@intentic/sandbox-run 1.176.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artur Kurowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,33 @@
+# @intentic/sandbox-run
+
+The sandbox container's run contract — every path that creates a sandbox composes its `docker run` from here.
+
+Names, capability posture, the environment allowlist, runtime directives, and the emitter that turns all of it
+into a command line. There are several ways a sandbox comes into existence (the CLI, the daemon, the desktop
+app); this package is why they cannot disagree about what one is.
+
+## Responsibilities
+
+- Define the container's identity: its name, image, labels and volumes.
+- Define its posture: which capabilities it gets, and which it is denied.
+- Define the environment allowlist — what is allowed to cross into the box.
+- Emit the `docker run` invocation, correctly quoted.
+
+## Key files
+
+- [src/index.ts](src/index.ts) — the contract and the docker-run emitter; the surface every docker-shaped flow uses.
+- [src/fly.ts](src/fly.ts) — the hosted flavor: the same contract emitted as a Fly Machine config (one VM per
+  sandbox, one volume standing in for the three docker ones, cloudflared in-box behind the `SANDBOX_VM` switch).
+- [src/quote.ts](src/quote.ts) — shell quoting, which is the part that is easy to get subtly wrong.
+- [src/quote-contract.integration.test.ts](src/quote-contract.integration.test.ts) — the emitted command run for
+  real, because a quoting bug is invisible to a unit test that only compares strings.
+
+## How it fits
+
+Consumed by every creation path. It depends on nothing that would stop a browser importing it, which is
+deliberate: the UI that offers to create a sandbox and the daemon that creates one describe it identically.
+
+## Conventions & gotchas
+
+- The allowlist is a floor, not a suggestion. Anything not named does not cross into the container, and widening
+  it is a security decision rather than a convenience one.

package/dist/fly.d.ts

@@ -0,0 +1,40 @@
+export declare const FLY_VOLUME_PATH = "/data";
+export declare const FLY_VOLUME_LAYOUT: {
+    readonly workspace: "/data/work";
+    readonly history: "/data/history";
+    readonly docker: "/data/docker";
+};
+export interface FlyMachineRun {
+    readonly name: string;
+    readonly image: string;
+    readonly baseImage: string;
+    readonly guest: {
+        readonly cpus: number;
+        readonly memoryMb: number;
+    };
+    readonly volumeId: string;
+    readonly env?: readonly (readonly [string, string])[];
+}
+export interface FlyMachineConfig {
+    readonly image: string;
+    readonly guest: {
+        readonly cpu_kind: "shared";
+        readonly cpus: number;
+        readonly memory_mb: number;
+    };
+    readonly env: Record<string, string>;
+    readonly mounts: readonly {
+        readonly volume: string;
+        readonly path: string;
+    }[];
+    readonly restart: {
+        readonly policy: "on-failure";
+        readonly max_retries: number;
+    };
+    readonly auto_destroy: false;
+    readonly init?: {
+        readonly exec: readonly string[];
+    };
+}
+export declare const flyMachineConfig: (run: FlyMachineRun) => FlyMachineConfig;
+//# sourceMappingURL=fly.d.ts.map

package/dist/fly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../src/fly.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,eAAe,UAAU,CAAC;AACvC,eAAO,MAAM,iBAAiB;aAC1B,SAAS;aACT,OAAO;aACP,MAAM;CACA,CAAC;AAEX,MAAM,WAAW,aAAa;IAG1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAErE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;CACzD;AAGD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACnG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAG/E,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC;IAM7B,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACxD;AAED,eAAO,MAAM,gBAAgB,QAAS,aAAa,KAAG,gBAepD,CAAC"}

package/dist/fly.js

@@ -0,0 +1,21 @@
+export const FLY_VOLUME_PATH = "/data";
+export const FLY_VOLUME_LAYOUT = {
+    workspace: `${FLY_VOLUME_PATH}/work`,
+    history: `${FLY_VOLUME_PATH}/history`,
+    docker: `${FLY_VOLUME_PATH}/docker`,
+};
+export const flyMachineConfig = (run) => ({
+    image: run.image,
+    guest: { cpu_kind: "shared", cpus: run.guest.cpus, memory_mb: run.guest.memoryMb },
+    env: Object.fromEntries([
+        ["SANDBOX_NAME", run.name],
+        ["SANDBOX_IMAGE", run.image],
+        ["SANDBOX_BASE_IMAGE", run.baseImage],
+        ["SANDBOX_VM", "1"],
+        ...(run.env ?? []).filter(([, value]) => value !== ""),
+    ]),
+    mounts: [{ volume: run.volumeId, path: FLY_VOLUME_PATH }],
+    restart: { policy: "on-failure", max_retries: 3 },
+    auto_destroy: false,
+});
+//# sourceMappingURL=fly.js.map

