@giselles-ai/sandkit 0.1.0 → 0.1.2

package/dist/integrations/vercel.js

@@ -1,19 +1,19 @@
 import {
   resolveGithubDefaultApiKey
-} from "../chunk-XM4HGRXW.js";
+} from "../chunk-5MXHFOJH.js";
+import {
+  createSandboxProvider
+} from "../chunk-XN6DGLRP.js";
 import {
   resolveCodexDefaultApiKey
-} from "../chunk-FSDVHEEX.js";
+} from "../chunk-2M2AZUOC.js";
 import {
   resolveGeminiDefaultApiKey
-} from "../chunk-7DLK7LOM.js";
+} from "../chunk-6GHZO3Y5.js";
 import {
   resolveAiGatewayDefaultApiKey
-} from "../chunk-REGOUXVI.js";
-import {
-  createSandboxProvider
-} from "../chunk-HVYCAAZQ.js";
-import "../chunk-VISDS5T7.js";
+} from "../chunk-UEAKE56H.js";
+import "../chunk-NKTNTBOY.js";
 
 // src/drivers/vercel-sandbox.ts
 import { Sandbox } from "@vercel/sandbox";
@@ -66,6 +66,12 @@ function resolveCredentialValue(serviceId, header) {
     `Workspace policy for service "${serviceId}" contains a redacted credential and cannot be applied.`
   );
 }
+function encodeHeaderValue(value, encoding) {
+  if (encoding === "base64") {
+    return Buffer.from(value, "utf8").toString("base64");
+  }
+  return value;
+}
 function compileHeaderRules(serviceId, headers) {
   if (!headers || headers.length === 0) {
     return [];
@@ -73,7 +79,10 @@ function compileHeaderRules(serviceId, headers) {
   const resolvedHeaders = Object.fromEntries(
     headers.map((header) => [
       header.headerName,
-      `${header.valuePrefix ?? ""}${resolveCredentialValue(serviceId, header)}`
+      `${header.valuePrefix ?? ""}${encodeHeaderValue(
+        `${header.credentialPrefix ?? ""}${resolveCredentialValue(serviceId, header)}`,
+        header.valueEncoding
+      )}`
     ])
   );
   return [
@@ -95,8 +104,11 @@ function compileVercelNetworkPolicy(policy) {
     case "allow-services": {
       const allow = {};
       for (const service of policy.services) {
-        const rules = compileHeaderRules(service.id, service.headers);
         for (const domain of service.domains) {
+          const rules = compileHeaderRules(
+            service.id,
+            service.domainHeaders?.[domain] ?? service.headers
+          );
           const existing = allow[domain] ?? [];
           allow[domain] = [...existing, ...rules];
         }
@@ -129,13 +141,24 @@ var VercelSandboxDriver = class {
       expiresAt: new Date(Date.parse(observedAt) + timeoutMs).toISOString()
     };
   }
-  async runCommand(command, args) {
-    const result = await this.#sandbox.runCommand(command, args);
-    const finished = await this.#toCommandFinished(result);
+  async runCommand(command, args, options) {
+    const rawResult = options?.detached ? await this.#sandbox.runCommand({
+      cmd: command,
+      args,
+      detached: true
+    }) : await this.#sandbox.runCommand(command, args);
+    const logIterator = options?.detached ? getCommandLogIterator(rawResult) : void 0;
+    const commandLogs = logIterator ? () => createEphemeralCommandLogStream(logIterator) : void 0;
     return {
-      exitCode: finished.exitCode,
-      stdout: await finished.stdout(),
-      stderr: await finished.stderr()
+      wait: async () => {
+        const finished = await this.#toCommandFinished(rawResult);
+        return {
+          exitCode: finished.exitCode,
+          stdout: await finished.stdout(),
+          stderr: await finished.stderr()
+        };
+      },
+      logs: commandLogs
     };
   }
   async startProcess(input) {
@@ -156,7 +179,7 @@ var VercelSandboxDriver = class {
     return {
       processId,
       wait: async () => {
-        const finished = await started.wait();
+        const finished = await this.#toCommandFinished(started);
         return {
           exitCode: finished.exitCode,
           stdout: await finished.stdout(),
@@ -205,6 +228,25 @@ var VercelSandboxDriver = class {
     return raw;
   }
 };
+function createEphemeralCommandLogStream(logs) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      try {
+        for await (const log of logs) {
+          const normalized = normalizeCommandLog(log);
+          if (normalized) {
+            yield normalized;
+          }
+        }
+      } catch (cause) {
+        if (cause instanceof Error) {
+          throw cause;
+        }
+        throw new Error("Command logs failed.");
+      }
+    }
+  };
+}
 function isVercelCommandHandle(value) {
   if (typeof value !== "object" || value === null) {
     return false;

