@codeworksh/harness 0.0.1-dev.20260907151726 → 0.0.1-dev.20260917115353

package/sandbox-Dlz9cGeD.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-Dlz9cGeD.mjs","names":["AbsolutePath","Service","withCwd","path","Shell","FileSystem","SandboxFileSystem.Service","ShellTag","EffectLayer","SandboxFileSystem.withCwd","shellWithCwd","SandboxInstance.ID","SandboxInstance.Status","SandboxInstance.PersistedError"],"sources":["../../src/schema.ts","../../src/util/posix.ts","../../src/sandbox/instance.ts","../../src/sandbox/fs/filesystem.ts","../../src/sandbox/shell/shell.ts","../../src/sandbox/io.ts","../../src/sandbox/driver.ts","../../src/sandbox/errors.ts","../../src/sandbox/public/driver.ts","../../src/sandbox/public/io.ts","../../src/sandbox/error.ts","../../src/sandbox/resource.ts","../../src/sandbox/public/shell.ts"],"sourcesContent":["import { Message } from \"@codeworksh/aikit\";\nimport { DateTime, Option, Schema, SchemaGetter } from \"effect\";\nimport type { Static, TSchema } from \"typebox\";\nimport TypeBoxSchema from \"typebox/schema\";\n\nconst aikitValidators = new WeakMap<TSchema, ReturnType<typeof TypeBoxSchema.Compile>>();\n\nconst aikitValidatorFor = <T extends TSchema>(schema: T): ReturnType<typeof TypeBoxSchema.Compile<T>> => {\n\tconst cached = aikitValidators.get(schema) as ReturnType<typeof TypeBoxSchema.Compile<T>> | undefined;\n\tif (cached !== undefined) return cached;\n\tconst compiled = TypeBoxSchema.Compile(schema);\n\taikitValidators.set(schema, compiled);\n\treturn compiled;\n};\n\nconst aikitErrorPath = (error: {\n\treadonly instancePath?: string;\n\treadonly params?: Record<string, unknown>;\n}): string => {\n\tif (error.instancePath) return error.instancePath.substring(1);\n\tconst required = error.params?.requiredProperties;\n\treturn Array.isArray(required) ? required.join(\", \") : \"root\";\n};\n\nconst validateAikitSchema = <T extends TSchema>(schema: T, value: unknown, label: string): Static<T> => {\n\tconst validator = aikitValidatorFor(schema);\n\tif (validator.Check(value)) return value;\n\n\tconst [, issues] = validator.Errors(value);\n\tconst details = issues.map((issue) => ` - ${aikitErrorPath(issue)}: ${issue.message}`).join(\"\\n\") || \"unknown error\";\n\tthrow new Error(`validation failed for ${label}\\n${details}`);\n};\n\n/** Validate an aikit message without coercing or rewriting durable data. */\nexport const validateAikitMessage = (value: unknown, label: string): Message.Message =>\n\tvalidateAikitSchema(Message.MessageSchema, value, label);\n\nexport const validateAikitUserMessage = (value: unknown, label: string): Message.UserMessage =>\n\tvalidateAikitSchema(Message.UserMessageSchema, value, label);\n\nexport const validateAikitAssistantMessage = (value: unknown, label: string): Message.AssistantMessage =>\n\tvalidateAikitSchema(Message.AssistantMessageSchema, value, label);\n\nexport const validateAikitToolCallTerminalPart = (value: unknown, label: string): Message.ToolCallTerminalPart =>\n\tvalidateAikitSchema(Message.ToolCallTerminalPartSchema, value, label);\n\nexport const isAikitAssistantMessage = (value: unknown): value is Message.AssistantMessage =>\n\taikitValidatorFor(Message.AssistantMessageSchema).Check(value);\n\nexport const isAikitToolCallTerminalPart = (value: unknown): value is Message.ToolCallTerminalPart =>\n\taikitValidatorFor(Message.ToolCallTerminalPartSchema).Check(value);\n\n/**\n * Integer greater than zero.\n */\nexport const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));\n\n/**\n * Integer greater than or equal to zero.\n */\nexport const NonNegativeInt = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));\n\n/**\n * Cost greater than or equal with finite value\n */\nexport const NonNegativeCost = Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0));\n\n/**\n * Absolute file path (e.g., `/home/user/projects/myapp/src/main.ts`).\n */\nexport const AbsolutePath = Schema.String.pipe(Schema.brand(\"AbsolutePath\"));\nexport type AbsolutePath = Schema.Schema.Type<typeof AbsolutePath>;\n\n/**\n * Optional public JSON field that can hold explicit `undefined` on the type\n * side but encodes it as an omitted key, matching legacy `JSON.stringify`.\n */\nexport const optional = <S extends Schema.Top>(schema: S) =>\n\tSchema.optionalKey(schema).pipe(\n\t\tSchema.decodeTo(Schema.optional(Schema.toType(schema)), {\n\t\t\tdecode: SchemaGetter.passthrough({ strict: false }),\n\t\t\tencode: SchemaGetter.transformOptional(Option.filter((value) => value !== undefined)),\n\t\t}),\n\t);\n\n/**\n * Strip `readonly` from a nested type. Stand-in for `effect`'s `Types.DeepMutable`\n * until `effect:core/x228my` (\"Types.DeepMutable widens unknown to `{}`\") lands.\n *\n * The upstream version falls through `unknown` into `{ -readonly [K in keyof T]: ... }`\n * where `keyof unknown = never`, so `unknown` collapses to `{}`. This local\n * version gates the object branch on `extends object` (which `unknown` does\n * not) so `unknown` passes through untouched.\n *\n * Primitive bailout matches upstream — without it, branded strings like\n * `string & Brand<\"SessionID\">` fall into the object branch and get their\n * prototype methods walked.\n *\n * Tuple branch preserves readonly tuples (e.g. `ConfigPlugin.Spec`'s\n * `readonly [string, Options]`); the general array branch would otherwise\n * widen them to unbounded arrays.\n */\nexport type DeepMutable<T> = T extends string | number | boolean | bigint | symbol | Function\n\t? T\n\t: T extends readonly [unknown, ...unknown[]]\n\t\t? { -readonly [K in keyof T]: DeepMutable<T[K]> }\n\t\t: T extends readonly (infer U)[]\n\t\t\t? DeepMutable<U>[]\n\t\t\t: T extends object\n\t\t\t\t? { -readonly [K in keyof T]: DeepMutable<T[K]> }\n\t\t\t\t: T;\n\n/**\n * Attach static methods to a schema object. Designed to be used with `.pipe()`:\n *\n * @example\n *   export const Foo = fooSchema.pipe(\n *     withStatics((schema) => ({\n *       zero: schema.make(0),\n *       from: Schema.decodeUnknownOption(schema),\n *     }))\n *   )\n */\nexport const withStatics =\n\t<S extends object, M extends Record<string, unknown>>(methods: (schema: S) => M) =>\n\t(schema: S): S & M =>\n\t\tObject.assign(schema, methods(schema));\n\n/**\n * Nominal wrapper for scalar types. The class itself is a valid schema —\n * pass it directly to `Schema.decode`, `Schema.decodeEffect`, etc.\n *\n * Overrides `~type.make` on the derived `Schema.Opaque` so `Schema.Schema.Type`\n * of a field using this newtype resolves to `Self` rather than the underlying\n * branded phantom. Without that override, passing a class instance to code\n * typed against `Schema.Schema.Type<FieldSchema>` would require a cast even\n * though the values are structurally equivalent at runtime.\n *\n * @example\n *   class QuestionID extends Newtype<QuestionID>()(\"QuestionID\", Schema.String) {\n *     static make(id: string): QuestionID {\n *       return this.make(id)\n *     }\n *   }\n *\n *   Schema.decodeEffect(QuestionID)(input)\n */\nexport function Newtype<Self>() {\n\treturn <const Tag extends string, S extends Schema.Top>(tag: Tag, schema: S) => {\n\t\tabstract class Base {\n\t\t\tdeclare readonly _newtype: Tag;\n\n\t\t\tstatic make(value: Schema.Schema.Type<S>): Self {\n\t\t\t\treturn value as unknown as Self;\n\t\t\t}\n\t\t}\n\n\t\tObject.setPrototypeOf(Base, schema);\n\n\t\treturn Base as unknown as (abstract new (_: never) => { readonly _newtype: Tag }) & {\n\t\t\treadonly make: (value: Schema.Schema.Type<S>) => Self;\n\t\t} & Omit<Schema.Opaque<Self, S, {}>, \"make\" | \"~type.make\"> & {\n\t\t\t\treadonly \"~type.make\": Self;\n\t\t\t};\n\t};\n}\n\nexport const DateTimeUtcFromMillis = Schema.Finite.pipe(\n\tSchema.decodeTo(Schema.DateTimeUtc, {\n\t\tdecode: SchemaGetter.transform((value) => DateTime.makeUnsafe(value)),\n\t\tencode: SchemaGetter.transform((value) => DateTime.toEpochMillis(value)),\n\t}),\n);\n","import { Effect, Path } from \"effect\";\n\n/** Shared POSIX path implementation for sandbox and remote-runtime paths. */\nexport const posix = Effect.runSync(Path.Path.pipe(Effect.provide(Path.layer)));\n","import { Option, Schema } from \"effect\";\nimport { uuidv7 } from \"uuidv7\";\nimport { withStatics } from \"../schema.ts\";\nimport type { SandboxDriver } from \"./driver.ts\";\n\n/**\n * A Sandbox instance is a **durable filesystem namespace** plus whatever compute\n * acts on it — a device in Unix terms, which exists whether or not anything has\n * it mounted. `Sandbox.Controller` is the only thing that creates,\n * stops, or destroys one; this module is just its identity and state model.\n *\n * The application ID is deliberately separate from the driver's own resource\n * locator: callers never parse a Vercel name or a Daytona ID, driver formats may\n * change, and a destroyed resource must stay identifiable in Project/Session\n * history. A missing resource is never recreated under an existing ID — a new\n * resource is a new namespace and therefore a new ID.\n */\n\nexport const ID = Schema.String.pipe(\n\tSchema.brand(\"SandboxInstance.ID\"),\n\twithStatics((schema) => ({\n\t\t/**\n\t\t * The host. Reserved, and never written to a column — see {@link toColumn}.\n\t\t * It exists at runtime so nothing has to branch on \"is this the host\": it is\n\t\t * what identity reads, what logs show, and what the transport cache keys on.\n\t\t */\n\t\tlocal: schema.make(\"local\"),\n\t\t/** A fresh identity for a namespace nothing has named yet. */\n\t\tcreate: () => schema.make(`sbx_${uuidv7()}`),\n\t})),\n);\nexport type ID = typeof ID.Type;\n\n/**\n * The storage boundary for namespace references, in one place.\n *\n * The host filesystem exists whether or not a row describes it, so it gets no\n * row and `NULL` is the only spelling of it — the Unix analogue is exact, since\n * `/` has no entry in the mount table you consult to find other mounts. That\n * makes a session or directory writable before any namespace is registered (the\n * foreign key is skipped on NULL), makes `SET sandbox_instance_id = NULL` a\n * meaningful \"revert to the host\", and leaves the host impossible to tombstone,\n * collect, or destroy, because there is nothing to point at.\n *\n * Two SQLite consequences ride on this and break correctness silently if missed:\n * unique indexes treat NULLs as distinct, so every uniqueness constraint\n * spanning a namespace column coalesces to `'local'`; and `= NULL` never\n * matches, so namespace-scoped reads use `IS`.\n */\nexport const toColumn = (id: ID): string | null => (id === ID.local ? null : id);\nexport const fromColumn = (value: string | null): ID => (value === null ? ID.local : ID.make(value));\n\n/**\n * The same mapping for row models, whose optional columns are `Option` rather\n * than `null`. Kept beside {@link toColumn} so the boundary stays one place:\n * `toColumn`/`fromColumn` for SQL parameters, these for `Model.FieldOption`.\n */\nexport const toField = (id: ID): Option.Option<ID> => (id === ID.local ? Option.none() : Option.some(id));\nexport const fromField = (value: Option.Option<ID>): ID => Option.getOrElse(value, () => ID.local);\n\n/**\n * Filesystem-class taxonomy, mirroring Unix: disk, tmpfs/procfs, NFS/CIFS.\n * Stored on the row rather than derived from the registered driver, so reading\n * an instance never depends on the registry — which matters most when a driver\n * is *not* configured and you need to list or clean up its rows.\n */\nexport const Kind = Schema.Literals([\"local\", \"virtual\", \"remote\"]);\nexport type Kind = typeof Kind.Type;\n\nexport const Ownership = Schema.Literals([\"managed\", \"external\"]);\nexport type Ownership = typeof Ownership.Type;\n\n/**\n * Lifecycle state, in ZFS pool vocabulary. This is the **last observed** value,\n * not live driver truth: Daytona auto-stops and auto-archives, Vercel sandboxes\n * expire on their own timeout, so drift is normal. `stateObservedAt` carries the\n * freshness and `Controller.refresh` updates it without waking anything.\n *\n * `removed` and `unavail` are deliberately distinct. `removed` means we deleted\n * it; `unavail` means the driver claims it is gone. A \"not found\" is frequently a\n * misclassification — wrong region, wrong API url, a revoked key answering 404,\n * eventual consistency right after create — so it must never be recorded as if we\n * had destroyed the resource ourselves.\n */\nexport const Status = Schema.Literals([\n\t\"provisioning\",\n\t\"online\",\n\t\"offline\",\n\t\"suspending\",\n\t\"removing\",\n\t\"removed\",\n\t\"unavail\",\n\t\"faulted\",\n]);\nexport type Status = typeof Status.Type;\n\n/**\n * The statuses a `mount` may proceed from. This is the predicate every\n * conditional write depends on, so it is enumerated once here rather than\n * restated as prose at each call site.\n *\n * `offline` qualifies because mounting wakes.\n * `faulted` qualifies because a fault is a *usability* condition, not an identity one — see {@link Status}.\n *\n * There is no `resuming`: it would exist to be observed by nothing, since\n * mounting wakes, `offline` is already mountable, and waking is not destructive\n * so it needs no claim. `suspending` and `removing` stay because they *are*\n * compare-and-set claims, blocking a concurrent mount mid-destruction.\n */\nexport const mountable: ReadonlySet<Status> = new Set<Status>([\"online\", \"offline\", \"faulted\"]);\n\nexport const isMountable = (status: Status): boolean => mountable.has(status);\n\n/**\n * Reference state, derived — never stored. `busy` carries its `umount` meaning:\n * something holds this and destruction must not proceed unforced.\n *\n * `pinned` is the kernel sense of the word: never reclaimable. It short-circuits\n * counting entirely for instances that cannot be stopped or destroyed (the local\n * host), which is what keeps them out of any future collector by construction\n * rather than by an ownership check happening to catch them.\n */\nexport const Usage = Schema.Literals([\"idle\", \"busy\", \"pinned\"]);\nexport type Usage = typeof Usage.Type;\n\n/** Sanitized driver failure. The only error shape allowed to be persisted or logged. */\nexport const PersistedError = Schema.Struct({\n\tname: Schema.String,\n\tmessage: Schema.String,\n\tcode: Schema.optional(Schema.String),\n});\nexport type PersistedError = typeof PersistedError.Type;\n\n/** Durable metadata, safe to return and persist. Assembled by the control plane. */\nexport interface Info {\n\treadonly id: ID;\n\treadonly driver: SandboxDriver.Name;\n\treadonly kind: Kind;\n\treadonly providerResourceId: Option.Option<string>;\n\treadonly ownership: Ownership;\n\treadonly status: Status;\n\treadonly usage: Usage;\n\t/** References held by *this* control plane. Process-local; see the transport cache. */\n\treadonly refCount: number;\n\treadonly providerStatus: Option.Option<string>;\n\treadonly metadata: Readonly<Record<string, string>>;\n\treadonly lastError: Option.Option<PersistedError>;\n\treadonly createdAt: Date;\n\treadonly updatedAt: Date;\n\treadonly stateObservedAt: Date;\n\treadonly lastMountedAt: Option.Option<Date>;\n\treadonly lastUnmountedAt: Option.Option<Date>;\n\treadonly lastUsedAt: Option.Option<Date>;\n\treadonly removedAt: Option.Option<Date>;\n}\n\nexport * as SandboxInstance from \"./instance.ts\";\n","import { Context, Effect, Schema } from \"effect\";\nimport { posix } from \"../../util/posix.ts\";\n\n/**\n * The runtime filesystem contract, independent of any backend.\n *\n * Two surfaces, deliberately:\n * - {@link Provider} is what a backend implements — plain promises that reject,\n *   matching every SDK we wrap.\n * - {@link Interface} is what the harness consumes — Effect with a typed error\n *   channel and tracing spans. {@link fromProvider} bridges the two exactly\n *   once, so no consumer ever writes `Effect.tryPromise` against a filesystem.\n *\n * Implementations:\n * - Local:\n * implement it over a VFS (`./local`);\n * local filesystem use OS primitives; hence have broader filesytem capabilities.\n *\n * - Remote:\n * implement it over a provider (`./remote`).\n * remote filesytems depends on the interface provided by the remote provider; hence can have limited filesytem capabilities.\n *\n * `isFile`/`isDirectory` are required booleans; size, mtime, and isSymbolicLink are omitted when the\n * backend cannot report them — never fabricated.\n *\n * **Paths are POSIX, and the harness is Unix-only (for now!).** Every path uses `/`\n * separators on both the host and inside a sandbox — Windows is not supported,\n * so no translation layer exists. Consumers must use the shared Effect POSIX\n * path implementation, never the platform default, or a host running the harness would\n * impose its own flavour on a remote sandbox's paths. Relative paths resolve\n * against the backend's configured `cwd`.\n */\n\nexport class OperationUnsupportedError extends Schema.TaggedError<OperationUnsupportedError>()(\n\t\"OperationUnsupportedError\",\n\t{\n\t\toperation: Schema.String,\n\t\tmessage: Schema.String,\n\t},\n) {}\n\n/** A backend operation failed. `cause` carries the provider's own rejection. */\nexport class FileSystemError extends Schema.TaggedError<FileSystemError>()(\"SandboxFileSystemError\", {\n\tmethod: Schema.String,\n\tpath: Schema.String,\n\tcause: Schema.optional(Schema.Defect()),\n}) {}\n\nexport interface FileStat {\n\treadonly isFile: boolean;\n\treadonly isDirectory: boolean;\n\treadonly isSymbolicLink?: boolean;\n\treadonly size?: number;\n\treadonly mtime?: Date;\n}\n\nexport interface RmOptions {\n\treadonly recursive?: boolean;\n\treadonly force?: boolean;\n}\n\n/** Whether a provider failure means the path itself is definitively absent. */\nexport const isNotFoundError = (cause: unknown) => {\n\tconst code = (cause as NodeJS.ErrnoException | undefined)?.code;\n\treturn code === \"ENOENT\" || code === \"ENOTDIR\";\n};\n\n/**\n * Shell forms of `realpath` for backends that only expose a process API.\n * `pwd -P` is the portable primitive: directories resolve directly, anything\n * else resolves its parent and keeps the final name as given. Run as\n * `sh -c <script> _ <path>`; try the first, fall back to the second.\n */\nexport const realpathScripts = [\n\t'cd -- \"$1\" && pwd -P',\n\t'cd -- \"$(dirname -- \"$1\")\" && printf \\'%s/%s\\' \"$(pwd -P)\" \"$(basename -- \"$1\")\"',\n] as const;\n\n/**\n * The backend-facing contract. Backends author plain promises and let them\n * reject; {@link fromProvider} turns rejections into typed failures.\n */\nexport interface Provider {\n\treadonly readFile: (path: string) => Promise<string>;\n\treadonly readFileBuffer: (path: string) => Promise<Uint8Array>;\n\t/**\n\t * Write the file. Parents may be missing — do not create them here;\n\t * {@link fromProvider} owns that guarantee for every backend.\n\t */\n\treadonly writeFile: (path: string, content: string | Uint8Array) => Promise<void>;\n\treadonly stat: (path: string) => Promise<FileStat>;\n\treadonly readdir: (path: string) => Promise<string[]>;\n\treadonly exists: (path: string) => Promise<boolean>;\n\treadonly mkdir: (path: string, options?: { recursive?: boolean }) => Promise<void>;\n\treadonly rm: (path: string, options?: RmOptions) => Promise<void>;\n\t/** Canonical absolute path with symlinks resolved; rejects when the path does not exist. */\n\treadonly realpath: (path: string) => Promise<string>;\n\t/**\n\t * Metadata for the directory entry itself rather than a symlink's target.\n\t * Optional: a backend whose `stat` has mixed symlink semantics implements it\n\t * so symlink identity is asked for explicitly, never inferred.\n\t */\n\treadonly lstat?: (path: string) => Promise<FileStat>;\n}\n\n/**\n * The consumer-facing contract. `exists` distinguishes \"absent\" from \"could not\n * tell\": a backend failure is a typed failure, not `false`, so a caller acting\n * on absence never acts on a network blip. Use `SandboxFs.existsOrFalse` where\n * a best-effort answer really is wanted.\n */\nexport interface Interface {\n\treadonly readFile: (path: string) => Effect.Effect<string, FileSystemError>;\n\treadonly readFileBuffer: (path: string) => Effect.Effect<Uint8Array, FileSystemError>;\n\t/** Creates missing parent directories, on every backend. */\n\treadonly writeFile: (path: string, content: string | Uint8Array) => Effect.Effect<void, FileSystemError>;\n\treadonly stat: (path: string) => Effect.Effect<FileStat, FileSystemError>;\n\treadonly readdir: (path: string) => Effect.Effect<string[], FileSystemError>;\n\treadonly exists: (path: string) => Effect.Effect<boolean, FileSystemError>;\n\treadonly mkdir: (path: string, options?: { recursive?: boolean }) => Effect.Effect<void, FileSystemError>;\n\treadonly rm: (path: string, options?: RmOptions) => Effect.Effect<void, FileSystemError | OperationUnsupportedError>;\n\t/** Canonical absolute path with symlinks resolved; fails when the path does not exist. */\n\treadonly realpath: (path: string) => Effect.Effect<string, FileSystemError>;\n\t// `lstat` is present only when the backend supports it; check before calling.\n\treadonly lstat?: (path: string) => Effect.Effect<FileStat, FileSystemError>;\n}\n\n/** The runtime filesystem service — the live {@link Interface} for the active sandbox. */\nexport class Service extends Context.Service<Service, Interface>()(\n\t\"@codeworksh/harness/sandbox/fs/filesystem/Service\",\n) {}\n\n/**\n * Reject `rm` options a provider does not implement, before any mutation. Only\n * `recursive` and `force` are part of the contract; anything else is refused\n * loudly rather than silently ignored.\n */\nexport const validateRmOptions = (\n\toptions: RmOptions | undefined,\n\toperation = \"rm\",\n): Effect.Effect<void, OperationUnsupportedError> =>\n\tEffect.suspend(() => {\n\t\tfor (const option of Object.keys((options ?? {}) as Record<string, unknown>)) {\n\t\t\tif (option === \"recursive\" || option === \"force\") continue;\n\t\t\treturn Effect.fail(new OperationUnsupportedError({ operation, message: `Unsupported rm option: ${option}` }));\n\t\t}\n\t\treturn Effect.void;\n\t});\n\n/**\n * Lift a {@link Provider} into the runtime {@link Interface}: one place that\n * converts rejections into {@link FileSystemError}, validates `rm` options,\n * creates missing parents on write, and names a tracing span per operation.\n */\nexport const fromProvider = (provider: Provider): Interface => {\n\tconst attempt = <A>(method: string, path: string, run: () => Promise<A>) =>\n\t\tEffect.tryPromise({ try: run, catch: (cause) => new FileSystemError({ method, path, cause }) });\n\n\t// The parent-creation guarantee, installed once for every backend instead of\n\t// re-implemented per provider: anything that reaches `Interface` reaches it\n\t// through here, so a backend cannot forget it.\n\t//\n\t// Lazy by design — try the write first, so the happy path stays a single call\n\t// and no remote backend pays a round-trip per write. A failure is usually a\n\t// missing parent, so create it and retry once. The mkdir's own error is\n\t// dropped on purpose: when the write failed for some other reason (EACCES,\n\t// EROFS, a dropped connection), the retry reproduces it, and *that* is the\n\t// failure the caller must see rather than a misleading mkdir error standing\n\t// in for it.