@computesdk/createos-sandbox 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 computesdk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,100 @@
+# @computesdk/createos-sandbox
+
+[ComputeSDK](https://github.com/computesdk/computesdk) provider for **CreateOS** —
+NodeOps' createos-sandbox VM sandbox service. Thin adapter over the
+official [`@nodeops-createos/sandbox`](https://www.npmjs.com/package/@nodeops-createos/sandbox).
+
+## Install
+
+```bash
+npm install computesdk @computesdk/createos-sandbox
+```
+
+## Usage
+
+```typescript
+import { compute } from "computesdk";
+import { createosSandbox } from "@computesdk/createos-sandbox";
+
+compute.setConfig({
+  provider: createosSandbox({
+    apiKey: process.env.CREATEOS_SANDBOX_API_KEY,
+    baseUrl: process.env.CREATEOS_SANDBOX_BASE_URL,
+  }),
+});
+
+const sandbox = await compute.sandbox.create({ memoryMb: 1024, image: "devbox:1" });
+const { stdout } = await sandbox.runCommand("echo hello");
+await sandbox.filesystem.writeFile("/tmp/x.txt", "hi");
+await sandbox.destroy();
+```
+
+## Configuration
+
+| Field | Env fallback | Notes |
+|---|---|---|
+| `apiKey` | `CREATEOS_SANDBOX_API_KEY` | Required. createos-sandbox API key. |
+| `baseUrl` | `CREATEOS_SANDBOX_BASE_URL` | Control-plane URL. Optional; defaults to the production control plane. |
+| `shape` | — | Default VM shape (e.g. `s-1vcpu-1gb`). |
+| `rootfs` | — | Default rootfs catalog name / template. |
+| `timeout` | — | Reported `getInfo().timeout` (ms). Informational. |
+
+## Capability mapping
+
+createos-sandbox sizes VMs from a **shape catalog** (not free-form cpu/mem), so
+`create()` fetches the live catalog (`GET /v1/shapes`) and maps ComputeSDK's
+`cpus`/`memoryMb` onto the smallest shape that fits. Pass a provider-specific
+`shape` to pin one exactly (skips the catalog fetch). With no size pinned, the
+default is the smallest live shape with ≥1 GiB RAM. `image`/`runtime` map to
+`rootfs`; `ephemeralDiskMb` is passed straight through to `disk_mib` (the
+control plane validates it; `0`/omitted = the shape's default disk).
+
+| ComputeSDK | createos-sandbox |
+|---|---|
+| shape selection | `GET /v1/shapes` (live catalog, nearest fit) |
+| `sandbox.create` / `getById` / `list` / `destroy` | `POST/GET/DELETE /v1/sandboxes` |
+| `sandbox.runCommand` | `POST /v1/sandboxes/:id/exec` (wrapped in `sh -c`) |
+| `sandbox.getInfo` | `GET /v1/sandboxes/:id` |
+| `sandbox.getUrl({port})` | per-sandbox ingress URL |
+| `filesystem.readFile` / `writeFile` | `GET/PUT /v1/sandboxes/:id/files` |
+| `filesystem.mkdir` / `readdir` / `exists` / `remove` | synthesised via `runCommand` |
+| `snapshot.create` / `list` / `delete` | `pause` / list paused / `destroy` |
+
+Template builds (`/v1/templates`) are **not** exposed through the ComputeSDK
+provider surface — ComputeSDK's public `Provider` type can't carry the
+createos-specific `dockerfile` create option type-safely. Build templates with
+the native `@nodeops-createos/sandbox` client (`client.templates.create`)
+directly.
+
+### Native escape hatch
+
+ComputeSDK's core surface has no pause/resume/fork. Reach the full
+`@nodeops-createos/sandbox` `Sandbox` handle via `getInstance()`:
+
+```typescript
+const native = sandbox.getInstance();
+await native.pause();
+await native.resume();
+const clone = await native.fork();
+await native.attachDisk({ diskId: "my-bucket", mountPath: "/mnt/data" });
+```
+
+## Known limitations
+
+- **`runCommand` env/cwd are synthesised** — createos-sandbox drops per-exec env
+  server-side, so `env`/`cwd` are injected by wrapping the command in an inline
+  `sh -c` script. Sandbox-level env should be set at create time (`envs`).
+- **Snapshot semantics differ** — `snapshot.create` *pauses* the sandbox (the
+  source VM stops); the paused sandbox id IS the snapshot id. `create({ snapshotId })`
+  forks that paused bundle into a fresh sandbox.
+- **`getUrl` needs ingress + works in-process** — sandboxes are created with
+  ingress enabled by default; `getUrl` is only available for sandboxes created in
+  this process (the SDK handle from `getById`/`list` carries no ingress template).
+  Ingress currently serves a non-CA TLS cert and strips the `Authorization`
+  header upstream — use `protocol: "http"` / `curl -k` and don't rely on HTTP auth
+  behind ingress.
+- **`readdir` parses `ls` output** — relies on coreutils `ls` in the rootfs.
+
+## License
+
+MIT

package/dist/index.d.mts

@@ -0,0 +1,62 @@
+import * as _computesdk_provider from '@computesdk/provider';
+import { CreateSandboxOptions, SandboxInfo, RunCommandOptions, FileEntry } from '@computesdk/provider';
+import { Shape, SandboxStatus, ForkSandboxRequest, CreateSandboxRequest, Sandbox } from '@nodeops-createos/sandbox';
+export { Sandbox as CreateosSandbox } from '@nodeops-createos/sandbox';
+
+interface CreateosConfig {
+    /** createos-sandbox API key. Falls back to the CREATEOS_SANDBOX_API_KEY env var. */
+    apiKey?: string;
+    /** Control-plane base URL. Falls back to the CREATEOS_SANDBOX_BASE_URL env
+     *  var, then the production control plane. */
+    baseUrl?: string;
+    /** Default shape when create options pin neither `shape` nor cpus/memoryMb. */
+    shape?: string;
+    /** Default rootfs catalog name or template id. Empty = host default. */
+    rootfs?: string;
+    /** Reported `getInfo().timeout` in ms. Informational only. */
+    timeout?: number;
+}
+/** ComputeSDK create options plus the createos-specific fields this provider
+ *  reads off the (otherwise open) options bag. Declaring them turns the cast-
+ *  heavy decode into a typed contract and makes unsupported fields obvious. */
+interface CreateosCreateOptions extends CreateSandboxOptions {
+    /** Explicit shape id. Overrides cpus/memoryMb selection and skips the catalog fetch. */
+    shape?: string;
+    /** Rootfs catalog name or template id (alias of `runtime`). */
+    image?: string;
+    /** Rootfs catalog name or template id (alias of `image`). */
+    runtime?: string;
+    /** Requested RAM; mapped onto the smallest fitting shape. */
+    memoryMb?: number;
+    /** Requested vCPUs; mapped onto the smallest fitting shape. */
+    cpus?: number;
+    /** Overlay disk size (MiB). 0 / omitted = the shape's default disk. */
+    ephemeralDiskMb?: number;
+    /** Enable public ingress. Defaults to true. */
+    ingressEnabled?: boolean;
+    /** SSH public keys to inject at boot. */
+    sshPubkeys?: string[];
+    /** Egress allow-list. */
+    egress?: string[];
+}
+/** Pick the smallest live catalog shape that satisfies the requested cpu/mem.
+ *  Returns undefined when neither is given (caller applies the default). */
+declare function pickShape(shapes: Shape[], memoryMb?: number, cpus?: number): string | undefined;
+/** Default shape when create() pins neither `shape` nor cpus/memoryMb: the
+ *  smallest live shape meeting the RAM floor, else the smallest available. */
+declare function defaultShape(shapes: Shape[]): string | undefined;
+/** Map an createos-sandbox lifecycle state onto ComputeSDK's running|stopped|error. */
+declare function mapStatus(status: SandboxStatus): SandboxInfo["status"];
+/** Pure map: ComputeSDK create options → createos-sandbox fork request body. */
+declare function toForkRequest(opts: CreateosCreateOptions): ForkSandboxRequest;
+/** Pure map: ComputeSDK create options (+ resolved shape/rootfs) → create request. */
+declare function toCreateRequest(opts: CreateosCreateOptions, shape: string, rootfs?: string): CreateSandboxRequest;
+/** Wrap a command so per-call cwd/env/background work despite the server dropping
+ *  exec env. Env *keys* are validated before being spliced into `export` —
+ *  values are shell-quoted, but a malformed key would otherwise be raw shell. */
+declare function buildScript(command: string, options?: RunCommandOptions): string;
+/** Parse `ls -lA --time-style=+%s` output into ComputeSDK FileEntry rows. */
+declare function parseLsOutput(stdout: string): FileEntry[];
+declare const createosSandbox: (config: CreateosConfig) => _computesdk_provider.Provider<Sandbox, any, any>;
+
+export { type CreateosConfig, type CreateosCreateOptions, buildScript, createosSandbox, defaultShape, mapStatus, parseLsOutput, pickShape, toCreateRequest, toForkRequest };

package/dist/index.d.ts

@@ -0,0 +1,62 @@
+import * as _computesdk_provider from '@computesdk/provider';
+import { CreateSandboxOptions, SandboxInfo, RunCommandOptions, FileEntry } from '@computesdk/provider';
+import { Shape, SandboxStatus, ForkSandboxRequest, CreateSandboxRequest, Sandbox } from '@nodeops-createos/sandbox';
+export { Sandbox as CreateosSandbox } from '@nodeops-createos/sandbox';
+
+interface CreateosConfig {
+    /** createos-sandbox API key. Falls back to the CREATEOS_SANDBOX_API_KEY env var. */
+    apiKey?: string;
+    /** Control-plane base URL. Falls back to the CREATEOS_SANDBOX_BASE_URL env
+     *  var, then the production control plane. */
+    baseUrl?: string;
+    /** Default shape when create options pin neither `shape` nor cpus/memoryMb. */
+    shape?: string;
+    /** Default rootfs catalog name or template id. Empty = host default. */
+    rootfs?: string;
+    /** Reported `getInfo().timeout` in ms. Informational only. */
+    timeout?: number;
+}
+/** ComputeSDK create options plus the createos-specific fields this provider
+ *  reads off the (otherwise open) options bag. Declaring them turns the cast-
+ *  heavy decode into a typed contract and makes unsupported fields obvious. */
+interface CreateosCreateOptions extends CreateSandboxOptions {
+    /** Explicit shape id. Overrides cpus/memoryMb selection and skips the catalog fetch. */
+    shape?: string;
+    /** Rootfs catalog name or template id (alias of `runtime`). */
+    image?: string;
+    /** Rootfs catalog name or template id (alias of `image`). */
+    runtime?: string;
+    /** Requested RAM; mapped onto the smallest fitting shape. */
+    memoryMb?: number;
+    /** Requested vCPUs; mapped onto the smallest fitting shape. */
+    cpus?: number;
+    /** Overlay disk size (MiB). 0 / omitted = the shape's default disk. */
+    ephemeralDiskMb?: number;
+    /** Enable public ingress. Defaults to true. */
+    ingressEnabled?: boolean;
+    /** SSH public keys to inject at boot. */
+    sshPubkeys?: string[];
+    /** Egress allow-list. */
+    egress?: string[];
+}
+/** Pick the smallest live catalog shape that satisfies the requested cpu/mem.
+ *  Returns undefined when neither is given (caller applies the default). */
+declare function pickShape(shapes: Shape[], memoryMb?: number, cpus?: number): string | undefined;
+/** Default shape when create() pins neither `shape` nor cpus/memoryMb: the
+ *  smallest live shape meeting the RAM floor, else the smallest available. */
+declare function defaultShape(shapes: Shape[]): string | undefined;
+/** Map an createos-sandbox lifecycle state onto ComputeSDK's running|stopped|error. */
+declare function mapStatus(status: SandboxStatus): SandboxInfo["status"];
+/** Pure map: ComputeSDK create options → createos-sandbox fork request body. */
+declare function toForkRequest(opts: CreateosCreateOptions): ForkSandboxRequest;
+/** Pure map: ComputeSDK create options (+ resolved shape/rootfs) → create request. */
+declare function toCreateRequest(opts: CreateosCreateOptions, shape: string, rootfs?: string): CreateSandboxRequest;
+/** Wrap a command so per-call cwd/env/background work despite the server dropping
+ *  exec env. Env *keys* are validated before being spliced into `export` —
+ *  values are shell-quoted, but a malformed key would otherwise be raw shell. */
+declare function buildScript(command: string, options?: RunCommandOptions): string;
+/** Parse `ls -lA --time-style=+%s` output into ComputeSDK FileEntry rows. */
+declare function parseLsOutput(stdout: string): FileEntry[];
+declare const createosSandbox: (config: CreateosConfig) => _computesdk_provider.Provider<Sandbox, any, any>;
+
+export { type CreateosConfig, type CreateosCreateOptions, buildScript, createosSandbox, defaultShape, mapStatus, parseLsOutput, pickShape, toCreateRequest, toForkRequest };

package/dist/index.js

@@ -0,0 +1,294 @@
+'use strict';
+
+var sandbox = require('@nodeops-createos/sandbox');
+var provider = require('@computesdk/provider');
+
+// src/index.ts
+var PROVIDER_NAME = "createos-sandbox";
+var sandboxConfig = /* @__PURE__ */ new WeakMap();
+function shellQuote(arg) {
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+var DEFAULT_SHAPE_MIN_MIB = 1024;
+var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var DEFAULT_BASE_URL = "https://api.sb.createos.sh";
+function env(key) {
+  return typeof process !== "undefined" ? process.env?.[key] : void 0;
+}
+function resolveClient(config) {
+  const apiKey = config.apiKey ?? env("CREATEOS_SANDBOX_API_KEY");
+  if (!apiKey) {
+    throw new Error(
+      "Missing CreateOS API key. Provide 'apiKey' in config or set the CREATEOS_SANDBOX_API_KEY environment variable."