package/dist/integrations/vercel.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/drivers/vercel-sandbox.ts","../../src/policies/default-credentials.ts","../../src/drivers/vercel-network-policy.ts","../../src/integrations/vercel.ts"],"sourcesContent":["import { Sandbox } from \"@vercel/sandbox\";\n\nimport type { WorkspacePolicy } from \"../policies/types.ts\";\nimport type {\n  CommandResult,\n  PersistedSandboxState,\n  SandboxSessionLease,\n  SandboxDriver,\n  WorkspaceSessionLog,\n  WorkspaceSessionProcess,\n  WorkspaceSessionProcessStartInput,\n  SandboxCreateOptions,\n  SandboxDriverFactory,\n  WorkspaceRecord,\n  VercelSandboxOptions,\n} from \"../types.ts\";\nimport { compileVercelNetworkPolicy } from \"./vercel-network-policy.ts\";\n\ninterface VercelCommandFinished {\n  exitCode: number;\n  stdout(): Promise<string>;\n  stderr(): Promise<string>;\n}\n\ninterface VercelCommandHandle {\n  wait(): Promise<VercelCommandFinished>;\n  readonly cmdId?: string;\n  readonly logs?: () => unknown;\n}\n\ninterface VercelPersistedState {\n  snapshotId?: string;\n}\n\nclass VercelSandboxDriver implements SandboxDriver {\n  readonly #sandbox: Awaited<ReturnType<typeof Sandbox.get>>;\n  readonly provider = \"vercel-sandbox\";\n\n  constructor(sandbox: Awaited<ReturnType<typeof Sandbox.get>>) {\n    this.#sandbox = sandbox;\n  }\n\n  get id(): string {\n    return this.#sandbox.sandboxId;\n  }\n\n  async applyPolicy(policy: WorkspacePolicy): Promise<void> {\n    await this.#sandbox.updateNetworkPolicy(compileVercelNetworkPolicy(policy));\n  }\n\n  async getSessionLease(): Promise<SandboxSessionLease> {\n    const sandbox = this.#sandbox;\n    const observedAt = new Date().toISOString();\n    const timeoutMs =\n      typeof sandbox.timeout === \"number\" && Number.isFinite(sandbox.timeout) && sandbox.timeout > 0\n        ? sandbox.timeout\n        : 60_000;\n\n    return {\n      sandboxId: sandbox.sandboxId,\n      observedAt,\n      expiresAt: new Date(Date.parse(observedAt) + timeoutMs).toISOString(),\n    };\n  }\n\n  async runCommand(command: string, args: string[]): Promise<CommandResult> {\n    const result = await this.#sandbox.runCommand(command, args);\n    const finished = await this.#toCommandFinished(result);\n\n    return {\n      exitCode: finished.exitCode,\n      stdout: await finished.stdout(),\n      stderr: await finished.stderr(),\n    };\n  }\n\n  async startProcess(input: WorkspaceSessionProcessStartInput): Promise<WorkspaceSessionProcess> {\n    const started = await this.#sandbox.runCommand({\n      cmd: input.command,\n      args: [...input.args],\n      detached: true,\n    });\n    if (!isVercelCommandHandle(started)) {\n      throw new Error(\"Unexpected Vercel sandbox startProcess() response shape.\");\n    }\n\n    const processId = started.cmdId ?? `${this.#sandbox.sandboxId}-${Date.now()}`;\n    const commandLogBroadcast = createCommandLogBroadcaster(\n      getCommandLogIterator(started),\n      input.onStdout,\n      input.onStderr,\n    );\n\n    return {\n      processId,\n      wait: async (): Promise<CommandResult> => {\n        const finished = await started.wait();\n        return {\n          exitCode: finished.exitCode,\n          stdout: await finished.stdout(),\n          stderr: await finished.stderr(),\n        };\n      },\n      logs: commandLogBroadcast ? () => commandLogBroadcast() : undefined,\n    };\n  }\n\n  async url(port: number): Promise<string> {\n    try {\n      return this.#sandbox.domain(port);\n    } catch (error) {\n      if (!(error instanceof Error) || !error.message.includes(\"No route for port\")) {\n        throw error;\n      }\n\n      const refreshed = await Sandbox.get({ sandboxId: this.#sandbox.sandboxId });\n      return refreshed.domain(port);\n    }\n  }\n\n  async extendTimeout(durationMs: number): Promise<void> {\n    const extendTimeout = (\n      this.#sandbox as { extendTimeout?: (durationMs: number) => Promise<unknown> }\n    ).extendTimeout;\n    if (!extendTimeout) {\n      throw new Error(\"This Vercel sandbox does not support extendTimeout().\");\n    }\n\n    await extendTimeout.call(this.#sandbox, durationMs);\n  }\n\n  async snapshot(): Promise<PersistedSandboxState> {\n    // Vercel sandbox snapshot() restores through a new sandbox and implicitly stops the source sandbox.\n    // Keep this behavior as a provider detail in the driver implementation.\n    const snapshot = await this.#sandbox.snapshot();\n\n    return {\n      kind: \"vercel-sandbox-snapshot\",\n      sessionId: this.#sandbox.sandboxId,\n      state: {\n        snapshotId: snapshot.snapshotId,\n      },\n    };\n  }\n\n  async #toCommandFinished(raw: unknown): Promise<VercelCommandFinished> {\n    if (typeof raw !== \"object\" || raw === null) {\n      throw new Error(\"Unexpected Vercel sandbox command response\");\n    }\n\n    const candidate = raw as { wait?: () => Promise<VercelCommandFinished> };\n    if (candidate.wait) {\n      return candidate.wait();\n    }\n\n    return raw as VercelCommandFinished;\n  }\n}\n\nfunction isVercelCommandHandle(value: unknown): value is VercelCommandHandle {\n  if (typeof value !== \"object\" || value === null) {\n    return false;\n  }\n\n  const candidate = value as { wait?: unknown; cmdId?: unknown };\n  if (typeof candidate.wait !== \"function\") {\n    return false;\n  }\n\n  return candidate.cmdId === undefined || typeof candidate.cmdId === \"string\";\n}\n\nfunction isIterable<T = unknown>(value: unknown): value is Iterable<T> {\n  return (\n    value !== null &&\n    (typeof value === \"object\" || typeof value === \"function\") &&\n    typeof (value as Iterable<T>)[Symbol.iterator] === \"function\"\n  );\n}\n\nfunction isAsyncIterable<T = unknown>(value: unknown): value is AsyncIterable<T> {\n  return (\n    value !== null &&\n    (typeof value === \"object\" || typeof value === \"function\") &&\n    typeof (value as AsyncIterable<T>)[Symbol.asyncIterator] === \"function\"\n  );\n}\n\nfunction getCommandLogIterator(raw: VercelCommandHandle): AsyncIterable<unknown> | undefined {\n  const rawLogs = raw.logs?.();\n  if (rawLogs === undefined) {\n    return undefined;\n  }\n  if (isAsyncIterable<unknown>(rawLogs)) {\n    return rawLogs;\n  }\n  if (isIterable<unknown>(rawLogs)) {\n    return toAsyncIterableFromSync(rawLogs);\n  }\n  return undefined;\n}\n\nfunction toAsyncIterableFromSync<T>(iterable: Iterable<T>): AsyncIterable<T> {\n  return {\n    async *[Symbol.asyncIterator]() {\n      for (const value of iterable) {\n        yield value;\n      }\n    },\n  };\n}\n\nfunction createCommandLogBroadcaster(\n  logs: AsyncIterable<unknown> | undefined,\n  onStdout?: (chunk: string) => void,\n  onStderr?: (chunk: string) => void,\n): (() => AsyncIterable<WorkspaceSessionLog>) | undefined {\n  if (!logs) {\n    return undefined;\n  }\n\n  const bufferedLogs: WorkspaceSessionLog[] = [];\n  const waiters: Array<() => void> = [];\n  let completed = false;\n  let error: unknown = null;\n  let pumpStarted = false;\n\n  const notifyWaiters = () => {\n    while (waiters.length > 0) {\n      waiters.pop()?.();\n    }\n  };\n\n  const run = async (): Promise<void> => {\n    if (pumpStarted) {\n      return;\n    }\n    pumpStarted = true;\n\n    try {\n      for await (const log of logs) {\n        const normalized = normalizeCommandLog(log);\n        if (!normalized) {\n          continue;\n        }\n\n        bufferedLogs.push(normalized);\n        if (normalized.stream === \"stderr\") {\n          onStderr?.(normalized.chunk);\n        } else {\n          onStdout?.(normalized.chunk);\n        }\n        notifyWaiters();\n      }\n    } catch (cause) {\n      error = cause;\n    } finally {\n      completed = true;\n      notifyWaiters();\n    }\n  };\n\n  void run().catch(() => {});\n\n  const waitForWork = (): Promise<void> => {\n    return new Promise<void>((resolve) => {\n      waiters.push(resolve);\n    });\n  };\n\n  const createLogIterable = (): AsyncIterable<WorkspaceSessionLog> => {\n    return {\n      async *[Symbol.asyncIterator]() {\n        let index = 0;\n        while (true) {\n          if (index < bufferedLogs.length) {\n            yield bufferedLogs[index++]!;\n            continue;\n          }\n          if (error !== null) {\n            throw error instanceof Error ? error : new Error(\"startProcess logs failed.\");\n          }\n          if (completed) {\n            return;\n          }\n          await waitForWork();\n        }\n      },\n    };\n  };\n\n  return createLogIterable;\n}\n\nexport function normalizeCommandLog(log: unknown): WorkspaceSessionLog | null {\n  if (typeof log === \"string\") {\n    return { stream: \"stdout\", chunk: log };\n  }\n  if (typeof log !== \"object\" || log === null) {\n    return null;\n  }\n\n  const candidate = log as {\n    stream?: unknown;\n    output?: unknown;\n    chunk?: unknown;\n    text?: unknown;\n    message?: unknown;\n    data?: unknown;\n  };\n  const streamValue = candidate.stream;\n  const stream = streamValue === \"stderr\" || streamValue === \"stdout\" ? streamValue : \"stdout\";\n  const rawChunk =\n    candidate.data ??\n    candidate.output ??\n    candidate.chunk ??\n    candidate.text ??\n    candidate.message ??\n    null;\n\n  if (typeof rawChunk !== \"string\") {\n    return null;\n  }\n\n  return { stream, chunk: rawChunk };\n}\n\nclass VercelSandboxDriverFactory implements SandboxDriverFactory {\n  readonly #runtime: string;\n  readonly #defaultTimeout: number;\n\n  constructor(options: VercelSandboxOptions = {}) {\n    this.#runtime = options.runtime ?? \"node24\";\n    this.#defaultTimeout = normalizeSandboxTimeout(\n      options.defaultTimeout ?? options.timeout,\n      \"Vercel sandbox default timeout\",\n    );\n  }\n\n  isSessionUnavailableError(error: unknown): boolean {\n    if (!(error instanceof Error)) {\n      return false;\n    }\n\n    const message = error.message.toLowerCase();\n    return (\n      message.includes(\"not found\") ||\n      message.includes(\"does not exist\") ||\n      message.includes(\"sandbox_stopped\") ||\n      message.includes(\"sandbox stopped\")\n    );\n  }\n\n  async createSandbox(\n    _workspace: WorkspaceRecord,\n    options: SandboxCreateOptions,\n  ): Promise<SandboxDriver> {\n    const timeout = this.#defaultTimeoutForCreate(options);\n\n    const sandbox = await Sandbox.create({\n      runtime: this.#runtime,\n      timeout,\n      ports: options.exposedPorts,\n      networkPolicy: compileVercelNetworkPolicy(options.policy),\n    });\n\n    return new VercelSandboxDriver(sandbox);\n  }\n\n  async resumeSandbox(\n    workspace: WorkspaceRecord,\n    snapshot: PersistedSandboxState,\n    options: SandboxCreateOptions,\n  ): Promise<SandboxDriver> {\n    const timeout = this.#defaultTimeoutForCreate(options);\n    const state = snapshot.state as VercelPersistedState | undefined;\n    const snapshotId = state?.snapshotId;\n    const fallbackSandboxId = workspace.sandboxId ?? snapshot.sessionId;\n\n    const sandbox =\n      snapshotId === undefined || typeof snapshotId !== \"string\"\n        ? await (fallbackSandboxId === undefined\n            ? (() => {\n                throw new Error(\"Persisted sandbox state is missing restore information\");\n              })()\n            : Sandbox.get({ sandboxId: fallbackSandboxId }))\n        : await Sandbox.create({\n            source: {\n              type: \"snapshot\",\n              snapshotId,\n            },\n            timeout,\n            ports: options.exposedPorts,\n            networkPolicy: compileVercelNetworkPolicy(options.policy),\n          });\n\n    // Reattaching to an existing live sandbox should not mutate provider state.\n    // Updating the network policy here races with commit/snapshot shutdown and can\n    // fail on otherwise read-only flows like getActiveLease().\n    return new VercelSandboxDriver(sandbox);\n  }\n\n  #defaultTimeoutForCreate(options: SandboxCreateOptions): number {\n    return normalizeSandboxTimeout(options.timeoutMs ?? this.#defaultTimeout, \"runtime timeout\");\n  }\n}\n\nfunction normalizeSandboxTimeout(value: unknown, label: string): number {\n  if (value === undefined) {\n    return 60_000;\n  }\n\n  if (\n    typeof value !== \"number\" ||\n    !Number.isInteger(value) ||\n    !Number.isFinite(value) ||\n    value <= 0\n  ) {\n    throw new Error(`${label} must be a positive integer in milliseconds.