@cofy-x/axern-sdk 0.2.0-bootstrap.0

package/README.md

@@ -0,0 +1,169 @@
+# Axern TypeScript SDK
+
+Node.js SDK for programmable Axern sandboxes.
+
+This first SDK surface is intentionally focused on the programmable sandbox path:
+
+- create or attach a `Sandbox`
+- run `exec`
+- start attached `process` streams
+- discover optional providers with `capabilityStatus`
+- use Computer Use status, display, screenshot, mouse, and keyboard APIs
+- use platform file RPCs such as `readFile`, `writeFile`, `stat`, and `listDir`
+- transfer directories with archive-backed `uploadDir` and `downloadDir`
+- expose local services to the sandbox with `tunnel`
+
+## Install
+
+Install the published package in a Node.js project:
+
+```bash
+pnpm add @cofy-x/axern-sdk
+```
+
+For repository development:
+
+```bash
+pnpm install
+make sdk-typescript-verify
+```
+
+The SDK dynamically loads Axern proto definitions from `sdk/proto`. Set
+`AXERN_PROTO_ROOT` when running from a different layout.
+
+## Basic Usage
+
+```ts
+import { AxernClient, Sandbox } from "@cofy-x/axern-sdk";
+
+const client = AxernClient.fromContext(
+  process.env.AXERN_CONFIG ?? `${process.env.HOME}/.config/axern/config.json`,
+  process.env.AXERN_CONTEXT,
+);
+
+const sandbox = await new Sandbox({
+  client,
+  image: "python:3.12-slim",
+  namespace: "typescript-sdk-example",
+  tunnel: {
+    upstream: "127.0.0.1:8080",
+    proxyPort: 8786,
+  },
+}).start();
+
+try {
+  const result = await sandbox.exec("python - <<'PY'\nprint('hello from axern')\nPY", {
+    check: true,
+  });
+  console.log(result.stdoutText());
+
+  await sandbox.writeText("/tmp/message.txt", "hello\n", { createParents: true });
+  console.log(await sandbox.readText("/tmp/message.txt"));
+
+  await sandbox.uploadDir("./fixtures", "/tmp/fixtures");
+  await sandbox.downloadDir("/tmp/fixtures", "./downloaded-fixtures");
+} finally {
+  await sandbox.close();
+  client.close();
+}
+```
+
+Run a tool from a separate image with `execImage` or `processImage`. OCI and
+Nydus refs use the same image field. When `mounts` is omitted, the SDK requests
+`/workspace -> /workspace`; pass `mounts: []` for no shared paths. Use
+`new Sandbox({ image })` when the image should be the sandbox rootfs with normal
+files, exec, process, tunnel, and lifecycle APIs; image-backed processes are
+temporary side processes attached to an existing sandbox.
+
+```ts
+import { workspaceMount } from "@cofy-x/axern-sdk";
+
+const result = await sandbox.execImage("ghcr.io/cofy-x/agent:latest", "tool run", {
+  check: true,
+  mounts: [workspaceMount("/workspace")],
+});
+console.log(result.stdoutText());
+```
+
+`AxernClient` requires an explicit endpoint. Use `AxernClient.fromContext()` in
+interactive examples or `AxernClient.fromEnv()` in environment-driven
+automation. Neither the client constructor nor `Sandbox` silently reads the
+user directory.
+
+## Configuration
+
+`Sandbox` requires exactly one source: `templateId`, `image`, or
+`environmentId`.
+
+Common options:
+
+- `namespace`: control-plane namespace, default `default`
+- `client`: explicit `AxernClient` shared by the sandbox
+- `argv`, `env`, `cwd`: initial sandbox process configuration
+- `runtimeClass`: runtime selector, for example `runsc` or `runc`
+- `requestCpu`, `requestMemory`: scheduler resource requests such as `500m`
+  and `512MiB`; numeric CPU values are cores and numeric memory values are bytes
+- `limitCpu`, `limitMemory`: runtime cgroup resource limits such as `1` and
+  `1GiB`; numeric CPU values are cores and numeric memory values are bytes
+- `readyTimeoutMs`: service replica readiness timeout
+
+Tunnel options:
+
+- `tunnel.upstream`: local TCP address reached by the SDK connector, for
+  example `127.0.0.1:8080`
+- `tunnel.proxyPort`: sandbox-local port bound by Axern, default `8786`
+- `tunnel.ttlSeconds`: control-plane tunnel session TTL, renewed by the SDK
+
+Tunnel traffic reuses the client gateway endpoint, mTLS identity, server name,
+and proxy policy.
+
+After `start()`, use `sandbox.metadata.tunnel?.boundAddr` from inside the
+sandbox, for example `http://127.0.0.1:8786`.
+
+## Sandbox API
+
+- Lifecycle: `start()`, `close()`, `state`, `metadata`
+- Execution: `exec(command, options)`, `process(command, options)`
+- Agent sandbox: `capabilityStatus`, `computerUseStatus`,
+  `computerUseScreenshot`, `computerUseDisplay`, `computerUseMouse`,
+  `computerUseKeyboard`
+- Files: `readFile`, `readText`, `writeFile`, `writeText`, `stat`, `listDir`,
+  `exists`, `mkdir`, `remove`, `copy`, `move`, `chmod`, `touch`
+- Directories: `uploadDir(localPath, remotePath)`,
+  `downloadDir(remotePath, localPath)`
+- Tunnel: `new Sandbox({ tunnel: { upstream, proxyPort } })`,
+  `metadata.tunnel`
+- Errors: `AxernRpcError`, `SandboxExecError`, `SandboxStateError`,
+  `SandboxValidationError`, `isNotFound`, `isPermissionDenied`, `isTimeout`,
+  `rpcCode`
+
+## Local Smoke
+
+With the local compose stack running, verify the real SDK path with:
+
+```bash
+pnpm --filter @cofy-x/axern-sdk run smoke:local
+pnpm --filter @cofy-x/axern-sdk run smoke:tunnel
+```
+
+The smoke loads `deploy/local/state/compose/axern.env` when present. It uses the
+`python311` template by default; set `AXERN_TS_SMOKE_IMAGE` to verify an image
+source instead.
+
+Check package contents with:
+
+```bash
+pnpm --filter @cofy-x/axern-sdk run pack:dry-run
+```
+
+## Proto Boundary
+
+The SDK loads protobuf definitions through `@grpc/proto-loader`. Dynamic proto
+access remains isolated under `src/generated`; public callers depend only on
+the stable TypeScript DTOs and error types.
+
+## Scope
+
+This SDK is Node.js-first. The higher-level Browser API, generated TypeScript
+proto stubs, and full control-plane administration APIs remain outside the
+v0.2 public contract.

