !== token) return errorJson("Unauthorized", "unauthorized", 401);
-		}
-		return next();
-	});
-	app.get(`${apiPrefix}/pool/stats`, async (c) => {
-		const warmTarget = Number.parseInt(c.env.WARM_POOL_TARGET || "0", 10) || 0;
-		const refreshInterval = Number.parseInt(c.env.WARM_POOL_REFRESH_INTERVAL || "10000", 10) || 1e4;
-		const poolStub = getWarmPoolStub(c.env, warmPoolBinding);
-		try {
-			await poolStub.configure({
-				warmTarget,
-				refreshInterval
-			});
-		} catch {}
-		const stats = await poolStub.getStats();
-		return c.json(stats);
-	});
-	app.post(`${apiPrefix}/pool/shutdown-prewarmed`, async (c) => {
-		const warmTarget = Number.parseInt(c.env.WARM_POOL_TARGET || "0", 10) || 0;
-		const refreshInterval = Number.parseInt(c.env.WARM_POOL_REFRESH_INTERVAL || "10000", 10) || 1e4;
-		const poolStub = getWarmPoolStub(c.env, warmPoolBinding);
-		try {
-			await poolStub.configure({
-				warmTarget,
-				refreshInterval
-			});
-		} catch {}
-		await poolStub.shutdownPrewarmed();
-		return c.json({ ok: true });
-	});
-	app.post(`${apiPrefix}/pool/prime`, async (c) => {
-		await primePool(c.env, warmPoolBinding);
-		return c.json({ ok: true });
-	});
-}
-
-//#endregion
-//#region src/bridge/routes/processes.ts
-function registerProcessRoutes(app, apiPrefix, sandboxBinding) {
-	app.post(`${apiPrefix}/sandbox/:id/processes`, async (c) => {
-		const body = await parseProcessRequest(c.req.raw);
-		if (body instanceof Response) return body;
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		const options = processOptions(body);
-		if (options instanceof Response) return options;
-		try {
-			const process = await sandbox.exec(body.argv, options);
-			return c.json(await process.status());
-		} catch (err) {
-			return errorJson(`process launch failed: ${err instanceof Error ? err.message : String(err)}`, "process_error", 502);
-		}
-	});
-	app.get(`${apiPrefix}/sandbox/:id/processes`, async (c) => {
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		return c.json(await sandbox.listProcesses());
-	});
-	app.get(`${apiPrefix}/sandbox/:id/processes/:processId`, async (c) => {
-		const process = await getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID")).getProcess(c.req.param("processId"));
-		if (!process) return errorJson("Process not found", "not_found", 404);
-		return c.json(await process.status());
-	});
-	app.get(`${apiPrefix}/sandbox/:id/processes/:processId/logs`, async (c) => {
-		const process = await getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID")).getProcess(c.req.param("processId"));
-		if (!process) return errorJson("Process not found", "not_found", 404);
-		const replay = parseBoolean(c.req.query("replay"));
-		const follow = parseBoolean(c.req.query("follow"));
-		const logs = await process.logs({
-			since: c.req.query("since"),
-			replay,
-			follow
-		});
-		return new Response(processLogsToSSE(logs), { headers: {
-			"Content-Type": "text/event-stream",
-			"Cache-Control": "no-cache"
-		} });
-	});
-	app.post(`${apiPrefix}/sandbox/:id/processes/:processId/kill`, async (c) => {
-		const process = await getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID")).getProcess(c.req.param("processId"));
-		if (!process) return errorJson("Process not found", "not_found", 404);
-		const signal = await parseKillRequest(c.req.raw);
-		if (signal instanceof Response) return signal;
-		await process.kill(signal);
-		return c.body(null, 204);
-	});
-	app.post(`${apiPrefix}/sandbox/:id/tunnel/:port`, async (c) => {
-		const port = Number(c.req.param("port"));
-		if (!validatePort(port)) return errorJson("Invalid port", "invalid_request", 400);
-		const options = parseTunnelOptions(await c.req.text());
-		if (options instanceof Response) return options;
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const tunnel = await sandbox.tunnels.get(port, options);
-			return c.json(tunnel);
-		} catch (err) {
-			return errorJson(`tunnel failed: ${err instanceof Error ? err.message : String(err)}`, "tunnel_error", 502);
-		}
-	});
-	app.delete(`${apiPrefix}/sandbox/:id/tunnel/:port`, async (c) => {
-		const port = Number(c.req.param("port"));