`);\n  }\n\n  return value;\n}\n\nexport function createVercelSandboxDriverFactory(\n  options: VercelSandboxOptions = {},\n): SandboxDriverFactory {\n  return new VercelSandboxDriverFactory(options);\n}\n","import { resolveAiGatewayDefaultApiKey } from \"./ai-gateway.ts\";\nimport { resolveCodexDefaultApiKey } from \"./codex.ts\";\nimport { resolveGeminiDefaultApiKey } from \"./gemini.ts\";\nimport { resolveGithubDefaultApiKey } from \"./github.ts\";\n\nexport function resolveDefaultCredentialValue(serviceId: string): string | undefined {\n  switch (serviceId) {\n    case \"codex\":\n      return resolveCodexDefaultApiKey();\n    case \"gemini\":\n      return resolveGeminiDefaultApiKey();\n    case \"github\":\n      return resolveGithubDefaultApiKey();\n    case \"aiGateway\":\n      return resolveAiGatewayDefaultApiKey();\n    default:\n      return undefined;\n  }\n}\n\nexport function describeDefaultCredentialSource(serviceId: string): string {\n  switch (serviceId) {\n    case \"codex\":\n      return \"CODEX_API_KEY\";\n    case \"gemini\":\n      return \"GEMINI_API_KEY\";\n    case \"github\":\n      return \"GITHUB_TOKEN\";\n    case \"aiGateway\":\n      return \"AI_GATEWAY_API_KEY\";\n    default:\n      return `default credential for service \"${serviceId}\"`;\n  }\n}\n","import type {\n  NetworkPolicy as VercelNetworkPolicy,\n  NetworkPolicyRule as VercelNetworkPolicyRule,\n} from \"@vercel/sandbox\";\n\nimport {\n  describeDefaultCredentialSource,\n  resolveDefaultCredentialValue,\n} from \"../policies/default-credentials.ts\";\nimport type { PolicyServiceHeaderTransform, WorkspacePolicy } from \"../policies/types.ts\";\n\nfunction resolveCredentialValue(serviceId: string, header: PolicyServiceHeaderTransform): string {\n  if (header.credential.kind === \"value\") {\n    return header.credential.value;\n  }\n\n  if (header.credential.kind === \"default\") {\n    const value = resolveDefaultCredentialValue(serviceId);\n    if (!value) {\n      throw new Error(\n        `Workspace policy for service \"${serviceId}\" requires ${describeDefaultCredentialSource(serviceId)}.`,\n      );\n    }\n    return value;\n  }\n\n  throw new Error(\n    `Workspace policy for service \"${serviceId}\" contains a redacted credential and cannot be applied.`,\n  );\n}\n\nfunction compileHeaderRules(\n  serviceId: string,\n  headers: readonly PolicyServiceHeaderTransform[] | undefined,\n): VercelNetworkPolicyRule[] {\n  if (!headers || headers.length === 0) {\n    return [];\n  }\n\n  const resolvedHeaders = Object.fromEntries(\n    headers.map((header) => [\n      header.headerName,\n      `${header.valuePrefix ?? \"\"}${resolveCredentialValue(serviceId, header)}`,\n    ]),\n  );\n\n  return [\n    {\n      transform: [\n        {\n          headers: resolvedHeaders,\n        },\n      ],\n    },\n  ];\n}\n\nexport function compileVercelNetworkPolicy(policy: WorkspacePolicy): VercelNetworkPolicy {\n  switch (policy.mode) {\n    case \"allow-all\":\n      return \"allow-all\";\n    case \"deny-all\":\n      return \"deny-all\";\n    case \"allow-services\": {\n      const allow: Record<string, VercelNetworkPolicyRule[]> = {};\n\n      for (const service of policy.services) {\n        const rules = compileHeaderRules(service.id, service.headers);\n        for (const domain of service.domains) {\n          const existing = allow[domain] ?? [];\n          allow[domain] = [...existing, ...rules];\n        }\n      }\n\n      return { allow };\n    }\n  }\n}\n","import { createVercelSandboxDriverFactory } from \"../drivers/vercel-sandbox.ts\";\nimport { createSandboxProvider } from \"../types.ts\";\nimport type { SandkitSandboxProvider, VercelSandboxOptions } from \"../types.ts\";\n\nexport type { SandkitSandboxProvider, VercelSandboxOptions } from \"../types.ts\";\n\nexport function vercelSandbox(options: VercelSandboxOptions = {}): SandkitSandboxProvider {\n  return createSandboxProvider(\"vercel\", createVercelSandboxDriverFactory(options));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;;;ACKjB,SAAS,8BAA8B,WAAuC;AACnF,UAAQ,WAAW;AAAA,IACjB,KAAK;AACH,aAAO,0BAA0B;AAAA,IACnC,KAAK;AACH,aAAO,2BAA2B;AAAA,IACpC,KAAK;AACH,aAAO,2BAA2B;AAAA,IACpC,KAAK;AACH,aAAO,8BAA8B;AAAA,IACvC;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,gCAAgC,WAA2B;AACzE,UAAQ,WAAW;AAAA,IACjB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,mCAAmC,SAAS;AAAA,EACvD;AACF;;;ACtBA,SAAS,uBAAuB,WAAmB,QAA8C;AAC/F,MAAI,OAAO,WAAW,SAAS,SAAS;AACtC,WAAO,OAAO,WAAW;AAAA,EAC3B;AAEA,MAAI,OAAO,WAAW,SAAS,WAAW;AACxC,UAAM,QAAQ,8BAA8B,SAAS;AACrD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,iCAAiC,SAAS,cAAc,gCAAgC,SAAS,CAAC;AAAA,MACpG;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,IAAI;AAAA,IACR,iCAAiC,SAAS;AAAA,EAC5C;AACF;AAEA,SAAS,mBACP,WACA,SAC2B;AAC3B,MAAI,CAAC,WAAW,QAAQ,WAAW,GAAG;AACpC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,kBAAkB,OAAO;AAAA,IAC7B,QAAQ,IAAI,CAAC,WAAW;AAAA,MACtB,OAAO;AAAA,MACP,GAAG,OAAO,eAAe,EAAE,GAAG,uBAAuB,WAAW,MAAM,CAAC;AAAA,IACzE,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,MACE,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,2BAA2B,QAA8C;AACvF,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK,kBAAkB;AACrB,YAAM,QAAmD,CAAC;AAE1D,iBAAW,WAAW,OAAO,UAAU;AACrC,cAAM,QAAQ,mBAAmB,QAAQ,IAAI,QAAQ,OAAO;AAC5D,mBAAW,UAAU,QAAQ,SAAS;AACpC,gBAAM,WAAW,MAAM,MAAM,KAAK,CAAC;AACnC,gBAAM,MAAM,IAAI,CAAC,GAAG,UAAU,GAAG,KAAK;AAAA,QACxC;AAAA,MACF;AAEA,aAAO,EAAE,MAAM;AAAA,IACjB;AAAA,EACF;AACF;;;AF3CA,IAAM,sBAAN,MAAmD;AAAA,EACxC;AAAA,EACA,WAAW;AAAA,EAEpB,YAAY,SAAkD;AAC5D,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,KAAa;AACf,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEA,MAAM,YAAY,QAAwC;AACxD,UAAM,KAAK,SAAS,oBAAoB,2BAA2B,MAAM,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,kBAAgD;AACpD,UAAM,UAAU,KAAK;AACrB,UAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,UAAM,YACJ,OAAO,QAAQ,YAAY,YAAY,OAAO,SAAS,QAAQ,OAAO,KAAK,QAAQ,UAAU,IACzF,QAAQ,UACR;AAEN,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,WAAW,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,YAAY;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAAiB,MAAwC;AACxE,UAAM,SAAS,MAAM,KAAK,SAAS,WAAW,SAAS,IAAI;AAC3D,UAAM,WAAW,MAAM,KAAK,mBAAmB,MAAM;AAErD,WAAO;AAAA,MACL,UAAU,SAAS;AAAA,MACnB,QAAQ,MAAM,SAAS,OAAO;AAAA,MAC9B,QAAQ,MAAM,SAAS,OAAO;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAA4E;AAC7F,UAAM,UAAU,MAAM,KAAK,SAAS,WAAW;AAAA,MAC7C,KAAK,MAAM;AAAA,MACX,MAAM,CAAC,GAAG,MAAM,IAAI;AAAA,MACpB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,sBAAsB,OAAO,GAAG;AACnC,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAEA,UAAM,YAAY,QAAQ,SAAS,GAAG,KAAK,SAAS,SAAS,IAAI,KAAK,IAAI,CAAC;AAC3E,UAAM,sBAAsB;AAAA,MAC1B,sBAAsB,OAAO;AAAA,MAC7B,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM,YAAoC;AACxC,cAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,eAAO;AAAA,UACL,UAAU,SAAS;AAAA,UACnB,QAAQ,MAAM,SAAS,OAAO;AAAA,UAC9B,QAAQ,MAAM,SAAS,OAAO;AAAA,QAChC;AAAA,MACF;AAAA,MACA,MAAM,sBAAsB,MAAM,oBAAoB,IAAI;AAAA,IAC5D;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,MAA+B;AACvC,QAAI;AACF,aAAO,KAAK,SAAS,OAAO,IAAI;AAAA,IAClC,SAAS,OAAO;AACd,UAAI,EAAE,iBAAiB,UAAU,CAAC,MAAM,QAAQ,SAAS,mBAAmB,GAAG;AAC7E,cAAM;AAAA,MACR;AAEA,YAAM,YAAY,MAAM,QAAQ,IAAI,EAAE,WAAW,KAAK,SAAS,UAAU,CAAC;AAC1E,aAAO,UAAU,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,YAAmC;AACrD,UAAM,gBACJ,KAAK,SACL;AACF,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAEA,UAAM,cAAc,KAAK,KAAK,UAAU,UAAU;AAAA,EACpD;AAAA,EAEA,MAAM,WAA2C;AAG/C,UAAM,WAAW,MAAM,KAAK,SAAS,SAAS;AAE9C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,WAAW,KAAK,SAAS;AAAA,MACzB,OAAO;AAAA,QACL,YAAY,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBAAmB,KAA8C;AACrE,QAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,YAAY;AAClB,QAAI,UAAU,MAAM;AAClB,aAAO,UAAU,KAAK;AAAA,IACxB;AAEA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAAsB,OAA8C;AAC3E,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,SAAS,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,SAAO,UAAU,UAAU,UAAa,OAAO,UAAU,UAAU;AACrE;AAEA,SAAS,WAAwB,OAAsC;AACrE,SACE,UAAU,SACT,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,OAAQ,MAAsB,OAAO,QAAQ,MAAM;AAEvD;AAEA,SAAS,gBAA6B,OAA2C;AAC/E,SACE,UAAU,SACT,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,OAAQ,MAA2B,OAAO,aAAa,MAAM;AAEjE;AAEA,SAAS,sBAAsB,KAA8D;AAC3F,QAAM,UAAU,IAAI,OAAO;AAC3B,MAAI,YAAY,QAAW;AACzB,WAAO;AAAA,EACT;AACA,MAAI,gBAAyB,OAAO,GAAG;AACrC,WAAO;AAAA,EACT;AACA,MAAI,WAAoB,OAAO,GAAG;AAChC,WAAO,wBAAwB,OAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,wBAA2B,UAAyC;AAC3E,SAAO;AAAA,IACL,QAAQ,OAAO,aAAa,IAAI;AAC9B,iBAAW,SAAS,UAAU;AAC5B,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,4BACP,MACA,UACA,UACwD;AACxD,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,eAAsC,CAAC;AAC7C,QAAM,UAA6B,CAAC;AACpC,MAAI,YAAY;AAChB,MAAI,QAAiB;AACrB,MAAI,cAAc;AAElB,QAAM,gBAAgB,MAAM;AAC1B,WAAO,QAAQ,SAAS,GAAG;AACzB,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,MAAM,YAA2B;AACrC,QAAI,aAAa;AACf;AAAA,IACF;AACA,kBAAc;AAEd,QAAI;AACF,uBAAiB,OAAO,MAAM;AAC5B,cAAM,aAAa,oBAAoB,GAAG;AAC1C,YAAI,CAAC,YAAY;AACf;AAAA,QACF;AAEA,qBAAa,KAAK,UAAU;AAC5B,YAAI,WAAW,WAAW,UAAU;AAClC,qBAAW,WAAW,KAAK;AAAA,QAC7B,OAAO;AACL,qBAAW,WAAW,KAAK;AAAA,QAC7B;AACA,sBAAc;AAAA,MAChB;AAAA,IACF,SAAS,OAAO;AACd,cAAQ;AAAA,IACV,UAAE;AACA,kBAAY;AACZ,oBAAc;AAAA,IAChB;AAAA,EACF;AAEA,OAAK,IAAI,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAEzB,QAAM,cAAc,MAAqB;AACvC,WAAO,IAAI,QAAc,CAAC,YAAY;AACpC,cAAQ,KAAK,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,QAAM,oBAAoB,MAA0C;AAClE,WAAO;AAAA,MACL,QAAQ,OAAO,aAAa,IAAI;AAC9B,YAAI,QAAQ;AACZ,eAAO,MAAM;AACX,cAAI,QAAQ,aAAa,QAAQ;AAC/B,kBAAM,aAAa,OAAO;AAC1B;AAAA,UACF;AACA,cAAI,UAAU,MAAM;AAClB,kBAAM,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,2BAA2B;AAAA,UAC9E;AACA,cAAI,WAAW;AACb;AAAA,UACF;AACA,gBAAM,YAAY;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,oBAAoB,KAA0C;AAC5E,MAAI,OAAO,QAAQ,UAAU;AAC3B,WAAO,EAAE,QAAQ,UAAU,OAAO,IAAI;AAAA,EACxC;AACA,MAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AAQlB,QAAM,cAAc,UAAU;AAC9B,QAAM,SAAS,gBAAgB,YAAY,gBAAgB,WAAW,cAAc;AACpF,QAAM,WACJ,UAAU,QACV,UAAU,UACV,UAAU,SACV,UAAU,QACV,UAAU,WACV;AAEF,MAAI,OAAO,aAAa,UAAU;AAChC,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,QAAQ,OAAO,SAAS;AACnC;AAEA,IAAM,6BAAN,MAAiE;AAAA,EACtD;AAAA,EACA;AAAA,EAET,YAAY,UAAgC,CAAC,GAAG;AAC9C,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,kBAAkB;AAAA,MACrB,QAAQ,kBAAkB,QAAQ;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,0BAA0B,OAAyB;AACjD,QAAI,EAAE,iBAAiB,QAAQ;AAC7B,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,MAAM,QAAQ,YAAY;AAC1C,WACE,QAAQ,SAAS,WAAW,KAC5B,QAAQ,SAAS,gBAAgB,KACjC,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,iBAAiB;AAAA,EAEtC;AAAA,EAEA,MAAM,cACJ,YACA,SACwB;AACxB,UAAM,UAAU,KAAK,yBAAyB,OAAO;AAErD,UAAM,UAAU,MAAM,QAAQ,OAAO;AAAA,MACnC,SAAS,KAAK;AAAA,MACd;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,eAAe,2BAA2B,QAAQ,MAAM;AAAA,IAC1D,CAAC;AAED,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AAAA,EAEA,MAAM,cACJ,WACA,UACA,SACwB;AACxB,UAAM,UAAU,KAAK,yBAAyB,OAAO;AACrD,UAAM,QAAQ,SAAS;AACvB,UAAM,aAAa,OAAO;AAC1B,UAAM,oBAAoB,UAAU,aAAa,SAAS;AAE1D,UAAM,UACJ,eAAe,UAAa,OAAO,eAAe,WAC9C,OAAO,sBAAsB,UACxB,MAAM;AACL,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E,GAAG,IACH,QAAQ,IAAI,EAAE,WAAW,kBAAkB,CAAC,KAChD,MAAM,QAAQ,OAAO;AAAA,MACnB,QAAQ;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,eAAe,2BAA2B,QAAQ,MAAM;AAAA,IAC1D,CAAC;AAKP,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AAAA,EAEA,yBAAyB,SAAuC;AAC9D,WAAO,wBAAwB,QAAQ,aAAa,KAAK,iBAAiB,iBAAiB;AAAA,EAC7F;AACF;AAEA,SAAS,wBAAwB,OAAgB,OAAuB;AACtE,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AAEA,MACE,OAAO,UAAU,YACjB,CAAC,OAAO,UAAU,KAAK,KACvB,CAAC,OAAO,SAAS,KAAK,KACtB,SAAS,GACT;AACA,UAAM,IAAI,MAAM,GAAG,KAAK,8CAA8C;AAAA,EACxE;AAEA,SAAO;AACT;AAEO,SAAS,iCACd,UAAgC,CAAC,GACX;AACtB,SAAO,IAAI,2BAA2B,OAAO;AAC/C;;;AGtaO,SAAS,cAAc,UAAgC,CAAC,GAA2B;AACxF,SAAO,sBAAsB,UAAU,iCAAiC,OAAO,CAAC;AAClF;","names":[]}