package/dist/client/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2026 cofy-x
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as grpc from "@grpc/grpc-js";
+import { NodeSandboxClient } from "../node/client.js";
+import type { ResourceQuantity } from "../resources.js";
+import { TunnelControlClient } from "../tunnel/control.js";
+import type { VolumeMount } from "../types.js";
+import type { GatewayTransportOptions } from "../tunnel/relay.js";
+export interface AxernClientOptions {
+    endpoint: string;
+    credentials?: grpc.ChannelCredentials;
+    tlsCaCert?: string;
+    tlsCert?: string;
+    tlsKey?: string;
+    tlsServerName?: string;
+    proxyMode?: "env" | "direct";
+}
+export interface CreateEnvironmentOptions {
+    namespace?: string;
+    templateId?: string;
+    image?: string;
+    registryCredentialId?: string;
+    rootfsReadonly?: boolean;
+    labels?: Record<string, string>;
+}
+export interface CreateServiceOptions {
+    namespace?: string;
+    environmentId: string;
+    argv?: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+    runtimeClass?: string;
+    volumes?: readonly VolumeMount[];
+    requestCpu?: ResourceQuantity;
+    requestMemory?: ResourceQuantity;
+    limitCpu?: ResourceQuantity;
+    limitMemory?: ResourceQuantity;
+    labels?: Record<string, string>;
+}
+export declare class AxernClient {
+    readonly endpoint: string;
+    private readonly credentials;
+    private readonly controlOptions;
+    private readonly environmentControl;
+    private readonly serviceControl;
+    private readonly tunnelControl;
+    private readonly gatewayTransport;
+    constructor(options: AxernClientOptions);
+    static fromEnv(overrides?: Partial<AxernClientOptions>): AxernClient;
+    static fromContext(path: string, name?: string): AxernClient;
+    close(): void;
+    createEnvironment(options: CreateEnvironmentOptions): Promise<Record<string, unknown>>;
+    deleteEnvironment(environmentId: string): Promise<void>;
+    createService(options: CreateServiceOptions): Promise<Record<string, unknown>>;
+    deleteService(serviceId: string): Promise<void>;
+    listServiceReplicas(serviceId: string): Promise<Record<string, unknown>[]>;
+    nodeSandbox(allocationId: string): NodeSandboxClient;
+    tunnelClient(): TunnelControlClient;
+    tunnelTransport(): GatewayTransportOptions;
+}

