@effect-uai/deno 0.12.0 → 0.13.0

package/dist/DenoSandbox.d.mts

@@ -3,8 +3,6 @@ import { BoundSecret, CommonCreateRequest, Sandbox, SandboxHostnameAllowlist, Sa
 import * as SandboxError from "@effect-uai/core/SandboxError";
 import { Context, Effect, Layer, Redacted, Scope } from "effect";
 import { ApiError, ConnectionClosedError, ConnectionEstablishmentError, InvalidMemoryError, InvalidTimeoutError, InvalidTokenError, MissingTokenError, SandboxCommandError, SandboxKillError } from "@deno/sandbox";
-
-//#region src/DenoSandbox.d.ts
 declare namespace DenoSandbox_d_exports {
   export { ApiError, ConnectionClosedError, ConnectionEstablishmentError, DenoRegion, DenoSandbox, DenoSandboxBoundSecret, DenoSandboxConfig, DenoSandboxCreateRequest, DenoSandboxService, InvalidMemoryError, InvalidTimeoutError, InvalidTokenError, MissingTokenError, SandboxCommandError, SandboxKillError, layer };
 }
@@ -19,13 +17,18 @@ type DenoSandboxCreateRequest = Omit<CommonCreateRequest, "secrets"> & {
    * range at GA is 768 MiB – 4 GiB (default 1280 MiB).
    */
   readonly memory?: Memory.Input;
-  readonly labels?: Readonly<Record<string, string>>; /** Auto-expose this port at boot; the live sandbox's `url` reaches it. */
+  readonly labels?: Readonly<Record<string, string>>;
+  /** Auto-expose this port at boot; the live sandbox's `url` reaches it. */
   readonly port?: number;
 };
 type DenoSandboxConfig = {
-  /** Overrides `DENO_DEPLOY_TOKEN`. */readonly token?: Redacted.Redacted<string>; /** Overrides `DENO_DEPLOY_ORG`. Required for personal `ddp_` tokens. */
-  readonly org?: string; /** Overrides `DENO_DEPLOY_ENDPOINT`. */
-  readonly apiEndpoint?: string; /** Default region when create requests omit one. */
+  /** Overrides `DENO_DEPLOY_TOKEN`. */
+  readonly token?: Redacted.Redacted<string>;
+  /** Overrides `DENO_DEPLOY_ORG`. Required for personal `ddp_` tokens. */
+  readonly org?: string;
+  /** Overrides `DENO_DEPLOY_ENDPOINT`. */
+  readonly apiEndpoint?: string;
+  /** Default region when create requests omit one. */
   readonly defaultRegion?: DenoRegion;
 };
 /**
@@ -70,7 +73,7 @@ declare class DenoSandbox extends DenoSandbox_base {}
  * - `SandboxPauseResume` — Deno doesn't offer in-place memory-preserving pause.
  * - `SandboxKernelSession`, `SandboxPty` — no Jupyter / no PTY.
  */
-declare const layer: (config?: DenoSandboxConfig) => Layer.Layer<DenoSandbox | Sandbox | SandboxHostnameAllowlist | SandboxSecretInjection | SandboxSnapshots | SandboxVolumes | SandboxPortExposure, never, never>;
+declare const layer: (config?: DenoSandboxConfig) => Layer.Layer<DenoSandbox | Sandbox | SandboxHostnameAllowlist | SandboxPortExposure | SandboxSecretInjection | SandboxSnapshots | SandboxVolumes, never, never>;
 //#endregion
 export { ApiError, ConnectionClosedError, ConnectionEstablishmentError, DenoRegion, DenoSandbox, DenoSandboxBoundSecret, DenoSandboxConfig, DenoSandboxCreateRequest, DenoSandboxService, InvalidMemoryError, InvalidTimeoutError, InvalidTokenError, MissingTokenError, SandboxCommandError, SandboxKillError, layer, DenoSandbox_d_exports as t };
 //# sourceMappingURL=DenoSandbox.d.mts.map

package/dist/DenoSandbox.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"DenoSandbox.d.mts","names":[],"sources":["../src/DenoSandbox.ts"],"mappings":";;;;;;;;;;KAoEY,sBAAA,GAAyB,IAAA,CAAK,WAAA;AAAA,KAE9B,UAAA;AAAA,KAEA,wBAAA,GAA2B,IAAA,CAAK,mBAAA;EAAA,SACjC,OAAA,GAAU,aAAA,CAAc,sBAAA;EAAA,SACxB,MAAA,GAAS,UAAA;;;;;;WAMT,MAAA,GAAS,MAAA,CAAO,KAAA;EAAA,SAChB,MAAA,GAAS,QAAA,CAAS,MAAA;WAElB,IAAA;AAAA;AAAA,KAGC,iBAAA;gDAED,KAAA,GAAQ,QAAA,CAAS,QAAA;WAEjB,GAAA;WAEA,WAAA,WAxBuB;EAAA,SA0BvB,aAAA,GAAgB,UAAA;AAAA;;AAxB3B;;;;;AAEA;;;KAkCY,kBAAA,GAAqB,IAAA,CAAK,cAAA;EAAA,SAC3B,MAAA,GACP,OAAA,EAAS,wBAAA,KACN,MAAA,CAAO,MAAA,CAAO,eAAA,EAAiB,YAAA,CAAa,YAAA,EAAc,KAAA,CAAM,KAAA;EApCpC;;;;;;EAAA,SA2CxB,cAAA,GACP,QAAA,EAAU,QAAA,EACV,IAAA,cACG,MAAA,CAAO,MAAA,CAAO,UAAA,EAAY,YAAA,CAAa,YAAA;AAAA;AAAA,cAC7C,gBAAA;cAEY,WAAA,SAAoB,gBAAA;;;;;;;;;;;;;;AApCjC;;;;;;;;cAyzBa,KAAA,GAAS,MAAA,GAAQ,iBAAA,KAAsB,KAAA,CAAA,KAAA,CAAA,WAAA,GAAA,OAAA,GAAA,wBAAA,GAAA,sBAAA,GAAA,gBAAA,GAAA,cAAA,GAAA,mBAAA"}
+{"version":3,"file":"DenoSandbox.d.mts","names":[],"sources":["../src/DenoSandbox.ts"],"mappings":";;;;;;;;KAoEY,yBAAyB,KAAK;KAE9B;KAEA,2BAA2B,KAAK;WACjC,UAAU,cAAc;WACxB,SAAS;;;;;;WAMT,SAAS,OAAO;WAChB,SAAS,SAAS;;WAElB;;KAGC;;WAED,QAAQ,SAAS;;WAEjB;;WAEA;;WAEA,gBAAgB;;;;;;;;;;;KAYf,qBAAqB,KAAK;WAC3B,SACP,SAAS,6BACN,OAAO,OAAO,iBAAiB,aAAa,cAAc,MAAM;;;;;;;WAO5D,iBACP,UAAU,UACV,kBACG,OAAO,OAAO,YAAY,aAAa;;;cAGjC,oBAAoB;;;;;;;;;;;;;;;;;;;;;;cAywBpB,QAAK,SAAY,sBAAiB,MAAA,MAAA,cAAA,UAAA,2BAAA,sBAAA,yBAAA,mBAAA"}

package/dist/DenoSandbox.mjs

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./chunk-CfYAbeIz.mjs";
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import * as Memory from "@effect-uai/core/Memory";
 import { ExecEvent, Sandbox, SandboxHostnameAllowlist, SandboxId, SandboxPortExposure, SandboxSecretInjection, SandboxSnapshots, SandboxVolumes, SnapshotId, VolumeId } from "@effect-uai/core/Sandbox";
 import * as SandboxError from "@effect-uai/core/SandboxError";
@@ -119,13 +119,14 @@ const volumesStep = (volumes) => {
 	return Effect.succeed(set("volumes", map));
 };
 const secretsStep = (secrets) => {
-	return set("secrets", Array.reduce(secrets, {}, (acc, s) => {
+	const record = Array.reduce(secrets, {}, (acc, s) => {
 		acc[s.name] = {
 			hosts: [...s.hosts],
 			value: Redacted.value(s.value)
 		};
 		return acc;
-	}));
+	});
+	return set("secrets", record);
 };
 const baseClientOptions = (config) => ({
 	...config.token === void 0 ? {} : { token: Redacted.value(config.token) },
@@ -223,8 +224,10 @@ const adaptInstance = (sdk, portRegistry) => {
 			}),
 			catch: mapExecError
 		})), (c) => Effect.promise(() => c.kill("SIGKILL").catch(() => void 0)).pipe(Effect.ignore));
-		if (request.stdin !== void 0) if (stdinIsStream(request.stdin)) yield* Effect.forkScoped(feedStreamStdin(child, request.stdin));
-		else yield* writeStdinBytes(child, toBytes(request.stdin));
+		if (request.stdin !== void 0) {
+			if (stdinIsStream(request.stdin)) yield* Effect.forkScoped(feedStreamStdin(child, request.stdin));
+			else yield* writeStdinBytes(child, toBytes(request.stdin));
+		}
 		return {
 			child,
 			startedAt
@@ -341,10 +344,11 @@ const buildService = (config) => {
 		destroy: destroyById,
 		snapshotVolume: (volumeId, slug) => Effect.gen(function* () {
 			const snapSlug = slug ?? `eff-uai-snap-${yield* randomToken}`;
-			return SnapshotId((yield* Effect.tryPromise({
+			const snap = yield* Effect.tryPromise({
 				try: () => client.volumes.snapshot(volumeId, { slug: snapSlug }),
 				catch: mapCreateError
-			})).slug);
+			});
+			return SnapshotId(snap.slug);
 		}),
 		snapshots: {
 			create: () => Effect.fail(new SandboxError.SandboxUnsupported({

package/dist/DenoSandbox.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"DenoSandbox.mjs","names":["Arr","CoreExecEvent","DenoSdkSandbox","CoreSandbox"],"sources":["../src/DenoSandbox.ts"],"sourcesContent":["import * as Memory from \"@effect-uai/core/Memory\"\nimport {\n  ExecEvent as CoreExecEvent,\n  Sandbox as CoreSandbox,\n  SandboxHostnameAllowlist,\n  SandboxPortExposure,\n  SandboxSecretInjection,\n  SandboxSnapshots,\n  SandboxVolumes,\n  type BoundSecret,\n  type CommonCreateRequest,\n  type CommonExecRequest,\n  type CommonSpawnRequest,\n  type ExecResult,\n  type ImageRef,\n  type NetworkPolicy,\n  type ProcessHandle,\n  SandboxId,\n  type SandboxInstance,\n  type SandboxRef,\n  type SandboxService,\n  SnapshotId,\n  VolumeId,\n} from \"@effect-uai/core/Sandbox\"\nimport * as SandboxError from \"@effect-uai/core/SandboxError\"\nimport {\n  Array as Arr,\n  Clock,\n  Context,\n  Duration,\n  Effect,\n  Layer,\n  Match,\n  Option,\n  Random,\n  Redacted,\n  Schedule,\n  Scope,\n  Stream,\n} from \"effect\"\nimport {\n  ApiError,\n  Client,\n  ConnectionClosedError,\n  ConnectionEstablishmentError,\n  InvalidMemoryError,\n  InvalidTimeoutError,\n  InvalidTokenError,\n  MissingTokenError,\n  Sandbox as DenoSdkSandbox,\n  SandboxCommandError,\n  SandboxKillError,\n  type ChildProcess as DenoChildProcess,\n  type SandboxOptions,\n  type SecretConfig,\n} from \"@deno/sandbox\"\n\nconst PROVIDER = \"deno\"\n\n// ---------------------------------------------------------------------------\n// Provider-narrowed request types.\n//\n// Deno's `secrets: Record<name, SecretConfig>` shape has no per-secret\n// custom header — substitution is always \"Authorization: Bearer <value>\".\n// We omit `header` on the typed surface (row B) and reject at the upcast\n// adapter (row D) if a caller routes through the generic `Sandbox.create`.\n// ---------------------------------------------------------------------------\n\nexport type DenoSandboxBoundSecret = Omit<BoundSecret, \"header\">\n\nexport type DenoRegion = \"ord\" | \"ams\"\n\nexport type DenoSandboxCreateRequest = Omit<CommonCreateRequest, \"secrets\"> & {\n  readonly secrets?: ReadonlyArray<DenoSandboxBoundSecret>\n  readonly region?: DenoRegion\n  /**\n   * Memory size for the sandbox. Accepts a byte count, a {@link Memory.Memory},\n   * or a human string like `\"1280 MiB\"` / `\"1 GiB\"`. Deno's accepted\n   * range at GA is 768 MiB – 4 GiB (default 1280 MiB).\n   */\n  readonly memory?: Memory.Input\n  readonly labels?: Readonly<Record<string, string>>\n  /** Auto-expose this port at boot; the live sandbox's `url` reaches it. */\n  readonly port?: number\n}\n\nexport type DenoSandboxConfig = {\n  /** Overrides `DENO_DEPLOY_TOKEN`. */\n  readonly token?: Redacted.Redacted<string>\n  /** Overrides `DENO_DEPLOY_ORG`. Required for personal `ddp_` tokens. */\n  readonly org?: string\n  /** Overrides `DENO_DEPLOY_ENDPOINT`. */\n  readonly apiEndpoint?: string\n  /** Default region when create requests omit one. */\n  readonly defaultRegion?: DenoRegion\n}\n\n/**\n * Deno-narrowed service. `create` accepts the narrowed\n * {@link DenoSandboxCreateRequest}; every other method is identical to\n * the generic {@link SandboxService} except for the per-provider\n * `snapshotVolume` escape hatch — Deno snapshots are derived from\n * volumes, not from live sandboxes, so the generic\n * `Sandbox.snapshots.create(fromInstance)` doesn't fit and fails with\n * `SandboxUnsupported`.\n */\nexport type DenoSandboxService = Omit<SandboxService, \"create\"> & {\n  readonly create: (\n    request: DenoSandboxCreateRequest,\n  ) => Effect.Effect<SandboxInstance, SandboxError.SandboxError, Scope.Scope>\n  /**\n   * Snapshot an existing volume by id/slug. Deno's snapshot model is\n   * volume-derived, so the generic `Sandbox.snapshots.create` doesn't\n   * apply — use this escape hatch instead. The volume must not be\n   * attached to any running sandbox at the time of snapshot.\n   */\n  readonly snapshotVolume: (\n    volumeId: VolumeId,\n    slug?: string,\n  ) => Effect.Effect<SnapshotId, SandboxError.SandboxError>\n}\n\nexport class DenoSandbox extends Context.Service<DenoSandbox, DenoSandboxService>()(\n  \"@betalyra/effect-uai/providers/deno/DenoSandbox\",\n) {}\n\n// ---------------------------------------------------------------------------\n// Effect-native primitives\n// ---------------------------------------------------------------------------\n\n/** Random base-36 token, ~8 chars. */\nconst randomToken = Random.next.pipe(Effect.map((r) => r.toString(36).slice(2, 10)))\n\n// ---------------------------------------------------------------------------\n// Error mapping\n// ---------------------------------------------------------------------------\n\nconst reasonOf = (e: unknown) => (e instanceof Error ? { reason: e.message } : {})\n\nconst isAuthError = (e: unknown): boolean =>\n  e instanceof MissingTokenError ||\n  e instanceof InvalidTokenError ||\n  (e instanceof ApiError && (e.status === 401 || e.status === 403)) ||\n  (e instanceof ConnectionEstablishmentError && (e.status === 401 || e.status === 403))\n\nconst isQuotaError = (e: unknown): boolean =>\n  (e instanceof ApiError && e.status === 429) ||\n  (e instanceof ConnectionEstablishmentError && e.status === 429)\n\n/**\n * \"Sandbox is no longer reachable\" — covers both the 404 (never existed)\n * and the 400 + `SANDBOX_ALREADY_TERMINATED` case the API returns when\n * you `connect` to a sandbox after its `kill`. Both map to\n * `SandboxNotFound` so `destroy` and friends stay idempotent.\n */\nconst isNotFoundError = (e: unknown): boolean =>\n  (e instanceof ApiError && (e.status === 404 || e.code === \"SANDBOX_ALREADY_TERMINATED\")) ||\n  (e instanceof ConnectionEstablishmentError &&\n    (e.status === 404 || e.code === \"SANDBOX_ALREADY_TERMINATED\"))\n\nconst mapCreateError = (e: unknown): SandboxError.SandboxError =>\n  isAuthError(e)\n    ? new SandboxError.SandboxAuthFailed({ provider: PROVIDER, subtype: \"auth\", raw: e })\n    : isQuotaError(e)\n      ? new SandboxError.SandboxQuotaExceeded({\n          provider: PROVIDER,\n          raw: e,\n          ...reasonOf(e),\n        })\n      : e instanceof InvalidTimeoutError || e instanceof InvalidMemoryError\n        ? new SandboxError.SandboxInvalidRequest({\n            provider: PROVIDER,\n            raw: e,\n            ...reasonOf(e),\n          })\n        : new SandboxError.SandboxCreateFailed({\n            provider: PROVIDER,\n            raw: e,\n            ...reasonOf(e),\n          })\n\nconst mapLookupError =\n  (id: string) =>\n  (e: unknown): SandboxError.SandboxError =>\n    isNotFoundError(e)\n      ? new SandboxError.SandboxNotFound({ provider: PROVIDER, id })\n      : mapCreateError(e)\n\nconst mapExecError = (e: unknown): SandboxError.SandboxError =>\n  e instanceof SandboxCommandError\n    ? new SandboxError.SandboxExecFailed({\n        provider: PROVIDER,\n        raw: e,\n        reason: e.message,\n      })\n    : e instanceof ConnectionClosedError\n      ? new SandboxError.SandboxExecFailed({\n          provider: PROVIDER,\n          raw: e,\n          reason: e.reason ?? \"connection closed\",\n        })\n      : new SandboxError.SandboxExecFailed({\n          provider: PROVIDER,\n          raw: e,\n          ...reasonOf(e),\n        })\n\nconst mapFsError = (e: unknown): SandboxError.SandboxError =>\n  new SandboxError.SandboxExecFailed({\n    provider: PROVIDER,\n    raw: e,\n    ...reasonOf(e),\n  })\n\n// ---------------------------------------------------------------------------\n// Transient WebSocket handshake failures.