\n\tconst writeCreatingParents = (path: string, content: string | Uint8Array) => {\n\t\tconst write = attempt(\"writeFile\", path, () => provider.writeFile(path, content));\n\t\tconst parent = posix.dirname(path);\n\t\treturn write.pipe(\n\t\t\tEffect.catch(() =>\n\t\t\t\tattempt(\"mkdir\", parent, () => provider.mkdir(parent, { recursive: true })).pipe(\n\t\t\t\t\tEffect.ignore,\n\t\t\t\t\tEffect.andThen(write),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t};\n\n\treturn {\n\t\treadFile: Effect.fn(\"SandboxFileSystem.readFile\")((path: string) =>\n\t\t\tattempt(\"readFile\", path, () => provider.readFile(path)),\n\t\t),\n\t\treadFileBuffer: Effect.fn(\"SandboxFileSystem.readFileBuffer\")((path: string) =>\n\t\t\tattempt(\"readFileBuffer\", path, () => provider.readFileBuffer(path)),\n\t\t),\n\t\twriteFile: Effect.fn(\"SandboxFileSystem.writeFile\")(writeCreatingParents),\n\t\tstat: Effect.fn(\"SandboxFileSystem.stat\")((path: string) => attempt(\"stat\", path, () => provider.stat(path))),\n\t\t// carried through only when the backend actually implements it\n\t\t...(provider.lstat === undefined\n\t\t\t? {}\n\t\t\t: {\n\t\t\t\t\tlstat: Effect.fn(\"SandboxFileSystem.lstat\")((path: string) =>\n\t\t\t\t\t\tattempt(\"lstat\", path, () => provider.lstat!(path)),\n\t\t\t\t\t),\n\t\t\t\t}),\n\t\treaddir: Effect.fn(\"SandboxFileSystem.readdir\")((path: string) =>\n\t\t\tattempt(\"readdir\", path, () => provider.readdir(path)),\n\t\t),\n\t\t// A backend that cannot answer fails; it does not report \"absent\". A\n\t\t// caller acting on absence — deleting a record, say — must not be told\n\t\t// the path is gone because a token expired or a request timed out.\n\t\texists: Effect.fn(\"SandboxFileSystem.exists\")((path: string) =>\n\t\t\tattempt(\"exists\", path, () => provider.exists(path)),\n\t\t),\n\t\tmkdir: Effect.fn(\"SandboxFileSystem.mkdir\")((path: string, options?: { recursive?: boolean }) =>\n\t\t\tattempt(\"mkdir\", path, () => provider.mkdir(path, options)),\n\t\t),\n\t\trm: Effect.fn(\"SandboxFileSystem.rm\")((path: string, options?: RmOptions) =>\n\t\t\tvalidateRmOptions(options).pipe(Effect.andThen(attempt(\"rm\", path, () => provider.rm(path, options)))),\n\t\t),\n\t\trealpath: Effect.fn(\"SandboxFileSystem.realpath\")((path: string) =>\n\t\t\tattempt(\"realpath\", path, () => provider.realpath(path)),\n\t\t),\n\t};\n};\n\n/**\n * Bind a cwd-neutral filesystem to one mount's working directory.\n *\n * The counterpart of `Shell.withCwd`, and the reason relative paths mean the\n * same thing to both: a shared transport stays rooted at the namespace root, so\n * resolution happens here, per mount, rather than inside a VFS whose `chdir` is\n * global state two mounts would fight over.\n */\nexport const withCwd = (fs: Interface, cwd: string): Interface => {\n\tconst at = (path: string) => posix.resolve(cwd, path);\n\treturn {\n\t\treadFile: (path) => fs.readFile(at(path)),\n\t\treadFileBuffer: (path) => fs.readFileBuffer(at(path)),\n\t\twriteFile: (path, content) => fs.writeFile(at(path), content),\n\t\tstat: (path) => fs.stat(at(path)),\n\t\treaddir: (path) => fs.readdir(at(path)),\n\t\texists: (path) => fs.exists(at(path)),\n\t\tmkdir: (path, options) => fs.mkdir(at(path), options),\n\t\trm: (path, options) => fs.rm(at(path), options),\n\t\trealpath: (path) => fs.realpath(at(path)),\n\t\t// carried through only when the backend implements it, so a caller can\n\t\t// still detect absence by checking the property\n\t\t...(fs.lstat === undefined ? {} : { lstat: (path: string) => fs.lstat!(at(path)) }),\n\t};\n};\n\nexport * as SandboxFileSystem from \"./filesystem.ts\";\n","import { Context, type Effect, Schema, type Stream } from \"effect\";\nimport { posix as path } from \"../../util/posix.ts\";\n\n/**\n * The pluggable execution contract. Local sandboxes usually get a Shell through\n * just-bash over the local `Local.Vfs`; remote sandboxes provide their own\n * native Shell. Either way the rest of the harness depends only on this service\n * tag.\n */\n\nexport class ShellError extends Schema.TaggedError<ShellError>()(\"ShellError\", {\n\tcommand: Schema.String,\n\tcause: Schema.optional(Schema.Defect()),\n}) {}\n\nexport interface ExecResult {\n\treadonly stdout: string;\n\treadonly stderr: string;\n\treadonly exitCode: number;\n}\n\n/**\n * One options shape for every entry point. `cwd` is the operation-level\n * override: it wins over the mount's working directory, and a relative value\n * resolves against it. Neither mutates shared state, so concurrent commands in\n * one mount can run in different directories.\n */\nexport interface ShellOptions {\n\treadonly env?: Record<string, string>;\n\treadonly cwd?: string;\n}\n\n/**\n * A streamed chunk of command output, terminated by a single `exit` carrying the\n * exit code. (A backend-level mirror of the tool layer's event; kept here so\n * `sandbox/` does not depend on `tool/`.)\n */\nexport type ExecChunk =\n\t| { readonly _tag: \"stdout\"; readonly bytes: Uint8Array }\n\t| { readonly _tag: \"stderr\"; readonly bytes: Uint8Array }\n\t| { readonly _tag: \"exit\"; readonly exitCode: number };\n\n/**\n * The command-execution capability a sandbox exposes. For an in-process\n * backend this is just-bash; for a remote backend it is the sandbox's own\n * shell. The {@link Shell} service tag carries this interface.\n */\nexport interface ISandboxExe {\n\treadonly exec: (command: string, options?: ShellOptions) => Effect.Effect<ExecResult, ShellError>;\n\t/**\n\t * Run a program with an explicit argument vector, bypassing shell word\n\t * splitting. Callers that build commands from untrusted values — branch\n\t * names, file paths — must use this instead of interpolating into\n\t * {@link exec}, where a space or `$(…)` would change what runs.\n\t *\n\t * Backends whose transport only accepts a string quote the vector with\n\t * {@link quote}; backends that spawn directly pass it through untouched.\n\t */\n\treadonly execArgv: (argv: ReadonlyArray<string>, options?: ShellOptions) => Effect.Effect<ExecResult, ShellError>;\n\t/**\n\t * Optional streaming output: stdout/stderr chunks then a terminal `exit`.\n\t * Backends that can stream (e.g. Vercel) implement it; `ToolShell.fromSandboxShell`\n\t * bridges it to `ToolShell.stream` so the bash tool streams over them too.\n\t */\n\treadonly stream?: (command: string, options?: ShellOptions) => Stream.Stream<ExecChunk, ShellError>;\n}\n\ntype MountFactory = (cwd: string) => ISandboxExe;\n\n/**\n * Mount-local shell factories are attached out-of-band so the public Shell\n * contract stays about command execution only.\n *\n * Most transports are safely shared and need only the cwd wrapper below.\n * Stateful in-process interpreters use this hook to construct one interpreter\n * per mount while retaining the underlying filesystem transport. This tag must\n * remain on the outermost wrapper consumed by {@link withCwd}; wrapper helpers\n * such as {@link fromExec} must propagate it when they return a new object.\n */\nconst mountFactories = new WeakMap<object, MountFactory>();\n\nexport const perMount = (transport: ISandboxExe, make: MountFactory): ISandboxExe => {\n\tmountFactories.set(transport, make);\n\treturn transport;\n};\n\n/**\n * POSIX single-quote escaping: wrap in `'…'` and rewrite each embedded quote as\n * `'\\''`. Everything inside single quotes is literal to the shell, so this is\n * safe for arbitrary bytes.\n */\nexport const quote = (value: string) => `'${value.replace(/'/g, `'\\\\''`)}'`;\n\n/** Render an argument vector as one shell-safe command string. */\nexport const quoteArgv = (argv: ReadonlyArray<string>) => argv.map(quote).join(\" \");\n\n/**\n * Resolve a per-command cwd against the sandbox cwd. Passing a relative cwd\n * straight to a host or remote process API would otherwise resolve it against\n * that API's own default, which need not be the filesystem's configured cwd.\n */\nexport const resolveCwd = (base: string | undefined, cwd: string | undefined) => {\n\tif (cwd === undefined || path.isAbsolute(cwd) || base === undefined) return cwd ?? base;\n\treturn path.resolve(base, cwd);\n};\n\n/**\n * Complete a string-only backend: `execArgv` quotes the vector and runs it\n * through `exec`. Backends that spawn a real argument vector (Vercel) implement\n * `execArgv` themselves instead, so the args never meet a shell parser at all.\n *\n * `cwd` rides the options rather than a `cd <dir> && …` prefix. Every backend\n * we wrap takes a working directory natively, and the prefix form cannot tell a\n * failed `cd` from a failed command — both arrive as one exit code.\n */\nexport const fromExec = (backend: Omit<ISandboxExe, \"execArgv\">): ISandboxExe => {\n\tconst wrapped: ISandboxExe = {\n\t\t...backend,\n\t\texecArgv: (argv, options) => backend.exec(quoteArgv(argv), options),\n\t};\n\tconst mountFactory = mountFactories.get(backend);\n\treturn mountFactory === undefined ? wrapped : perMount(wrapped, (cwd) => fromExec(mountFactory(cwd)));\n};\n\n/**\n * Bind a cwd-neutral backend to one mount's working directory.\n *\n * The transport is shared between mounts and must stay rooted at the namespace\n * root, so the directory cannot live inside it: two mounts at different\n * directories would otherwise see each other's. This wrapper is per mount, and\n * an operation-level `cwd` still wins — resolved against the mount's, so a\n * relative one means what it reads like.\n */\nexport const withCwd = (backend: ISandboxExe, cwd: string): ISandboxExe => {\n\tconst mounted = mountFactories.get(backend)?.(cwd) ?? backend;\n\tconst at = (options?: ShellOptions): ShellOptions => {\n\t\tconst resolvedCwd = resolveCwd(cwd, options?.cwd);\n\t\treturn { ...options, ...(resolvedCwd === undefined ? {} : { cwd: resolvedCwd }) };\n\t};\n\tconst stream = mounted.stream;\n\treturn {\n\t\texec: (command, options) => mounted.exec(command, at(options)),\n\t\texecArgv: (argv, options) => mounted.execArgv(argv, at(options)),\n\t\t...(stream === undefined ? {} : { stream: (command, options) => stream(command, at(options)) }),\n\t};\n};\n\n/** Execution service — the live {@link ISandboxExe} for the active sandbox. */\nexport class Shell extends Context.Service<Shell, ISandboxExe>()(\"@codeworksh/harness/sandbox/shell/shell\") {}\n","import { Context, Effect, Layer as EffectLayer } from \"effect\";\nimport { posix } from \"../util/posix.ts\";\nimport type { SandboxDriver } from \"./driver.ts\";\nimport { SandboxFileSystem } from \"./fs/filesystem.ts\";\nimport { SandboxInstance } from \"./instance.ts\";\nimport { type ISandboxExe, Shell as ShellTag, withCwd as shellWithCwd } from \"./shell/shell.ts\";\n\n/**\n * `SandboxIO` is a **mount**: a filesystem, a shell, and the identity and\n * working directory they act on.\n *\n * It is the whole vocabulary a consumer needs. Project, Git, Copy, Location, and\n * every tool ask for `SandboxIO.FileSystem`, `SandboxIO.Shell`, and\n * `SandboxIO.Current` — never for a driver, an address, or a provider SDK — so\n * a host directory, an in-memory VFS, and a remote microVM are interchangeable\n * behind one contract.\n *\n * The mount neither creates nor destroys infrastructure. `SandboxInstance` is\n * the durable namespace it acts on — a device, which exists whether or not\n * anything has it mounted — and `Sandbox.Controller` is the only path that\n * creates, stops, or destroys one.\n */\n\n/**\n * The filesystem tag. Re-exported here so consumers import one namespace —\n * Project, Git, Copy, and the runner ask for `SandboxIO.FileSystem`, never for\n * the module that happens to define it. Code *inside* `sandbox/` keeps importing\n * the tag directly, since `io.ts` is built on top of it.\n */\nexport const FileSystem = SandboxFileSystem.Service;\nexport type FileSystem = SandboxFileSystem.Service;\n\n/** The shell tag. Re-exported here so consumers import one namespace. */\nexport const Shell = ShellTag;\nexport type Shell = ShellTag;\n\n/**\n * What a mount sees: immutable identity, plus the working directory resolved for\n * *this* mount.\n *\n * Nothing mutable belongs here. `status`, `usage`, and reference counts all\n * change while a mount is open, so a mount-time snapshot of them would be wrong\n * by construction — runtime code that needs live management state asks the\n * control plane. The driver's own resource locator is likewise absent: consumers\n * never parse a Vercel name or a Daytona id.\n */\nexport interface Identity {\n\treadonly id: SandboxInstance.ID;\n\treadonly driver: SandboxDriver.Name;\n\treadonly kind: SandboxInstance.Kind;\n\t/** Absolute, and always a path in *this* namespace. */\n\treadonly cwd: string;\n}\n\n/** Identity and working directory of the current mount. */\nexport class Current extends Context.Service<Current, Identity>()(\"@codeworksh/harness/sandbox/io/Current\") {}\n\n/** Everything a mount provides. */\nexport type Provides = Current | SandboxFileSystem.Service | ShellTag;\n\n/** A built mount. */\nexport type Layer<E = never, RIn = never> = EffectLayer.Layer<Provides, E, RIn>;\n\n/**\n * Resolve a mount's cwd without consulting ambient process state.\n *\n * The default is supplied by the namespace adapter:\n * provider metadata remotely, `/` for a virtual filesystem, and `process.cwd()` for the host adapter.\n * An explicit absolute cwd replaces it; a relative cwd is resolved inside it. The\n * result is therefore always the one concrete absolute path `Current` requires.\n *\n * A non-absolute default throws rather than failing typed. It is the one\n * defect-level guard in this module, and deliberately so:\n * Adapters reading a value from a provider call this inside their own error channel,\n * where the throw becomes their typed failure (see `EnvDaytona.mountCwd`).\n */\nexport const resolveMountCwd = (defaultCwd: string, cwd?: string): string => {\n\tif (!posix.isAbsolute(defaultCwd)) {\n\t\tthrow new TypeError(`Sandbox default cwd must be absolute: ${defaultCwd}`);\n\t}\n\t// `resolve`, not `normalize`: normalize keeps a trailing slash, and `cwd` is\n\t// persisted — `space.location` and its id hash would read\n\t// `/workspace/` and `/workspace` as two directories and keep a row for each.\n\t//\n\t// A provider-reported default (`getWorkDir()`) or a config value is free to\n\t// carry one, so it is stripped here rather than at every reader.\n\tif (cwd === undefined) return posix.resolve(defaultCwd);\n\treturn posix.isAbsolute(cwd) ? posix.resolve(cwd) : posix.resolve(defaultCwd, cwd);\n};\n\n/**\n * Bind a cwd-neutral transport to one mount.\n *\n * The transport underneath is shared between\n * mounts and stays rooted at the namespace root, and everything directory-shaped\n * happens here, once per mount. Two mounts of one namespace at different working\n * directories therefore coexist without seeing or moving each other's.\n *\n * It consumes the same two tags it provides — the transport is supplied by the\n * layer this is composed over, not by itself.\n */\nexport const mount = (identity: Identity): EffectLayer.Layer<Provides, never, SandboxFileSystem.Service | ShellTag> =>\n\tEffectLayer.mergeAll(\n\t\tEffectLayer.succeed(Current, identity),\n\t\tEffectLayer.effect(\n\t\t\tSandboxFileSystem.Service,\n\t\t\tEffect.map(SandboxFileSystem.Service, (fs) => SandboxFileSystem.withCwd(fs, identity.cwd)),\n\t\t),\n\t\tEffectLayer.effect(\n\t\t\tShellTag,\n\t\t\tEffect.map(ShellTag, (shell: ISandboxExe) => shellWithCwd(shell, identity.cwd)),\n\t\t),\n\t);\n\n/**\n * Just the identity tag, with no filesystem or shell beneath it. For consumers\n * assembled from stubs — a test that runs `Project` over a fake filesystem still\n * needs to know which namespace it is in.\n */\nexport const identityLayer = (identity: Identity) => EffectLayer.succeed(Current, identity);\n\n/** The host identity alone. See {@link identityLayer}. */\nexport const hostLayer = (cwd?: string) => identityLayer(host(cwd));\n\n/**\n * The host, rooted at `cwd`. Always `SandboxInstance.ID.local`: the working\n * directory selects where relative paths resolve, it does not make a second host\n * namespace — two mounts rooted at different directories still agree on absolute\n * paths.\n *\n * The host adapter defaults to `process.cwd()`, matching the OS process it wraps.\n * This is the one namespace where that coordinate is intrinsically valid; remote\n * and virtual adapters must never inherit it.\n */\nexport const host = (cwd?: string): Identity => ({\n\tid: SandboxInstance.ID.local,\n\tdriver: \"local\" as SandboxDriver.Name,\n\tkind: \"local\",\n\tcwd: resolveMountCwd(process.cwd(), cwd),\n});\n\n/**\n * A VFS-backed namespace. The id is minted per call unless one is named, because\n * building one of these builds a fresh VFS: N unnamed calls are N distinct\n * namespaces, none of which outlives the process. A file-backed store is the\n * exception — its file is the state, so whoever knows the file supplies the id\n * it was registered under.\n */\nexport const virtual = (input: {\n\treadonly driver: string;\n\treadonly id?: SandboxInstance.ID;\n\treadonly defaultCwd?: string;\n\treadonly cwd?: string;\n}): Identity => ({\n\tid: input.id ?? SandboxInstance.ID.create(),\n\tdriver: input.driver as SandboxDriver.Name,\n\tkind: \"virtual\",\n\tcwd: resolveMountCwd(input.defaultCwd ?? \"/\", input.cwd),\n});\n\n/**\n * A provider-hosted namespace. The id is always supplied: a remote resource's\n * durable identity is minted and recorded by whoever provisioned it, never\n * derived here from the provider's own locator.\n */\nexport const remote = (input: {\n\treadonly driver: string;\n\treadonly id: SandboxInstance.ID;\n\t/** Namespace-intrinsic default supplied or discovered by the driver. */\n\treadonly defaultCwd: string;\n\treadonly cwd?: string;\n}): Identity => ({\n\tid: input.id,\n\tdriver: input.driver as SandboxDriver.Name,\n\tkind: \"remote\",\n\tcwd: resolveMountCwd(input.defaultCwd, input.cwd),\n});\n\nexport * as SandboxIO from \"./io.ts\";\n","import { type Effect, type Layer, Option, Schema } from \"effect\";\nimport type { SandboxProviderError } from \"./errors.ts\";\nimport { SandboxInstance } from \"./instance.ts\";\nimport { SandboxIO } from \"./io.ts\";\n\n/** Version of the loadable sandbox-driver module ABI. */\nexport const apiVersion = 1 as const;\nexport type ApiVersion = typeof apiVersion;\n\n/** Open driver identity. Adding a driver never extends a union in core. */\nexport const Name = Schema.String.check(Schema.isNonEmpty()).pipe(Schema.brand(\"SandboxDriver.Name\"));\nexport type Name = typeof Name.Type;\n\n/** A path whose coordinate system is the mounted namespace. */\nexport const AbsolutePath = Schema.String.check(Schema.isStartsWith(\"/\")).pipe(\n\tSchema.brand(\"SandboxDriver.AbsolutePath\"),\n);\nexport type AbsolutePath = typeof AbsolutePath.Type;\n\nexport const RuntimeConfigBase = Schema.Struct({ defaultCwd: AbsolutePath });\nexport interface RuntimeConfigBase extends Schema.Schema.Type<typeof RuntimeConfigBase> {}\n\nexport interface Capabilities {\n\treadonly inspect: boolean;\n\treadonly reattach: boolean;\n\treadonly wake: boolean;\n\treadonly stop: boolean;\n\treadonly destroy: boolean;\n\treadonly cancels: boolean;\n}\n\nexport interface Observed {\n\treadonly status: SandboxInstance.Status;\n\treadonly providerStatus?: string | undefined;\n\treadonly metadata?: Readonly<Record<string, string>> | undefined;\n}\n\nexport interface Provisioned<RuntimeConfig extends RuntimeConfigBase> {\n\treadonly providerResourceId?: string | undefined;\n\treadonly providerStatus?: string | undefined;\n\treadonly runtimeConfig: RuntimeConfig;\n\treadonly metadata?: Readonly<Record<string, string>> | undefined;\n}\n\nexport interface RuntimeInput<RuntimeConfig extends RuntimeConfigBase> {\n\treadonly id: SandboxInstance.ID;\n\treadonly providerResourceId: Option.Option<string>;\n\treadonly runtimeConfig: RuntimeConfig;\n}\n\nexport interface Driver<CreateConfig, RuntimeConfig extends RuntimeConfigBase> {\n\treadonly name: Name;\n\treadonly kind: Exclude<SandboxInstance.Kind, \"local\">;\n\treadonly capabilities: Capabilities;\n\treadonly createConfigCodec: Schema.Codec<CreateConfig, unknown>;\n\treadonly runtimeConfigCodec: Schema.Codec<RuntimeConfig, unknown>;\n\treadonly create: (input: {\n\t\treadonly instanceId: SandboxInstance.ID;\n\t\treadonly config: CreateConfig;\n\t}) => Effect.Effect<Provisioned<RuntimeConfig>, SandboxProviderError>;\n\treadonly runtimeConfigFor?:\n\t\t| ((input: {\n\t\t\t\treadonly providerResourceId: string;\n\t\t\t\treadonly overrides?: Partial<RuntimeConfig> | undefined;\n\t\t  }) => Effect.Effect<RuntimeConfig, SandboxProviderError>)\n\t\t| undefined;\n\treadonly attach: (\n\t\tinput: RuntimeInput<RuntimeConfig>,\n\t) => Layer.Layer<SandboxIO.FileSystem | SandboxIO.Shell, SandboxProviderError>;\n\treadonly inspect?: (input: RuntimeInput<RuntimeConfig>) => Effect.Effect<Observed, SandboxProviderError>;\n\treadonly wake?: (input: RuntimeInput<RuntimeConfig>) => Effect.Effect<Observed, SandboxProviderError>;\n\treadonly stop?: (input: RuntimeInput<RuntimeConfig>) => Effect.Effect<Observed, SandboxProviderError>;\n\treadonly destroy?: (input: RuntimeInput<RuntimeConfig>) => Effect.Effect<void, SandboxProviderError>;\n}\n\nexport type Definition<CreateConfig, RuntimeConfig extends RuntimeConfigBase> = Pick<\n\tDriver<CreateConfig, RuntimeConfig>,\n\t\"name\" | \"createConfigCodec\" | \"runtimeConfigCodec\"\n>;\n\n/** Registry-only erased shape. Driver authors construct it via {@link driver}. */\nexport interface Registered {\n\treadonly name: Name;\n\treadonly kind: Exclude<SandboxInstance.Kind, \"local\">;\n\treadonly capabilities: Capabilities;\n\treadonly createConfigCodec: Schema.Codec<unknown, unknown>;\n\treadonly runtimeConfigCodec: Schema.Codec<RuntimeConfigBase, unknown>;\n\treadonly create: (input: {\n\t\treadonly instanceId: SandboxInstance.ID;\n\t\treadonly config: unknown;\n\t}) => Effect.Effect<Provisioned<RuntimeConfigBase>, SandboxProviderError>;\n\treadonly runtimeConfigFor?:\n\t\t| ((input: {\n\t\t\t\treadonly providerResourceId: string;\n\t\t\t\treadonly overrides?: Readonly<Record<string, unknown>> | undefined;\n\t\t  }) => Effect.Effect<RuntimeConfigBase, SandboxProviderError>)\n\t\t| undefined;\n\treadonly attach: (\n\t\tinput: RuntimeInput<RuntimeConfigBase>,\n\t) => Layer.Layer<SandboxIO.FileSystem | SandboxIO.Shell, SandboxProviderError>;\n\treadonly inspect?: (input: RuntimeInput<RuntimeConfigBase>) => Effect.Effect<Observed, SandboxProviderError>;\n\treadonly wake?: (input: RuntimeInput<RuntimeConfigBase>) => Effect.Effect<Observed, SandboxProviderError>;\n\treadonly stop?: (input: RuntimeInput<RuntimeConfigBase>) => Effect.Effect<Observed, SandboxProviderError>;\n\treadonly destroy?: (input: RuntimeInput<RuntimeConfigBase>) => Effect.Effect<void, SandboxProviderError>;\n}\n\nexport const erase = <CreateConfig, RuntimeConfig extends RuntimeConfigBase>(\n\tvalue: Driver<CreateConfig, RuntimeConfig>,\n): Registered => ({\n\tname: value.name,\n\tkind: value.kind,\n\tcapabilities: value.capabilities,\n\tcreateConfigCodec: value.createConfigCodec as Schema.Codec<unknown, unknown>,\n\truntimeConfigCodec: value.runtimeConfigCodec as Schema.Codec<RuntimeConfigBase, unknown>,\n\tcreate: (input) => value.create({ instanceId: input.instanceId, config: input.config as CreateConfig }),\n\t...(value.runtimeConfigFor === undefined\n\t\t? {}\n\t\t: {\n\t\t\t\truntimeConfigFor: (input: {\n\t\t\t\t\treadonly providerResourceId: string;\n\t\t\t\t\treadonly overrides?: Readonly<Record<string, unknown>> | undefined;\n\t\t\t\t}) =>\n\t\t\t\t\tvalue.runtimeConfigFor!({\n\t\t\t\t\t\tproviderResourceId: input.providerResourceId,\n\t\t\t\t\t\t...(input.overrides === undefined ? {} : { overrides: input.overrides as Partial<RuntimeConfig> }),\n\t\t\t\t\t}),\n\t\t\t}),\n\tattach: (input) => value.attach(input as RuntimeInput<RuntimeConfig>),\n\t...(value.inspect === undefined\n\t\t? {}\n\t\t: { inspect: (input: RuntimeInput<RuntimeConfigBase>) => value.inspect!(input as RuntimeInput<RuntimeConfig>) }),\n\t...(value.wake === undefined\n\t\t? {}\n\t\t: { wake: (input: RuntimeInput<RuntimeConfigBase>) => value.wake!(input as RuntimeInput<RuntimeConfig>) }),\n\t...(value.stop === undefined\n\t\t? {}\n\t\t: { stop: (input: RuntimeInput<RuntimeConfigBase>) => value.stop!