+{"version":3,"sources":["../../src/drivers/vercel-sandbox.ts","../../src/policies/default-credentials.ts","../../src/drivers/vercel-network-policy.ts","../../src/integrations/vercel.ts"],"sourcesContent":["import { Sandbox } from \"@vercel/sandbox\";\n\nimport type { WorkspacePolicy } from \"../policies/types.ts\";\nimport type {\n  Command,\n  CommandResult,\n  PersistedSandboxState,\n  SandboxSessionLease,\n  SandboxDriver,\n  WorkspaceSessionLog,\n  WorkspaceSessionProcess,\n  WorkspaceSessionProcessStartInput,\n  SandboxCreateOptions,\n  SandboxDriverFactory,\n  WorkspaceRecord,\n  VercelSandboxOptions,\n} from \"../types.ts\";\nimport { compileVercelNetworkPolicy } from \"./vercel-network-policy.ts\";\n\ninterface VercelCommandFinished {\n  exitCode: number;\n  stdout(): Promise<string>;\n  stderr(): Promise<string>;\n}\n\ninterface VercelCommandHandle {\n  wait(): Promise<VercelCommandFinished>;\n  readonly cmdId?: string;\n  readonly logs?: () => unknown;\n}\n\ninterface VercelPersistedState {\n  snapshotId?: string;\n}\n\nclass VercelSandboxDriver implements SandboxDriver {\n  readonly #sandbox: Awaited<ReturnType<typeof Sandbox.get>>;\n  readonly provider = \"vercel-sandbox\";\n\n  constructor(sandbox: Awaited<ReturnType<typeof Sandbox.get>>) {\n    this.#sandbox = sandbox;\n  }\n\n  get id(): string {\n    return this.#sandbox.sandboxId;\n  }\n\n  async applyPolicy(policy: WorkspacePolicy): Promise<void> {\n    await this.#sandbox.updateNetworkPolicy(compileVercelNetworkPolicy(policy));\n  }\n\n  async getSessionLease(): Promise<SandboxSessionLease> {\n    const sandbox = this.#sandbox;\n    const observedAt = new Date().toISOString();\n    const timeoutMs =\n      typeof sandbox.timeout === \"number\" && Number.isFinite(sandbox.timeout) && sandbox.timeout > 0\n        ? sandbox.timeout\n        : 60_000;\n\n    return {\n      sandboxId: sandbox.sandboxId,\n      observedAt,\n      expiresAt: new Date(Date.parse(observedAt) + timeoutMs).toISOString(),\n    };\n  }\n\n  async runCommand(\n    command: string,\n    args: string[],\n    options?: { readonly detached?: boolean },\n  ): Promise<Command> {\n    const rawResult = options?.detached\n      ? await this.#sandbox.runCommand({\n          cmd: command,\n          args,\n          detached: true,\n        })\n      : await this.#sandbox.runCommand(command, args);\n\n    const logIterator = options?.detached ? getCommandLogIterator(rawResult) : undefined;\n    const commandLogs = logIterator\n      ? () => createEphemeralCommandLogStream(logIterator)\n      : undefined;\n\n    return {\n      wait: async () => {\n        const finished = await this.#toCommandFinished(rawResult);\n        return {\n          exitCode: finished.exitCode,\n          stdout: await finished.stdout(),\n          stderr: await finished.stderr(),\n        };\n      },\n      logs: commandLogs,\n    };\n  }\n\n  async startProcess(input: WorkspaceSessionProcessStartInput): Promise<WorkspaceSessionProcess> {\n    const started = await this.#sandbox.runCommand({\n      cmd: input.command,\n      args: [...input.args],\n      detached: true,\n    });\n    if (!isVercelCommandHandle(started)) {\n      throw new Error(\"Unexpected Vercel sandbox startProcess() response shape.\");\n    }\n\n    const processId = started.cmdId ?? `${this.#sandbox.sandboxId}-${Date.now()}`;\n    const commandLogBroadcast = createCommandLogBroadcaster(\n      getCommandLogIterator(started),\n      input.onStdout,\n      input.onStderr,\n    );\n\n    return {\n      processId,\n      wait: async (): Promise<CommandResult> => {\n        const finished = await this.#toCommandFinished(started);\n        return {\n          exitCode: finished.exitCode,\n          stdout: await finished.stdout(),\n          stderr: await finished.stderr(),\n        };\n      },\n      logs: commandLogBroadcast ? () => commandLogBroadcast() : undefined,\n    };\n  }\n\n  async url(port: number): Promise<string> {\n    try {\n      return this.#sandbox.domain(port);\n    } catch (error) {\n      if (!(error instanceof Error) || !error.message.includes(\"No route for port\")) {\n        throw error;\n      }\n\n      const refreshed = await Sandbox.get({ sandboxId: this.#sandbox.sandboxId });\n      return refreshed.domain(port);\n    }\n  }\n\n  async extendTimeout(durationMs: number): Promise<void> {\n    const extendTimeout = (\n      this.#sandbox as { extendTimeout?: (durationMs: number) => Promise<unknown> }\n    ).extendTimeout;\n    if (!extendTimeout) {\n      throw new Error(\"This Vercel sandbox does not support extendTimeout().\");\n    }\n\n    await extendTimeout.call(this.#sandbox, durationMs);\n  }\n\n  async snapshot(): Promise<PersistedSandboxState> {\n    // Vercel sandbox snapshot() restores through a new sandbox and implicitly stops the source sandbox.\n    // Keep this behavior as a provider detail in the driver implementation.\n    const snapshot = await this.#sandbox.snapshot();\n\n    return {\n      kind: \"vercel-sandbox-snapshot\",\n      sessionId: this.#sandbox.sandboxId,\n      state: {\n        snapshotId: snapshot.snapshotId,\n      },\n    };\n  }\n\n  async #toCommandFinished(raw: unknown): Promise<VercelCommandFinished> {\n    if (typeof raw !== \"object\" || raw === null) {\n      throw new Error(\"Unexpected Vercel sandbox command response\");\n    }\n\n    const candidate = raw as { wait?: () => Promise<VercelCommandFinished> };\n    if (candidate.wait) {\n      return candidate.wait();\n    }\n\n    return raw as VercelCommandFinished;\n  }\n}\n\nfunction createEphemeralCommandLogStream(\n  logs: AsyncIterable<unknown>,\n): AsyncIterable<WorkspaceSessionLog> {\n  return {\n    async *[Symbol.asyncIterator]() {\n      try {\n        for await (const log of logs) {\n          const normalized = normalizeCommandLog(log);\n          if (normalized) {\n            yield normalized;\n          }\n        }\n      } catch (cause) {\n        if (cause instanceof Error) {\n          throw cause;\n        }\n        throw new Error(\"Command logs failed.\");\n      }\n    },\n  };\n}\n\nfunction isVercelCommandHandle(value: unknown): value is VercelCommandHandle {\n  if (typeof value !== \"object\" || value === null) {\n    return false;\n  }\n\n  const candidate = value as { wait?: unknown; cmdId?: unknown };\n  if (typeof candidate.wait !== \"function\") {\n    return false;\n  }\n\n  return candidate.cmdId === undefined || typeof candidate.cmdId === \"string\";\n}\n\nfunction isIterable<T = unknown>(value: unknown): value is Iterable<T> {\n  return (\n    value !== null &&\n    (typeof value === \"object\" || typeof value === \"function\") &&\n    typeof (value as Iterable<T>)[Symbol.iterator] === \"function\"\n  );\n}\n\nfunction isAsyncIterable<T = unknown>(value: unknown): value is AsyncIterable<T> {\n  return (\n    value !== null &&\n    (typeof value === \"object\" || typeof value === \"function\") &&\n    typeof (value as AsyncIterable<T>)[Symbol.asyncIterator] === \"function\"\n  );\n}\n\nfunction getCommandLogIterator(raw: VercelCommandHandle): AsyncIterable<unknown> | undefined {\n  const rawLogs = raw.logs?.();\n  if (rawLogs === undefined) {\n    return undefined;\n  }\n  if (isAsyncIterable<unknown>(rawLogs)) {\n    return rawLogs;\n  }\n  if (isIterable<unknown>(rawLogs)) {\n    return toAsyncIterableFromSync(rawLogs);\n  }\n  return undefined;\n}\n\nfunction toAsyncIterableFromSync<T>(iterable: Iterable<T>): AsyncIterable<T> {\n  return {\n    async *[Symbol.asyncIterator]() {\n      for (const value of iterable) {\n        yield value;\n      }\n    },\n  };\n}\n\nfunction createCommandLogBroadcaster(\n  logs: AsyncIterable<unknown> | undefined,\n  onStdout?: (chunk: string) => void,\n  onStderr?: (chunk: string) => void,\n): (() => AsyncIterable<WorkspaceSessionLog>) | undefined {\n  if (!logs) {\n    return undefined;\n  }\n\n  const bufferedLogs: WorkspaceSessionLog[] = [];\n  const waiters: Array<() => void> = [];\n  let completed = false;\n  let error: unknown = null;\n  let pumpStarted = false;\n\n  const notifyWaiters = () => {\n    while (waiters.length > 0) {\n      waiters.pop()?.();\n    }\n  };\n\n  const run = async (): Promise<void> => {\n    if (pumpStarted) {\n      return;\n    }\n    pumpStarted = true;\n\n    try {\n      for await (const log of logs) {\n        const normalized = normalizeCommandLog(log);\n        if (!normalized) {\n          continue;\n        }\n\n        bufferedLogs.push(normalized);\n        if (normalized.stream === \"stderr\") {\n          onStderr?.(normalized.chunk);\n        } else {\n          onStdout?.(normalized.chunk);\n        }\n        notifyWaiters();\n      }\n    } catch (cause) {\n      error = cause;\n    } finally {\n      completed = true;\n      notifyWaiters();\n    }\n  };\n\n  void run().catch(() => {});\n\n  const waitForWork = (): Promise<void> => {\n    return new Promise<void>((resolve) => {\n      waiters.push(resolve);\n    });\n  };\n\n  const createLogIterable = (): AsyncIterable<WorkspaceSessionLog> => {\n    return {\n      async *[Symbol.asyncIterator]() {\n        let index = 0;\n        while (true) {\n          if (index < bufferedLogs.length) {\n            yield bufferedLogs[index++]!;\n            continue;\n          }\n          if (error !== null) {\n            throw error instanceof Error ? error : new Error(\"startProcess logs failed.\");\n          }\n          if (completed) {\n            return;\n          }\n          await waitForWork();\n        }\n      },\n    };\n  };\n\n  return createLogIterable;\n}\n\nexport function normalizeCommandLog(log: unknown): WorkspaceSessionLog | null {\n  if (typeof log === \"string\") {\n    return { stream: \"stdout\", chunk: log };\n  }\n  if (typeof log !== \"object\" || log === null) {\n    return null;\n  }\n\n  const candidate = log as {\n    stream?: unknown;\n    output?: unknown;\n    chunk?: unknown;\n    text?: unknown;\n    message?: unknown;\n    data?: unknown;\n  };\n  const streamValue = candidate.stream;\n  const stream = streamValue === \"stderr\" || streamValue === \"stdout\" ? streamValue : \"stdout\";\n  const rawChunk =\n    candidate.data ??\n    candidate.output ??\n    candidate.chunk ??\n    candidate.text ??\n    candidate.message ??\n    null;\n\n  if (typeof rawChunk !== \"string\") {\n    return null;\n  }\n\n  return { stream, chunk: rawChunk };\n}\n\nclass VercelSandboxDriverFactory implements SandboxDriverFactory {\n  readonly #runtime: string;\n  readonly #defaultTimeout: number;\n\n  constructor(options: VercelSandboxOptions = {}) {\n    this.#runtime = options.runtime ?? \"node24\";\n    this.#defaultTimeout = normalizeSandboxTimeout(\n      options.defaultTimeout ?? options.timeout,\n      \"Vercel sandbox default timeout\",\n    );\n  }\n\n  isSessionUnavailableError(error: unknown): boolean {\n    if (!(error instanceof Error)) {\n      return false;\n    }\n\n    const message = error.message.toLowerCase();\n    return (\n      message.includes(\"not found\") ||\n      message.includes(\"does not exist\") ||\n      message.includes(\"sandbox_stopped\") ||\n      message.includes(\"sandbox stopped\")\n    );\n  }\n\n  async createSandbox(\n    _workspace: WorkspaceRecord,\n    options: SandboxCreateOptions,\n  ): Promise<SandboxDriver> {\n    const timeout = this.#defaultTimeoutForCreate(options);\n\n    const sandbox = await Sandbox.create({\n      runtime: this.#runtime,\n      timeout,\n      ports: options.exposedPorts,\n      networkPolicy: compileVercelNetworkPolicy(options.policy),\n    });\n\n    return new VercelSandboxDriver(sandbox);\n  }\n\n  async resumeSandbox(\n    workspace: WorkspaceRecord,\n    snapshot: PersistedSandboxState,\n    options: SandboxCreateOptions,\n  ): Promise<SandboxDriver> {\n    const timeout = this.#defaultTimeoutForCreate(options);\n    const state = snapshot.state as VercelPersistedState | undefined;\n    const snapshotId = state?.snapshotId;\n    const fallbackSandboxId = workspace.sandboxId ?? snapshot.sessionId;\n\n    const sandbox =\n      snapshotId === undefined || typeof snapshotId !== \"string\"\n        ? await (fallbackSandboxId === undefined\n            ? (() => {\n                throw new Error(\"Persisted sandbox state is missing restore information\");\n              })()\n            : Sandbox.get({ sandboxId: fallbackSandboxId }))\n        : await Sandbox.create({\n            source: {\n              type: \"snapshot\",\n              snapshotId,\n            },\n            timeout,\n            ports: options.exposedPorts,\n            networkPolicy: compileVercelNetworkPolicy(options.policy),\n          });\n\n    // Reattaching to an existing live sandbox should not mutate provider state.\n    // Updating the network policy here races with commit/snapshot shutdown and can\n    // fail on otherwise read-only flows like getActiveLease().\n    return new VercelSandboxDriver(sandbox);\n  }\n\n  #defaultTimeoutForCreate(options: SandboxCreateOptions): number {\n    return normalizeSandboxTimeout(options.timeoutMs ?? this.#defaultTimeout, \"runtime timeout\");\n  }\n}\n\nfunction normalizeSandboxTimeout(value: unknown, label: string): number {\n  if (value === undefined) {\n    return 60_000;\n  }\n\n  if (\n    typeof value !== \"number\" ||\n    !Number.isInteger(value) ||\n    !Number.isFinite(value) ||\n    value <= 0\n  ) {\n    throw new Error(`${label} must be a positive integer in milliseconds.