\n//\n// Empirically (SDK 0.13.2): `sdk.spawn` opens a per-process WebSocket\n// to the sandbox-side relay. The Deploy edge intermittently returns\n// `500 SANDBOX_WEBSOCKET_HANDSHAKE_ERROR` on this handshake; the next\n// attempt against the same sandbox typically succeeds. Retry narrowly\n// on that specific code rather than blanketing all 5xx — most are not\n// transient.\n//\n// Budget: 3 attempts ≈ 500+1000+2000 = 3.5s on top of the original\n// call, well under the 120s test timeout.\n// ---------------------------------------------------------------------------\n\nconst isTransientWsHandshake = (e: SandboxError.SandboxError) =>\n  (e._tag === \"SandboxExecFailed\" || e._tag === \"SandboxCreateFailed\") &&\n  e.raw instanceof ConnectionEstablishmentError &&\n  e.raw.code === \"SANDBOX_WEBSOCKET_HANDSHAKE_ERROR\"\n\nconst wsHandshakeSchedule = Schedule.exponential(\"500 millis\")\nconst WS_HANDSHAKE_RETRIES = 3\n\nconst retryOnTransientWs = <A, R>(\n  effect: Effect.Effect<A, SandboxError.SandboxError, R>,\n): Effect.Effect<A, SandboxError.SandboxError, R> =>\n  Effect.retry(effect, {\n    schedule: wsHandshakeSchedule,\n    times: WS_HANDSHAKE_RETRIES,\n    while: isTransientWsHandshake,\n  })\n\n// ---------------------------------------------------------------------------\n// Builder pipeline — a `Step` mutates `SandboxOptions`. Deno's create\n// API is a plain options object (no builder fluent API), so each Step\n// returns a partial overlay; the create flow folds them into the base.\n// Keeping the same shape as microsandbox's `Step` pattern means optional\n// fields read uniformly.\n// ---------------------------------------------------------------------------\n\ntype OptionsPatch = Partial<SandboxOptions>\ntype Step = (patch: OptionsPatch) => OptionsPatch\n\nconst noop: Step = (p) => p\n\nconst when = <A>(value: A | undefined, step: (a: A) => Step): Step =>\n  value === undefined ? noop : step(value)\n\nconst set =\n  <K extends keyof SandboxOptions>(key: K, value: SandboxOptions[K]): Step =>\n  (p) => ({ ...p, [key]: value })\n\n// ---------------------------------------------------------------------------\n// Duration → Deno timeout format (\"30s\"). Deno's `create.timeout`\n// accepts `\"session\" | \"${number}s\" | \"${number}m\"`; we always emit\n// `<seconds>s` since seconds is the most precise unit honored.\n// ---------------------------------------------------------------------------\n\nconst toDenoSeconds = (d: Duration.Input): `${number}s` => {\n  const secs = Math.max(1, Math.ceil(Duration.toMillis(Duration.fromInputUnsafe(d)) / 1000))\n  return `${secs}s`\n}\n\n// ---------------------------------------------------------------------------\n// ImageRef → Step. Default omits `root`; Snapshot sets it; Registry /\n// Dockerfile are unsupported and fail at decode.\n// ---------------------------------------------------------------------------\n\nconst imageStep = (image: ImageRef | undefined): Effect.Effect<Step, SandboxError.SandboxError> => {\n  if (image === undefined) return Effect.succeed(noop)\n  return Match.value(image).pipe(\n    Match.tag(\n      \"Default\",\n      (): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(noop),\n    ),\n    Match.tag(\n      \"Snapshot\",\n      ({ id }): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(set(\"root\", id)),\n    ),\n    Match.tag(\n      \"Registry\",\n      (): Effect.Effect<Step, SandboxError.SandboxError> =>\n        Effect.fail(\n          new SandboxError.SandboxUnsupported({\n            provider: PROVIDER,\n            capability: \"image.registry\",\n            reason: \"deno sandboxes do not accept OCI registry refs — boot from a snapshot instead\",\n          }),\n        ),\n    ),\n    Match.tag(\n      \"Dockerfile\",\n      (): Effect.Effect<Step, SandboxError.SandboxError> =>\n        Effect.fail(\n          new SandboxError.SandboxUnsupported({\n            provider: PROVIDER,\n            capability: \"image.dockerfile\",\n            reason:\n              \"deno sandboxes do not accept Dockerfiles — install software into a bootable volume then snapshot it\",\n          }),\n        ),\n    ),\n    Match.exhaustive,\n  )\n}\n\n// ---------------------------------------------------------------------------\n// NetworkPolicy → Step. Deno accepts hostnames + literal IPs but no\n// CIDR ranges; reject `cidrs` rather than silently dropping. `Blocked`\n// encodes as empty allowlist; `Open` omits the field.\n// ---------------------------------------------------------------------------\n\nconst networkStep = (policy: NetworkPolicy): Effect.Effect<Step, SandboxError.SandboxError> =>\n  Match.value(policy).pipe(\n    Match.tag(\"Open\", (): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(noop)),\n    Match.tag(\n      \"Blocked\",\n      (): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(set(\"allowNet\", [])),\n    ),\n    Match.tag(\n      \"Allowlist\",\n      ({ hosts, cidrs }): Effect.Effect<Step, SandboxError.SandboxError> =>\n        cidrs !== undefined && cidrs.length > 0\n          ? Effect.fail(\n              new SandboxError.SandboxUnsupported({\n                provider: PROVIDER,\n                capability: \"network.cidrs\",\n                reason:\n                  \"deno's allowNet accepts hostnames or literal IPs, not CIDR ranges — use hosts instead\",\n              }),\n            )\n          : Effect.succeed(set(\"allowNet\", [...(hosts ?? [])])),\n    ),\n    Match.exhaustive,\n  )\n\n// ---------------------------------------------------------------------------\n// Volumes → Step. Deno mounts read-write only; reject `readonly: true`.\n// ---------------------------------------------------------------------------\n\nconst volumesStep = (\n  volumes: CommonCreateRequest[\"volumes\"],\n): Effect.Effect<Step, SandboxError.SandboxError> => {\n  if (volumes === undefined || volumes.length === 0) return Effect.succeed(noop)\n  if (volumes.some((v) => v.readonly === true)) {\n    return Effect.fail(\n      new SandboxError.SandboxUnsupported({\n        provider: PROVIDER,\n        capability: \"volumes.readonly\",\n        reason: \"deno mounts volumes read-write — read-only mounts are not supported\",\n      }),\n    )\n  }\n  const map = Arr.reduce(volumes, {} as Record<string, string>, (acc, v) => {\n    acc[v.mountPath] = v.id\n    return acc\n  })\n  return Effect.succeed(set(\"volumes\", map))\n}\n\n// ---------------------------------------------------------------------------\n// Secrets → Step. Stays sync — no decode-time failure modes (custom\n// header is rejected upstream in the upcast).\n// ---------------------------------------------------------------------------\n\nconst secretsStep = (secrets: ReadonlyArray<DenoSandboxBoundSecret>): Step => {\n  const record = Arr.reduce(secrets, {} as Record<string, SecretConfig>, (acc, s) => {\n    acc[s.name] = { hosts: [...s.hosts], value: Redacted.value(s.value) }\n    return acc\n  })\n  return set(\"secrets\", record)\n}\n\n// ---------------------------------------------------------------------------\n// Base client options used for both client construction and per-call\n// overrides. `token` is a Redacted — we unwrap at the SDK boundary.\n// ---------------------------------------------------------------------------\n\nconst baseClientOptions = (config: DenoSandboxConfig): SandboxOptions => ({\n  ...(config.token === undefined ? {} : { token: Redacted.value(config.token) }),\n  ...(config.org === undefined ? {} : { org: config.org }),\n  ...(config.apiEndpoint === undefined ? {} : { apiEndpoint: config.apiEndpoint }),\n})\n\n// ---------------------------------------------------------------------------\n// argv splitter. Deno's `spawn(command, { args })` is direct argv only —\n// for `cmd: string` (shell semantics) we route through `bash -c`.\n// ---------------------------------------------------------------------------\n\nconst argv = (\n  cmd: CommonExecRequest[\"cmd\"],\n): Effect.Effect<\n  { readonly command: string; readonly args: ReadonlyArray<string> },\n  SandboxError.SandboxError\n> =>\n  typeof cmd === \"string\"\n    ? Effect.succeed({ command: \"bash\", args: [\"-c\", cmd] })\n    : Option.match(Arr.head(cmd), {\n        onNone: () =>\n          Effect.fail(\n            new SandboxError.SandboxInvalidRequest({\n              provider: PROVIDER,\n              param: \"cmd\",\n              reason: \"argv array must be non-empty\",\n            }),\n          ),\n        onSome: (head) => Effect.succeed({ command: head, args: Arr.drop(cmd, 1) }),\n      })\n\n// ---------------------------------------------------------------------------\n// AbortController scoped to the caller. On scope close we abort, which\n// signals the SDK to terminate the in-flight call. This is the kill-\n// switch the SDK responds to.\n// ---------------------------------------------------------------------------\n\nconst acquireAbortController: Effect.Effect<AbortController, never, Scope.Scope> =\n  Effect.acquireRelease(\n    Effect.sync(() => new AbortController()),\n    (ac) => Effect.sync(() => ac.abort()),\n  )\n\n// ---------------------------------------------------------------------------\n// stdin helpers\n// ---------------------------------------------------------------------------\n\nconst stdinIsStream = (\n  stdin: CommonSpawnRequest[\"stdin\"],\n): stdin is Stream.Stream<Uint8Array, never, never> =>\n  stdin !== undefined && typeof stdin !== \"string\" && !(stdin instanceof Uint8Array)\n\n/**\n * Copy into a fresh `Uint8Array<ArrayBuffer>`. The Deno SDK strictly\n * types its bytes argument as `Uint8Array<ArrayBuffer>` (not the\n * `ArrayBufferLike` upper bound), so `TextEncoder`-produced bytes and\n * caller-supplied Uint8Arrays need to be copied to a guaranteed-\n * `ArrayBuffer`-backed buffer to satisfy the type.\n */\nconst toBytes = (input: Uint8Array | string): Uint8Array<ArrayBuffer> => {\n  const src = typeof input === \"string\" ? new TextEncoder().encode(input) : input\n  const out = new Uint8Array(new ArrayBuffer(src.byteLength))\n  out.set(src)\n  return out\n}\n\n/**\n * Acquire the child's stdin writer, run `use(writer)`, then close the\n * writer on release (regardless of success / failure / interrupt).\n * Returns `Effect.void` if the child wasn't spawned with `stdin: \"piped\"`.\n */\nconst withStdinWriter = <A, E, R>(\n  child: DenoChildProcess,\n  use: (writer: WritableStreamDefaultWriter<Uint8Array>) => Effect.Effect<A, E, R>,\n): Effect.Effect<void | A, E | SandboxError.SandboxError, R> => {\n  const stdin = child.stdin\n  if (stdin === null) return Effect.void\n  return Effect.acquireUseRelease(\n    Effect.sync(() => stdin.getWriter()),\n    use,\n    (writer) => Effect.promise(() => writer.close().catch(() => undefined)).pipe(Effect.ignore),\n  )\n}\n\nconst writeStdinBytes = (\n  child: DenoChildProcess,\n  bytes: Uint8Array,\n): Effect.Effect<void, SandboxError.SandboxError> =>\n  withStdinWriter(child, (writer) =>\n    Effect.tryPromise({ try: () => writer.write(bytes), catch: mapExecError }),\n  ).pipe(Effect.asVoid)\n\nconst feedStreamStdin = (\n  child: DenoChildProcess,\n  source: Stream.Stream<Uint8Array, never, never>,\n): Effect.Effect<void, SandboxError.SandboxError> =>\n  withStdinWriter(child, (writer) =>\n    Stream.runForEach(source, (chunk) =>\n      Effect.tryPromise({ try: () => writer.write(chunk), catch: mapExecError }),\n    ),\n  ).pipe(Effect.asVoid)\n\n// ---------------------------------------------------------------------------\n// ReadableStream<Uint8Array> → Stream<Uint8Array>.\n// ---------------------------------------------------------------------------\n\nconst streamFromReadable = (\n  readable: ReadableStream<Uint8Array>,\n): Stream.Stream<Uint8Array, SandboxError.SandboxError> =>\n  Stream.fromReadableStream({\n    evaluate: () => readable,\n    onError: mapExecError,\n  })\n\n// ---------------------------------------------------------------------------\n// Merge stdout + stderr into a tagged ExecEvent stream terminated by a\n// single Complete event derived from `child.status`.