package/dist/client/index.js

@@ -0,0 +1,213 @@
+/**
+ * @license
+ * Copyright 2026 cofy-x
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as grpc from "@grpc/grpc-js";
+import { readFileSync } from "node:fs";
+import { loadAxernContext, loadAxernEnv, normalizeProxyMode } from "../config/index.js";
+import { mapRpcError } from "../errors/index.js";
+import { serviceConstructor, unary } from "../generated/proto.js";
+import { NodeSandboxClient } from "../node/client.js";
+import { buildResourceSpec } from "../resources.js";
+import { TunnelControlClient } from "../tunnel/control.js";
+import { required } from "../validation.js";
+export class AxernClient {
+    endpoint;
+    credentials;
+    controlOptions;
+    environmentControl;
+    serviceControl;
+    tunnelControl;
+    gatewayTransport;
+    constructor(options) {
+        this.endpoint = required("endpoint", options.endpoint);
+        const proxyMode = normalizeProxyMode(options.proxyMode);
+        const tlsConfigured = tlsOptionsConfigured({
+            tlsCaCert: options.tlsCaCert,
+            tlsCert: options.tlsCert,
+            tlsKey: options.tlsKey,
+        });
+        const tlsServerName = options.tlsServerName ?? defaultLocalTlsServerName(this.endpoint, tlsConfigured);
+        this.credentials = options.credentials ?? controlCredentials({
+            tlsCaCert: options.tlsCaCert,
+            tlsCert: options.tlsCert,
+            tlsKey: options.tlsKey,
+        });
+        this.controlOptions = tlsServerName === undefined || tlsServerName === ""
+            ? {}
+            : { "grpc.ssl_target_name_override": tlsServerName };
+        if (proxyMode === "direct") {
+            this.controlOptions["grpc.enable_http_proxy"] = 0;
+        }
+        this.gatewayTransport = {
+            insecure: !tlsConfigured,
+            tlsCaCert: options.tlsCaCert,
+            tlsCert: options.tlsCert,
+            tlsKey: options.tlsKey,
+            serverName: tlsServerName,
+            proxyMode,
+        };
+        const EnvironmentControl = serviceConstructor([
+            "axern",
+            "control",
+            "environment",
+            "v1",
+            "EnvironmentControl",
+        ]);
+        const ServiceControl = serviceConstructor(["axern", "control", "service", "v1", "ServiceControl"]);
+        const TunnelControl = serviceConstructor(["axern", "control", "tunnel", "v1", "TunnelControl"]);
+        this.environmentControl = new EnvironmentControl(this.endpoint, this.credentials, this.controlOptions);
+        this.serviceControl = new ServiceControl(this.endpoint, this.credentials, this.controlOptions);
+        this.tunnelControl = new TunnelControl(this.endpoint, this.credentials, this.controlOptions);
+    }
+    static fromEnv(overrides = {}) {
+        const environment = loadAxernEnv();
+        return new AxernClient({ ...environment, ...overrides, endpoint: overrides.endpoint ?? environment.endpoint });
+    }
+    static fromContext(path, name = "") {
+        const config = loadAxernContext(path, name);
+        return new AxernClient({
+            endpoint: config.endpoint,
+            tlsCaCert: config.tlsCaCert,
+            tlsCert: config.tlsCert,
+            tlsKey: config.tlsKey,
+            tlsServerName: config.tlsServerName,
+            proxyMode: config.proxyMode,
+        });
+    }
+    close() {
+        this.environmentControl.close();
+        this.serviceControl.close();
+        this.tunnelControl.close();
+    }
+    async createEnvironment(options) {
+        const namespace = options.namespace ?? "default";
+        const sources = [options.templateId, options.image].filter((value) => value !== undefined && value !== "");
+        if (sources.length !== 1) {
+            throw new Error("exactly one of templateId or image is required");
+        }
+        const spec = { namespace };
+        if (options.templateId !== undefined && options.templateId !== "") {
+            spec.template_id = options.templateId;
+        }
+        else {
+            spec.image = {
+                ref: required("image", options.image),
+                registry_credential_id: options.registryCredentialId ?? "",
+                rootfs_readonly: options.rootfsReadonly ?? false,
+            };
+        }
+        try {