+    );
+  }
+  const baseUrl = config.baseUrl?.trim() || env("CREATEOS_SANDBOX_BASE_URL")?.trim() || DEFAULT_BASE_URL;
+  return new sandbox.CreateosSandboxClient({ apiKey, baseUrl });
+}
+function isNotFound(e) {
+  return e instanceof sandbox.CreateosSandboxNotFoundError;
+}
+function sortShapes(shapes) {
+  return shapes.toSorted((a, b) => a.mem_mib - b.mem_mib || a.vcpu - b.vcpu);
+}
+function pickShape(shapes, memoryMb, cpus) {
+  if (memoryMb == null && cpus == null) return void 0;
+  const sorted = sortShapes(shapes);
+  const fit = sorted.find(
+    (s) => (memoryMb == null || s.mem_mib >= memoryMb) && (cpus == null || s.vcpu >= cpus)
+  );
+  return (fit ?? sorted[sorted.length - 1])?.id;
+}
+function defaultShape(shapes) {
+  const sorted = sortShapes(shapes);
+  const fit = sorted.find((s) => s.mem_mib >= DEFAULT_SHAPE_MIN_MIB);
+  return (fit ?? sorted[0])?.id;
+}
+async function resolveShape(client, opts, config) {
+  const explicit = opts.shape ?? config.shape;
+  if (explicit) return explicit;
+  const shapes = await client.listShapes();
+  const picked = pickShape(shapes, opts.memoryMb, opts.cpus) ?? defaultShape(shapes);
+  if (!picked) {
+    throw new Error("CreateOS control plane returned an empty shape catalog.");
+  }
+  return picked;
+}
+function mapStatus(status) {
+  if (status === "running") return "running";
+  if (status === "error" || status === "failed") return "error";
+  return "stopped";
+}
+function envsOf(opts) {
+  const envs = opts.envs ?? opts.env;
+  return envs && Object.keys(envs).length > 0 ? envs : void 0;
+}
+function strArray(v) {
+  return Array.isArray(v) ? v : void 0;
+}
+function toForkRequest(opts) {
+  const req = {
+    ingress_enabled: opts.ingressEnabled !== void 0 ? Boolean(opts.ingressEnabled) : true
+  };
+  const ssh = strArray(opts.sshPubkeys);
+  if (ssh) req.ssh_pubkeys = ssh;
+  const egress = strArray(opts.egress);
+  if (egress) req.egress = egress;
+  const envs = envsOf(opts);
+  if (envs) req.envs = envs;
+  return req;
+}
+function toCreateRequest(opts, shape, rootfs) {
+  const req = {
+    shape,
+    ingress_enabled: opts.ingressEnabled !== void 0 ? Boolean(opts.ingressEnabled) : true
+  };
+  if (rootfs) req.rootfs = rootfs;
+  if (opts.name) req.name = String(opts.name);
+  if (typeof opts.ephemeralDiskMb === "number" && opts.ephemeralDiskMb > 0) {
+    req.disk_mib = opts.ephemeralDiskMb;
+  }
+  const envs = envsOf(opts);
+  if (envs) req.envs = envs;
+  const ssh = strArray(opts.sshPubkeys);
+  if (ssh) req.ssh_pubkeys = ssh;
+  const egress = strArray(opts.egress);
+  if (egress) req.egress = egress;
+  return req;
+}
+function buildScript(command, options) {
+  let script = command;
+  if (options?.cwd) script = `cd ${shellQuote(options.cwd)} && ${script}`;
+  if (options?.env && Object.keys(options.env).length > 0) {
+    const exports = Object.entries(options.env).map(([k, v]) => {
+      if (!ENV_KEY_RE.test(k)) {
+        throw new Error(
+          `Invalid environment variable name ${JSON.stringify(k)}: must match ${ENV_KEY_RE.source}.`
+        );
+      }
+      return `export ${k}=${shellQuote(String(v))}`;
+    }).join("; ");
+    script = `${exports}; ${script}`;
+  }
+  if (options?.background) {
+    script = `nohup sh -c ${shellQuote(script)} > /dev/null 2>&1 &`;
+  }
+  return script;
+}
+function parseLsOutput(stdout) {
+  const entries = [];
+  for (const line of stdout.split("\n")) {
+    if (!line || line.startsWith("total ")) continue;
+    const m = line.match(/^(\S+)\s+\d+\s+\S+\s+\S+\s+(\d+)\s+(\d+)\s+(.+)$/);
+    if (!m) continue;
+    const name = m[4].replace(/ -> .*$/, "");
+    entries.push({
+      name,
+      type: m[1].startsWith("d") ? "directory" : "file",
+      size: Number(m[2]),
+      modified: new Date(Number(m[3]) * 1e3)
+    });
+  }
+  return entries;
+}
+var createosSandbox = provider.defineProvider({
+  name: PROVIDER_NAME,
+  methods: {
+    sandbox: {
+      create: async (config, options) => {
+        const client = resolveClient(config);
+        const opts = options ?? {};
+        if (opts.snapshotId) {
+          const source = await client.getSandbox(opts.snapshotId);
+          const forked = await source.fork(toForkRequest(opts));
+          await forked.waitUntilRunning();
+          sandboxConfig.set(forked, config);
+          return { sandbox: forked, sandboxId: forked.id };
+        }
+        const shape = await resolveShape(client, opts, config);
+        const rootfs = opts.image ?? opts.runtime ?? config.rootfs;
+        const sandbox = await client.createSandbox(toCreateRequest(opts, shape, rootfs));
+        sandboxConfig.set(sandbox, config);
+        return { sandbox, sandboxId: sandbox.id };
+      },
+      getById: async (config, sandboxId) => {
+        const client = resolveClient(config);
+        try {
+          const sandbox = await client.getSandbox(sandboxId);
+          sandboxConfig.set(sandbox, config);
+          return { sandbox, sandboxId: sandbox.id };
+        } catch (e) {
+          if (isNotFound(e)) return null;
+          throw e;
+        }
+      },
+      list: async (config) => {
+        const client = resolveClient(config);
+        const sandboxes = await client.listSandboxes({ limit: 100 });
+        return sandboxes.map((sandbox) => {
+          sandboxConfig.set(sandbox, config);
+          return { sandbox, sandboxId: sandbox.id };
+        });
+      },
+      destroy: async (config, sandboxId) => {
+        const client = resolveClient(config);
+        try {
+          const sandbox = await client.getSandbox(sandboxId);
+          await sandbox.destroy();
+        } catch (e) {
+          if (isNotFound(e)) return;
+          throw e;
+        }
+      },
+      runCommand: async (sandbox, command, options) => {
+        const { result, exec_ms } = await sandbox.runCommand("sh", [
+          "-c",
+          buildScript(command, options)
+        ]);
+        const stderr = result.error ? `${result.stderr}${result.error}` : result.stderr;
+        return {
+          stdout: result.stdout,
+          stderr,
+          exitCode: result.exit_code,
+          durationMs: exec_ms
+        };
+      },
+      getInfo: async (sandbox) => {
+        await sandbox.refresh();
+        const v = sandbox.data;
+        return {
+          id: v.id,
+          provider: PROVIDER_NAME,
+          status: mapStatus(v.status),
+          createdAt: new Date(v.created_at),
+          timeout: sandboxConfig.get(sandbox)?.timeout ?? 0,
+          metadata: {
+            createosStatus: v.status,
+            shape: v.shape,
+            rootfs: v.rootfs,
+            region: v.region,
+            ip: v.ip,
+            ingressEnabled: v.ingress_enabled
+          }
+        };
+      },
+      getUrl: async (sandbox, options) => {
+        const scheme = options.protocol === "http" ? "http" : "https";
+        return sandbox.previewUrl(options.port, { scheme });
+      },
+      // Escape hatch: the bare native @nodeops-createos/sandbox handle
+      // (pause/resume/fork/disks/...).
+      getInstance: (sandbox) => sandbox,
+      filesystem: {
+        readFile: async (sandbox, path) => {
+          const buf = await sandbox.files.download(path);
+          return new TextDecoder().decode(buf);
+        },
+        writeFile: async (sandbox, path, content) => {
+          await sandbox.files.upload(path, content);
+        },
+        mkdir: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `mkdir -p ${shellQuote(path)}`);
+          if (r.exitCode !== 0) throw new Error(`mkdir ${path} failed: ${r.stderr}`);
+        },
+        readdir: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `ls -lA --time-style=+%s ${shellQuote(path)}`);
+          if (r.exitCode !== 0) throw new Error(`readdir ${path} failed: ${r.stderr}`);
+          return parseLsOutput(r.stdout);
+        },
+        exists: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `test -e ${shellQuote(path)}`);
+          return r.exitCode === 0;
+        },
+        remove: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `rm -rf ${shellQuote(path)}`);
+          if (r.exitCode !== 0) throw new Error(`remove ${path} failed: ${r.stderr}`);
+        }
+      }
+    },
+    snapshot: {
+      create: async (config, sandboxId, options) => {
+        const client = resolveClient(config);
+        const sandbox = await client.getSandbox(sandboxId);
+        await sandbox.pause();
+        await sandbox.waitUntilPaused();
+        return {
+          id: sandboxId,
+          provider: PROVIDER_NAME,
+          createdAt: /* @__PURE__ */ new Date(),
+          metadata: { name: options?.name, ...options?.metadata }
+        };
+      },
+      list: async (config, _options) => {
+        const client = resolveClient(config);
+        const all = await client.listSandboxes({ limit: 500 });
+        return all.filter((s) => s.status === "paused").map((s) => ({
+          id: s.id,
+          provider: PROVIDER_NAME,
+          createdAt: new Date(s.data.paused_at ?? s.data.created_at)
+        }));
+      },
+      delete: async (config, snapshotId) => {
+        const client = resolveClient(config);
+        try {
+          const sandbox = await client.getSandbox(snapshotId);
+          await sandbox.destroy();
+        } catch (e) {
+          if (isNotFound(e)) return;
+          throw e;
+        }
+      }
+    }
+  }
+});
+
+exports.buildScript = buildScript;
+exports.createosSandbox = createosSandbox;
+exports.defaultShape = defaultShape;
+exports.mapStatus = mapStatus;
+exports.parseLsOutput = parseLsOutput;
+exports.pickShape = pickShape;
+exports.toCreateRequest = toCreateRequest;
+exports.toForkRequest = toForkRequest;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["CreateosSandboxClient","CreateosSandboxNotFoundError","defineProvider"],"mappings":";;;;;;AAiDA,IAAM,aAAA,GAAgB,kBAAA;AAOtB,IAAM,aAAA,uBAAoB,OAAA,EAAiC;AAO3D,SAAS,WAAW,GAAA,EAAqB;AACvC,EAAA,OAAO,CAAA,CAAA,EAAI,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AAaA,IAAM,qBAAA,GAAwB,IAAA;AAI9B,IAAM,UAAA,GAAa,0BAAA;AA0CnB,IAAM,gBAAA,GAAmB,4BAAA;AAEzB,SAAS,IAAI,GAAA,EAAiC;AAC5C,EAAA,OAAO,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,GAAA,GAAM,GAAG,CAAA,GAAI,MAAA;AAC/D;AAEA,SAAS,cAAc,MAAA,EAA+C;AACpE,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,GAAA,CAAI,0BAA0B,CAAA;AAC9D,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GACJ,OAAO,OAAA,EAAS,IAAA,MAAU,GAAA,CAAI,2BAA2B,CAAA,EAAG,IAAA,EAAK,IAAK,gBAAA;AACxE,EAAA,OAAO,IAAIA,6BAAA,CAAsB,EAAE,MAAA,EAAQ,SAAS,CAAA;AACtD;AAIA,SAAS,WAAW,CAAA,EAAqB;AACvC,EAAA,OAAO,CAAA,YAAaC,oCAAA;AACtB;AAIA,SAAS,WAAW,MAAA,EAA0B;AAC5C,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,OAAA,GAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,GAAO,CAAA,CAAE,IAAI,CAAA;AAC3E;AAIO,SAAS,SAAA,CAAU,MAAA,EAAiB,QAAA,EAAmB,IAAA,EAAmC;AAC/F,EAAA,IAAI,QAAA,IAAY,IAAA,IAAQ,IAAA,IAAQ,IAAA,EAAM,OAAO,MAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,WAAW,MAAM,CAAA;AAChC,EAAA,MAAM,MAAM,MAAA,CAAO,IAAA;AAAA,IACjB,CAAC,CAAA,KAAA,CAAO,QAAA,IAAY,IAAA,IAAQ,CAAA,CAAE,WAAW,QAAA,MAAc,IAAA,IAAQ,IAAA,IAAQ,CAAA,CAAE,IAAA,IAAQ,IAAA;AAAA,GACnF;AACA,EAAA,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,MAAA,CAAO,MAAA,GAAS,CAAC,CAAA,GAAI,EAAA;AAC7C;AAIO,SAAS,aAAa,MAAA,EAAqC;AAChE,EAAA,MAAM,MAAA,GAAS,WAAW,MAAM,CAAA;AAChC,EAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,qBAAqB,CAAA;AACjE,EAAA,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,CAAC,CAAA,GAAI,EAAA;AAC7B;AAKA,eAAe,YAAA,CACb,MAAA,EACA,IAAA,EACA,MAAA,EACiB;AACjB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,IAAS,MAAA,CAAO,KAAA;AACtC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,EAAA,MAAM,MAAA,GAAS,UAAU,MAAA,EAAQ,IAAA,CAAK,UAAU,IAAA,CAAK,IAAI,CAAA,IAAK,YAAA,CAAa,MAAM,CAAA;AACjF,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,UAAU,MAAA,EAA8C;AACtE,EAAA,IAAI,MAAA,KAAW,WAAW,OAAO,SAAA;AACjC,EAAA,IAAI,MAAA,KAAW,OAAA,IAAW,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA;AACtD,EAAA,OAAO,SAAA;AACT;AAGA,SAAS,OAAO,IAAA,EAAiE;AAC/E,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAS,IAAA,CAA0C,GAAA;AACrE,EAAA,OAAO,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,GAAS,IAAI,IAAA,GAAO,MAAA;AACvD;AAGA,SAAS,SAAS,CAAA,EAAkC;AAClD,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAK,CAAA,GAAiB,MAAA;AAC9C;AAGO,SAAS,cAAc,IAAA,EAAiD;AAC7E,EAAA,MAAM,GAAA,GAA0B;AAAA,IAC9B,iBAAiB,IAAA,CAAK,cAAA,KAAmB,SAAY,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA,GAAI;AAAA,GACtF;AACA,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA;AACpC,EAAA,IAAI,GAAA,MAAS,WAAA,GAAc,GAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,MAAY,MAAA,GAAS,MAAA;AACzB,EAAA,MAAM,IAAA,GAAO,OAAO,IAAI,CAAA;AACxB,EAAA,IAAI,IAAA,MAAU,IAAA,GAAO,IAAA;AACrB,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,eAAA,CACd,IAAA,EACA,KAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,GAAA,GAA4B;AAAA,IAChC,KAAA;AAAA,IACA,iBAAiB,IAAA,CAAK,cAAA,KAAmB,SAAY,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA,GAAI;AAAA,GACtF;AACA,EAAA,IAAI,MAAA,MAAY,MAAA,GAAS,MAAA;AACzB,EAAA,IAAI,KAAK,IAAA,EAAM,GAAA,CAAI,IAAA,GAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AAG1C,EAAA,IAAI,OAAO,IAAA,CAAK,eAAA,KAAoB,QAAA,IAAY,IAAA,CAAK,kBAAkB,CAAA,EAAG;AACxE,IAAA,GAAA,CAAI,WAAW,IAAA,CAAK,eAAA;AAAA,EACtB;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,IAAI,CAAA;AACxB,EAAA,IAAI,IAAA,MAAU,IAAA,GAAO,IAAA;AACrB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA;AACpC,EAAA,IAAI,GAAA,MAAS,WAAA,GAAc,GAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,MAAY,MAAA,GAAS,MAAA;AACzB,EAAA,OAAO,GAAA;AACT;AAKO,SAAS,WAAA,CAAY,SAAiB,OAAA,EAAqC;AAChF,EAAA,IAAI,MAAA,GAAS,OAAA;AACb,EAAA,IAAI,OAAA,EAAS,KAAK,MAAA,GAAS,CAAA,GAAA,EAAM,WAAW,OAAA,CAAQ,GAAG,CAAC,CAAA,IAAA,EAAO,MAAM,CAAA,CAAA;AACrE,EAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAG,CAAA,CAAE,SAAS,CAAA,EAAG;AACvD,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM;AACf,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,qCAAqC,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA,aAAA,EACtC,WAAW,MAAM,CAAA,CAAA;AAAA,SACnC;AAAA,MACF;AACA,MAAA,OAAO,UAAU,CAAC,CAAA,CAAA,EAAI,WAAW,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA,CAAA;AAAA,IAC7C,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AACZ,IAAA,MAAA,GAAS,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA;AAAA,EAChC;AACA,EAAA,IAAI,SAAS,UAAA,EAAY;AACvB,IAAA,MAAA,GAAS,CAAA,YAAA,EAAe,UAAA,CAAW,MAAM,CAAC,CAAA,mBAAA,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,cAAc,MAAA,EAA6B;AACzD,EAAA,MAAM,UAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,EAAG;AACrC,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,kDAAkD,CAAA;AACvE,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,MAAM,OAAO,CAAA,CAAE,CAAC,CAAA,CAAG,OAAA,CAAQ,WAAW,EAAE,CAAA;AACxC,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA;AAAA,MACA,MAAM,CAAA,CAAE,CAAC,EAAG,UAAA,CAAW,GAAG,IAAI,WAAA,GAAc,MAAA;AAAA,MAC5C,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,MACjB,QAAA,EAAU,IAAI,IAAA,CAAK,MAAA,CAAO,EAAE,CAAC,CAAC,IAAI,GAAI;AAAA,KACvC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,OAAA;AACT;AAEO,IAAM,kBAAkBC,uBAAA,CAAwC;AAAA,EACrE,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS;AAAA,IACP,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,OAAO,MAAA,EAAwB,OAAA,KAAmC;AACxE,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,MAAM,IAAA,GAAQ,WAAW,EAAC;AAG1B,QAAA,IAAI,KAAK,UAAA,EAAY;AACnB,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AACtD,UAAA,MAAM,SAAS,MAAM,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAC,CAAA;AAGpD,UAAA,MAAM,OAAO,gBAAA,EAAiB;AAC9B,UAAA,aAAA,CAAc,GAAA,CAAI,QAAQ,MAAM,CAAA;AAChC,UAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,OAAO,EAAA,EAAG;AAAA,QACjD;AAEA,QAAA,MAAM,KAAA,GAAQ,MAAM,YAAA,CAAa,MAAA,EAAQ,MAAM,MAAM,CAAA;AACrD,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,WAAW,MAAA,CAAO,MAAA;AACpD,QAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,aAAA,CAAc,gBAAgB,IAAA,EAAM,KAAA,EAAO,MAAM,CAAC,CAAA;AAC/E,QAAA,aAAA,CAAc,GAAA,CAAI,SAAS,MAAM,CAAA;AACjC,QAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,OAAA,CAAQ,EAAA,EAAG;AAAA,MAC1C,CAAA;AAAA,MAEA,OAAA,EAAS,OAAO,MAAA,EAAwB,SAAA,KAAsB;AAC5D,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA;AACjD,UAAA,aAAA,CAAc,GAAA,CAAI,SAAS,MAAM,CAAA;AACjC,UAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,OAAA,CAAQ,EAAA,EAAG;AAAA,QAC1C,SAAS,CAAA,EAAG;AACV,UAAA,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG,OAAO,IAAA;AAC1B,UAAA,MAAM,CAAA;AAAA,QACR;AAAA,MACF,CAAA;AAAA,MAEA,IAAA,EAAM,OAAO,MAAA,KAA2B;AACtC,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AAEnC,QAAA,MAAM,YAAY,MAAM,MAAA,CAAO,cAAc,EAAE,KAAA,EAAO,KAAK,CAAA;AAC3D,QAAA,OAAO,SAAA,CAAU,GAAA,CAAI,CAAC,OAAA,KAAY;AAChC,UAAA,aAAA,CAAc,GAAA,CAAI,SAAS,MAAM,CAAA;AACjC,UAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,OAAA,CAAQ,EAAA,EAAG;AAAA,QAC1C,CAAC,CAAA;AAAA,MACH,CAAA;AAAA,MAEA,OAAA,EAAS,OAAO,MAAA,EAAwB,SAAA,KAAsB;AAC5D,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA;AACjD,UAAA,MAAM,QAAQ,OAAA,EAAQ;AAAA,QACxB,SAAS,CAAA,EAAG;AACV,UAAA,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG;AACnB,UAAA,MAAM,CAAA;AAAA,QACR;AAAA,MACF,CAAA;AAAA,MAEA,UAAA,EAAY,OACV,OAAA,EACA,OAAA,EACA,OAAA,KAC2B;AAI3B,QAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,KAAY,MAAM,OAAA,CAAQ,WAAW,IAAA,EAAM;AAAA,UACzD,IAAA;AAAA,UACA,WAAA,CAAY,SAAS,OAAO;AAAA,SAC7B,CAAA;AACD,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,GAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA,CAAA,GAAK,MAAA,CAAO,MAAA;AACzE,QAAA,OAAO;AAAA,UACL,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,MAAA;AAAA,UACA,UAAU,MAAA,CAAO,SAAA;AAAA,UACjB,UAAA,EAAY;AAAA,SACd;AAAA,MACF,CAAA;AAAA,MAEA,OAAA,EAAS,OAAO,OAAA,KAA2C;AAGzD,QAAA,MAAM,QAAQ,OAAA,EAAQ;AACtB,QAAA,MAAM,IAAI,OAAA,CAAQ,IAAA;AAClB,QAAA,OAAO;AAAA,UACL,IAAI,CAAA,CAAE,EAAA;AAAA,UACN,QAAA,EAAU,aAAA;AAAA,UACV,MAAA,EAAQ,SAAA,CAAU,CAAA,CAAE,MAAM,CAAA;AAAA,UAC1B,SAAA,EAAW,IAAI,IAAA,CAAK,CAAA,CAAE,UAAU,CAAA;AAAA,UAChC,OAAA,EAAS,aAAA,CAAc,GAAA,CAAI,OAAO,GAAG,OAAA,IAAW,CAAA;AAAA,UAChD,QAAA,EAAU;AAAA,YACR,gBAAgB,CAAA,CAAE,MAAA;AAAA,YAClB,OAAO,CAAA,CAAE,KAAA;AAAA,YACT,QAAQ,CAAA,CAAE,MAAA;AAAA,YACV,QAAQ,CAAA,CAAE,MAAA;AAAA,YACV,IAAI,CAAA,CAAE,EAAA;AAAA,YACN,gBAAgB,CAAA,CAAE;AAAA;AACpB,SACF;AAAA,MACF,CAAA;AAAA,MAEA,MAAA,EAAQ,OAAO,OAAA,EAAkB,OAAA,KAAiD;AAChF,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAS,MAAA,GAAS,OAAA;AACtD,QAAA,OAAO,QAAQ,UAAA,CAAW,OAAA,CAAQ,IAAA,EAAM,EAAE,QAAQ,CAAA;AAAA,MACpD,CAAA;AAAA;AAAA;AAAA,MAIA,WAAA,EAAa,CAAC,OAAA,KAA8B,OAAA;AAAA,MAE5C,UAAA,EAAY;AAAA,QACV,QAAA,EAAU,OAAO,OAAA,EAAkB,IAAA,KAAkC;AACnE,UAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,KAAA,CAAM,SAAS,IAAI,CAAA;AAC7C,UAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA;AAAA,QACrC,CAAA;AAAA,QACA,SAAA,EAAW,OAAO,OAAA,EAAkB,IAAA,EAAc,OAAA,KAAmC;AACnF,UAAA,MAAM,OAAA,CAAQ,KAAA,CAAM,MAAA,CAAO,IAAA,EAAM,OAAO,CAAA;AAAA,QAC1C,CAAA;AAAA,QACA,KAAA,EAAO,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAA6C;AACzF,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,YAAY,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AAClE,UAAA,IAAI,CAAA,CAAE,QAAA,KAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,SAAA,EAAY,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,QAC3E,CAAA;AAAA,QACA,OAAA,EAAS,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAAoD;AAClG,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,2BAA2B,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AACjF,UAAA,IAAI,CAAA,CAAE,QAAA,KAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,IAAI,CAAA,SAAA,EAAY,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC3E,UAAA,OAAO,aAAA,CAAc,EAAE,MAAM,CAAA;AAAA,QAC/B,CAAA;AAAA,QACA,MAAA,EAAQ,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAAgD;AAC7F,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,WAAW,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AACjE,UAAA,OAAO,EAAE,QAAA,KAAa,CAAA;AAAA,QACxB,CAAA;AAAA,QACA,MAAA,EAAQ,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAA6C;AAC1F,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,UAAU,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AAChE,UAAA,IAAI,CAAA,CAAE,QAAA,KAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,OAAA,EAAU,IAAI,CAAA,SAAA,EAAY,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,QAC5E;AAAA;AACF,KACF;AAAA,IAEA,QAAA,EAAU;AAAA,MACR,MAAA,EAAQ,OACN,MAAA,EACA,SAAA,EACA,OAAA,KACG;AACH,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA;AAGjD,QAAA,MAAM,QAAQ,KAAA,EAAM;AAGpB,QAAA,MAAM,QAAQ,eAAA,EAAgB;AAC9B,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,SAAA;AAAA,UACJ,QAAA,EAAU,aAAA;AAAA,UACV,SAAA,sBAAe,IAAA,EAAK;AAAA,UACpB,UAAU,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,GAAG,SAAS,QAAA;AAAS,SACxD;AAAA,MACF,CAAA;AAAA,MACA,IAAA,EAAM,OAAO,MAAA,EAAwB,QAAA,KAAoC;AACvE,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AAEnC,QAAA,MAAM,MAAM,MAAM,MAAA,CAAO,cAAc,EAAE,KAAA,EAAO,KAAK,CAAA;AACrD,QAAA,OAAO,GAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UACX,IAAI,CAAA,CAAE,EAAA;AAAA,UACN,QAAA,EAAU,aAAA;AAAA,UACV,SAAA,EAAW,IAAI,IAAA,CAAK,CAAA,CAAE,KAAK,SAAA,IAAa,CAAA,CAAE,KAAK,UAAU;AAAA,SAC3D,CAAE,CAAA;AAAA,MACN,CAAA;AAAA,MACA,MAAA,EAAQ,OAAO,MAAA,EAAwB,UAAA,KAAuB;AAC5D,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA;AAClD,UAAA,MAAM,QAAQ,OAAA,EAAQ;AAAA,QACxB,SAAS,CAAA,EAAG;AACV,UAAA,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG;AACnB,UAAA,MAAM,CAAA;AAAA,QACR;AAAA,MACF;AAAA;AACF;AAEJ,CAAC","file":"index.js","sourcesContent":["/**\n * CreateOS Sandbox Provider for ComputeSDK\n *\n * VM sandboxes backed by the NodeOps createos-sandbox control plane.\n * Thin adapter over the official `@nodeops-createos/sandbox` npm package — the same\n * SDK used across the CreateOS tooling.\n *\n * Design notes:\n *  - `TSandbox` is the native `@nodeops-createos/sandbox` `Sandbox` handle, so\n *    `getInstance()` hands callers the full stateful API (pause / resume / fork /\n *    disks / networks / bandwidth) that ComputeSDK's core surface does not model.\n *    The resolving config is associated with each handle via a `WeakMap`\n *    side-channel (`sandboxConfig`), so `getInfo` can honour `config` (e.g.\n *    `timeout`) and its error policy without wrapping or mutating the handle.\n *  - createos-sandbox sizes VMs from a fixed *shape* catalog rather than free-form\n *    cpu/mem, so create() maps ComputeSDK's `cpus`/`memoryMb` onto the nearest\n *    shape and honours an explicit provider-specific `shape` override.\n *  - The control plane drops per-exec env server-side (env is sandbox-level,\n *    set at create time), so per-command `env`/`cwd` are synthesised by\n *    wrapping the command in an inline `sh -c` script.\n *  - Snapshot semantics differ from running-snapshot providers (e2b/tensorlake):\n *    `snapshot.create` *pauses* the sandbox (the source VM stops), and the\n *    paused sandbox id IS the snapshot id. `create({ snapshotId })` forks that\n *    paused bundle into a fresh sandbox.\n *\n * Error policy: provider operations fail loudly when the provider boundary is\n * broken. Only a genuine 404 (`CreateosSandboxNotFoundError`) is mapped to the\n * idempotent \"absent\" outcome (`getById` → null, `destroy`/`delete` → no-op).\n * Auth, network, validation, and server errors propagate.\n */\n\nimport { CreateosSandboxClient, CreateosSandboxNotFoundError, Sandbox } from \"@nodeops-createos/sandbox\";\nimport type {\n  CreateSandboxRequest,\n  ForkSandboxRequest,\n  SandboxStatus,\n  Shape,\n} from \"@nodeops-createos/sandbox\";\nimport { defineProvider } from \"@computesdk/provider\";\nimport type {\n  CommandResult,\n  CreateSandboxOptions,\n  CreateSnapshotOptions,\n  FileEntry,\n  ListSnapshotsOptions,\n  RunCommandOptions,\n  SandboxInfo,\n} from \"@computesdk/provider\";\n\nconst PROVIDER_NAME = \"createos-sandbox\";\n\n/** Per-sandbox config side-channel: associates the resolving config with each\n *  native handle without mutating it or wrapping `TSandbox` — so `getInstance()`\n *  still returns the bare native handle (the escape hatch other providers honour),\n *  while `getInfo` can still reach `config` (e.g. `timeout`). Keyed weakly, so an\n *  entry is collected with its sandbox. */\nconst sandboxConfig = new WeakMap<Sandbox, CreateosConfig>();\n\n/** Quote a value into one complete, self-contained shell token. Unlike the\n *  framework's `escapeShellArg` (which only neutralises metacharacters *inside*\n *  surrounding double quotes), this wraps in single quotes so the token is safe\n *  to splice unquoted — spaces, `;`, `&`, `|`, globs and the rest cannot split\n *  the command or inject syntax. Embedded single quotes are closed/escaped/reopened. */\nfunction shellQuote(arg: string): string {\n  return `'${arg.