\n// ---------------------------------------------------------------------------\n\nconst eventStream = (\n  child: DenoChildProcess,\n  startedAt: number,\n): Stream.Stream<CoreExecEvent, SandboxError.SandboxError> => {\n  const stdout: Stream.Stream<CoreExecEvent, SandboxError.SandboxError> =\n    child.stdout === null\n      ? Stream.empty\n      : Stream.map(streamFromReadable(child.stdout), (chunk) => CoreExecEvent.Stdout({ chunk }))\n  const stderr: Stream.Stream<CoreExecEvent, SandboxError.SandboxError> =\n    child.stderr === null\n      ? Stream.empty\n      : Stream.map(streamFromReadable(child.stderr), (chunk) => CoreExecEvent.Stderr({ chunk }))\n  const complete: Stream.Stream<CoreExecEvent, SandboxError.SandboxError> = Stream.unwrap(\n    Effect.gen(function* () {\n      const status = yield* Effect.tryPromise({ try: () => child.status, catch: mapExecError })\n      const now = yield* Clock.currentTimeMillis\n      return Stream.succeed(\n        CoreExecEvent.Complete({ exitCode: status.code, durationMs: now - startedAt }),\n      )\n    }),\n  )\n  return Stream.concat(Stream.merge(stdout, stderr), complete)\n}\n\n// ---------------------------------------------------------------------------\n// Per-exec timeout. Races against `Effect.sleep` so the parent scope\n// finalizers (which kill the child via `acquireRelease`) fire on breach.\n// We don't lean on `Effect.timeout` because it returns `Option`-shaped\n// fallbacks in v4; the race-based shape lets us keep the SandboxError\n// channel directly.\n// ---------------------------------------------------------------------------\n\nconst withExecTimeout = <A, R>(\n  timeout: Duration.Input | undefined,\n  effect: Effect.Effect<A, SandboxError.SandboxError, R>,\n): Effect.Effect<A, SandboxError.SandboxError, R> =>\n  timeout === undefined\n    ? effect\n    : Effect.race(\n        effect,\n        Effect.sleep(timeout).pipe(\n          Effect.andThen(\n            Effect.fail(\n              new SandboxError.SandboxTimeout({\n                provider: PROVIDER,\n                operation: \"exec\",\n                budget: Duration.fromInputUnsafe(timeout),\n              }),\n            ),\n          ),\n        ),\n      )\n\n// ---------------------------------------------------------------------------\n// Live SandboxInstance adapter. The `WeakMap<SandboxInstance, sdk>`\n// passed in is the back-reference used by the port-exposure sub-API\n// to recover the SDK handle from an opaque `SandboxInstance`.\n// ---------------------------------------------------------------------------\n\nconst adaptInstance = (\n  sdk: DenoSdkSandbox,\n  portRegistry: WeakMap<SandboxInstance, DenoSdkSandbox>,\n): SandboxInstance => {\n  const id = SandboxId(sdk.id)\n\n  const openProcess = (request: CommonSpawnRequest) =>\n    Effect.gen(function* () {\n      const { command, args } = yield* argv(request.cmd)\n      const ac = yield* acquireAbortController\n      const stdinMode: \"piped\" | \"null\" = request.stdin === undefined ? \"null\" : \"piped\"\n      const startedAt = yield* Clock.currentTimeMillis\n      const child = yield* Effect.acquireRelease(\n        retryOnTransientWs(\n          Effect.tryPromise({\n            try: () =>\n              sdk.spawn(command, {\n                args: [...args],\n                ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n                ...(request.env === undefined ? {} : { env: { ...request.env } }),\n                stdin: stdinMode,\n                stdout: \"piped\",\n                stderr: \"piped\",\n                signal: ac.signal,\n              }),\n            catch: mapExecError,\n          }),\n        ),\n        (c) => Effect.promise(() => c.kill(\"SIGKILL\").catch(() => undefined)).pipe(Effect.ignore),\n      )\n      if (request.stdin !== undefined) {\n        if (stdinIsStream(request.stdin)) {\n          yield* Effect.forkScoped(feedStreamStdin(child, request.stdin))\n        } else {\n          yield* writeStdinBytes(child, toBytes(request.stdin))\n        }\n      }\n      return { child, startedAt }\n    })\n\n  const instance: SandboxInstance = {\n    id,\n\n    exec: (request) =>\n      withExecTimeout(\n        request.timeout,\n        Effect.scoped(\n          Effect.gen(function* () {\n            const { child, startedAt } = yield* openProcess(request)\n            const output = yield* Effect.tryPromise({\n              try: () => child.output(),\n              catch: mapExecError,\n            })\n            const completedAt = yield* Clock.currentTimeMillis\n            return {\n              exitCode: output.status.code,\n              stdout: output.stdoutText ?? \"\",\n              stderr: output.stderrText ?? \"\",\n              durationMs: completedAt - startedAt,\n            } satisfies ExecResult\n          }),\n        ),\n      ),\n\n    execStream: (request) =>\n      Stream.unwrap(\n        Effect.map(openProcess(request), ({ child, startedAt }) => eventStream(child, startedAt)),\n      ),\n\n    spawn: (request) =>\n      Effect.map(\n        openProcess(request),\n        ({ child, startedAt }): ProcessHandle => ({\n          pid: child.pid,\n          events: eventStream(child, startedAt),\n          kill: Effect.tryPromise({\n            try: () => child.kill(\"SIGTERM\"),\n            catch: mapExecError,\n          }),\n          exit: Effect.tryPromise({\n            try: () => child.status,\n            catch: mapExecError,\n          }).pipe(Effect.map((status) => ({ exitCode: status.code }))),\n        }),\n      ),\n\n    files: {\n      read: (path) => Effect.tryPromise({ try: () => sdk.fs.readFile(path), catch: mapFsError }),\n      write: (path, contents) =>\n        Effect.tryPromise({\n          try: () => sdk.fs.writeFile(path, toBytes(contents)),\n          catch: mapFsError,\n        }),\n      remove: (path) => Effect.tryPromise({ try: () => sdk.fs.remove(path), catch: mapFsError }),\n      mkdir: (path) =>\n        Effect.tryPromise({\n          try: () => sdk.fs.mkdir(path, { recursive: true }),\n          catch: mapFsError,\n        }),\n      list: (path) =>\n        Stream.fromAsyncIterable(sdk.fs.readDir(path), mapFsError).pipe(\n          Stream.map((e) => ({\n            path: e.name,\n            kind: e.isFile\n              ? (\"file\" as const)\n              : e.isDirectory\n                ? (\"directory\" as const)\n                : e.isSymlink\n                  ? (\"symlink\" as const)\n                  : (\"other\" as const),\n          })),\n          Stream.runCollect,\n        ),\n      exists: (path) =>\n        Effect.tryPromise({\n          try: () => sdk.fs.stat(path),\n          catch: mapFsError,\n        }).pipe(\n          Effect.as(true),\n          Effect.catchCause(() => Effect.succeed(false)),\n        ),\n    },\n  }\n\n  portRegistry.set(instance, sdk)\n  return instance\n}\n\n// ---------------------------------------------------------------------------\n// Service factory\n// ---------------------------------------------------------------------------\n\nconst buildService = (config: DenoSandboxConfig): DenoSandboxService => {\n  const clientOpts = baseClientOptions(config)\n  const client = new Client(clientOpts)\n  const portRegistry = new WeakMap<SandboxInstance, DenoSdkSandbox>()\n\n  const buildOptions = (\n    request: DenoSandboxCreateRequest,\n  ): Effect.Effect<SandboxOptions, SandboxError.SandboxError> =>\n    Effect.gen(function* () {\n      const img = yield* imageStep(request.image)\n      const net = yield* request.network === undefined\n        ? Effect.succeed(noop)\n        : networkStep(request.network)\n      const vols = yield* volumesStep(request.volumes)\n\n      const steps: ReadonlyArray<Step> = [\n        img,\n        when(request.region ?? config.defaultRegion, (r) => set(\"region\", r)),\n        when(request.env, (env) => set(\"env\", { ...env })),\n        when(request.timeout, (t) => set(\"timeout\", toDenoSeconds(t))),\n        when(request.memory, (m) => set(\"memory\", Memory.toBytes(m))),\n        when(request.labels, (l) => set(\"labels\", { ...l })),\n        net,\n        vols,\n        when(request.secrets, (s) => (s.length === 0 ? noop : secretsStep(s))),\n        when(request.port, (p) => set(\"port\", p)),\n      ]\n      const overlay = Arr.reduce(steps, {} as OptionsPatch, (acc, step) => step(acc))\n      return { ...clientOpts, ...overlay }\n    })\n\n  const acquireSdk = (request: DenoSandboxCreateRequest) =>\n    Effect.flatMap(buildOptions(request), (opts) =>\n      Effect.tryPromise({ try: () => DenoSdkSandbox.create(opts), catch: mapCreateError }),\n    )\n\n  const releaseSdk = (sdk: DenoSdkSandbox) =>\n    Effect.promise(() => sdk.kill().catch(() => undefined)).pipe(Effect.ignore)\n\n  const releaseAttached = (sdk: DenoSdkSandbox) =>\n    Effect.promise(() => sdk.close().catch(() => undefined)).pipe(Effect.ignore)\n\n  const destroyById = (id: SandboxId) =>\n    Effect.tryPromise({\n      try: () => DenoSdkSandbox.connect(id, clientOpts),\n      catch: mapLookupError(id),\n    }).pipe(\n      Effect.flatMap((sdk) =>\n        Effect.tryPromise({ try: () => sdk.kill(), catch: mapLookupError(id) }),\n      ),\n      Effect.catchTag(\"SandboxNotFound\", () => Effect.void),\n    )\n\n  return {\n    create: (request) =>\n      Effect.acquireRelease(acquireSdk(request), releaseSdk).pipe(\n        Effect.map((sdk) => adaptInstance(sdk, portRegistry)),\n      ),\n\n    attach: (id) =>\n      Effect.acquireRelease(\n        Effect.tryPromise({\n          try: () => DenoSdkSandbox.connect(id, clientOpts),\n          catch: mapLookupError(id),\n        }),\n        releaseAttached,\n      ).pipe(Effect.map((sdk) => adaptInstance(sdk, portRegistry))),\n\n    list: Effect.tryPromise({\n      try: () => client.sandboxes.list(),\n      catch: mapCreateError,\n    }).pipe(Effect.map(Arr.map((m): SandboxRef => ({ id: SandboxId(m.id) })))),\n\n    destroy: destroyById,\n\n    snapshotVolume: (volumeId, slug) =>\n      Effect.gen(function* () {\n        const snapSlug = slug ?? `eff-uai-snap-${yield* randomToken}`\n        const snap = yield* Effect.tryPromise({\n          try: () => client.volumes.snapshot(volumeId, { slug: snapSlug }),\n          catch: mapCreateError,\n        })\n        return SnapshotId(snap.slug)\n      }),\n\n    snapshots: {\n      create: () =>\n        Effect.fail(\n          new SandboxError.SandboxUnsupported({\n            provider: PROVIDER,\n            capability: \"snapshots.create\",\n            reason:\n              \"deno snapshots are derived from volumes, not from running sandboxes — use DenoSandbox.snapshotVolume(volumeId, slug?) instead\",\n          }),\n        ),\n      destroy: (sid) =>\n        Effect.tryPromise({\n          try: () => client.snapshots.delete(sid),\n          catch: mapLookupError(sid),\n        }),\n      list: Stream.unwrap(\n        Effect.tryPromise({\n          try: () => client.snapshots.list(),\n          catch: mapCreateError,\n        }).pipe(Effect.map((page) => Stream.fromAsyncIterable(page, mapCreateError))),\n      ).pipe(\n        Stream.map((snap) => ({ id: SnapshotId(snap.id), name: snap.slug })),\n        Stream.runCollect,\n      ),\n    },\n\n    volumes: {\n      create: (name, options) =>\n        Effect.tryPromise({\n          try: () =>\n            client.volumes.create({\n              slug: name,\n              // Volumes are only available in `ord` at the moment.\n              // Callers needing a different region can pre-create via\n              // the SDK directly.\n              region: config.defaultRegion ?? \"ord\",\n              capacity: options?.quotaBytes ?? \"1GB\",\n            }),\n          catch: mapCreateError,\n        }).pipe(Effect.map((vol) => VolumeId(vol.slug))),\n      destroy: (vid) =>\n        Effect.tryPromise({\n          try: () => client.volumes.delete(vid),\n          catch: mapLookupError(vid),\n        }),\n      list: Stream.unwrap(\n        Effect.tryPromise({\n          try: () => client.volumes.list(),\n          catch: mapCreateError,\n        }).pipe(Effect.map((page) => Stream.fromAsyncIterable(page, mapCreateError))),\n      ).pipe(\n        Stream.map((vol) => ({ id: VolumeId(vol.slug), name: vol.slug })),\n        Stream.runCollect,\n      ),\n    },\n\n    ports: {\n      expose: (instance, port) =>\n        Effect.gen(function* () {\n          const sdk = portRegistry.get(instance)\n          if (sdk === undefined) {\n            return yield* new SandboxError.SandboxNotFound({ provider: PROVIDER, id: instance.id })\n          }\n          const url = yield* Effect.tryPromise({\n            try: () => sdk.exposeHttp({ port }),\n            catch: mapExecError,\n          })\n          return { url }\n        }),\n    },\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Cross-provider upcast — reject custom header on BoundSecret since\n// Deno doesn't support per-secret headers.\n// ---------------------------------------------------------------------------\n\nconst rejectCustomHeader = (\n  secrets: CommonCreateRequest[\"secrets\"],\n): Effect.Effect<void, SandboxError.SandboxError> =>\n  secrets === undefined || !secrets.some((s) => s.header !== undefined)\n    ? Effect.void\n    : Effect.fail(\n        new SandboxError.SandboxUnsupported({\n          provider: PROVIDER,\n          capability: \"BoundSecret.header\",\n          reason:\n            \"deno always injects secrets as `Authorization: Bearer <value>` — custom headers aren't supported. Use the narrowed `DenoSandbox.create` surface, which omits this field.