(input as RuntimeInput<RuntimeConfig>) }),\n\t...(value.destroy === undefined\n\t\t? {}\n\t\t: { destroy: (input: RuntimeInput<RuntimeConfigBase>) => value.destroy!(input as RuntimeInput<RuntimeConfig>) }),\n});\n\nexport type Source = \"core\" | \"builtin\" | \"package\" | \"file\";\n\nexport interface Registration {\n\treadonly registered: Registered;\n\treadonly apiVersion: ApiVersion;\n\treadonly source: Source;\n}\n\nexport interface Module<Options> {\n\treadonly apiVersion: ApiVersion;\n\treadonly name: Name;\n\treadonly options: Schema.Codec<Options, unknown>;\n\treadonly make: (options: Options) => Registration;\n}\n\nexport interface ModuleDefinition<Options> {\n\treadonly apiVersion: ApiVersion;\n\treadonly name: string | Name;\n\treadonly options: Schema.Codec<Options, unknown>;\n\treadonly make: (options: Options) => Registration;\n}\n\n/** Define the default export of a loadable sandbox package. */\nconst defineModule = <Options>(value: ModuleDefinition<Options>): Module<Options> => ({\n\t...value,\n\tname: Name.make(value.name),\n});\nexport { defineModule as module };\n\n/** Construct a driver and its registry contribution. */\nexport const driver = <CreateConfig, RuntimeConfig extends RuntimeConfigBase>(\n\tvalue: Driver<CreateConfig, RuntimeConfig>,\n): Driver<CreateConfig, RuntimeConfig> & Registration =>\n\tObject.assign(value, {\n\t\tregistered: erase(value),\n\t\tapiVersion,\n\t\tsource: \"builtin\" as const,\n\t});\n\n/** Attach trusted origin metadata without changing the driver implementation. */\nexport const withSource = (registration: Registration, source: Source): Registration => ({\n\t...registration,\n\tsource,\n});\n\nexport * as SandboxDriver from \"./driver.ts\";\n","import { Schema } from \"effect\";\nimport { SandboxInstance } from \"./instance.ts\";\n\n/**\n * Lifecycle errors are confined to the control plane. Once a mount succeeds,\n * consumers continue to see only FileSystemError and ShellError.\n */\nexport class SandboxNotFoundError extends Schema.TaggedError<SandboxNotFoundError>()(\"SandboxNotFoundError\", {\n\tid: SandboxInstance.ID,\n}) {}\n\nexport class SandboxDriverNotRegisteredError extends Schema.TaggedError<SandboxDriverNotRegisteredError>()(\n\t\"SandboxDriverNotRegisteredError\",\n\t{\n\t\tdriver: Schema.String,\n\t\tregistered: Schema.optional(Schema.Array(Schema.String)),\n\t},\n) {}\n\nexport class SandboxDriverRegistrationError extends Schema.TaggedError<SandboxDriverRegistrationError>()(\n\t\"SandboxDriverRegistrationError\",\n\t{\n\t\tdriver: Schema.String,\n\t\treason: Schema.String,\n\t},\n) {}\n\nexport const SandboxDriverLoadPhase = Schema.Literals([\n\t\"resolve\",\n\t\"import\",\n\t\"module\",\n\t\"api-version\",\n\t\"options\",\n\t\"factory\",\n\t\"registration\",\n]);\nexport type SandboxDriverLoadPhase = typeof SandboxDriverLoadPhase.Type;\n\nexport class SandboxDriverLoadError extends Schema.TaggedError<SandboxDriverLoadError>()(\"SandboxDriverLoadError\", {\n\tspecifier: Schema.String,\n\tphase: SandboxDriverLoadPhase,\n\tdriver: Schema.optional(Schema.String),\n\treason: Schema.String,\n}) {}\n\nexport class SandboxBusyError extends Schema.TaggedError<SandboxBusyError>()(\"SandboxBusyError\", {\n\tid: SandboxInstance.ID,\n\trefCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n}) {}\n\nexport class SandboxMustBeStoppedError extends Schema.TaggedError<SandboxMustBeStoppedError>()(\n\t\"SandboxMustBeStoppedError\",\n\t{\n\t\tid: SandboxInstance.ID,\n\t\tstatus: SandboxInstance.Status,\n\t},\n) {}\n\nexport class SandboxRemovedError extends Schema.TaggedError<SandboxRemovedError>()(\"SandboxRemovedError\", {\n\tid: SandboxInstance.ID,\n\tremovedAt: Schema.optional(Schema.DateTimeUtc),\n}) {}\n\nexport class SandboxUnavailError extends Schema.TaggedError<SandboxUnavailError>()(\"SandboxUnavailError\", {\n\tid: SandboxInstance.ID,\n\treason: Schema.String,\n}) {}\n\nexport class SandboxUnsupportedError extends Schema.TaggedError<SandboxUnsupportedError>()(\"SandboxUnsupportedError\", {\n\tid: Schema.optional(SandboxInstance.ID),\n\tdriver: Schema.String,\n\toperation: Schema.String,\n}) {}\n\nexport class SandboxTransitionConflictError extends Schema.TaggedError<SandboxTransitionConflictError>()(\n\t\"SandboxTransitionConflictError\",\n\t{\n\t\tid: SandboxInstance.ID,\n\t\texpected: Schema.Array(SandboxInstance.Status),\n\t\tactual: SandboxInstance.Status,\n\t},\n) {}\n\n/**\n * A lifecycle failure safe to serialize, persist, or log.\n *\n * The raw SDK defect is deliberately absent from the schema. It is retained on\n * a non-enumerable symbol by {@link providerError}, so Effect's default\n * formatting and JSON serialization cannot expose credentials nested in it.\n */\nexport class SandboxProviderError extends Schema.TaggedError<SandboxProviderError>()(\"SandboxProviderError\", {\n\tdriver: Schema.String,\n\toperation: Schema.String,\n\tsanitized: SandboxInstance.PersistedError,\n}) {}\n\nconst rawCause = Symbol(\"@codework/sandbox/provider/error/raw/cause\");\nconst missingResource = Symbol(\"@codework/sandbox/provider/error/missing/resource\");\n\nexport const providerErrorCause = (error: SandboxProviderError): unknown =>\n\t(error as SandboxProviderError & { readonly [rawCause]?: unknown })[rawCause];\n\nexport const providerErrorIsNotFound = (error: SandboxProviderError): boolean =>\n\t(error as SandboxProviderError & { readonly [missingResource]?: boolean })[missingResource] === true;\n\nexport type Redactor = (value: string) => string;\n\nconst REDACTED = \"<redacted>\";\n\n/**\n * Conservative text redaction shared by every driver sanitizer.\n *\n * Disclaimer: This can really leak. Its never safe\n *\n * Configured secrets are removed exactly. Common authorization/header and URL\n * query shapes are masked as a second line of defence for values the caller did\n * not explicitly seed.\n *\n * Note: add support for diff regex as needed.\n */\nexport const makeRedactor = (secrets: Iterable<string> = []): Redactor => {\n\tconst configured = [...secrets].filter((secret) => secret.length > 0).sort((a, b) => b.length - a.length);\n\treturn (value) => {\n\t\tlet redacted = value;\n\t\tfor (const secret of configured) redacted = redacted.replaceAll(secret, REDACTED);\n\t\treturn redacted\n\t\t\t.replace(/\\b(authorization\\s*:\\s*(?:bearer|basic)\\s+)[^\\s,;]+/gi, `$1${REDACTED}`)\n\t\t\t.replace(/\\b((?:api[-_]?key|token|secret|password)\\s*[=:]\\s*)[^\\s,;&]+/gi, `$1${REDACTED}`)\n\t\t\t.replace(/([?&](?:access_token|api_key|token|secret|password)=)[^&#\\s]+/gi, `$1${REDACTED}`)\n\t\t\t.replace(/\\b(?:gh[opsu]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,})\\b/g, REDACTED);\n\t};\n};\n\nconst errorCode = (cause: unknown): string | undefined => {\n\tif (typeof cause !== \"object\" || cause === null || !(\"code\" in cause)) return undefined;\n\tconst code = cause.code;\n\treturn typeof code === \"string\" || typeof code === \"number\" ? String(code) : undefined;\n};\n\nconst errorName = (cause: unknown): string => {\n\tif (typeof cause !== \"object\" || cause === null || !(\"name\" in cause) || typeof cause.name !== \"string\")\n\t\treturn \"Error\";\n\treturn cause.name;\n};\n\nconst errorMessage = (cause: unknown): string => {\n\tif (typeof cause === \"object\" && cause !== null && \"message\" in cause && typeof cause.message === \"string\")\n\t\treturn cause.message;\n\treturn String(cause);\n};\n\nexport const sanitizeError = (cause: unknown, redact: Redactor = makeRedactor()): SandboxInstance.PersistedError => {\n\tconst code = errorCode(cause);\n\treturn {\n\t\tname: redact(errorName(cause)),\n\t\tmessage: redact(errorMessage(cause)),\n\t\t...(code === undefined ? {} : { code: redact(code) }),\n\t};\n};\n\nexport const providerError = (input: {\n\treadonly driver: string;\n\treadonly operation: string;\n\treadonly cause: unknown;\n\treadonly redact?: Redactor;\n\treadonly sanitize?: (cause: unknown, redact: Redactor) => SandboxInstance.PersistedError;\n\treadonly notFound?: boolean;\n}): SandboxProviderError => {\n\tconst redact = input.redact ?? makeRedactor();\n\tconst error = new SandboxProviderError({\n\t\tdriver: input.driver,\n\t\toperation: input.operation,\n\t\tsanitized: (input.sanitize ?? sanitizeError)(input.cause, redact),\n\t});\n\tObject.defineProperty(error, rawCause, {\n\t\tconfigurable: false,\n\t\tenumerable: false,\n\t\tvalue: input.cause,\n\t\twritable: false,\n\t});\n\tObject.defineProperty(error, missingResource, {\n\t\tconfigurable: false,\n\t\tenumerable: false,\n\t\tvalue: input.notFound === true,\n\t\twritable: false,\n\t});\n\treturn error;\n};\n\nexport type SandboxMountError =\n\t| SandboxNotFoundError\n\t| SandboxDriverNotRegisteredError\n\t| SandboxUnavailError\n\t| SandboxRemovedError\n\t| SandboxProviderError;\n\nexport type SandboxCreateError =\n\t| SandboxDriverNotRegisteredError\n\t| SandboxDriverRegistrationError\n\t| SandboxProviderError;\n\nexport type SandboxRegisterError =\n\t| SandboxDriverNotRegisteredError\n\t| SandboxDriverRegistrationError\n\t| SandboxUnsupportedError\n\t| SandboxProviderError;\n\nexport type SandboxReadError = never;\n\nexport type SandboxRefreshError =\n\t| SandboxNotFoundError\n\t| SandboxDriverNotRegisteredError\n\t| SandboxUnavailError\n\t| SandboxUnsupportedError\n\t| SandboxProviderError;\n\nexport type SandboxWakeError = SandboxRefreshError | SandboxRemovedError;\n\nexport type SandboxStopError = SandboxWakeError | SandboxBusyError | SandboxTransitionConflictError;\n\nexport type SandboxDestroyError = SandboxStopError | SandboxMustBeStoppedError;\n\nexport * as SandboxError from \"./errors.ts\";\n","export { AbsolutePath, apiVersion, driver, module, Name, RuntimeConfigBase } from \"../driver.ts\";\nexport type {\n\tApiVersion,\n\tCapabilities,\n\tDefinition,\n\tDriver,\n\tModule,\n\tModuleDefinition,\n\tObserved,\n\tProvisioned,\n\tRegistration,\n\tRuntimeConfigBase as RuntimeConfig,\n\tRuntimeInput,\n} from \"../driver.ts\";\n\nexport * as SandboxDriver from \"./driver.ts\";\n","export { Current, FileSystem, Shell } from \"../io.ts\";\nexport type { Identity, Layer, Provides } from \"../io.ts\";\n\nexport * as SandboxIO from \"./io.ts\";\n","export {\n\tmakeRedactor,\n\tproviderError,\n\tproviderErrorCause,\n\tproviderErrorIsNotFound,\n\tSandboxProviderError,\n\tsanitizeError,\n} from \"./errors.ts\";\nexport type { Redactor } from \"./errors.ts\";\n","import { Context } from \"effect\";\n\n/**\n * The driver's own locator for the attached resource — a Vercel sandbox name, a\n * Daytona sandbox id.\n *\n * Deliberately *not* on `SandboxIO.Current`: consumers never parse one,\n * and keeps it separate from the application id precisely so a driver's format can\n * change without touching identity.\n *\n * It exists for the control plane, which records it as `provider_resource_id`,\n * and for tests that reattach to the same resource.\n *\n * One tag for every driver rather than one per driver. A mount has exactly one\n * driver, so there is nothing to disambiguate, and the control plane has to read\n * the locator without knowing which driver produced it — keeps the\n * driver name open, so anything keyed on a closed `\"vercel\" | \"daytona\"` set is\n * a bug waiting for the third driver.\n */\nexport class Service extends Context.Service<Service, { readonly providerResourceId: string }>()(\n\t\"@codeworksh/harness/sandbox/resource/Service\",\n) {}\n\nexport * as SandboxResource from \"./resource.ts\";\n","export { fromExec, quote, quoteArgv, Shell, ShellError } from \"../shell/shell.ts\";\nexport type { ExecChunk, ExecResult, ISandboxExe, ShellOptions } from \"../shell/shell.ts\";\n"],"mappings":";;;;;;AAKA,MAAM,kCAAkB,IAAI,QAA2D;AAEvF,MAAM,qBAAwC,WAA2D;CACxG,MAAM,SAAS,gBAAgB,IAAI,MAAM;CACzC,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,MAAM,WAAW,cAAc,QAAQ,MAAM;CAC7C,gBAAgB,IAAI,QAAQ,QAAQ;CACpC,OAAO;AACR;AAEA,MAAM,kBAAkB,UAGV;CACb,IAAI,MAAM,cAAc,OAAO,MAAM,aAAa,UAAU,CAAC;CAC7D,MAAM,WAAW,MAAM,QAAQ;CAC/B,OAAO,MAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI;AACxD;AAEA,MAAM,uBAA0C,QAAW,OAAgB,UAA6B;CACvG,MAAM,YAAY,kBAAkB,MAAM;CAC1C,IAAI,UAAU,MAAM,KAAK,GAAG,OAAO;CAEnC,MAAM,GAAG,UAAU,UAAU,OAAO,KAAK;CACzC,MAAM,UAAU,OAAO,KAAK,UAAU,MAAM,eAAe,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,KAAK;CACrG,MAAM,IAAI,MAAM,yBAAyB,MAAM,IAAI,SAAS;AAC7D;;AAGA,MAAa,wBAAwB,OAAgB,UACpD,oBAAoB,QAAQ,eAAe,OAAO,KAAK;AAExD,MAAa,4BAA4B,OAAgB,UACxD,oBAAoB,QAAQ,mBAAmB,OAAO,KAAK;AAE5D,MAAa,iCAAiC,OAAgB,UAC7D,oBAAoB,QAAQ,wBAAwB,OAAO,KAAK;AAEjE,MAAa,qCAAqC,OAAgB,UACjE,oBAAoB,QAAQ,4BAA4B,OAAO,KAAK;AAErE,MAAa,2BAA2B,UACvC,kBAAkB,QAAQ,sBAAsB,CAAC,CAAC,MAAM,KAAK;AAE9D,MAAa,+BAA+B,UAC3C,kBAAkB,QAAQ,0BAA0B,CAAC,CAAC,MAAM,KAAK;AAKvC,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;;;;AAKnE,MAAa,iBAAiB,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;;;AAK/E,MAAa,kBAAkB,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC;;;;AAKnF,MAAaA,iBAAe,OAAO,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;;;;;AAO3E,MAAa,YAAkC,WAC9C,OAAO,YAAY,MAAM,CAAC,CAAC,KAC1B,OAAO,SAAS,OAAO,SAAS,OAAO,OAAO,MAAM,CAAC,GAAG;CACvD,QAAQ,aAAa,YAAY,EAAE,QAAQ,MAAM,CAAC;CAClD,QAAQ,aAAa,kBAAkB,OAAO,QAAQ,UAAU,UAAU,KAAA,CAAS,CAAC;AACrF,CAAC,CACF;;;;;;;;;;;;AAwCD,MAAa,eAC0C,aACrD,WACA,OAAO,OAAO,QAAQ,QAAQ,MAAM,CAAC;AAyCvC,MAAa,wBAAwB,OAAO,OAAO,KAClD,OAAO,SAAS,OAAO,aAAa;CACnC,QAAQ,aAAa,WAAW,UAAU,SAAS,WAAW,KAAK,CAAC;CACpE,QAAQ,aAAa,WAAW,UAAU,SAAS,cAAc,KAAK,CAAC;AACxE,CAAC,CACF;;;;ACzKA,MAAa,QAAQ,OAAO,QAAQ,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACe9E,MAAa,KAAK,OAAO,OAAO,KAC/B,OAAO,MAAM,oBAAoB,GACjC,aAAa,YAAY;;;;;;CAMxB,OAAO,OAAO,KAAK,OAAO;;CAE1B,cAAc,OAAO,KAAK,OAAO,OAAO,GAAG;AAC5C,EAAE,CACH;;;;;;;;;;;;;;;;;AAmBA,MAAa,YAAY,OAA2B,OAAO,GAAG,QAAQ,OAAO;AAC7E,MAAa,cAAc,UAA8B,UAAU,OAAO,GAAG,QAAQ,GAAG,KAAK,KAAK;;;;;;AAOlG,MAAa,WAAW,OAA+B,OAAO,GAAG,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AACvG,MAAa,aAAa,UAAiC,OAAO,UAAU,aAAa,GAAG,KAAK;;;;;;;AAQjG,MAAa,OAAO,OAAO,SAAS;CAAC;CAAS;CAAW;AAAQ,CAAC;AAGlE,MAAa,YAAY,OAAO,SAAS,CAAC,WAAW,UAAU,CAAC;;;;;;;;;;;;;AAehE,MAAa,SAAS,OAAO,SAAS;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;;;;;;;;;;;;;;AAgBD,MAAa,4BAAiC,IAAI,IAAY;CAAC;CAAU;CAAW;AAAS,CAAC;AAE9F,MAAa,eAAe,WAA4B,UAAU,IAAI,MAAM;;;;;;;;;;AAW5E,MAAa,QAAQ,OAAO,SAAS;CAAC;CAAQ;CAAQ;AAAQ,CAAC;;AAI/D,MAAa,iBAAiB,OAAO,OAAO;CAC3C,MAAM,OAAO;CACb,SAAS,OAAO;CAChB,MAAM,OAAO,SAAS,OAAO,MAAM;AACpC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjGD,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC7F,6BACA;CACC,WAAW,OAAO;CAClB,SAAS,OAAO;AACjB,CACD,CAAC,CAAC,CAAC;;AAGH,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,0BAA0B;CACpG,QAAQ,OAAO;CACf,MAAM,OAAO;CACb,OAAO,OAAO,SAAS,OAAO,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC,CAAC;;AAgBJ,MAAa,mBAAmB,UAAmB;CAClD,MAAM,OAAQ,OAA6C;CAC3D,OAAO,SAAS,YAAY,SAAS;AACtC;;;;;;;AAQA,MAAa,kBAAkB,CAC9B,0BACA,0FACD;;AAoDA,IAAaC,YAAb,cAA6B,QAAQ,QAA4B,CAAC,CACjE,mDACD,CAAC,CAAC,CAAC;;;;;;AAOH,MAAa,qBACZ,SACA,YAAY,SAEZ,OAAO,cAAc;CACpB,KAAK,MAAM,UAAU,OAAO,KAAM,WAAW,CAAC,CAA6B,GAAG;EAC7E,IAAI,WAAW,eAAe,WAAW,SAAS;EAClD,OAAO,OAAO,KAAK,IAAI,0BAA0B;GAAE;GAAW,SAAS,0BAA0B;EAAS,CAAC,CAAC;CAC7G;CACA,OAAO,OAAO;AACf,CAAC;;;;;;AAOF,MAAa,gBAAgB,aAAkC;CAC9D,MAAM,WAAc,QAAgB,MAAc,QACjD,OAAO,WAAW;EAAE,KAAK;EAAK,QAAQ,UAAU,IAAI,gBAAgB;GAAE;GAAQ;GAAM;EAAM,CAAC;CAAE,CAAC;CAa/F,MAAM,wBAAwB,MAAc,YAAiC;EAC5E,MAAM,QAAQ,QAAQ,aAAa,YAAY,SAAS,UAAU,MAAM,OAAO,CAAC;EAChF,MAAM,SAAS,MAAM,QAAQ,IAAI;EACjC,OAAO,MAAM,KACZ,OAAO,YACN,QAAQ,SAAS,cAAc,SAAS,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,KAC3E,OAAO,QACP,OAAO,QAAQ,KAAK,CACrB,CACD,CACD;CACD;CAEA,OAAO;EACN,UAAU,OAAO,GAAG,4BAA4B,CAAC,EAAE,SAClD,QAAQ,YAAY,YAAY,SAAS,SAAS,IAAI,CAAC,CACxD;EACA,gBAAgB,OAAO,GAAG,kCAAkC,CAAC,EAAE,SAC9D,QAAQ,kBAAkB,YAAY,SAAS,eAAe,IAAI,CAAC,CACpE;EACA,WAAW,OAAO,GAAG,6BAA6B,CAAC,CAAC,oBAAoB;EACxE,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,SAAiB,QAAQ,QAAQ,YAAY,SAAS,KAAK,IAAI,CAAC,CAAC;EAE5G,GAAI,SAAS,UAAU,KAAA,IACpB,CAAC,IACD,EACA,OAAO,OAAO,GAAG,yBAAyB,CAAC,EAAE,SAC5C,QAAQ,SAAS,YAAY,SAAS,MAAO,IAAI,CAAC,CACnD,EACD;EACF,SAAS,OAAO,GAAG,2BAA2B,CAAC,EAAE,SAChD,QAAQ,WAAW,YAAY,SAAS,QAAQ,IAAI,CAAC,CACtD;EAIA,QAAQ,OAAO,GAAG,0BAA0B,CAAC,EAAE,SAC9C,QAAQ,UAAU,YAAY,SAAS,OAAO,IAAI,CAAC,CACpD;EACA,OAAO,OAAO,GAAG,yBAAyB,CAAC,EAAE,MAAc,YAC1D,QAAQ,SAAS,YAAY,SAAS,MAAM,MAAM,OAAO,CAAC,CAC3D;EACA,IAAI,OAAO,GAAG,sBAAsB,CAAC,EAAE,MAAc,YACpD,kBAAkB,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,MAAM,YAAY,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CACtG;EACA,UAAU,OAAO,GAAG,4BAA4B,CAAC,EAAE,SAClD,QAAQ,YAAY,YAAY,SAAS,SAAS,IAAI,CAAC,CACxD;CACD;AACD;;;;;;;;;AAUA,MAAaC,aAAW,IAAe,QAA2B;CACjE,MAAM,MAAM,SAAiB,MAAM,QAAQ,KAAK,IAAI;CACpD,OAAO;EACN,WAAW,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;EACxC,iBAAiB,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC;EACpD,YAAY,MAAM,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO;EAC5D,OAAO,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;EAChC,UAAU,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;EACtC,SAAS,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;EACpC,QAAQ,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO;EACpD,KAAK,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,GAAG,OAAO;EAC9C,WAAW,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;EAGxC,GAAI,GAAG,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAiB,GAAG,MAAO,GAAG,IAAI,CAAC,EAAE;CAClF;AACD;;;;;;;;;AC1OA,IAAa,aAAb,cAAgC,OAAO,YAAwB,CAAC,CAAC,cAAc;CAC9E,SAAS,OAAO;CAChB,OAAO,OAAO,SAAS,OAAO,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;AAkEJ,MAAM,iCAAiB,IAAI,QAA8B;AAEzD,MAAa,YAAY,WAAwB,SAAoC;CACpF,eAAe,IAAI,WAAW,IAAI;CAClC,OAAO;AACR;;;;;;AAOA,MAAa,SAAS,UAAkB,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;;AAGzE,MAAa,aAAa,SAAgC,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG;;;;;;AAOlF,MAAa,cAAc,MAA0B,QAA4B;CAChF,IAAI,QAAQ,KAAA,KAAaC,MAAK,WAAW,GAAG,KAAK,SAAS,KAAA,GAAW,OAAO,OAAO;CACnF,OAAOA,MAAK,QAAQ,MAAM,GAAG;AAC9B;;;;;;;;;;AAWA,MAAa,YAAY,YAAwD;CAChF,MAAM,UAAuB;EAC5B,GAAG;EACH,WAAW,MAAM,YAAY,QAAQ,KAAK,UAAU,IAAI,GAAG,OAAO;CACnE;CACA,MAAM,eAAe,eAAe,IAAI,OAAO;CAC/C,OAAO,iBAAiB,KAAA,IAAY,UAAU,SAAS,UAAU,QAAQ,SAAS,aAAa,GAAG,CAAC,CAAC;AACrG;;;;;;;;;;AAWA,MAAa,WAAW,SAAsB,QAA6B;CAC1E,MAAM,UAAU,eAAe,IAAI,OAAO,CAAC,GAAG,GAAG,KAAK;CACtD,MAAM,MAAM,YAAyC;EACpD,MAAM,cAAc,WAAW,KAAK,SAAS,GAAG;EAChD,OAAO;GAAE,GAAG;GAAS,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,YAAY;EAAG;CACjF;CACA,MAAM,SAAS,QAAQ;CACvB,OAAO;EACN,OAAO,SAAS,YAAY,QAAQ,KAAK,SAAS,GAAG,OAAO,CAAC;EAC7D,WAAW,MAAM,YAAY,QAAQ,SAAS,MAAM,GAAG,OAAO,CAAC;EAC/D,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,YAAY,OAAO,SAAS,GAAG,OAAO,CAAC,EAAE;CAC9F;AACD;;AAGA,IAAaC,UAAb,cAA2B,QAAQ,QAA4B,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;ACvH7G,MAAaC,eAAaC;;AAI1B,MAAa,QAAQC;;AAsBrB,IAAa,UAAb,cAA6B,QAAQ,QAA2B,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;AAqB7G,MAAa,mBAAmB,YAAoB,QAAyB;CAC5E,IAAI,CAAC,MAAM,WAAW,UAAU,GAC/B,MAAM,IAAI,UAAU,yCAAyC,YAAY;CAQ1E,IAAI,QAAQ,KAAA,GAAW,OAAO,MAAM,QAAQ,UAAU;CACtD,OAAO,MAAM,WAAW,GAAG,IAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,QAAQ,YAAY,GAAG;AAClF;;;;;;;;;;;;AAaA,MAAa,SAAS,aACrBC,MAAY,SACXA,MAAY,QAAQ,SAAS,QAAQ,GACrCA,MAAY,OACXF,WACA,OAAO,IAAIA,YAA4B,OAAOG,UAA0B,IAAI,SAAS,GAAG,CAAC,CAC1F,GACAD,MAAY,OACXD,SACA,OAAO,IAAIA,UAAW,UAAuBG,QAAa,OAAO,SAAS,GAAG,CAAC,CAC/E,CACD;;;;;;;;;;;AAsBD,MAAa,QAAQ,SAA4B;CAChD,IAAA,GAAuB;CACvB,QAAQ;CACR,MAAM;CACN,KAAK,gBAAgB,QAAQ,IAAI,GAAG,GAAG;AACxC;;ACjIA,MAAa,OAAO,OAAO,OAAO,MAAM,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,oBAAoB,CAAC;;AAIpG,MAAa,eAAe,OAAO,OAAO,MAAM,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,KACzE,OAAO,MAAM,4BAA4B,CAC1C;AAGA,MAAa,oBAAoB,OAAO,OAAO,EAAE,YAAY,aAAa,CAAC;AAuF3E,MAAa,SACZ,WACiB;CACjB,MAAM,MAAM;CACZ,MAAM,MAAM;CACZ,cAAc,MAAM;CACpB,mBAAmB,MAAM;CACzB,oBAAoB,MAAM;CAC1B,SAAS,UAAU,MAAM,OAAO;EAAE,YAAY,MAAM;EAAY,QAAQ,MAAM;CAAuB,CAAC;CACtG,GAAI,MAAM,qBAAqB,KAAA,IAC5B,CAAC,IACD,EACA,mBAAmB,UAIlB,MAAM,iBAAkB;EACvB,oBAAoB,MAAM;EAC1B,GAAI,MAAM,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAoC;CACjG,CAAC,EACH;CACF,SAAS,UAAU,MAAM,OAAO,KAAoC;CACpE,GAAI,MAAM,YAAY,KAAA,IACnB,CAAC,IACD,EAAE,UAAU,UAA2C,MAAM,QAAS,KAAoC,EAAE;CAC/G,GAAI,MAAM,SAAS,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,UAA2C,MAAM,KAAM,KAAoC,EAAE;CACzG,GAAI,MAAM,SAAS,KAAA,IAChB,CAAC,IACD,EAAE,OAAO,UAA2C,MAAM,KAAM,KAAoC,EAAE;CACzG,GAAI,MAAM,YAAY,KAAA,IACnB,CAAC,IACD,EAAE,UAAU,UAA2C,MAAM,QAAS,KAAoC,EAAE;AAChH;;AAyBA,MAAM,gBAAyB,WAAuD;CACrF,GAAG;CACH,MAAM,KAAK,KAAK,MAAM,IAAI;AAC3B;;AAIA,MAAa,UACZ,UAEA,OAAO,OAAO,OAAO;CACpB,YAAY,MAAM,KAAK;CACvB,YAAA;CACA,QAAQ;AACT,CAAC;;AAGF,MAAa,cAAc,cAA4B,YAAkC;CACxF,GAAG;CACH;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;AClLA,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAAC,wBAAwB,EAC5G,IAAIC,GACL,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,kCAAb,cAAqD,OAAO,YAA6C,CAAC,CACzG,mCACA;CACC,QAAQ,OAAO;CACf,YAAY,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AACxD,CACD,CAAC,CAAC,CAAC;AAEH,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACvG,kCACA;CACC,QAAQ,OAAO;CACf,QAAQ,OAAO;AAChB,CACD,CAAC,CAAC,CAAC;AAEH,MAAa,yBAAyB,OAAO,SAAS;CACrD;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AAGD,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CAAC,0BAA0B;CAClH,WAAW,OAAO;CAClB,OAAO;CACP,QAAQ,OAAO,SAAS,OAAO,MAAM;CACrC,QAAQ,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAAC,oBAAoB;CAChG,IAAIA;CACJ,UAAU,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC7F,6BACA;CACC,IAAIA;CACJ,QAAQC;AACT,CACD,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAAC,uBAAuB;CACzG,IAAID;CACJ,WAAW,OAAO,SAAS,OAAO,WAAW;AAC9C,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAAC,uBAAuB;CACzG,IAAIA;CACJ,QAAQ,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CAAC,2BAA2B;CACrH,IAAI,OAAO,SAASA,EAAkB;CACtC,QAAQ,OAAO;CACf,WAAW,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACvG,kCACA;CACC,IAAIA;CACJ,UAAU,OAAO,MAAMC,MAAsB;CAC7C,QAAQA;AACT,CACD,CAAC,CAAC,CAAC;;;;;;;;AASH,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAAC,wBAAwB;CAC5G,QAAQ,OAAO;CACf,WAAW,OAAO;CAClB,WAAWC;AACZ,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,WAAW,OAAO,4CAA4C;AACpE,MAAM,kBAAkB,OAAO,mDAAmD;AAElF,MAAa,sBAAsB,UACjC,MAAmE;AAErE,MAAa,2BAA2B,UACtC,MAA0E,qBAAqB;AAIjG,MAAM,WAAW;;;;;;;;;;;;AAajB,MAAa,gBAAgB,UAA4B,CAAC,MAAgB;CACzE,MAAM,aAAa,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,WAAW,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM;CACxG,QAAQ,UAAU;EACjB,IAAI,WAAW;EACf,KAAK,MAAM,UAAU,YAAY,WAAW,SAAS,WAAW,QAAQ,QAAQ;EAChF,OAAO,SACL,QAAQ,yDAAyD,KAAK,UAAU,CAAC,CACjF,QAAQ,kEAAkE,KAAK,UAAU,CAAC,CAC1F,QAAQ,mEAAmE,KAAK,UAAU,CAAC,CAC3F,QAAQ,oEAAoE,QAAQ;CACvF;AACD;AAEA,MAAM,aAAa,UAAuC;CACzD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,UAAU,QAAQ,OAAO,KAAA;CAC9E,MAAM,OAAO,MAAM;CACnB,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW,OAAO,IAAI,IAAI,KAAA;AAC9E;AAEA,MAAM,aAAa,UAA2B;CAC7C,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,UAAU,UAAU,OAAO,MAAM,SAAS,UAC9F,OAAO;CACR,OAAO,MAAM;AACd;AAEA,MAAM,gBAAgB,UAA2B;CAChD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa,SAAS,OAAO,MAAM,YAAY,UACjG,OAAO,MAAM;CACd,OAAO,OAAO,KAAK;AACpB;AAEA,MAAa,iBAAiB,OAAgB,SAAmB,aAAa,MAAsC;CACnH,MAAM,OAAO,UAAU,KAAK;CAC5B,OAAO;EACN,MAAM,OAAO,UAAU,KAAK,CAAC;EAC7B,SAAS,OAAO,aAAa,KAAK,CAAC;EACnC,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,OAAO,IAAI,EAAE;CACpD;AACD;AAEA,MAAa,iBAAiB,UAOF;CAC3B,MAAM,SAAS,MAAM,UAAU,aAAa;CAC5C,MAAM,QAAQ,IAAI,qBAAqB;EACtC,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,YAAY,MAAM,YAAY,cAAA,CAAe,MAAM,OAAO,MAAM;CACjE,CAAC;CACD,OAAO,eAAe,OAAO,UAAU;EACtC,cAAc;EACd,YAAY;EACZ,OAAO,MAAM;EACb,UAAU;CACX,CAAC;CACD,OAAO,eAAe,OAAO,iBAAiB;EAC7C,cAAc;EACd,YAAY;EACZ,OAAO,MAAM,aAAa;EAC1B,UAAU;CACX,CAAC;CACD,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AIxKA,IAAa,UAAb,cAA6B,QAAQ,QAA0D,CAAC,CAC/F,8CACD,CAAC,CAAC,CAAC"}