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** The framework-supplied command runner handed to filesystem callbacks. */\ntype CommandRunner = (\n  sandbox: Sandbox,\n  command: string,\n  options?: RunCommandOptions,\n) => Promise<CommandResult>;\n\n/** Memory floor (MiB) for the default shape when a create() pins no size. The\n *  control plane names no default shape and `CreateSandboxRequest` requires\n *  one, so the default is a client policy — the smallest *live* catalog shape\n *  with at least this much RAM. Override per-create with `shape`/`config.shape`. */\nconst DEFAULT_SHAPE_MIN_MIB = 1024;\n\n/** POSIX environment variable name. Keys are spliced into a shell `export`, so\n *  anything outside this grammar is rejected rather than emitted (injection). */\nconst ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nexport interface CreateosConfig {\n  /** createos-sandbox API key. Falls back to the CREATEOS_SANDBOX_API_KEY env var. */\n  apiKey?: string;\n  /** Control-plane base URL. Falls back to the CREATEOS_SANDBOX_BASE_URL env\n   *  var, then the production control plane. */\n  baseUrl?: string;\n  /** Default shape when create options pin neither `shape` nor cpus/memoryMb. */\n  shape?: string;\n  /** Default rootfs catalog name or template id. Empty = host default. */\n  rootfs?: string;\n  /** Reported `getInfo().timeout` in ms. Informational only. */\n  timeout?: number;\n}\n\n/** ComputeSDK create options plus the createos-specific fields this provider\n *  reads off the (otherwise open) options bag. Declaring them turns the cast-\n *  heavy decode into a typed contract and makes unsupported fields obvious. */\nexport interface CreateosCreateOptions extends CreateSandboxOptions {\n  /** Explicit shape id. Overrides cpus/memoryMb selection and skips the catalog fetch. */\n  shape?: string;\n  /** Rootfs catalog name or template id (alias of `runtime`). */\n  image?: string;\n  /** Rootfs catalog name or template id (alias of `image`). */\n  runtime?: string;\n  /** Requested RAM; mapped onto the smallest fitting shape. */\n  memoryMb?: number;\n  /** Requested vCPUs; mapped onto the smallest fitting shape. */\n  cpus?: number;\n  /** Overlay disk size (MiB). 0 / omitted = the shape's default disk. */\n  ephemeralDiskMb?: number;\n  /** Enable public ingress. Defaults to true. */\n  ingressEnabled?: boolean;\n  /** SSH public keys to inject at boot. */\n  sshPubkeys?: string[];\n  /** Egress allow-list. */\n  egress?: string[];\n}\n\n/** Production control-plane base URL, used when neither `config.baseUrl` nor\n *  the CREATEOS_SANDBOX_BASE_URL env var is set. */\nconst DEFAULT_BASE_URL = \"https://api.sb.createos.sh\";\n\nfunction env(key: string): string | undefined {\n  return typeof process !== \"undefined\" ? process.env?.[key] : undefined;\n}\n\nfunction resolveClient(config: CreateosConfig): CreateosSandboxClient {\n  const apiKey = config.apiKey ?? env(\"CREATEOS_SANDBOX_API_KEY\");\n  if (!apiKey) {\n    throw new Error(\n      \"Missing CreateOS API key. Provide 'apiKey' in config or set the \" +\n        \"CREATEOS_SANDBOX_API_KEY environment variable.\",\n    );\n  }\n  // Precedence: explicit config > env var > production default. A blank value\n  // is treated as unset so the next source applies.\n  const baseUrl =\n    config.baseUrl?.trim() || env(\"CREATEOS_SANDBOX_BASE_URL\")?.trim() || DEFAULT_BASE_URL;\n  return new CreateosSandboxClient({ apiKey, baseUrl });\n}\n\n/** True only for a genuine \"resource does not exist\" (404). Everything else —\n *  auth, network, validation, server, rate-limit — is a broken boundary. */\nfunction isNotFound(e: unknown): boolean {\n  return e instanceof CreateosSandboxNotFoundError;\n}\n\n/** Sort a catalog by ascending RAM then vCPU. Selection relies on this order;\n *  the control plane gives no ordering guarantee for `listShapes()`. */\nfunction sortShapes(shapes: Shape[]): Shape[] {\n  return shapes.toSorted((a, b) => a.mem_mib - b.mem_mib || a.vcpu - b.vcpu);\n}\n\n/** Pick the smallest live catalog shape that satisfies the requested cpu/mem.\n *  Returns undefined when neither is given (caller applies the default). */\nexport function pickShape(shapes: Shape[], memoryMb?: number, cpus?: number): string | undefined {\n  if (memoryMb == null && cpus == null) return undefined;\n  const sorted = sortShapes(shapes);\n  const fit = sorted.find(\n    (s) => (memoryMb == null || s.mem_mib >= memoryMb) && (cpus == null || s.vcpu >= cpus),\n  );\n  return (fit ?? sorted[sorted.length - 1])?.id;\n}\n\n/** Default shape when create() pins neither `shape` nor cpus/memoryMb: the\n *  smallest live shape meeting the RAM floor, else the smallest available. */\nexport function defaultShape(shapes: Shape[]): string | undefined {\n  const sorted = sortShapes(shapes);\n  const fit = sorted.find((s) => s.mem_mib >= DEFAULT_SHAPE_MIN_MIB);\n  return (fit ?? sorted[0])?.id;\n}\n\n/** Resolve the shape for a create() call. Fetches the live catalog only when\n *  no explicit `shape` is pinned, so the explicit path never depends on\n *  `/v1/shapes` being reachable. */\nasync function resolveShape(\n  client: CreateosSandboxClient,\n  opts: CreateosCreateOptions,\n  config: CreateosConfig,\n): Promise<string> {\n  const explicit = opts.shape ?? config.shape;\n  if (explicit) return explicit;\n  const shapes = await client.listShapes();\n  const picked = pickShape(shapes, opts.memoryMb, opts.cpus) ?? defaultShape(shapes);\n  if (!picked) {\n    throw new Error(\"CreateOS control plane returned an empty shape catalog.\");\n  }\n  return picked;\n}\n\n/** Map an createos-sandbox lifecycle state onto ComputeSDK's running|stopped|error. */\nexport function mapStatus(status: SandboxStatus): SandboxInfo[\"status\"] {\n  if (status === \"running\") return \"running\";\n  if (status === \"error\" || status === \"failed\") return \"error\";\n  return \"stopped\";\n}\n\n/** A non-empty env record from `envs` (preferred) or the legacy `env` alias. */\nfunction envsOf(opts: CreateosCreateOptions): Record<string, string> | undefined {\n  const envs = opts.envs ?? (opts as { env?: Record<string, string> }).env;\n  return envs && Object.keys(envs).length > 0 ? envs : undefined;\n}\n\n/** A string[] when the value is an array, else undefined. */\nfunction strArray(v: unknown): string[] | undefined {\n  return Array.isArray(v) ? (v as string[]) : undefined;\n}\n\n/** Pure map: ComputeSDK create options → createos-sandbox fork request body. */\nexport function toForkRequest(opts: CreateosCreateOptions): ForkSandboxRequest {\n  const req: ForkSandboxRequest = {\n    ingress_enabled: opts.ingressEnabled !== undefined ? Boolean(opts.ingressEnabled) : true,\n  };\n  const ssh = strArray(opts.sshPubkeys);\n  if (ssh) req.ssh_pubkeys = ssh;\n  const egress = strArray(opts.egress);\n  if (egress) req.egress = egress;\n  const envs = envsOf(opts);\n  if (envs) req.envs = envs;\n  return req;\n}\n\n/** Pure map: ComputeSDK create options (+ resolved shape/rootfs) → create request. */\nexport function toCreateRequest(\n  opts: CreateosCreateOptions,\n  shape: string,\n  rootfs?: string,\n): CreateSandboxRequest {\n  const req: CreateSandboxRequest = {\n    shape,\n    ingress_enabled: opts.ingressEnabled !== undefined ? Boolean(opts.ingressEnabled) : true,\n  };\n  if (rootfs) req.rootfs = rootfs;\n  if (opts.name) req.name = String(opts.name);\n  // Pass the requested overlay-disk size straight through; the control plane\n  // validates it (0 / omitted = shape default). No client-side menu.\n  if (typeof opts.ephemeralDiskMb === \"number\" && opts.ephemeralDiskMb > 0) {\n    req.disk_mib = opts.ephemeralDiskMb;\n  }\n  const envs = envsOf(opts);\n  if (envs) req.envs = envs;\n  const ssh = strArray(opts.sshPubkeys);\n  if (ssh) req.ssh_pubkeys = ssh;\n  const egress = strArray(opts.egress);\n  if (egress) req.egress = egress;\n  return req;\n}\n\n/** Wrap a command so per-call cwd/env/background work despite the server dropping\n *  exec env. Env *keys* are validated before being spliced into `export` —\n *  values are shell-quoted, but a malformed key would otherwise be raw shell. */\nexport function buildScript(command: string, options?: RunCommandOptions): string {\n  let script = command;\n  if (options?.cwd) script = `cd ${shellQuote(options.cwd)} && ${script}`;\n  if (options?.env && Object.keys(options.env).length > 0) {\n    const exports = Object.entries(options.env)\n      .map(([k, v]) => {\n        if (!ENV_KEY_RE.test(k)) {\n          throw new Error(\n            `Invalid environment variable name ${JSON.stringify(k)}: ` +\n              `must match ${ENV_KEY_RE.source}.`,\n          );\n        }\n        return `export ${k}=${shellQuote(String(v))}`;\n      })\n      .join(\"; \");\n    script = `${exports}; ${script}`;\n  }\n  if (options?.background) {\n    script = `nohup sh -c ${shellQuote(script)} > /dev/null 2>&1 &`;\n  }\n  return script;\n}\n\n/** Parse `ls -lA --time-style=+%s` output into ComputeSDK FileEntry rows. */\nexport function parseLsOutput(stdout: string): FileEntry[] {\n  const entries: FileEntry[] = [];\n  for (const line of stdout.split(\"\\n\")) {\n    if (!line || line.startsWith(\"total \")) continue;\n    const m = line.match(/^(\\S+)\\s+\\d+\\s+\\S+\\s+\\S+\\s+(\\d+)\\s+(\\d+)\\s+(.+)$/);\n    if (!m) continue;\n    const name = m[4]!.replace(/ -> .*$/, \"\"); // strip symlink target\n    entries.push({\n      name,\n      type: m[1]!.startsWith(\"d\") ? \"directory\" : \"file\",\n      size: Number(m[2]),\n      modified: new Date(Number(m[3]) * 1000),\n    });\n  }\n  return entries;\n}\n\nexport const createosSandbox = defineProvider<Sandbox, CreateosConfig>({\n  name: PROVIDER_NAME,\n  methods: {\n    sandbox: {\n      create: async (config: CreateosConfig, options?: CreateSandboxOptions) => {\n        const client = resolveClient(config);\n        const opts = (options ?? {}) as CreateosCreateOptions;\n\n        // A snapshot id is a paused sandbox: fork it into a fresh sandbox.\n        if (opts.snapshotId) {\n          const source = await client.getSandbox(opts.snapshotId);\n          const forked = await source.fork(toForkRequest(opts));\n          // Surface lifecycle failures: a fork that never reaches \"running\"\n          // (or hits a terminal state) must not be reported as success.\n          await forked.waitUntilRunning();\n          sandboxConfig.set(forked, config);\n          return { sandbox: forked, sandboxId: forked.id };\n        }\n\n        const shape = await resolveShape(client, opts, config);\n        const rootfs = opts.image ?? opts.runtime ?? config.rootfs;\n        const sandbox = await client.createSandbox(toCreateRequest(opts, shape, rootfs));\n        sandboxConfig.set(sandbox, config);\n        return { sandbox, sandboxId: sandbox.id };\n      },\n\n      getById: async (config: CreateosConfig, sandboxId: string) => {\n        const client = resolveClient(config);\n        try {\n          const sandbox = await client.getSandbox(sandboxId);\n          sandboxConfig.set(sandbox, config);\n          return { sandbox, sandboxId: sandbox.id };\n        } catch (e) {\n          if (isNotFound(e)) return null;\n          throw e;\n        }\n      },\n\n      list: async (config: CreateosConfig) => {\n        const client = resolveClient(config);\n        // No catch: a failed list is a broken boundary, not an empty account.\n        const sandboxes = await client.listSandboxes({ limit: 100 });\n        return sandboxes.map((sandbox) => {\n          sandboxConfig.set(sandbox, config);\n          return { sandbox, sandboxId: sandbox.id };\n        });\n      },\n\n      destroy: async (config: CreateosConfig, sandboxId: string) => {\n        const client = resolveClient(config);\n        try {\n          const sandbox = await client.getSandbox(sandboxId);\n          await sandbox.destroy();\n        } catch (e) {\n          if (isNotFound(e)) return; // already gone; destroy is idempotent\n          throw e;\n        }\n      },\n\n      runCommand: async (\n        sandbox: Sandbox,\n        command: string,\n        options?: RunCommandOptions,\n      ): Promise<CommandResult> => {\n        // `sh -c` (not `bash -lc`): POSIX-portable so bare rootfses without\n        // bash still run. buildScript only emits POSIX constructs. Transport /\n        // auth errors propagate; a command that ran reports its own exit code.\n        const { result, exec_ms } = await sandbox.runCommand(\"sh\", [\n          \"-c\",\n          buildScript(command, options),\n        ]);\n        const stderr = result.error ? `${result.stderr}${result.error}` : result.stderr;\n        return {\n          stdout: result.stdout,\n          stderr,\n          exitCode: result.exit_code,\n          durationMs: exec_ms,\n        };\n      },\n\n      getInfo: async (sandbox: Sandbox): Promise<SandboxInfo> => {\n        // Refresh failures propagate (no swallow): a getInfo that cannot reach\n        // the control plane must surface that rather than return stale data.