@finalai/final-agent-provider 0.5.0 → 0.6.1

package/dist/modules/sandboxes/computers-api.d.mts

@@ -1,17 +1,8 @@
 import { type ProcessInspectionRequestIface, type ProcessInspectionResultIface } from '@finalai/agent-protocol/process-inspection';
-import type { JsonValue } from '@finalai/agent-provider';
+import { type JsonValue, type SandboxCredentialsIface } from '@finalai/agent-provider';
 import { ComputerImageState, type ComputerBaseIface, type ComputerBrowserAccessIface, type ComputerBrowserAccessOptionsIface, type ComputerCommandMode, ComputerEgressPolicy, type ComputerIdlePolicy, type ComputerImageIface, type ComputerInfoIface, type ComputerScreenOpenOptionsIface, type ComputerSnapshotRequestIface, type ComputerSnapshotResponseIface } from '@finalai/computers';
 import * as z from 'zod';
-export interface ComputersApiCredentialIface {
-    apiKey: string;
-    teamId: string | null;
-}
 export interface ComputersApiConfigIface {
-    url: string;
-    credential: (args: {
-        organizationId: string;
-    }) => Promise<ComputersApiCredentialIface | null>;
-    credentialTtlMs?: number;
     fetch?: typeof fetch;
     requestTimeoutMs?: number;
 }
@@ -204,14 +195,8 @@ export interface ComputersApiClientIface {
     setBaseRetention(baseId: string, retained: boolean): Promise<ComputerBaseIface>;
     getBase(baseId: string): Promise<ComputerBaseIface | null>;
 }
-export interface ComputersApiCredentialsIface {
-    get(organizationId: string): Promise<ComputersApiCredentialIface>;
-    invalidate(organizationId: string): void;
-}
-export declare const createComputersApiCredentials: (config: Pick<ComputersApiConfigIface, "credential" | "credentialTtlMs">, now?: () => number) => ComputersApiCredentialsIface;
 export declare const createComputersApiClient: (args: {
     config: ComputersApiConfigIface;
-    credentials: ComputersApiCredentialsIface;
-    organizationId: string;
+    credentials: SandboxCredentialsIface | undefined;
 }) => ComputersApiClientIface;
 export {};

package/dist/modules/sandboxes/computers-api.mjs

@@ -1,7 +1,9 @@
 import {
   ProcessInspectionOperation
 } from "@finalai/agent-protocol/process-inspection";
-import { jsonValueSchema } from "@finalai/agent-provider";
+import {
+  jsonValueSchema
+} from "@finalai/agent-provider";
 import {
   computerBrowserAccessSchema,
   ComputerImageState,
@@ -15,7 +17,6 @@ import {
 } from "@finalai/computers";
 import * as z from "zod";
 import { inspectComputerProcesses } from "./computer-processes.mjs";
-import { COMPUTERS_API_KEY_SECRET } from "./environment.mjs";
 var ComputersApiErrorCode = /* @__PURE__ */ ((ComputersApiErrorCode2) => {
   ComputersApiErrorCode2["CredentialMissing"] = "credential_missing";
   ComputersApiErrorCode2["RequestFailed"] = "request_failed";
@@ -52,50 +53,34 @@ const computerResponseSchema = z.object({ computer: jsonValueSchema });
 const imageResponseSchema = z.object({ image: jsonValueSchema });
 const baseResponseSchema = z.object({ base: jsonValueSchema });
 const imagesResponseSchema = z.object({ images: z.array(jsonValueSchema) });
-const createComputersApiCredentials = (config, now = () => Date.now()) => {
-  const cache = /* @__PURE__ */ new Map();
-  const ttlMs = config.credentialTtlMs ?? 6e4;
-  return {
-    get: async (organizationId) => {
-      const cached = cache.get(organizationId);
-      if (cached != null && cached.expiresAtMs > now()) return cached.value;
-      const value = await config.credential({ organizationId });
-      if (value == null) {
+const createComputersApiClient = (args) => {
+  const request = async (req) => {
+    const send = async (refresh) => {
+      const access = await args.credentials?.computersAccess({ refresh });
+      if (access == null) {
         throw computersApiError(
-          `this organization has no Computers API key for the computer sandbox: create an organization API key and store it as the organization secret ${COMPUTERS_API_KEY_SECRET}`,
+          "the host granted the computer sandbox no Computers API access",
           null,
           "credential_missing" /* CredentialMissing */
         );
       }
-      cache.set(organizationId, { value, expiresAtMs: now() + ttlMs });
-      return value;
-    },
-    invalidate: (organizationId) => {
-      cache.delete(organizationId);
-    }
-  };
-};
-const createComputersApiClient = (args) => {
-  const request = async (req) => {
-    const credential = await args.credentials.get(args.organizationId);
-    const transport = createTransport({
-      baseUrl: args.config.url,
-      auth: { apiKey: credential.apiKey },
-      fetch: args.config.fetch,
-      requestTimeoutMs: args.config.requestTimeoutMs
-    });
-    const response = await transport.request({
-      method: req.method,
-      path: req.path,
-      query: req.query,
-      jsonBody: req.body,
-      headers: req.headers,
-      signal: req.signal
-    });
-    if (!response.ok) {
-      if (response.statusCode === 401) args.credentials.invalidate(args.organizationId);
-      throw computersApiError(response.error, response.statusCode ?? null);
-    }
+      return createTransport({
+        baseUrl: access.baseUrl,
+        auth: { apiKey: access.token },
+        fetch: args.config.fetch,
+        requestTimeoutMs: args.config.requestTimeoutMs
+      }).request({
+        method: req.method,
+        path: req.path,
+        query: req.query,
+        jsonBody: req.body,
+        headers: req.headers,
+        signal: req.signal
+      });
+    };
+    let response = await send(false);
+    if (!response.ok && response.statusCode === 401) response = await send(true);
+    if (!response.ok) throw computersApiError(response.error, response.statusCode ?? null);
     const parsed = response.data;
     const result = req.schema.safeParse(parsed);
     if (!result.success)
@@ -140,11 +125,10 @@ const createComputersApiClient = (args) => {
       return input.operation === ProcessInspectionOperation.Available && "available" in result.data ? { ...result.data, canStop: true } : result.data;
     },
     createComputer: async (body, idempotencyKey) => {
-      const { teamId } = await args.credentials.get(args.organizationId);
       const response = await request({
         method: "POST",
         path: "/computers",
-        body: teamId == null ? body : { ...body, teamId },
+        body,
         headers: { "idempotency-key": idempotencyKey },
         schema: computerResponseSchema
       });
@@ -388,7 +372,6 @@ export {
   ComputersApiErrorCode,
   computersApiError,
   createComputersApiClient,
-  createComputersApiCredentials,
   isComputersApiError,
   isComputersApiStatus
 };

package/dist/modules/sandboxes/computers-api.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/sandboxes/computers-api.ts"],
-  "sourcesContent": ["import {\n  ProcessInspectionOperation,\n  type ProcessInspectionRequestIface,\n  type ProcessInspectionResultIface,\n} from '@finalai/agent-protocol/process-inspection';\nimport type { JsonValue } from '@finalai/agent-provider';\nimport { jsonValueSchema } from '@finalai/agent-provider';\nimport {\n  computerBrowserAccessSchema,\n  ComputerImageState,\n  computerSnapshotResponseSchema,\n  createTransport,\n  normalizeComputerBase,\n  normalizeComputerImage,\n  normalizeComputerInfo,\n  ok,\n  type ComputerBaseIface,\n  type ComputerBrowserAccessIface,\n  type ComputerBrowserAccessOptionsIface,\n  type ComputerCommandMode,\n  ComputerEgressPolicy,\n  type ComputerIdlePolicy,\n  type ComputerImageIface,\n  type ComputerInfoIface,\n  type ComputerScreenOpenOptionsIface,\n  type ComputerSnapshotRequestIface,\n  type ComputerSnapshotResponseIface,\n} from '@finalai/computers';\nimport * as z from 'zod';\nimport { inspectComputerProcesses } from \"./computer-processes.mjs\";\nimport { COMPUTERS_API_KEY_SECRET } from \"./environment.mjs\";\n\n// The public Computers API (`/v1`, vm-service/docs/v1-api.md), authenticated the\n// way any developer's code is: an organization API key as the bearer. The\n// provider holds no platform credential and reaches no `/internal` route. This\n// speaks the REST surface directly, reusing @finalai/computers's row\n// normalization, because the provider needs an injected fetch and per-call\n// abort signals that the SDK's client does not take.\n\n// An organization's Computers API credential. `teamId` (`team_...`) owns the\n// computers when the key has no owning user (an organization or team key),\n// which POST /v1/computers requires.\nexport interface ComputersApiCredentialIface {\n  apiKey: string;\n  teamId: string | null;\n}\n\nexport interface ComputersApiConfigIface {\n  // Public Computers API origin (VM_SERVICE_WORKER_DOMAIN); requests go to `<url>/v1/...`.\n  url: string;\n  // The organization's credential, null when it has none.