`);\n  }\n\n  return value;\n}\n\nexport function createVercelSandboxDriverFactory(\n  options: VercelSandboxOptions = {},\n): SandboxDriverFactory {\n  return new VercelSandboxDriverFactory(options);\n}\n","import { resolveAiGatewayDefaultApiKey } from \"./ai-gateway.ts\";\nimport { resolveCodexDefaultApiKey } from \"./codex.ts\";\nimport { resolveGeminiDefaultApiKey } from \"./gemini.ts\";\nimport { resolveGithubDefaultApiKey } from \"./github.ts\";\n\nexport function resolveDefaultCredentialValue(serviceId: string): string | undefined {\n  switch (serviceId) {\n    case \"codex\":\n      return resolveCodexDefaultApiKey();\n    case \"gemini\":\n      return resolveGeminiDefaultApiKey();\n    case \"github\":\n      return resolveGithubDefaultApiKey();\n    case \"aiGateway\":\n      return resolveAiGatewayDefaultApiKey();\n    default:\n      return undefined;\n  }\n}\n\nexport function describeDefaultCredentialSource(serviceId: string): string {\n  switch (serviceId) {\n    case \"codex\":\n      return \"CODEX_API_KEY\";\n    case \"gemini\":\n      return \"GEMINI_API_KEY\";\n    case \"github\":\n      return \"GITHUB_TOKEN\";\n    case \"aiGateway\":\n      return \"AI_GATEWAY_API_KEY\";\n    default:\n      return `default credential for service \"${serviceId}\"`;\n  }\n}\n","import type {\n  NetworkPolicy as VercelNetworkPolicy,\n  NetworkPolicyRule as VercelNetworkPolicyRule,\n} from \"@vercel/sandbox\";\n\nimport {\n  describeDefaultCredentialSource,\n  resolveDefaultCredentialValue,\n} from \"../policies/default-credentials.ts\";\nimport type { PolicyServiceHeaderTransform, WorkspacePolicy } from \"../policies/types.ts\";\n\nfunction resolveCredentialValue(serviceId: string, header: PolicyServiceHeaderTransform): string {\n  if (header.credential.kind === \"value\") {\n    return header.credential.value;\n  }\n\n  if (header.credential.kind === \"default\") {\n    const value = resolveDefaultCredentialValue(serviceId);\n    if (!value) {\n      throw new Error(\n        `Workspace policy for service \"${serviceId}\" requires ${describeDefaultCredentialSource(serviceId)}.`,\n      );\n    }\n    return value;\n  }\n\n  throw new Error(\n    `Workspace policy for service \"${serviceId}\" contains a redacted credential and cannot be applied.`,\n  );\n}\n\nfunction encodeHeaderValue(\n  value: string,\n  encoding: PolicyServiceHeaderTransform[\"valueEncoding\"],\n): string {\n  if (encoding === \"base64\") {\n    return Buffer.from(value, \"utf8\").toString(\"base64\");\n  }\n\n  return value;\n}\n\nfunction compileHeaderRules(\n  serviceId: string,\n  headers: readonly PolicyServiceHeaderTransform[] | undefined,\n): VercelNetworkPolicyRule[] {\n  if (!headers || headers.length === 0) {\n    return [];\n  }\n\n  const resolvedHeaders = Object.fromEntries(\n    headers.map((header) => [\n      header.headerName,\n      `${header.valuePrefix ?? \"\"}${encodeHeaderValue(\n        `${header.credentialPrefix ?? \"\"}${resolveCredentialValue(serviceId, header)}`,\n        header.valueEncoding,\n      )}`,\n    ]),\n  );\n\n  return [\n    {\n      transform: [\n        {\n          headers: resolvedHeaders,\n        },\n      ],\n    },\n  ];\n}\n\nexport function compileVercelNetworkPolicy(policy: WorkspacePolicy): VercelNetworkPolicy {\n  switch (policy.mode) {\n    case \"allow-all\":\n      return \"allow-all\";\n    case \"deny-all\":\n      return \"deny-all\";\n    case \"allow-services\": {\n      const allow: Record<string, VercelNetworkPolicyRule[]> = {};\n\n      for (const service of policy.services) {\n        for (const domain of service.domains) {\n          const rules = compileHeaderRules(\n            service.id,\n            service.domainHeaders?.[domain] ?? service.headers,\n          );\n          const existing = allow[domain] ?? [];\n          allow[domain] = [...existing, ...rules];\n        }\n      }\n\n      return { allow };\n    }\n  }\n}\n","import { createVercelSandboxDriverFactory } from \"../drivers/vercel-sandbox.ts\";\nimport { createSandboxProvider } from \"../types.ts\";\nimport type { SandkitSandboxProvider, VercelSandboxOptions } from \"../types.ts\";\n\nexport type { SandkitSandboxProvider, VercelSandboxOptions } from \"../types.ts\";\n\nexport function vercelSandbox(options: VercelSandboxOptions = {}): SandkitSandboxProvider {\n  return createSandboxProvider(\"vercel\", createVercelSandboxDriverFactory(options));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;;;ACKjB,SAAS,8BAA8B,WAAuC;AACnF,UAAQ,WAAW;AAAA,IACjB,KAAK;AACH,aAAO,0BAA0B;AAAA,IACnC,KAAK;AACH,aAAO,2BAA2B;AAAA,IACpC,KAAK;AACH,aAAO,2BAA2B;AAAA,IACpC,KAAK;AACH,aAAO,8BAA8B;AAAA,IACvC;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,gCAAgC,WAA2B;AACzE,UAAQ,WAAW;AAAA,IACjB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,mCAAmC,SAAS;AAAA,EACvD;AACF;;;ACtBA,SAAS,uBAAuB,WAAmB,QAA8C;AAC/F,MAAI,OAAO,WAAW,SAAS,SAAS;AACtC,WAAO,OAAO,WAAW;AAAA,EAC3B;AAEA,MAAI,OAAO,WAAW,SAAS,WAAW;AACxC,UAAM,QAAQ,8BAA8B,SAAS;AACrD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,iCAAiC,SAAS,cAAc,gCAAgC,SAAS,CAAC;AAAA,MACpG;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,IAAI;AAAA,IACR,iCAAiC,SAAS;AAAA,EAC5C;AACF;AAEA,SAAS,kBACP,OACA,UACQ;AACR,MAAI,aAAa,UAAU;AACzB,WAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ;AAAA,EACrD;AAEA,SAAO;AACT;AAEA,SAAS,mBACP,WACA,SAC2B;AAC3B,MAAI,CAAC,WAAW,QAAQ,WAAW,GAAG;AACpC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,kBAAkB,OAAO;AAAA,IAC7B,QAAQ,IAAI,CAAC,WAAW;AAAA,MACtB,OAAO;AAAA,MACP,GAAG,OAAO,eAAe,EAAE,GAAG;AAAA,QAC5B,GAAG,OAAO,oBAAoB,EAAE,GAAG,uBAAuB,WAAW,MAAM,CAAC;AAAA,QAC5E,OAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,MACE,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,2BAA2B,QAA8C;AACvF,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK,kBAAkB;AACrB,YAAM,QAAmD,CAAC;AAE1D,iBAAW,WAAW,OAAO,UAAU;AACrC,mBAAW,UAAU,QAAQ,SAAS;AACpC,gBAAM,QAAQ;AAAA,YACZ,QAAQ;AAAA,YACR,QAAQ,gBAAgB,MAAM,KAAK,QAAQ;AAAA,UAC7C;AACA,gBAAM,WAAW,MAAM,MAAM,KAAK,CAAC;AACnC,gBAAM,MAAM,IAAI,CAAC,GAAG,UAAU,GAAG,KAAK;AAAA,QACxC;AAAA,MACF;AAEA,aAAO,EAAE,MAAM;AAAA,IACjB;AAAA,EACF;AACF;;;AF3DA,IAAM,sBAAN,MAAmD;AAAA,EACxC;AAAA,EACA,WAAW;AAAA,EAEpB,YAAY,SAAkD;AAC5D,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,KAAa;AACf,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEA,MAAM,YAAY,QAAwC;AACxD,UAAM,KAAK,SAAS,oBAAoB,2BAA2B,MAAM,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,kBAAgD;AACpD,UAAM,UAAU,KAAK;AACrB,UAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,UAAM,YACJ,OAAO,QAAQ,YAAY,YAAY,OAAO,SAAS,QAAQ,OAAO,KAAK,QAAQ,UAAU,IACzF,QAAQ,UACR;AAEN,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,WAAW,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,YAAY;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,MAAM,WACJ,SACA,MACA,SACkB;AAClB,UAAM,YAAY,SAAS,WACvB,MAAM,KAAK,SAAS,WAAW;AAAA,MAC7B,KAAK;AAAA,MACL;AAAA,MACA,UAAU;AAAA,IACZ,CAAC,IACD,MAAM,KAAK,SAAS,WAAW,SAAS,IAAI;AAEhD,UAAM,cAAc,SAAS,WAAW,sBAAsB,SAAS,IAAI;AAC3E,UAAM,cAAc,cAChB,MAAM,gCAAgC,WAAW,IACjD;AAEJ,WAAO;AAAA,MACL,MAAM,YAAY;AAChB,cAAM,WAAW,MAAM,KAAK,mBAAmB,SAAS;AACxD,eAAO;AAAA,UACL,UAAU,SAAS;AAAA,UACnB,QAAQ,MAAM,SAAS,OAAO;AAAA,UAC9B,QAAQ,MAAM,SAAS,OAAO;AAAA,QAChC;AAAA,MACF;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAA4E;AAC7F,UAAM,UAAU,MAAM,KAAK,SAAS,WAAW;AAAA,MAC7C,KAAK,MAAM;AAAA,MACX,MAAM,CAAC,GAAG,MAAM,IAAI;AAAA,MACpB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,sBAAsB,OAAO,GAAG;AACnC,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAEA,UAAM,YAAY,QAAQ,SAAS,GAAG,KAAK,SAAS,SAAS,IAAI,KAAK,IAAI,CAAC;AAC3E,UAAM,sBAAsB;AAAA,MAC1B,sBAAsB,OAAO;AAAA,MAC7B,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM,YAAoC;AACxC,cAAM,WAAW,MAAM,KAAK,mBAAmB,OAAO;AACtD,eAAO;AAAA,UACL,UAAU,SAAS;AAAA,UACnB,QAAQ,MAAM,SAAS,OAAO;AAAA,UAC9B,QAAQ,MAAM,SAAS,OAAO;AAAA,QAChC;AAAA,MACF;AAAA,MACA,MAAM,sBAAsB,MAAM,oBAAoB,IAAI;AAAA,IAC5D;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,MAA+B;AACvC,QAAI;AACF,aAAO,KAAK,SAAS,OAAO,IAAI;AAAA,IAClC,SAAS,OAAO;AACd,UAAI,EAAE,iBAAiB,UAAU,CAAC,MAAM,QAAQ,SAAS,mBAAmB,GAAG;AAC7E,cAAM;AAAA,MACR;AAEA,YAAM,YAAY,MAAM,QAAQ,IAAI,EAAE,WAAW,KAAK,SAAS,UAAU,CAAC;AAC1E,aAAO,UAAU,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,YAAmC;AACrD,UAAM,gBACJ,KAAK,SACL;AACF,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAEA,UAAM,cAAc,KAAK,KAAK,UAAU,UAAU;AAAA,EACpD;AAAA,EAEA,MAAM,WAA2C;AAG/C,UAAM,WAAW,MAAM,KAAK,SAAS,SAAS;AAE9C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,WAAW,KAAK,SAAS;AAAA,MACzB,OAAO;AAAA,QACL,YAAY,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBAAmB,KAA8C;AACrE,QAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,YAAY;AAClB,QAAI,UAAU,MAAM;AAClB,aAAO,UAAU,KAAK;AAAA,IACxB;AAEA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gCACP,MACoC;AACpC,SAAO;AAAA,IACL,QAAQ,OAAO,aAAa,IAAI;AAC9B,UAAI;AACF,yBAAiB,OAAO,MAAM;AAC5B,gBAAM,aAAa,oBAAoB,GAAG;AAC1C,cAAI,YAAY;AACd,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,OAAO;AAC1B,gBAAM;AAAA,QACR;AACA,cAAM,IAAI,MAAM,sBAAsB;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAA8C;AAC3E,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,SAAS,YAAY;AACxC,WAAO;AAAA,EACT;AAEA,SAAO,UAAU,UAAU,UAAa,OAAO,UAAU,UAAU;AACrE;AAEA,SAAS,WAAwB,OAAsC;AACrE,SACE,UAAU,SACT,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,OAAQ,MAAsB,OAAO,QAAQ,MAAM;AAEvD;AAEA,SAAS,gBAA6B,OAA2C;AAC/E,SACE,UAAU,SACT,OAAO,UAAU,YAAY,OAAO,UAAU,eAC/C,OAAQ,MAA2B,OAAO,aAAa,MAAM;AAEjE;AAEA,SAAS,sBAAsB,KAA8D;AAC3F,QAAM,UAAU,IAAI,OAAO;AAC3B,MAAI,YAAY,QAAW;AACzB,WAAO;AAAA,EACT;AACA,MAAI,gBAAyB,OAAO,GAAG;AACrC,WAAO;AAAA,EACT;AACA,MAAI,WAAoB,OAAO,GAAG;AAChC,WAAO,wBAAwB,OAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,wBAA2B,UAAyC;AAC3E,SAAO;AAAA,IACL,QAAQ,OAAO,aAAa,IAAI;AAC9B,iBAAW,SAAS,UAAU;AAC5B,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,4BACP,MACA,UACA,UACwD;AACxD,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,eAAsC,CAAC;AAC7C,QAAM,UAA6B,CAAC;AACpC,MAAI,YAAY;AAChB,MAAI,QAAiB;AACrB,MAAI,cAAc;AAElB,QAAM,gBAAgB,MAAM;AAC1B,WAAO,QAAQ,SAAS,GAAG;AACzB,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,MAAM,YAA2B;AACrC,QAAI,aAAa;AACf;AAAA,IACF;AACA,kBAAc;AAEd,QAAI;AACF,uBAAiB,OAAO,MAAM;AAC5B,cAAM,aAAa,oBAAoB,GAAG;AAC1C,YAAI,CAAC,YAAY;AACf;AAAA,QACF;AAEA,qBAAa,KAAK,UAAU;AAC5B,YAAI,WAAW,WAAW,UAAU;AAClC,qBAAW,WAAW,KAAK;AAAA,QAC7B,OAAO;AACL,qBAAW,WAAW,KAAK;AAAA,QAC7B;AACA,sBAAc;AAAA,MAChB;AAAA,IACF,SAAS,OAAO;AACd,cAAQ;AAAA,IACV,UAAE;AACA,kBAAY;AACZ,oBAAc;AAAA,IAChB;AAAA,EACF;AAEA,OAAK,IAAI,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAEzB,QAAM,cAAc,MAAqB;AACvC,WAAO,IAAI,QAAc,CAAC,YAAY;AACpC,cAAQ,KAAK,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,QAAM,oBAAoB,MAA0C;AAClE,WAAO;AAAA,MACL,QAAQ,OAAO,aAAa,IAAI;AAC9B,YAAI,QAAQ;AACZ,eAAO,MAAM;AACX,cAAI,QAAQ,aAAa,QAAQ;AAC/B,kBAAM,aAAa,OAAO;AAC1B;AAAA,UACF;AACA,cAAI,UAAU,MAAM;AAClB,kBAAM,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,2BAA2B;AAAA,UAC9E;AACA,cAAI,WAAW;AACb;AAAA,UACF;AACA,gBAAM,YAAY;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,oBAAoB,KAA0C;AAC5E,MAAI,OAAO,QAAQ,UAAU;AAC3B,WAAO,EAAE,QAAQ,UAAU,OAAO,IAAI;AAAA,EACxC;AACA,MAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AAQlB,QAAM,cAAc,UAAU;AAC9B,QAAM,SAAS,gBAAgB,YAAY,gBAAgB,WAAW,cAAc;AACpF,QAAM,WACJ,UAAU,QACV,UAAU,UACV,UAAU,SACV,UAAU,QACV,UAAU,WACV;AAEF,MAAI,OAAO,aAAa,UAAU;AAChC,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,QAAQ,OAAO,SAAS;AACnC;AAEA,IAAM,6BAAN,MAAiE;AAAA,EACtD;AAAA,EACA;AAAA,EAET,YAAY,UAAgC,CAAC,GAAG;AAC9C,SAAK,WAAW,QAAQ,WAAW;AACnC,SAAK,kBAAkB;AAAA,MACrB,QAAQ,kBAAkB,QAAQ;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,0BAA0B,OAAyB;AACjD,QAAI,EAAE,iBAAiB,QAAQ;AAC7B,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,MAAM,QAAQ,YAAY;AAC1C,WACE,QAAQ,SAAS,WAAW,KAC5B,QAAQ,SAAS,gBAAgB,KACjC,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,iBAAiB;AAAA,EAEtC;AAAA,EAEA,MAAM,cACJ,YACA,SACwB;AACxB,UAAM,UAAU,KAAK,yBAAyB,OAAO;AAErD,UAAM,UAAU,MAAM,QAAQ,OAAO;AAAA,MACnC,SAAS,KAAK;AAAA,MACd;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,eAAe,2BAA2B,QAAQ,MAAM;AAAA,IAC1D,CAAC;AAED,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AAAA,EAEA,MAAM,cACJ,WACA,UACA,SACwB;AACxB,UAAM,UAAU,KAAK,yBAAyB,OAAO;AACrD,UAAM,QAAQ,SAAS;AACvB,UAAM,aAAa,OAAO;AAC1B,UAAM,oBAAoB,UAAU,aAAa,SAAS;AAE1D,UAAM,UACJ,eAAe,UAAa,OAAO,eAAe,WAC9C,OAAO,sBAAsB,UACxB,MAAM;AACL,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E,GAAG,IACH,QAAQ,IAAI,EAAE,WAAW,kBAAkB,CAAC,KAChD,MAAM,QAAQ,OAAO;AAAA,MACnB,QAAQ;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,eAAe,2BAA2B,QAAQ,MAAM;AAAA,IAC1D,CAAC;AAKP,WAAO,IAAI,oBAAoB,OAAO;AAAA,EACxC;AAAA,EAEA,yBAAyB,SAAuC;AAC9D,WAAO,wBAAwB,QAAQ,aAAa,KAAK,iBAAiB,iBAAiB;AAAA,EAC7F;AACF;AAEA,SAAS,wBAAwB,OAAgB,OAAuB;AACtE,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AAEA,MACE,OAAO,UAAU,YACjB,CAAC,OAAO,UAAU,KAAK,KACvB,CAAC,OAAO,SAAS,KAAK,KACtB,SAAS,GACT;AACA,UAAM,IAAI,MAAM,GAAG,KAAK,8CAA8C;AAAA,EACxE;AAEA,SAAO;AACT;AAEO,SAAS,iCACd,UAAgC,CAAC,GACX;AACtB,SAAO,IAAI,2BAA2B,OAAO;AAC/C;;;AGjdO,SAAS,cAAc,UAAgC,CAAC,GAA2B;AACxF,SAAO,sBAAsB,UAAU,iCAAiC,OAAO,CAAC;AAClF;","names":[]}