-		if (!validatePort(port)) return errorJson("Invalid port", "invalid_request", 400);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			await sandbox.tunnels.destroy(port);
-			return c.body(null, 204);
-		} catch (err) {
-			return errorJson(`tunnel failed: ${err instanceof Error ? err.message : String(err)}`, "tunnel_error", 502);
-		}
-	});
-	app.get(`${apiPrefix}/sandbox/:id/running`, async (c) => {
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const response = { running: await sandbox.isRuntimeActive() };
-			return c.json(response);
-		} catch {
-			return c.json({ running: false });
-		}
-	});
-}
-async function parseProcessRequest(request) {
-	let body;
-	try {
-		body = await request.json();
-	} catch {
-		return errorJson("Invalid JSON body", "invalid_request", 400);
-	}
-	if (!Array.isArray(body.argv) || body.argv.length === 0) return errorJson("argv must be a non-empty array", "invalid_request", 400);
-	if (body.argv.some((item) => typeof item !== "string")) return errorJson("argv items must be strings", "invalid_request", 400);
-	if (body.argv[0].length === 0) return errorJson("argv executable must be non-empty", "invalid_request", 400);
-	return body;
-}
-function processOptions(body) {
-	const options = {};
-	if (body.timeout !== void 0) {
-		if (typeof body.timeout !== "number" || !Number.isFinite(body.timeout) || body.timeout <= 0) return errorJson("timeout must be a positive finite number", "invalid_request", 400);
-		options.timeout = body.timeout;
-	}
-	if (typeof body.cwd === "string") {
-		const cwd = resolveWorkspacePath(body.cwd);
-		if (!cwd) return errorJson("cwd must resolve to a location within /workspace", "invalid_request", 403);
-		options.cwd = cwd;
-	}
-	if ("env" in body && body.env !== void 0) {
-		if (!isStringRecord(body.env)) return errorJson("env must be an object of strings", "invalid_request", 400);
-		options.env = body.env;
-	}
-	return options;
-}
-async function parseKillRequest(request) {
-	if (!request.headers.get("content-type")) return 15;
-	let body;
-	try {
-		body = await request.json();
-	} catch {
-		return errorJson("Invalid JSON body", "invalid_request", 400);
-	}
-	if (typeof body !== "object" || body === null || Array.isArray(body)) return errorJson("Request body must be an object", "invalid_request", 400);
-	const signal = body.signal;
-	if (signal === void 0) return 15;
-	if (typeof signal !== "number" || !Number.isInteger(signal) || signal < 1 || signal > 64) return errorJson("signal must be an integer between 1 and 64", "invalid_request", 400);
-	return signal;
-}
-function parseBoolean(value) {
-	if (value === void 0) return void 0;
-	return value === "true" || value === "1";
-}
-function isStringRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
-}
-function processLogsToSSE(logs) {
-	const reader = logs.getReader();
-	const encoder = new TextEncoder();
-	let finished = false;
-	async function finish(cancelSource) {
-		if (finished) return;
-		finished = true;
-		if (cancelSource) await reader.cancel().catch(() => void 0);
-		reader.releaseLock();
-	}
-	return new ReadableStream({
-		async pull(controller) {
-			try {
-				const result = await reader.read();
-				if (result.done) {
-					await finish(false);
-					controller.close();
-					return;
-				}
-				const event = result.value;
-				const data = event.type === "stdout" || event.type === "stderr" ? {
-					type: event.type,
-					cursor: event.cursor,
-					timestamp: event.timestamp,
-					data: bytesToBase64(event.data)
-				} : event;
-				controller.enqueue(encoder.encode(`data: ${JSON.stringify(data)}\n\n`));
-			} catch (error) {
-				await finish(true);
-				controller.error(error);
-			}
-		},
-		async cancel() {
-			await finish(true);
-		}
-	}, { highWaterMark: 0 });
-}
-function bytesToBase64(data) {
-	let binary = "";
-	for (const byte of data) binary += String.fromCharCode(byte);
-	return btoa(binary);
-}
-
-//#endregion
-//#region src/bridge/routes/terminals.ts
-function parsePositiveInteger(value, name) {
-	if (value === void 0) return void 0;
-	const parsed = Number(value);
-	if (!Number.isInteger(parsed) || parsed <= 0) return errorJson(`${name} must be a positive integer`, "invalid_request", 400);
-	return parsed;
-}
-function isSandboxCommand(value) {
-	return Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string");