\n  credential: (args: { organizationId: string }) => Promise<ComputersApiCredentialIface | null>;\n  // How long a resolved credential is reused before it is read again; a 401 drops it at once.\n  credentialTtlMs?: number;\n  fetch?: typeof fetch;\n  requestTimeoutMs?: number;\n}\n\nexport enum ComputersApiErrorCode {\n  CredentialMissing = 'credential_missing',\n  RequestFailed = 'request_failed',\n}\n\nexport interface ComputersApiErrorIface extends Error {\n  code: ComputersApiErrorCode;\n  statusCode: number | null;\n}\n\nexport const computersApiError = (\n  message: string,\n  statusCode: number | null,\n  code: ComputersApiErrorCode = ComputersApiErrorCode.RequestFailed,\n): ComputersApiErrorIface =>\n  Object.assign(new Error(message), { name: 'ComputersApiError', code, statusCode });\n\nexport const isComputersApiError = (cause: unknown): cause is ComputersApiErrorIface =>\n  cause instanceof Error && 'statusCode' in cause && 'code' in cause;\n\nexport const isComputersApiStatus = (cause: unknown, ...statuses: number[]): boolean =>\n  isComputersApiError(cause) && cause.statusCode != null && statuses.includes(cause.statusCode);\n\n// Exactly one of imageVersionId (a registered image) and baseId (a captured computer).\nexport interface CreateComputerBodyIface {\n  name: string;\n  imageVersionId?: string;\n  baseId?: string;\n  regionSlug?: string;\n  vcpu?: number;\n  memoryMb?: number;\n  diskGb?: number;\n  // Null: no user volume, so everything the computer writes is on the disk a capture takes.\n  userVolumeGb?: number | null;\n  env: Record<string, string>;\n  commandMode?: ComputerCommandMode;\n  customCommand?: string;\n  ephemeral?: boolean;\n  idleTimeoutSeconds?: number;\n  idlePolicy?: ComputerIdlePolicy;\n  network?: { egress: ComputerEgressPolicy; allow?: string[] };\n  autoResume?: boolean;\n  tags?: string[];\n}\n\nexport interface ExecBodyIface {\n  autoResume?: boolean;\n  command: string;\n  env?: Record<string, string>;\n  cwd?: string;\n  user?: string;\n  timeoutMs?: number;\n  readyTimeoutMs?: number;\n}\n\n// `stop` shelves a computer that is not ephemeral: its disks go to storage and\n// its host is released; `start` brings it back with its files (vm-service\n// docs/v1-api.md).\nexport type ComputerAction = 'start' | 'stop' | 'pause' | 'resume' | 'delete';\n\nconst outputStreamSchema = z.object({\n  dataB64: z.string(),\n  offset: z.number(),\n  nextOffset: z.number(),\n  eof: z.boolean(),\n});\nconst processOutputSchema = z.object({\n  stdout: outputStreamSchema,\n  stderr: outputStreamSchema,\n  state: z.union([z.literal('running'), z.literal('exited')]),\n  result: z.object({ exitCode: z.number().nullable(), signal: z.string().nullable() }).nullable(),\n});\nexport type ComputerProcessOutputIface = z.infer<typeof processOutputSchema>;\nconst runResponseSchema = processOutputSchema.extend({\n  id: z.string(),\n  bootId: z.string(),\n  timedOut: z.boolean(),\n});\nexport type ComputerRunResultIface = z.infer<typeof runResponseSchema>;\nconst execResponseSchema = z.object({ id: z.string(), bootId: z.string() });\nconst fileReadSchema = z.object({\n  dataB64: z.string(),\n  eof: z.boolean(),\n  offset: z.number().optional(),\n});\nconst tokenSchema = z.object({ id: z.string(), token: z.string() });\nconst computerResponseSchema = z.object({ computer: jsonValueSchema });\nconst imageResponseSchema = z.object({ image: jsonValueSchema });\nconst baseResponseSchema = z.object({ base: jsonValueSchema });\nconst imagesResponseSchema = z.object({ images: z.array(jsonValueSchema) });\n\nexport interface ComputersApiClientIface {\n  disableAutoResume(computerId: string): Promise<void>;\n  inspectProcesses(\n    computerId: string,\n    input: ProcessInspectionRequestIface,\n  ): Promise<ProcessInspectionResultIface>;\n  openBrowserAccess(\n    computerId: string,\n    options: ComputerBrowserAccessOptionsIface,\n  ): Promise<ComputerBrowserAccessIface>;\n  closeBrowserAccess(computerId: string, tokenId: string): Promise<void>;\n  readSnapshot(\n    computerId: string,\n    request: ComputerSnapshotRequestIface,\n  ): Promise<ComputerSnapshotResponseIface>;\n  screenStatus(computerId: string, signal?: AbortSignal): Promise<{ available: boolean }>;\n  openScreen(\n    computerId: string,\n    options?: ComputerScreenOpenOptionsIface,\n  ): Promise<{ url: string; token: string; expiresAt: string }>;\n  computerUseStatus(\n    computerId: string,\n    signal?: AbortSignal,\n  ): Promise<{ available: boolean; installed: boolean }>;\n  openComputerUse(\n    computerId: string,\n    options: { cwd: string; readyTimeoutMs?: number; signal?: AbortSignal },\n  ): Promise<{ id: string; bootId: string }>;\n  setNetworkPolicy(\n    computerId: string,\n    policy: { egress: ComputerEgressPolicy; allow?: string[] },\n    lifecycle?: { autoResume: false },\n  ): Promise<void>;\n  createComputer(body: CreateComputerBodyIface, idempotencyKey: string): Promise<ComputerInfoIface>;\n  // Null when the computer does not exist (or was deleted).\n  getComputer(idOrName: string): Promise<ComputerInfoIface | null>;\n  getNetworkPolicy(\n    idOrName: string,\n  ): Promise<{ egress: ComputerEgressPolicy; allow: string[] } | null>;\n  action(idOrName: string, action: ComputerAction): Promise<void>;\n  exec(computerId: string, body: ExecBodyIface): Promise<{ id: string; bootId: string }>;\n  run(\n    computerId: string,\n    body: ExecBodyIface & { waitMs?: number },\n  ): Promise<ComputerRunResultIface>;\n  output(args: {\n    computerId: string;\n    processId: string;\n    bootId: string;\n    stdoutOffset: number;\n    stderrOffset: number;\n    waitMs: number;\n    signal?: AbortSignal;\n  }): Promise<ComputerProcessOutputIface>;\n  input(args: {\n    computerId: string;\n    processId: string;\n    body: Record<string, JsonValue>;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  terminate(args: { computerId: string; processId: string; bootId: string }): Promise<void>;\n  readFile(args: {\n    computerId: string;\n    path: string;\n    offset: number;\n    length: number;\n    signal?: AbortSignal;\n  }): Promise<{ dataB64: string; eof: boolean }>;\n  writeFile(args: {\n    computerId: string;\n    path: string;\n    dataB64: string;\n    append: boolean;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  // An `http`-scoped token for one computer's ports (a preview token).\n  createPreviewToken(args: { computerId: string; name: string; expiresAt: Date }): Promise<string>;\n  // The organization's and the platform's image versions, newest first.\n  listImages(args: { lineage: string; state: ComputerImageState }): Promise<ComputerImageIface[]>;\n  // Registering a digest the organization already has returns that version.\n  registerImage(args: {\n    reference: string;\n    registryCredentialId?: string;\n  }): Promise<ComputerImageIface>;\n  getImage(imageVersionId: string): Promise<ComputerImageIface>;\n  // Captures a running computer as a base; the computer stops for it.\n  captureComputer(idOrName: string, options?: { retained?: boolean }): Promise<ComputerBaseIface>;\n  setBaseRetention(baseId: string, retained: boolean): Promise<ComputerBaseIface>;\n  // Null when the base does not exist.\n  getBase(baseId: string): Promise<ComputerBaseIface | null>;\n}\n\ninterface CachedCredentialIface {\n  value: ComputersApiCredentialIface;\n  expiresAtMs: number;\n}\n\nexport interface ComputersApiCredentialsIface {\n  get(organizationId: string): Promise<ComputersApiCredentialIface>;\n  invalidate(organizationId: string): void;\n}\n\n// Credentials per organization, reused for `credentialTtlMs` (default 60 s, as\n// vm-service caches an API key's validation) so a handle's calls do not each\n// read the secret store.\nexport const createComputersApiCredentials = (\n  config: Pick<ComputersApiConfigIface, 'credential' | 'credentialTtlMs'>,\n  now: () => number = () => Date.now(),\n): ComputersApiCredentialsIface => {\n  const cache = new Map<string, CachedCredentialIface>();\n  const ttlMs = config.credentialTtlMs ?? 