+            const response = await unary(this.environmentControl, "CreateEnvironment", { spec, labels: options.labels ?? {} });
+            return response.environment;
+        }
+        catch (error) {
+            throw mapRpcError(error, "create environment");
+        }
+    }
+    async deleteEnvironment(environmentId) {
+        try {
+            await unary(this.environmentControl, "DeleteEnvironment", { environment_id: required("environmentId", environmentId) });
+        }
+        catch (error) {
+            throw mapRpcError(error, "delete environment");
+        }
+    }
+    async createService(options) {
+        const resources = buildResourceSpec(options);
+        try {
+            const response = await unary(this.serviceControl, "CreateService", {
+                namespace: options.namespace ?? "default",
+                environment_id: required("environmentId", options.environmentId),
+                replicas: 1,
+                config: {
+                    argv: options.argv ?? [],
+                    env: options.env ?? {},
+                    cwd: options.cwd ?? "",
+                    runtime_class: options.runtimeClass ?? "",
+                    volume_mounts: serviceVolumeMounts(options.volumes),
+                    resources,
+                },
+                labels: options.labels ?? {},
+            });
+            return response.service;
+        }
+        catch (error) {
+            throw mapRpcError(error, "create service");
+        }
+    }
+    async deleteService(serviceId) {
+        try {
+            await unary(this.serviceControl, "DeleteService", { service_id: required("serviceId", serviceId) });
+        }
+        catch (error) {
+            throw mapRpcError(error, "delete service");
+        }
+    }
+    async listServiceReplicas(serviceId) {
+        try {
+            const response = await unary(this.serviceControl, "ListServiceReplicas", {
+                service_id: required("serviceId", serviceId),
+                filter: { view: 2 },
+            });
+            return response.replicas ?? [];
+        }
+        catch (error) {
+            throw mapRpcError(error, "list service replicas");
+        }
+    }
+    nodeSandbox(allocationId) {
+        return new NodeSandboxClient({
+            allocationId: required("allocationId", allocationId),
+            target: this.endpoint,
+            credentials: this.credentials,
+            channelOptions: this.controlOptions,
+        });
+    }
+    tunnelClient() {
+        return new TunnelControlClient(this.tunnelControl);
+    }
+    tunnelTransport() {
+        return { ...this.gatewayTransport };
+    }
+}
+function serviceVolumeMounts(mounts) {
+    return (mounts ?? []).map((mount) => ({
+        name: mount.name,
+        target: mount.target,
+        readonly: mount.readonly ?? false,
+        options: [...(mount.options ?? [])],
+    }));
+}
+function controlCredentials(options) {
+    const configured = [options.tlsCaCert, options.tlsCert, options.tlsKey].filter((value) => value !== undefined && value !== "");
+    if (configured.length === 0) {
+        return grpc.credentials.createInsecure();
+    }
+    if (configured.length !== 3) {
+        throw new Error("mTLS requires tlsCaCert, tlsCert, and tlsKey");
+    }
+    const rootCerts = readFileSync(options.tlsCaCert);
+    const certChain = readFileSync(options.tlsCert);
+    const privateKey = readFileSync(options.tlsKey);
+    return grpc.credentials.createSsl(rootCerts, privateKey, certChain);
+}
+function tlsOptionsConfigured(options) {
+    return [options.tlsCaCert, options.tlsCert, options.tlsKey].some((value) => value !== undefined && value !== "");
+}
+function defaultLocalTlsServerName(target, tlsConfigured) {
+    if (!tlsConfigured) {
+        return undefined;
+    }
+    const host = targetHost(target);
+    return host === "127.0.0.1" || host === "::1" ? "localhost" : undefined;
+}
+function targetHost(target) {
+    const withoutScheme = target.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+    if (withoutScheme.startsWith("[")) {
+        const end = withoutScheme.indexOf("]");
+        return end === -1 ? withoutScheme : withoutScheme.slice(1, end);
+    }
+    return withoutScheme.split(":", 1)[0] ?? withoutScheme;
+}