-}
-function parseCreateTerminalBody(rawBody) {
-	let body;
-	try {
-		body = JSON.parse(rawBody);
-	} catch {
-		return errorJson("Invalid JSON body", "invalid_request", 400);
-	}
-	if (!body || typeof body !== "object" || Array.isArray(body)) return errorJson("Request body must be an object", "invalid_request", 400);
-	const record = body;
-	const argv = record.argv;
-	if (!isSandboxCommand(argv)) return errorJson("argv must be a non-empty string array", "invalid_request", 400);
-	const options = { command: argv };
-	if (record.cwd !== void 0) {
-		if (typeof record.cwd !== "string") return errorJson("cwd must be a string", "invalid_request", 400);
-		options.cwd = record.cwd;
-	}
-	if (record.env !== void 0) {
-		if (!record.env || typeof record.env !== "object" || Array.isArray(record.env)) return errorJson("env must be an object", "invalid_request", 400);
-		const env$1 = {};
-		for (const [key, value] of Object.entries(record.env)) {
-			if (typeof value !== "string") return errorJson("env values must be strings", "invalid_request", 400);
-			env$1[key] = value;
-		}
-		options.env = env$1;
-	}
-	if (record.cols !== void 0) {
-		if (typeof record.cols !== "number" || !Number.isInteger(record.cols) || record.cols <= 0) return errorJson("cols must be a positive integer", "invalid_request", 400);
-		options.cols = record.cols;
-	}
-	if (record.rows !== void 0) {
-		if (typeof record.rows !== "number" || !Number.isInteger(record.rows) || record.rows <= 0) return errorJson("rows must be a positive integer", "invalid_request", 400);
-		options.rows = record.rows;
-	}
-	return options;
-}
-function terminalError(error) {
-	return errorJson(`terminal failed: ${error instanceof Error ? error.message : String(error)}`, "exec_transport_error", 502);
-}
-function registerTerminalRoutes(app, apiPrefix, sandboxBinding) {
-	app.post(`${apiPrefix}/sandbox/:id/terminals`, async (c) => {
-		const parsed = parseCreateTerminalBody(await c.req.text());
-		if (parsed instanceof Response) return parsed;
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const terminal = await sandbox.createTerminal(parsed);
-			return c.json(await terminal.getSnapshot());
-		} catch (error) {
-			return terminalError(error);
-		}
-	});
-	app.get(`${apiPrefix}/sandbox/:id/terminals`, async (c) => {
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const terminals = await sandbox.listTerminals();
-			return c.json(await Promise.all(terminals.map((terminal) => terminal.getSnapshot())));
-		} catch (error) {
-			return terminalError(error);
-		}
-	});
-	app.get(`${apiPrefix}/sandbox/:id/terminals/:terminalId`, async (c) => {
-		const terminalId = validateTerminalId(c.req.param("terminalId"));
-		if (!terminalId) return errorJson("Invalid terminal ID format", "invalid_request", 400);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const terminal = await sandbox.getTerminal(terminalId);
-			if (!terminal) return errorJson("Terminal not found", "not_found", 404);
-			return c.json(await terminal.getSnapshot());
-		} catch (error) {
-			return terminalError(error);
-		}
-	});
-	app.get(`${apiPrefix}/sandbox/:id/terminals/:terminalId/connect`, async (c) => {
-		const upgrade = c.req.header("Upgrade");
-		if (!upgrade || upgrade.toLowerCase() !== "websocket") return errorJson("WebSocket upgrade required", "invalid_request", 400);
-		const terminalId = validateTerminalId(c.req.param("terminalId"));
-		if (!terminalId) return errorJson("Invalid terminal ID format", "invalid_request", 400);
-		const cols = parsePositiveInteger(c.req.query("cols"), "cols");
-		if (cols instanceof Response) return cols;
-		const rows = parsePositiveInteger(c.req.query("rows"), "rows");
-		if (rows instanceof Response) return rows;
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const terminal = await sandbox.getTerminal(terminalId);
-			if (!terminal) return errorJson("Terminal not found", "not_found", 404);
-			return await terminal.connect(c.req.raw, {
-				cursor: c.req.query("cursor"),
-				cols,
-				rows
-			});
-		} catch (error) {
-			return terminalError(error);
-		}
-	});
-	app.post(`${apiPrefix}/sandbox/:id/terminals/:terminalId/interrupt`, async (c) => {