60_000;\n  return {\n    get: async (organizationId) => {\n      const cached = cache.get(organizationId);\n      if (cached != null && cached.expiresAtMs > now()) return cached.value;\n      const value = await config.credential({ organizationId });\n      if (value == null) {\n        throw computersApiError(\n          `this organization has no Computers API key for the computer sandbox: create an organization API key and store it as the organization secret ${COMPUTERS_API_KEY_SECRET}`,\n          null,\n          ComputersApiErrorCode.CredentialMissing,\n        );\n      }\n      cache.set(organizationId, { value, expiresAtMs: now() + ttlMs });\n      return value;\n    },\n    invalidate: (organizationId) => {\n      cache.delete(organizationId);\n    },\n  };\n};\n\nexport const createComputersApiClient = (args: {\n  config: ComputersApiConfigIface;\n  credentials: ComputersApiCredentialsIface;\n  organizationId: string;\n}): ComputersApiClientIface => {\n  const request = async <T>(req: {\n    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n    path: string;\n    query?: Record<string, string>;\n    body?: object;\n    headers?: Record<string, string>;\n    signal?: AbortSignal;\n    schema: z.ZodType<T>;\n  }): Promise<T> => {\n    const credential = await args.credentials.get(args.organizationId);\n    const transport = createTransport({\n      baseUrl: args.config.url,\n      auth: { apiKey: credential.apiKey },\n      fetch: args.config.fetch,\n      requestTimeoutMs: args.config.requestTimeoutMs,\n    });\n    const response = await transport.request({\n      method: req.method,\n      path: req.path,\n      query: req.query,\n      jsonBody: req.body,\n      headers: req.headers,\n      signal: req.signal,\n    });\n    if (!response.ok) {\n      if (response.statusCode === 401) args.credentials.invalidate(args.organizationId);\n      throw computersApiError(response.error, response.statusCode ?? null);\n    }\n    const parsed = response.data;\n    const result = req.schema.safeParse(parsed);\n    if (!result.success)\n      throw computersApiError(`unexpected Computers API ${req.path} response`, null);\n    return result.data;\n  };\n\n  const computerPath = (idOrName: string): string => `/computers/${encodeURIComponent(idOrName)}`;\n  const toInfo = (row: JsonValue): ComputerInfoIface => {\n    const info = normalizeComputerInfo(row);\n    if (info == null) throw computersApiError('unexpected computer shape', null);\n    return info;\n  };\n  const toImage = (row: JsonValue): ComputerImageIface => {\n    const image = normalizeComputerImage(row);\n    if (image == null) throw computersApiError('unexpected image shape', null);\n    return image;\n  };\n  const toBase = (row: JsonValue): ComputerBaseIface => {\n    const base = normalizeComputerBase(row);\n    if (base == null) throw computersApiError('unexpected base shape', null);\n    return base;\n  };\n  const anyBody = jsonValueSchema;\n\n  return {\n    inspectProcesses: async (computerId, input) => {\n      const result = await inspectComputerProcesses({\n        computerPath: computerPath(computerId),\n        request: input,\n        transport: {\n          request: async (args) =>\n            ok(\n              await request({\n                method: args.method,\n                path: args.path,\n                query: args.query,\n                body: args.jsonBody,\n                schema: jsonValueSchema,\n              }),\n            ),\n        },\n      });\n      if (!result.ok) throw computersApiError(result.error, result.statusCode ?? null);\n      return input.operation === ProcessInspectionOperation.Available && 'available' in result.data\n        ? { ...result.data, canStop: true }\n        : result.data;\n    },\n    createComputer: async (body, idempotencyKey) => {\n      const { teamId } = await args.credentials.get(args.organizationId);\n      const response = await request({\n        method: 'POST',\n        path: '/computers',\n        body: teamId == null ? body : { ...body, teamId },\n        headers: { 'idempotency-key': idempotencyKey },\n        schema: computerResponseSchema,\n      });\n      return toInfo(response.computer);\n    },\n    getNetworkPolicy: async (idOrName) => {\n      const response = await request({\n        method: 'GET',\n        path: computerPath(idOrName),\n        schema: computerResponseSchema,\n      });\n      const parsed = z\n        .object({\n          network: z.object({\n            egress: z.nativeEnum(ComputerEgressPolicy),\n            allow: z.array(z.string()).default([]),\n          }),\n        })\n        .safeParse(response.computer);\n      if (!parsed.success)\n        throw computersApiError(\n          'The public Computers API did not return a supported network policy',\n          null,\n        );\n      return parsed.data.network;\n    },\n    getComputer: async (idOrName) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: computerPath(idOrName),\n          schema: computerResponseSchema,\n        });\n        return toInfo(response.computer);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n    action: async (idOrName, action) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(idOrName)}/actions/${action}`,\n        body: {},\n        schema: anyBody,\n      });\n    },\n    openBrowserAccess: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/browser-access`,\n        body: options,\n        schema: computerBrowserAccessSchema,\n      }),\n    closeBrowserAccess: async (computerId, tokenId) => {\n      await request({\n        method: 'DELETE',\n        path: `${computerPath(computerId)}/browser-access/${encodeURIComponent(tokenId)}`,\n        schema: anyBody,\n      });\n    },\n    readSnapshot: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/file-snapshots/read`,\n        body,\n        schema: computerSnapshotResponseSchema,\n      }),\n    screenStatus: (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/screen`,\n        signal,\n        schema: z.object({ available: z.boolean() }),\n      }),\n    openScreen: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/screen`,\n        body: options ?? {},\n        schema: z.object({ url: z.string().url(), token: z.string(), expiresAt: z.string() }),\n      }),\n    computerUseStatus: async (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/computer-use`,\n        signal,\n        schema: z.object({ available: z.boolean(), installed: z.boolean().default(false) }),\n      }),\n    openComputerUse: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/computer-use`,\n        body: { cwd: options.cwd, readyTimeoutMs: options.readyTimeoutMs },\n        signal: options.signal,\n        schema: execResponseSchema,\n      }),\n    disableAutoResume: async (computerId) => {\n      await request({\n        method: 'PATCH',\n        path: computerPath(computerId),\n        body: { autoResume: false },\n        schema: computerResponseSchema,\n      });\n    },\n    setNetworkPolicy: async (computerId, policy, lifecycle) => {\n      await request({\n        method: 'PATCH',\n        path: computerPath(computerId),\n        body: { network: policy, ...lifecycle },\n        schema: computerResponseSchema,\n      });\n    },\n    exec: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/exec`,\n        body,\n        schema: execResponseSchema,\n      }),\n    run: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/run`,\n        body,\n        schema: runResponseSchema,\n      }),\n    output: (o) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/output`,\n        query: {\n          bootId: o.bootId,\n          stdoutOffset: String(o.stdoutOffset),\n          stderrOffset: String(o.stderrOffset),\n          waitMs: String(o.waitMs),\n        },\n        signal: o.signal,\n        schema: processOutputSchema,\n      }),\n    input: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/input`,\n        body: o.body,\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    terminate: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/terminate`,\n        body: { bootId: o.bootId },\n        schema: anyBody,\n      });\n    },\n    readFile: async (o) => {\n      const read = await request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/files`,\n        query: {\n          path: o.path,\n          offset: String(o.offset),\n          length: String(o.length),\n          autoResume: 'false',\n        },\n        signal: o.signal,\n        schema: fileReadSchema,\n      });\n      // The API echoes the offset; a server that ignored the range would hand back the start again.\n      if (o.offset > 0 && read.offset !