package/dist/policies/ai-gateway.d.ts

@@ -1,4 +1,4 @@
-import { P as PolicyServiceDescriptor, W as WorkspacePolicy } from '../types-BCgprbo8.js';
+import { P as PolicyServiceDescriptor, W as WorkspacePolicy } from '../types-Dpr_BkF9.js';
 
 interface AiGatewayOptions {
     readonly baseUrl?: string;

package/dist/policies/ai-gateway.js

@@ -2,8 +2,8 @@ import {
   aiGateway,
   allowAiGateway,
   resolveAiGatewayDefaultApiKey
-} from "../chunk-REGOUXVI.js";
-import "../chunk-VISDS5T7.js";
+} from "../chunk-UEAKE56H.js";
+import "../chunk-NKTNTBOY.js";
 export {
   aiGateway,
   allowAiGateway,

package/dist/policies/bun.d.ts

@@ -0,0 +1,9 @@
+import { W as WorkspacePolicy, P as PolicyServiceDescriptor } from '../types-Dpr_BkF9.js';
+
+/**
+ * Allow outbound access to Bun distribution and install endpoints.
+ */
+declare function bun(): PolicyServiceDescriptor;
+declare function allowBun(): WorkspacePolicy;
+
+export { allowBun, bun };

package/dist/policies/bun.js

@@ -0,0 +1,10 @@
+import {
+  allowBun,
+  bun
+} from "../chunk-YGUNJGP7.js";
+import "../chunk-NKTNTBOY.js";
+export {
+  allowBun,
+  bun
+};
+//# sourceMappingURL=bun.js.map

package/dist/policies/bun.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/policies/codex.d.ts

@@ -1,4 +1,4 @@
-import { P as PolicyServiceDescriptor, W as WorkspacePolicy } from '../types-BCgprbo8.js';
+import { P as PolicyServiceDescriptor, W as WorkspacePolicy } from '../types-Dpr_BkF9.js';
 
 interface CodexOptions {
     readonly apiKey?: string;

package/dist/policies/codex.js

@@ -2,8 +2,8 @@ import {
   allowCodex,
   codex,
   resolveCodexDefaultApiKey
-} from "../chunk-FSDVHEEX.js";
-import "../chunk-VISDS5T7.js";
+} from "../chunk-2M2AZUOC.js";
+import "../chunk-NKTNTBOY.js";
 export {
   allowCodex,
   codex,

package/dist/policies/gemini.d.ts

@@ -1,4 +1,4 @@
-import { P as PolicyServiceDescriptor, W as WorkspacePolicy } from '../types-BCgprbo8.js';
+import { P as PolicyServiceDescriptor, W as WorkspacePolicy } from '../types-Dpr_BkF9.js';
 
 interface GeminiOptions {
     readonly apiKey?: string;

package/dist/policies/gemini.js

@@ -2,8 +2,8 @@ import {
   allowGemini,
   gemini,
   resolveGeminiDefaultApiKey
-} from "../chunk-7DLK7LOM.js";
-import "../chunk-VISDS5T7.js";
+} from "../chunk-6GHZO3Y5.js";
+import "../chunk-NKTNTBOY.js";
 export {
   allowGemini,
   gemini,

package/dist/policies/npm.d.ts

@@ -0,0 +1,12 @@
+import { W as WorkspacePolicy, P as PolicyServiceDescriptor } from '../types-Dpr_BkF9.js';
+
+/**
+ * Allow outbound access to the public npm package registry.
+ *
+ * Keep this preset scoped to the actual package source host instead of
+ * broadening to unrelated npm web properties.
+ */
+declare function npm(): PolicyServiceDescriptor;
+declare function allowNpm(): WorkspacePolicy;
+
+export { allowNpm, npm };

package/dist/policies/npm.js

@@ -0,0 +1,10 @@
+import {
+  allowNpm,
+  npm
+} from "../chunk-T76VM5D2.js";
+import "../chunk-NKTNTBOY.js";
+export {
+  allowNpm,
+  npm
+};
+//# sourceMappingURL=npm.js.map

package/dist/policies/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{types-Cy36bS1j.d.ts → types-DNpj280o.d.ts}

@@ -1,4 +1,4 @@
-import { W as WorkspacePolicy } from './types-BCgprbo8.js';
+import { W as WorkspacePolicy } from './types-Dpr_BkF9.js';
 
 type WorkspaceStatus = "active" | "inactive" | "archived";
 type RunStatus = "started" | "succeeded" | "failed";
@@ -15,7 +15,7 @@ interface SharedSetup {
      * Shared setup state is durable and reused across workspaces, so this policy
      * must also be durable. Explicit secret-bearing policies are rejected.
      */
-    readonly policy?: WorkspacePolicy;
+    readonly policy: WorkspacePolicy;
 }
 /**
  * Internal durable artifact produced by a successful shared bootstrap.

package/dist/{types-BCgprbo8.d.ts → types-Dpr_BkF9.d.ts}

@@ -4,6 +4,7 @@ interface PolicyServiceDescriptor {
     readonly description?: string;
     readonly domains: readonly string[];
     readonly headers?: readonly PolicyServiceHeaderTransform[];
+    readonly domainHeaders?: Readonly<Record<string, readonly PolicyServiceHeaderTransform[]>>;
 }
 interface PolicyServiceCredentialDefault {
     readonly kind: "default";
@@ -19,6 +20,8 @@ type PolicyServiceCredentialSource = PolicyServiceCredentialDefault | PolicyServ
 interface PolicyServiceHeaderTransform {
     readonly headerName: string;
     readonly valuePrefix?: string;
+    readonly credentialPrefix?: string;
+    readonly valueEncoding?: "plain" | "base64";
     readonly credential: PolicyServiceCredentialSource;
 }
 interface WorkspaceAllowAllPolicy {

package/dist/{types-BEKQnjeb.d.ts → types-nu3vpBCZ.d.ts}

@@ -1,5 +1,5 @@
-import { a as SandkitAdapter, S as SharedSetup, W as WorkspaceRecord, b as WorkspaceMetadata, c as WorkspaceStatus } from './types-Cy36bS1j.js';
-import { W as WorkspacePolicy } from './types-BCgprbo8.js';
+import { a as SandkitAdapter, S as SharedSetup, W as WorkspaceRecord, b as WorkspaceMetadata, c as WorkspaceStatus } from './types-DNpj280o.js';
+import { W as WorkspacePolicy } from './types-Dpr_BkF9.js';
 
 type JsonPrimitive = boolean | number | string | null;
 type JsonValue = JsonPrimitive | JsonValue[] | {
@@ -28,6 +28,18 @@ interface CommandResult {
     stderr: string;
     stdout: string;
 }
+interface Command {
+    /**
+     * Wait for durable completion of the command unit-of-work: process exit,
+     * snapshot/commit, and persist outcome.
+     */
+    readonly wait: () => Promise<CommandResult>;
+    /**
+     * Ephemeral log stream for detached execution. The stream is live-only and does
+     * not participate in durable state replay.
+     */
+    readonly logs?: () => AsyncIterable<WorkspaceSessionLog>;
+}
 interface SandboxSessionLease {
     readonly sandboxId: string;
     readonly observedAt: string;
@@ -69,10 +81,26 @@ interface WorkspaceSessionProcessStartInput {
      */
     readonly onStderr?: ((chunk: string) => void) | undefined;
 }
-interface SandboxRunCommandOptions {
+interface WorkspaceSessionRunCommandOptions {
+    readonly command: string;
+    readonly args?: readonly string[];
+    readonly policy?: WorkspacePolicy;
+}
+interface WorkspaceRunCommandBaseOptions {
     readonly command: string;
     readonly args?: readonly string[];
     readonly policy?: WorkspacePolicy;
+    /**
+     * Ephemeral timeout override for this durable runCommand() invocation.
+     * This affects sandbox create/restore lease timing for the run only and
+     * must not mutate durable workspace defaults.
+     */
+    readonly timeoutMs?: number;
+}
+interface WorkspaceRunCommandOptions extends WorkspaceRunCommandBaseOptions {
+}
+interface WorkspaceRunCommandDetachedOptions extends WorkspaceRunCommandBaseOptions {
+    readonly detached: true;
 }
 interface PersistedSandboxState {
     readonly kind: string;
@@ -90,7 +118,9 @@ interface SandboxDriver {
      * so callers should not treat mere reads as lease refreshes.
      */
     getSessionLease(): Promise<SandboxSessionLease>;
-    runCommand(command: string, args: string[]): Promise<CommandResult>;
+    runCommand(command: string, args: string[], options?: {
+        readonly detached?: boolean;
+    }): Promise<Command>;
     startProcess?(input: WorkspaceSessionProcessStartInput): Promise<WorkspaceSessionProcess>;
     /** Persists and restores durability state through commit() and attach/restore APIs. */
     snapshot(): Promise<PersistedSandboxState>;
@@ -136,4 +166,4 @@ interface SandkitOptions {
     readonly sandbox: SandkitSandboxProvider;
 }
 