\",\n        }),\n      )\n\nconst upcastService = (s: DenoSandboxService): SandboxService => ({\n  ...s,\n  create: (request) =>\n    rejectCustomHeader(request.secrets).pipe(\n      Effect.andThen(s.create(request as DenoSandboxCreateRequest)),\n    ),\n})\n\n// ---------------------------------------------------------------------------\n// Layer\n// ---------------------------------------------------------------------------\n\n/**\n * Layer registering the Deno Sandbox adapter against `Sandbox`, with\n * the capability markers Deno actually supports.\n *\n * Shipped:\n * - {@link SandboxHostnameAllowlist} — `allowNet` accepts hostnames + wildcards.\n * - {@link SandboxSecretInjection} — `secrets.<name>.value` is injected\n *   only on outbound HTTPS to bound hosts; in-VM env shows a placeholder.\n * - {@link SandboxSnapshots} — read-side helpers (`list`, `destroy`)\n *   work. `snapshots.create(fromInstance)` fails with\n *   `SandboxUnsupported`; use the per-provider\n *   `DenoSandbox.snapshotVolume` escape hatch for the volume-derived\n *   snapshot workflow.\n * - {@link SandboxVolumes} — `client.volumes.*` directly.\n * - {@link SandboxPortExposure} — `sandbox.exposeHttp({ port })`.\n *\n * NOT shipped (calling those helpers fails at compile time):\n * - `SandboxCustomImage` — no Dockerfile / no OCI registry refs.\n * - `SandboxPauseResume` — Deno doesn't offer in-place memory-preserving pause.\n * - `SandboxKernelSession`, `SandboxPty` — no Jupyter / no PTY.\n */\nexport const layer = (config: DenoSandboxConfig = {}) => {\n  const service = buildService(config)\n  return Layer.mergeAll(\n    Layer.succeed(DenoSandbox, service),\n    Layer.succeed(CoreSandbox, upcastService(service)),\n    Layer.succeed(SandboxHostnameAllowlist, undefined),\n    Layer.succeed(SandboxSecretInjection, undefined),\n    Layer.succeed(SandboxSnapshots, undefined),\n    Layer.succeed(SandboxVolumes, undefined),\n    Layer.succeed(SandboxPortExposure, undefined),\n  )\n}\n\n// Re-export SDK error classes so consumers don't need a direct\n// dependency on `@deno/sandbox` to do error-shape-narrowed handling.\nexport {\n  ApiError,\n  ConnectionClosedError,\n  ConnectionEstablishmentError,\n  InvalidMemoryError,\n  InvalidTimeoutError,\n  InvalidTokenError,\n  MissingTokenError,\n  SandboxCommandError,\n  SandboxKillError,\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyDA,MAAM,WAAW;AAiEjB,IAAa,cAAb,cAAiC,QAAQ,SAA0C,CACjF,kDACD,CAAC;;AAOF,MAAM,cAAc,OAAO,KAAK,KAAK,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AAMpF,MAAM,YAAY,MAAgB,aAAa,QAAQ,EAAE,QAAQ,EAAE,SAAS,GAAG,EAAE;AAEjF,MAAM,eAAe,MACnB,aAAa,qBACb,aAAa,qBACZ,aAAa,aAAa,EAAE,WAAW,OAAO,EAAE,WAAW,QAC3D,aAAa,iCAAiC,EAAE,WAAW,OAAO,EAAE,WAAW;AAElF,MAAM,gBAAgB,MACnB,aAAa,YAAY,EAAE,WAAW,OACtC,aAAa,gCAAgC,EAAE,WAAW;;;;;;;AAQ7D,MAAM,mBAAmB,MACtB,aAAa,aAAa,EAAE,WAAW,OAAO,EAAE,SAAS,iCACzD,aAAa,iCACX,EAAE,WAAW,OAAO,EAAE,SAAS;AAEpC,MAAM,kBAAkB,MACtB,YAAY,EAAE,GACV,IAAI,aAAa,kBAAkB;CAAE,UAAU;CAAU,SAAS;CAAQ,KAAK;CAAG,CAAC,GACnF,aAAa,EAAE,GACb,IAAI,aAAa,qBAAqB;CACpC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,EAAE;CACf,CAAC,GACF,aAAa,uBAAuB,aAAa,qBAC/C,IAAI,aAAa,sBAAsB;CACrC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,EAAE;CACf,CAAC,GACF,IAAI,aAAa,oBAAoB;CACnC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,EAAE;CACf,CAAC;AAEZ,MAAM,kBACH,QACA,MACC,gBAAgB,EAAE,GACd,IAAI,aAAa,gBAAgB;CAAE,UAAU;CAAU;CAAI,CAAC,GAC5D,eAAe,EAAE;AAEzB,MAAM,gBAAgB,MACpB,aAAa,sBACT,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,QAAQ,EAAE;CACX,CAAC,GACF,aAAa,wBACX,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,QAAQ,EAAE,UAAU;CACrB,CAAC,GACF,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,EAAE;CACf,CAAC;AAEV,MAAM,cAAc,MAClB,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,EAAE;CACf,CAAC;AAgBJ,MAAM,0BAA0B,OAC7B,EAAE,SAAS,uBAAuB,EAAE,SAAS,0BAC9C,EAAE,eAAe,gCACjB,EAAE,IAAI,SAAS;AAEjB,MAAM,sBAAsB,SAAS,YAAY,aAAa;AAC9D,MAAM,uBAAuB;AAE7B,MAAM,sBACJ,WAEA,OAAO,MAAM,QAAQ;CACnB,UAAU;CACV,OAAO;CACP,OAAO;CACR,CAAC;AAaJ,MAAM,QAAc,MAAM;AAE1B,MAAM,QAAW,OAAsB,SACrC,UAAU,KAAA,IAAY,OAAO,KAAK,MAAM;AAE1C,MAAM,OAC6B,KAAQ,WACxC,OAAO;CAAE,GAAG;EAAI,MAAM;CAAO;AAQhC,MAAM,iBAAiB,MAAoC;AAEzD,QAAO,GADM,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,SAAS,SAAS,gBAAgB,EAAE,CAAC,GAAG,IAAK,CAC3E,CAAC;;AAQjB,MAAM,aAAa,UAAgF;AACjG,KAAI,UAAU,KAAA,EAAW,QAAO,OAAO,QAAQ,KAAK;AACpD,QAAO,MAAM,MAAM,MAAM,CAAC,KACxB,MAAM,IACJ,iBACsD,OAAO,QAAQ,KAAK,CAC3E,EACD,MAAM,IACJ,aACC,EAAE,SAAyD,OAAO,QAAQ,IAAI,QAAQ,GAAG,CAAC,CAC5F,EACD,MAAM,IACJ,kBAEE,OAAO,KACL,IAAI,aAAa,mBAAmB;EAClC,UAAU;EACV,YAAY;EACZ,QAAQ;EACT,CAAC,CACH,CACJ,EACD,MAAM,IACJ,oBAEE,OAAO,KACL,IAAI,aAAa,mBAAmB;EAClC,UAAU;EACV,YAAY;EACZ,QACE;EACH,CAAC,CACH,CACJ,EACD,MAAM,WACP;;AASH,MAAM,eAAe,WACnB,MAAM,MAAM,OAAO,CAAC,KAClB,MAAM,IAAI,cAA8D,OAAO,QAAQ,KAAK,CAAC,EAC7F,MAAM,IACJ,iBACsD,OAAO,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,CAC1F,EACD,MAAM,IACJ,cACC,EAAE,OAAO,YACR,UAAU,KAAA,KAAa,MAAM,SAAS,IAClC,OAAO,KACL,IAAI,aAAa,mBAAmB;CAClC,UAAU;CACV,YAAY;CACZ,QACE;CACH,CAAC,CACH,GACD,OAAO,QAAQ,IAAI,YAAY,CAAC,GAAI,SAAS,EAAE,CAAE,CAAC,CAAC,CAC1D,EACD,MAAM,WACP;AAMH,MAAM,eACJ,YACmD;AACnD,KAAI,YAAY,KAAA,KAAa,QAAQ,WAAW,EAAG,QAAO,OAAO,QAAQ,KAAK;AAC9E,KAAI,QAAQ,MAAM,MAAM,EAAE,aAAa,KAAK,CAC1C,QAAO,OAAO,KACZ,IAAI,aAAa,mBAAmB;EAClC,UAAU;EACV,YAAY;EACZ,QAAQ;EACT,CAAC,CACH;CAEH,MAAM,MAAMA,MAAI,OAAO,SAAS,EAAE,GAA6B,KAAK,MAAM;AACxE,MAAI,EAAE,aAAa,EAAE;AACrB,SAAO;GACP;AACF,QAAO,OAAO,QAAQ,IAAI,WAAW,IAAI,CAAC;;AAQ5C,MAAM,eAAe,YAAyD;AAK5E,QAAO,IAAI,WAJIA,MAAI,OAAO,SAAS,EAAE,GAAmC,KAAK,MAAM;AACjF,MAAI,EAAE,QAAQ;GAAE,OAAO,CAAC,GAAG,EAAE,MAAM;GAAE,OAAO,SAAS,MAAM,EAAE,MAAM;GAAE;AACrE,SAAO;GAEmB,CAAC;;AAQ/B,MAAM,qBAAqB,YAA+C;CACxE,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,GAAG,EAAE,OAAO,SAAS,MAAM,OAAO,MAAM,EAAE;CAC7E,GAAI,OAAO,QAAQ,KAAA,IAAY,EAAE,GAAG,EAAE,KAAK,OAAO,KAAK;CACvD,GAAI,OAAO,gBAAgB,KAAA,IAAY,EAAE,GAAG,EAAE,aAAa,OAAO,aAAa;CAChF;AAOD,MAAM,QACJ,QAKA,OAAO,QAAQ,WACX,OAAO,QAAQ;CAAE,SAAS;CAAQ,MAAM,CAAC,MAAM,IAAI;CAAE,CAAC,GACtD,OAAO,MAAMA,MAAI,KAAK,IAAI,EAAE;CAC1B,cACE,OAAO,KACL,IAAI,aAAa,sBAAsB;EACrC,UAAU;EACV,OAAO;EACP,QAAQ;EACT,CAAC,CACH;CACH,SAAS,SAAS,OAAO,QAAQ;EAAE,SAAS;EAAM,MAAMA,MAAI,KAAK,KAAK,EAAE;EAAE,CAAC;CAC5E,CAAC;AAQR,MAAM,yBACJ,OAAO,eACL,OAAO,WAAW,IAAI,iBAAiB,CAAC,GACvC,OAAO,OAAO,WAAW,GAAG,OAAO,CAAC,CACtC;AAMH,MAAM,iBACJ,UAEA,UAAU,KAAA,KAAa,OAAO,UAAU,YAAY,EAAE,iBAAiB;;;;;;;;AASzE,MAAM,WAAW,UAAwD;CACvE,MAAM,MAAM,OAAO,UAAU,WAAW,IAAI,aAAa,CAAC,OAAO,MAAM,GAAG;CAC1E,MAAM,MAAM,IAAI,WAAW,IAAI,YAAY,IAAI,WAAW,CAAC;AAC3D,KAAI,IAAI,IAAI;AACZ,QAAO;;;;;;;AAQT,MAAM,mBACJ,OACA,QAC8D;CAC9D,MAAM,QAAQ,MAAM;AACpB,KAAI,UAAU,KAAM,QAAO,OAAO;AAClC,QAAO,OAAO,kBACZ,OAAO,WAAW,MAAM,WAAW,CAAC,EACpC,MACC,WAAW,OAAO,cAAc,OAAO,OAAO,CAAC,YAAY,KAAA,EAAU,CAAC,CAAC,KAAK,OAAO,OAAO,CAC5F;;AAGH,MAAM,mBACJ,OACA,UAEA,gBAAgB,QAAQ,WACtB,OAAO,WAAW;CAAE,WAAW,OAAO,MAAM,MAAM;CAAE,OAAO;CAAc,CAAC,CAC3E,CAAC,KAAK,OAAO,OAAO;AAEvB,MAAM,mBACJ,OACA,WAEA,gBAAgB,QAAQ,WACtB,OAAO,WAAW,SAAS,UACzB,OAAO,WAAW;CAAE,WAAW,OAAO,MAAM,MAAM;CAAE,OAAO;CAAc,CAAC,CAC3E,CACF,CAAC,KAAK,OAAO,OAAO;AAMvB,MAAM,sBACJ,aAEA,OAAO,mBAAmB;CACxB,gBAAgB;CAChB,SAAS;CACV,CAAC;AAOJ,MAAM,eACJ,OACA,cAC4D;CAC5D,MAAM,SACJ,MAAM,WAAW,OACb,OAAO,QACP,OAAO,IAAI,mBAAmB,MAAM,OAAO,GAAG,UAAUC,UAAc,OAAO,EAAE,OAAO,CAAC,CAAC;CAC9F,MAAM,SACJ,MAAM,WAAW,OACb,OAAO,QACP,OAAO,IAAI,mBAAmB,MAAM,OAAO,GAAG,UAAUA,UAAc,OAAO,EAAE,OAAO,CAAC,CAAC;CAC9F,MAAM,WAAoE,OAAO,OAC/E,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,OAAO,WAAW;GAAE,WAAW,MAAM;GAAQ,OAAO;GAAc,CAAC;EACzF,MAAM,MAAM,OAAO,MAAM;AACzB,SAAO,OAAO,QACZA,UAAc,SAAS;GAAE,UAAU,OAAO;GAAM,YAAY,MAAM;GAAW,CAAC,CAC/E;GACD,CACH;AACD,QAAO,OAAO,OAAO,OAAO,MAAM,QAAQ,OAAO,EAAE,SAAS;;AAW9D,MAAM,mBACJ,SACA,WAEA,YAAY,KAAA,IACR,SACA,OAAO,KACL,QACA,OAAO,MAAM,QAAQ,CAAC,KACpB,OAAO,QACL,OAAO,KACL,IAAI,aAAa,eAAe;CAC9B,UAAU;CACV,WAAW;CACX,QAAQ,SAAS,gBAAgB,QAAQ;CAC1C,CAAC,CACH,CACF,CACF,CACF;AAQP,MAAM,iBACJ,KACA,iBACoB;CACpB,MAAM,KAAK,UAAU,IAAI,GAAG;CAE5B,MAAM,eAAe,YACnB,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,SAAS,SAAS,OAAO,KAAK,QAAQ,IAAI;EAClD,MAAM,KAAK,OAAO;EAClB,MAAM,YAA8B,QAAQ,UAAU,KAAA,IAAY,SAAS;EAC3E,MAAM,YAAY,OAAO,MAAM;EAC/B,MAAM,QAAQ,OAAO,OAAO,eAC1B,mBACE,OAAO,WAAW;GAChB,WACE,IAAI,MAAM,SAAS;IACjB,MAAM,CAAC,GAAG,KAAK;IACf,GAAI,QAAQ,QAAQ,KAAA,IAAY,EAAE,GAAG,EAAE,KAAK,QAAQ,KAAK;IACzD,GAAI,QAAQ,QAAQ,KAAA,IAAY,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,KAAK,EAAE;IAChE,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ,GAAG;IACZ,CAAC;GACJ,OAAO;GACR,CAAC,CACH,GACA,MAAM,OAAO,cAAc,EAAE,KAAK,UAAU,CAAC,YAAY,KAAA,EAAU,CAAC,CAAC,KAAK,OAAO,OAAO,CAC1F;AACD,MAAI,QAAQ,UAAU,KAAA,EACpB,KAAI,cAAc,QAAQ,MAAM,CAC9B,QAAO,OAAO,WAAW,gBAAgB,OAAO,QAAQ,MAAM,CAAC;MAE/D,QAAO,gBAAgB,OAAO,QAAQ,QAAQ,MAAM,CAAC;AAGzD,SAAO;GAAE;GAAO;GAAW;GAC3B;CAEJ,MAAM,WAA4B;EAChC;EAEA,OAAO,YACL,gBACE,QAAQ,SACR,OAAO,OACL,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,OAAO,cAAc,OAAO,YAAY,QAAQ;GACxD,MAAM,SAAS,OAAO,OAAO,WAAW;IACtC,WAAW,MAAM,QAAQ;IACzB,OAAO;IACR,CAAC;GACF,MAAM,cAAc,OAAO,MAAM;AACjC,UAAO;IACL,UAAU,OAAO,OAAO;IACxB,QAAQ,OAAO,cAAc;IAC7B,QAAQ,OAAO,cAAc;IAC7B,YAAY,cAAc;IAC3B;IACD,CACH,CACF;EAEH,aAAa,YACX,OAAO,OACL,OAAO,IAAI,YAAY,QAAQ,GAAG,EAAE,OAAO,gBAAgB,YAAY,OAAO,UAAU,CAAC,CAC1F;EAEH,QAAQ,YACN,OAAO,IACL,YAAY,QAAQ,GACnB,EAAE,OAAO,iBAAgC;GACxC,KAAK,MAAM;GACX,QAAQ,YAAY,OAAO,UAAU;GACrC,MAAM,OAAO,WAAW;IACtB,WAAW,MAAM,KAAK,UAAU;IAChC,OAAO;IACR,CAAC;GACF,MAAM,OAAO,WAAW;IACtB,WAAW,MAAM;IACjB,OAAO;IACR,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,EAAE,UAAU,OAAO,MAAM,EAAE,CAAC;GAC7D,EACF;EAEH,OAAO;GACL,OAAO,SAAS,OAAO,WAAW;IAAE,WAAW,IAAI,GAAG,SAAS,KAAK;IAAE,OAAO;IAAY,CAAC;GAC1F,QAAQ,MAAM,aACZ,OAAO,WAAW;IAChB,WAAW,IAAI,GAAG,UAAU,MAAM,QAAQ,SAAS,CAAC;IACpD,OAAO;IACR,CAAC;GACJ,SAAS,SAAS,OAAO,WAAW;IAAE,WAAW,IAAI,GAAG,OAAO,KAAK;IAAE,OAAO;IAAY,CAAC;GAC1F,QAAQ,SACN,OAAO,WAAW;IAChB,WAAW,IAAI,GAAG,MAAM,MAAM,EAAE,WAAW,MAAM,CAAC;IAClD,OAAO;IACR,CAAC;GACJ,OAAO,SACL,OAAO,kBAAkB,IAAI,GAAG,QAAQ,KAAK,EAAE,WAAW,CAAC,KACzD,OAAO,KAAK,OAAO;IACjB,MAAM,EAAE;IACR,MAAM,EAAE,SACH,SACD,EAAE,cACC,cACD,EAAE,YACC,YACA;IACV,EAAE,EACH,OAAO,WACR;GACH,SAAS,SACP,OAAO,WAAW;IAChB,WAAW,IAAI,GAAG,KAAK,KAAK;IAC5B,OAAO;IACR,CAAC,CAAC,KACD,OAAO,GAAG,KAAK,EACf,OAAO,iBAAiB,OAAO,QAAQ,MAAM,CAAC,CAC/C;GACJ;EACF;AAED,cAAa,IAAI,UAAU,IAAI;AAC/B,QAAO;;AAOT,MAAM,gBAAgB,WAAkD;CACtE,MAAM,aAAa,kBAAkB,OAAO;CAC5C,MAAM,SAAS,IAAI,OAAO,WAAW;CACrC,MAAM,+BAAe,IAAI,SAA0C;CAEnE,MAAM,gBACJ,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU,QAAQ,MAAM;EAC3C,MAAM,MAAM,OAAO,QAAQ,YAAY,KAAA,IACnC,OAAO,QAAQ,KAAK,GACpB,YAAY,QAAQ,QAAQ;EAChC,MAAM,OAAO,OAAO,YAAY,QAAQ,QAAQ;EAEhD,MAAM,QAA6B;GACjC;GACA,KAAK,QAAQ,UAAU,OAAO,gBAAgB,MAAM,IAAI,UAAU,EAAE,CAAC;GACrE,KAAK,QAAQ,MAAM,QAAQ,IAAI,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;GAClD,KAAK,QAAQ,UAAU,MAAM,IAAI,WAAW,cAAc,EAAE,CAAC,CAAC;GAC9D,KAAK,QAAQ,SAAS,MAAM,IAAI,UAAU,OAAO,QAAQ,EAAE,CAAC,CAAC;GAC7D,KAAK,QAAQ,SAAS,MAAM,IAAI,UAAU,EAAE,GAAG,GAAG,CAAC,CAAC;GACpD;GACA;GACA,KAAK,QAAQ,UAAU,MAAO,EAAE,WAAW,IAAI,OAAO,YAAY,EAAE,CAAE;GACtE,KAAK,QAAQ,OAAO,MAAM,IAAI,QAAQ,EAAE,CAAC;GAC1C;EACD,MAAM,UAAUD,MAAI,OAAO,OAAO,EAAE,GAAmB,KAAK,SAAS,KAAK,IAAI,CAAC;AAC/E,SAAO;GAAE,GAAG;GAAY,GAAG;GAAS;GACpC;CAEJ,MAAM,cAAc,YAClB,OAAO,QAAQ,aAAa,QAAQ,GAAG,SACrC,OAAO,WAAW;EAAE,WAAWE,UAAe,OAAO,KAAK;EAAE,OAAO;EAAgB,CAAC,CACrF;CAEH,MAAM,cAAc,QAClB,OAAO,cAAc,IAAI,MAAM,CAAC,YAAY,KAAA,EAAU,CAAC,CAAC,KAAK,OAAO,OAAO;CAE7E,MAAM,mBAAmB,QACvB,OAAO,cAAc,IAAI,OAAO,CAAC,YAAY,KAAA,EAAU,CAAC,CAAC,KAAK,OAAO,OAAO;CAE9E,MAAM,eAAe,OACnB,OAAO,WAAW;EAChB,WAAWA,UAAe,QAAQ,IAAI,WAAW;EACjD,OAAO,eAAe,GAAG;EAC1B,CAAC,CAAC,KACD,OAAO,SAAS,QACd,OAAO,WAAW;EAAE,WAAW,IAAI,MAAM;EAAE,OAAO,eAAe,GAAG;EAAE,CAAC,CACxE,EACD,OAAO,SAAS,yBAAyB,OAAO,KAAK,CACtD;AAEH,QAAO;EACL,SAAS,YACP,OAAO,eAAe,WAAW,QAAQ,EAAE,WAAW,CAAC,KACrD,OAAO,KAAK,QAAQ,cAAc,KAAK,aAAa,CAAC,CACtD;EAEH,SAAS,OACP,OAAO,eACL,OAAO,WAAW;GAChB,WAAWA,UAAe,QAAQ,IAAI,WAAW;GACjD,OAAO,eAAe,GAAG;GAC1B,CAAC,EACF,gBACD,CAAC,KAAK,OAAO,KAAK,QAAQ,cAAc,KAAK,aAAa,CAAC,CAAC;EAE/D,MAAM,OAAO,WAAW;GACtB,WAAW,OAAO,UAAU,MAAM;GAClC,OAAO;GACR,CAAC,CAAC,KAAK,OAAO,IAAIF,MAAI,KAAK,OAAmB,EAAE,IAAI,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;EAE1E,SAAS;EAET,iBAAiB,UAAU,SACzB,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,QAAQ,gBAAgB,OAAO;AAKhD,UAAO,YAAW,OAJE,OAAO,WAAW;IACpC,WAAW,OAAO,QAAQ,SAAS,UAAU,EAAE,MAAM,UAAU,CAAC;IAChE,OAAO;IACR,CAAC,EACqB,KAAK;IAC5B;EAEJ,WAAW;GACT,cACE,OAAO,KACL,IAAI,aAAa,mBAAmB;IAClC,UAAU;IACV,YAAY;IACZ,QACE;IACH,CAAC,CACH;GACH,UAAU,QACR,OAAO,WAAW;IAChB,WAAW,OAAO,UAAU,OAAO,IAAI;IACvC,OAAO,eAAe,IAAI;IAC3B,CAAC;GACJ,MAAM,OAAO,OACX,OAAO,WAAW;IAChB,WAAW,OAAO,UAAU,MAAM;IAClC,OAAO;IACR,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,OAAO,kBAAkB,MAAM,eAAe,CAAC,CAAC,CAC9E,CAAC,KACA,OAAO,KAAK,UAAU;IAAE,IAAI,WAAW,KAAK,GAAG;IAAE,MAAM,KAAK;IAAM,EAAE,EACpE,OAAO,WACR;GACF;EAED,SAAS;GACP,SAAS,MAAM,YACb,OAAO,WAAW;IAChB,WACE,OAAO,QAAQ,OAAO;KACpB,MAAM;KAIN,QAAQ,OAAO,iBAAiB;KAChC,UAAU,SAAS,cAAc;KAClC,CAAC;IACJ,OAAO;IACR,CAAC,CAAC,KAAK,OAAO,KAAK,QAAQ,SAAS,IAAI,KAAK,CAAC,CAAC;GAClD,UAAU,QACR,OAAO,WAAW;IAChB,WAAW,OAAO,QAAQ,OAAO,IAAI;IACrC,OAAO,eAAe,IAAI;IAC3B,CAAC;GACJ,MAAM,OAAO,OACX,OAAO,WAAW;IAChB,WAAW,OAAO,QAAQ,MAAM;IAChC,OAAO;IACR,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,OAAO,kBAAkB,MAAM,eAAe,CAAC,CAAC,CAC9E,CAAC,KACA,OAAO,KAAK,SAAS;IAAE,IAAI,SAAS,IAAI,KAAK;IAAE,MAAM,IAAI;IAAM,EAAE,EACjE,OAAO,WACR;GACF;EAED,OAAO,EACL,SAAS,UAAU,SACjB,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,aAAa,IAAI,SAAS;AACtC,OAAI,QAAQ,KAAA,EACV,QAAO,OAAO,IAAI,aAAa,gBAAgB;IAAE,UAAU;IAAU,IAAI,SAAS;IAAI,CAAC;AAMzF,UAAO,EAAE,KAAA,OAJU,OAAO,WAAW;IACnC,WAAW,IAAI,WAAW,EAAE,MAAM,CAAC;IACnC,OAAO;IACR,CAAC,EACY;IACd,EACL;EACF;;AAQH,MAAM,sBACJ,YAEA,YAAY,KAAA,KAAa,CAAC,QAAQ,MAAM,MAAM,EAAE,WAAW,KAAA,EAAU,GACjE,OAAO,OACP,OAAO,KACL,IAAI,aAAa,mBAAmB;CAClC,UAAU;CACV,YAAY;CACZ,QACE;CACH,CAAC,CACH;AAEP,MAAM,iBAAiB,OAA2C;CAChE,GAAG;CACH,SAAS,YACP,mBAAmB,QAAQ,QAAQ,CAAC,KAClC,OAAO,QAAQ,EAAE,OAAO,QAAoC,CAAC,CAC9D;CACJ;;;;;;;;;;;;;;;;;;;;;;AA2BD,MAAa,SAAS,SAA4B,EAAE,KAAK;CACvD,MAAM,UAAU,aAAa,OAAO;AACpC,QAAO,MAAM,SACX,MAAM,QAAQ,aAAa,QAAQ,EACnC,MAAM,QAAQG,SAAa,cAAc,QAAQ,CAAC,EAClD,MAAM,QAAQ,0BAA0B,KAAA,EAAU,EAClD,MAAM,QAAQ,wBAAwB,KAAA,EAAU,EAChD,MAAM,QAAQ,kBAAkB,KAAA,EAAU,EAC1C,MAAM,QAAQ,gBAAgB,KAAA,EAAU,EACxC,MAAM,QAAQ,qBAAqB,KAAA,EAAU,CAC9C"}