== o.offset) {\n        throw computersApiError(\n          'the Computers API ignored a ranged file read; partial contents refused',\n          null,\n        );\n      }\n      return { dataB64: read.dataB64, eof: read.eof };\n    },\n    writeFile: async (o) => {\n      await request({\n        method: 'PUT',\n        path: `${computerPath(o.computerId)}/files`,\n        body: { path: o.path, dataB64: o.dataB64, append: o.append },\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    createPreviewToken: async (o) =>\n      (\n        await request({\n          method: 'POST',\n          path: '/tokens',\n          body: {\n            name: o.name,\n            computerId: o.computerId,\n            scopes: ['http'],\n            expiresAt: o.expiresAt.toISOString(),\n          },\n          schema: tokenSchema,\n        })\n      ).token,\n    listImages: async (o) =>\n      (\n        await request({\n          method: 'GET',\n          path: '/images',\n          query: { lineage: o.lineage, state: o.state },\n          schema: imagesResponseSchema,\n        })\n      ).images.map(toImage),\n    registerImage: async (o) =>\n      toImage(\n        (\n          await request({\n            method: 'POST',\n            path: '/images',\n            body: o.registryCredentialId == null ? { reference: o.reference } : o,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    getImage: async (imageVersionId) =>\n      toImage(\n        (\n          await request({\n            method: 'GET',\n            path: `/images/${encodeURIComponent(imageVersionId)}`,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    captureComputer: async (idOrName, options) =>\n      toBase(\n        (\n          await request({\n            method: 'POST',\n            path: `${computerPath(idOrName)}/capture`,\n            body: options ?? {},\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    setBaseRetention: async (baseId, retained) =>\n      toBase(\n        (\n          await request({\n            method: 'PATCH',\n            path: `/bases/${encodeURIComponent(baseId)}`,\n            body: { retained },\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    getBase: async (baseId) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: `/bases/${encodeURIComponent(baseId)}`,\n          schema: baseResponseSchema,\n        });\n        return toBase(response.base);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n  };\n};\n"],
-  "mappings": "AAAA;AAAA,EACE;AAAA,OAGK;AAEP,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAKA;AAAA,OAOK;AACP,YAAY,OAAO;AACnB,SAAS,gCAAgC;AACzC,SAAS,gCAAgC;AA4BlC,IAAK,wBAAL,kBAAKA,2BAAL;AACL,EAAAA,uBAAA,uBAAoB;AACpB,EAAAA,uBAAA,mBAAgB;AAFN,SAAAA;AAAA,GAAA;AAUL,MAAM,oBAAoB,CAC/B,SACA,YACA,OAA8B,yCAE9B,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,MAAM,qBAAqB,MAAM,WAAW,CAAC;AAE5E,MAAM,sBAAsB,CAAC,UAClC,iBAAiB,SAAS,gBAAgB,SAAS,UAAU;AAExD,MAAM,uBAAuB,CAAC,UAAmB,aACtD,oBAAoB,KAAK,KAAK,MAAM,cAAc,QAAQ,SAAS,SAAS,MAAM,UAAU;AAuC9F,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,SAAS,EAAE,OAAO;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,EACjB,YAAY,EAAE,OAAO;AAAA,EACrB,KAAK,EAAE,QAAQ;AACjB,CAAC;AACD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC1D,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS;AAChG,CAAC;AAED,MAAM,oBAAoB,oBAAoB,OAAO;AAAA,EACnD,IAAI,EAAE,OAAO;AAAA,EACb,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1E,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,SAAS,EAAE,OAAO;AAAA,EAClB,KAAK,EAAE,QAAQ;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAClE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,gBAAgB,CAAC;AACrE,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC;AAC/D,MAAM,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC7D,MAAM,uBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,EAAE,CAAC;AA2GnE,MAAM,gCAAgC,CAC3C,QACA,MAAoB,MAAM,KAAK,IAAI,MACF;AACjC,QAAM,QAAQ,oBAAI,IAAmC;AACrD,QAAM,QAAQ,OAAO,mBAAmB;AACxC,SAAO;AAAA,IACL,KAAK,OAAO,mBAAmB;AAC7B,YAAM,SAAS,MAAM,IAAI,cAAc;AACvC,UAAI,UAAU,QAAQ,OAAO,cAAc,IAAI,EAAG,QAAO,OAAO;AAChE,YAAM,QAAQ,MAAM,OAAO,WAAW,EAAE,eAAe,CAAC;AACxD,UAAI,SAAS,MAAM;AACjB,cAAM;AAAA,UACJ,+IAA+I,wBAAwB;AAAA,UACvK;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI,gBAAgB,EAAE,OAAO,aAAa,IAAI,IAAI,MAAM,CAAC;AAC/D,aAAO;AAAA,IACT;AAAA,IACA,YAAY,CAAC,mBAAmB;AAC9B,YAAM,OAAO,cAAc;AAAA,IAC7B;AAAA,EACF;AACF;AAEO,MAAM,2BAA2B,CAAC,SAIV;AAC7B,QAAM,UAAU,OAAU,QAQR;AAChB,UAAM,aAAa,MAAM,KAAK,YAAY,IAAI,KAAK,cAAc;AACjE,UAAM,YAAY,gBAAgB;AAAA,MAChC,SAAS,KAAK,OAAO;AAAA,MACrB,MAAM,EAAE,QAAQ,WAAW,OAAO;AAAA,MAClC,OAAO,KAAK,OAAO;AAAA,MACnB,kBAAkB,KAAK,OAAO;AAAA,IAChC,CAAC;AACD,UAAM,WAAW,MAAM,UAAU,QAAQ;AAAA,MACvC,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,OAAO,IAAI;AAAA,MACX,UAAU,IAAI;AAAA,MACd,SAAS,IAAI;AAAA,MACb,QAAQ,IAAI;AAAA,IACd,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,eAAe,IAAK,MAAK,YAAY,WAAW,KAAK,cAAc;AAChF,YAAM,kBAAkB,SAAS,OAAO,SAAS,cAAc,IAAI;AAAA,IACrE;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,SAAS,IAAI,OAAO,UAAU,MAAM;AAC1C,QAAI,CAAC,OAAO;AACV,YAAM,kBAAkB,4BAA4B,IAAI,IAAI,aAAa,IAAI;AAC/E,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,eAAe,CAAC,aAA6B,cAAc,mBAAmB,QAAQ,CAAC;AAC7F,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,6BAA6B,IAAI;AAC3E,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,QAAuC;AACtD,UAAM,QAAQ,uBAAuB,GAAG;AACxC,QAAI,SAAS,KAAM,OAAM,kBAAkB,0BAA0B,IAAI;AACzE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,yBAAyB,IAAI;AACvE,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAEhB,SAAO;AAAA,IACL,kBAAkB,OAAO,YAAY,UAAU;AAC7C,YAAM,SAAS,MAAM,yBAAyB;AAAA,QAC5C,cAAc,aAAa,UAAU;AAAA,QACrC,SAAS;AAAA,QACT,WAAW;AAAA,UACT,SAAS,OAAOC,UACd;AAAA,YACE,MAAM,QAAQ;AAAA,cACZ,QAAQA,MAAK;AAAA,cACb,MAAMA,MAAK;AAAA,cACX,OAAOA,MAAK;AAAA,cACZ,MAAMA,MAAK;AAAA,cACX,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACJ;AAAA,MACF,CAAC;AACD,UAAI,CAAC,OAAO,GAAI,OAAM,kBAAkB,OAAO,OAAO,OAAO,cAAc,IAAI;AAC/E,aAAO,MAAM,cAAc,2BAA2B,aAAa,eAAe,OAAO,OACrF,EAAE,GAAG,OAAO,MAAM,SAAS,KAAK,IAChC,OAAO;AAAA,IACb;AAAA,IACA,gBAAgB,OAAO,MAAM,mBAAmB;AAC9C,YAAM,EAAE,OAAO,IAAI,MAAM,KAAK,YAAY,IAAI,KAAK,cAAc;AACjE,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,UAAU,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO;AAAA,QAChD,SAAS,EAAE,mBAAmB,eAAe;AAAA,QAC7C,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,OAAO,SAAS,QAAQ;AAAA,IACjC;AAAA,IACA,kBAAkB,OAAO,aAAa;AACpC,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B,QAAQ;AAAA,QACR,MAAM,aAAa,QAAQ;AAAA,QAC3B,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,SAAS,EACZ,OAAO;AAAA,QACN,SAAS,EAAE,OAAO;AAAA,UAChB,QAAQ,EAAE,WAAW,oBAAoB;AAAA,UACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,QACvC,CAAC;AAAA,MACH,CAAC,EACA,UAAU,SAAS,QAAQ;AAC9B,UAAI,CAAC,OAAO;AACV,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AACF,aAAO,OAAO,KAAK;AAAA,IACrB;AAAA,IACA,aAAa,OAAO,aAAa;AAC/B,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,aAAa,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,QAAQ;AAAA,MACjC,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAU,WAAW;AAClC,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC,YAAY,MAAM;AAAA,QACjD,MAAM,CAAC;AAAA,QACP,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,CAAC,YAAY,YAC9B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,oBAAoB,OAAO,YAAY,YAAY;AACjD,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,UAAU,CAAC,mBAAmB,mBAAmB,OAAO,CAAC;AAAA,QAC/E,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,cAAc,CAAC,YAAY,SACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,cAAc,CAAC,YAAY,WACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAAA,IAC7C,CAAC;AAAA,IACH,YAAY,CAAC,YAAY,YACvB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,WAAW,CAAC;AAAA,MAClB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAAA,IACtF,CAAC;AAAA,IACH,mBAAmB,OAAO,YAAY,WACpC,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,CAAC;AAAA,IACpF,CAAC;AAAA,IACH,iBAAiB,CAAC,YAAY,YAC5B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,EAAE,KAAK,QAAQ,KAAK,gBAAgB,QAAQ,eAAe;AAAA,MACjE,QAAQ,QAAQ;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,mBAAmB,OAAO,eAAe;AACvC,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,aAAa,UAAU;AAAA,QAC7B,MAAM,EAAE,YAAY,MAAM;AAAA,QAC1B,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,OAAO,YAAY,QAAQ,cAAc;AACzD,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,aAAa,UAAU;AAAA,QAC7B,MAAM,EAAE,SAAS,QAAQ,GAAG,UAAU;AAAA,QACtC,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,MAAM,CAAC,YAAY,SACjB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,KAAK,CAAC,YAAY,SAChB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,QAAQ,CAAC,MACP,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,MAChF,OAAO;AAAA,QACL,QAAQ,EAAE;AAAA,QACV,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,QAAQ,OAAO,EAAE,MAAM;AAAA,MACzB;AAAA,MACA,QAAQ,EAAE;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,OAAO,OAAO,MAAM;AAClB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE;AAAA,QACR,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE,QAAQ,EAAE,OAAO;AAAA,QACzB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,UAAU,OAAO,MAAM;AACrB,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,OAAO;AAAA,UACL,MAAM,EAAE;AAAA,UACR,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,YAAY;AAAA,QACd;AAAA,QACA,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,EAAE,SAAS,KAAK,KAAK,WAAW,EAAE,QAAQ;AAC5C,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,SAAS,KAAK,SAAS,KAAK,KAAK,IAAI;AAAA,IAChD;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,QAAQ,EAAE,OAAO;AAAA,QAC3D,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,oBAAoB,OAAO,OAEvB,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,MAAM,EAAE;AAAA,QACR,YAAY,EAAE;AAAA,QACd,QAAQ,CAAC,MAAM;AAAA,QACf,WAAW,EAAE,UAAU,YAAY;AAAA,MACrC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC,GACD;AAAA,IACJ,YAAY,OAAO,OAEf,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,MAAM;AAAA,MAC5C,QAAQ;AAAA,IACV,CAAC,GACD,OAAO,IAAI,OAAO;AAAA,IACtB,eAAe,OAAO,MACpB;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,wBAAwB,OAAO,EAAE,WAAW,EAAE,UAAU,IAAI;AAAA,QACpE,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,UAAU,OAAO,mBACf;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,WAAW,mBAAmB,cAAc,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,iBAAiB,OAAO,UAAU,YAChC;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC;AAAA,QAC/B,MAAM,WAAW,CAAC;AAAA,QAClB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,kBAAkB,OAAO,QAAQ,aAC/B;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,QAC1C,MAAM,EAAE,SAAS;AAAA,QACjB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,SAAS,OAAO,WAAW;AACzB,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,UAC1C,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,IAAI;AAAA,MAC7B,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import {\n  ProcessInspectionOperation,\n  type ProcessInspectionRequestIface,\n  type ProcessInspectionResultIface,\n} from '@finalai/agent-protocol/process-inspection';\nimport {\n  jsonValueSchema,\n  type JsonValue,\n  type SandboxCredentialsIface,\n} from '@finalai/agent-provider';\nimport {\n  computerBrowserAccessSchema,\n  ComputerImageState,\n  computerSnapshotResponseSchema,\n  createTransport,\n  normalizeComputerBase,\n  normalizeComputerImage,\n  normalizeComputerInfo,\n  ok,\n  type ComputerBaseIface,\n  type ComputerBrowserAccessIface,\n  type ComputerBrowserAccessOptionsIface,\n  type ComputerCommandMode,\n  ComputerEgressPolicy,\n  type ComputerIdlePolicy,\n  type ComputerImageIface,\n  type ComputerInfoIface,\n  type ComputerScreenOpenOptionsIface,\n  type ComputerSnapshotRequestIface,\n  type ComputerSnapshotResponseIface,\n} from '@finalai/computers';\nimport * as z from 'zod';\nimport { inspectComputerProcesses } from \"./computer-processes.mjs\";\n// The public Computers API (`/v1`), authenticated with the context's\n// `credentials.computersAccess`. This speaks the REST surface directly, reusing\n// @finalai/computers's row normalization, because the provider needs an injected\n// fetch and per-call abort signals that the SDK's client does not take.\n\nexport interface ComputersApiConfigIface {\n  fetch?: typeof fetch;\n  requestTimeoutMs?: number;\n}\n\nexport enum ComputersApiErrorCode {\n  CredentialMissing = 'credential_missing',\n  RequestFailed = 'request_failed',\n}\n\nexport interface ComputersApiErrorIface extends Error {\n  code: ComputersApiErrorCode;\n  statusCode: number | null;\n}\n\nexport const computersApiError = (\n  message: string,\n  statusCode: number | null,\n  code: ComputersApiErrorCode = ComputersApiErrorCode.RequestFailed,\n): ComputersApiErrorIface =>\n  Object.assign(new Error(message), { name: 'ComputersApiError', code, statusCode });\n\nexport const isComputersApiError = (cause: unknown): cause is ComputersApiErrorIface =>\n  cause instanceof Error && 'statusCode' in cause && 'code' in cause;\n\nexport const isComputersApiStatus = (cause: unknown, ...statuses: number[]): boolean =>\n  isComputersApiError(cause) && cause.statusCode != null && statuses.includes(cause.statusCode);\n\n// Exactly one of imageVersionId (a registered image) and baseId (a captured computer).\nexport interface CreateComputerBodyIface {\n  name: string;\n  imageVersionId?: string;\n  baseId?: string;\n  regionSlug?: string;\n  vcpu?: number;\n  memoryMb?: number;\n  diskGb?: number;\n  // Null: no user volume, so everything the computer writes is on the disk a capture takes.\n  userVolumeGb?: number | null;\n  env: Record<string, string>;\n  commandMode?: ComputerCommandMode;\n  customCommand?: string;\n  ephemeral?: boolean;\n  idleTimeoutSeconds?: number;\n  idlePolicy?: ComputerIdlePolicy;\n  network?: { egress: ComputerEgressPolicy; allow?: string[] };\n  autoResume?: boolean;\n  tags?: string[];\n}\n\nexport interface ExecBodyIface {\n  autoResume?: boolean;\n  command: string;\n  env?: Record<string, string>;\n  cwd?: string;\n  user?: string;\n  timeoutMs?: number;\n  readyTimeoutMs?: number;\n}\n\n// `stop` shelves a computer that is not ephemeral: its disks go to storage and\n// its host is released; `start` brings it back with its files.\nexport type ComputerAction = 'start' | 'stop' | 'pause' | 'resume' | 'delete';\n\nconst outputStreamSchema = z.object({\n  dataB64: z.string(),\n  offset: z.number(),\n  nextOffset: z.number(),\n  eof: z.boolean(),\n});\nconst processOutputSchema = z.object({\n  stdout: outputStreamSchema,\n  stderr: outputStreamSchema,\n  state: z.union([z.literal('running'), z.literal('exited')]),\n  result: z.object({ exitCode: z.number().nullable(), signal: z.string().nullable() }).nullable(),\n});\nexport type ComputerProcessOutputIface = z.infer<typeof processOutputSchema>;\nconst runResponseSchema = processOutputSchema.extend({\n  id: z.string(),\n  bootId: z.string(),\n  timedOut: z.boolean(),\n});\nexport type ComputerRunResultIface = z.infer<typeof runResponseSchema>;\nconst execResponseSchema = z.object({ id: z.string(), bootId: z.string() });\nconst fileReadSchema = z.object({\n  dataB64: z.string(),\n  eof: z.boolean(),\n  offset: z.number().optional(),\n});\nconst tokenSchema = z.object({ id: z.string(), token: z.string() });\nconst computerResponseSchema = z.object({ computer: jsonValueSchema });\nconst imageResponseSchema = z.object({ image: jsonValueSchema });\nconst baseResponseSchema = z.object({ base: jsonValueSchema });\nconst imagesResponseSchema = z.object({ images: z.array(jsonValueSchema) });\n\nexport interface ComputersApiClientIface {\n  disableAutoResume(computerId: string): Promise<void>;\n  inspectProcesses(\n    computerId: string,\n    input: ProcessInspectionRequestIface,\n  ): Promise<ProcessInspectionResultIface>;\n  openBrowserAccess(\n    computerId: string,\n    options: ComputerBrowserAccessOptionsIface,\n  ): Promise<ComputerBrowserAccessIface>;\n  closeBrowserAccess(computerId: string, tokenId: string): Promise<void>;\n  readSnapshot(\n    computerId: string,\n    request: ComputerSnapshotRequestIface,\n  ): Promise<ComputerSnapshotResponseIface>;\n  screenStatus(computerId: string, signal?: AbortSignal): Promise<{ available: boolean }>;\n  openScreen(\n    computerId: string,\n    options?: ComputerScreenOpenOptionsIface,\n  ): Promise<{ url: string; token: string; expiresAt: string }>;\n  computerUseStatus(\n    computerId: string,\n    signal?: AbortSignal,\n  ): Promise<{ available: boolean; installed: boolean }>;\n  openComputerUse(\n    computerId: string,\n    options: { cwd: string; readyTimeoutMs?: number; signal?: AbortSignal },\n  ): Promise<{ id: string; bootId: string }>;\n  setNetworkPolicy(\n    computerId: string,\n    policy: { egress: ComputerEgressPolicy; allow?: string[] },\n    lifecycle?: { autoResume: false },\n  ): Promise<void>;\n  createComputer(body: CreateComputerBodyIface, idempotencyKey: string): Promise<ComputerInfoIface>;\n  // Null when the computer does not exist (or was deleted).\n  getComputer(idOrName: string): Promise<ComputerInfoIface | null>;\n  getNetworkPolicy(\n    idOrName: string,\n  ): Promise<{ egress: ComputerEgressPolicy; allow: string[] } | null>;\n  action(idOrName: string, action: ComputerAction): Promise<void>;\n  exec(computerId: string, body: ExecBodyIface): Promise<{ id: string; bootId: string }>;\n  run(\n    computerId: string,\n    body: ExecBodyIface & { waitMs?: number },\n  ): Promise<ComputerRunResultIface>;\n  output(args: {\n    computerId: string;\n    processId: string;\n    bootId: string;\n    stdoutOffset: number;\n    stderrOffset: number;\n    waitMs: number;\n    signal?: AbortSignal;\n  }): Promise<ComputerProcessOutputIface>;\n  input(args: {\n    computerId: string;\n    processId: string;\n    body: Record<string, JsonValue>;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  terminate(args: { computerId: string; processId: string; bootId: string }): Promise<void>;\n  readFile(args: {\n    computerId: string;\n    path: string;\n    offset: number;\n    length: number;\n    signal?: AbortSignal;\n  }): Promise<{ dataB64: string; eof: boolean }>;\n  writeFile(args: {\n    computerId: string;\n    path: string;\n    dataB64: string;\n    append: boolean;\n    signal?: AbortSignal;\n  }): Promise<void>;\n  // An `http`-scoped token for one computer's ports (a preview token).\n  createPreviewToken(args: { computerId: string; name: string; expiresAt: Date }): Promise<string>;\n  // The organization's and the platform's image versions, newest first.\n  listImages(args: { lineage: string; state: ComputerImageState }): Promise<ComputerImageIface[]>;\n  // Registering a digest the organization already has returns that version.