package/sandbox.d.mts

@@ -1,2 +1,2 @@
-import { E as filesystem_d_exports, a as driver_d_exports, i as io_d_exports, n as resource_d_exports, r as error_d_exports, t as shell_d_exports, u as instance_d_exports } from "./sandbox-DnL9UPzZ.mjs";
+import { W as filesystem_d_exports, a as driver_d_exports, i as io_d_exports, n as resource_d_exports, r as error_d_exports, t as shell_d_exports, u as instance_d_exports } from "./sandbox-DX9mliQs.mjs";
 export { driver_d_exports as SandboxDriver, filesystem_d_exports as SandboxFileSystem, io_d_exports as SandboxIO, instance_d_exports as SandboxInstance, error_d_exports as SandboxProvider, resource_d_exports as SandboxResource, shell_d_exports as SandboxShell };

package/sandbox.mjs

@@ -1,2 +1,2 @@
-import { H as filesystem_exports, Q as instance_exports, a as io_exports, i as error_exports, o as driver_exports, r as resource_exports, t as shell_exports } from "./sandbox-QCmZ3UhD.mjs";
+import { G as filesystem_exports, a as io_exports, i as error_exports, nt as instance_exports, o as driver_exports, r as resource_exports, t as shell_exports } from "./sandbox-Dlz9cGeD.mjs";
 export { driver_exports as SandboxDriver, filesystem_exports as SandboxFileSystem, io_exports as SandboxIO, instance_exports as SandboxInstance, error_exports as SandboxProvider, resource_exports as SandboxResource, shell_exports as SandboxShell };

package/sandboxes/daytona/index.d.mts

@@ -1,2 +1,2 @@
-import { a as RuntimeConfig, c as sandbox, i as ResourcesConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../index-CTm6Qzer.mjs";
+import { a as RuntimeConfig, c as sandbox, i as ResourcesConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../index-5Ur9C_De.mjs";
 export { ClientOptions, CreateConfig, Options, ResourcesConfig, RuntimeConfig, config, sandbox as default, make };

package/sandboxes/daytona/index.mjs

@@ -1,2 +1,2 @@
-import { a as RuntimeConfig, c as sandbox, i as ResourcesConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../daytona-C6wWlJ4z.mjs";
+import { a as RuntimeConfig, c as sandbox, i as ResourcesConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../daytona-jO3_hTRS.mjs";
 export { ClientOptions, CreateConfig, Options, ResourcesConfig, RuntimeConfig, config, sandbox as default, make };

package/sandboxes/vercel/index.d.mts

@@ -1,2 +1,2 @@
-import { a as Source, c as sandbox, i as RuntimeConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../index-D5gDWEaM.mjs";
+import { a as Source, c as sandbox, i as RuntimeConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../index-B72Qlv0L.mjs";
 export { ClientOptions, CreateConfig, Options, RuntimeConfig, Source, config, sandbox as default, make };

package/sandboxes/vercel/index.mjs

@@ -1,2 +1,2 @@
-import { a as Source, c as sandbox, i as RuntimeConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../vercel-DW62mvsC.mjs";
+import { a as Source, c as sandbox, i as RuntimeConfig, n as CreateConfig, o as config, r as Options, s as make, t as ClientOptions } from "../../vercel-QPuO0iit.mjs";
 export { ClientOptions, CreateConfig, Options, RuntimeConfig, Source, config, sandbox as default, make };

package/{vercel-DW62mvsC.mjs → vercel-QPuO0iit.mjs}

@@ -1,4 +1,4 @@
-import { C as Name, E as driver, N as Shell, P as ShellError, R as quoteArgv, S as AbsolutePath, T as defineModule, U as fromProvider, V as Service, W as isNotFoundError, Y as PersistedError, n as Service$1, nt as posix, v as makeRedactor, x as sanitizeError, y as providerError, z as resolveCwd } from "./sandbox-QCmZ3UhD.mjs";
+import { $ as PersistedError, C as AbsolutePath, D as driver, E as defineModule, H as resolveCwd, I as Shell, J as realpathScripts, K as fromProvider, L as ShellError, S as sanitizeError, V as quoteArgv, W as Service, b as providerError, n as Service$1, ot as posix, q as isNotFoundError, w as Name, y as makeRedactor } from "./sandbox-Dlz9cGeD.mjs";
 import { Context, Effect, Layer, Option, Schema, Stream } from "effect";
 import { Buffer } from "node:buffer";
 //#region src/sandboxes/vercel/fs.ts
@@ -25,7 +25,8 @@ const make$1 = (provider, options) => {
 		readdir: (path) => provider.readdir(resolve(path)),
 		exists: (path) => provider.exists(resolve(path)),
 		mkdir: (path, mkdirOptions) => provider.mkdir(resolve(path), mkdirOptions),
-		rm: (path, rmOptions) => provider.rm(resolve(path), rmOptions)
+		rm: (path, rmOptions) => provider.rm(resolve(path), rmOptions),
+		realpath: (path) => provider.realpath(resolve(path))
 	};
 };
 //#endregion
@@ -97,7 +98,7 @@ const statsFrom = (stats) => {
 		...mtime instanceof Date && !Number.isNaN(mtime.getTime()) ? { mtime } : {}
 	};
 };
-const providerFrom = (sandbox) => {
+const providerFrom = (sandbox, options) => {
 	return {
 		readFile: (path) => sandbox.fs.readFile(path, "utf8"),
 		readFileBuffer: async (path) => new Uint8Array(await sandbox.fs.readFile(path)),
@@ -120,7 +121,20 @@ const providerFrom = (sandbox) => {
 		rm: (path, rmOptions) => sandbox.fs.rm(path, {
 			...rmOptions?.recursive === void 0 ? {} : { recursive: rmOptions.recursive },
 			...rmOptions?.force === void 0 ? {} : { force: rmOptions.force }
-		})
+		}),
+		realpath: async (path) => {
+			for (const script of realpathScripts) {
+				const result = await (await spawnArgv(sandbox, options, [
+					"sh",
+					"-c",
+					script,
+					"_",
+					path
+				])).wait();
+				if (result.exitCode === 0) return (await result.stdout()).trimEnd();
+			}
+			throw Object.assign(/* @__PURE__ */ new Error(`ENOENT: no such file or directory, realpath '${path}'`), { code: "ENOENT" });
+		}
 	};
 };
 const spawn = (sandbox, options, command, env, cwd) => spawnArgv(sandbox, options, [
@@ -194,7 +208,7 @@ const stream = (sandbox, options) => (command, opts) => Stream.unwrap(acquireCom
 * one here. The returned layer owns no provider resource and has no deletion
 * finalizer.
 */
-const transport = (sandbox, options = {}) => Layer.merge(Layer.succeed(Service, fromProvider(make$1(providerFrom(sandbox)))), Layer.succeed(Shell, Shell.of({
+const transport = (sandbox, options = {}) => Layer.merge(Layer.succeed(Service, fromProvider(make$1(providerFrom(sandbox, options)))), Layer.succeed(Shell, Shell.of({
 	exec: exec(sandbox, options),
 	execArgv: execArgv(sandbox, options),
 	stream: stream(sandbox, options)
@@ -338,4 +352,4 @@ const config = (value) => ({
 //#endregion
 export { Source as a, sandbox as c, RuntimeConfig as i, CreateConfig as n, config as o, Options as r, make as s, ClientOptions as t };
 
-//# sourceMappingURL=vercel-DW62mvsC.mjs.map
+//# sourceMappingURL=vercel-QPuO0iit.mjs.map