-		const terminalId = validateTerminalId(c.req.param("terminalId"));
-		if (!terminalId) return errorJson("Invalid terminal ID format", "invalid_request", 400);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const terminal = await sandbox.getTerminal(terminalId);
-			if (!terminal) return errorJson("Terminal not found", "not_found", 404);
-			await terminal.interrupt();
-			return new Response(null, { status: 204 });
-		} catch (error) {
-			return terminalError(error);
-		}
-	});
-	app.post(`${apiPrefix}/sandbox/:id/terminals/:terminalId/terminate`, async (c) => {
-		const terminalId = validateTerminalId(c.req.param("terminalId"));
-		if (!terminalId) return errorJson("Invalid terminal ID format", "invalid_request", 400);
-		const sandbox = getSandbox(getSandboxNs(c.env, sandboxBinding), c.get("containerUUID"));
-		try {
-			const terminal = await sandbox.getTerminal(terminalId);
-			if (!terminal) return errorJson("Terminal not found", "not_found", 404);
-			await terminal.terminate();
-			return new Response(null, { status: 204 });
-		} catch (error) {
-			return terminalError(error);
-		}
-	});
-}
-
-//#endregion
-//#region src/bridge/routes.ts
-function sandboxRoutePoolMode(method, routePath) {
-	if (method === "GET" && routePath === "/running") return "lookup";
-	if (method === "GET" && (routePath === "/processes" || /^\/processes\/[^/]+(?:\/logs)?$/.test(routePath))) return "lookup";
-	if (method === "POST" && /^\/processes\/[^/]+\/kill$/.test(routePath)) return "lookup";
-	if (method === "GET" && (routePath === "/terminals" || /^\/terminals\/[^/]+(?:\/connect)?$/.test(routePath))) return "lookup";
-	if (method === "POST" && /^\/terminals\/[^/]+\/(interrupt|terminate)$/.test(routePath)) return "lookup";
-	if (method === "POST" && [
-		"/processes",
-		"/terminals",
-		"/persist",
-		"/hydrate",
-		"/mount",
-		"/unmount"
-	].includes(routePath)) return "allocate";
-	if ((method === "GET" || method === "PUT") && routePath.startsWith("/file/")) return "allocate";
-	if ((method === "POST" || method === "DELETE") && /^\/tunnel\/[^/]+$/.test(routePath)) return "allocate";
-	return "unmatched";
-}
-function missingRuntimeResponse(routePath) {
-	if (routePath === "/running") return Response.json({ running: false });
-	if (routePath === "/processes" || routePath === "/terminals") return Response.json([]);
-	if (routePath.startsWith("/terminals/")) return errorJson("Terminal not found", "not_found", 404);
-	return errorJson("Process not found", "not_found", 404);
-}
-function createBridgeApp(config) {
-	const app = new Hono();
-	const { sandboxBinding, warmPoolBinding, apiPrefix } = config;
-	app.use(`${apiPrefix}/sandbox/*`, async (c, next) => {
-		const sandboxId = new URL(c.req.url).pathname.split("/")[apiPrefix.split("/").filter(Boolean).length + 2];
-		if (sandboxId && !/^[a-z2-7]{1,128}$/.test(sandboxId)) return errorJson("Invalid sandbox ID format", "invalid_request", 400);
-		const token = c.env.SANDBOX_API_KEY;
-		if (token) {
-			const authHeader = c.req.header("Authorization") ?? "";
-			if ((authHeader.toLowerCase().startsWith("bearer ") ? authHeader.slice(7) : "") !== token) return errorJson("Unauthorized", "unauthorized", 401);
-		}
-		return next();
-	});
-	app.use(`${apiPrefix}/sandbox/:id/*`, async (c, next) => {
-		const url = new URL(c.req.url);
-		const sandboxId = c.req.param("id");
-		const routePath = url.pathname.slice(`${apiPrefix}/sandbox/${sandboxId}`.length);
-		const poolMode = sandboxRoutePoolMode(c.req.method, routePath);
-		if (poolMode === "unmatched") return next();
-		const warmTarget = Number.parseInt(c.env.WARM_POOL_TARGET || "0", 10) || 0;
-		const refreshInterval = Number.parseInt(c.env.WARM_POOL_REFRESH_INTERVAL || "10000", 10) || 1e4;
-		const poolStub = getWarmPoolStub(c.env, warmPoolBinding);
-		try {
-			await poolStub.configure({
-				warmTarget,
-				refreshInterval
-			});
-			const containerUUID = poolMode === "lookup" ? await poolStub.lookupContainer(sandboxId) : await poolStub.getContainer(sandboxId);
-			if (!containerUUID) return missingRuntimeResponse(routePath);
-			c.set("containerUUID", containerUUID);
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (msg.includes("instance limit reached")) return errorJson(msg, "capacity_exceeded", 503);