\n        await sandbox.refresh();\n        const v = sandbox.data;\n        return {\n          id: v.id,\n          provider: PROVIDER_NAME,\n          status: mapStatus(v.status),\n          createdAt: new Date(v.created_at),\n          timeout: sandboxConfig.get(sandbox)?.timeout ?? 0,\n          metadata: {\n            createosStatus: v.status,\n            shape: v.shape,\n            rootfs: v.rootfs,\n            region: v.region,\n            ip: v.ip,\n            ingressEnabled: v.ingress_enabled,\n          },\n        };\n      },\n\n      getUrl: async (sandbox: Sandbox, options: { port: number; protocol?: string }) => {\n        const scheme = options.protocol === \"http\" ? \"http\" : \"https\";\n        return sandbox.previewUrl(options.port, { scheme });\n      },\n\n      // Escape hatch: the bare native @nodeops-createos/sandbox handle\n      // (pause/resume/fork/disks/...).\n      getInstance: (sandbox: Sandbox): Sandbox => sandbox,\n\n      filesystem: {\n        readFile: async (sandbox: Sandbox, path: string): Promise<string> => {\n          const buf = await sandbox.files.download(path);\n          return new TextDecoder().decode(buf);\n        },\n        writeFile: async (sandbox: Sandbox, path: string, content: string): Promise<void> => {\n          await sandbox.files.upload(path, content);\n        },\n        mkdir: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<void> => {\n          const r = await runCommand(sandbox, `mkdir -p ${shellQuote(path)}`);\n          if (r.exitCode !== 0) throw new Error(`mkdir ${path} failed: ${r.stderr}`);\n        },\n        readdir: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<FileEntry[]> => {\n          const r = await runCommand(sandbox, `ls -lA --time-style=+%s ${shellQuote(path)}`);\n          if (r.exitCode !== 0) throw new Error(`readdir ${path} failed: ${r.stderr}`);\n          return parseLsOutput(r.stdout);\n        },\n        exists: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<boolean> => {\n          const r = await runCommand(sandbox, `test -e ${shellQuote(path)}`);\n          return r.exitCode === 0;\n        },\n        remove: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<void> => {\n          const r = await runCommand(sandbox, `rm -rf ${shellQuote(path)}`);\n          if (r.exitCode !== 0) throw new Error(`remove ${path} failed: ${r.stderr}`);\n        },\n      },\n    },\n\n    snapshot: {\n      create: async (\n        config: CreateosConfig,\n        sandboxId: string,\n        options?: CreateSnapshotOptions,\n      ) => {\n        const client = resolveClient(config);\n        const sandbox = await client.getSandbox(sandboxId);\n        // createos-sandbox has no decoupled snapshot object: pausing IS the snapshot,\n        // and the paused sandbox id is the snapshot id. This stops the source VM.\n        await sandbox.pause();\n        // The success claim is \"it paused\" — surface a pause that timed out or\n        // entered a terminal state rather than returning a phantom snapshot.\n        await sandbox.waitUntilPaused();\n        return {\n          id: sandboxId,\n          provider: PROVIDER_NAME,\n          createdAt: new Date(),\n          metadata: { name: options?.name, ...options?.metadata },\n        };\n      },\n      list: async (config: CreateosConfig, _options?: ListSnapshotsOptions) => {\n        const client = resolveClient(config);\n        // The typed status filter excludes \"paused\", so list all and filter.\n        const all = await client.listSandboxes({ limit: 500 });\n        return all\n          .filter((s) => s.status === \"paused\")\n          .map((s) => ({\n            id: s.id,\n            provider: PROVIDER_NAME,\n            createdAt: new Date(s.data.paused_at ?? s.data.created_at),\n          }));\n      },\n      delete: async (config: CreateosConfig, snapshotId: string) => {\n        const client = resolveClient(config);\n        try {\n          const sandbox = await client.getSandbox(snapshotId);\n          await sandbox.destroy();\n        } catch (e) {\n          if (isNotFound(e)) return; // already gone\n          throw e;\n        }\n      },\n    },\n  },\n});\n\nexport type { Sandbox as CreateosSandbox } from \"@nodeops-createos/sandbox\";\n"]}

package/dist/index.mjs

@@ -0,0 +1,285 @@
+import { CreateosSandboxClient, CreateosSandboxNotFoundError } from '@nodeops-createos/sandbox';
+import { defineProvider } from '@computesdk/provider';
+
+// src/index.ts
+var PROVIDER_NAME = "createos-sandbox";
+var sandboxConfig = /* @__PURE__ */ new WeakMap();
+function shellQuote(arg) {
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+var DEFAULT_SHAPE_MIN_MIB = 1024;
+var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var DEFAULT_BASE_URL = "https://api.sb.createos.sh";
+function env(key) {
+  return typeof process !== "undefined" ? process.env?.[key] : void 0;
+}
+function resolveClient(config) {
+  const apiKey = config.apiKey ?? env("CREATEOS_SANDBOX_API_KEY");
+  if (!apiKey) {
+    throw new Error(
+      "Missing CreateOS API key. Provide 'apiKey' in config or set the CREATEOS_SANDBOX_API_KEY environment variable."
+    );
+  }
+  const baseUrl = config.baseUrl?.trim() || env("CREATEOS_SANDBOX_BASE_URL")?.trim() || DEFAULT_BASE_URL;
+  return new CreateosSandboxClient({ apiKey, baseUrl });
+}
+function isNotFound(e) {
+  return e instanceof CreateosSandboxNotFoundError;
+}
+function sortShapes(shapes) {
+  return shapes.toSorted((a, b) => a.mem_mib - b.mem_mib || a.vcpu - b.vcpu);
+}
+function pickShape(shapes, memoryMb, cpus) {
+  if (memoryMb == null && cpus == null) return void 0;
+  const sorted = sortShapes(shapes);
+  const fit = sorted.find(
+    (s) => (memoryMb == null || s.mem_mib >= memoryMb) && (cpus == null || s.vcpu >= cpus)
+  );
+  return (fit ?? sorted[sorted.length - 1])?.id;
+}
+function defaultShape(shapes) {
+  const sorted = sortShapes(shapes);
+  const fit = sorted.find((s) => s.mem_mib >= DEFAULT_SHAPE_MIN_MIB);
+  return (fit ?? sorted[0])?.id;
+}
+async function resolveShape(client, opts, config) {
+  const explicit = opts.shape ?? config.shape;
+  if (explicit) return explicit;
+  const shapes = await client.listShapes();
+  const picked = pickShape(shapes, opts.memoryMb, opts.cpus) ?? defaultShape(shapes);
+  if (!picked) {
+    throw new Error("CreateOS control plane returned an empty shape catalog.");
+  }
+  return picked;
+}
+function mapStatus(status) {
+  if (status === "running") return "running";
+  if (status === "error" || status === "failed") return "error";
+  return "stopped";
+}
+function envsOf(opts) {
+  const envs = opts.envs ?? opts.env;
+  return envs && Object.keys(envs).length > 0 ? envs : void 0;
+}
+function strArray(v) {
+  return Array.isArray(v) ? v : void 0;
+}
+function toForkRequest(opts) {
+  const req = {
+    ingress_enabled: opts.ingressEnabled !== void 0 ? Boolean(opts.ingressEnabled) : true
+  };
+  const ssh = strArray(opts.sshPubkeys);
+  if (ssh) req.ssh_pubkeys = ssh;
+  const egress = strArray(opts.egress);
+  if (egress) req.egress = egress;
+  const envs = envsOf(opts);
+  if (envs) req.envs = envs;
+  return req;
+}
+function toCreateRequest(opts, shape, rootfs) {
+  const req = {
+    shape,
+    ingress_enabled: opts.ingressEnabled !== void 0 ? Boolean(opts.ingressEnabled) : true
+  };
+  if (rootfs) req.rootfs = rootfs;
+  if (opts.name) req.name = String(opts.name);
+  if (typeof opts.ephemeralDiskMb === "number" && opts.ephemeralDiskMb > 0) {
+    req.disk_mib = opts.ephemeralDiskMb;
+  }
+  const envs = envsOf(opts);
+  if (envs) req.envs = envs;
+  const ssh = strArray(opts.sshPubkeys);
+  if (ssh) req.ssh_pubkeys = ssh;
+  const egress = strArray(opts.egress);
+  if (egress) req.egress = egress;
+  return req;
+}
+function buildScript(command, options) {
+  let script = command;
+  if (options?.cwd) script = `cd ${shellQuote(options.cwd)} && ${script}`;
+  if (options?.env && Object.keys(options.env).length > 0) {
+    const exports = Object.entries(options.env).map(([k, v]) => {
+      if (!ENV_KEY_RE.test(k)) {
+        throw new Error(
+          `Invalid environment variable name ${JSON.stringify(k)}: must match ${ENV_KEY_RE.source}.`
+        );
+      }
+      return `export ${k}=${shellQuote(String(v))}`;
+    }).join("; ");
+    script = `${exports}; ${script}`;
+  }
+  if (options?.background) {
+    script = `nohup sh -c ${shellQuote(script)} > /dev/null 2>&1 &`;
+  }
+  return script;
+}
+function parseLsOutput(stdout) {
+  const entries = [];
+  for (const line of stdout.split("\n")) {
+    if (!line || line.startsWith("total ")) continue;
+    const m = line.match(/^(\S+)\s+\d+\s+\S+\s+\S+\s+(\d+)\s+(\d+)\s+(.+)$/);
+    if (!m) continue;
+    const name = m[4].replace(/ -> .*$/, "");
+    entries.push({
+      name,
+      type: m[1].startsWith("d") ? "directory" : "file",
+      size: Number(m[2]),
+      modified: new Date(Number(m[3]) * 1e3)
+    });
+  }
+  return entries;
+}
+var createosSandbox = defineProvider({
+  name: PROVIDER_NAME,
+  methods: {
+    sandbox: {
+      create: async (config, options) => {
+        const client = resolveClient(config);
+        const opts = options ?? {};
+        if (opts.snapshotId) {
+          const source = await client.getSandbox(opts.snapshotId);
+          const forked = await source.fork(toForkRequest(opts));
+          await forked.waitUntilRunning();
+          sandboxConfig.set(forked, config);
+          return { sandbox: forked, sandboxId: forked.id };
+        }
+        const shape = await resolveShape(client, opts, config);
+        const rootfs = opts.image ?? opts.runtime ?? config.rootfs;
+        const sandbox = await client.createSandbox(toCreateRequest(opts, shape, rootfs));
+        sandboxConfig.set(sandbox, config);
+        return { sandbox, sandboxId: sandbox.id };
+      },
+      getById: async (config, sandboxId) => {
+        const client = resolveClient(config);
+        try {
+          const sandbox = await client.getSandbox(sandboxId);
+          sandboxConfig.set(sandbox, config);
+          return { sandbox, sandboxId: sandbox.id };
+        } catch (e) {
+          if (isNotFound(e)) return null;
+          throw e;
+        }
+      },
+      list: async (config) => {
+        const client = resolveClient(config);
+        const sandboxes = await client.listSandboxes({ limit: 100 });
+        return sandboxes.map((sandbox) => {
+          sandboxConfig.set(sandbox, config);
+          return { sandbox, sandboxId: sandbox.id };
+        });
+      },
+      destroy: async (config, sandboxId) => {
+        const client = resolveClient(config);
+        try {
+          const sandbox = await client.getSandbox(sandboxId);
+          await sandbox.destroy();
+        } catch (e) {
+          if (isNotFound(e)) return;
+          throw e;
+        }
+      },
+      runCommand: async (sandbox, command, options) => {
+        const { result, exec_ms } = await sandbox.runCommand("sh", [
+          "-c",
+          buildScript(command, options)
+        ]);
+        const stderr = result.error ? `${result.stderr}${result.error}` : result.stderr;
+        return {
+          stdout: result.stdout,
+          stderr,
+          exitCode: result.exit_code,
+          durationMs: exec_ms
+        };
+      },
+      getInfo: async (sandbox) => {
+        await sandbox.refresh();
+        const v = sandbox.data;
+        return {
+          id: v.id,
+          provider: PROVIDER_NAME,
+          status: mapStatus(v.status),
+          createdAt: new Date(v.created_at),
+          timeout: sandboxConfig.get(sandbox)?.timeout ?? 0,
+          metadata: {
+            createosStatus: v.status,
+            shape: v.shape,
+            rootfs: v.rootfs,
+            region: v.region,
+            ip: v.ip,
+            ingressEnabled: v.ingress_enabled
+          }
+        };
+      },
+      getUrl: async (sandbox, options) => {
+        const scheme = options.protocol === "http" ? "http" : "https";
+        return sandbox.previewUrl(options.port, { scheme });
+      },
+      // Escape hatch: the bare native @nodeops-createos/sandbox handle
+      // (pause/resume/fork/disks/...).