+{"version":3,"file":"DenoSandbox.mjs","names":["Arr","CoreExecEvent","DenoSdkSandbox","CoreSandbox"],"sources":["../src/DenoSandbox.ts"],"sourcesContent":["import * as Memory from \"@effect-uai/core/Memory\"\nimport {\n  ExecEvent as CoreExecEvent,\n  Sandbox as CoreSandbox,\n  SandboxHostnameAllowlist,\n  SandboxPortExposure,\n  SandboxSecretInjection,\n  SandboxSnapshots,\n  SandboxVolumes,\n  type BoundSecret,\n  type CommonCreateRequest,\n  type CommonExecRequest,\n  type CommonSpawnRequest,\n  type ExecResult,\n  type ImageRef,\n  type NetworkPolicy,\n  type ProcessHandle,\n  SandboxId,\n  type SandboxInstance,\n  type SandboxRef,\n  type SandboxService,\n  SnapshotId,\n  VolumeId,\n} from \"@effect-uai/core/Sandbox\"\nimport * as SandboxError from \"@effect-uai/core/SandboxError\"\nimport {\n  Array as Arr,\n  Clock,\n  Context,\n  Duration,\n  Effect,\n  Layer,\n  Match,\n  Option,\n  Random,\n  Redacted,\n  Schedule,\n  Scope,\n  Stream,\n} from \"effect\"\nimport {\n  ApiError,\n  Client,\n  ConnectionClosedError,\n  ConnectionEstablishmentError,\n  InvalidMemoryError,\n  InvalidTimeoutError,\n  InvalidTokenError,\n  MissingTokenError,\n  Sandbox as DenoSdkSandbox,\n  SandboxCommandError,\n  SandboxKillError,\n  type ChildProcess as DenoChildProcess,\n  type SandboxOptions,\n  type SecretConfig,\n} from \"@deno/sandbox\"\n\nconst PROVIDER = \"deno\"\n\n// ---------------------------------------------------------------------------\n// Provider-narrowed request types.\n//\n// Deno's `secrets: Record<name, SecretConfig>` shape has no per-secret\n// custom header — substitution is always \"Authorization: Bearer <value>\".\n// We omit `header` on the typed surface (row B) and reject at the upcast\n// adapter (row D) if a caller routes through the generic `Sandbox.create`.\n// ---------------------------------------------------------------------------\n\nexport type DenoSandboxBoundSecret = Omit<BoundSecret, \"header\">\n\nexport type DenoRegion = \"ord\" | \"ams\"\n\nexport type DenoSandboxCreateRequest = Omit<CommonCreateRequest, \"secrets\"> & {\n  readonly secrets?: ReadonlyArray<DenoSandboxBoundSecret>\n  readonly region?: DenoRegion\n  /**\n   * Memory size for the sandbox. Accepts a byte count, a {@link Memory.Memory},\n   * or a human string like `\"1280 MiB\"` / `\"1 GiB\"`. Deno's accepted\n   * range at GA is 768 MiB – 4 GiB (default 1280 MiB).\n   */\n  readonly memory?: Memory.Input\n  readonly labels?: Readonly<Record<string, string>>\n  /** Auto-expose this port at boot; the live sandbox's `url` reaches it. */\n  readonly port?: number\n}\n\nexport type DenoSandboxConfig = {\n  /** Overrides `DENO_DEPLOY_TOKEN`. */\n  readonly token?: Redacted.Redacted<string>\n  /** Overrides `DENO_DEPLOY_ORG`. Required for personal `ddp_` tokens. */\n  readonly org?: string\n  /** Overrides `DENO_DEPLOY_ENDPOINT`. */\n  readonly apiEndpoint?: string\n  /** Default region when create requests omit one. */\n  readonly defaultRegion?: DenoRegion\n}\n\n/**\n * Deno-narrowed service. `create` accepts the narrowed\n * {@link DenoSandboxCreateRequest}; every other method is identical to\n * the generic {@link SandboxService} except for the per-provider\n * `snapshotVolume` escape hatch — Deno snapshots are derived from\n * volumes, not from live sandboxes, so the generic\n * `Sandbox.snapshots.create(fromInstance)` doesn't fit and fails with\n * `SandboxUnsupported`.\n */\nexport type DenoSandboxService = Omit<SandboxService, \"create\"> & {\n  readonly create: (\n    request: DenoSandboxCreateRequest,\n  ) => Effect.Effect<SandboxInstance, SandboxError.SandboxError, Scope.Scope>\n  /**\n   * Snapshot an existing volume by id/slug. Deno's snapshot model is\n   * volume-derived, so the generic `Sandbox.snapshots.create` doesn't\n   * apply — use this escape hatch instead. The volume must not be\n   * attached to any running sandbox at the time of snapshot.\n   */\n  readonly snapshotVolume: (\n    volumeId: VolumeId,\n    slug?: string,\n  ) => Effect.Effect<SnapshotId, SandboxError.SandboxError>\n}\n\nexport class DenoSandbox extends Context.Service<DenoSandbox, DenoSandboxService>()(\n  \"@betalyra/effect-uai/providers/deno/DenoSandbox\",\n) {}\n\n// ---------------------------------------------------------------------------\n// Effect-native primitives\n// ---------------------------------------------------------------------------\n\n/** Random base-36 token, ~8 chars. */\nconst randomToken = Random.next.pipe(Effect.map((r) => r.toString(36).slice(2, 10)))\n\n// ---------------------------------------------------------------------------\n// Error mapping\n// ---------------------------------------------------------------------------\n\nconst reasonOf = (e: unknown) => (e instanceof Error ? { reason: e.message } : {})\n\nconst isAuthError = (e: unknown): boolean =>\n  e instanceof MissingTokenError ||\n  e instanceof InvalidTokenError ||\n  (e instanceof ApiError && (e.status === 401 || e.status === 403)) ||\n  (e instanceof ConnectionEstablishmentError && (e.status === 401 || e.status === 403))\n\nconst isQuotaError = (e: unknown): boolean =>\n  (e instanceof ApiError && e.status === 429) ||\n  (e instanceof ConnectionEstablishmentError && e.status === 429)\n\n/**\n * \"Sandbox is no longer reachable\" — covers both the 404 (never existed)\n * and the 400 + `SANDBOX_ALREADY_TERMINATED` case the API returns when\n * you `connect` to a sandbox after its `kill`. Both map to\n * `SandboxNotFound` so `destroy` and friends stay idempotent.\n */\nconst isNotFoundError = (e: unknown): boolean =>\n  (e instanceof ApiError && (e.status === 404 || e.code === \"SANDBOX_ALREADY_TERMINATED\")) ||\n  (e instanceof ConnectionEstablishmentError &&\n    (e.status === 404 || e.code === \"SANDBOX_ALREADY_TERMINATED\"))\n\nconst mapCreateError = (e: unknown): SandboxError.SandboxError =>\n  isAuthError(e)\n    ? new SandboxError.SandboxAuthFailed({ provider: PROVIDER, subtype: \"auth\", raw: e })\n    : isQuotaError(e)\n      ? new SandboxError.SandboxQuotaExceeded({\n          provider: PROVIDER,\n          raw: e,\n          ...reasonOf(e),\n        })\n      : e instanceof InvalidTimeoutError || e instanceof InvalidMemoryError\n        ? new SandboxError.SandboxInvalidRequest({\n            provider: PROVIDER,\n            raw: e,\n            ...reasonOf(e),\n          })\n        : new SandboxError.SandboxCreateFailed({\n            provider: PROVIDER,\n            raw: e,\n            ...reasonOf(e),\n          })\n\nconst mapLookupError =\n  (id: string) =>\n  (e: unknown): SandboxError.SandboxError =>\n    isNotFoundError(e)\n      ? new SandboxError.SandboxNotFound({ provider: PROVIDER, id })\n      : mapCreateError(e)\n\nconst mapExecError = (e: unknown): SandboxError.SandboxError =>\n  e instanceof SandboxCommandError\n    ? new SandboxError.SandboxExecFailed({\n        provider: PROVIDER,\n        raw: e,\n        reason: e.message,\n      })\n    : e instanceof ConnectionClosedError\n      ? new SandboxError.SandboxExecFailed({\n          provider: PROVIDER,\n          raw: e,\n          reason: e.reason ?? \"connection closed\",\n        })\n      : new SandboxError.SandboxExecFailed({\n          provider: PROVIDER,\n          raw: e,\n          ...reasonOf(e),\n        })\n\nconst mapFsError = (e: unknown): SandboxError.SandboxError =>\n  new SandboxError.SandboxExecFailed({\n    provider: PROVIDER,\n    raw: e,\n    ...reasonOf(e),\n  })\n\n// ---------------------------------------------------------------------------\n// Transient WebSocket handshake failures.\n//\n// Empirically (SDK 0.13.2): `sdk.spawn` opens a per-process WebSocket\n// to the sandbox-side relay. The Deploy edge intermittently returns\n// `500 SANDBOX_WEBSOCKET_HANDSHAKE_ERROR` on this handshake; the next\n// attempt against the same sandbox typically succeeds. Retry narrowly\n// on that specific code rather than blanketing all 5xx — most are not\n// transient.\n//\n// Budget: 3 attempts ≈ 500+1000+2000 = 3.5s on top of the original\n// call, well under the 120s test timeout.\n// ---------------------------------------------------------------------------\n\nconst isTransientWsHandshake = (e: SandboxError.SandboxError) =>\n  (e._tag === \"SandboxExecFailed\" || e._tag === \"SandboxCreateFailed\") &&\n  e.raw instanceof ConnectionEstablishmentError &&\n  e.raw.code === \"SANDBOX_WEBSOCKET_HANDSHAKE_ERROR\"\n\nconst wsHandshakeSchedule = Schedule.exponential(\"500 millis\")\nconst WS_HANDSHAKE_RETRIES = 3\n\nconst retryOnTransientWs = <A, R>(\n  effect: Effect.Effect<A, SandboxError.SandboxError, R>,\n): Effect.Effect<A, SandboxError.SandboxError, R> =>\n  Effect.retry(effect, {\n    schedule: wsHandshakeSchedule,\n    times: WS_HANDSHAKE_RETRIES,\n    while: isTransientWsHandshake,\n  })\n\n// ---------------------------------------------------------------------------\n// Builder pipeline — a `Step` mutates `SandboxOptions`. Deno's create\n// API is a plain options object (no builder fluent API), so each Step\n// returns a partial overlay; the create flow folds them into the base.\n// Keeping the same shape as microsandbox's `Step` pattern means optional\n// fields read uniformly.\n// ---------------------------------------------------------------------------\n\ntype OptionsPatch = Partial<SandboxOptions>\ntype Step = (patch: OptionsPatch) => OptionsPatch\n\nconst noop: Step = (p) => p\n\nconst when = <A>(value: A | undefined, step: (a: A) => Step): Step =>\n  value === undefined ? noop : step(value)\n\nconst set =\n  <K extends keyof SandboxOptions>(key: K, value: SandboxOptions[K]): Step =>\n  (p) => ({ ...p, [key]: value })\n\n// ---------------------------------------------------------------------------\n// Duration → Deno timeout format (\"30s\"). Deno's `create.timeout`\n// accepts `\"session\" | \"${number}s\" | \"${number}m\"`; we always emit\n// `<seconds>s` since seconds is the most precise unit honored.\n// ---------------------------------------------------------------------------\n\nconst toDenoSeconds = (d: Duration.Input): `${number}s` => {\n  const secs = Math.max(1, Math.ceil(Duration.toMillis(Duration.fromInputUnsafe(d)) / 1000))\n  return `${secs}s`\n}\n\n// ---------------------------------------------------------------------------\n// ImageRef → Step. Default omits `root`; Snapshot sets it; Registry /\n// Dockerfile are unsupported and fail at decode.\n// ---------------------------------------------------------------------------\n\nconst imageStep = (image: ImageRef | undefined): Effect.Effect<Step, SandboxError.SandboxError> => {\n  if (image === undefined) return Effect.succeed(noop)\n  return Match.value(image).pipe(\n    Match.tag(\"Default\", (): Effect.Effect<Step, SandboxError.SandboxError> =>\n      Effect.succeed(noop),\n    ),\n    Match.tag(\"Snapshot\", ({ id }): Effect.Effect<Step, SandboxError.SandboxError> =>\n      Effect.succeed(set(\"root\", id)),\n    ),\n    Match.tag(\"Registry\", (): Effect.Effect<Step, SandboxError.SandboxError> =>\n      Effect.fail(\n        new SandboxError.SandboxUnsupported({\n          provider: PROVIDER,\n          capability: \"image.registry\",\n          reason: \"deno sandboxes do not accept OCI registry refs — boot from a snapshot instead\",\n        }),\n      ),\n    ),\n    Match.tag(\"Dockerfile\", (): Effect.Effect<Step, SandboxError.SandboxError> =>\n      Effect.fail(\n        new SandboxError.SandboxUnsupported({\n          provider: PROVIDER,\n          capability: \"image.dockerfile\",\n          reason:\n            \"deno sandboxes do not accept Dockerfiles — install software into a bootable volume then snapshot it\",\n        }),\n      ),\n    ),\n    Match.exhaustive,\n  )\n}\n\n// ---------------------------------------------------------------------------\n// NetworkPolicy → Step. Deno accepts hostnames + literal IPs but no\n// CIDR ranges; reject `cidrs` rather than silently dropping. `Blocked`\n// encodes as empty allowlist; `Open` omits the field.\n// ---------------------------------------------------------------------------\n\nconst networkStep = (policy: NetworkPolicy): Effect.Effect<Step, SandboxError.SandboxError> =>\n  Match.value(policy).pipe(\n    Match.tag(\"Open\", (): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(noop)),\n    Match.tag(\"Blocked\", (): Effect.Effect<Step, SandboxError.SandboxError> =>\n      Effect.succeed(set(\"allowNet\", [])),\n    ),\n    Match.tag(\"Allowlist\", ({ hosts, cidrs }): Effect.Effect<Step, SandboxError.SandboxError> =>\n      cidrs !== undefined && cidrs.length > 0\n        ? Effect.fail(\n            new SandboxError.SandboxUnsupported({\n              provider: PROVIDER,\n              capability: \"network.cidrs\",\n              reason:\n                \"deno's allowNet accepts hostnames or literal IPs, not CIDR ranges — use hosts instead\",\n            }),\n          )\n        : Effect.succeed(set(\"allowNet\", [...(hosts ?? [])])),\n    ),\n    Match.exhaustive,\n  )\n\n// ---------------------------------------------------------------------------\n// Volumes → Step. Deno mounts read-write only; reject `readonly: true`.