-			return errorJson(`pool error: ${msg}`, "pool_error", 502);
-		}
-		return next();
-	});
-	app.use(`${apiPrefix}/sandbox/:id`, async (c, next) => {
-		if (c.req.method !== "DELETE") return next();
-		const sandboxId = c.req.param("id");
-		const poolStub = getWarmPoolStub(c.env, warmPoolBinding);
-		try {
-			const containerUUID = await poolStub.lookupContainer(sandboxId);
-			if (!containerUUID) return new Response(null, { status: 204 });
-			c.set("containerUUID", containerUUID);
-		} catch (err) {
-			return errorJson(`pool error: ${err instanceof Error ? err.message : String(err)}`, "pool_error", 502);
-		}
-		return next();
-	});
-	registerLifecycleRoutes(app, apiPrefix, config.healthPath, sandboxBinding, warmPoolBinding);
-	registerProcessRoutes(app, apiPrefix, sandboxBinding);
-	registerFileRoutes(app, apiPrefix, sandboxBinding);
-	registerTerminalRoutes(app, apiPrefix, sandboxBinding);
-	registerOpenApiRoutes(app, apiPrefix);
-	return app;
-}
-function registerOpenApiRoutes(app, apiPrefix) {
-	const openapiAuth = async (c, next) => {
-		const token = c.env.SANDBOX_API_KEY;
-		if (token) {
-			const authHeader = c.req.header("Authorization") ?? "";
-			const provided = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
-			const queryToken = c.req.query("token") ?? "";
-			if (provided !== token && queryToken !== token) return errorJson("Unauthorized", "unauthorized", 401);
-		}
-		return next();
-	};
-	const openapiHtmlHandler = () => new Response(renderOpenApiHtml(OPENAPI_SCHEMA), { headers: { "Content-Type": "text/html; charset=utf-8" } });
-	app.get(`${apiPrefix}/openapi.json`, openapiAuth, (c) => c.json(OPENAPI_SCHEMA));
-	app.get(`${apiPrefix}/openapi.html`, openapiAuth, openapiHtmlHandler);
-	app.get(`${apiPrefix}/openapi`, openapiAuth, openapiHtmlHandler);
-}
-
-//#endregion
-//#region src/bridge/warm-pool.ts
-/**
-* WarmPool — Durable Object that maintains a pool of pre-started sandbox containers.
-*
-* The pool keeps N idle containers standing by so new sandboxes boot instantly.
-* Once a container is assigned to a sandbox ID, it is consumed and never returned
-* to the pool.
-*
-* Configuration is pushed in via `configure()` on every request (idempotent)
-* so changes to wrangler vars take effect without manual intervention.
-*/
-const DEFAULT_CONFIG = {
-	warmTarget: 0,
-	refreshInterval: 1e4
-};
-var WarmPool = class extends DurableObject {
-	config = { ...DEFAULT_CONFIG };
-	/** Container UUIDs that are warm and available for assignment */
-	warmContainers = /* @__PURE__ */ new Set();
-	/** Maps caller-provided sandbox IDs to container UUIDs (1:1, no sharing) */
-	assignments = /* @__PURE__ */ new Map();
-	/** Containers currently starting — excluded from health checks */
-	startingContainers = /* @__PURE__ */ new Set();
-	/** Inferred max_instances limit learned from Cloudflare errors, or null */
-	knownMaxInstances = null;
-	capacityExhausted = false;
-	initialized = false;
-	/**
-	* Get a container UUID for the given sandbox ID.
-	* - If this ID already has an assigned container that's still running, return it.
-	* - Otherwise assign a warm container (or start a new one).
-	*/
-	async getContainer(sandboxId) {
-		await this.init();
-		const existing = this.assignments.get(sandboxId);
-		if (existing) {
-			if (await this.isContainerRunning(existing)) return existing;
-			this.assignments.delete(sandboxId);
-			await this.persist();
-		}
-		if (this.warmContainers.size > 0) {
-			const containerUUID$1 = this.warmContainers.values().next().value;
-			this.warmContainers.delete(containerUUID$1);
-			this.assignments.set(sandboxId, containerUUID$1);
-			await this.persist();
-			return containerUUID$1;
-		}
-		if (this.remainingCapacity() <= 0) this.throwCapacityError();
-		const containerUUID = await this.startContainer();
-		if (containerUUID) {
-			this.assignments.set(sandboxId, containerUUID);
-			await this.persist();
-			return containerUUID;
-		}
-		if (this.capacityExhausted) this.throwCapacityError();
-		throw new Error("Failed to start container");
-	}
-	/**
-	* Look up an existing container assignment without allocating.
-	* Returns the container UUID if the sandbox ID has an active assignment, null otherwise.