+      getInstance: (sandbox) => sandbox,
+      filesystem: {
+        readFile: async (sandbox, path) => {
+          const buf = await sandbox.files.download(path);
+          return new TextDecoder().decode(buf);
+        },
+        writeFile: async (sandbox, path, content) => {
+          await sandbox.files.upload(path, content);
+        },
+        mkdir: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `mkdir -p ${shellQuote(path)}`);
+          if (r.exitCode !== 0) throw new Error(`mkdir ${path} failed: ${r.stderr}`);
+        },
+        readdir: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `ls -lA --time-style=+%s ${shellQuote(path)}`);
+          if (r.exitCode !== 0) throw new Error(`readdir ${path} failed: ${r.stderr}`);
+          return parseLsOutput(r.stdout);
+        },
+        exists: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `test -e ${shellQuote(path)}`);
+          return r.exitCode === 0;
+        },
+        remove: async (sandbox, path, runCommand) => {
+          const r = await runCommand(sandbox, `rm -rf ${shellQuote(path)}`);
+          if (r.exitCode !== 0) throw new Error(`remove ${path} failed: ${r.stderr}`);
+        }
+      }
+    },
+    snapshot: {
+      create: async (config, sandboxId, options) => {
+        const client = resolveClient(config);
+        const sandbox = await client.getSandbox(sandboxId);
+        await sandbox.pause();
+        await sandbox.waitUntilPaused();
+        return {
+          id: sandboxId,
+          provider: PROVIDER_NAME,
+          createdAt: /* @__PURE__ */ new Date(),
+          metadata: { name: options?.name, ...options?.metadata }
+        };
+      },
+      list: async (config, _options) => {
+        const client = resolveClient(config);
+        const all = await client.listSandboxes({ limit: 500 });
+        return all.filter((s) => s.status === "paused").map((s) => ({
+          id: s.id,
+          provider: PROVIDER_NAME,
+          createdAt: new Date(s.data.paused_at ?? s.data.created_at)
+        }));
+      },
+      delete: async (config, snapshotId) => {
+        const client = resolveClient(config);
+        try {
+          const sandbox = await client.getSandbox(snapshotId);
+          await sandbox.destroy();
+        } catch (e) {
+          if (isNotFound(e)) return;
+          throw e;
+        }
+      }
+    }
+  }
+});
+
+export { buildScript, createosSandbox, defaultShape, mapStatus, parseLsOutput, pickShape, toCreateRequest, toForkRequest };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;AAiDA,IAAM,aAAA,GAAgB,kBAAA;AAOtB,IAAM,aAAA,uBAAoB,OAAA,EAAiC;AAO3D,SAAS,WAAW,GAAA,EAAqB;AACvC,EAAA,OAAO,CAAA,CAAA,EAAI,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAC,CAAA,CAAA,CAAA;AACvC;AAaA,IAAM,qBAAA,GAAwB,IAAA;AAI9B,IAAM,UAAA,GAAa,0BAAA;AA0CnB,IAAM,gBAAA,GAAmB,4BAAA;AAEzB,SAAS,IAAI,GAAA,EAAiC;AAC5C,EAAA,OAAO,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,GAAA,GAAM,GAAG,CAAA,GAAI,MAAA;AAC/D;AAEA,SAAS,cAAc,MAAA,EAA+C;AACpE,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,GAAA,CAAI,0BAA0B,CAAA;AAC9D,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GACJ,OAAO,OAAA,EAAS,IAAA,MAAU,GAAA,CAAI,2BAA2B,CAAA,EAAG,IAAA,EAAK,IAAK,gBAAA;AACxE,EAAA,OAAO,IAAI,qBAAA,CAAsB,EAAE,MAAA,EAAQ,SAAS,CAAA;AACtD;AAIA,SAAS,WAAW,CAAA,EAAqB;AACvC,EAAA,OAAO,CAAA,YAAa,4BAAA;AACtB;AAIA,SAAS,WAAW,MAAA,EAA0B;AAC5C,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,OAAA,GAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,GAAO,CAAA,CAAE,IAAI,CAAA;AAC3E;AAIO,SAAS,SAAA,CAAU,MAAA,EAAiB,QAAA,EAAmB,IAAA,EAAmC;AAC/F,EAAA,IAAI,QAAA,IAAY,IAAA,IAAQ,IAAA,IAAQ,IAAA,EAAM,OAAO,MAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,WAAW,MAAM,CAAA;AAChC,EAAA,MAAM,MAAM,MAAA,CAAO,IAAA;AAAA,IACjB,CAAC,CAAA,KAAA,CAAO,QAAA,IAAY,IAAA,IAAQ,CAAA,CAAE,WAAW,QAAA,MAAc,IAAA,IAAQ,IAAA,IAAQ,CAAA,CAAE,IAAA,IAAQ,IAAA;AAAA,GACnF;AACA,EAAA,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,MAAA,CAAO,MAAA,GAAS,CAAC,CAAA,GAAI,EAAA;AAC7C;AAIO,SAAS,aAAa,MAAA,EAAqC;AAChE,EAAA,MAAM,MAAA,GAAS,WAAW,MAAM,CAAA;AAChC,EAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,qBAAqB,CAAA;AACjE,EAAA,OAAA,CAAQ,GAAA,IAAO,MAAA,CAAO,CAAC,CAAA,GAAI,EAAA;AAC7B;AAKA,eAAe,YAAA,CACb,MAAA,EACA,IAAA,EACA,MAAA,EACiB;AACjB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,IAAS,MAAA,CAAO,KAAA;AACtC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,EAAA,MAAM,MAAA,GAAS,UAAU,MAAA,EAAQ,IAAA,CAAK,UAAU,IAAA,CAAK,IAAI,CAAA,IAAK,YAAA,CAAa,MAAM,CAAA;AACjF,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,UAAU,MAAA,EAA8C;AACtE,EAAA,IAAI,MAAA,KAAW,WAAW,OAAO,SAAA;AACjC,EAAA,IAAI,MAAA,KAAW,OAAA,IAAW,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA;AACtD,EAAA,OAAO,SAAA;AACT;AAGA,SAAS,OAAO,IAAA,EAAiE;AAC/E,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAS,IAAA,CAA0C,GAAA;AACrE,EAAA,OAAO,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,GAAS,IAAI,IAAA,GAAO,MAAA;AACvD;AAGA,SAAS,SAAS,CAAA,EAAkC;AAClD,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAK,CAAA,GAAiB,MAAA;AAC9C;AAGO,SAAS,cAAc,IAAA,EAAiD;AAC7E,EAAA,MAAM,GAAA,GAA0B;AAAA,IAC9B,iBAAiB,IAAA,CAAK,cAAA,KAAmB,SAAY,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA,GAAI;AAAA,GACtF;AACA,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA;AACpC,EAAA,IAAI,GAAA,MAAS,WAAA,GAAc,GAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,MAAY,MAAA,GAAS,MAAA;AACzB,EAAA,MAAM,IAAA,GAAO,OAAO,IAAI,CAAA;AACxB,EAAA,IAAI,IAAA,MAAU,IAAA,GAAO,IAAA;AACrB,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,eAAA,CACd,IAAA,EACA,KAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,GAAA,GAA4B;AAAA,IAChC,KAAA;AAAA,IACA,iBAAiB,IAAA,CAAK,cAAA,KAAmB,SAAY,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA,GAAI;AAAA,GACtF;AACA,EAAA,IAAI,MAAA,MAAY,MAAA,GAAS,MAAA;AACzB,EAAA,IAAI,KAAK,IAAA,EAAM,GAAA,CAAI,IAAA,GAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AAG1C,EAAA,IAAI,OAAO,IAAA,CAAK,eAAA,KAAoB,QAAA,IAAY,IAAA,CAAK,kBAAkB,CAAA,EAAG;AACxE,IAAA,GAAA,CAAI,WAAW,IAAA,CAAK,eAAA;AAAA,EACtB;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,IAAI,CAAA;AACxB,EAAA,IAAI,IAAA,MAAU,IAAA,GAAO,IAAA;AACrB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA;AACpC,EAAA,IAAI,GAAA,MAAS,WAAA,GAAc,GAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,MAAY,MAAA,GAAS,MAAA;AACzB,EAAA,OAAO,GAAA;AACT;AAKO,SAAS,WAAA,CAAY,SAAiB,OAAA,EAAqC;AAChF,EAAA,IAAI,MAAA,GAAS,OAAA;AACb,EAAA,IAAI,OAAA,EAAS,KAAK,MAAA,GAAS,CAAA,GAAA,EAAM,WAAW,OAAA,CAAQ,GAAG,CAAC,CAAA,IAAA,EAAO,MAAM,CAAA,CAAA;AACrE,EAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAG,CAAA,CAAE,SAAS,CAAA,EAAG;AACvD,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,CACvC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM;AACf,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,qCAAqC,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA,aAAA,EACtC,WAAW,MAAM,CAAA,CAAA;AAAA,SACnC;AAAA,MACF;AACA,MAAA,OAAO,UAAU,CAAC,CAAA,CAAA,EAAI,WAAW,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA,CAAA;AAAA,IAC7C,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AACZ,IAAA,MAAA,GAAS,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA;AAAA,EAChC;AACA,EAAA,IAAI,SAAS,UAAA,EAAY;AACvB,IAAA,MAAA,GAAS,CAAA,YAAA,EAAe,UAAA,CAAW,MAAM,CAAC,CAAA,mBAAA,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,cAAc,MAAA,EAA6B;AACzD,EAAA,MAAM,UAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,EAAG;AACrC,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA,EAAG;AACxC,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,kDAAkD,CAAA;AACvE,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,MAAM,OAAO,CAAA,CAAE,CAAC,CAAA,CAAG,OAAA,CAAQ,WAAW,EAAE,CAAA;AACxC,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA;AAAA,MACA,MAAM,CAAA,CAAE,CAAC,EAAG,UAAA,CAAW,GAAG,IAAI,WAAA,GAAc,MAAA;AAAA,MAC5C,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,MACjB,QAAA,EAAU,IAAI,IAAA,CAAK,MAAA,CAAO,EAAE,CAAC,CAAC,IAAI,GAAI;AAAA,KACvC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,OAAA;AACT;AAEO,IAAM,kBAAkB,cAAA,CAAwC;AAAA,EACrE,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS;AAAA,IACP,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,OAAO,MAAA,EAAwB,OAAA,KAAmC;AACxE,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,MAAM,IAAA,GAAQ,WAAW,EAAC;AAG1B,QAAA,IAAI,KAAK,UAAA,EAAY;AACnB,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AACtD,UAAA,MAAM,SAAS,MAAM,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,IAAI,CAAC,CAAA;AAGpD,UAAA,MAAM,OAAO,gBAAA,EAAiB;AAC9B,UAAA,aAAA,CAAc,GAAA,CAAI,QAAQ,MAAM,CAAA;AAChC,UAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,OAAO,EAAA,EAAG;AAAA,QACjD;AAEA,QAAA,MAAM,KAAA,GAAQ,MAAM,YAAA,CAAa,MAAA,EAAQ,MAAM,MAAM,CAAA;AACrD,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,WAAW,MAAA,CAAO,MAAA;AACpD,QAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,aAAA,CAAc,gBAAgB,IAAA,EAAM,KAAA,EAAO,MAAM,CAAC,CAAA;AAC/E,QAAA,aAAA,CAAc,GAAA,CAAI,SAAS,MAAM,CAAA;AACjC,QAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,OAAA,CAAQ,EAAA,EAAG;AAAA,MAC1C,CAAA;AAAA,MAEA,OAAA,EAAS,OAAO,MAAA,EAAwB,SAAA,KAAsB;AAC5D,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA;AACjD,UAAA,aAAA,CAAc,GAAA,CAAI,SAAS,MAAM,CAAA;AACjC,UAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,OAAA,CAAQ,EAAA,EAAG;AAAA,QAC1C,SAAS,CAAA,EAAG;AACV,UAAA,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG,OAAO,IAAA;AAC1B,UAAA,MAAM,CAAA;AAAA,QACR;AAAA,MACF,CAAA;AAAA,MAEA,IAAA,EAAM,OAAO,MAAA,KAA2B;AACtC,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AAEnC,QAAA,MAAM,YAAY,MAAM,MAAA,CAAO,cAAc,EAAE,KAAA,EAAO,KAAK,CAAA;AAC3D,QAAA,OAAO,SAAA,CAAU,GAAA,CAAI,CAAC,OAAA,KAAY;AAChC,UAAA,aAAA,CAAc,GAAA,CAAI,SAAS,MAAM,CAAA;AACjC,UAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,OAAA,CAAQ,EAAA,EAAG;AAAA,QAC1C,CAAC,CAAA;AAAA,MACH,CAAA;AAAA,MAEA,OAAA,EAAS,OAAO,MAAA,EAAwB,SAAA,KAAsB;AAC5D,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA;AACjD,UAAA,MAAM,QAAQ,OAAA,EAAQ;AAAA,QACxB,SAAS,CAAA,EAAG;AACV,UAAA,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG;AACnB,UAAA,MAAM,CAAA;AAAA,QACR;AAAA,MACF,CAAA;AAAA,MAEA,UAAA,EAAY,OACV,OAAA,EACA,OAAA,EACA,OAAA,KAC2B;AAI3B,QAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,KAAY,MAAM,OAAA,CAAQ,WAAW,IAAA,EAAM;AAAA,UACzD,IAAA;AAAA,UACA,WAAA,CAAY,SAAS,OAAO;AAAA,SAC7B,CAAA;AACD,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,GAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA,CAAA,GAAK,MAAA,CAAO,MAAA;AACzE,QAAA,OAAO;AAAA,UACL,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,MAAA;AAAA,UACA,UAAU,MAAA,CAAO,SAAA;AAAA,UACjB,UAAA,EAAY;AAAA,SACd;AAAA,MACF,CAAA;AAAA,MAEA,OAAA,EAAS,OAAO,OAAA,KAA2C;AAGzD,QAAA,MAAM,QAAQ,OAAA,EAAQ;AACtB,QAAA,MAAM,IAAI,OAAA,CAAQ,IAAA;AAClB,QAAA,OAAO;AAAA,UACL,IAAI,CAAA,CAAE,EAAA;AAAA,UACN,QAAA,EAAU,aAAA;AAAA,UACV,MAAA,EAAQ,SAAA,CAAU,CAAA,CAAE,MAAM,CAAA;AAAA,UAC1B,SAAA,EAAW,IAAI,IAAA,CAAK,CAAA,CAAE,UAAU,CAAA;AAAA,UAChC,OAAA,EAAS,aAAA,CAAc,GAAA,CAAI,OAAO,GAAG,OAAA,IAAW,CAAA;AAAA,UAChD,QAAA,EAAU;AAAA,YACR,gBAAgB,CAAA,CAAE,MAAA;AAAA,YAClB,OAAO,CAAA,CAAE,KAAA;AAAA,YACT,QAAQ,CAAA,CAAE,MAAA;AAAA,YACV,QAAQ,CAAA,CAAE,MAAA;AAAA,YACV,IAAI,CAAA,CAAE,EAAA;AAAA,YACN,gBAAgB,CAAA,CAAE;AAAA;AACpB,SACF;AAAA,MACF,CAAA;AAAA,MAEA,MAAA,EAAQ,OAAO,OAAA,EAAkB,OAAA,KAAiD;AAChF,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,QAAA,KAAa,MAAA,GAAS,MAAA,GAAS,OAAA;AACtD,QAAA,OAAO,QAAQ,UAAA,CAAW,OAAA,CAAQ,IAAA,EAAM,EAAE,QAAQ,CAAA;AAAA,MACpD,CAAA;AAAA;AAAA;AAAA,MAIA,WAAA,EAAa,CAAC,OAAA,KAA8B,OAAA;AAAA,MAE5C,UAAA,EAAY;AAAA,QACV,QAAA,EAAU,OAAO,OAAA,EAAkB,IAAA,KAAkC;AACnE,UAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,KAAA,CAAM,SAAS,IAAI,CAAA;AAC7C,UAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAA;AAAA,QACrC,CAAA;AAAA,QACA,SAAA,EAAW,OAAO,OAAA,EAAkB,IAAA,EAAc,OAAA,KAAmC;AACnF,UAAA,MAAM,OAAA,CAAQ,KAAA,CAAM,MAAA,CAAO,IAAA,EAAM,OAAO,CAAA;AAAA,QAC1C,CAAA;AAAA,QACA,KAAA,EAAO,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAA6C;AACzF,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,YAAY,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AAClE,UAAA,IAAI,CAAA,CAAE,QAAA,KAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,SAAA,EAAY,