package/vercel-QPuO0iit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-QPuO0iit.mjs","names":["make","SandboxInstance.PersistedError","sanitizeSandboxError","SandboxFileSystem.isNotFoundError","SandboxFileSystem.realpathScripts","SandboxFileSystem.Service","SandboxFileSystem.fromProvider","RemoteFileSystem.make","SandboxResource.Service","SandboxDriver.AbsolutePath","EnvVercel.credentialsFrom","SandboxProvider.makeRedactor","SandboxProvider.providerError","EnvVercel.sanitizeProviderError","SandboxDriver.driver","EnvVercel.createSandbox","EnvVercel.transport","SandboxDriver.module"],"sources":["../../src/sandboxes/vercel/fs.ts","../../src/sandboxes/vercel/provider.ts","../../src/sandboxes/vercel/index.ts"],"sourcesContent":["import { posix } from \"../../util/posix.ts\";\nimport { SandboxFileSystem } from \"../../sandbox/fs/filesystem.ts\";\n\n// The provider contract and FileStat live in `filesystem.ts` (the single source of truth, VFS-free).\n// A remote provider implements this Interface; `make` wraps\n// it into the same runtime surface the local vfs backend exposes.\nexport type FileStat = SandboxFileSystem.FileStat;\n\n// Remote-aware callers can opt into metadata that is not part of the generic\n// SandboxFileSystem surface. In particular, `stat` keeps the familiar\n// provider-level meaning, while `lstat` explicitly asks for the directory entry\n// itself so symlink identity is not inferred from a method with mixed provider\n// semantics.\nexport interface Interface extends SandboxFileSystem.Provider {\n\treadonly lstat?: (path: string) => Promise<FileStat>;\n}\n\nexport interface Options {\n\t/**\n\t * Optional remote working directory for relative paths. When omitted, relative\n\t * paths are passed through so the remote provider can use its own default cwd.\n\t */\n\treadonly cwd?: string;\n}\n\nconst resolvePath = (path: string, options?: Options) => {\n\tconst normalized = posix.normalize(path);\n\tif (options?.cwd === undefined || posix.isAbsolute(normalized)) return normalized;\n\treturn posix.normalize(posix.join(options.cwd, normalized));\n};\n\n/**\n * Wrap a remote provider into the runtime filesystem surface: resolve relative\n * paths against `cwd`, and nothing else. Parent creation and `rm` option\n * validation are the runtime's job and live in `SandboxFileSystem.fromProvider`,\n * which every backend passes through — putting them here would cover only the\n * backends that happen to use this wrapper.\n */\nexport const make = (provider: Interface, options?: Options): SandboxFileSystem.Provider => {\n\tconst resolve = (path: string) => resolvePath(path, options);\n\n\treturn {\n\t\treadFile: (path) => provider.readFile(resolve(path)),\n\t\treadFileBuffer: (path) => provider.readFileBuffer(resolve(path)),\n\t\twriteFile: (path, content) => provider.writeFile(resolve(path), content),\n\t\tstat: (path) => provider.stat(resolve(path)),\n\t\t...(provider.lstat === undefined ? {} : { lstat: (path: string) => provider.lstat!(resolve(path)) }),\n\t\treaddir: (path) => provider.readdir(resolve(path)),\n\t\texists: (path) => provider.exists(resolve(path)),\n\t\tmkdir: (path, mkdirOptions) => provider.mkdir(resolve(path), mkdirOptions),\n\t\t// option validation happens in `fromProvider`, before any mutation\n\t\trm: (path, rmOptions) => provider.rm(resolve(path), rmOptions),\n\t\trealpath: (path) => provider.realpath(resolve(path)),\n\t};\n};\n\nexport const withProvider = make;\n","/* oxlint-disable effecttsgo/async-function -- Vercel's sandbox SDK boundary is Promise-based. */\nimport { Context, Effect, Layer, Schema, Stream } from \"effect\";\nimport { Buffer } from \"node:buffer\";\nimport { makeRedactor, type Redactor, sanitizeError as sanitizeSandboxError } from \"../../sandbox/errors.ts\";\nimport { SandboxFileSystem } from \"../../sandbox/fs/filesystem.ts\";\nimport { SandboxInstance } from \"../../sandbox/instance.ts\";\nimport { SandboxIO } from \"../../sandbox/io.ts\";\nimport { SandboxResource } from \"../../sandbox/resource.ts\";\nimport {\n\ttype ExecChunk,\n\ttype ExecResult,\n\ttype ISandboxExe,\n\tquoteArgv,\n\tresolveCwd,\n\tShell,\n\tShellError,\n} from \"../../sandbox/shell/shell.ts\";\nimport * as RemoteFileSystem from \"./fs.ts\";\n\nconst utf8 = new TextEncoder();\ntype Command = import(\"@vercel/sandbox\").Command;\ntype RemoteSandbox = import(\"@vercel/sandbox\").Sandbox;\n\n/** Vercel's namespace-intrinsic working directory. */\nexport const DEFAULT_CWD = \"/vercel/sandbox\";\n\nexport class VercelError extends Schema.TaggedError<VercelError>()(\"VercelError\", {\n\tsanitized: SandboxInstance.PersistedError,\n}) {}\n\nconst ApiFailure = Schema.Struct({\n\tjson: Schema.Struct({\n\t\terror: Schema.Struct({\n\t\t\tmessage: Schema.optional(Schema.String),\n\t\t\tcode: Schema.optional(Schema.String),\n\t\t}),\n\t}),\n});\nconst isApiFailure = Schema.is(ApiFailure);\n\n/** Prefer Vercel's structured API failure while retaining the shared redaction boundary. */\nexport const sanitizeProviderError = (\n\tcause: unknown,\n\tredact: Redactor = makeRedactor(),\n): SandboxInstance.PersistedError => {\n\tconst fallback = sanitizeSandboxError(cause, redact);\n\tif (!isApiFailure(cause)) return fallback;\n\tconst message = cause.json.error.message?.trim();\n\tconst code = cause.json.error.code?.trim();\n\treturn {\n\t\t...fallback,\n\t\t...(message === undefined || message.length === 0 ? {} : { message: redact(message) }),\n\t\t...(code === undefined || code.length === 0 ? {} : { code: redact(code) }),\n\t};\n};\n\n/**\n * Vercel API credentials. Either all three are provided together or none are:\n * when omitted, the SDK resolves them from the `VERCEL_OIDC_TOKEN` env var\n * (the token's payload carries the project and team ids).\n */\nexport interface Credentials {\n\treadonly token: string;\n\treadonly teamId: string;\n\treadonly projectId: string;\n}\n\nexport interface Options {\n\t/** Auth token (OIDC or access token). Falls back to `VERCEL_OIDC_TOKEN`. */\n\treadonly token?: string | undefined;\n\t/** Team id. Derived from the OIDC token when omitted. */\n\treadonly teamId?: string | undefined;\n\t/** Project id. Derived from the OIDC token when omitted. */\n\treadonly projectId?: string | undefined;\n\t/** Reuse an existing sandbox by name instead of creating one. */\n\treadonly sandboxName?: string | undefined;\n\t/** Explicit name for a newly created sandbox. */\n\treadonly name?: string | undefined;\n\t/** Provider-side diagnostic labels (maximum five). */\n\treadonly tags?: Record<string, string> | undefined;\n\t/** Durable instance identity for this namespace. Supplied by the Controller. */\n\treadonly instanceId?: SandboxInstance.ID | undefined;\n\t/** Snapshot id to create the sandbox from. */\n\treadonly snapshot?: string | undefined;\n\t/** Source to seed the sandbox filesystem from (git or tarball). */\n\treadonly source?:\n\t\t| {\n\t\t\t\treadonly type: \"git\";\n\t\t\t\treadonly url: string;\n\t\t\t\treadonly revision?: string | undefined;\n\t\t\t\treadonly depth?: number | undefined;\n\t\t  }\n\t\t| { readonly type: \"tarball\"; readonly url: string };\n\t/** Runtime used by the sandbox. Defaults to the SDK default (`node24`). */\n\treadonly runtime?: string | undefined;\n\t/** Ports to expose from the sandbox (max 4). */\n\treadonly ports?: number[] | undefined;\n\t/** Environment variables baked into the sandbox. */\n\treadonly envVars?: Record<string, string> | undefined;\n\t/** vCPU allocation (memory scales at 2048 MB per vCPU). */\n\treadonly vcpus?: number | undefined;\n\t/**\n\t * Mount working directory. Relative values resolve against `/vercel/sandbox`;\n\t * omitted values use that namespace default.\n\t */\n\treadonly cwd?: string | undefined;\n\t/** Milliseconds before the sandbox auto-terminates. */\n\treadonly timeout?: number | undefined;\n\t/** Per-command timeout in milliseconds. Omit for no timeout. */\n\treadonly execTimeout?: number | undefined;\n}\n\ninterface RemoteState {\n\treadonly sandbox: RemoteSandbox;\n}\n\nclass Remote extends Context.Service<Remote, RemoteState>()(\"@codeworksh/harness/sandboxes/vercel/provider/Remote\") {}\n\n// Vercel requires all three credential fields together or none — partial\n// credentials are rejected by the SDK — so only forward them when complete.\nexport const credentialsFrom = (options: Options): Credentials | undefined =>\n\toptions.token !== undefined && options.teamId !== undefined && options.projectId !== undefined\n\t\t? { token: options.token, teamId: options.teamId, projectId: options.projectId }\n\t\t: undefined;\n\nexport const createSandbox = async (options: Options, creds: Credentials | undefined = credentialsFrom(options)) => {\n\tconst { Sandbox } = await import(\"@vercel/sandbox\");\n\tconst withCreds = <T extends object>(params: T) => (creds ? { ...params, ...creds } : params);\n\tconst source =\n\t\toptions.source?.type === \"git\"\n\t\t\t? {\n\t\t\t\t\ttype: \"git\" as const,\n\t\t\t\t\turl: options.source.url,\n\t\t\t\t\t...(options.source.revision === undefined ? {} : { revision: options.source.revision }),\n\t\t\t\t\t...(options.source.depth === undefined ? {} : { depth: options.source.depth }),\n\t\t\t\t}\n\t\t\t: options.source;\n\tconst base = {\n\t\t...(options.name === undefined ? {} : { name: options.name }),\n\t\t...(options.tags === undefined ? {} : { tags: options.tags }),\n\t\t...(options.envVars === undefined ? {} : { env: options.envVars }),\n\t\t...(options.ports === undefined ? {} : { ports: options.ports }),\n\t\t...(options.timeout === undefined ? {} : { timeout: options.timeout }),\n\t\t...(options.vcpus === undefined ? {} : { resources: { vcpus: options.vcpus } }),\n\t};\n\treturn options.snapshot !== undefined\n\t\t? Sandbox.create(withCreds({ ...base, source: { type: \"snapshot\" as const, snapshotId: options.snapshot } }))\n\t\t: Sandbox.create(\n\t\t\t\twithCreds({\n\t\t\t\t\t...base,\n\t\t\t\t\t...(options.runtime === undefined ? {} : { runtime: options.runtime }),\n\t\t\t\t\t...(source === undefined ? {} : { source }),\n\t\t\t\t}),\n\t\t\t);\n};\n\nconst remote = (options: Options) =>\n\tLayer.effect(\n\t\tRemote,\n\t\tEffect.tryPromise({\n\t\t\ttry: async (): Promise<RemoteState> => {\n\t\t\t\tconst { Sandbox } = await import(\"@vercel/sandbox\");\n\t\t\t\tconst creds = credentialsFrom(options);\n\t\t\t\tconst sandbox = options.sandboxName\n\t\t\t\t\t? await Sandbox.get(creds ? { ...creds, name: options.sandboxName } : { name: options.sandboxName })\n\t\t\t\t\t: await createSandbox(options, creds);\n\t\t\t\treturn { sandbox };\n\t\t\t},\n\t\t\tcatch: (cause) => new VercelError({ sanitized: sanitizeProviderError(cause) }),\n\t\t}),\n\t);\n\ninterface Stats {\n\treadonly size: number;\n\treadonly mtime: Date;\n\treadonly isFile: () => boolean;\n\treadonly isDirectory: () => boolean;\n\treadonly isSymbolicLink: () => boolean;\n}\n\nexport const statsFrom = (stats: Stats): RemoteFileSystem.FileStat => {\n\tconst mtime = stats.mtime;\n\n\t// omit size/mtime the stat could not report — never fabricate\n\treturn {\n\t\tisFile: stats.isFile(),\n\t\tisDirectory: stats.isDirectory(),\n\t\tisSymbolicLink: stats.isSymbolicLink(),\n\t\t...(Number.isFinite(stats.size) ? { size: stats.size } : {}),\n\t\t...(mtime instanceof Date && !Number.isNaN(mtime.getTime()) ? { mtime } : {}),\n\t};\n};\n\ntype RemoteFilesystemProvider = Pick<\n\tRemoteFileSystem.Interface,\n\t\"readFile\" | \"readFileBuffer\" | \"writeFile\" | \"stat\" | \"lstat\" | \"readdir\" | \"exists\" | \"mkdir\" | \"rm\" | \"realpath\"\n>;\n\n// The Vercel `fs` surface is `node:fs/promises`-compatible, so the provider\n// maps almost directly. The `RemoteFileSystem.make` wrapper resolves relative\n// paths against `cwd` and guarantees parent creation on `writeFile`. Only\n// `realpath` has no fs counterpart and shells out.\nconst providerFrom = (sandbox: RemoteSandbox, options: Options): RemoteFilesystemProvider => {\n\tconst filesystem: RemoteFilesystemProvider = {\n\t\treadFile: (path: string) => sandbox.fs.readFile(path, \"utf8\"),\n\t\treadFileBuffer: async (path: string) => new Uint8Array(await sandbox.fs.readFile(path)),\n\t\twriteFile: (path: string, content: string | Uint8Array) =>\n\t\t\tsandbox.fs.writeFile(path, typeof content === \"string\" ? Buffer.from(content, \"utf8\") : Buffer.from(content)),\n\t\tstat: async (path: string) => statsFrom(await sandbox.fs.stat(path)),\n\t\t// Keep symlink identity explicit: Vercel's `stat` follows symlinks\n\t\t// (`stat -L`), so remote-aware callers must ask for `lstat` when they\n\t\t// need the entry itself instead of the target's metadata.\n\t\tlstat: async (path: string) => statsFrom(await sandbox.fs.lstat(path)),\n\t\t// `withFileTypes` lists via `find`, which includes dotfiles (`.git` …);\n\t\t// the bare `readdir` shells out to `ls -1` and would drop them.\n\t\treaddir: async (path: string) => (await sandbox.fs.readdir(path, { withFileTypes: true })).map((e) => e.name),\n\t\texists: async (path: string) => {\n\t\t\ttry {\n\t\t\t\tawait sandbox.fs.stat(path);\n\t\t\t\treturn true;\n\t\t\t} catch (cause) {\n\t\t\t\tif (SandboxFileSystem.isNotFoundError(cause)) return false;\n\t\t\t\tthrow cause;\n\t\t\t}\n\t\t},\n\t\tmkdir: async (path: string, mkdirOptions?: { recursive?: boolean }) => {\n\t\t\tawait sandbox.fs.mkdir(\n\t\t\t\tpath,\n\t\t\t\tmkdirOptions?.recursive === undefined ? {} : { recursive: mkdirOptions.recursive },\n\t\t\t);\n\t\t},\n\t\t// `rm -f` is native, so force/recursive delegate straight through; the\n\t\t// wrapper has already rejected any unsupported option before we get here.\n\t\trm: (path: string, rmOptions?: { recursive?: boolean; force?: boolean }) =>\n\t\t\tsandbox.fs.rm(path, {\n\t\t\t\t...(rmOptions?.recursive === undefined ? {} : { recursive: rmOptions.recursive }),\n\t\t\t\t...(rmOptions?.force === undefined ? {} : { force: rmOptions.force }),\n\t\t\t}),\n\t\trealpath: async (path: string) => {\n\t\t\tfor (const script of SandboxFileSystem.realpathScripts) {\n\t\t\t\tconst result = await (await spawnArgv(sandbox, options, [\"sh\", \"-c\", script, \"_\", path])).wait();\n\t\t\t\tif (result.exitCode === 0) return (await result.stdout()).trimEnd();\n\t\t\t}\n\t\t\t// same shape `fs.stat` rejects with, so `isNotFoundError` recognises it\n\t\t\tthrow Object.assign(new Error(`ENOENT: no such file or directory, realpath '${path}'`), { code: \"ENOENT\" });\n\t\t},\n\t};\n\n\treturn filesystem;\n};\n\n// Arbitrary command strings run through `sh -c` to match the single-string\n// contract the rest of the harness expects. Commands run **detached** so the\n// returned `Command` exposes `kill`/`logs`/`wait`: a `cwd`/`env` is threaded in,\n// and the per-command `execTimeout` is a server-side SIGKILL deadline.\nconst spawn = (\n\tsandbox: RemoteSandbox,\n\toptions: Options,\n\tcommand: string,\n\tenv?: Record<string, string>,\n\tcwd?: string,\n): Promise<Command> => spawnArgv(sandbox, options, [\"sh\", \"-c\", command], env, cwd);\n\n// Vercel spawns a program with a real argument vector, so `execArgv` needs no\n// quoting at all — the args never pass through a shell.\nconst spawnArgv = (\n\tsandbox: RemoteSandbox,\n\toptions: Options,\n\targv: ReadonlyArray<string>,\n\tenv?: Record<string, string>,\n\tcwd?: string,\n): Promise<Command> => {\n\tconst resolvedCwd = resolveCwd(options.cwd, cwd);\n\treturn sandbox.runCommand({\n\t\tcmd: argv[0]!,\n\t\targs: argv.slice(1),\n\t\t...(resolvedCwd === undefined ? {} : { cwd: resolvedCwd }),\n\t\t...(env === undefined ? {} : { env }),\n\t\tdetached: true,\n\t\t...(options.execTimeout === undefined ? {} : { timeoutMs: options.execTimeout }),\n\t});\n};\n\n// Acquire a detached command and register its kill as a scope finalizer, so an\n// interrupt / timeout from the consumer actually terminates the remote process\n// (best-effort SIGKILL) instead of leaving it running server-side.\n// `command` labels failures only; the spawn itself is supplied by the caller so\n// string and argv execution share one kill finalizer.\nconst acquireWith = (command: string, run: () => Promise<Command>) =>\n\tEffect.acquireRelease(Effect.tryPromise({ try: run, catch: (cause) => new ShellError({ command, cause }) }), (cmd) =>\n\t\tEffect.promise(() => cmd.kill(\"SIGKILL\").catch(() => {})),\n\t);\n\n// Vercel reports stdout and stderr separately with a distinct exit code, so the\n// shell surfaces both streams faithfully.\nconst collect = (command: string) => (cmd: Command) =>\n\tEffect.tryPromise({\n\t\ttry: async (): Promise<ExecResult> => {\n\t\t\tconst result = await cmd.wait();\n\t\t\tconst [stdout, stderr] = await Promise.all([result.stdout(), result.stderr()]);\n\t\t\treturn { stdout, stderr, exitCode: result.exitCode };\n\t\t},\n\t\tcatch: (cause) => new ShellError({ command, cause }),\n\t});\n\nconst acquireCommand = (\n\tsandbox: RemoteSandbox,\n\toptions: Options,\n\tcommand: string,\n\tenv?: Record<string, string>,\n\tcwd?: string,\n) => acquireWith(command, () => spawn(sandbox, options, command, env, cwd));\n\nconst exec =\n\t(sandbox: RemoteSandbox, options: Options): ISandboxExe[\"exec\"] =>\n\t(command, opts) =>\n\t\tacquireCommand(sandbox, options, command, opts?.env, opts?.cwd).pipe(\n\t\t\tEffect.flatMap(collect(command)),\n\t\t\tEffect.scoped,\n\t\t);\n\nconst execArgv =\n\t(sandbox: RemoteSandbox, options: Options): ISandboxExe[\"execArgv\"] =>\n\t(argv, opts) => {\n\t\t// quoted for the error label only — the spawn passes argv through untouched\n\t\tconst command = quoteArgv(argv);\n\t\treturn acquireWith(command, () => spawnArgv(sandbox, options, argv, opts?.env, opts?.cwd)).pipe(\n\t\t\tEffect.flatMap(collect(command)),\n\t\t\tEffect.scoped,\n\t\t);\n\t};\n\n// Streaming output via `Command.logs` (an async generator of stdout/stderr\n// entries), followed by the exit code from `wait`. The kill finalizer fires when\n// the consuming scope closes (interrupt / timeout).\nconst stream =\n\t(sandbox: RemoteSandbox, options: Options): NonNullable<ISandboxExe[\"stream\"]> =>\n\t(command, opts) =>\n\t\tStream.unwrap(\n\t\t\tacquireCommand(sandbox, options, command, opts?.env, opts?.cwd).pipe(\n\t\t\t\tEffect.map((cmd) => {\n\t\t\t\t\tconst logs = Stream.fromAsyncIterable(cmd.logs(), (cause) => new ShellError({ command, cause })).pipe(\n\t\t\t\t\t\tStream.map((log): ExecChunk => ({ _tag: log.stream, bytes: utf8.encode(log.data) })),\n\t\t\t\t\t);\n\t\t\t\t\tconst exit = Stream.fromEffect(\n\t\t\t\t\t\tEffect.tryPromise({ try: () => cmd.wait(), catch: (cause) => new ShellError({ command, cause }) }),\n\t\t\t\t\t).pipe(Stream.map((finished): ExecChunk => ({ _tag: \"exit\", exitCode: finished.exitCode })));\n\t\t\t\t\treturn Stream.concat(logs, exit);\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\nconst filesystemLayer = (options: Options) =>\n\tLayer.effect(\n\t\tSandboxFileSystem.Service,\n\t\tEffect.map(Remote, ({ sandbox }) =>\n\t\t\tSandboxFileSystem.fromProvider(\n\t\t\t\tRemoteFileSystem.make(\n\t\t\t\t\tproviderFrom(sandbox, options),\n\t\t\t\t\toptions.cwd === undefined ? undefined : { cwd: options.cwd },\n\t\t\t\t),\n\t\t\t),\n\t\t),\n\t);\n\nconst shellLayer = (options: Options) =>\n\tLayer.effect(\n\t\tShell,\n\t\tEffect.map(Remote, ({ sandbox }) =>\n\t\t\tShell.of({\n\t\t\t\texec: exec(sandbox, options),\n\t\t\t\texecArgv: execArgv(sandbox, options),\n\t\t\t\tstream: stream(sandbox, options),\n\t\t\t}),\n\t\t),\n\t);\n\n/**\n * Cwd-neutral IO attachment for a lifecycle driver.\n *\n * The controller binds a cwd per mount, so neither filesystem nor shell stores\n * one here. The returned layer owns no provider resource and has no deletion\n * finalizer.\n */\nexport const transport = (\n\tsandbox: RemoteSandbox,\n\toptions: Pick<Options, \"execTimeout\"> = {},\n): Layer.Layer<SandboxFileSystem.Service | Shell> =>\n\tLayer.merge(\n\t\tLayer.succeed(\n\t\t\tSandboxFileSystem.Service,\n\t\t\tSandboxFileSystem.fromProvider(RemoteFileSystem.make(providerFrom(sandbox, options))),\n\t\t),\n\t\tLayer.succeed(\n\t\t\tShell,\n\t\t\tShell.of({\n\t\t\t\texec: exec(sandbox, options),\n\t\t\t\texecArgv: execArgv(sandbox, options),\n\t\t\t\tstream: stream(sandbox, options),\n\t\t\t}),\n\t\t),\n\t);\n\n// Vercel's locator is the sandbox name. See `SandboxResource` for why this is a\n// shared tag rather than a Vercel-specific one.\nconst resourceLayer = Layer.effect(\n\tSandboxResource.Service,\n\tEffect.map(Remote, ({ sandbox }) => ({ providerResourceId: sandbox.name })),\n);\n\n// Identity is per remote sandbox, not per provider: two sandboxes both rooted at\n// the same directory must not share persisted directory records.