package/dist/config/index.d.ts

@@ -0,0 +1,15 @@
+/** Explicit environment and context loaders for the Axern SDK. */
+export interface AxernConfig {
+    endpoint: string;
+    serviceUrl?: string;
+    sshEndpoint?: string;
+    sshIdentityFile?: string;
+    tlsCaCert?: string;
+    tlsCert?: string;
+    tlsKey?: string;
+    tlsServerName?: string;
+    proxyMode: "env" | "direct";
+}
+export declare function loadAxernEnv(overrides?: Partial<AxernConfig>): AxernConfig;
+export declare function loadAxernContext(path: string, name?: string): AxernConfig;
+export declare function normalizeProxyMode(value: string | undefined): "env" | "direct";

package/dist/config/index.js

@@ -0,0 +1,65 @@
+/** Explicit environment and context loaders for the Axern SDK. */
+import { readFileSync } from "node:fs";
+export function loadAxernEnv(overrides = {}) {
+    return {
+        endpoint: overrides.endpoint ?? process.env.AXERN_ENDPOINT ?? "127.0.0.1:25000",
+        serviceUrl: overrides.serviceUrl ?? process.env.AXERN_SERVICE_URL,
+        sshEndpoint: overrides.sshEndpoint ?? process.env.AXERN_SSH_ENDPOINT,
+        sshIdentityFile: overrides.sshIdentityFile ?? process.env.AXERN_SSH_IDENTITY_FILE,
+        tlsCaCert: overrides.tlsCaCert ?? process.env.AXERN_TLS_CA_CERT,
+        tlsCert: overrides.tlsCert ?? process.env.AXERN_TLS_CERT,
+        tlsKey: overrides.tlsKey ?? process.env.AXERN_TLS_KEY,
+        tlsServerName: overrides.tlsServerName ?? process.env.AXERN_TLS_SERVER_NAME,
+        proxyMode: normalizeProxyMode(overrides.proxyMode ?? process.env.AXERN_PROXY_MODE),
+    };
+}
+export function loadAxernContext(path, name = "") {
+    const file = JSON.parse(readFileSync(path, "utf8"));
+    rejectUnknown(file, ["current_context", "contexts", "agent_profiles"], "config");
+    const contextName = name || stringValue(file.current_context);
+    if (!contextName)
+        throw new Error("Axern context name is required");
+    const contexts = objectValue(file.contexts, "contexts");
+    const context = objectValue(contexts[contextName], `context ${JSON.stringify(contextName)}`);
+    rejectUnknown(context, ["endpoint", "service_url", "ssh_endpoint", "ssh_identity_file", "tls", "proxy_mode"], "context");
+    const tls = objectValue(context.tls, "context.tls");
+    rejectUnknown(tls, ["ca_cert", "cert", "key", "server_name"], "context.tls");
+    const config = {
+        endpoint: stringValue(context.endpoint),
+        serviceUrl: stringValue(context.service_url) || undefined,
+        sshEndpoint: stringValue(context.ssh_endpoint) || undefined,
+        sshIdentityFile: stringValue(context.ssh_identity_file) || undefined,
+        tlsCaCert: stringValue(tls.ca_cert),
+        tlsCert: stringValue(tls.cert),
+        tlsKey: stringValue(tls.key),
+        tlsServerName: stringValue(tls.server_name) || undefined,
+        proxyMode: normalizeProxyMode(stringValue(context.proxy_mode)),
+    };
+    if (!config.endpoint || !config.tlsCaCert || !config.tlsCert || !config.tlsKey) {
+        throw new Error("context requires endpoint and tls.ca_cert, tls.cert, and tls.key");
+    }
+    return config;
+}
+export function normalizeProxyMode(value) {
+    const mode = value?.trim() || "env";
+    if (mode !== "env" && mode !== "direct")
+        throw new Error("proxy_mode must be 'env' or 'direct'");
+    return mode;
+}
+function objectValue(value, path) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error(`${path} must be an object`);
+    return value;
+}
+function stringValue(value) {
+    if (value === undefined)
+        return "";
+    if (typeof value !== "string")
+        throw new Error("context string field has invalid type");
+    return value.trim();
+}
+function rejectUnknown(value, allowed, path) {
+    const unknown = Object.keys(value).filter((key) => !allowed.includes(key)).sort();
+    if (unknown.length > 0)
+        throw new Error(`${path} contains unknown field ${JSON.stringify(unknown[0])}`);
+}