-	* Used by DELETE to avoid starting a container just to destroy it.
-	*/
-	async lookupContainer(sandboxId) {
-		await this.init();
-		const existing = this.assignments.get(sandboxId);
-		if (existing) return existing;
-		return null;
-	}
-	/**
-	* Report that a container has stopped — removes it from tracking.
-	*/
-	async reportStopped(containerUUID) {
-		await this.init();
-		this.removeContainer(containerUUID);
-		await this.persist();
-	}
-	/**
-	* Get current pool statistics.
-	*/
-	async getStats() {
-		await this.init();
-		return {
-			warm: this.warmContainers.size,
-			assigned: this.assignments.size,
-			total: this.warmContainers.size + this.assignments.size,
-			config: this.config,
-			maxInstances: this.knownMaxInstances
-		};
-	}
-	/**
-	* Update pool configuration. Idempotent — called on every request to keep
-	* config in sync with wrangler vars across deploys.
-	*/
-	async configure(config) {
-		await this.init();
-		this.config = {
-			...DEFAULT_CONFIG,
-			...config
-		};
-		await this.ctx.storage.put("config", this.config);
-	}
-	/**
-	* Shutdown all pre-warmed (unassigned) containers.
-	* Does not affect containers that are assigned to sandbox IDs.
-	*/
-	async shutdownPrewarmed() {
-		await this.init();
-		for (const containerUUID of [...this.warmContainers]) try {
-			await this.getSandboxStub(containerUUID).destroy();
-			this.warmContainers.delete(containerUUID);
-		} catch (error) {
-			console.error({
-				message: "Failed to destroy container",
-				component: "warm-pool",
-				containerUUID,
-				error
-			});
-		}
-		await this.persist();
-	}
-	async alarm() {
-		await this.init();
-		this.capacityExhausted = false;
-		try {
-			await this.checkContainerHealth();
-			await this.adjustPool();
-			await this.keepWarmContainersAlive();
-		} catch (error) {
-			console.error({
-				message: "Alarm handler error",
-				component: "warm-pool",
-				error
-			});
-		}
-		await this.ctx.storage.setAlarm(Date.now() + this.config.refreshInterval);
-	}
-	async init() {
-		if (this.initialized) return;
-		const storedWarm = await this.ctx.storage.get("warmContainers");
-		if (storedWarm) this.warmContainers = new Set(storedWarm);
-		const storedAssignments = await this.ctx.storage.get("assignments");
-		if (storedAssignments) this.assignments = new Map(storedAssignments);
-		const storedConfig = await this.ctx.storage.get("config");
-		if (storedConfig) this.config = {
-			...DEFAULT_CONFIG,
-			...storedConfig
-		};
-		const storedMax = await this.ctx.storage.get("knownMaxInstances");
-		if (storedMax !== void 0) this.knownMaxInstances = storedMax;
-		this.initialized = true;
-		await this.scheduleRefresh();
-	}
-	async persist() {
-		await this.ctx.storage.put("warmContainers", this.warmContainers);
-		await this.ctx.storage.put("assignments", this.assignments);
-		if (this.knownMaxInstances !== null) await this.ctx.storage.put("knownMaxInstances", this.knownMaxInstances);
-		else await this.ctx.storage.delete("knownMaxInstances");
-	}
-	async scheduleRefresh() {
-		if (!await this.ctx.storage.getAlarm()) await this.ctx.storage.setAlarm(Date.now() + this.config.refreshInterval);
-	}
-	async startContainer() {
-		const containerUUID = crypto.randomUUID();
-		this.startingContainers.add(containerUUID);
-		try {
-			await this.getSandboxStub(containerUUID).startAndWaitForPorts();
-			console.info({
-				message: "Container started",
-				component: "warm-pool",
-				containerUUID
-			});
-			return containerUUID;
-		} catch (error) {
-			if (this.isMaxInstancesError(error)) await this.recordCapacityLimit();
-			else console.error({
-				message: "Failed to start container",
-				component: "warm-pool",
-				containerUUID,
-				error
-			});
-			return null;
-		} finally {
-			this.startingContainers.delete(containerUUID);
-		}
-	}
-	async isContainerRunning(containerUUID) {
-		if (this.startingContainers.has(containerUUID)) return true;
-		try {
-			const state = await this.getSandboxStub(containerUUID).getState();
-			return state.status === "running" || state.status === "healthy";
-		} catch (error) {
-			console.warn({
-				message: "Failed to check container status, assuming stopped",
-				component: "warm-pool",
-				containerUUID,
-				error
-			});
-			return false;
-		}
-	}
-	async checkContainerHealth() {
-		const allUUIDs = [...this.warmContainers, ...this.assignments.values()];
-		let anyRemoved = false;
-		for (const uuid of allUUIDs) if (!await this.isContainerRunning(uuid)) {
-			console.info({
-				message: "Container not running, removing from pool",
-				component: "warm-pool",
-				containerUUID: uuid
-			});
-			if (this.removeContainer(uuid)) anyRemoved = true;
-		}
-		if (anyRemoved) await this.persist();
-	}
-	/**
-	* Renew activity timeout on all warm containers to prevent them from sleeping.