\n//\n// The id is minted here only when the caller names none. A durable id is the\n// control plane's to mint and record — deriving one from the provider's own\n// locator is what §6.1 forbids — so a caller that needs the namespace to survive\n// a restart passes `instanceId` rather than relying on this.\nconst identityLayer = (options: Options) =>\n\tLayer.effect(\n\t\tSandboxIO.Current,\n\t\tEffect.map(Remote, () =>\n\t\t\tSandboxIO.remote({\n\t\t\t\tdriver: \"vercel\",\n\t\t\t\tid: options.instanceId ?? SandboxInstance.ID.create(),\n\t\t\t\tdefaultCwd: DEFAULT_CWD,\n\t\t\t\t...(options.cwd === undefined ? {} : { cwd: options.cwd }),\n\t\t\t}),\n\t\t),\n\t);\n\n/**\n * A Vercel sandbox provides the runtime filesystem service directly plus the\n * sandbox's native remote shell. It intentionally does not provide VFS: remote\n * filesystems have no synchronous filesystem surface.\n */\nexport const layer = (\n\toptions: Options = {},\n): Layer.Layer<SandboxIO.Provides | SandboxResource.Service, VercelError> => {\n\tconst mounted = { ...options, cwd: SandboxIO.resolveMountCwd(DEFAULT_CWD, options.cwd) };\n\treturn Layer.mergeAll(filesystemLayer(mounted), shellLayer(mounted), identityLayer(mounted), resourceLayer).pipe(\n\t\tLayer.provide(remote(mounted)),\n\t);\n};\n\nexport const services = layer;\n","import { Effect, Layer, Option, Schema } from \"effect\";\nimport { SandboxDriver, SandboxInstance, SandboxProvider } from \"../../sandbox.ts\";\nimport * as EnvVercel from \"./provider.ts\";\n\nexport const Options = Schema.Struct({\n\ttoken: Schema.optional(Schema.String),\n\tteamId: Schema.optional(Schema.String),\n\tprojectId: Schema.optional(Schema.String),\n});\nexport type Options = typeof Options.Type;\nexport const ClientOptions = Options;\nexport type ClientOptions = Options;\n\nexport const Source = Schema.Union([\n\tSchema.Struct({\n\t\ttype: Schema.Literal(\"git\"),\n\t\turl: Schema.String,\n\t\trevision: Schema.optional(Schema.String),\n\t\tdepth: Schema.optional(Schema.Finite),\n\t}),\n\tSchema.Struct({\n\t\ttype: Schema.Literal(\"tarball\"),\n\t\turl: Schema.String,\n\t}),\n]);\nexport type Source = typeof Source.Type;\n\nexport const CreateConfig = Schema.Struct({\n\tsnapshot: Schema.optional(Schema.String),\n\tsource: Schema.optional(Source),\n\truntime: Schema.optional(Schema.String),\n\tports: Schema.optional(Schema.Array(Schema.Finite)),\n\tenvVars: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n\tvcpus: Schema.optional(Schema.Finite),\n\ttimeout: Schema.optional(Schema.Finite),\n\texecTimeout: Schema.optional(Schema.Finite),\n});\nexport type CreateConfig = typeof CreateConfig.Type;\n\nexport const RuntimeConfig = Schema.Struct({\n\tdefaultCwd: SandboxDriver.AbsolutePath,\n\texecTimeout: Schema.optional(Schema.Finite),\n});\nexport type RuntimeConfig = typeof RuntimeConfig.Type;\n\nconst name = SandboxDriver.Name.make(\"vercel\");\ntype RemoteSandbox = import(\"@vercel/sandbox\").Sandbox;\n\nconst statusFrom = (\n\tstatus: RemoteSandbox[\"status\"],\n): {\n\treadonly status: SandboxInstance.Status;\n\treadonly providerStatus: string;\n} => ({\n\tstatus:\n\t\tstatus === \"stopped\"\n\t\t\t? \"offline\"\n\t\t\t: status === \"stopping\" || status === \"snapshotting\"\n\t\t\t\t? \"suspending\"\n\t\t\t\t: status === \"failed\" || status === \"aborted\"\n\t\t\t\t\t? \"faulted\"\n\t\t\t\t\t: \"online\",\n\tproviderStatus: status,\n});\n\nconst isNotFound = (cause: unknown): boolean => {\n\tif (typeof cause !== \"object\" || cause === null) return false;\n\tconst response = \"response\" in cause && cause.response instanceof Response ? cause.response : undefined;\n\tconst code =\n\t\t\"code\" in cause && typeof cause.code === \"string\"\n\t\t\t? cause.code\n\t\t\t: \"json\" in cause &&\n\t\t\t\t  typeof cause.json === \"object\" &&\n\t\t\t\t  cause.json !== null &&\n\t\t\t\t  \"error\" in cause.json &&\n\t\t\t\t  typeof cause.json.error === \"object\" &&\n\t\t\t\t  cause.json.error !== null &&\n\t\t\t\t  \"code\" in cause.json.error &&\n\t\t\t\t  typeof cause.json.error.code === \"string\"\n\t\t\t\t? cause.json.error.code\n\t\t\t\t: undefined;\n\treturn response?.status === 404 || code === \"not_found\" || code === \"sandbox_not_found\";\n};\n\nexport const make = (\n\tclient: ClientOptions = {},\n): SandboxDriver.Driver<CreateConfig, RuntimeConfig> & SandboxDriver.Registration => {\n\tconst credentials = EnvVercel.credentialsFrom(client);\n\tconst redact = SandboxProvider.makeRedactor([client.token ?? \"\"]);\n\n\tconst attempt = <A>(\n\t\toperation: string,\n\t\trun: () => Promise<A>,\n\t): Effect.Effect<A, SandboxProvider.SandboxProviderError> =>\n\t\tEffect.tryPromise({\n\t\t\ttry: run,\n\t\t\tcatch: (cause) =>\n\t\t\t\tSandboxProvider.providerError({\n\t\t\t\t\tdriver: name,\n\t\t\t\t\toperation,\n\t\t\t\t\tcause,\n\t\t\t\t\tredact,\n\t\t\t\t\tsanitize: EnvVercel.sanitizeProviderError,\n\t\t\t\t\tnotFound: isNotFound(cause),\n\t\t\t\t}),\n\t\t});\n\n\tconst get = (providerResourceId: string, resume: boolean, operation: string) =>\n\t\tattempt(operation, () =>\n\t\t\timport(\"@vercel/sandbox\").then(({ Sandbox }) =>\n\t\t\t\tSandbox.get(\n\t\t\t\t\tcredentials === undefined\n\t\t\t\t\t\t? { name: providerResourceId, resume }\n\t\t\t\t\t\t: { ...credentials, name: providerResourceId, resume },\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\tconst observed = (sandbox: RemoteSandbox): SandboxDriver.Observed => ({\n\t\t...statusFrom(sandbox.status),\n\t\tmetadata: {\n\t\t\tcwd: sandbox.cwd,\n\t\t},\n\t});\n\n\treturn SandboxDriver.driver({\n\t\tname,\n\t\tkind: \"remote\",\n\t\tcapabilities: {\n\t\t\tinspect: true,\n\t\t\treattach: true,\n\t\t\twake: true,\n\t\t\tstop: true,\n\t\t\tdestroy: true,\n\t\t\tcancels: true,\n\t\t},\n\t\tcreateConfigCodec: CreateConfig,\n\t\truntimeConfigCodec: RuntimeConfig,\n\t\tcreate: ({ instanceId, config }) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst source =\n\t\t\t\t\tconfig.source?.type === \"git\"\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\ttype: \"git\" as const,\n\t\t\t\t\t\t\t\turl: config.source.url,\n\t\t\t\t\t\t\t\t...(config.source.revision === undefined ? {} : { revision: config.source.revision }),\n\t\t\t\t\t\t\t\t...(config.source.depth === undefined ? {} : { depth: config.source.depth }),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: config.source;\n\t\t\t\tconst sandbox = yield* attempt(\"create\", () =>\n\t\t\t\t\tEnvVercel.createSandbox(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t...client,\n\t\t\t\t\t\t\t...(config.snapshot === undefined ? {} : { snapshot: config.snapshot }),\n\t\t\t\t\t\t\t...(source === undefined ? {} : { source }),\n\t\t\t\t\t\t\t...(config.runtime === undefined ? {} : { runtime: config.runtime }),\n\t\t\t\t\t\t\t...(config.ports === undefined ? {} : { ports: [...config.ports] }),\n\t\t\t\t\t\t\t...(config.envVars === undefined ? {} : { envVars: config.envVars }),\n\t\t\t\t\t\t\t...(config.vcpus === undefined ? {} : { vcpus: config.vcpus }),\n\t\t\t\t\t\t\t...(config.timeout === undefined ? {} : { timeout: config.timeout }),\n\t\t\t\t\t\t\t...(config.execTimeout === undefined ? {} : { execTimeout: config.execTimeout }),\n\t\t\t\t\t\t\ttags: {\n\t\t\t\t\t\t\t\t\"codework-instance\": instanceId,\n\t\t\t\t\t\t\t\t\"codework-managed\": \"true\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t\tcredentials,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tconst state = statusFrom(sandbox.status);\n\t\t\t\treturn {\n\t\t\t\t\tproviderResourceId: sandbox.name,\n\t\t\t\t\tproviderStatus: state.providerStatus,\n\t\t\t\t\truntimeConfig: {\n\t\t\t\t\t\tdefaultCwd: SandboxDriver.AbsolutePath.make(sandbox.cwd || EnvVercel.DEFAULT_CWD),\n\t\t\t\t\t\t...(config.execTimeout === undefined ? {} : { execTimeout: config.execTimeout }),\n\t\t\t\t\t},\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tcwd: sandbox.cwd,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}),\n\t\truntimeConfigFor: ({ providerResourceId, overrides }) =>\n\t\t\tEffect.map(get(providerResourceId, false, \"runtimeConfigFor\"), (sandbox) => ({\n\t\t\t\tdefaultCwd: overrides?.defaultCwd ?? SandboxDriver.AbsolutePath.make(sandbox.cwd || EnvVercel.DEFAULT_CWD),\n\t\t\t\t...(overrides?.execTimeout === undefined ? {} : { execTimeout: overrides.execTimeout }),\n\t\t\t})),\n\t\tattach: (input) =>\n\t\t\tLayer.unwrap(\n\t\t\t\tEffect.map(\n\t\t\t\t\tget(\n\t\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\t\ttrue,\n\t\t\t\t\t\t\"attach\",\n\t\t\t\t\t),\n\t\t\t\t\t(sandbox) =>\n\t\t\t\t\t\tEnvVercel.transport(\n\t\t\t\t\t\t\tsandbox,\n\t\t\t\t\t\t\tinput.runtimeConfig.execTimeout === undefined\n\t\t\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t\t\t: { execTimeout: input.runtimeConfig.execTimeout },\n\t\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\tinspect: (input) =>\n\t\t\tEffect.map(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\tfalse,\n\t\t\t\t\t\"inspect\",\n\t\t\t\t),\n\t\t\t\tobserved,\n\t\t\t),\n\t\twake: (input) =>\n\t\t\tEffect.map(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\ttrue,\n\t\t\t\t\t\"wake\",\n\t\t\t\t),\n\t\t\t\tobserved,\n\t\t\t),\n\t\tstop: (input) =>\n\t\t\tEffect.flatMap(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\tfalse,\n\t\t\t\t\t\"stop\",\n\t\t\t\t),\n\t\t\t\t(sandbox) => attempt(\"stop\", () => sandbox.stop()).pipe(Effect.map(() => observed(sandbox))),\n\t\t\t),\n\t\tdestroy: (input) =>\n\t\t\tEffect.flatMap(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\tfalse,\n\t\t\t\t\t\"destroy\",\n\t\t\t\t),\n\t\t\t\t(sandbox) => attempt(\"destroy\", () => sandbox.delete()),\n\t\t\t),\n\t});\n};\n\nconst sandbox = SandboxDriver.module({\n\tapiVersion: SandboxDriver.apiVersion,\n\tname,\n\toptions: Options,\n\tmake,\n});\n\nexport const config = (value: CreateConfig) => ({ driver: \"vercel\" as const, config: value });\n\nexport default sandbox;\n"],"mappings":";;;;AAyBA,MAAM,eAAe,MAAc,YAAsB;CACxD,MAAM,aAAa,MAAM,UAAU,IAAI;CACvC,IAAI,SAAS,QAAQ,KAAA,KAAa,MAAM,WAAW,UAAU,GAAG,OAAO;CACvE,OAAO,MAAM,UAAU,MAAM,KAAK,QAAQ,KAAK,UAAU,CAAC;AAC3D;;;;;;;;AASA,MAAaA,UAAQ,UAAqB,YAAkD;CAC3F,MAAM,WAAW,SAAiB,YAAY,MAAM,OAAO;CAE3D,OAAO;EACN,WAAW,SAAS,SAAS,SAAS,QAAQ,IAAI,CAAC;EACnD,iBAAiB,SAAS,SAAS,eAAe,QAAQ,IAAI,CAAC;EAC/D,YAAY,MAAM,YAAY,SAAS,UAAU,QAAQ,IAAI,GAAG,OAAO;EACvE,OAAO,SAAS,SAAS,KAAK,QAAQ,IAAI,CAAC;EAC3C,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAiB,SAAS,MAAO,QAAQ,IAAI,CAAC,EAAE;EAClG,UAAU,SAAS,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACjD,SAAS,SAAS,SAAS,OAAO,QAAQ,IAAI,CAAC;EAC/C,QAAQ,MAAM,iBAAiB,SAAS,MAAM,QAAQ,IAAI,GAAG,YAAY;EAEzE,KAAK,MAAM,cAAc,SAAS,GAAG,QAAQ,IAAI,GAAG,SAAS;EAC7D,WAAW,SAAS,SAAS,SAAS,QAAQ,IAAI,CAAC;CACpD;AACD;;;ACnCA,MAAM,OAAO,IAAI,YAAY;AAOI,OAAO,YAAyB,CAAC,CAAC,eAAe,EACjF,WAAWC,eACZ,CAAC;AAED,MAAM,aAAa,OAAO,OAAO,EAChC,MAAM,OAAO,OAAO,EACnB,OAAO,OAAO,OAAO;CACpB,SAAS,OAAO,SAAS,OAAO,MAAM;CACtC,MAAM,OAAO,SAAS,OAAO,MAAM;AACpC,CAAC,EACF,CAAC,EACF,CAAC;AACD,MAAM,eAAe,OAAO,GAAG,UAAU;;AAGzC,MAAa,yBACZ,OACA,SAAmB,aAAa,MACI;CACpC,MAAM,WAAWC,cAAqB,OAAO,MAAM;CACnD,IAAI,CAAC,aAAa,KAAK,GAAG,OAAO;CACjC,MAAM,UAAU,MAAM,KAAK,MAAM,SAAS,KAAK;CAC/C,MAAM,OAAO,MAAM,KAAK,MAAM,MAAM,KAAK;CACzC,OAAO;EACN,GAAG;EACH,GAAI,YAAY,KAAA,KAAa,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,SAAS,OAAO,OAAO,EAAE;EACpF,GAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,CAAC,IAAI,EAAE,MAAM,OAAO,IAAI,EAAE;CACzE;AACD;AA8DA,IAAM,SAAN,cAAqB,QAAQ,QAA6B,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC;AAIrH,MAAa,mBAAmB,YAC/B,QAAQ,UAAU,KAAA,KAAa,QAAQ,WAAW,KAAA,KAAa,QAAQ,cAAc,KAAA,IAClF;CAAE,OAAO,QAAQ;CAAO,QAAQ,QAAQ;CAAQ,WAAW,QAAQ;AAAU,IAC7E,KAAA;AAEJ,MAAa,gBAAgB,OAAO,SAAkB,QAAiC,gBAAgB,OAAO,MAAM;CACnH,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,aAA+B,WAAe,QAAQ;EAAE,GAAG;EAAQ,GAAG;CAAM,IAAI;CACtF,MAAM,SACL,QAAQ,QAAQ,SAAS,QACtB;EACA,MAAM;EACN,KAAK,QAAQ,OAAO;EACpB,GAAI,QAAQ,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,OAAO,SAAS;EACrF,GAAI,QAAQ,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,OAAO,MAAM;CAC7E,IACC,QAAQ;CACZ,MAAM,OAAO;EACZ,GAAI,QAAQ,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;EAC3D,GAAI,QAAQ,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;EAC3D,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,QAAQ;EAChE,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,QAAQ,MAAM,EAAE;CAC9E;CACA,OAAO,QAAQ,aAAa,KAAA,IACzB,QAAQ,OAAO,UAAU;EAAE,GAAG;EAAM,QAAQ;GAAE,MAAM;GAAqB,YAAY,QAAQ;EAAS;CAAE,CAAC,CAAC,IAC1G,QAAQ,OACR,UAAU;EACT,GAAG;EACH,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACpE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;CAC1C,CAAC,CACF;AACH;AA0BA,MAAa,aAAa,UAA4C;CACrE,MAAM,QAAQ,MAAM;CAGpB,OAAO;EACN,QAAQ,MAAM,OAAO;EACrB,aAAa,MAAM,YAAY;EAC/B,gBAAgB,MAAM,eAAe;EACrC,GAAI,OAAO,SAAS,MAAM,IAAI,IAAI,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;EAC1D,GAAI,iBAAiB,QAAQ,CAAC,OAAO,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC5E;AACD;AAWA,MAAM,gBAAgB,SAAwB,YAA+C;CA8C5F,OAAO;EA5CN,WAAW,SAAiB,QAAQ,GAAG,SAAS,MAAM,MAAM;EAC5D,gBAAgB,OAAO,SAAiB,IAAI,WAAW,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC;EACtF,YAAY,MAAc,YACzB,QAAQ,GAAG,UAAU,MAAM,OAAO,YAAY,WAAW,OAAO,KAAK,SAAS,MAAM,IAAI,OAAO,KAAK,OAAO,CAAC;EAC7G,MAAM,OAAO,SAAiB,UAAU,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC;EAInE,OAAO,OAAO,SAAiB,UAAU,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;EAGrE,SAAS,OAAO,UAAkB,MAAM,QAAQ,GAAG,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,IAAI;EAC5G,QAAQ,OAAO,SAAiB;GAC/B,IAAI;IACH,MAAM,QAAQ,GAAG,KAAK,IAAI;IAC1B,OAAO;GACR,SAAS,OAAO;IACf,IAAIC,gBAAkC,KAAK,GAAG,OAAO;IACrD,MAAM;GACP;EACD;EACA,OAAO,OAAO,MAAc,iBAA2C;GACtE,MAAM,QAAQ,GAAG,MAChB,MACA,cAAc,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,aAAa,UAAU,CAClF;EACD;EAGA,KAAK,MAAc,cAClB,QAAQ,GAAG,GAAG,MAAM;GACnB,GAAI,WAAW,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;GAC/E,GAAI,WAAW,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;EACpE,CAAC;EACF,UAAU,OAAO,SAAiB;GACjC,KAAK,MAAM,UAAUC,iBAAmC;IACvD,MAAM,SAAS,OAAO,MAAM,UAAU,SAAS,SAAS;KAAC;KAAM;KAAM;KAAQ;KAAK;IAAI,CAAC,EAAA,CAAG,KAAK;IAC/F,IAAI,OAAO,aAAa,GAAG,QAAQ,MAAM,OAAO,OAAO,EAAA,CAAG,QAAQ;GACnE;GAEA,MAAM,OAAO,uBAAO,IAAI,MAAM,gDAAgD,KAAK,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;EAC3G;CAGe;AACjB;AAMA,MAAM,SACL,SACA,SACA,SACA,KACA,QACsB,UAAU,SAAS,SAAS;CAAC;CAAM;CAAM;AAAO,GAAG,KAAK,GAAG;AAIlF,MAAM,aACL,SACA,SACA,MACA,KACA,QACsB;CACtB,MAAM,cAAc,WAAW,QAAQ,KAAK,GAAG;CAC/C,OAAO,QAAQ,WAAW;EACzB,KAAK,KAAK;EACV,MAAM,KAAK,MAAM,CAAC;EAClB,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,YAAY;EACxD,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;EACnC,UAAU;EACV,GAAI,QAAQ,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,YAAY;CAC/E,CAAC;AACF;AAOA,MAAM,eAAe,SAAiB,QACrC,OAAO,eAAe,OAAO,WAAW;CAAE,KAAK;CAAK,QAAQ,UAAU,IAAI,WAAW;EAAE;EAAS;CAAM,CAAC;AAAE,CAAC,IAAI,QAC7G,OAAO,cAAc,IAAI,KAAK,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CACzD;AAID,MAAM,WAAW,aAAqB,QACrC,OAAO,WAAW;CACjB,KAAK,YAAiC;EACrC,MAAM,SAAS,MAAM,IAAI,KAAK;EAC9B,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CAAC,OAAO,OAAO,GAAG,OAAO,OAAO,CAAC,CAAC;EAC7E,OAAO;GAAE;GAAQ;GAAQ,UAAU,OAAO;EAAS;CACpD;CACA,QAAQ,UAAU,IAAI,WAAW;EAAE;EAAS;CAAM,CAAC;AACpD,CAAC;AAEF,MAAM,kBACL,SACA,SACA,SACA,KACA,QACI,YAAY,eAAe,MAAM,SAAS,SAAS,SAAS,KAAK,GAAG,CAAC;AAE1E,MAAM,QACJ,SAAwB,aACxB,SAAS,SACT,eAAe,SAAS,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,KAC/D,OAAO,QAAQ,QAAQ,OAAO,CAAC,GAC/B,OAAO,MACR;AAEF,MAAM,YACJ,SAAwB,aACxB,MAAM,SAAS;CAEf,MAAM,UAAU,UAAU,IAAI;CAC9B,OAAO,YAAY,eAAe,UAAU,SAAS,SAAS,MAAM,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,KAC1F,OAAO,QAAQ,QAAQ,OAAO,CAAC,GAC/B,OAAO,MACR;AACD;AAKD,MAAM,UACJ,SAAwB,aACxB,SAAS,SACT,OAAO,OACN,eAAe,SAAS,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,KAC/D,OAAO,KAAK,QAAQ;CACnB,MAAM,OAAO,OAAO,kBAAkB,IAAI,KAAK,IAAI,UAAU,IAAI,WAAW;EAAE;EAAS;CAAM,CAAC,CAAC,CAAC,CAAC,KAChG,OAAO,KAAK,SAAoB;EAAE,MAAM,IAAI;EAAQ,OAAO,KAAK,OAAO,IAAI,IAAI;CAAE,EAAE,CACpF;CACA,MAAM,OAAO,OAAO,WACnB,OAAO,WAAW;EAAE,WAAW,IAAI,KAAK;EAAG,QAAQ,UAAU,IAAI,WAAW;GAAE;GAAS;EAAM,CAAC;CAAE,CAAC,CAClG,CAAC,CAAC,KAAK,OAAO,KAAK,cAAyB;EAAE,MAAM;EAAQ,UAAU,SAAS;CAAS,EAAE,CAAC;CAC3F,OAAO,OAAO,OAAO,MAAM,IAAI;AAChC,CAAC,CACF,CACD;;;;;;;;AAkCF,MAAa,aACZ,SACA,UAAwC,CAAC,MAEzC,MAAM,MACL,MAAM,QACLC,SACAC,aAA+BC,OAAsB,aAAa,SAAS,OAAO,CAAC,CAAC,CACrF,GACA,MAAM,QACL,OACA,MAAM,GAAG;CACR,MAAM,KAAK,SAAS,OAAO;CAC3B,UAAU,SAAS,SAAS,OAAO;CACnC,QAAQ,OAAO,SAAS,OAAO;AAChC,CAAC,CACF,CACD;AAIqB,MAAM,OAC3BC,WACA,OAAO,IAAI,SAAS,EAAE,eAAe,EAAE,oBAAoB,QAAQ,KAAK,EAAE,CAC3E;;;ACpZA,MAAa,UAAU,OAAO,OAAO;CACpC,OAAO,OAAO,SAAS,OAAO,MAAM;CACpC,QAAQ,OAAO,SAAS,OAAO,MAAM;CACrC,WAAW,OAAO,SAAS,OAAO,MAAM;AACzC,CAAC;AAED,MAAa,gBAAgB;AAG7B,MAAa,SAAS,OAAO,MAAM,CAClC,OAAO,OAAO;CACb,MAAM,OAAO,QAAQ,KAAK;CAC1B,KAAK,OAAO;CACZ,UAAU,OAAO,SAAS,OAAO,MAAM;CACvC,OAAO,OAAO,SAAS,OAAO,MAAM;AACrC,CAAC,GACD,OAAO,OAAO;CACb,MAAM,OAAO,QAAQ,SAAS;CAC9B,KAAK,OAAO;AACb,CAAC,CACF,CAAC;AAGD,MAAa,eAAe,OAAO,OAAO;CACzC,UAAU,OAAO,SAAS,OAAO,MAAM;CACvC,QAAQ,OAAO,SAAS,MAAM;CAC9B,SAAS,OAAO,SAAS,OAAO,MAAM;CACtC,OAAO,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;CAClD,SAAS,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,CAAC;CACpE,OAAO,OAAO,SAAS,OAAO,MAAM;CACpC,SAAS,OAAO,SAAS,OAAO,MAAM;CACtC,aAAa,OAAO,SAAS,OAAO,MAAM;AAC3C,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;CAC1C,YAAYC;CACZ,aAAa,OAAO,SAAS,OAAO,MAAM;AAC3C,CAAC;AAGD,MAAM,OAAA,KAA0B,KAAK,QAAQ;AAG7C,MAAM,cACL,YAIK;CACL,QACC,WAAW,YACR,YACA,WAAW,cAAc,WAAW,iBACnC,eACA,WAAW,YAAY,WAAW,YACjC,YACA;CACN,gBAAgB;AACjB;AAEA,MAAM,cAAc,UAA4B;CAC/C,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,WAAW,cAAc,SAAS,MAAM,oBAAoB,WAAW,MAAM,WAAW,KAAA;CAC9F,MAAM,OACL,UAAU,SAAS,OAAO,MAAM,SAAS,WACtC,MAAM,OACN,UAAU,SACT,OAAO,MAAM,SAAS,YACtB,MAAM,SAAS,QACf,WAAW,MAAM,QACjB,OAAO,MAAM,KAAK,UAAU,YAC5B,MAAM,KAAK,UAAU,QACrB,UAAU,MAAM,KAAK,SACrB,OAAO,MAAM,KAAK,MAAM,SAAS,WACjC,MAAM,KAAK,MAAM,OACjB,KAAA;CACL,OAAO,UAAU,WAAW,OAAO,SAAS,eAAe,SAAS;AACrE;AAEA,MAAa,QACZ,SAAwB,CAAC,MAC2D;CACpF,MAAM,cAAcC,gBAA0B,MAAM;CACpD,MAAM,SAASC,aAA6B,CAAC,OAAO,SAAS,EAAE,CAAC;CAEhE,MAAM,WACL,WACA,QAEA,OAAO,WAAW;EACjB,KAAK;EACL,QAAQ,UACPC,cAA8B;GAC7B,QAAQ;GACR;GACA;GACA;GACA,UAAUC;GACV,UAAU,WAAW,KAAK;EAC3B,CAAC;CACH,CAAC;CAEF,MAAM,OAAO,oBAA4B,QAAiB,cACzD,QAAQ,iBACP,OAAO,kBAAkB,CAAC,MAAM,EAAE,cACjC,QAAQ,IACP,gBAAgB,KAAA,IACb;EAAE,MAAM;EAAoB;CAAO,IACnC;EAAE,GAAG;EAAa,MAAM;EAAoB;CAAO,CACvD,CACD,CACD;CAED,MAAM,YAAY,aAAoD;EACrE,GAAG,WAAW,QAAQ,MAAM;EAC5B,UAAU,EACT,KAAK,QAAQ,IACd;CACD;CAEA,OAAOC,OAAqB;EAC3B;EACA,MAAM;EACN,cAAc;GACb,SAAS;GACT,UAAU;GACV,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACV;EACA,mBAAmB;EACnB,oBAAoB;EACpB,SAAS,EAAE,YAAY,aACtB,OAAO,IAAI,aAAa;GACvB,MAAM,SACL,OAAO,QAAQ,SAAS,QACrB;IACA,MAAM;IACN,KAAK,OAAO,OAAO;IACnB,GAAI,OAAO,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,OAAO,SAAS;IACnF,GAAI,OAAO,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,OAAO,MAAM;GAC3E,IACC,OAAO;GACX,MAAM,UAAU,OAAO,QAAQ,gBAC9BC,cACC;IACC,GAAG;IACH,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;IACrE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;IACzC,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;IAClE,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,OAAO,KAAK,EAAE;IACjE,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;IAClE,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;IAC5D,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;IAClE,GAAI,OAAO,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,OAAO,YAAY;IAC9E,MAAM;KACL,qBAAqB;KACrB,oBAAoB;IACrB;GACD,GACA,WACD,CACD;GACA,MAAM,QAAQ,WAAW,QAAQ,MAAM;GACvC,OAAO;IACN,oBAAoB,QAAQ;IAC5B,gBAAgB,MAAM;IACtB,eAAe;KACd,YAAA,aAAuC,KAAK,QAAQ,OAAO,iBAAqB;KAChF,GAAI,OAAO,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,OAAO,YAAY;IAC/E;IACA,UAAU,EACT,KAAK,QAAQ,IACd;GACD;EACD,CAAC;EACF,mBAAmB,EAAE,oBAAoB,gBACxC,OAAO,IAAI,IAAI,oBAAoB,OAAO,kBAAkB,IAAI,aAAa;GAC5E,YAAY,WAAW,cAAA,aAAyC,KAAK,QAAQ,OAAO,iBAAqB;GACzG,GAAI,WAAW,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,UAAU,YAAY;EACtF,EAAE;EACH,SAAS,UACR,MAAM,OACL,OAAO,IACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,MACA,QACD,IACC,YACAC,UACC,SACA,MAAM,cAAc,gBAAgB,KAAA,IACjC,KAAA,IACA,EAAE,aAAa,MAAM,cAAc,YAAY,CACnD,CACF,CACD;EACD,UAAU,UACT,OAAO,IACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,OACA,SACD,GACA,QACD;EACD,OAAO,UACN,OAAO,IACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,MACA,MACD,GACA,QACD;EACD,OAAO,UACN,OAAO,QACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,OACA,MACD,IACC,YAAY,QAAQ,cAAc,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,SAAS,OAAO,CAAC,CAAC,CAC5F;EACD,UAAU,UACT,OAAO,QACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,OACA,SACD,IACC,YAAY,QAAQ,iBAAiB,QAAQ,OAAO,CAAC,CACvD;CACF,CAAC;AACF;AAEA,MAAM,UAAUC,aAAqB;CACpC,YAAY;CACZ;CACA,SAAS;CACT;AACD,CAAC;AAED,MAAa,UAAU,WAAyB;CAAE,QAAQ;CAAmB,QAAQ;AAAM"}