\n  registerImage(args: {\n    reference: string;\n    registryCredentialId?: string;\n  }): Promise<ComputerImageIface>;\n  getImage(imageVersionId: string): Promise<ComputerImageIface>;\n  // Captures a running computer as a base; the computer stops for it.\n  captureComputer(idOrName: string, options?: { retained?: boolean }): Promise<ComputerBaseIface>;\n  setBaseRetention(baseId: string, retained: boolean): Promise<ComputerBaseIface>;\n  // Null when the base does not exist.\n  getBase(baseId: string): Promise<ComputerBaseIface | null>;\n}\n\nexport const createComputersApiClient = (args: {\n  config: ComputersApiConfigIface;\n  // The context's credentials; asked for access before each request.\n  credentials: SandboxCredentialsIface | undefined;\n}): ComputersApiClientIface => {\n  const request = async <T>(req: {\n    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n    path: string;\n    query?: Record<string, string>;\n    body?: object;\n    headers?: Record<string, string>;\n    signal?: AbortSignal;\n    schema: z.ZodType<T>;\n  }): Promise<T> => {\n    const send = async (refresh: boolean) => {\n      const access = await args.credentials?.computersAccess({ refresh });\n      if (access == null) {\n        throw computersApiError(\n          'the host granted the computer sandbox no Computers API access',\n          null,\n          ComputersApiErrorCode.CredentialMissing,\n        );\n      }\n      return createTransport({\n        baseUrl: access.baseUrl,\n        auth: { apiKey: access.token },\n        fetch: args.config.fetch,\n        requestTimeoutMs: args.config.requestTimeoutMs,\n      }).request({\n        method: req.method,\n        path: req.path,\n        query: req.query,\n        jsonBody: req.body,\n        headers: req.headers,\n        signal: req.signal,\n      });\n    };\n    let response = await send(false);\n    // A rejected token is asked for again once, in case it expired.\n    if (!response.ok && response.statusCode === 401) response = await send(true);\n    if (!response.ok) throw computersApiError(response.error, response.statusCode ?? null);\n    const parsed = response.data;\n    const result = req.schema.safeParse(parsed);\n    if (!result.success)\n      throw computersApiError(`unexpected Computers API ${req.path} response`, null);\n    return result.data;\n  };\n\n  const computerPath = (idOrName: string): string => `/computers/${encodeURIComponent(idOrName)}`;\n  const toInfo = (row: JsonValue): ComputerInfoIface => {\n    const info = normalizeComputerInfo(row);\n    if (info == null) throw computersApiError('unexpected computer shape', null);\n    return info;\n  };\n  const toImage = (row: JsonValue): ComputerImageIface => {\n    const image = normalizeComputerImage(row);\n    if (image == null) throw computersApiError('unexpected image shape', null);\n    return image;\n  };\n  const toBase = (row: JsonValue): ComputerBaseIface => {\n    const base = normalizeComputerBase(row);\n    if (base == null) throw computersApiError('unexpected base shape', null);\n    return base;\n  };\n  const anyBody = jsonValueSchema;\n\n  return {\n    inspectProcesses: async (computerId, input) => {\n      const result = await inspectComputerProcesses({\n        computerPath: computerPath(computerId),\n        request: input,\n        transport: {\n          request: async (args) =>\n            ok(\n              await request({\n                method: args.method,\n                path: args.path,\n                query: args.query,\n                body: args.jsonBody,\n                schema: jsonValueSchema,\n              }),\n            ),\n        },\n      });\n      if (!result.ok) throw computersApiError(result.error, result.statusCode ?? null);\n      return input.operation === ProcessInspectionOperation.Available && 'available' in result.data\n        ? { ...result.data, canStop: true }\n        : result.data;\n    },\n    createComputer: async (body, idempotencyKey) => {\n      // The token determines the project.\n      const response = await request({\n        method: 'POST',\n        path: '/computers',\n        body,\n        headers: { 'idempotency-key': idempotencyKey },\n        schema: computerResponseSchema,\n      });\n      return toInfo(response.computer);\n    },\n    getNetworkPolicy: async (idOrName) => {\n      const response = await request({\n        method: 'GET',\n        path: computerPath(idOrName),\n        schema: computerResponseSchema,\n      });\n      const parsed = z\n        .object({\n          network: z.object({\n            egress: z.nativeEnum(ComputerEgressPolicy),\n            allow: z.array(z.string()).default([]),\n          }),\n        })\n        .safeParse(response.computer);\n      if (!parsed.success)\n        throw computersApiError(\n          'The public Computers API did not return a supported network policy',\n          null,\n        );\n      return parsed.data.network;\n    },\n    getComputer: async (idOrName) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: computerPath(idOrName),\n          schema: computerResponseSchema,\n        });\n        return toInfo(response.computer);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n    action: async (idOrName, action) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(idOrName)}/actions/${action}`,\n        body: {},\n        schema: anyBody,\n      });\n    },\n    openBrowserAccess: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/browser-access`,\n        body: options,\n        schema: computerBrowserAccessSchema,\n      }),\n    closeBrowserAccess: async (computerId, tokenId) => {\n      await request({\n        method: 'DELETE',\n        path: `${computerPath(computerId)}/browser-access/${encodeURIComponent(tokenId)}`,\n        schema: anyBody,\n      });\n    },\n    readSnapshot: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/file-snapshots/read`,\n        body,\n        schema: computerSnapshotResponseSchema,\n      }),\n    screenStatus: (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/screen`,\n        signal,\n        schema: z.object({ available: z.boolean() }),\n      }),\n    openScreen: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/screen`,\n        body: options ?? {},\n        schema: z.object({ url: z.string().url(), token: z.string(), expiresAt: z.string() }),\n      }),\n    computerUseStatus: async (computerId, signal) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(computerId)}/computer-use`,\n        signal,\n        schema: z.object({ available: z.boolean(), installed: z.boolean().default(false) }),\n      }),\n    openComputerUse: (computerId, options) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/computer-use`,\n        body: { cwd: options.cwd, readyTimeoutMs: options.readyTimeoutMs },\n        signal: options.signal,\n        schema: execResponseSchema,\n      }),\n    disableAutoResume: async (computerId) => {\n      await request({\n        method: 'PATCH',\n        path: computerPath(computerId),\n        body: { autoResume: false },\n        schema: computerResponseSchema,\n      });\n    },\n    setNetworkPolicy: async (computerId, policy, lifecycle) => {\n      await request({\n        method: 'PATCH',\n        path: computerPath(computerId),\n        body: { network: policy, ...lifecycle },\n        schema: computerResponseSchema,\n      });\n    },\n    exec: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/exec`,\n        body,\n        schema: execResponseSchema,\n      }),\n    run: (computerId, body) =>\n      request({\n        method: 'POST',\n        path: `${computerPath(computerId)}/run`,\n        body,\n        schema: runResponseSchema,\n      }),\n    output: (o) =>\n      request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/output`,\n        query: {\n          bootId: o.bootId,\n          stdoutOffset: String(o.stdoutOffset),\n          stderrOffset: String(o.stderrOffset),\n          waitMs: String(o.waitMs),\n        },\n        signal: o.signal,\n        schema: processOutputSchema,\n      }),\n    input: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/input`,\n        body: o.body,\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    terminate: async (o) => {\n      await request({\n        method: 'POST',\n        path: `${computerPath(o.computerId)}/processes/${encodeURIComponent(o.processId)}/terminate`,\n        body: { bootId: o.bootId },\n        schema: anyBody,\n      });\n    },\n    readFile: async (o) => {\n      const read = await request({\n        method: 'GET',\n        path: `${computerPath(o.computerId)}/files`,\n        query: {\n          path: o.path,\n          offset: String(o.offset),\n          length: String(o.length),\n          autoResume: 'false',\n        },\n        signal: o.signal,\n        schema: fileReadSchema,\n      });\n      // The API echoes the offset; a server that ignored the range would hand back the start again.