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,QAC3E,CAAA;AAAA,QACA,OAAA,EAAS,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAAoD;AAClG,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,2BAA2B,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AACjF,UAAA,IAAI,CAAA,CAAE,QAAA,KAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,IAAI,CAAA,SAAA,EAAY,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC3E,UAAA,OAAO,aAAA,CAAc,EAAE,MAAM,CAAA;AAAA,QAC/B,CAAA;AAAA,QACA,MAAA,EAAQ,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAAgD;AAC7F,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,WAAW,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AACjE,UAAA,OAAO,EAAE,QAAA,KAAa,CAAA;AAAA,QACxB,CAAA;AAAA,QACA,MAAA,EAAQ,OAAO,OAAA,EAAkB,IAAA,EAAc,UAAA,KAA6C;AAC1F,UAAA,MAAM,CAAA,GAAI,MAAM,UAAA,CAAW,OAAA,EAAS,UAAU,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,CAAA;AAChE,UAAA,IAAI,CAAA,CAAE,QAAA,KAAa,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,OAAA,EAAU,IAAI,CAAA,SAAA,EAAY,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAAA,QAC5E;AAAA;AACF,KACF;AAAA,IAEA,QAAA,EAAU;AAAA,MACR,MAAA,EAAQ,OACN,MAAA,EACA,SAAA,EACA,OAAA,KACG;AACH,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA;AAGjD,QAAA,MAAM,QAAQ,KAAA,EAAM;AAGpB,QAAA,MAAM,QAAQ,eAAA,EAAgB;AAC9B,QAAA,OAAO;AAAA,UACL,EAAA,EAAI,SAAA;AAAA,UACJ,QAAA,EAAU,aAAA;AAAA,UACV,SAAA,sBAAe,IAAA,EAAK;AAAA,UACpB,UAAU,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,GAAG,SAAS,QAAA;AAAS,SACxD;AAAA,MACF,CAAA;AAAA,MACA,IAAA,EAAM,OAAO,MAAA,EAAwB,QAAA,KAAoC;AACvE,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AAEnC,QAAA,MAAM,MAAM,MAAM,MAAA,CAAO,cAAc,EAAE,KAAA,EAAO,KAAK,CAAA;AACrD,QAAA,OAAO,GAAA,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA,CACnC,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UACX,IAAI,CAAA,CAAE,EAAA;AAAA,UACN,QAAA,EAAU,aAAA;AAAA,UACV,SAAA,EAAW,IAAI,IAAA,CAAK,CAAA,CAAE,KAAK,SAAA,IAAa,CAAA,CAAE,KAAK,UAAU;AAAA,SAC3D,CAAE,CAAA;AAAA,MACN,CAAA;AAAA,MACA,MAAA,EAAQ,OAAO,MAAA,EAAwB,UAAA,KAAuB;AAC5D,QAAA,MAAM,MAAA,GAAS,cAAc,MAAM,CAAA;AACnC,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA;AAClD,UAAA,MAAM,QAAQ,OAAA,EAAQ;AAAA,QACxB,SAAS,CAAA,EAAG;AACV,UAAA,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG;AACnB,UAAA,MAAM,CAAA;AAAA,QACR;AAAA,MACF;AAAA;AACF;AAEJ,CAAC","file":"index.mjs","sourcesContent":["/**\n * CreateOS Sandbox Provider for ComputeSDK\n *\n * VM sandboxes backed by the NodeOps createos-sandbox control plane.\n * Thin adapter over the official `@nodeops-createos/sandbox` npm package — the same\n * SDK used across the CreateOS tooling.\n *\n * Design notes:\n *  - `TSandbox` is the native `@nodeops-createos/sandbox` `Sandbox` handle, so\n *    `getInstance()` hands callers the full stateful API (pause / resume / fork /\n *    disks / networks / bandwidth) that ComputeSDK's core surface does not model.\n *    The resolving config is associated with each handle via a `WeakMap`\n *    side-channel (`sandboxConfig`), so `getInfo` can honour `config` (e.g.\n *    `timeout`) and its error policy without wrapping or mutating the handle.\n *  - createos-sandbox sizes VMs from a fixed *shape* catalog rather than free-form\n *    cpu/mem, so create() maps ComputeSDK's `cpus`/`memoryMb` onto the nearest\n *    shape and honours an explicit provider-specific `shape` override.\n *  - The control plane drops per-exec env server-side (env is sandbox-level,\n *    set at create time), so per-command `env`/`cwd` are synthesised by\n *    wrapping the command in an inline `sh -c` script.\n *  - Snapshot semantics differ from running-snapshot providers (e2b/tensorlake):\n *    `snapshot.create` *pauses* the sandbox (the source VM stops), and the\n *    paused sandbox id IS the snapshot id. `create({ snapshotId })` forks that\n *    paused bundle into a fresh sandbox.\n *\n * Error policy: provider operations fail loudly when the provider boundary is\n * broken. Only a genuine 404 (`CreateosSandboxNotFoundError`) is mapped to the\n * idempotent \"absent\" outcome (`getById` → null, `destroy`/`delete` → no-op).\n * Auth, network, validation, and server errors propagate.\n */\n\nimport { CreateosSandboxClient, CreateosSandboxNotFoundError, Sandbox } from \"@nodeops-createos/sandbox\";\nimport type {\n  CreateSandboxRequest,\n  ForkSandboxRequest,\n  SandboxStatus,\n  Shape,\n} from \"@nodeops-createos/sandbox\";\nimport { defineProvider } from \"@computesdk/provider\";\nimport type {\n  CommandResult,\n  CreateSandboxOptions,\n  CreateSnapshotOptions,\n  FileEntry,\n  ListSnapshotsOptions,\n  RunCommandOptions,\n  SandboxInfo,\n} from \"@computesdk/provider\";\n\nconst PROVIDER_NAME = \"createos-sandbox\";\n\n/** Per-sandbox config side-channel: associates the resolving config with each\n *  native handle without mutating it or wrapping `TSandbox` — so `getInstance()`\n *  still returns the bare native handle (the escape hatch other providers honour),\n *  while `getInfo` can still reach `config` (e.g. `timeout`). Keyed weakly, so an\n *  entry is collected with its sandbox. */\nconst sandboxConfig = new WeakMap<Sandbox, CreateosConfig>();\n\n/** Quote a value into one complete, self-contained shell token. Unlike the\n *  framework's `escapeShellArg` (which only neutralises metacharacters *inside*\n *  surrounding double quotes), this wraps in single quotes so the token is safe\n *  to splice unquoted — spaces, `;`, `&`, `|`, globs and the rest cannot split\n *  the command or inject syntax. Embedded single quotes are closed/escaped/reopened. */\nfunction shellQuote(arg: string): string {\n  return `'${arg.replace(/'/g, \"'\\\\''\")}'`;\n}\n\n/** The framework-supplied command runner handed to filesystem callbacks. */\ntype CommandRunner = (\n  sandbox: Sandbox,\n  command: string,\n  options?: RunCommandOptions,\n) => Promise<CommandResult>;\n\n/** Memory floor (MiB) for the default shape when a create() pins no size. The\n *  control plane names no default shape and `CreateSandboxRequest` requires\n *  one, so the default is a client policy — the smallest *live* catalog shape\n *  with at least this much RAM. Override per-create with `shape`/`config.shape`. */\nconst DEFAULT_SHAPE_MIN_MIB = 1024;\n\n/** POSIX environment variable name. Keys are spliced into a shell `export`, so\n *  anything outside this grammar is rejected rather than emitted (injection). */\nconst ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nexport interface CreateosConfig {\n  /** createos-sandbox API key. Falls back to the CREATEOS_SANDBOX_API_KEY env var. */\n  apiKey?: string;\n  /** Control-plane base URL. Falls back to the CREATEOS_SANDBOX_BASE_URL env\n   *  var, then the production control plane. */\n  baseUrl?: string;\n  /** Default shape when create options pin neither `shape` nor cpus/memoryMb. */\n  shape?: string;\n  /** Default rootfs catalog name or template id. Empty = host default. */\n  rootfs?: string;\n  /** Reported `getInfo().timeout` in ms. Informational only. */\n  timeout?: number;\n}\n\n/** ComputeSDK create options plus the createos-specific fields this provider\n *  reads off the (otherwise open) options bag. Declaring them turns the cast-\n *  heavy decode into a typed contract and makes unsupported fields obvious. */\nexport interface CreateosCreateOptions extends CreateSandboxOptions {\n  /** Explicit shape id. Overrides cpus/memoryMb selection and skips the catalog fetch. */\n  shape?: string;\n  /** Rootfs catalog name or template id (alias of `runtime`). */\n  image?: string;\n  /** Rootfs catalog name or template id (alias of `image`). */\n  runtime?: string;\n  /** Requested RAM; mapped onto the smallest fitting shape. */\n  memoryMb?: number;\n  /** Requested vCPUs; mapped onto the smallest fitting shape. */\n  cpus?: number;\n  /** Overlay disk size (MiB). 0 / omitted = the shape's default disk. */\n  ephemeralDiskMb?: number;\n  /** Enable public ingress. Defaults to true. */\n  ingressEnabled?: boolean;\n  /** SSH public keys to inject at boot. */\n  sshPubkeys?: string[];\n  /** Egress allow-list. */\n  egress?: string[];\n}\n\n/** Production control-plane base URL, used when neither `config.baseUrl` nor\n *  the CREATEOS_SANDBOX_BASE_URL env var is set. */\nconst DEFAULT_BASE_URL = \"https://api.sb.createos.sh\";\n\nfunction env(key: string): string | undefined {\n  return typeof process !== \"undefined\" ? process.env?.[key] : undefined;\n}\n\nfunction resolveClient(config: CreateosConfig): CreateosSandboxClient {\n  const apiKey = config.apiKey ?? env(\"CREATEOS_SANDBOX_API_KEY\");\n  if (!apiKey) {\n    throw new Error(\n      \"Missing CreateOS API key. Provide 'apiKey' in config or set the \" +\n        \"CREATEOS_SANDBOX_API_KEY environment variable.\",\n    );\n  }\n  // Precedence: explicit config > env var > production default. A blank value\n  // is treated as unset so the next source applies.\n  const baseUrl =\n    config.baseUrl?.trim() || env(\"CREATEOS_SANDBOX_BASE_URL\")?.trim() || DEFAULT_BASE_URL;\n  return new CreateosSandboxClient({ apiKey, baseUrl });\n}\n\n/** True only for a genuine \"resource does not exist\" (404). Everything else —\n *  auth, network, validation, server, rate-limit — is a broken boundary. */\nfunction isNotFound(e: unknown): boolean {\n  return e instanceof CreateosSandboxNotFoundError;\n}\n\n/** Sort a catalog by ascending RAM then vCPU. Selection relies on this order;\n *  the control plane gives no ordering guarantee for `listShapes()`. */\nfunction sortShapes(shapes: Shape[]): Shape[] {\n  return shapes.toSorted((a, b) => a.mem_mib - b.mem_mib || a.vcpu - b.vcpu);\n}\n\n/** Pick the smallest live catalog shape that satisfies the requested cpu/mem.\n *  Returns undefined when neither is given (caller applies the default). */\nexport function pickShape(shapes: Shape[], memoryMb?: number, cpus?: number): string | undefined {\n  if (memoryMb == null && cpus == null) return undefined;\n  const sorted = sortShapes(shapes);\n  const fit = sorted.find(\n    (s) => (memoryMb == null || s.mem_mib >= memoryMb) && (cpus == null || s.vcpu >= cpus),\n  );\n  return (fit ?? sorted[sorted.length - 1])?.id;\n}\n\n/** Default shape when create() pins neither `shape` nor cpus/memoryMb: the\n *  smallest live shape meeting the RAM floor, else the smallest available. */\nexport function defaultShape(shapes: Shape[]): string | undefined {\n  const sorted = sortShapes(shapes);\n  const fit = sorted.find((s) => s.mem_mib >= DEFAULT_SHAPE_MIN_MIB);\n  return (fit ?? sorted[0])?.id;\n}\n\n/** Resolve the shape for a create() call. Fetches the live catalog only when\n *  no explicit `shape` is pinned, so the explicit path never depends on\n *  `/v1/shapes` being reachable. */\nasync function resolveShape(\n  client: CreateosSandboxClient,\n  opts: CreateosCreateOptions,\n  config: CreateosConfig,\n): Promise<string> {\n  const explicit = opts.shape ?? config.shape;\n  if (explicit) return explicit;\n  const shapes = await client.listShapes();\n  const picked = pickShape(shapes, opts.memoryMb, opts.cpus) ?? defaultShape(shapes);\n  if (!picked) {\n    throw new Error(\"CreateOS control plane returned an empty shape catalog.\");\n  }\n  return picked;\n}\n\n/** Map an createos-sandbox lifecycle state onto ComputeSDK's running|stopped|error. */\nexport function mapStatus(status: SandboxStatus): SandboxInfo[\"status\"] {\n  if (status === \"running\") return \"running\";\n  if (status === \"error\" || status === \"failed\") return \"error\";\n  return \"stopped\";\n}\n\n/** A non-empty env record from `envs` (preferred) or the legacy `env` alias. */\nfunction envsOf(opts: CreateosCreateOptions): Record<string, string> | undefined {\n  const envs = opts.envs ?? (opts as { env?: Record<string, string> }).env;\n  return envs && Object.keys(envs).length > 0 ? envs : undefined;\n}\n\n/** A string[] when the value is an array, else undefined. */\nfunction strArray(v: unknown): string[] | undefined {\n  return Array.isArray(v) ? (v as string[]) : undefined;\n}\n\n/** Pure map: ComputeSDK create options → createos-sandbox fork request body. */\nexport function toForkRequest(opts: CreateosCreateOptions): ForkSandboxRequest {\n  const req: ForkSandboxRequest = {\n    ingress_enabled: opts.ingressEnabled !