package/daytona-C6wWlJ4z.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"daytona-C6wWlJ4z.mjs","names":["make","SandboxIO.resolveMountCwd","SandboxInstance.PersistedError","SandboxFileSystem.Service","SandboxFileSystem.fromProvider","RemoteFileSystem.make","SandboxResource.Service","SandboxDriver.AbsolutePath","SandboxProvider.makeRedactor","SandboxProvider.providerError","SandboxDriver.driver","EnvDaytona.mountCwd","EnvDaytona.transport","SandboxDriver.module"],"sources":["../../src/sandboxes/daytona/fs.ts","../../src/sandboxes/daytona/provider.ts","../../src/sandboxes/daytona/index.ts"],"sourcesContent":["import { posix } from \"../../util/posix.ts\";\nimport { SandboxFileSystem } from \"../../sandbox/fs/filesystem.ts\";\n\nexport type FileStat = SandboxFileSystem.FileStat;\n\nexport interface Interface extends SandboxFileSystem.Provider {\n\treadonly lstat?: (path: string) => Promise<FileStat>;\n}\n\nexport interface Options {\n\treadonly cwd?: string;\n}\n\nconst resolvePath = (path: string, options?: Options) => {\n\tconst normalized = posix.normalize(path);\n\tif (options?.cwd === undefined || posix.isAbsolute(normalized)) return normalized;\n\treturn posix.normalize(posix.join(options.cwd, normalized));\n};\n\n/** Resolve provider paths without adding policy or mutable working-directory state. */\nexport const make = (provider: Interface, options?: Options): Interface => {\n\tconst resolve = (path: string) => resolvePath(path, options);\n\n\treturn {\n\t\treadFile: (path) => provider.readFile(resolve(path)),\n\t\treadFileBuffer: (path) => provider.readFileBuffer(resolve(path)),\n\t\twriteFile: (path, content) => provider.writeFile(resolve(path), content),\n\t\tstat: (path) => provider.stat(resolve(path)),\n\t\t...(provider.lstat === undefined ? {} : { lstat: (path: string) => provider.lstat!(resolve(path)) }),\n\t\treaddir: (path) => provider.readdir(resolve(path)),\n\t\texists: (path) => provider.exists(resolve(path)),\n\t\tmkdir: (path, mkdirOptions) => provider.mkdir(resolve(path), mkdirOptions),\n\t\trm: (path, rmOptions) => provider.rm(resolve(path), rmOptions),\n\t};\n};\n\nexport const withProvider = make;\n","/* oxlint-disable effecttsgo/async-function -- Daytona's SDK boundary is Promise-based. */\nimport { Context, DateTime, Effect, Layer, Option, Schema } from \"effect\";\nimport { Buffer } from \"node:buffer\";\nimport { posix } from \"../../util/posix.ts\";\nimport { sanitizeError } from \"../../sandbox/errors.ts\";\nimport { SandboxFileSystem } from \"../../sandbox/fs/filesystem.ts\";\nimport { SandboxInstance } from \"../../sandbox/instance.ts\";\nimport { SandboxIO } from \"../../sandbox/io.ts\";\nimport { SandboxResource } from \"../../sandbox/resource.ts\";\nimport { type ISandboxExe, quote, quoteArgv, resolveCwd, Shell, ShellError } from \"../../sandbox/shell/shell.ts\";\nimport * as RemoteFileSystem from \"./fs.ts\";\n\ntype CodeLanguage = import(\"@daytona/sdk\").CodeLanguage;\ntype Daytona = import(\"@daytona/sdk\").Daytona;\ntype FileInfo = import(\"@daytona/sdk\").FileInfo;\ntype Image = import(\"@daytona/sdk\").Image;\ntype RemoteSandbox = import(\"@daytona/sdk\").Sandbox;\ntype Resources = import(\"@daytona/sdk\").Resources;\n\n/** Fallback when Daytona cannot report a snapshot/image-specific work directory. */\nexport const DEFAULT_CWD = \"/home/daytona\";\n\n/**\n * The mount cwd for a Daytona namespace.\n *\n * An absolute override replaces the namespace default outright, so the\n * `getWorkDir()` round-trip is skipped: it would discover a value we then throw\n * away. Otherwise the sandbox's own work directory is the default, and\n * {@link DEFAULT_CWD} covers a snapshot or image that reports none.\n *\n * Taken as a thunk rather than read off the sandbox so all three branches are\n * testable without provisioning one — this decides where every Daytona mount\n * roots, and §8.1 makes a wrong answer here resolve silently rather than fail.\n */\nexport const mountCwd = async (\n\tcwd: string | undefined,\n\tgetWorkDir: () => Promise<string | undefined>,\n): Promise<string> => {\n\tconst defaultCwd = posix.isAbsolute(cwd ?? \"\") ? DEFAULT_CWD : ((await getWorkDir()) ?? DEFAULT_CWD);\n\treturn SandboxIO.resolveMountCwd(defaultCwd, cwd);\n};\n\nexport class DaytonaError extends Schema.TaggedError<DaytonaError>()(\"DaytonaError\", {\n\tsanitized: SandboxInstance.PersistedError,\n}) {}\n\nexport interface Options {\n\t/** API key. Falls back to the `DAYTONA_API_KEY` env var when omitted. */\n\treadonly apiKey?: string | undefined;\n\t/** API URL. Falls back to `DAYTONA_API_URL` / the SDK default. */\n\treadonly apiUrl?: string | undefined;\n\t/** Target region. Falls back to `DAYTONA_TARGET` / the SDK default. */\n\treadonly target?: string | undefined;\n\t/** Reuse an existing sandbox by id or name instead of creating one. */\n\treadonly sandboxId?: string | undefined;\n\t/** Durable instance identity for this namespace. Supplied by the Controller. */\n\treadonly instanceId?: SandboxInstance.ID | undefined;\n\t/** Snapshot to create the sandbox from. */\n\treadonly snapshot?: string | undefined;\n\t/** Image (registry reference or declarative `Image`) to create the sandbox from. */\n\treadonly image?: string | Image | undefined;\n\t/** Runtime used for code execution. Defaults to `\"typescript\"`. */\n\treadonly language?: CodeLanguage | string | undefined;\n\t/** Environment variables baked into the sandbox. */\n\treadonly envVars?: Record<string, string> | undefined;\n\t/** Resource allocation (cpu / memory / disk). */\n\treadonly resources?: Resources | undefined;\n\t/** OS user to run as inside the sandbox. */\n\treadonly user?: string | undefined;\n\t/**\n\t * Mount working directory. Relative values resolve against `getWorkDir()`;\n\t * omitted values use it, with `/home/daytona` as the provider fallback.\n\t */\n\treadonly cwd?: string | undefined;\n\t/** Idle minutes before the sandbox auto-stops. */\n\treadonly autoStopInterval?: number | undefined;\n\t/** Per-command timeout in seconds. 0 means no timeout. */\n\treadonly execTimeout?: number | undefined;\n}\n\ninterface RemoteState {\n\treadonly sandbox: RemoteSandbox;\n\treadonly cwd: string;\n}\n\nclass Remote extends Context.Service<Remote, RemoteState>()(\"@codeworksh/harness/sandboxes/daytona/provider/Remote\") {}\n\nconst assertCommandSucceeded = (command: string, result: { exitCode: number; result?: string }) => {\n\tif (result.exitCode !== 0) throw new Error(result.result || `command failed (${result.exitCode}): ${command}`);\n};\n\nconst dateFrom = (value: string | undefined) => {\n\tif (value === undefined) return undefined;\n\treturn Option.getOrUndefined(DateTime.make(value).pipe(Option.map(DateTime.toDateUtc)));\n};\n\nexport const createSandbox = (daytona: Daytona, options: Options) => {\n\tconst base = {\n\t\tlanguage: options.language ?? \"typescript\",\n\t\t...(options.envVars === undefined ? {} : { envVars: options.envVars }),\n\t\t...(options.user === undefined ? {} : { user: options.user }),\n\t\t...(options.autoStopInterval === undefined ? {} : { autoStopInterval: options.autoStopInterval }),\n\t\tautoDeleteInterval: -1,\n\t};\n\treturn options.image !== undefined\n\t\t? daytona.create({\n\t\t\t\t...base,\n\t\t\t\timage: options.image,\n\t\t\t\t...(options.resources === undefined ? {} : { resources: options.resources }),\n\t\t\t})\n\t\t: daytona.create({ ...base, ...(options.snapshot === undefined ? {} : { snapshot: options.snapshot }) });\n};\n\nconst remote = (options: Options) =>\n\tLayer.effect(\n\t\tRemote,\n\t\tEffect.tryPromise({\n\t\t\ttry: async (): Promise<RemoteState> => {\n\t\t\t\tconst { Daytona } = await import(\"@daytona/sdk\");\n\t\t\t\tconst daytona = new Daytona({\n\t\t\t\t\t...(options.apiKey === undefined ? {} : { apiKey: options.apiKey }),\n\t\t\t\t\t...(options.apiUrl === undefined ? {} : { apiUrl: options.apiUrl }),\n\t\t\t\t\t...(options.target === undefined ? {} : { target: options.target }),\n\t\t\t\t});\n\t\t\t\tconst sandbox = options.sandboxId\n\t\t\t\t\t? await daytona.get(options.sandboxId)\n\t\t\t\t\t: await createSandbox(daytona, options);\n\t\t\t\treturn {\n\t\t\t\t\tsandbox,\n\t\t\t\t\tcwd: await mountCwd(options.cwd, () => sandbox.getWorkDir()),\n\t\t\t\t};\n\t\t\t},\n\t\t\tcatch: (cause) => new DaytonaError({ sanitized: sanitizeError(cause) }),\n\t\t}),\n\t);\n\nexport const statsFrom = (info: FileInfo): RemoteFileSystem.FileStat => {\n\tconst symlink = info.mode === undefined ? undefined : info.mode.startsWith(\"l\");\n\tconst mtime = dateFrom(info.modifiedAt ?? info.modTime);\n\n\t// omit size/mtime/isSymbolicLink the toolbox did not report — never fabricate\n\treturn {\n\t\tisFile: !info.isDir && symlink !== true,\n\t\tisDirectory: info.isDir,\n\t\t...(symlink === undefined ? {} : { isSymbolicLink: symlink }),\n\t\t...(info.size === undefined ? {} : { size: info.size }),\n\t\t...(mtime === undefined ? {} : { mtime }),\n\t};\n};\n\ntype RemoteFilesystemProvider = Pick<\n\tRemoteFileSystem.Interface,\n\t\"readFile\" | \"readFileBuffer\" | \"writeFile\" | \"stat\" | \"lstat\" | \"readdir\" | \"exists\" | \"mkdir\" | \"rm\"\n>;\n\nconst providerFrom = (sandbox: RemoteSandbox, options: Options) => {\n\tconst filesystem: RemoteFilesystemProvider = {\n\t\treadFile: async (path: string) => (await sandbox.fs.downloadFile(path)).toString(\"utf8\"),\n\t\treadFileBuffer: async (path: string) => new Uint8Array(await sandbox.fs.downloadFile(path)),\n\t\twriteFile: (path: string, content: string | Uint8Array) =>\n\t\t\tsandbox.fs.uploadFile(typeof content === \"string\" ? Buffer.from(content, \"utf8\") : Buffer.from(content), path),\n\t\tstat: async (path: string) => statsFrom(await sandbox.fs.getFileDetails(path)),\n\t\t// The toolbox file-details endpoint follows symlinks. Detect the entry\n\t\t// with the sandbox shell first so lstat never reports target metadata as\n\t\t// if it described the link itself.\n\t\tlstat: async (path: string) => {\n\t\t\tconst command = `test -L ${quote(path)}`;\n\t\t\tconst result = await sandbox.process.executeCommand(command, options.cwd, undefined, options.execTimeout);\n\t\t\tif (result.exitCode === 0) {\n\t\t\t\treturn { isFile: false, isDirectory: false, isSymbolicLink: true };\n\t\t\t}\n\t\t\tif (result.exitCode === 1) return statsFrom(await sandbox.fs.getFileDetails(path));\n\t\t\tassertCommandSucceeded(command, result);\n\t\t\tthrow new Error(`unreachable lstat result for ${path}`);\n\t\t},\n\t\treaddir: async (path: string) => (await sandbox.fs.listFiles(path)).map((entry) => entry.name),\n\t\t// Only a genuine 404 means \"absent\". Auth, rate-limit, and transport\n\t\t// failures propagate: a caller that deletes records on absence must not\n\t\t// be told a path is gone because the API was briefly unreachable.\n\t\texists: async (path: string) => {\n\t\t\ttry {\n\t\t\t\tawait sandbox.fs.getFileDetails(path);\n\t\t\t\treturn true;\n\t\t\t} catch (cause) {\n\t\t\t\tconst { DaytonaNotFoundError } = await import(\"@daytona/sdk\");\n\t\t\t\tif (cause instanceof DaytonaNotFoundError) return false;\n\t\t\t\tthrow cause;\n\t\t\t}\n\t\t},\n\t\tmkdir: async (path: string, mkdirOptions?: { recursive?: boolean }) => {\n\t\t\tif (!mkdirOptions?.recursive) {\n\t\t\t\tawait sandbox.fs.createFolder(path, \"755\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst command = `mkdir -p ${quote(path)}`;\n\t\t\tconst result = await sandbox.process.executeCommand(command, options.cwd, undefined, options.execTimeout);\n\t\t\tassertCommandSucceeded(command, result);\n\t\t},\n\t\trm: async (path: string, rmOptions?: { recursive?: boolean; force?: boolean }) => {\n\t\t\tif (rmOptions?.force && !(await filesystem.exists(path))) return;\n\t\t\ttry {\n\t\t\t\tawait sandbox.fs.deleteFile(path, rmOptions?.recursive);\n\t\t\t} catch (cause) {\n\t\t\t\tif (rmOptions?.force && !(await filesystem.exists(path))) return;\n\t\t\t\tthrow cause;\n\t\t\t}\n\t\t},\n\t};\n\n\treturn filesystem;\n};\n\n// Daytona's execute API folds stderr into `result` and reports a single exit\n// code, so the shell surfaces the combined output as stdout and leaves stderr\n// empty rather than inventing a split.\nconst runCommand = (\n\tsandbox: RemoteSandbox,\n\toptions: Options,\n\tcommand: string,\n\topts?: { env?: Record<string, string>; cwd?: string },\n) =>\n\tEffect.tryPromise({\n\t\ttry: () =>\n\t\t\tsandbox.process.executeCommand(command, resolveCwd(options.cwd, opts?.cwd), opts?.env, options.execTimeout),\n\t\tcatch: (cause) => new ShellError({ command, cause }),\n\t}).pipe(Effect.map((response) => ({ stdout: response.result ?? \"\", stderr: \"\", exitCode: response.exitCode })));\n\nconst exec =\n\t(sandbox: RemoteSandbox, options: Options): ISandboxExe[\"exec\"] =>\n\t(command, opts) =>\n\t\trunCommand(sandbox, options, command, opts);\n\n// `executeCommand` takes a single string, so the vector is quoted here rather\n// than spawned; the per-call cwd rides the toolbox's own cwd argument instead\n// of a `cd` prefix.\nconst execArgv =\n\t(sandbox: RemoteSandbox, options: Options): ISandboxExe[\"execArgv\"] =>\n\t(argv, opts) =>\n\t\trunCommand(sandbox, options, quoteArgv(argv), opts);\n\nconst filesystemLayer = (options: Options) =>\n\tLayer.effect(\n\t\tSandboxFileSystem.Service,\n\t\tEffect.map(Remote, ({ sandbox, cwd }) => {\n\t\t\tconst mounted = { ...options, cwd };\n\t\t\treturn SandboxFileSystem.fromProvider(RemoteFileSystem.make(providerFrom(sandbox, mounted), { cwd }));\n\t\t}),\n\t);\n\nconst shellLayer = (options: Options) =>\n\tLayer.effect(\n\t\tShell,\n\t\tEffect.map(Remote, ({ sandbox, cwd }) => {\n\t\t\tconst mounted = { ...options, cwd };\n\t\t\treturn Shell.of({ exec: exec(sandbox, mounted), execArgv: execArgv(sandbox, mounted) });\n\t\t}),\n\t);\n\n/**\n * Cwd-neutral IO attachment for a lifecycle driver.\n *\n * Mount wrappers supply an absolute cwd to every public operation. Internal\n * filesystem helper commands already receive absolute paths, so the transport\n * itself keeps no mutable working-directory state and owns no resource\n * finalizer.\n */\nexport const transport = (\n\tsandbox: RemoteSandbox,\n\toptions: Pick<Options, \"execTimeout\"> = {},\n): Layer.Layer<SandboxFileSystem.Service | Shell> =>\n\tLayer.merge(\n\t\tLayer.succeed(\n\t\t\tSandboxFileSystem.Service,\n\t\t\tSandboxFileSystem.fromProvider(RemoteFileSystem.make(providerFrom(sandbox, options))),\n\t\t),\n\t\tLayer.succeed(\n\t\t\tShell,\n\t\t\tShell.of({\n\t\t\t\texec: exec(sandbox, options),\n\t\t\t\texecArgv: execArgv(sandbox, options),\n\t\t\t}),\n\t\t),\n\t);\n\n// Daytona's locator is the sandbox id. See `SandboxResource` for why this is a\n// shared tag rather than a Daytona-specific one.\nconst resourceLayer = Layer.effect(\n\tSandboxResource.Service,\n\tEffect.map(Remote, ({ sandbox }) => ({ providerResourceId: sandbox.id })),\n);\n\n// Identity is per remote sandbox, not per provider: two sandboxes both rooted at\n// the same directory must not share persisted directory records.\n//\n// The id is minted here only when the caller names none. A durable id is the\n// control plane's to mint and record — deriving one from the provider's own\n// locator is what §6.1 forbids — so a caller that needs the namespace to survive\n// a restart passes `instanceId` rather than relying on this.\nconst identityLayer = (options: Options) =>\n\tLayer.effect(\n\t\tSandboxIO.Current,\n\t\tEffect.map(Remote, ({ cwd }) =>\n\t\t\tSandboxIO.remote({\n\t\t\t\tdriver: \"daytona\",\n\t\t\t\tid: options.instanceId ?? SandboxInstance.ID.create(),\n\t\t\t\tdefaultCwd: cwd,\n\t\t\t}),\n\t\t),\n\t);\n\n/**\n * A Daytona sandbox provides the runtime filesystem service directly plus\n * the sandbox's native remote shell. It intentionally does not provide VFS:\n * remote filesystems have no synchronous filesystem surface.