\n      if (o.offset > 0 && read.offset !== o.offset) {\n        throw computersApiError(\n          'the Computers API ignored a ranged file read; partial contents refused',\n          null,\n        );\n      }\n      return { dataB64: read.dataB64, eof: read.eof };\n    },\n    writeFile: async (o) => {\n      await request({\n        method: 'PUT',\n        path: `${computerPath(o.computerId)}/files`,\n        body: { path: o.path, dataB64: o.dataB64, append: o.append },\n        signal: o.signal,\n        schema: anyBody,\n      });\n    },\n    createPreviewToken: async (o) =>\n      (\n        await request({\n          method: 'POST',\n          path: '/tokens',\n          body: {\n            name: o.name,\n            computerId: o.computerId,\n            scopes: ['http'],\n            expiresAt: o.expiresAt.toISOString(),\n          },\n          schema: tokenSchema,\n        })\n      ).token,\n    listImages: async (o) =>\n      (\n        await request({\n          method: 'GET',\n          path: '/images',\n          query: { lineage: o.lineage, state: o.state },\n          schema: imagesResponseSchema,\n        })\n      ).images.map(toImage),\n    registerImage: async (o) =>\n      toImage(\n        (\n          await request({\n            method: 'POST',\n            path: '/images',\n            body: o.registryCredentialId == null ? { reference: o.reference } : o,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    getImage: async (imageVersionId) =>\n      toImage(\n        (\n          await request({\n            method: 'GET',\n            path: `/images/${encodeURIComponent(imageVersionId)}`,\n            schema: imageResponseSchema,\n          })\n        ).image,\n      ),\n    captureComputer: async (idOrName, options) =>\n      toBase(\n        (\n          await request({\n            method: 'POST',\n            path: `${computerPath(idOrName)}/capture`,\n            body: options ?? {},\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    setBaseRetention: async (baseId, retained) =>\n      toBase(\n        (\n          await request({\n            method: 'PATCH',\n            path: `/bases/${encodeURIComponent(baseId)}`,\n            body: { retained },\n            schema: baseResponseSchema,\n          })\n        ).base,\n      ),\n    getBase: async (baseId) => {\n      try {\n        const response = await request({\n          method: 'GET',\n          path: `/bases/${encodeURIComponent(baseId)}`,\n          schema: baseResponseSchema,\n        });\n        return toBase(response.base);\n      } catch (error) {\n        if (isComputersApiStatus(error, 404)) return null;\n        throw error;\n      }\n    },\n  };\n};\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAKA;AAAA,OAOK;AACP,YAAY,OAAO;AACnB,SAAS,gCAAgC;AAWlC,IAAK,wBAAL,kBAAKA,2BAAL;AACL,EAAAA,uBAAA,uBAAoB;AACpB,EAAAA,uBAAA,mBAAgB;AAFN,SAAAA;AAAA,GAAA;AAUL,MAAM,oBAAoB,CAC/B,SACA,YACA,OAA8B,yCAE9B,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,MAAM,qBAAqB,MAAM,WAAW,CAAC;AAE5E,MAAM,sBAAsB,CAAC,UAClC,iBAAiB,SAAS,gBAAgB,SAAS,UAAU;AAExD,MAAM,uBAAuB,CAAC,UAAmB,aACtD,oBAAoB,KAAK,KAAK,MAAM,cAAc,QAAQ,SAAS,SAAS,MAAM,UAAU;AAsC9F,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,SAAS,EAAE,OAAO;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,EACjB,YAAY,EAAE,OAAO;AAAA,EACrB,KAAK,EAAE,QAAQ;AACjB,CAAC;AACD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC1D,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS;AAChG,CAAC;AAED,MAAM,oBAAoB,oBAAoB,OAAO;AAAA,EACnD,IAAI,EAAE,OAAO;AAAA,EACb,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1E,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,SAAS,EAAE,OAAO;AAAA,EAClB,KAAK,EAAE,QAAQ;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAClE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,gBAAgB,CAAC;AACrE,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC;AAC/D,MAAM,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC7D,MAAM,uBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,EAAE,CAAC;AA8FnE,MAAM,2BAA2B,CAAC,SAIV;AAC7B,QAAM,UAAU,OAAU,QAQR;AAChB,UAAM,OAAO,OAAO,YAAqB;AACvC,YAAM,SAAS,MAAM,KAAK,aAAa,gBAAgB,EAAE,QAAQ,CAAC;AAClE,UAAI,UAAU,MAAM;AAClB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,gBAAgB;AAAA,QACrB,SAAS,OAAO;AAAA,QAChB,MAAM,EAAE,QAAQ,OAAO,MAAM;AAAA,QAC7B,OAAO,KAAK,OAAO;AAAA,QACnB,kBAAkB,KAAK,OAAO;AAAA,MAChC,CAAC,EAAE,QAAQ;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,UAAU,IAAI;AAAA,QACd,SAAS,IAAI;AAAA,QACb,QAAQ,IAAI;AAAA,MACd,CAAC;AAAA,IACH;AACA,QAAI,WAAW,MAAM,KAAK,KAAK;AAE/B,QAAI,CAAC,SAAS,MAAM,SAAS,eAAe,IAAK,YAAW,MAAM,KAAK,IAAI;AAC3E,QAAI,CAAC,SAAS,GAAI,OAAM,kBAAkB,SAAS,OAAO,SAAS,cAAc,IAAI;AACrF,UAAM,SAAS,SAAS;AACxB,UAAM,SAAS,IAAI,OAAO,UAAU,MAAM;AAC1C,QAAI,CAAC,OAAO;AACV,YAAM,kBAAkB,4BAA4B,IAAI,IAAI,aAAa,IAAI;AAC/E,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,eAAe,CAAC,aAA6B,cAAc,mBAAmB,QAAQ,CAAC;AAC7F,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,6BAA6B,IAAI;AAC3E,WAAO;AAAA,EACT;AACA,QAAM,UAAU,CAAC,QAAuC;AACtD,UAAM,QAAQ,uBAAuB,GAAG;AACxC,QAAI,SAAS,KAAM,OAAM,kBAAkB,0BAA0B,IAAI;AACzE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,CAAC,QAAsC;AACpD,UAAM,OAAO,sBAAsB,GAAG;AACtC,QAAI,QAAQ,KAAM,OAAM,kBAAkB,yBAAyB,IAAI;AACvE,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAEhB,SAAO;AAAA,IACL,kBAAkB,OAAO,YAAY,UAAU;AAC7C,YAAM,SAAS,MAAM,yBAAyB;AAAA,QAC5C,cAAc,aAAa,UAAU;AAAA,QACrC,SAAS;AAAA,QACT,WAAW;AAAA,UACT,SAAS,OAAOC,UACd;AAAA,YACE,MAAM,QAAQ;AAAA,cACZ,QAAQA,MAAK;AAAA,cACb,MAAMA,MAAK;AAAA,cACX,OAAOA,MAAK;AAAA,cACZ,MAAMA,MAAK;AAAA,cACX,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACJ;AAAA,MACF,CAAC;AACD,UAAI,CAAC,OAAO,GAAI,OAAM,kBAAkB,OAAO,OAAO,OAAO,cAAc,IAAI;AAC/E,aAAO,MAAM,cAAc,2BAA2B,aAAa,eAAe,OAAO,OACrF,EAAE,GAAG,OAAO,MAAM,SAAS,KAAK,IAChC,OAAO;AAAA,IACb;AAAA,IACA,gBAAgB,OAAO,MAAM,mBAAmB;AAE9C,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B,QAAQ;AAAA,QACR,MAAM;AAAA,QACN;AAAA,QACA,SAAS,EAAE,mBAAmB,eAAe;AAAA,QAC7C,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,OAAO,SAAS,QAAQ;AAAA,IACjC;AAAA,IACA,kBAAkB,OAAO,aAAa;AACpC,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B,QAAQ;AAAA,QACR,MAAM,aAAa,QAAQ;AAAA,QAC3B,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,SAAS,EACZ,OAAO;AAAA,QACN,SAAS,EAAE,OAAO;AAAA,UAChB,QAAQ,EAAE,WAAW,oBAAoB;AAAA,UACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,QACvC,CAAC;AAAA,MACH,CAAC,EACA,UAAU,SAAS,QAAQ;AAC9B,UAAI,CAAC,OAAO;AACV,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AACF,aAAO,OAAO,KAAK;AAAA,IACrB;AAAA,IACA,aAAa,OAAO,aAAa;AAC/B,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,aAAa,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,QAAQ;AAAA,MACjC,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,UAAU,WAAW;AAClC,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC,YAAY,MAAM;AAAA,QACjD,MAAM,CAAC;AAAA,QACP,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,CAAC,YAAY,YAC9B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,oBAAoB,OAAO,YAAY,YAAY;AACjD,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,UAAU,CAAC,mBAAmB,mBAAmB,OAAO,CAAC;AAAA,QAC/E,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,cAAc,CAAC,YAAY,SACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,cAAc,CAAC,YAAY,WACzB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAAA,IAC7C,CAAC;AAAA,IACH,YAAY,CAAC,YAAY,YACvB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,WAAW,CAAC;AAAA,MAClB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAAA,IACtF,CAAC;AAAA,IACH,mBAAmB,OAAO,YAAY,WACpC,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,CAAC;AAAA,IACpF,CAAC;AAAA,IACH,iBAAiB,CAAC,YAAY,YAC5B,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC,MAAM,EAAE,KAAK,QAAQ,KAAK,gBAAgB,QAAQ,eAAe;AAAA,MACjE,QAAQ,QAAQ;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,mBAAmB,OAAO,eAAe;AACvC,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,aAAa,UAAU;AAAA,QAC7B,MAAM,EAAE,YAAY,MAAM;AAAA,QAC1B,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,OAAO,YAAY,QAAQ,cAAc;AACzD,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,aAAa,UAAU;AAAA,QAC7B,MAAM,EAAE,SAAS,QAAQ,GAAG,UAAU;AAAA,QACtC,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,MAAM,CAAC,YAAY,SACjB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,KAAK,CAAC,YAAY,SAChB,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,UAAU,CAAC;AAAA,MACjC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,QAAQ,CAAC,MACP,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,MAChF,OAAO;AAAA,QACL,QAAQ,EAAE;AAAA,QACV,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,cAAc,OAAO,EAAE,YAAY;AAAA,QACnC,QAAQ,OAAO,EAAE,MAAM;AAAA,MACzB;AAAA,MACA,QAAQ,EAAE;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,IACH,OAAO,OAAO,MAAM;AAClB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE;AAAA,QACR,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,cAAc,mBAAmB,EAAE,SAAS,CAAC;AAAA,QAChF,MAAM,EAAE,QAAQ,EAAE,OAAO;AAAA,QACzB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,UAAU,OAAO,MAAM;AACrB,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,OAAO;AAAA,UACL,MAAM,EAAE;AAAA,UACR,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,QAAQ,OAAO,EAAE,MAAM;AAAA,UACvB,YAAY;AAAA,QACd;AAAA,QACA,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,EAAE,SAAS,KAAK,KAAK,WAAW,EAAE,QAAQ;AAC5C,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,EAAE,SAAS,KAAK,SAAS,KAAK,KAAK,IAAI;AAAA,IAChD;AAAA,IACA,WAAW,OAAO,MAAM;AACtB,YAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC;AAAA,QACnC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,QAAQ,EAAE,OAAO;AAAA,QAC3D,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,oBAAoB,OAAO,OAEvB,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,MAAM,EAAE;AAAA,QACR,YAAY,EAAE;AAAA,QACd,QAAQ,CAAC,MAAM;AAAA,QACf,WAAW,EAAE,UAAU,YAAY;AAAA,MACrC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC,GACD;AAAA,IACJ,YAAY,OAAO,OAEf,MAAM,QAAQ;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,MAAM;AAAA,MAC5C,QAAQ;AAAA,IACV,CAAC,GACD,OAAO,IAAI,OAAO;AAAA,IACtB,eAAe,OAAO,MACpB;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM,EAAE,wBAAwB,OAAO,EAAE,WAAW,EAAE,UAAU,IAAI;AAAA,QACpE,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,UAAU,OAAO,mBACf;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,WAAW,mBAAmB,cAAc,CAAC;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,iBAAiB,OAAO,UAAU,YAChC;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,aAAa,QAAQ,CAAC;AAAA,QAC/B,MAAM,WAAW,CAAC;AAAA,QAClB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,kBAAkB,OAAO,QAAQ,aAC/B;AAAA,OAEI,MAAM,QAAQ;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,QAC1C,MAAM,EAAE,SAAS;AAAA,QACjB,QAAQ;AAAA,MACV,CAAC,GACD;AAAA,IACJ;AAAA,IACF,SAAS,OAAO,WAAW;AACzB,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B,QAAQ;AAAA,UACR,MAAM,UAAU,mBAAmB,MAAM,CAAC;AAAA,UAC1C,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,OAAO,SAAS,IAAI;AAAA,MAC7B,SAAS,OAAO;AACd,YAAI,qBAAqB,OAAO,GAAG,EAAG,QAAO;AAC7C,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["ComputersApiErrorCode", "args"]
 }

package/dist/modules/sandboxes/device-api.d.mts

@@ -1,20 +1,15 @@
 import { deviceEgressEnrollmentSchema, deviceEgressLeaseSchema, deviceEgressWorkspaceSchema, deviceWorkspaceNetworkStateSchema, type WorkspaceNetworkPolicyIface } from '@finalai/agent-protocol/device-egress';
 import { type ProcessInspectionRequestIface, type ProcessInspectionResultIface } from '@finalai/agent-protocol/process-inspection';
-import { type SandboxActingUserIface } from '@finalai/agent-provider/sandbox';
+import { type SandboxActingUserIface, type SandboxCredentialsIface } from '@finalai/agent-provider/sandbox';
 import * as z from 'zod';
 import type { SandboxTransportIface } from "./transport.mjs";
 export { DEVICE_API_ACTING_USER_HEADER } from "./environment.mjs";
 export interface DeviceApiCallerIface {
     organizationId: string;
+    credentials?: SandboxCredentialsIface;
     actingUser: SandboxActingUserIface;
 }
 export interface DeviceApiConfigIface {
-    url: string;
-    credential: (args: {
-        organizationId: string;
-        actingUserId: string | null;
-    }) => Promise<string | null>;
-    credentialTtlMs?: number;
     fetch?: DeviceApiFetchIface;
 }
 export interface DeviceApiFetchIface {
@@ -82,6 +77,7 @@ export interface DeviceApiClientIface {
     egress: {
         networkState(args: {
             organizationId: string;
+            credentials?: SandboxCredentialsIface;
             workspaceId: string;
         }): Promise<z.infer<typeof deviceWorkspaceNetworkStateSchema>>;
         setNetworkPolicy(args: {
@@ -204,5 +200,4 @@ export interface DeviceApiClientIface {
 export declare const createDeviceApiClient: (config: {
     api: DeviceApiConfigIface | (() => DeviceApiConfigIface);
     fetch?: DeviceApiFetchIface;
-    now?: () => number;
 }) => DeviceApiClientIface;

package/dist/modules/sandboxes/device-api.mjs

@@ -12,7 +12,9 @@ import {
   processInspectionResultSchema
 } from "@finalai/agent-protocol/process-inspection";
 import { jsonObjectSchema, jsonValueSchema } from "@finalai/agent-provider";
-import { SandboxEntryType } from "@finalai/agent-provider/sandbox";
+import {
+  SandboxEntryType
+} from "@finalai/agent-provider/sandbox";
 import * as z from "zod";
 import { decodeBase64, encodeBase64 } from "./bytes.mjs";
 import { DEVICE_API_ACTING_USER_HEADER } from "./environment.mjs";
@@ -111,7 +113,7 @@ var DeviceApiClientErrorCode = /* @__PURE__ */ ((DeviceApiClientErrorCode2) => {
 const apiError = (status, code, message) => Object.assign(new Error(`Device API ${status} ${code}: ${message}`), { status, code });
 const credentialMissing = (actingUserId) => Object.assign(
   new Error(
-    `Device API access is unavailable ${actingUserId == null ? "for workspace networking (no acting user)" : "for this acting user"}: configure the credential callback`
+    `Device API access is unavailable ${actingUserId == null ? "for workspace networking (no acting user)" : "for this acting user"}: the host's credentials.deviceAccess granted none`
   ),
   { status: null, code: "credential_missing" /* CredentialMissing */ }
 );
@@ -142,42 +144,29 @@ const leaseOf = (raw) => ({
   expiresAtMs: Date.parse(raw.expiresAt)
 });
 const createDeviceApiClient = (config) => {
-  const now = config.now ?? Date.now;
   const readApi = () => typeof config.api === "function" ? config.api() : config.api;
-  const keys = /* @__PURE__ */ new Map();
   const failure = async (response) => {
     const text = await response.text().catch(() => "");
     const body = errorBodySchema.safeParse(parseJson(text));
     return body.success ? apiError(response.status, body.data.error.code, body.data.error.message) : apiError(response.status, "http", text.slice(0, 200) || response.statusText);
   };
-  const credentialFor = async (args) => {
-    const { organizationId, actingUserId, reread, api } = args;
-    const cacheKey = JSON.stringify([api.url, organizationId, actingUserId]);
-    const currentTime = now();
-    for (const [key2, entry] of keys) {
-      if (entry.expiresAtMs <= currentTime) keys.delete(key2);
-    }
-    const cached = keys.get(cacheKey);
-    if (cached != null && !reread) return cached.key;
-    const key = await api.credential({ organizationId, actingUserId });
-    if (key == null) {
-      keys.delete(cacheKey);
-      throw credentialMissing(actingUserId);
-    }
-    keys.set(cacheKey, { key, expiresAtMs: now() + (api.credentialTtlMs ?? 6e4) });
-    return key;
+  const accessFor = async (args) => {
+    const access = await args.caller.credentials?.deviceAccess({
+      actingUserId: args.actingUserId,
+      refresh: args.refresh
+    });
+    if (access == null) throw credentialMissing(args.actingUserId);
+    return access;
   };
   const send = async (args) => {
     const api = readApi();
-    const origin = api.url.replace(/\/+$/, "");
-    const url = new URL(`${origin}${args.path}`);
-    for (const [key, value] of Object.entries(args.query ?? {})) url.searchParams.set(key, value);
     const actingUserId = await args.caller.actingUser.current();
     if (actingUserId == null && !args.anonymous) throw noActingUser();
     const attempt = async (refresh) => {
-      const headers = new Headers({
-        authorization: `Bearer ${await credentialFor({ organizationId: args.caller.organizationId, actingUserId, reread: refresh, api })}`
-      });
+      const access = await accessFor({ caller: args.caller, actingUserId, refresh });
+      const url = new URL(`${access.baseUrl.replace(/\/+$/, "")}${args.path}`);
+      for (const [key, value] of Object.entries(args.query ?? {})) url.searchParams.set(key, value);
+      const headers = new Headers({ authorization: `Bearer ${access.token}` });
       if (actingUserId != null) headers.set(DEVICE_API_ACTING_USER_HEADER, actingUserId);
       if (args.contentType != null) headers.set("content-type", args.contentType);
       return (config.fetch ?? api.fetch ?? fetch)(url.toString(), {
@@ -324,8 +313,8 @@ const createDeviceApiClient = (config) => {
   };
   return {
     egress: {
-      networkState: ({ organizationId, workspaceId }) => json(deviceWorkspaceNetworkStateSchema, {
-        caller: { organizationId, actingUser: { current: async () => null } },
+      networkState: ({ organizationId, credentials, workspaceId }) => json(deviceWorkspaceNetworkStateSchema, {
+        caller: { organizationId, credentials, actingUser: { current: async () => null } },
         anonymous: true,
         method: "GET",
         path: `/v1/egress/workspaces/${encodeURIComponent(deviceEgressWorkspaceIdSchema.parse(workspaceId))}/network-state`,