\n// ---------------------------------------------------------------------------\n\nconst volumesStep = (\n  volumes: CommonCreateRequest[\"volumes\"],\n): Effect.Effect<Step, SandboxError.SandboxError> => {\n  if (volumes === undefined || volumes.length === 0) return Effect.succeed(noop)\n  if (volumes.some((v) => v.readonly === true)) {\n    return Effect.fail(\n      new SandboxError.SandboxUnsupported({\n        provider: PROVIDER,\n        capability: \"volumes.readonly\",\n        reason: \"deno mounts volumes read-write — read-only mounts are not supported\",\n      }),\n    )\n  }\n  const map = Arr.reduce(volumes, {} as Record<string, string>, (acc, v) => {\n    acc[v.mountPath] = v.id\n    return acc\n  })\n  return Effect.succeed(set(\"volumes\", map))\n}\n\n// ---------------------------------------------------------------------------\n// Secrets → Step. Stays sync — no decode-time failure modes (custom\n// header is rejected upstream in the upcast).\n// ---------------------------------------------------------------------------\n\nconst secretsStep = (secrets: ReadonlyArray<DenoSandboxBoundSecret>): Step => {\n  const record = Arr.reduce(secrets, {} as Record<string, SecretConfig>, (acc, s) => {\n    acc[s.name] = { hosts: [...s.hosts], value: Redacted.value(s.value) }\n    return acc\n  })\n  return set(\"secrets\", record)\n}\n\n// ---------------------------------------------------------------------------\n// Base client options used for both client construction and per-call\n// overrides. `token` is a Redacted — we unwrap at the SDK boundary.\n// ---------------------------------------------------------------------------\n\nconst baseClientOptions = (config: DenoSandboxConfig): SandboxOptions => ({\n  ...(config.token === undefined ? {} : { token: Redacted.value(config.token) }),\n  ...(config.org === undefined ? {} : { org: config.org }),\n  ...(config.apiEndpoint === undefined ? {} : { apiEndpoint: config.apiEndpoint }),\n})\n\n// ---------------------------------------------------------------------------\n// argv splitter. Deno's `spawn(command, { args })` is direct argv only —\n// for `cmd: string` (shell semantics) we route through `bash -c`.\n// ---------------------------------------------------------------------------\n\nconst argv = (\n  cmd: CommonExecRequest[\"cmd\"],\n): Effect.Effect<\n  { readonly command: string; readonly args: ReadonlyArray<string> },\n  SandboxError.SandboxError\n> =>\n  typeof cmd === \"string\"\n    ? Effect.succeed({ command: \"bash\", args: [\"-c\", cmd] })\n    : Option.match(Arr.head(cmd), {\n        onNone: () =>\n          Effect.fail(\n            new SandboxError.SandboxInvalidRequest({\n              provider: PROVIDER,\n              param: \"cmd\",\n              reason: \"argv array must be non-empty\",\n            }),\n          ),\n        onSome: (head) => Effect.succeed({ command: head, args: Arr.drop(cmd, 1) }),\n      })\n\n// ---------------------------------------------------------------------------\n// AbortController scoped to the caller. On scope close we abort, which\n// signals the SDK to terminate the in-flight call. This is the kill-\n// switch the SDK responds to.\n// ---------------------------------------------------------------------------\n\nconst acquireAbortController: Effect.Effect<AbortController, never, Scope.Scope> =\n  Effect.acquireRelease(\n    Effect.sync(() => new AbortController()),\n    (ac) => Effect.sync(() => ac.abort()),\n  )\n\n// ---------------------------------------------------------------------------\n// stdin helpers\n// ---------------------------------------------------------------------------\n\nconst stdinIsStream = (\n  stdin: CommonSpawnRequest[\"stdin\"],\n): stdin is Stream.Stream<Uint8Array, never, never> =>\n  stdin !== undefined && typeof stdin !== \"string\" && !(stdin instanceof Uint8Array)\n\n/**\n * Copy into a fresh `Uint8Array<ArrayBuffer>`. The Deno SDK strictly\n * types its bytes argument as `Uint8Array<ArrayBuffer>` (not the\n * `ArrayBufferLike` upper bound), so `TextEncoder`-produced bytes and\n * caller-supplied Uint8Arrays need to be copied to a guaranteed-\n * `ArrayBuffer`-backed buffer to satisfy the type.\n */\nconst toBytes = (input: Uint8Array | string): Uint8Array<ArrayBuffer> => {\n  const src = typeof input === \"string\" ? new TextEncoder().encode(input) : input\n  const out = new Uint8Array(new ArrayBuffer(src.byteLength))\n  out.set(src)\n  return out\n}\n\n/**\n * Acquire the child's stdin writer, run `use(writer)`, then close the\n * writer on release (regardless of success / failure / interrupt).\n * Returns `Effect.void` if the child wasn't spawned with `stdin: \"piped\"`.\n */\nconst withStdinWriter = <A, E, R>(\n  child: DenoChildProcess,\n  use: (writer: WritableStreamDefaultWriter<Uint8Array>) => Effect.Effect<A, E, R>,\n): Effect.Effect<void | A, E | SandboxError.SandboxError, R> => {\n  const stdin = child.stdin\n  if (stdin === null) return Effect.void\n  return Effect.acquireUseRelease(\n    Effect.sync(() => stdin.getWriter()),\n    use,\n    (writer) => Effect.promise(() => writer.close().catch(() => undefined)).pipe(Effect.ignore),\n  )\n}\n\nconst writeStdinBytes = (\n  child: DenoChildProcess,\n  bytes: Uint8Array,\n): Effect.Effect<void, SandboxError.SandboxError> =>\n  withStdinWriter(child, (writer) =>\n    Effect.tryPromise({ try: () => writer.write(bytes), catch: mapExecError }),\n  ).pipe(Effect.asVoid)\n\nconst feedStreamStdin = (\n  child: DenoChildProcess,\n  source: Stream.Stream<Uint8Array, never, never>,\n): Effect.Effect<void, SandboxError.SandboxError> =>\n  withStdinWriter(child, (writer) =>\n    Stream.runForEach(source, (chunk) =>\n      Effect.tryPromise({ try: () => writer.write(chunk), catch: mapExecError }),\n    ),\n  ).pipe(Effect.asVoid)\n\n// ---------------------------------------------------------------------------\n// ReadableStream<Uint8Array> → Stream<Uint8Array>.\n// ---------------------------------------------------------------------------\n\nconst streamFromReadable = (\n  readable: ReadableStream<Uint8Array>,\n): Stream.Stream<Uint8Array, SandboxError.SandboxError> =>\n  Stream.fromReadableStream({\n    evaluate: () => readable,\n    onError: mapExecError,\n  })\n\n// ---------------------------------------------------------------------------\n// Merge stdout + stderr into a tagged ExecEvent stream terminated by a\n// single Complete event derived from `child.status`.\n// ---------------------------------------------------------------------------\n\nconst eventStream = (\n  child: DenoChildProcess,\n  startedAt: number,\n): Stream.Stream<CoreExecEvent, SandboxError.SandboxError> => {\n  const stdout: Stream.Stream<CoreExecEvent, SandboxError.SandboxError> =\n    child.stdout === null\n      ? Stream.empty\n      : Stream.map(streamFromReadable(child.stdout), (chunk) => CoreExecEvent.Stdout({ chunk }))\n  const stderr: Stream.Stream<CoreExecEvent, SandboxError.SandboxError> =\n    child.stderr === null\n      ? Stream.empty\n      : Stream.map(streamFromReadable(child.stderr), (chunk) => CoreExecEvent.Stderr({ chunk }))\n  const complete: Stream.Stream<CoreExecEvent, SandboxError.SandboxError> = Stream.unwrap(\n    Effect.gen(function* () {\n      const status = yield* Effect.tryPromise({ try: () => child.status, catch: mapExecError })\n      const now = yield* Clock.currentTimeMillis\n      return Stream.succeed(\n        CoreExecEvent.Complete({ exitCode: status.code, durationMs: now - startedAt }),\n      )\n    }),\n  )\n  return Stream.concat(Stream.merge(stdout, stderr), complete)\n}\n\n// ---------------------------------------------------------------------------\n// Per-exec timeout. Races against `Effect.sleep` so the parent scope\n// finalizers (which kill the child via `acquireRelease`) fire on breach.\n// We don't lean on `Effect.timeout` because it returns `Option`-shaped\n// fallbacks in v4; the race-based shape lets us keep the SandboxError\n// channel directly.\n// ---------------------------------------------------------------------------\n\nconst withExecTimeout = <A, R>(\n  timeout: Duration.Input | undefined,\n  effect: Effect.Effect<A, SandboxError.SandboxError, R>,\n): Effect.Effect<A, SandboxError.SandboxError, R> =>\n  timeout === undefined\n    ? effect\n    : Effect.race(\n        effect,\n        Effect.sleep(timeout).pipe(\n          Effect.andThen(\n            Effect.fail(\n              new SandboxError.SandboxTimeout({\n                provider: PROVIDER,\n                operation: \"exec\",\n                budget: Duration.fromInputUnsafe(timeout),\n              }),\n            ),\n          ),\n        ),\n      )\n\n// ---------------------------------------------------------------------------\n// Live SandboxInstance adapter. The `WeakMap<SandboxInstance, sdk>`\n// passed in is the back-reference used by the port-exposure sub-API\n// to recover the SDK handle from an opaque `SandboxInstance`.\n// ---------------------------------------------------------------------------\n\nconst adaptInstance = (\n  sdk: DenoSdkSandbox,\n  portRegistry: WeakMap<SandboxInstance, DenoSdkSandbox>,\n): SandboxInstance => {\n  const id = SandboxId(sdk.id)\n\n  const openProcess = (request: CommonSpawnRequest) =>\n    Effect.gen(function* () {\n      const { command, args } = yield* argv(request.cmd)\n      const ac = yield* acquireAbortController\n      const stdinMode: \"piped\" | \"null\" = request.stdin === undefined ? \"null\" : \"piped\"\n      const startedAt = yield* Clock.currentTimeMillis\n      const child = yield* Effect.acquireRelease(\n        retryOnTransientWs(\n          Effect.tryPromise({\n            try: () =>\n              sdk.spawn(command, {\n                args: [...args],\n                ...(request.cwd === undefined ? {} : { cwd: request.cwd }),\n                ...(request.env === undefined ? {} : { env: { ...request.env } }),\n                stdin: stdinMode,\n                stdout: \"piped\",\n                stderr: \"piped\",\n                signal: ac.signal,\n              }),\n            catch: mapExecError,\n          }),\n        ),\n        (c) => Effect.promise(() => c.kill(\"SIGKILL\").catch(() => undefined)).pipe(Effect.ignore),\n      )\n      if (request.stdin !== undefined) {\n        if (stdinIsStream(request.stdin)) {\n          yield* Effect.forkScoped(feedStreamStdin(child, request.stdin))\n        } else {\n          yield* writeStdinBytes(child, toBytes(request.stdin))\n        }\n      }\n      return { child, startedAt }\n    })\n\n  const instance: SandboxInstance = {\n    id,\n\n    exec: (request) =>\n      withExecTimeout(\n        request.timeout,\n        Effect.scoped(\n          Effect.gen(function* () {\n            const { child, startedAt } = yield* openProcess(request)\n            const output = yield* Effect.tryPromise({\n              try: () => child.output(),\n              catch: mapExecError,\n            })\n            const completedAt = yield* Clock.currentTimeMillis\n            return {\n              exitCode: output.status.code,\n              stdout: output.stdoutText ?? \"\",\n              stderr: output.stderrText ?? \"\",\n              durationMs: completedAt - startedAt,\n            } satisfies ExecResult\n          }),\n        ),\n      ),\n\n    execStream: (request) =>\n      Stream.unwrap(\n        Effect.map(openProcess(request), ({ child, startedAt }) => eventStream(child, startedAt)),\n      ),\n\n    spawn: (request) =>\n      Effect.map(openProcess(request), ({ child, startedAt }): ProcessHandle => ({\n        pid: child.pid,\n        events: eventStream(child, startedAt),\n        kill: Effect.tryPromise({\n          try: () => child.kill(\"SIGTERM\"),\n          catch: mapExecError,\n        }),\n        exit: Effect.tryPromise({\n          try: () => child.status,\n          catch: mapExecError,\n        }).pipe(Effect.map((status) => ({ exitCode: status.code }))),\n      })),\n\n    files: {\n      read: (path) => Effect.tryPromise({ try: () => sdk.fs.readFile(path), catch: mapFsError }),\n      write: (path, contents) =>\n        Effect.tryPromise({\n          try: () => sdk.fs.writeFile(path, toBytes(contents)),\n          catch: mapFsError,\n        }),\n      remove: (path) => Effect.tryPromise({ try: () => sdk.fs.remove(path), catch: mapFsError }),\n      mkdir: (path) =>\n        Effect.tryPromise({\n          try: () => sdk.fs.mkdir(path, { recursive: true }),\n          catch: mapFsError,\n        }),\n      list: (path) =>\n        Stream.fromAsyncIterable(sdk.fs.readDir(path), mapFsError).pipe(\n          Stream.map((e) => ({\n            path: e.name,\n            kind: e.isFile\n              ? (\"file\" as const)\n              : e.isDirectory\n                ? (\"directory\" as const)\n                : e.isSymlink\n                  ? (\"symlink\" as const)\n                  : (\"other\" as const),\n          })),\n          Stream.runCollect,\n        ),\n      exists: (path) =>\n        Effect.tryPromise({\n          try: () => sdk.fs.stat(path),\n          catch: mapFsError,\n        }).pipe(\n          Effect.as(true),\n          Effect.catchCause(() => Effect.succeed(false)),\n        ),\n    },\n  }\n\n  portRegistry.set(instance, sdk)\n  return instance\n}\n\n// ---------------------------------------------------------------------------\n// Service factory\n// ---------------------------------------------------------------------------\n\nconst