\n */\nexport const layer = (options: Options = {}): Layer.Layer<SandboxIO.Provides | SandboxResource.Service, DaytonaError> =>\n\tLayer.mergeAll(filesystemLayer(options), shellLayer(options), identityLayer(options), resourceLayer).pipe(\n\t\tLayer.provide(remote(options)),\n\t);\n\nexport const services = layer;\n","import { Effect, Layer, Option, Schema } from \"effect\";\nimport { SandboxDriver, SandboxInstance, SandboxProvider } from \"../../sandbox.ts\";\nimport * as EnvDaytona from \"./provider.ts\";\n\nexport const Options = Schema.Struct({\n\tapiKey: Schema.optional(Schema.String),\n\tapiUrl: Schema.optional(Schema.String),\n\ttarget: Schema.optional(Schema.String),\n});\nexport type Options = typeof Options.Type;\nexport const ClientOptions = Options;\nexport type ClientOptions = Options;\n\nexport const ResourcesConfig = Schema.Struct({\n\tcpu: Schema.optional(Schema.Finite),\n\tgpu: Schema.optional(Schema.Finite),\n\tmemory: Schema.optional(Schema.Finite),\n\tdisk: Schema.optional(Schema.Finite),\n});\nexport type ResourcesConfig = typeof ResourcesConfig.Type;\n\nexport const CreateConfig = Schema.Struct({\n\tsnapshot: Schema.optional(Schema.String),\n\timage: Schema.optional(Schema.String),\n\tlanguage: Schema.optional(Schema.String),\n\tenvVars: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n\tresources: Schema.optional(ResourcesConfig),\n\tuser: Schema.optional(Schema.String),\n\tcwd: Schema.optional(Schema.String),\n\tautoStopInterval: Schema.optional(Schema.Finite),\n\texecTimeout: Schema.optional(Schema.Finite),\n});\nexport type CreateConfig = typeof CreateConfig.Type;\n\nexport const RuntimeConfig = Schema.Struct({\n\tdefaultCwd: SandboxDriver.AbsolutePath,\n\tuser: Schema.optional(Schema.String),\n\texecTimeout: Schema.optional(Schema.Finite),\n});\nexport type RuntimeConfig = typeof RuntimeConfig.Type;\n\nconst name = SandboxDriver.Name.make(\"daytona\");\ntype DaytonaSdk = typeof import(\"@daytona/sdk\");\ntype RemoteSandbox = import(\"@daytona/sdk\").Sandbox;\ntype Resources = import(\"@daytona/sdk\").Resources;\n\nconst statusFrom = (\n\tstate: RemoteSandbox[\"state\"],\n): {\n\treadonly status: SandboxInstance.Status;\n\treadonly providerStatus: string;\n} => {\n\tconst providerStatus = state ?? \"unknown\";\n\treturn {\n\t\tstatus:\n\t\t\tstate === \"stopped\" || state === \"archived\"\n\t\t\t\t? \"offline\"\n\t\t\t\t: state === \"stopping\" || state === \"archiving\" || state === \"snapshotting\" || state === \"destroying\"\n\t\t\t\t\t? \"suspending\"\n\t\t\t\t\t: state === \"destroyed\"\n\t\t\t\t\t\t? \"unavail\"\n\t\t\t\t\t\t: state === \"error\" || state === \"build_failed\" || state === \"unknown\"\n\t\t\t\t\t\t\t? \"faulted\"\n\t\t\t\t\t\t\t: \"online\",\n\t\tproviderStatus,\n\t};\n};\n\nconst shouldWake = (sandbox: RemoteSandbox): boolean => sandbox.state === \"stopped\" || sandbox.state === \"archived\";\n\nexport const make = (\n\tclient: ClientOptions = {},\n): SandboxDriver.Driver<CreateConfig, RuntimeConfig> & SandboxDriver.Registration => {\n\tconst redact = SandboxProvider.makeRedactor([client.apiKey ?? \"\"]);\n\tconst daytona = (sdk: DaytonaSdk) =>\n\t\tnew sdk.Daytona({\n\t\t\t...(client.apiKey === undefined ? {} : { apiKey: client.apiKey }),\n\t\t\t...(client.apiUrl === undefined ? {} : { apiUrl: client.apiUrl }),\n\t\t\t...(client.target === undefined ? {} : { target: client.target }),\n\t\t});\n\n\tconst attempt = <A>(\n\t\toperation: string,\n\t\trun: (sdk: DaytonaSdk) => Promise<A>,\n\t): Effect.Effect<A, SandboxProvider.SandboxProviderError> =>\n\t\tEffect.suspend(() => {\n\t\t\tlet sdk: DaytonaSdk | undefined;\n\t\t\treturn Effect.tryPromise({\n\t\t\t\ttry: () =>\n\t\t\t\t\timport(\"@daytona/sdk\").then((loaded) => {\n\t\t\t\t\t\tsdk = loaded;\n\t\t\t\t\t\treturn run(loaded);\n\t\t\t\t\t}),\n\t\t\t\tcatch: (cause) =>\n\t\t\t\t\tSandboxProvider.providerError({\n\t\t\t\t\t\tdriver: name,\n\t\t\t\t\t\toperation,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t\tredact,\n\t\t\t\t\t\tnotFound: sdk !== undefined && cause instanceof sdk.DaytonaNotFoundError,\n\t\t\t\t\t}),\n\t\t\t});\n\t\t});\n\n\tconst get = (providerResourceId: string, operation: string) =>\n\t\tattempt(operation, (sdk) => daytona(sdk).get(providerResourceId));\n\n\tconst refresh = (sandbox: RemoteSandbox, operation: string) =>\n\t\tattempt(operation, () => sandbox.refreshData()).pipe(Effect.as(sandbox));\n\n\tconst observed = (sandbox: RemoteSandbox): SandboxDriver.Observed => ({\n\t\t...statusFrom(sandbox.state),\n\t\tmetadata: {\n\t\t\ttarget: sandbox.target,\n\t\t},\n\t});\n\n\tconst wake = (sandbox: RemoteSandbox, operation: string) =>\n\t\tshouldWake(sandbox)\n\t\t\t? attempt(operation, () => sandbox.start()).pipe(Effect.map(() => sandbox))\n\t\t\t: Effect.succeed(sandbox);\n\n\tconst runtime = (\n\t\tdefaultCwd: string,\n\t\tinput: { readonly user?: string | undefined; readonly execTimeout?: number | undefined },\n\t) => ({\n\t\tdefaultCwd: SandboxDriver.AbsolutePath.make(defaultCwd),\n\t\t...(input.user === undefined ? {} : { user: input.user }),\n\t\t...(input.execTimeout === undefined ? {} : { execTimeout: input.execTimeout }),\n\t});\n\n\treturn SandboxDriver.driver({\n\t\tname,\n\t\tkind: \"remote\",\n\t\tcapabilities: {\n\t\t\tinspect: true,\n\t\t\treattach: true,\n\t\t\twake: true,\n\t\t\tstop: true,\n\t\t\tdestroy: true,\n\t\t\t// Installed SDK 0.187.0 has no cancellation signal on\n\t\t\t// executeCommand; session execution cannot carry cwd/env safely.\n\t\t\tcancels: false,\n\t\t},\n\t\tcreateConfigCodec: CreateConfig,\n\t\truntimeConfigCodec: RuntimeConfig,\n\t\tcreate: ({ instanceId, config }) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst base = {\n\t\t\t\t\tlanguage: config.language ?? \"typescript\",\n\t\t\t\t\t...(config.envVars === undefined ? {} : { envVars: config.envVars }),\n\t\t\t\t\t...(config.user === undefined ? {} : { user: config.user }),\n\t\t\t\t\t...(config.autoStopInterval === undefined ? {} : { autoStopInterval: config.autoStopInterval }),\n\t\t\t\t\tautoDeleteInterval: -1,\n\t\t\t\t\tlabels: {\n\t\t\t\t\t\t\"codework-instance\": instanceId,\n\t\t\t\t\t\t\"codework-managed\": \"true\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t\tconst sandbox = yield* attempt(\"create\", (loaded) => {\n\t\t\t\t\tconst sdk = daytona(loaded);\n\t\t\t\t\treturn config.image === undefined\n\t\t\t\t\t\t? sdk.create({ ...base, ...(config.snapshot === undefined ? {} : { snapshot: config.snapshot }) })\n\t\t\t\t\t\t: sdk.create({\n\t\t\t\t\t\t\t\t...base,\n\t\t\t\t\t\t\t\timage: config.image,\n\t\t\t\t\t\t\t\t...(config.resources === undefined ? {} : { resources: config.resources as Resources }),\n\t\t\t\t\t\t\t});\n\t\t\t\t});\n\t\t\t\tconst defaultCwd = yield* attempt(\"create.cwd\", () =>\n\t\t\t\t\tEnvDaytona.mountCwd(config.cwd, () => sandbox.getWorkDir()),\n\t\t\t\t);\n\t\t\t\tconst state = statusFrom(sandbox.state);\n\t\t\t\treturn {\n\t\t\t\t\tproviderResourceId: sandbox.id,\n\t\t\t\t\tproviderStatus: state.providerStatus,\n\t\t\t\t\truntimeConfig: runtime(defaultCwd, config),\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\ttarget: sandbox.target,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}),\n\t\truntimeConfigFor: ({ providerResourceId, overrides }) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst sandbox = yield* get(providerResourceId, \"runtimeConfigFor\");\n\t\t\t\tconst defaultCwd =\n\t\t\t\t\toverrides?.defaultCwd ??\n\t\t\t\t\tSandboxDriver.AbsolutePath.make(\n\t\t\t\t\t\tyield* attempt(\"runtimeConfigFor.cwd\", () =>\n\t\t\t\t\t\t\tEnvDaytona.mountCwd(undefined, () => sandbox.getWorkDir()),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\treturn {\n\t\t\t\t\tdefaultCwd,\n\t\t\t\t\t...(overrides?.user === undefined ? { user: sandbox.user } : { user: overrides.user }),\n\t\t\t\t\t...(overrides?.execTimeout === undefined ? {} : { execTimeout: overrides.execTimeout }),\n\t\t\t\t};\n\t\t\t}),\n\t\tattach: (input) =>\n\t\t\tLayer.unwrap(\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst sandbox = yield* get(\n\t\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\t\t\"attach\",\n\t\t\t\t\t);\n\t\t\t\t\tyield* wake(sandbox, \"attach.wake\");\n\t\t\t\t\treturn EnvDaytona.transport(\n\t\t\t\t\t\tsandbox,\n\t\t\t\t\t\tinput.runtimeConfig.execTimeout === undefined\n\t\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t\t: { execTimeout: input.runtimeConfig.execTimeout },\n\t\t\t\t\t);\n\t\t\t\t}),\n\t\t\t),\n\t\tinspect: (input) =>\n\t\t\tEffect.flatMap(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\t\"inspect\",\n\t\t\t\t),\n\t\t\t\t(sandbox) => Effect.map(refresh(sandbox, \"inspect.refresh\"), observed),\n\t\t\t),\n\t\twake: (input) =>\n\t\t\tEffect.flatMap(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\t\"wake\",\n\t\t\t\t),\n\t\t\t\t(sandbox) => Effect.map(wake(sandbox, \"wake.start\"), observed),\n\t\t\t),\n\t\tstop: (input) =>\n\t\t\tEffect.flatMap(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\t\"stop\",\n\t\t\t\t),\n\t\t\t\t(sandbox) => attempt(\"stop\", () => sandbox.stop()).pipe(Effect.map(() => observed(sandbox))),\n\t\t\t),\n\t\tdestroy: (input) =>\n\t\t\tEffect.flatMap(\n\t\t\t\tget(\n\t\t\t\t\tOption.getOrElse(input.providerResourceId, () => input.id),\n\t\t\t\t\t\"destroy\",\n\t\t\t\t),\n\t\t\t\t(sandbox) => attempt(\"destroy\", () => sandbox.delete()),\n\t\t\t),\n\t});\n};\n\nconst sandbox = SandboxDriver.module({\n\tapiVersion: SandboxDriver.apiVersion,\n\tname,\n\toptions: Options,\n\tmake,\n});\n\nexport const config = (value: CreateConfig) => ({ driver: \"daytona\" as const, config: value });\n\nexport default sandbox;\n"],"mappings":";;;;AAaA,MAAM,eAAe,MAAc,YAAsB;CACxD,MAAM,aAAa,MAAM,UAAU,IAAI;CACvC,IAAI,SAAS,QAAQ,KAAA,KAAa,MAAM,WAAW,UAAU,GAAG,OAAO;CACvE,OAAO,MAAM,UAAU,MAAM,KAAK,QAAQ,KAAK,UAAU,CAAC;AAC3D;;AAGA,MAAaA,UAAQ,UAAqB,YAAiC;CAC1E,MAAM,WAAW,SAAiB,YAAY,MAAM,OAAO;CAE3D,OAAO;EACN,WAAW,SAAS,SAAS,SAAS,QAAQ,IAAI,CAAC;EACnD,iBAAiB,SAAS,SAAS,eAAe,QAAQ,IAAI,CAAC;EAC/D,YAAY,MAAM,YAAY,SAAS,UAAU,QAAQ,IAAI,GAAG,OAAO;EACvE,OAAO,SAAS,SAAS,KAAK,QAAQ,IAAI,CAAC;EAC3C,GAAI,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAiB,SAAS,MAAO,QAAQ,IAAI,CAAC,EAAE;EAClG,UAAU,SAAS,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACjD,SAAS,SAAS,SAAS,OAAO,QAAQ,IAAI,CAAC;EAC/C,QAAQ,MAAM,iBAAiB,SAAS,MAAM,QAAQ,IAAI,GAAG,YAAY;EACzE,KAAK,MAAM,cAAc,SAAS,GAAG,QAAQ,IAAI,GAAG,SAAS;CAC9D;AACD;;;;ACdA,MAAa,cAAc;;;;;;;;;;;;;AAc3B,MAAa,WAAW,OACvB,KACA,eACqB;CACrB,MAAM,aAAa,MAAM,WAAW,OAAO,EAAE,IAAI,cAAgB,MAAM,WAAW,KAAA;CAClF,OAAOC,gBAA0B,YAAY,GAAG;AACjD;AAEkC,OAAO,YAA0B,CAAC,CAAC,gBAAgB,EACpF,WAAWC,eACZ,CAAC;AAyCD,IAAM,SAAN,cAAqB,QAAQ,QAA6B,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC;AAEtH,MAAM,0BAA0B,SAAiB,WAAkD;CAClG,IAAI,OAAO,aAAa,GAAG,MAAM,IAAI,MAAM,OAAO,UAAU,mBAAmB,OAAO,SAAS,KAAK,SAAS;AAC9G;AAEA,MAAM,YAAY,UAA8B;CAC/C,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO,OAAO,eAAe,SAAS,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,SAAS,CAAC,CAAC;AACvF;AA0CA,MAAa,aAAa,SAA8C;CACvE,MAAM,UAAU,KAAK,SAAS,KAAA,IAAY,KAAA,IAAY,KAAK,KAAK,WAAW,GAAG;CAC9E,MAAM,QAAQ,SAAS,KAAK,cAAc,KAAK,OAAO;CAGtD,OAAO;EACN,QAAQ,CAAC,KAAK,SAAS,YAAY;EACnC,aAAa,KAAK;EAClB,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ;EAC3D,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;EACrD,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;CACxC;AACD;AAOA,MAAM,gBAAgB,SAAwB,YAAqB;CAClE,MAAM,aAAuC;EAC5C,UAAU,OAAO,UAAkB,MAAM,QAAQ,GAAG,aAAa,IAAI,EAAA,CAAG,SAAS,MAAM;EACvF,gBAAgB,OAAO,SAAiB,IAAI,WAAW,MAAM,QAAQ,GAAG,aAAa,IAAI,CAAC;EAC1F,YAAY,MAAc,YACzB,QAAQ,GAAG,WAAW,OAAO,YAAY,WAAW,OAAO,KAAK,SAAS,MAAM,IAAI,OAAO,KAAK,OAAO,GAAG,IAAI;EAC9G,MAAM,OAAO,SAAiB,UAAU,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC;EAI7E,OAAO,OAAO,SAAiB;GAC9B,MAAM,UAAU,WAAW,MAAM,IAAI;GACrC,MAAM,SAAS,MAAM,QAAQ,QAAQ,eAAe,SAAS,QAAQ,KAAK,KAAA,GAAW,QAAQ,WAAW;GACxG,IAAI,OAAO,aAAa,GACvB,OAAO;IAAE,QAAQ;IAAO,aAAa;IAAO,gBAAgB;GAAK;GAElE,IAAI,OAAO,aAAa,GAAG,OAAO,UAAU,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC;GACjF,uBAAuB,SAAS,MAAM;GACtC,MAAM,IAAI,MAAM,gCAAgC,MAAM;EACvD;EACA,SAAS,OAAO,UAAkB,MAAM,QAAQ,GAAG,UAAU,IAAI,EAAA,CAAG,KAAK,UAAU,MAAM,IAAI;EAI7F,QAAQ,OAAO,SAAiB;GAC/B,IAAI;IACH,MAAM,QAAQ,GAAG,eAAe,IAAI;IACpC,OAAO;GACR,SAAS,OAAO;IACf,MAAM,EAAE,yBAAyB,MAAM,OAAO;IAC9C,IAAI,iBAAiB,sBAAsB,OAAO;IAClD,MAAM;GACP;EACD;EACA,OAAO,OAAO,MAAc,iBAA2C;GACtE,IAAI,CAAC,cAAc,WAAW;IAC7B,MAAM,QAAQ,GAAG,aAAa,MAAM,KAAK;IACzC;GACD;GAEA,MAAM,UAAU,YAAY,MAAM,IAAI;GACtC,MAAM,SAAS,MAAM,QAAQ,QAAQ,eAAe,SAAS,QAAQ,KAAK,KAAA,GAAW,QAAQ,WAAW;GACxG,uBAAuB,SAAS,MAAM;EACvC;EACA,IAAI,OAAO,MAAc,cAAyD;GACjF,IAAI,WAAW,SAAS,CAAE,MAAM,WAAW,OAAO,IAAI,GAAI;GAC1D,IAAI;IACH,MAAM,QAAQ,GAAG,WAAW,MAAM,WAAW,SAAS;GACvD,SAAS,OAAO;IACf,IAAI,WAAW,SAAS,CAAE,MAAM,WAAW,OAAO,IAAI,GAAI;IAC1D,MAAM;GACP;EACD;CACD;CAEA,OAAO;AACR;AAKA,MAAM,cACL,SACA,SACA,SACA,SAEA,OAAO,WAAW;CACjB,WACC,QAAQ,QAAQ,eAAe,SAAS,WAAW,QAAQ,KAAK,MAAM,GAAG,GAAG,MAAM,KAAK,QAAQ,WAAW;CAC3G,QAAQ,UAAU,IAAI,WAAW;EAAE;EAAS;CAAM,CAAC;AACpD,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,cAAc;CAAE,QAAQ,SAAS,UAAU;CAAI,QAAQ;CAAI,UAAU,SAAS;AAAS,EAAE,CAAC;AAE/G,MAAM,QACJ,SAAwB,aACxB,SAAS,SACT,WAAW,SAAS,SAAS,SAAS,IAAI;AAK5C,MAAM,YACJ,SAAwB,aACxB,MAAM,SACN,WAAW,SAAS,SAAS,UAAU,IAAI,GAAG,IAAI;;;;;;;;;AA4BpD,MAAa,aACZ,SACA,UAAwC,CAAC,MAEzC,MAAM,MACL,MAAM,QACLC,SACAC,aAA+BC,OAAsB,aAAa,SAAS,OAAO,CAAC,CAAC,CACrF,GACA,MAAM,QACL,OACA,MAAM,GAAG;CACR,MAAM,KAAK,SAAS,OAAO;CAC3B,UAAU,SAAS,SAAS,OAAO;AACpC,CAAC,CACF,CACD;AAIqB,MAAM,OAC3BC,WACA,OAAO,IAAI,SAAS,EAAE,eAAe,EAAE,oBAAoB,QAAQ,GAAG,EAAE,CACzE;;;AC9RA,MAAa,UAAU,OAAO,OAAO;CACpC,QAAQ,OAAO,SAAS,OAAO,MAAM;CACrC,QAAQ,OAAO,SAAS,OAAO,MAAM;CACrC,QAAQ,OAAO,SAAS,OAAO,MAAM;AACtC,CAAC;AAED,MAAa,gBAAgB;AAG7B,MAAa,kBAAkB,OAAO,OAAO;CAC5C,KAAK,OAAO,SAAS,OAAO,MAAM;CAClC,KAAK,OAAO,SAAS,OAAO,MAAM;CAClC,QAAQ,OAAO,SAAS,OAAO,MAAM;CACrC,MAAM,OAAO,SAAS,OAAO,MAAM;AACpC,CAAC;AAGD,MAAa,eAAe,OAAO,OAAO;CACzC,UAAU,OAAO,SAAS,OAAO,MAAM;CACvC,OAAO,OAAO,SAAS,OAAO,MAAM;CACpC,UAAU,OAAO,SAAS,OAAO,MAAM;CACvC,SAAS,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,CAAC;CACpE,WAAW,OAAO,SAAS,eAAe;CAC1C,MAAM,OAAO,SAAS,OAAO,MAAM;CACnC,KAAK,OAAO,SAAS,OAAO,MAAM;CAClC,kBAAkB,OAAO,SAAS,OAAO,MAAM;CAC/C,aAAa,OAAO,SAAS,OAAO,MAAM;AAC3C,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;CAC1C,YAAYC;CACZ,MAAM,OAAO,SAAS,OAAO,MAAM;CACnC,aAAa,OAAO,SAAS,OAAO,MAAM;AAC3C,CAAC;AAGD,MAAM,OAAA,KAA0B,KAAK,SAAS;AAK9C,MAAM,cACL,UAII;CAEJ,OAAO;EACN,QACC,UAAU,aAAa,UAAU,aAC9B,YACA,UAAU,cAAc,UAAU,eAAe,UAAU,kBAAkB,UAAU,eACtF,eACA,UAAU,cACT,YACA,UAAU,WAAW,UAAU,kBAAkB,UAAU,YAC1D,YACA;EACP,gBAZsB,SAAS;CAahC;AACD;AAEA,MAAM,cAAc,YAAoC,QAAQ,UAAU,aAAa,QAAQ,UAAU;AAEzG,MAAa,QACZ,SAAwB,CAAC,MAC2D;CACpF,MAAM,SAASC,aAA6B,CAAC,OAAO,UAAU,EAAE,CAAC;CACjE,MAAM,WAAW,QAChB,IAAI,IAAI,QAAQ;EACf,GAAI,OAAO,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;EAC/D,GAAI,OAAO,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;EAC/D,GAAI,OAAO,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;CAChE,CAAC;CAEF,MAAM,WACL,WACA,QAEA,OAAO,cAAc;EACpB,IAAI;EACJ,OAAO,OAAO,WAAW;GACxB,WACC,OAAO,eAAe,CAAC,MAAM,WAAW;IACvC,MAAM;IACN,OAAO,IAAI,MAAM;GAClB,CAAC;GACF,QAAQ,UACPC,cAA8B;IAC7B,QAAQ;IACR;IACA;IACA;IACA,UAAU,QAAQ,KAAA,KAAa,iBAAiB,IAAI;GACrD,CAAC;EACH,CAAC;CACF,CAAC;CAEF,MAAM,OAAO,oBAA4B,cACxC,QAAQ,YAAY,QAAQ,QAAQ,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC;CAEjE,MAAM,WAAW,SAAwB,cACxC,QAAQ,iBAAiB,QAAQ,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC;CAExE,MAAM,YAAY,aAAoD;EACrE,GAAG,WAAW,QAAQ,KAAK;EAC3B,UAAU,EACT,QAAQ,QAAQ,OACjB;CACD;CAEA,MAAM,QAAQ,SAAwB,cACrC,WAAW,OAAO,IACf,QAAQ,iBAAiB,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,OAAO,CAAC,IACxE,OAAO,QAAQ,OAAO;CAE1B,MAAM,WACL,YACA,WACK;EACL,YAAA,aAAuC,KAAK,UAAU;EACtD,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;EACvD,GAAI,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;CAC7E;CAEA,OAAOC,OAAqB;EAC3B;EACA,MAAM;EACN,cAAc;GACb,SAAS;GACT,UAAU;GACV,MAAM;GACN,MAAM;GACN,SAAS;GAGT,SAAS;EACV;EACA,mBAAmB;EACnB,oBAAoB;EACpB,SAAS,EAAE,YAAY,aACtB,OAAO,IAAI,aAAa;GACvB,MAAM,OAAO;IACZ,UAAU,OAAO,YAAY;IAC7B,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;IAClE,GAAI,OAAO,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK;IACzD,GAAI,OAAO,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB,OAAO,iBAAiB;IAC7F,oBAAoB;IACpB,QAAQ;KACP,qBAAqB;KACrB,oBAAoB;IACrB;GACD;GACA,MAAM,UAAU,OAAO,QAAQ,WAAW,WAAW;IACpD,MAAM,MAAM,QAAQ,MAAM;IAC1B,OAAO,OAAO,UAAU,KAAA,IACrB,IAAI,OAAO;KAAE,GAAG;KAAM,GAAI,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;IAAG,CAAC,IAC/F,IAAI,OAAO;KACX,GAAG;KACH,OAAO,OAAO;KACd,GAAI,OAAO,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,OAAO,UAAuB;IACtF,CAAC;GACJ,CAAC;GACD,MAAM,aAAa,OAAO,QAAQ,oBACjCC,SAAoB,OAAO,WAAW,QAAQ,WAAW,CAAC,CAC3D;GACA,MAAM,QAAQ,WAAW,QAAQ,KAAK;GACtC,OAAO;IACN,oBAAoB,QAAQ;IAC5B,gBAAgB,MAAM;IACtB,eAAe,QAAQ,YAAY,MAAM;IACzC,UAAU,EACT,QAAQ,QAAQ,OACjB;GACD;EACD,CAAC;EACF,mBAAmB,EAAE,oBAAoB,gBACxC,OAAO,IAAI,aAAa;GACvB,MAAM,UAAU,OAAO,IAAI,oBAAoB,kBAAkB;GAQjE,OAAO;IACN,YAPA,WAAW,cAAA,aACgB,KAC1B,OAAO,QAAQ,8BACdA,SAAoB,KAAA,SAAiB,QAAQ,WAAW,CAAC,CAC1D,CACD;IAGA,GAAI,WAAW,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,KAAK;IACpF,GAAI,WAAW,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,UAAU,YAAY;GACtF;EACD,CAAC;EACF,SAAS,UACR,MAAM,OACL,OAAO,IAAI,aAAa;GACvB,MAAM,UAAU,OAAO,IACtB,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,QACD;GACA,OAAO,KAAK,SAAS,aAAa;GAClC,OAAOC,UACN,SACA,MAAM,cAAc,gBAAgB,KAAA,IACjC,KAAA,IACA,EAAE,aAAa,MAAM,cAAc,YAAY,CACnD;EACD,CAAC,CACF;EACD,UAAU,UACT,OAAO,QACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,SACD,IACC,YAAY,OAAO,IAAI,QAAQ,SAAS,iBAAiB,GAAG,QAAQ,CACtE;EACD,OAAO,UACN,OAAO,QACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,MACD,IACC,YAAY,OAAO,IAAI,KAAK,SAAS,YAAY,GAAG,QAAQ,CAC9D;EACD,OAAO,UACN,OAAO,QACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,MACD,IACC,YAAY,QAAQ,cAAc,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,SAAS,OAAO,CAAC,CAAC,CAC5F;EACD,UAAU,UACT,OAAO,QACN,IACC,OAAO,UAAU,MAAM,0BAA0B,MAAM,EAAE,GACzD,SACD,IACC,YAAY,QAAQ,iBAAiB,QAAQ,OAAO,CAAC,CACvD;CACF,CAAC;AACF;AAEA,MAAM,UAAUC,aAAqB;CACpC,YAAY;CACZ;CACA,SAAS;CACT;AACD,CAAC;AAED,MAAa,UAAU,WAAyB;CAAE,QAAQ;CAAoB,QAAQ;AAAM"}