package/dist/errors/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @license
+ * Copyright 2026 cofy-x
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export declare class AxernError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class AxernRpcError extends AxernError {
+    readonly code?: number | string;
+    readonly operation: string;
+    readonly allocationId?: string;
+    readonly details: string;
+    readonly retryable: boolean;
+    constructor(operation: string, cause: unknown, options?: {
+        allocationId?: string;
+    });
+}
+export declare class SandboxTimeoutError extends AxernError {
+    constructor(message: string);
+}
+export declare class SandboxStateError extends AxernError {
+    constructor(message: string);
+}
+export declare class SandboxValidationError extends AxernError {
+    constructor(message: string);
+}
+export declare class SandboxExecError extends AxernError {
+    readonly argv: string[];
+    readonly exitCode: number;
+    readonly stdout: Buffer;
+    readonly stderr: Buffer;
+    constructor(argv: string[], result: {
+        exitCode: number;
+        stdout: Buffer;
+        stderr: Buffer;
+    });
+}
+export declare function mapRpcError(error: unknown, operation: string, allocationId?: string): AxernRpcError;
+export declare function isNotFound(error: unknown): boolean;
+export declare function isPermissionDenied(error: unknown): boolean;
+export declare function isTimeout(error: unknown): boolean;
+export declare function isCancelled(error: unknown): boolean;
+export declare function isUnavailable(error: unknown): boolean;
+export declare function errorRetryable(error: unknown): boolean;
+export declare function rpcCode(error: unknown): number | undefined;

package/dist/errors/index.js

@@ -0,0 +1,123 @@
+/**
+ * @license
+ * Copyright 2026 cofy-x
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export class AxernError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "AxernError";
+    }
+}
+export class AxernRpcError extends AxernError {
+    code;
+    operation;
+    allocationId;
+    details;
+    retryable;
+    constructor(operation, cause, options = {}) {
+        const detail = errorDetail(cause);
+        super(`${operation} failed${detail ? `: ${detail}` : ""}`, { cause });
+        this.name = "AxernRpcError";
+        this.operation = operation;
+        this.allocationId = options.allocationId;
+        this.details = detail;
+        this.code = typeof cause === "object" && cause !== null && "code" in cause
+            ? String(cause.code)
+            : undefined;
+        this.retryable = isRetryableRpcCode(rpcCode(this));
+    }
+}
+export class SandboxTimeoutError extends AxernError {
+    constructor(message) {
+        super(message);
+        this.name = "SandboxTimeoutError";
+    }
+}
+export class SandboxStateError extends AxernError {
+    constructor(message) {
+        super(message);
+        this.name = "SandboxStateError";
+    }
+}
+export class SandboxValidationError extends AxernError {
+    constructor(message) {
+        super(message);
+        this.name = "SandboxValidationError";
+    }
+}
+export class SandboxExecError extends AxernError {
+    argv;
+    exitCode;
+    stdout;
+    stderr;
+    constructor(argv, result) {
+        super(`sandbox command exited with code ${result.exitCode}: ${argv.join(" ")}`);
+        this.name = "SandboxExecError";
+        this.argv = [...argv];
+        this.exitCode = result.exitCode;
+        this.stdout = result.stdout;
+        this.stderr = result.stderr;
+    }
+}
+export function mapRpcError(error, operation, allocationId) {
+    return new AxernRpcError(operation, error, { allocationId });
+}
+export function isNotFound(error) {
+    return rpcCode(error) === 5;
+}
+export function isPermissionDenied(error) {
+    const code = rpcCode(error);
+    return code === 7 || code === 16;
+}
+export function isTimeout(error) {
+    return error instanceof SandboxTimeoutError || rpcCode(error) === 4;
+}
+export function isCancelled(error) {
+    return rpcCode(error) === 1;
+}
+export function isUnavailable(error) {
+    return rpcCode(error) === 14;
+}
+export function errorRetryable(error) {
+    if (error instanceof AxernRpcError) {
+        return error.retryable;
+    }
+    return isRetryableRpcCode(rpcCode(error));
+}
+export function rpcCode(error) {
+    const code = rawRpcCode(error);
+    if (code === undefined) {
+        return undefined;
+    }
+    const numeric = Number(code);
+    return Number.isNaN(numeric) ? undefined : numeric;
+}
+function rawRpcCode(error) {
+    if (typeof error !== "object" || error === null) {
+        return undefined;
+    }
+    const candidate = error;
+    if (candidate.code !== undefined) {
+        return candidate.code;
+    }
+    return rawRpcCode(candidate.cause);
+}
+function isRetryableRpcCode(code) {
+    return code === 4 || code === 14;
+}
+function errorDetail(error) {
+    if (typeof error === "object" && error !== null) {
+        const maybeDetails = error;
+        if (typeof maybeDetails.details === "string" && maybeDetails.details.length > 0) {
+            return maybeDetails.details;
+        }
+        if (typeof maybeDetails.message === "string" && maybeDetails.message.length > 0) {
+            return maybeDetails.message;
+        }
+    }
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return "";
+}