-export type { CommandResult as C, PersistedSandboxState as P, SandkitOptions as S, VercelSandboxOptions as V, WorkspaceSessionProcess as W, SandboxDriverFactory as a, SandboxRunCommandOptions as b, WorkspaceSessionProcessStartInput as c, WorkspaceSandboxLease as d, WorkspaceCreateOptions as e, SandboxCreateOptions as f, SandboxDriver as g, SandkitSandboxProvider as h };
+export type { CommandResult as C, PersistedSandboxState as P, SandkitOptions as S, VercelSandboxOptions as V, WorkspaceRunCommandOptions as W, SandboxDriverFactory as a, WorkspaceRunCommandDetachedOptions as b, Command as c, WorkspaceSessionRunCommandOptions as d, WorkspaceSessionProcess as e, WorkspaceSessionProcessStartInput as f, WorkspaceSandboxLease as g, WorkspaceCreateOptions as h, SandboxCreateOptions as i, SandboxDriver as j, SandkitSandboxProvider as k };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@giselles-ai/sandkit",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Workspace state, session management, and durable command execution for Vercel Sandbox.",
   "keywords": [
     "agent",
@@ -65,6 +65,11 @@
       "import": "./dist/policies/ai-gateway.js",
       "default": "./dist/policies/ai-gateway.js"
     },
+    "./policies/bun": {
+      "types": "./dist/policies/bun.d.ts",
+      "import": "./dist/policies/bun.js",
+      "default": "./dist/policies/bun.js"
+    },
     "./policies/codex": {
       "types": "./dist/policies/codex.d.ts",
       "import": "./dist/policies/codex.js",
@@ -75,6 +80,11 @@
       "import": "./dist/policies/gemini.js",
       "default": "./dist/policies/gemini.js"
     },
+    "./policies/npm": {
+      "types": "./dist/policies/npm.d.ts",
+      "import": "./dist/policies/npm.js",
+      "default": "./dist/policies/npm.js"
+    },
     "./schema": {
       "types": "./dist/schema/index.d.ts",
       "import": "./dist/schema/index.js",

package/dist/chunk-HVYCAAZQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { SandkitAdapter, WorkspaceRecord } from \"./adapters/types.ts\";\nimport type {\n  PolicySnapshotAdapter,\n  PolicySnapshotRecord,\n  PolicySnapshotCreateInput,\n  RunAdapter,\n  RunCreateInput,\n  RunFinishInput,\n  RunRecord,\n  RunStatus,\n  SetupStateAdapter,\n  SetupStateRecord,\n  SetupStatePutInput,\n  WorkspaceMetadata,\n  SharedSetup,\n  SharedSetupState,\n  WorkspaceStatus,\n} from \"./adapters/types.ts\";\nimport type { WorkspacePolicy } from \"./policies/types.ts\";\n\nexport type JsonPrimitive = boolean | number | string | null;\n\nexport type JsonValue =\n  | JsonPrimitive\n  | JsonValue[]\n  | {\n      [key: string]: JsonValue;\n    };\n\nexport type {\n  SandkitAdapter,\n  WorkspaceRecord,\n  RunAdapter,\n  RunCreateInput,\n  RunFinishInput,\n  RunRecord,\n  PolicySnapshotAdapter,\n  PolicySnapshotRecord,\n  PolicySnapshotCreateInput,\n  RunStatus,\n  SetupStateAdapter,\n  SetupStateRecord,\n  SetupStatePutInput,\n  SharedSetup,\n  SharedSetupState,\n};\nexport type { WorkspacePolicy };\n\nexport interface WorkspaceCreateOptions {\n  id?: string;\n  name?: string;\n  metadata?: WorkspaceMetadata;\n  policy?: WorkspacePolicy;\n  sandbox?: {\n    /**\n     * Durable workspace default for provider port publication. This affects\n     * create/restore behavior for live session/public URL flows, not the\n     * durable runCommand() unit-of-work model itself.\n     */\n    readonly exposedPorts?: readonly number[];\n  };\n  status?: WorkspaceStatus;\n  sandboxId?: string;\n  lastResumedAt?: string;\n}\n\nexport interface CommandResult {\n  exitCode: number;\n  stderr: string;\n  stdout: string;\n}\n\nexport interface SandboxSessionLease {\n  readonly sandboxId: string;\n  readonly observedAt: string;\n  readonly expiresAt: string;\n}\n\nexport interface WorkspaceSandboxLease {\n  readonly sandboxId: string;\n  readonly observedAt: string;\n  readonly expiresAt: string;\n  readonly remainingMs: number;\n}\n\nexport interface WorkspaceSessionProcess {\n  readonly processId: string;\n  wait(): Promise<CommandResult>;\n  /**\n   * Accesses the same normalized log stream used by onStdout/onStderr callbacks.\n   * Sandkit keeps a single internal stream, so callbacks and logs() observe\n   * the same sequence and buffered historical chunks are replayed to new readers.\n   */\n  logs?: () => AsyncIterable<WorkspaceSessionLog>;\n}\n\nexport interface WorkspaceSessionLog {\n  readonly stream: \"stdout\" | \"stderr\";\n  readonly chunk: string;\n}\n\nexport interface WorkspaceSessionProcessStartInput {\n  readonly command: string;\n  readonly args: readonly string[];\n  /**\n   * Optional per-call policy override for this session process.\n   */\n  readonly policy?: WorkspacePolicy;\n  /**\n   * Callbacks consume chunks from Sandkit's normalized process log stream.\n   */\n  readonly onStdout?: ((chunk: string) => void) | undefined;\n  /**\n   * Callbacks consume chunks from Sandkit's normalized process log stream.\n   */\n  readonly onStderr?: ((chunk: string) => void) | undefined;\n}\n\nexport interface SandboxRunCommandOptions {\n  readonly command: string;\n  readonly args?: readonly string[];\n  readonly policy?: WorkspacePolicy;\n}\n\nexport interface PersistedSandboxState {\n  readonly kind: string;\n  readonly sessionId: string;\n  readonly state?: JsonValue;\n}\n\nexport interface SandboxDriver {\n  readonly id: string;\n  readonly provider: string;\n  applyPolicy(policy: WorkspacePolicy): Promise<void>;\n  /**\n   * Returns lease timing observed from the current sandbox instance.\n   * Some providers expose this as an interpreted timeout value.\n   * Sandkit persists lease updates only from explicit session open/extend paths,\n   * so callers should not treat mere reads as lease refreshes.\n   */\n  getSessionLease(): Promise<SandboxSessionLease>;\n  runCommand(command: string, args: string[]): Promise<CommandResult>;\n  startProcess?(input: WorkspaceSessionProcessStartInput): Promise<WorkspaceSessionProcess>;\n  /** Persists and restores durability state through commit() and attach/restore APIs. */\n  snapshot(): Promise<PersistedSandboxState>;\n  url?(port: number): Promise<string>;\n  extendTimeout?(durationMs: number): Promise<void>;\n}\n\nexport interface SandboxCreateOptions {\n  readonly policy: WorkspacePolicy;\n  readonly exposedPorts?: readonly number[];\n  readonly timeoutMs?: number;\n}\n\nexport interface SandboxDriverFactory {\n  createSandbox(workspace: WorkspaceRecord, options: SandboxCreateOptions): Promise<SandboxDriver>;\n  resumeSandbox(\n    workspace: WorkspaceRecord,\n    snapshot: PersistedSandboxState,\n    options: SandboxCreateOptions,\n  ): Promise<SandboxDriver>;\n  isSessionUnavailableError?(error: unknown): boolean;\n}\n\nexport interface VercelSandboxOptions {\n  runtime?: string;\n  /**\n   * Provider default sandbox lease timeout in milliseconds. Sandkit uses this\n   * when creating or restoring a sandbox unless openSession({ timeoutMs })\n   * supplies a live-session override.\n   */\n  defaultTimeout?: number;\n  /**\n   * Legacy alias retained for compatibility with existing call sites.\n   * Prefer defaultTimeout for new code.\n   */\n  timeout?: number;\n}\n\nconst sandboxProviderContract = Symbol(\"sandkit.sandbox.provider\");\n\ntype SandboxProviderRecord = {\n  readonly provider: string;\n  readonly driverFactory: SandboxDriverFactory;\n};\n\nexport interface SandkitSandboxProvider {\n  readonly [sandboxProviderContract]: SandboxProviderRecord;\n}\n\nexport function createSandboxProvider(\n  provider: string,\n  driverFactory: SandboxDriverFactory,\n): SandkitSandboxProvider {\n  return {\n    [sandboxProviderContract]: {\n      provider,\n      driverFactory,\n    },\n  };\n}\n\nexport function getSandboxDriverFactory(\n  sandboxProvider: SandkitSandboxProvider,\n): SandboxDriverFactory {\n  const driverFactory = sandboxProvider[sandboxProviderContract]?.driverFactory;\n  if (!driverFactory) {\n    throw new Error(\n      \"SandkitOptions.sandbox is invalid. Pass a provider created by Sandkit integrations such as vercelSandbox(...).\",\n    );\n  }\n\n  return driverFactory;\n}\n\nexport interface SandkitOptions {\n  readonly database?: SandkitAdapter | undefined;\n  readonly setup?: SharedSetup | undefined;\n  readonly network?: readonly unknown[] | undefined;\n  readonly sandbox: SandkitSandboxProvider;\n}\n"],"mappings":";AAoLA,IAAM,0BAA0B,uBAAO,0BAA0B;AAW1D,SAAS,sBACd,UACA,eACwB;AACxB,SAAO;AAAA,IACL,CAAC,uBAAuB,GAAG;AAAA,MACzB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBACd,iBACsB;AACtB,QAAM,gBAAgB,gBAAgB,uBAAuB,GAAG;AAChE,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/chunk-VISDS5T7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/policies/dsl.ts"],"sourcesContent":["import type { JsonValue } from \"../types.ts\";\nimport type {\n  PolicyServiceCredentialSource,\n  PolicyServiceDescriptor,\n  PolicyServiceHeaderTransform,\n  WorkspacePolicy,\n} from \"./types.ts\";\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every((entry) => typeof entry === \"string\");\n}\n\nfunction isRecordArray(value: unknown): value is Record<string, unknown>[] {\n  return Array.isArray(value) && value.every((entry) => isRecord(entry));\n}\n\nfunction normalizeCredentialSource(\n  source: PolicyServiceCredentialSource,\n): PolicyServiceCredentialSource {\n  if (source.kind === \"default\") {\n    return { kind: \"default\" };\n  }\n\n  if (source.kind === \"value\") {\n    if (!source.value) {\n      throw new Error(\"Policy credential value must not be empty.\");\n    }\n    return { kind: \"value\", value: source.value };\n  }\n\n  return { kind: \"redacted\" };\n}\n\nfunction normalizeHeaderTransform(\n  header: PolicyServiceHeaderTransform,\n): PolicyServiceHeaderTransform {\n  const headerName = header.headerName.trim().toLowerCase();\n  if (!headerName) {\n    throw new Error(\"Policy header transform must include a header name.\");\n  }\n\n  return {\n    headerName,\n    valuePrefix: header.valuePrefix,\n    credential: normalizeCredentialSource(header.credential),\n  };\n}\n\nfunction normalizeService(service: PolicyServiceDescriptor): PolicyServiceDescriptor {\n  const id = service.id.trim();\n  const name = service.name.trim();\n  const domains = [\n    ...new Set(service.domains.map((domain) => domain.trim()).filter(Boolean)),\n  ].sort();\n\n  if (!id) {\n    throw new Error(\"Policy service id must not be empty.\");\n  }\n\n  if (!name) {\n    throw new Error(`Policy service \"${id}\" must have a name.`);\n  }\n\n  if (domains.length === 0) {\n    throw new Error(`Policy service \"${id}\" must declare at least one domain.`);\n  }\n\n  return {\n    id,\n    name,\n    description: service.description?.trim() || undefined,\n    domains,\n    headers: service.headers?.map((header) => normalizeHeaderTransform(header)),\n  };\n}\n\nfunction normalizeServices(\n  services: readonly PolicyServiceDescriptor[],\n): readonly PolicyServiceDescriptor[] {\n  if (services.length === 0) {\n    throw new Error(\"allowServices(...) requires at least one service descriptor.\");\n  }\n\n  const deduped = new Map<string, PolicyServiceDescriptor>();\n  for (const service of services) {\n    const normalized = normalizeService(service);\n    deduped.set(normalized.id, normalized);\n  }\n\n  return [...deduped.values()].sort((left, right) => left.id.localeCompare(right.id));\n}\n\nexport function allowAll(): WorkspacePolicy {\n  return { mode: \"allow-all\" };\n}\n\nexport function denyAll(): WorkspacePolicy {\n  return { mode: \"deny-all\" };\n}\n\nexport function allowService(service: PolicyServiceDescriptor): WorkspacePolicy {\n  return allowServices([service]);\n}\n\nexport function allowServices(services: readonly PolicyServiceDescriptor[]): WorkspacePolicy {\n  return {\n    mode: \"allow-services\",\n    services: normalizeServices(services),\n  };\n}\n\nexport function describeWorkspacePolicy(policy: WorkspacePolicy): string {\n  switch (policy.mode) {\n    case \"allow-all\":\n      return \"allow-all\";\n    case \"deny-all\":\n      return \"deny-all\";\n    case \"allow-services\":\n      return `allow-services:${policy.services.map((service) => service.id).join(\",\")}`;\n  }\n}\n\nexport function serializeWorkspacePolicy(policy: WorkspacePolicy): JsonValue {\n  return policy as unknown as JsonValue;\n}\n\nexport function redactWorkspacePolicy(policy: WorkspacePolicy): WorkspacePolicy {\n  if (policy.mode !== \"allow-services\") {\n    return policy;\n  }\n\n  return {\n    mode: \"allow-services\",\n    services: policy.services.map((service) => ({\n      ...service,\n      headers: service.headers?.map((header) => ({\n        headerName: header.headerName,\n        valuePrefix: header.valuePrefix,\n        credential: header.credential.kind === \"value\" ? { kind: \"redacted\" } : header.credential,\n      })),\n    })),\n  };\n}\n\nexport function assertWorkspacePolicyIsDurable(policy: WorkspacePolicy): void {\n  if (policy.mode !== \"allow-services\") {\n    return;\n  }\n\n  for (const service of policy.services) {\n    for (const header of service.headers ?? []) {\n      if (header.credential.kind === \"value\") {\n        throw new Error(\n          `Workspace policy for service \"${service.id}\" contains an explicit secret and cannot be stored durably.`,\n        );\n      }\n    }\n  }\n}\n\nexport function parseWorkspacePolicy(value: unknown): WorkspacePolicy {\n  if (!isRecord(value) || typeof value.mode !== \"string\") {\n    throw new Error(\"expected workspace policy object\");\n  }\n\n  if (value.mode === \"allow-all\") {\n    return allowAll();\n  }\n\n  if (value.mode === \"deny-all\") {\n    return denyAll();\n  }\n\n  if (value.mode === \"allow-services\") {\n    if (!Array.isArray(value.services)) {\n      throw new Error(\"allow-services policy must include a services array\");\n    }\n\n    const services = value.services.map((service, index) => {\n      if (!isRecord(service)) {\n        throw new Error(`service at index ${index} must be an object`);\n      }\n\n      if (\n        typeof service.id !== \"string\" ||\n        typeof service.name !== \"string\" ||\n        !isStringArray(service.domains)\n      ) {\n        throw new Error(`service at index ${index} has an invalid shape`);\n      }\n\n      const headers =\n        service.headers === undefined\n          ? undefined\n          : (() => {\n              if (!isRecordArray(service.headers)) {\n                throw new Error(`service at index ${index} has invalid headers`);\n              }\n\n              return service.headers.map((header, headerIndex) => {\n                if (\n                  typeof header.headerName !== \"string\" ||\n                  !isRecord(header.credential) ||\n                  typeof header.credential.kind !== \"string\"\n                ) {\n                  throw new Error(\n                    `service at index ${index} has invalid header transform at ${headerIndex}`,\n                  );\n                }\n\n                if (header.credential.kind === \"default\") {\n                  return normalizeHeaderTransform({\n                    headerName: header.headerName,\n                    valuePrefix:\n                      typeof header.valuePrefix === \"string\" ? header.valuePrefix : undefined,\n                    credential: {\n                      kind: \"default\",\n                    },\n                  });\n                }\n\n                if (header.credential.kind === \"redacted\") {\n                  return normalizeHeaderTransform({\n                    headerName: header.headerName,\n                    valuePrefix:\n                      typeof header.valuePrefix === \"string\" ? header.valuePrefix : undefined,\n                    credential: { kind: \"redacted\" },\n                  });\n                }\n\n                throw new Error(\n                  `service at index ${index} contains a non-durable credential source`,\n                );\n              });\n            })();\n\n      return normalizeService({\n        id: service.id,\n        name: service.name,\n        description: typeof service.description === \"string\" ? service.description : undefined,\n        domains: service.domains,\n        headers,\n      });\n    });\n\n    return allowServices(services);\n  }\n\n  throw new Error(`unsupported workspace policy mode \"${value.mode}\"`);\n}\n"],"mappings":";AAQA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,cAAc,OAAmC;AACxD,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ;AACjF;AAEA,SAAS,cAAc,OAAoD;AACzE,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,UAAU,SAAS,KAAK,CAAC;AACvE;AAEA,SAAS,0BACP,QAC+B;AAC/B,MAAI,OAAO,SAAS,WAAW;AAC7B,WAAO,EAAE,MAAM,UAAU;AAAA,EAC3B;AAEA,MAAI,OAAO,SAAS,SAAS;AAC3B,QAAI,CAAC,OAAO,OAAO;AACjB,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AACA,WAAO,EAAE,MAAM,SAAS,OAAO,OAAO,MAAM;AAAA,EAC9C;AAEA,SAAO,EAAE,MAAM,WAAW;AAC5B;AAEA,SAAS,yBACP,QAC8B;AAC9B,QAAM,aAAa,OAAO,WAAW,KAAK,EAAE,YAAY;AACxD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,OAAO;AAAA,IACpB,YAAY,0BAA0B,OAAO,UAAU;AAAA,EACzD;AACF;AAEA,SAAS,iBAAiB,SAA2D;AACnF,QAAM,KAAK,QAAQ,GAAG,KAAK;AAC3B,QAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAM,UAAU;AAAA,IACd,GAAG,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC;AAAA,EAC3E,EAAE,KAAK;AAEP,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,mBAAmB,EAAE,qBAAqB;AAAA,EAC5D;AAEA,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,MAAM,mBAAmB,EAAE,qCAAqC;AAAA,EAC5E;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,aAAa,KAAK,KAAK;AAAA,IAC5C;AAAA,IACA,SAAS,QAAQ,SAAS,IAAI,CAAC,WAAW,yBAAyB,MAAM,CAAC;AAAA,EAC5E;AACF;AAEA,SAAS,kBACP,UACoC;AACpC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAEA,QAAM,UAAU,oBAAI,IAAqC;AACzD,aAAW,WAAW,UAAU;AAC9B,UAAM,aAAa,iBAAiB,OAAO;AAC3C,YAAQ,IAAI,WAAW,IAAI,UAAU;AAAA,EACvC;AAEA,SAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,GAAG,cAAc,MAAM,EAAE,CAAC;AACpF;AAEO,SAAS,WAA4B;AAC1C,SAAO,EAAE,MAAM,YAAY;AAC7B;AAEO,SAAS,UAA2B;AACzC,SAAO,EAAE,MAAM,WAAW;AAC5B;AAEO,SAAS,aAAa,SAAmD;AAC9E,SAAO,cAAc,CAAC,OAAO,CAAC;AAChC;AAEO,SAAS,cAAc,UAA+D;AAC3F,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,kBAAkB,QAAQ;AAAA,EACtC;AACF;AAEO,SAAS,wBAAwB,QAAiC;AACvE,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,kBAAkB,OAAO,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,EACnF;AACF;AAEO,SAAS,yBAAyB,QAAoC;AAC3E,SAAO;AACT;AAEO,SAAS,sBAAsB,QAA0C;AAC9E,MAAI,OAAO,SAAS,kBAAkB;AACpC,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,OAAO,SAAS,IAAI,CAAC,aAAa;AAAA,MAC1C,GAAG;AAAA,MACH,SAAS,QAAQ,SAAS,IAAI,CAAC,YAAY;AAAA,QACzC,YAAY,OAAO;AAAA,QACnB,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO,WAAW,SAAS,UAAU,EAAE,MAAM,WAAW,IAAI,OAAO;AAAA,MACjF,EAAE;AAAA,IACJ,EAAE;AAAA,EACJ;AACF;AAEO,SAAS,+BAA+B,QAA+B;AAC5E,MAAI,OAAO,SAAS,kBAAkB;AACpC;AAAA,EACF;AAEA,aAAW,WAAW,OAAO,UAAU;AACrC,eAAW,UAAU,QAAQ,WAAW,CAAC,GAAG;AAC1C,UAAI,OAAO,WAAW,SAAS,SAAS;AACtC,cAAM,IAAI;AAAA,UACR,iCAAiC,QAAQ,EAAE;AAAA,QAC7C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,OAAiC;AACpE,MAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS,UAAU;AACtD,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AAEA,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI,MAAM,SAAS,YAAY;AAC7B,WAAO,QAAQ;AAAA,EACjB;AAEA,MAAI,MAAM,SAAS,kBAAkB;AACnC,QAAI,CAAC,MAAM,QAAQ,MAAM,QAAQ,GAAG;AAClC,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AAEA,UAAM,WAAW,MAAM,SAAS,IAAI,CAAC,SAAS,UAAU;AACtD,UAAI,CAAC,SAAS,OAAO,GAAG;AACtB,cAAM,IAAI,MAAM,oBAAoB,KAAK,oBAAoB;AAAA,MAC/D;AAEA,UACE,OAAO,QAAQ,OAAO,YACtB,OAAO,QAAQ,SAAS,YACxB,CAAC,cAAc,QAAQ,OAAO,GAC9B;AACA,cAAM,IAAI,MAAM,oBAAoB,KAAK,uBAAuB;AAAA,MAClE;AAEA,YAAM,UACJ,QAAQ,YAAY,SAChB,UACC,MAAM;AACL,YAAI,CAAC,cAAc,QAAQ,OAAO,GAAG;AACnC,gBAAM,IAAI,MAAM,oBAAoB,KAAK,sBAAsB;AAAA,QACjE;AAEA,eAAO,QAAQ,QAAQ,IAAI,CAAC,QAAQ,gBAAgB;AAClD,cACE,OAAO,OAAO,eAAe,YAC7B,CAAC,SAAS,OAAO,UAAU,KAC3B,OAAO,OAAO,WAAW,SAAS,UAClC;AACA,kBAAM,IAAI;AAAA,cACR,oBAAoB,KAAK,oCAAoC,WAAW;AAAA,YAC1E;AAAA,UACF;AAEA,cAAI,OAAO,WAAW,SAAS,WAAW;AACxC,mBAAO,yBAAyB;AAAA,cAC9B,YAAY,OAAO;AAAA,cACnB,aACE,OAAO,OAAO,gBAAgB,WAAW,OAAO,cAAc;AAAA,cAChE,YAAY;AAAA,gBACV,MAAM;AAAA,cACR;AAAA,YACF,CAAC;AAAA,UACH;AAEA,cAAI,OAAO,WAAW,SAAS,YAAY;AACzC,mBAAO,yBAAyB;AAAA,cAC9B,YAAY,OAAO;AAAA,cACnB,aACE,OAAO,OAAO,gBAAgB,WAAW,OAAO,cAAc;AAAA,cAChE,YAAY,EAAE,MAAM,WAAW;AAAA,YACjC,CAAC;AAAA,UACH;AAEA,gBAAM,IAAI;AAAA,YACR,oBAAoB,KAAK;AAAA,UAC3B;AAAA,QACF,CAAC;AAAA,MACH,GAAG;AAET,aAAO,iBAAiB;AAAA,QACtB,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,aAAa,OAAO,QAAQ,gBAAgB,WAAW,QAAQ,cAAc;AAAA,QAC7E,SAAS,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,WAAO,cAAc,QAAQ;AAAA,EAC/B;AAEA,QAAM,IAAI,MAAM,sCAAsC,MAAM,IAAI,GAAG;AACrE;","names":[]}