-	*/
-	async keepWarmContainersAlive() {
-		for (const containerUUID of this.warmContainers) try {
-			this.getSandboxStub(containerUUID).renewActivityTimeout();
-		} catch (error) {
-			console.error({
-				message: "Failed to renew activity timeout",
-				component: "warm-pool",
-				containerUUID,
-				error
-			});
-		}
-	}
-	/**
-	* Scale the warm pool towards warmTarget, respecting inferred max_instances.
-	*/
-	async adjustPool() {
-		let diff = this.config.warmTarget - this.warmContainers.size;
-		if (diff > 0) {
-			if (this.remainingCapacity() === 0 && this.knownMaxInstances !== null) {
-				console.info({
-					message: "Pool at inferred limit, probing for capacity changes",
-					component: "warm-pool",
-					knownMaxInstances: this.knownMaxInstances
-				});
-				const probeUUID = await this.startContainer();
-				if (probeUUID) {
-					console.info({
-						message: "Probe succeeded, clearing cached limit",
-						component: "warm-pool"
-					});
-					this.knownMaxInstances = null;
-					this.warmContainers.add(probeUUID);
-					diff--;
-					await this.persist();
-				} else {
-					await this.persist();
-					return;
-				}
-			}
-			const toStart = Math.min(diff, this.remainingCapacity());
-			if (toStart <= 0) {
-				console.log({
-					message: "Cannot scale up pool",
-					component: "warm-pool",
-					needed: diff,
-					available: this.remainingCapacity(),
-					warm: this.warmContainers.size,
-					assigned: this.assignments.size,
-					knownMaxInstances: this.knownMaxInstances ?? "unknown"
-				});
-				return;
-			}
-			console.info({
-				message: "Scaling up pool",
-				component: "warm-pool",
-				starting: toStart,
-				needed: diff,
-				capacity: this.remainingCapacity()
-			});
-			for (let i = 0; i < toStart; i++) {
-				if (this.capacityExhausted) {
-					console.log({
-						message: "Capacity exhausted mid-loop, stopping further starts",
-						component: "warm-pool"
-					});
-					break;
-				}
-				const uuid = await this.startContainer();
-				if (uuid) this.warmContainers.add(uuid);
-			}
-			await this.persist();
-		} else if (diff < 0) {
-			const excess = -diff;
-			console.info({
-				message: "Scaling down pool",
-				component: "warm-pool",
-				destroying: excess
-			});
-			const toDestroy = [...this.warmContainers].slice(0, excess);
-			const destroyed = [];
-			for (const uuid of toDestroy) try {
-				await this.getSandboxStub(uuid).destroy();
-				destroyed.push(uuid);
-			} catch (error) {
-				console.error({
-					message: "Failed to destroy container",
-					component: "warm-pool",
-					containerUUID: uuid,
-					error
-				});
-			}
-			for (const uuid of destroyed) this.warmContainers.delete(uuid);
-			await this.persist();
-		}
-	}
-	removeContainer(containerUUID) {
-		let removed = false;
-		if (this.warmContainers.delete(containerUUID)) removed = true;
-		for (const [sandboxId, uuid] of this.assignments) if (uuid === containerUUID) {
-			this.assignments.delete(sandboxId);
-			removed = true;
-			break;
-		}
-		return removed;
-	}
-	remainingCapacity() {
-		if (this.knownMaxInstances === null) return Infinity;
-		return Math.max(0, this.knownMaxInstances - (this.warmContainers.size + this.assignments.size));
-	}
-	isMaxInstancesError(error) {
-		return (error instanceof Error ? error.message : String(error)).includes("Maximum number of running container instances exceeded");
-	}
-	async recordCapacityLimit() {
-		const currentTotal = this.warmContainers.size + this.assignments.size;
-		this.knownMaxInstances = currentTotal;
-		this.capacityExhausted = true;
-		console.warn({
-			message: "Hit max_instances limit",
-			component: "warm-pool",
-			inferredCeiling: currentTotal,
-			warm: this.warmContainers.size,
-			assigned: this.assignments.size
-		});
-		await this.ctx.storage.put("knownMaxInstances", this.knownMaxInstances);
-	}
-	throwCapacityError() {
-		const total = this.warmContainers.size + this.assignments.size;
-		throw new Error(`Cannot start container: instance limit reached (${total}/${this.knownMaxInstances}). All container slots are in use. Wait for existing containers to stop.`);
-	}
-	getSandboxStub(containerUUID) {
-		const id = this.env.Sandbox.idFromName(containerUUID);
-		return this.env.Sandbox.get(id);
-	}
-};
-
-//#endregion
-//#region src/bridge/index.ts
-/**
-* @cloudflare/sandbox/bridge — Bridge factory for Cloudflare Sandbox Workers.