buildService = (config: DenoSandboxConfig): DenoSandboxService => {\n  const clientOpts = baseClientOptions(config)\n  const client = new Client(clientOpts)\n  const portRegistry = new WeakMap<SandboxInstance, DenoSdkSandbox>()\n\n  const buildOptions = (\n    request: DenoSandboxCreateRequest,\n  ): Effect.Effect<SandboxOptions, SandboxError.SandboxError> =>\n    Effect.gen(function* () {\n      const img = yield* imageStep(request.image)\n      const net = yield* request.network === undefined\n        ? Effect.succeed(noop)\n        : networkStep(request.network)\n      const vols = yield* volumesStep(request.volumes)\n\n      const steps: ReadonlyArray<Step> = [\n        img,\n        when(request.region ?? config.defaultRegion, (r) => set(\"region\", r)),\n        when(request.env, (env) => set(\"env\", { ...env })),\n        when(request.timeout, (t) => set(\"timeout\", toDenoSeconds(t))),\n        when(request.memory, (m) => set(\"memory\", Memory.toBytes(m))),\n        when(request.labels, (l) => set(\"labels\", { ...l })),\n        net,\n        vols,\n        when(request.secrets, (s) => (s.length === 0 ? noop : secretsStep(s))),\n        when(request.port, (p) => set(\"port\", p)),\n      ]\n      const overlay = Arr.reduce(steps, {} as OptionsPatch, (acc, step) => step(acc))\n      return { ...clientOpts, ...overlay }\n    })\n\n  const acquireSdk = (request: DenoSandboxCreateRequest) =>\n    Effect.flatMap(buildOptions(request), (opts) =>\n      Effect.tryPromise({ try: () => DenoSdkSandbox.create(opts), catch: mapCreateError }),\n    )\n\n  const releaseSdk = (sdk: DenoSdkSandbox) =>\n    Effect.promise(() => sdk.kill().catch(() => undefined)).pipe(Effect.ignore)\n\n  const releaseAttached = (sdk: DenoSdkSandbox) =>\n    Effect.promise(() => sdk.close().catch(() => undefined)).pipe(Effect.ignore)\n\n  const destroyById = (id: SandboxId) =>\n    Effect.tryPromise({\n      try: () => DenoSdkSandbox.connect(id, clientOpts),\n      catch: mapLookupError(id),\n    }).pipe(\n      Effect.flatMap((sdk) =>\n        Effect.tryPromise({ try: () => sdk.kill(), catch: mapLookupError(id) }),\n      ),\n      Effect.catchTag(\"SandboxNotFound\", () => Effect.void),\n    )\n\n  return {\n    create: (request) =>\n      Effect.acquireRelease(acquireSdk(request), releaseSdk).pipe(\n        Effect.map((sdk) => adaptInstance(sdk, portRegistry)),\n      ),\n\n    attach: (id) =>\n      Effect.acquireRelease(\n        Effect.tryPromise({\n          try: () => DenoSdkSandbox.connect(id, clientOpts),\n          catch: mapLookupError(id),\n        }),\n        releaseAttached,\n      ).pipe(Effect.map((sdk) => adaptInstance(sdk, portRegistry))),\n\n    list: Effect.tryPromise({\n      try: () => client.sandboxes.list(),\n      catch: mapCreateError,\n    }).pipe(Effect.map(Arr.map((m): SandboxRef => ({ id: SandboxId(m.id) })))),\n\n    destroy: destroyById,\n\n    snapshotVolume: (volumeId, slug) =>\n      Effect.gen(function* () {\n        const snapSlug = slug ?? `eff-uai-snap-${yield* randomToken}`\n        const snap = yield* Effect.tryPromise({\n          try: () => client.volumes.snapshot(volumeId, { slug: snapSlug }),\n          catch: mapCreateError,\n        })\n        return SnapshotId(snap.slug)\n      }),\n\n    snapshots: {\n      create: () =>\n        Effect.fail(\n          new SandboxError.SandboxUnsupported({\n            provider: PROVIDER,\n            capability: \"snapshots.create\",\n            reason:\n              \"deno snapshots are derived from volumes, not from running sandboxes — use DenoSandbox.snapshotVolume(volumeId, slug?) instead\",\n          }),\n        ),\n      destroy: (sid) =>\n        Effect.tryPromise({\n          try: () => client.snapshots.delete(sid),\n          catch: mapLookupError(sid),\n        }),\n      list: Stream.unwrap(\n        Effect.tryPromise({\n          try: () => client.snapshots.list(),\n          catch: mapCreateError,\n        }).pipe(Effect.map((page) => Stream.fromAsyncIterable(page, mapCreateError))),\n      ).pipe(\n        Stream.map((snap) => ({ id: SnapshotId(snap.id), name: snap.slug })),\n        Stream.runCollect,\n      ),\n    },\n\n    volumes: {\n      create: (name, options) =>\n        Effect.tryPromise({\n          try: () =>\n            client.volumes.create({\n              slug: name,\n              // Volumes are only available in `ord` at the moment.\n              // Callers needing a different region can pre-create via\n              // the SDK directly.\n              region: config.defaultRegion ?? \"ord\",\n              capacity: options?.quotaBytes ?? \"1GB\",\n            }),\n          catch: mapCreateError,\n        }).pipe(Effect.map((vol) => VolumeId(vol.slug))),\n      destroy: (vid) =>\n        Effect.tryPromise({\n          try: () => client.volumes.delete(vid),\n          catch: mapLookupError(vid),\n        }),\n      list: Stream.unwrap(\n        Effect.tryPromise({\n          try: () => client.volumes.list(),\n          catch: mapCreateError,\n        }).pipe(Effect.map((page) => Stream.fromAsyncIterable(page, mapCreateError))),\n      ).pipe(\n        Stream.map((vol) => ({ id: VolumeId(vol.slug), name: vol.slug })),\n        Stream.runCollect,\n      ),\n    },\n\n    ports: {\n      expose: (instance, port) =>\n        Effect.gen(function* () {\n          const sdk = portRegistry.get(instance)\n          if (sdk === undefined) {\n            return yield* new SandboxError.SandboxNotFound({ provider: PROVIDER, id: instance.id })\n          }\n          const url = yield* Effect.tryPromise({\n            try: () => sdk.exposeHttp({ port }),\n            catch: mapExecError,\n          })\n          return { url }\n        }),\n    },\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Cross-provider upcast — reject custom header on BoundSecret since\n// Deno doesn't support per-secret headers.\n// ---------------------------------------------------------------------------\n\nconst rejectCustomHeader = (\n  secrets: CommonCreateRequest[\"secrets\"],\n): Effect.Effect<void, SandboxError.SandboxError> =>\n  secrets === undefined || !secrets.some((s) => s.header !== undefined)\n    ? Effect.void\n    : Effect.fail(\n        new SandboxError.SandboxUnsupported({\n          provider: PROVIDER,\n          capability: \"BoundSecret.header\",\n          reason:\n            \"deno always injects secrets as `Authorization: Bearer <value>` — custom headers aren't supported. Use the narrowed `DenoSandbox.create` surface, which omits this field.\",\n        }),\n      )\n\nconst upcastService = (s: DenoSandboxService): SandboxService => ({\n  ...s,\n  create: (request) =>\n    rejectCustomHeader(request.secrets).pipe(\n      Effect.andThen(s.create(request as DenoSandboxCreateRequest)),\n    ),\n})\n\n// ---------------------------------------------------------------------------\n// Layer\n// ---------------------------------------------------------------------------\n\n/**\n * Layer registering the Deno Sandbox adapter against `Sandbox`, with\n * the capability markers Deno actually supports.\n *\n * Shipped:\n * - {@link SandboxHostnameAllowlist} — `allowNet` accepts hostnames + wildcards.\n * - {@link SandboxSecretInjection} — `secrets.<name>.value` is injected\n *   only on outbound HTTPS to bound hosts; in-VM env shows a placeholder.\n * - {@link SandboxSnapshots} — read-side helpers (`list`, `destroy`)\n *   work. `snapshots.create(fromInstance)` fails with\n *   `SandboxUnsupported`; use the per-provider\n *   `DenoSandbox.snapshotVolume` escape hatch for the volume-derived\n *   snapshot workflow.\n * - {@link SandboxVolumes} — `client.volumes.*` directly.\n * - {@link SandboxPortExposure} — `sandbox.exposeHttp({ port })`.\n *\n * NOT shipped (calling those helpers fails at compile time):\n * - `SandboxCustomImage` — no Dockerfile / no OCI registry refs.\n * - `SandboxPauseResume` — Deno doesn't offer in-place memory-preserving pause.\n * - `SandboxKernelSession`, `SandboxPty` — no Jupyter / no PTY.\n */\nexport const layer = (config: DenoSandboxConfig = {}) => {\n  const service = buildService(config)\n  return Layer.mergeAll(\n    Layer.succeed(DenoSandbox, service),\n    Layer.succeed(CoreSandbox, upcastService(service)),\n    Layer.succeed(SandboxHostnameAllowlist, undefined),\n    Layer.succeed(SandboxSecretInjection, undefined),\n    Layer.succeed(SandboxSnapshots, undefined),\n    Layer.succeed(SandboxVolumes, undefined),\n    Layer.succeed(SandboxPortExposure, undefined),\n  )\n}\n\n// Re-export SDK error classes so consumers don't need a direct\n// dependency on `@deno/sandbox` to do error-shape-narrowed handling.\nexport {\n  ApiError,\n  ConnectionClosedError,\n  ConnectionEstablishmentError,\n  InvalidMemoryError,\n  InvalidTimeoutError,\n  InvalidTokenError,\n  MissingTokenError,\n  SandboxCommandError,\n  SandboxKillError,\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyDA,MAAM,WAAW;AAiEjB,IAAa,cAAb,cAAiC,QAAQ,QAAyC,CAAC,CACjF,iDACF,CAAC,CAAC,CAAC;;AAOH,MAAM,cAAc,OAAO,KAAK,KAAK,OAAO,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAMnF,MAAM,YAAY,MAAgB,aAAa,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAEhF,MAAM,eAAe,MACnB,aAAa,qBACb,aAAa,qBACZ,aAAa,aAAa,EAAE,WAAW,OAAO,EAAE,WAAW,QAC3D,aAAa,iCAAiC,EAAE,WAAW,OAAO,EAAE,WAAW;AAElF,MAAM,gBAAgB,MACnB,aAAa,YAAY,EAAE,WAAW,OACtC,aAAa,gCAAgC,EAAE,WAAW;;;;;;;AAQ7D,MAAM,mBAAmB,MACtB,aAAa,aAAa,EAAE,WAAW,OAAO,EAAE,SAAS,iCACzD,aAAa,iCACX,EAAE,WAAW,OAAO,EAAE,SAAS;AAEpC,MAAM,kBAAkB,MACtB,YAAY,CAAC,IACT,IAAI,aAAa,kBAAkB;CAAE,UAAU;CAAU,SAAS;CAAQ,KAAK;AAAE,CAAC,IAClF,aAAa,CAAC,IACZ,IAAI,aAAa,qBAAqB;CACpC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,CAAC;AACf,CAAC,IACD,aAAa,uBAAuB,aAAa,qBAC/C,IAAI,aAAa,sBAAsB;CACrC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,CAAC;AACf,CAAC,IACD,IAAI,aAAa,oBAAoB;CACnC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,CAAC;AACf,CAAC;AAEX,MAAM,kBACH,QACA,MACC,gBAAgB,CAAC,IACb,IAAI,aAAa,gBAAgB;CAAE,UAAU;CAAU;AAAG,CAAC,IAC3D,eAAe,CAAC;AAExB,MAAM,gBAAgB,MACpB,aAAa,sBACT,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,QAAQ,EAAE;AACZ,CAAC,IACD,aAAa,wBACX,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,QAAQ,EAAE,UAAU;AACtB,CAAC,IACD,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,CAAC;AACf,CAAC;AAET,MAAM,cAAc,MAClB,IAAI,aAAa,kBAAkB;CACjC,UAAU;CACV,KAAK;CACL,GAAG,SAAS,CAAC;AACf,CAAC;AAgBH,MAAM,0BAA0B,OAC7B,EAAE,SAAS,uBAAuB,EAAE,SAAS,0BAC9C,EAAE,eAAe,gCACjB,EAAE,IAAI,SAAS;AAEjB,MAAM,sBAAsB,SAAS,YAAY,YAAY;AAC7D,MAAM,uBAAuB;AAE7B,MAAM,sBACJ,WAEA,OAAO,MAAM,QAAQ;CACnB,UAAU;CACV,OAAO;CACP,OAAO;AACT,CAAC;AAaH,MAAM,QAAc,MAAM;AAE1B,MAAM,QAAW,OAAsB,SACrC,UAAU,KAAA,IAAY,OAAO,KAAK,KAAK;AAEzC,MAAM,OAC6B,KAAQ,WACxC,OAAO;CAAE,GAAG;EAAI,MAAM;AAAM;AAQ/B,MAAM,iBAAiB,MAAoC;CAEzD,OAAO,GADM,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,SAAS,SAAS,gBAAgB,CAAC,CAAC,IAAI,GAAI,CAC3E,EAAE;AACjB;AAOA,MAAM,aAAa,UAAgF;CACjG,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,QAAQ,IAAI;CACnD,OAAO,MAAM,MAAM,KAAK,CAAC,CAAC,KACxB,MAAM,IAAI,iBACR,OAAO,QAAQ,IAAI,CACrB,GACA,MAAM,IAAI,aAAa,EAAE,SACvB,OAAO,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAChC,GACA,MAAM,IAAI,kBACR,OAAO,KACL,IAAI,aAAa,mBAAmB;EAClC,UAAU;EACV,YAAY;EACZ,QAAQ;CACV,CAAC,CACH,CACF,GACA,MAAM,IAAI,oBACR,OAAO,KACL,IAAI,aAAa,mBAAmB;EAClC,UAAU;EACV,YAAY;EACZ,QACE;CACJ,CAAC,CACH,CACF,GACA,MAAM,UACR;AACF;AAQA,MAAM,eAAe,WACnB,MAAM,MAAM,MAAM,CAAC,CAAC,KAClB,MAAM,IAAI,cAA8D,OAAO,QAAQ,IAAI,CAAC,GAC5F,MAAM,IAAI,iBACR,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,CACpC,GACA,MAAM,IAAI,cAAc,EAAE,OAAO,YAC/B,UAAU,KAAA,KAAa,MAAM,SAAS,IAClC,OAAO,KACL,IAAI,aAAa,mBAAmB;CAClC,UAAU;CACV,YAAY;CACZ,QACE;AACJ,CAAC,CACH,IACA,OAAO,QAAQ,IAAI,YAAY,CAAC,GAAI,SAAS,CAAC,CAAE,CAAC,CAAC,CACxD,GACA,MAAM,UACR;AAMF,MAAM,eACJ,YACmD;CACnD,IAAI,YAAY,KAAA,KAAa,QAAQ,WAAW,GAAG,OAAO,OAAO,QAAQ,IAAI;CAC7E,IAAI,QAAQ,MAAM,MAAM,EAAE,aAAa,IAAI,GACzC,OAAO,OAAO,KACZ,IAAI,aAAa,mBAAmB;EAClC,UAAU;EACV,YAAY;EACZ,QAAQ;CACV,CAAC,CACH;CAEF,MAAM,MAAMA,MAAI,OAAO,SAAS,CAAC,IAA8B,KAAK,MAAM;EACxE,IAAI,EAAE,aAAa,EAAE;EACrB,OAAO;CACT,CAAC;CACD,OAAO,OAAO,QAAQ,IAAI,WAAW,GAAG,CAAC;AAC3C;AAOA,MAAM,eAAe,YAAyD;CAC5E,MAAM,SAASA,MAAI,OAAO,SAAS,CAAC,IAAoC,KAAK,MAAM;EACjF,IAAI,EAAE,QAAQ;GAAE,OAAO,CAAC,GAAG,EAAE,KAAK;GAAG,OAAO,SAAS,MAAM,EAAE,KAAK;EAAE;EACpE,OAAO;CACT,CAAC;CACD,OAAO,IAAI,WAAW,MAAM;AAC9B;AAOA,MAAM,qBAAqB,YAA+C;CACxE,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,SAAS,MAAM,OAAO,KAAK,EAAE;CAC5E,GAAI,OAAO,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;CACtD,GAAI,OAAO,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,OAAO,YAAY;AAChF;AAOA,MAAM,QACJ,QAKA,OAAO,QAAQ,WACX,OAAO,QAAQ;CAAE,SAAS;CAAQ,MAAM,CAAC,MAAM,GAAG;AAAE,CAAC,IACrD,OAAO,MAAMA,MAAI,KAAK,GAAG,GAAG;CAC1B,cACE,OAAO,KACL,IAAI,aAAa,sBAAsB;EACrC,UAAU;EACV,OAAO;EACP,QAAQ;CACV,CAAC,CACH;CACF,SAAS,SAAS,OAAO,QAAQ;EAAE,SAAS;EAAM,MAAMA,MAAI,KAAK,KAAK,CAAC;CAAE,CAAC;AAC5E,CAAC;AAQP,MAAM,yBACJ,OAAO,eACL,OAAO,WAAW,IAAI,gBAAgB,CAAC,IACtC,OAAO,OAAO,WAAW,GAAG,MAAM,CAAC,CACtC;AAMF,MAAM,iBACJ,UAEA,UAAU,KAAA,KAAa,OAAO,UAAU,YAAY,EAAE,iBAAiB;;;;;;;;AASzE,MAAM,WAAW,UAAwD;CACvE,MAAM,MAAM,OAAO,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI;CAC1E,MAAM,MAAM,IAAI,WAAW,IAAI,YAAY,IAAI,UAAU,CAAC;CAC1D,IAAI,IAAI,GAAG;CACX,OAAO;AACT;;;;;;AAOA,MAAM,mBACJ,OACA,QAC8D;CAC9D,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,MAAM,OAAO,OAAO;CAClC,OAAO,OAAO,kBACZ,OAAO,WAAW,MAAM,UAAU,CAAC,GACnC,MACC,WAAW,OAAO,cAAc,OAAO,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,CAC5F;AACF;AAEA,MAAM,mBACJ,