== undefined ? Boolean(opts.ingressEnabled) : true,\n  };\n  const ssh = strArray(opts.sshPubkeys);\n  if (ssh) req.ssh_pubkeys = ssh;\n  const egress = strArray(opts.egress);\n  if (egress) req.egress = egress;\n  const envs = envsOf(opts);\n  if (envs) req.envs = envs;\n  return req;\n}\n\n/** Pure map: ComputeSDK create options (+ resolved shape/rootfs) → create request. */\nexport function toCreateRequest(\n  opts: CreateosCreateOptions,\n  shape: string,\n  rootfs?: string,\n): CreateSandboxRequest {\n  const req: CreateSandboxRequest = {\n    shape,\n    ingress_enabled: opts.ingressEnabled !== undefined ? Boolean(opts.ingressEnabled) : true,\n  };\n  if (rootfs) req.rootfs = rootfs;\n  if (opts.name) req.name = String(opts.name);\n  // Pass the requested overlay-disk size straight through; the control plane\n  // validates it (0 / omitted = shape default). No client-side menu.\n  if (typeof opts.ephemeralDiskMb === \"number\" && opts.ephemeralDiskMb > 0) {\n    req.disk_mib = opts.ephemeralDiskMb;\n  }\n  const envs = envsOf(opts);\n  if (envs) req.envs = envs;\n  const ssh = strArray(opts.sshPubkeys);\n  if (ssh) req.ssh_pubkeys = ssh;\n  const egress = strArray(opts.egress);\n  if (egress) req.egress = egress;\n  return req;\n}\n\n/** Wrap a command so per-call cwd/env/background work despite the server dropping\n *  exec env. Env *keys* are validated before being spliced into `export` —\n *  values are shell-quoted, but a malformed key would otherwise be raw shell. */\nexport function buildScript(command: string, options?: RunCommandOptions): string {\n  let script = command;\n  if (options?.cwd) script = `cd ${shellQuote(options.cwd)} && ${script}`;\n  if (options?.env && Object.keys(options.env).length > 0) {\n    const exports = Object.entries(options.env)\n      .map(([k, v]) => {\n        if (!ENV_KEY_RE.test(k)) {\n          throw new Error(\n            `Invalid environment variable name ${JSON.stringify(k)}: ` +\n              `must match ${ENV_KEY_RE.source}.`,\n          );\n        }\n        return `export ${k}=${shellQuote(String(v))}`;\n      })\n      .join(\"; \");\n    script = `${exports}; ${script}`;\n  }\n  if (options?.background) {\n    script = `nohup sh -c ${shellQuote(script)} > /dev/null 2>&1 &`;\n  }\n  return script;\n}\n\n/** Parse `ls -lA --time-style=+%s` output into ComputeSDK FileEntry rows. */\nexport function parseLsOutput(stdout: string): FileEntry[] {\n  const entries: FileEntry[] = [];\n  for (const line of stdout.split(\"\\n\")) {\n    if (!line || line.startsWith(\"total \")) continue;\n    const m = line.match(/^(\\S+)\\s+\\d+\\s+\\S+\\s+\\S+\\s+(\\d+)\\s+(\\d+)\\s+(.+)$/);\n    if (!m) continue;\n    const name = m[4]!.replace(/ -> .*$/, \"\"); // strip symlink target\n    entries.push({\n      name,\n      type: m[1]!.startsWith(\"d\") ? \"directory\" : \"file\",\n      size: Number(m[2]),\n      modified: new Date(Number(m[3]) * 1000),\n    });\n  }\n  return entries;\n}\n\nexport const createosSandbox = defineProvider<Sandbox, CreateosConfig>({\n  name: PROVIDER_NAME,\n  methods: {\n    sandbox: {\n      create: async (config: CreateosConfig, options?: CreateSandboxOptions) => {\n        const client = resolveClient(config);\n        const opts = (options ?? {}) as CreateosCreateOptions;\n\n        // A snapshot id is a paused sandbox: fork it into a fresh sandbox.\n        if (opts.snapshotId) {\n          const source = await client.getSandbox(opts.snapshotId);\n          const forked = await source.fork(toForkRequest(opts));\n          // Surface lifecycle failures: a fork that never reaches \"running\"\n          // (or hits a terminal state) must not be reported as success.\n          await forked.waitUntilRunning();\n          sandboxConfig.set(forked, config);\n          return { sandbox: forked, sandboxId: forked.id };\n        }\n\n        const shape = await resolveShape(client, opts, config);\n        const rootfs = opts.image ?? opts.runtime ?? config.rootfs;\n        const sandbox = await client.createSandbox(toCreateRequest(opts, shape, rootfs));\n        sandboxConfig.set(sandbox, config);\n        return { sandbox, sandboxId: sandbox.id };\n      },\n\n      getById: async (config: CreateosConfig, sandboxId: string) => {\n        const client = resolveClient(config);\n        try {\n          const sandbox = await client.getSandbox(sandboxId);\n          sandboxConfig.set(sandbox, config);\n          return { sandbox, sandboxId: sandbox.id };\n        } catch (e) {\n          if (isNotFound(e)) return null;\n          throw e;\n        }\n      },\n\n      list: async (config: CreateosConfig) => {\n        const client = resolveClient(config);\n        // No catch: a failed list is a broken boundary, not an empty account.\n        const sandboxes = await client.listSandboxes({ limit: 100 });\n        return sandboxes.map((sandbox) => {\n          sandboxConfig.set(sandbox, config);\n          return { sandbox, sandboxId: sandbox.id };\n        });\n      },\n\n      destroy: async (config: CreateosConfig, sandboxId: string) => {\n        const client = resolveClient(config);\n        try {\n          const sandbox = await client.getSandbox(sandboxId);\n          await sandbox.destroy();\n        } catch (e) {\n          if (isNotFound(e)) return; // already gone; destroy is idempotent\n          throw e;\n        }\n      },\n\n      runCommand: async (\n        sandbox: Sandbox,\n        command: string,\n        options?: RunCommandOptions,\n      ): Promise<CommandResult> => {\n        // `sh -c` (not `bash -lc`): POSIX-portable so bare rootfses without\n        // bash still run. buildScript only emits POSIX constructs. Transport /\n        // auth errors propagate; a command that ran reports its own exit code.\n        const { result, exec_ms } = await sandbox.runCommand(\"sh\", [\n          \"-c\",\n          buildScript(command, options),\n        ]);\n        const stderr = result.error ? `${result.stderr}${result.error}` : result.stderr;\n        return {\n          stdout: result.stdout,\n          stderr,\n          exitCode: result.exit_code,\n          durationMs: exec_ms,\n        };\n      },\n\n      getInfo: async (sandbox: Sandbox): Promise<SandboxInfo> => {\n        // Refresh failures propagate (no swallow): a getInfo that cannot reach\n        // the control plane must surface that rather than return stale data.\n        await sandbox.refresh();\n        const v = sandbox.data;\n        return {\n          id: v.id,\n          provider: PROVIDER_NAME,\n          status: mapStatus(v.status),\n          createdAt: new Date(v.created_at),\n          timeout: sandboxConfig.get(sandbox)?.timeout ?? 0,\n          metadata: {\n            createosStatus: v.status,\n            shape: v.shape,\n            rootfs: v.rootfs,\n            region: v.region,\n            ip: v.ip,\n            ingressEnabled: v.ingress_enabled,\n          },\n        };\n      },\n\n      getUrl: async (sandbox: Sandbox, options: { port: number; protocol?: string }) => {\n        const scheme = options.protocol === \"http\" ? \"http\" : \"https\";\n        return sandbox.previewUrl(options.port, { scheme });\n      },\n\n      // Escape hatch: the bare native @nodeops-createos/sandbox handle\n      // (pause/resume/fork/disks/...).\n      getInstance: (sandbox: Sandbox): Sandbox => sandbox,\n\n      filesystem: {\n        readFile: async (sandbox: Sandbox, path: string): Promise<string> => {\n          const buf = await sandbox.files.download(path);\n          return new TextDecoder().decode(buf);\n        },\n        writeFile: async (sandbox: Sandbox, path: string, content: string): Promise<void> => {\n          await sandbox.files.upload(path, content);\n        },\n        mkdir: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<void> => {\n          const r = await runCommand(sandbox, `mkdir -p ${shellQuote(path)}`);\n          if (r.exitCode !== 0) throw new Error(`mkdir ${path} failed: ${r.stderr}`);\n        },\n        readdir: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<FileEntry[]> => {\n          const r = await runCommand(sandbox, `ls -lA --time-style=+%s ${shellQuote(path)}`);\n          if (r.exitCode !== 0) throw new Error(`readdir ${path} failed: ${r.stderr}`);\n          return parseLsOutput(r.stdout);\n        },\n        exists: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<boolean> => {\n          const r = await runCommand(sandbox, `test -e ${shellQuote(path)}`);\n          return r.exitCode === 0;\n        },\n        remove: async (sandbox: Sandbox, path: string, runCommand: CommandRunner): Promise<void> => {\n          const r = await runCommand(sandbox, `rm -rf ${shellQuote(path)}`);\n          if (r.exitCode !== 0) throw new Error(`remove ${path} failed: ${r.stderr}`);\n        },\n      },\n    },\n\n    snapshot: {\n      create: async (\n        config: CreateosConfig,\n        sandboxId: string,\n        options?: CreateSnapshotOptions,\n      ) => {\n        const client = resolveClient(config);\n        const sandbox = await client.getSandbox(sandboxId);\n        // createos-sandbox has no decoupled snapshot object: pausing IS the snapshot,\n        // and the paused sandbox id is the snapshot id. This stops the source VM.\n        await sandbox.pause();\n        // The success claim is \"it paused\" — surface a pause that timed out or\n        // entered a terminal state rather than returning a phantom snapshot.\n        await sandbox.waitUntilPaused();\n        return {\n          id: sandboxId,\n          provider: PROVIDER_NAME,\n          createdAt: new Date(),\n          metadata: { name: options?.name, ...options?.metadata },\n        };\n      },\n      list: async (config: CreateosConfig, _options?: ListSnapshotsOptions) => {\n        const client = resolveClient(config);\n        // The typed status filter excludes \"paused\", so list all and filter.\n        const all = await client.listSandboxes({ limit: 500 });\n        return all\n          .filter((s) => s.status === \"paused\")\n          .map((s) => ({\n            id: s.id,\n            provider: PROVIDER_NAME,\n            createdAt: new Date(s.data.paused_at ?? s.data.created_at),\n          }));\n      },\n      delete: async (config: CreateosConfig, snapshotId: string) => {\n        const client = resolveClient(config);\n        try {\n          const sandbox = await client.getSandbox(snapshotId);\n          await sandbox.destroy();\n        } catch (e) {\n          if (isNotFound(e)) return; // already gone\n          throw e;\n        }\n      },\n    },\n  },\n});\n\nexport type { Sandbox as CreateosSandbox } from \"@nodeops-createos/sandbox\";\n"]}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@computesdk/createos-sandbox",
+  "version": "0.1.1",
+  "description": "CreateOS provider for ComputeSDK — NodeOps VM sandboxes with pause/resume/fork snapshots",
+  "author": "NodeOps Inc.",
+  "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@nodeops-createos/sandbox": "^0.6.0",
+    "@computesdk/provider": "2.1.3"
+  },
+  "keywords": [
+    "code-execution",
+    "computesdk",
+    "createos",
+    "createos-sandbox",
+    "nodeops",
+    "provider",
+    "sandbox",
+    "snapshot"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/computesdk/computesdk.git",
+    "directory": "packages/createos-sandbox"
+  },
+  "homepage": "https://www.computesdk.com",
+  "bugs": {
+    "url": "https://github.com/computesdk/computesdk/issues"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@vitest/coverage-v8": "^1.0.0",
+    "eslint": "^8.37.0",
+    "rimraf": "^5.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^1.0.0",
+    "@computesdk/test-utils": "2.0.0",
+    "computesdk": "4.1.3"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rimraf dist",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint"
+  }
+}