-*
-* Usage:
-* ```ts
-* import { bridge } from "@cloudflare/sandbox/bridge";
-* export { Sandbox } from "@cloudflare/sandbox";
-* export { WarmPool } from "@cloudflare/sandbox/bridge";
-*
-* export default bridge({
-*   async fetch(request, env, ctx) {
-*     return new Response("OK");
-*   },
-*   async scheduled(controller, env, ctx) {
-*     // custom scheduled logic
-*   }
-* });
-* ```
-*/
-/**
-* Log an error if the required Durable Object bindings are missing from the
-* module-level environment. The `cloudflare:workers` env exposes binding stubs
-* at module evaluation time, so a missing key means the wrangler.jsonc
-* configuration is wrong. The health endpoint performs the same validation at
-* request time and returns a 503.
-*/
-function checkBindings(env$1, options) {
-	const { sandboxBinding, warmPoolBinding } = options;
-	const missing = [];
-	if (!env$1[sandboxBinding]) missing.push(sandboxBinding);
-	if (!env$1[warmPoolBinding]) missing.push(warmPoolBinding);
-	if (missing.length > 0) for (const binding of missing) console.error({
-		message: `Missing required binding "${binding}"`,
-		component: "bridge",
-		binding,
-		hint: `Ensure your wrangler.jsonc has a Durable Object binding named "${binding}".`
-	});
-	if (!env$1.SANDBOX_API_KEY) console.warn({
-		message: "SANDBOX_API_KEY is not set — auth is disabled",
-		component: "bridge",
-		hint: "Set via `wrangler secret put SANDBOX_API_KEY`."
-	});
-}
-/**
-* Create a Worker export that wraps user handlers with bridge functionality.
-*
-* The bridge:
-* 1. Checks that required Durable Object bindings exist (logs errors if missing).
-* 2. Wraps `fetch()` to serve bridge API routes first, then falls through to the user handler.
-* 3. Wraps `scheduled()` to prime the warm pool, then calls the user handler.
-* 4. Passes through all other properties unchanged.
-*
-* @param worker - The user's worker handlers (fetch, scheduled, and any others).
-* @param config - Optional configuration for binding names and route paths.
-*/
-function bridge(worker, config) {
-	const sandboxBinding = config?.bindings?.sandbox ?? "Sandbox";
-	const warmPoolBinding = config?.bindings?.warmPool ?? "WarmPool";
-	const apiPrefix = config?.apiRoutePrefix ?? "/v1";
-	const healthPath = config?.healthRoute ?? "/health";
-	checkBindings(env, {
-		sandboxBinding,
-		warmPoolBinding
-	});
-	const app = createBridgeApp({
-		sandboxBinding,
-		warmPoolBinding,
-		apiPrefix,
-		healthPath
-	});
-	const passThrough = {};
-	for (const key of Object.keys(worker)) if (key !== "fetch" && key !== "scheduled") passThrough[key] = worker[key];
-	return {
-		...passThrough,
-		async fetch(request, env$1, ctx) {
-			const url = new URL(request.url);
-			if (url.pathname.startsWith(`${apiPrefix}/`) || url.pathname === apiPrefix || url.pathname === healthPath) return app.fetch(request, env$1, ctx);
-			if (worker.fetch) return worker.fetch(request, env$1, ctx);
-			return new Response("Not Found", { status: 404 });
-		},
-		async scheduled(controller, env$1, ctx) {
-			await primePool(env$1, warmPoolBinding);
-			if (worker.scheduled) await worker.scheduled(controller, env$1, ctx);
-		}
-	};
-}
-
-//#endregion
-export { WarmPool, bridge, resolveWorkspacePath, shellQuote };
-//# sourceMappingURL=index.js.map