OACA,UAEA,gBAAgB,QAAQ,WACtB,OAAO,WAAW;CAAE,WAAW,OAAO,MAAM,KAAK;CAAG,OAAO;AAAa,CAAC,CAC3E,CAAC,CAAC,KAAK,OAAO,MAAM;AAEtB,MAAM,mBACJ,OACA,WAEA,gBAAgB,QAAQ,WACtB,OAAO,WAAW,SAAS,UACzB,OAAO,WAAW;CAAE,WAAW,OAAO,MAAM,KAAK;CAAG,OAAO;AAAa,CAAC,CAC3E,CACF,CAAC,CAAC,KAAK,OAAO,MAAM;AAMtB,MAAM,sBACJ,aAEA,OAAO,mBAAmB;CACxB,gBAAgB;CAChB,SAAS;AACX,CAAC;AAOH,MAAM,eACJ,OACA,cAC4D;CAC5D,MAAM,SACJ,MAAM,WAAW,OACb,OAAO,QACP,OAAO,IAAI,mBAAmB,MAAM,MAAM,IAAI,UAAUC,UAAc,OAAO,EAAE,MAAM,CAAC,CAAC;CAC7F,MAAM,SACJ,MAAM,WAAW,OACb,OAAO,QACP,OAAO,IAAI,mBAAmB,MAAM,MAAM,IAAI,UAAUA,UAAc,OAAO,EAAE,MAAM,CAAC,CAAC;CAC7F,MAAM,WAAoE,OAAO,OAC/E,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,OAAO,WAAW;GAAE,WAAW,MAAM;GAAQ,OAAO;EAAa,CAAC;EACxF,MAAM,MAAM,OAAO,MAAM;EACzB,OAAO,OAAO,QACZA,UAAc,SAAS;GAAE,UAAU,OAAO;GAAM,YAAY,MAAM;EAAU,CAAC,CAC/E;CACF,CAAC,CACH;CACA,OAAO,OAAO,OAAO,OAAO,MAAM,QAAQ,MAAM,GAAG,QAAQ;AAC7D;AAUA,MAAM,mBACJ,SACA,WAEA,YAAY,KAAA,IACR,SACA,OAAO,KACL,QACA,OAAO,MAAM,OAAO,CAAC,CAAC,KACpB,OAAO,QACL,OAAO,KACL,IAAI,aAAa,eAAe;CAC9B,UAAU;CACV,WAAW;CACX,QAAQ,SAAS,gBAAgB,OAAO;AAC1C,CAAC,CACH,CACF,CACF,CACF;AAQN,MAAM,iBACJ,KACA,iBACoB;CACpB,MAAM,KAAK,UAAU,IAAI,EAAE;CAE3B,MAAM,eAAe,YACnB,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,SAAS,SAAS,OAAO,KAAK,QAAQ,GAAG;EACjD,MAAM,KAAK,OAAO;EAClB,MAAM,YAA8B,QAAQ,UAAU,KAAA,IAAY,SAAS;EAC3E,MAAM,YAAY,OAAO,MAAM;EAC/B,MAAM,QAAQ,OAAO,OAAO,eAC1B,mBACE,OAAO,WAAW;GAChB,WACE,IAAI,MAAM,SAAS;IACjB,MAAM,CAAC,GAAG,IAAI;IACd,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;IACxD,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,IAAI,EAAE;IAC/D,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ,GAAG;GACb,CAAC;GACH,OAAO;EACT,CAAC,CACH,IACC,MAAM,OAAO,cAAc,EAAE,KAAK,SAAS,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,CAC1F;EACA,IAAI,QAAQ,UAAU,KAAA,GAAW;GAC/B,IAAI,cAAc,QAAQ,KAAK,GAC7B,OAAO,OAAO,WAAW,gBAAgB,OAAO,QAAQ,KAAK,CAAC;QAE9D,OAAO,gBAAgB,OAAO,QAAQ,QAAQ,KAAK,CAAC;EAExD;EACA,OAAO;GAAE;GAAO;EAAU;CAC5B,CAAC;CAEH,MAAM,WAA4B;EAChC;EAEA,OAAO,YACL,gBACE,QAAQ,SACR,OAAO,OACL,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,OAAO,cAAc,OAAO,YAAY,OAAO;GACvD,MAAM,SAAS,OAAO,OAAO,WAAW;IACtC,WAAW,MAAM,OAAO;IACxB,OAAO;GACT,CAAC;GACD,MAAM,cAAc,OAAO,MAAM;GACjC,OAAO;IACL,UAAU,OAAO,OAAO;IACxB,QAAQ,OAAO,cAAc;IAC7B,QAAQ,OAAO,cAAc;IAC7B,YAAY,cAAc;GAC5B;EACF,CAAC,CACH,CACF;EAEF,aAAa,YACX,OAAO,OACL,OAAO,IAAI,YAAY,OAAO,IAAI,EAAE,OAAO,gBAAgB,YAAY,OAAO,SAAS,CAAC,CAC1F;EAEF,QAAQ,YACN,OAAO,IAAI,YAAY,OAAO,IAAI,EAAE,OAAO,iBAAgC;GACzE,KAAK,MAAM;GACX,QAAQ,YAAY,OAAO,SAAS;GACpC,MAAM,OAAO,WAAW;IACtB,WAAW,MAAM,KAAK,SAAS;IAC/B,OAAO;GACT,CAAC;GACD,MAAM,OAAO,WAAW;IACtB,WAAW,MAAM;IACjB,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,EAAE,UAAU,OAAO,KAAK,EAAE,CAAC;EAC7D,EAAE;EAEJ,OAAO;GACL,OAAO,SAAS,OAAO,WAAW;IAAE,WAAW,IAAI,GAAG,SAAS,IAAI;IAAG,OAAO;GAAW,CAAC;GACzF,QAAQ,MAAM,aACZ,OAAO,WAAW;IAChB,WAAW,IAAI,GAAG,UAAU,MAAM,QAAQ,QAAQ,CAAC;IACnD,OAAO;GACT,CAAC;GACH,SAAS,SAAS,OAAO,WAAW;IAAE,WAAW,IAAI,GAAG,OAAO,IAAI;IAAG,OAAO;GAAW,CAAC;GACzF,QAAQ,SACN,OAAO,WAAW;IAChB,WAAW,IAAI,GAAG,MAAM,MAAM,EAAE,WAAW,KAAK,CAAC;IACjD,OAAO;GACT,CAAC;GACH,OAAO,SACL,OAAO,kBAAkB,IAAI,GAAG,QAAQ,IAAI,GAAG,UAAU,CAAC,CAAC,KACzD,OAAO,KAAK,OAAO;IACjB,MAAM,EAAE;IACR,MAAM,EAAE,SACH,SACD,EAAE,cACC,cACD,EAAE,YACC,YACA;GACX,EAAE,GACF,OAAO,UACT;GACF,SAAS,SACP,OAAO,WAAW;IAChB,WAAW,IAAI,GAAG,KAAK,IAAI;IAC3B,OAAO;GACT,CAAC,CAAC,CAAC,KACD,OAAO,GAAG,IAAI,GACd,OAAO,iBAAiB,OAAO,QAAQ,KAAK,CAAC,CAC/C;EACJ;CACF;CAEA,aAAa,IAAI,UAAU,GAAG;CAC9B,OAAO;AACT;AAMA,MAAM,gBAAgB,WAAkD;CACtE,MAAM,aAAa,kBAAkB,MAAM;CAC3C,MAAM,SAAS,IAAI,OAAO,UAAU;CACpC,MAAM,+BAAe,IAAI,QAAyC;CAElE,MAAM,gBACJ,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU,QAAQ,KAAK;EAC1C,MAAM,MAAM,OAAO,QAAQ,YAAY,KAAA,IACnC,OAAO,QAAQ,IAAI,IACnB,YAAY,QAAQ,OAAO;EAC/B,MAAM,OAAO,OAAO,YAAY,QAAQ,OAAO;EAE/C,MAAM,QAA6B;GACjC;GACA,KAAK,QAAQ,UAAU,OAAO,gBAAgB,MAAM,IAAI,UAAU,CAAC,CAAC;GACpE,KAAK,QAAQ,MAAM,QAAQ,IAAI,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;GACjD,KAAK,QAAQ,UAAU,MAAM,IAAI,WAAW,cAAc,CAAC,CAAC,CAAC;GAC7D,KAAK,QAAQ,SAAS,MAAM,IAAI,UAAU,OAAO,QAAQ,CAAC,CAAC,CAAC;GAC5D,KAAK,QAAQ,SAAS,MAAM,IAAI,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;GACnD;GACA;GACA,KAAK,QAAQ,UAAU,MAAO,EAAE,WAAW,IAAI,OAAO,YAAY,CAAC,CAAE;GACrE,KAAK,QAAQ,OAAO,MAAM,IAAI,QAAQ,CAAC,CAAC;EAC1C;EACA,MAAM,UAAUD,MAAI,OAAO,OAAO,CAAC,IAAoB,KAAK,SAAS,KAAK,GAAG,CAAC;EAC9E,OAAO;GAAE,GAAG;GAAY,GAAG;EAAQ;CACrC,CAAC;CAEH,MAAM,cAAc,YAClB,OAAO,QAAQ,aAAa,OAAO,IAAI,SACrC,OAAO,WAAW;EAAE,WAAWE,UAAe,OAAO,IAAI;EAAG,OAAO;CAAe,CAAC,CACrF;CAEF,MAAM,cAAc,QAClB,OAAO,cAAc,IAAI,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;CAE5E,MAAM,mBAAmB,QACvB,OAAO,cAAc,IAAI,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;CAE7E,MAAM,eAAe,OACnB,OAAO,WAAW;EAChB,WAAWA,UAAe,QAAQ,IAAI,UAAU;EAChD,OAAO,eAAe,EAAE;CAC1B,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,QACd,OAAO,WAAW;EAAE,WAAW,IAAI,KAAK;EAAG,OAAO,eAAe,EAAE;CAAE,CAAC,CACxE,GACA,OAAO,SAAS,yBAAyB,OAAO,IAAI,CACtD;CAEF,OAAO;EACL,SAAS,YACP,OAAO,eAAe,WAAW,OAAO,GAAG,UAAU,CAAC,CAAC,KACrD,OAAO,KAAK,QAAQ,cAAc,KAAK,YAAY,CAAC,CACtD;EAEF,SAAS,OACP,OAAO,eACL,OAAO,WAAW;GAChB,WAAWA,UAAe,QAAQ,IAAI,UAAU;GAChD,OAAO,eAAe,EAAE;EAC1B,CAAC,GACD,eACF,CAAC,CAAC,KAAK,OAAO,KAAK,QAAQ,cAAc,KAAK,YAAY,CAAC,CAAC;EAE9D,MAAM,OAAO,WAAW;GACtB,WAAW,OAAO,UAAU,KAAK;GACjC,OAAO;EACT,CAAC,CAAC,CAAC,KAAK,OAAO,IAAIF,MAAI,KAAK,OAAmB,EAAE,IAAI,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;EAEzE,SAAS;EAET,iBAAiB,UAAU,SACzB,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,QAAQ,gBAAgB,OAAO;GAChD,MAAM,OAAO,OAAO,OAAO,WAAW;IACpC,WAAW,OAAO,QAAQ,SAAS,UAAU,EAAE,MAAM,SAAS,CAAC;IAC/D,OAAO;GACT,CAAC;GACD,OAAO,WAAW,KAAK,IAAI;EAC7B,CAAC;EAEH,WAAW;GACT,cACE,OAAO,KACL,IAAI,aAAa,mBAAmB;IAClC,UAAU;IACV,YAAY;IACZ,QACE;GACJ,CAAC,CACH;GACF,UAAU,QACR,OAAO,WAAW;IAChB,WAAW,OAAO,UAAU,OAAO,GAAG;IACtC,OAAO,eAAe,GAAG;GAC3B,CAAC;GACH,MAAM,OAAO,OACX,OAAO,WAAW;IAChB,WAAW,OAAO,UAAU,KAAK;IACjC,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,OAAO,kBAAkB,MAAM,cAAc,CAAC,CAAC,CAC9E,CAAC,CAAC,KACA,OAAO,KAAK,UAAU;IAAE,IAAI,WAAW,KAAK,EAAE;IAAG,MAAM,KAAK;GAAK,EAAE,GACnE,OAAO,UACT;EACF;EAEA,SAAS;GACP,SAAS,MAAM,YACb,OAAO,WAAW;IAChB,WACE,OAAO,QAAQ,OAAO;KACpB,MAAM;KAIN,QAAQ,OAAO,iBAAiB;KAChC,UAAU,SAAS,cAAc;IACnC,CAAC;IACH,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,QAAQ,SAAS,IAAI,IAAI,CAAC,CAAC;GACjD,UAAU,QACR,OAAO,WAAW;IAChB,WAAW,OAAO,QAAQ,OAAO,GAAG;IACpC,OAAO,eAAe,GAAG;GAC3B,CAAC;GACH,MAAM,OAAO,OACX,OAAO,WAAW;IAChB,WAAW,OAAO,QAAQ,KAAK;IAC/B,OAAO;GACT,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,OAAO,kBAAkB,MAAM,cAAc,CAAC,CAAC,CAC9E,CAAC,CAAC,KACA,OAAO,KAAK,SAAS;IAAE,IAAI,SAAS,IAAI,IAAI;IAAG,MAAM,IAAI;GAAK,EAAE,GAChE,OAAO,UACT;EACF;EAEA,OAAO,EACL,SAAS,UAAU,SACjB,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,aAAa,IAAI,QAAQ;GACrC,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,IAAI,aAAa,gBAAgB;IAAE,UAAU;IAAU,IAAI,SAAS;GAAG,CAAC;GAMxF,OAAO,EAAE,KAAA,OAJU,OAAO,WAAW;IACnC,WAAW,IAAI,WAAW,EAAE,KAAK,CAAC;IAClC,OAAO;GACT,CAAC,EACY;EACf,CAAC,EACL;CACF;AACF;AAOA,MAAM,sBACJ,YAEA,YAAY,KAAA,KAAa,CAAC,QAAQ,MAAM,MAAM,EAAE,WAAW,KAAA,CAAS,IAChE,OAAO,OACP,OAAO,KACL,IAAI,aAAa,mBAAmB;CAClC,UAAU;CACV,YAAY;CACZ,QACE;AACJ,CAAC,CACH;AAEN,MAAM,iBAAiB,OAA2C;CAChE,GAAG;CACH,SAAS,YACP,mBAAmB,QAAQ,OAAO,CAAC,CAAC,KAClC,OAAO,QAAQ,EAAE,OAAO,OAAmC,CAAC,CAC9D;AACJ;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,SAAS,SAA4B,CAAC,MAAM;CACvD,MAAM,UAAU,aAAa,MAAM;CACnC,OAAO,MAAM,SACX,MAAM,QAAQ,aAAa,OAAO,GAClC,MAAM,QAAQG,SAAa,cAAc,OAAO,CAAC,GACjD,MAAM,QAAQ,0BAA0B,KAAA,CAAS,GACjD,MAAM,QAAQ,wBAAwB,KAAA,CAAS,GAC/C,MAAM,QAAQ,kBAAkB,KAAA,CAAS,GACzC,MAAM,QAAQ,gBAAgB,KAAA,CAAS,GACvC,MAAM,QAAQ,qBAAqB,KAAA,CAAS,CAC9C;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effect-uai/deno",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Deno Sandbox provider (Firecracker microVMs on Deno Deploy) for @effect-uai/core.",
   "keywords": [
     "agents",
@@ -45,14 +45,14 @@
   },
   "devDependencies": {
     "@deno/sandbox": "^0.13.2",
-    "effect": "4.0.0-beta.94",
-    "typescript": "^6.0.3",
-    "@effect-uai/core": "0.12.0"
+    "effect": "4.0.0-rc.111",
+    "typescript": "^7.0.2",
+    "@effect-uai/core": "0.13.0"
   },
   "peerDependencies": {
     "@deno/sandbox": "^0.13.0",
     "@effect-uai/core": ">=0.5.0 <1",
-    "effect": ">=4.0.0-beta.94 <5.0.0"
+    "effect": ">=4.0.0-rc.111 <5.0.0"
   },
   "scripts": {
     "build": "tsdown",

package/src/DenoSandbox.ts

@@ -282,36 +282,30 @@ const toDenoSeconds = (d: Duration.Input): `${number}s` => {
 const imageStep = (image: ImageRef | undefined): Effect.Effect<Step, SandboxError.SandboxError> => {
   if (image === undefined) return Effect.succeed(noop)
   return Match.value(image).pipe(
-    Match.tag(
-      "Default",
-      (): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(noop),
+    Match.tag("Default", (): Effect.Effect<Step, SandboxError.SandboxError> =>
+      Effect.succeed(noop),
     ),
-    Match.tag(
-      "Snapshot",
-      ({ id }): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(set("root", id)),
+    Match.tag("Snapshot", ({ id }): Effect.Effect<Step, SandboxError.SandboxError> =>
+      Effect.succeed(set("root", id)),
     ),
-    Match.tag(
-      "Registry",
-      (): Effect.Effect<Step, SandboxError.SandboxError> =>
-        Effect.fail(
-          new SandboxError.SandboxUnsupported({
-            provider: PROVIDER,
-            capability: "image.registry",
-            reason: "deno sandboxes do not accept OCI registry refs — boot from a snapshot instead",
-          }),
-        ),
+    Match.tag("Registry", (): Effect.Effect<Step, SandboxError.SandboxError> =>
+      Effect.fail(
+        new SandboxError.SandboxUnsupported({
+          provider: PROVIDER,
+          capability: "image.registry",
+          reason: "deno sandboxes do not accept OCI registry refs — boot from a snapshot instead",
+        }),
+      ),
     ),
-    Match.tag(
-      "Dockerfile",
-      (): Effect.Effect<Step, SandboxError.SandboxError> =>
-        Effect.fail(
-          new SandboxError.SandboxUnsupported({
-            provider: PROVIDER,
-            capability: "image.dockerfile",
-            reason:
-              "deno sandboxes do not accept Dockerfiles — install software into a bootable volume then snapshot it",
-          }),
-        ),
+    Match.tag("Dockerfile", (): Effect.Effect<Step, SandboxError.SandboxError> =>
+      Effect.fail(
+        new SandboxError.SandboxUnsupported({
+          provider: PROVIDER,
+          capability: "image.dockerfile",
+          reason:
+            "deno sandboxes do not accept Dockerfiles — install software into a bootable volume then snapshot it",
+        }),
+      ),
     ),
     Match.exhaustive,
   )
@@ -326,23 +320,20 @@ const imageStep = (image: ImageRef | undefined): Effect.Effect<Step, SandboxErro
 const networkStep = (policy: NetworkPolicy): Effect.Effect<Step, SandboxError.SandboxError> =>
   Match.value(policy).pipe(
     Match.tag("Open", (): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(noop)),
-    Match.tag(
-      "Blocked",
-      (): Effect.Effect<Step, SandboxError.SandboxError> => Effect.succeed(set("allowNet", [])),
+    Match.tag("Blocked", (): Effect.Effect<Step, SandboxError.SandboxError> =>
+      Effect.succeed(set("allowNet", [])),
     ),
-    Match.tag(
-      "Allowlist",
-      ({ hosts, cidrs }): Effect.Effect<Step, SandboxError.SandboxError> =>
-        cidrs !== undefined && cidrs.length > 0
-          ? Effect.fail(
-              new SandboxError.SandboxUnsupported({
-                provider: PROVIDER,
-                capability: "network.cidrs",
-                reason:
-                  "deno's allowNet accepts hostnames or literal IPs, not CIDR ranges — use hosts instead",
-              }),
-            )
-          : Effect.succeed(set("allowNet", [...(hosts ?? [])])),
+    Match.tag("Allowlist", ({ hosts, cidrs }): Effect.Effect<Step, SandboxError.SandboxError> =>
+      cidrs !== undefined && cidrs.length > 0
+        ? Effect.fail(
+            new SandboxError.SandboxUnsupported({
+              provider: PROVIDER,
+              capability: "network.cidrs",
+              reason:
+                "deno's allowNet accepts hostnames or literal IPs, not CIDR ranges — use hosts instead",
+            }),
+          )
+        : Effect.succeed(set("allowNet", [...(hosts ?? [])])),
     ),
     Match.exhaustive,
   )
@@ -637,21 +628,18 @@ const adaptInstance = (
       ),
 
     spawn: (request) =>
-      Effect.map(
-        openProcess(request),
-        ({ child, startedAt }): ProcessHandle => ({
-          pid: child.pid,
-          events: eventStream(child, startedAt),
-          kill: Effect.tryPromise({
-            try: () => child.kill("SIGTERM"),
-            catch: mapExecError,
-          }),
-          exit: Effect.tryPromise({
-            try: () => child.status,
-            catch: mapExecError,
-          }).pipe(Effect.map((status) => ({ exitCode: status.code }))),
+      Effect.map(openProcess(request), ({ child, startedAt }): ProcessHandle => ({
+        pid: child.pid,
+        events: eventStream(child, startedAt),
+        kill: Effect.tryPromise({
+          try: () => child.kill("SIGTERM"),
+          catch: mapExecError,
         }),
-      ),
+        exit: Effect.tryPromise({
+          try: () => child.status,
+          catch: mapExecError,
+        }).pipe(Effect.map((status) => ({ exitCode: status.code }))),
+      })),
 
     files: {
       read: (path) => Effect.tryPromise({ try: () => sdk.fs.readFile(path), catch: mapFsError }),