package/dist/chunk-XM4HGRXW.js

@@ -1,37 +0,0 @@
-// src/policies/github.ts
-var GITHUB_DOMAINS = ["github.com", "*.github.com", "api.github.com", "*.githubusercontent.com"];
-function resolveGithubCredential(options) {
-  if (options === void 0) {
-    return { kind: "default" };
-  }
-  if (typeof options.apiKey !== "string" || options.apiKey.trim().length === 0) {
-    throw new Error(
-      'github(...) explicit override requires a non-empty "apiKey". Omit the options object to use GITHUB_TOKEN.'
-    );
-  }
-  return { kind: "value", value: options.apiKey };
-}
-function resolveGithubDefaultApiKey() {
-  return process.env.GITHUB_TOKEN;
-}
-function github(options) {
-  return {
-    id: "github",
-    name: "GitHub",
-    description: "Allow outbound access commonly needed for GitHub APIs and assets.",
-    domains: GITHUB_DOMAINS,
-    headers: [
-      {
-        headerName: "authorization",
-        valuePrefix: "Bearer ",
-        credential: resolveGithubCredential(options)
-      }
-    ]
-  };
-}
-
-export {
-  resolveGithubDefaultApiKey,
-  github
-};
-//# sourceMappingURL=chunk-XM4HGRXW.js.map

package/dist/chunk-XM4HGRXW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/policies/github.ts"],"sourcesContent":["import type { PolicyServiceDescriptor } from \"./types.ts\";\n\nconst GITHUB_DOMAINS = [\"github.com\", \"*.github.com\", \"api.github.com\", \"*.githubusercontent.com\"];\n\nexport interface GithubOptions {\n  readonly apiKey?: string;\n}\n\nfunction resolveGithubCredential(options?: GithubOptions) {\n  if (options === undefined) {\n    return { kind: \"default\" } as const;\n  }\n\n  if (typeof options.apiKey !== \"string\" || options.apiKey.trim().length === 0) {\n    throw new Error(\n      'github(...) explicit override requires a non-empty \"apiKey\". Omit the options object to use GITHUB_TOKEN.',\n    );\n  }\n\n  return { kind: \"value\", value: options.apiKey } as const;\n}\n\nexport function resolveGithubDefaultApiKey(): string | undefined {\n  return process.env.GITHUB_TOKEN;\n}\n\nexport function github(options?: GithubOptions): PolicyServiceDescriptor {\n  return {\n    id: \"github\",\n    name: \"GitHub\",\n    description: \"Allow outbound access commonly needed for GitHub APIs and assets.\",\n    domains: GITHUB_DOMAINS,\n    headers: [\n      {\n        headerName: \"authorization\",\n        valuePrefix: \"Bearer \",\n        credential: resolveGithubCredential(options),\n      },\n    ],\n  };\n}\n"],"mappings":";AAEA,IAAM,iBAAiB,CAAC,cAAc,gBAAgB,kBAAkB,yBAAyB;AAMjG,SAAS,wBAAwB,SAAyB;AACxD,MAAI,YAAY,QAAW;AACzB,WAAO,EAAE,MAAM,UAAU;AAAA,EAC3B;AAEA,MAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,KAAK,EAAE,WAAW,GAAG;AAC5E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,SAAS,OAAO,QAAQ,OAAO;AAChD;AAEO,SAAS,6BAAiD;AAC/D,SAAO,QAAQ,IAAI;AACrB;AAEO,SAAS,OAAO,SAAkD;AACvE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS;AAAA,MACP;AAAA,QACE,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,YAAY,wBAAwB,OAAO;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;","names":[]}