package/dist/fly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly.js","sourceRoot":"","sources":["../src/fly.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,SAAS,EAAE,GAAG,eAAe,OAAO;IACpC,OAAO,EAAE,GAAG,eAAe,UAAU;IACrC,MAAM,EAAE,GAAG,eAAe,SAAS;CAC7B,CAAC;AAoCX,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAkB,EAAoB,EAAE,CAAC,CAAC;IACvE,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE;IAClF,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;QACpB,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC;QAC1B,CAAC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC;QAC5B,CAAC,oBAAoB,EAAE,GAAG,CAAC,SAAS,CAAC;QAGrC,CAAC,YAAY,EAAE,GAAG,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;KACzD,CAAC;IACF,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACzD,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,EAAE;IACjD,YAAY,EAAE,KAAK;CACtB,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,61 @@
+export declare const ORIGIN_HOST = "intentic-sandbox-workspace";
+export interface SandboxNames {
+    readonly container: string;
+    readonly tunnelContainer: string;
+    readonly workspaceVolume: string;
+    readonly historyVolume: string;
+    readonly dockerVolume: string;
+    readonly network: string;
+}
+export declare const sandboxNames: (slug: string) => SandboxNames;
+export declare const SANDBOX_CAPABILITIES: readonly ["SYS_ADMIN", "SYS_PTRACE"];
+export declare const RUNTIME_DIRECTIVE_PREFIX = "# intentic:runtime ";
+export declare const RUNTIME_DIRECTIVES: readonly ["--device=/dev/net/tun", "--cap-add=NET_ADMIN", "--privileged", "--gpus=all"];
+export interface OptionalDirective {
+    readonly token: string;
+    readonly name: string;
+    readonly env: string;
+    readonly probe: {
+        readonly kind: "runtime";
+        readonly name: string;
+    } | {
+        readonly kind: "device";
+        readonly path: string;
+    };
+}
+export declare const OPTIONAL_DIRECTIVES: readonly OptionalDirective[];
+export declare const optionalDirective: (token: string) => OptionalDirective | undefined;
+export declare const runtimeDirectivesOf: (overlay: string) => string[];
+export declare const REPLAY_ENV: readonly ["WORKSPACE_ROOT", "HISTORY_ROOT", "AGENT_AUTH_DIR", "SANDBOX_HOST", "SANDBOX_PORT", "SANDBOX_NAME", "PREVIEW_PORT", "GOOGLE_CLIENT_ID", "CONNECT_TOKEN", "OWNER_EMAIL", "WEB_ORIGIN", "SANDBOX_PUBLIC_URL", "PLATFORM_URL", "ZROK_TOKEN", "ZROK_API", "ZROK_NAMESPACE", "CLOUDFLARE_API_TOKEN", "HOST_SSH_KEY", "SELF_HOST_USER", "SYNC_PAIR_TOKEN", "HOST_PAIR_TOKEN", "HOST_PLATFORM", "HOST_LABEL", "SELF_HOST_ADDRESS", "SELF_HOST_VIA"];
+export declare const parseNulEnv: (dump: string) => [string, string][];
+export declare const replayableEnv: (pairs: readonly (readonly [string, string])[]) => [string, string][];
+export declare const HEALTH: {
+    readonly url: "http://localhost:8787/health";
+    readonly attempts: 15;
+    readonly intervalSeconds: 2;
+};
+export declare const localDaemonPort: (sandboxId: string) => number;
+export declare const localDaemonUrl: (sandboxId: string, zone: string | undefined) => string | undefined;
+export declare const localDaemonUrlInsecure: (sandboxId: string) => string;
+export interface SandboxRun {
+    readonly names: SandboxNames;
+    readonly image: string;
+    readonly baseImage: string;
+    readonly environmentHash?: string;
+    readonly channel?: string;
+    readonly previousImage?: string;
+    readonly env?: readonly (readonly [string, string])[];
+    readonly runtime?: readonly string[];
+    readonly mounts?: readonly string[];
+    readonly ports?: readonly string[];
+    readonly labels?: readonly string[];
+    readonly dns?: readonly string[];
+    readonly sandboxId?: string;
+    readonly localPublish?: boolean;
+    readonly unsupported?: readonly string[];
+    readonly init?: boolean;
+    readonly alias?: boolean;
+}
+export declare const sandboxRunArgv: (run: SandboxRun) => string[];
+export declare const sandboxRunCommand: (run: SandboxRun) => string;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,WAAW,+BAA+B,CAAC;AAExD,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,YAO1C,CAAC;AAkBH,eAAO,MAAM,oBAAoB,YAAI,WAAW,EAAE,YAAY,CAAU,CAAC;AAUzE,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D,eAAO,MAAM,kBAAkB,YAAI,uBAAuB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AA6B1H,MAAM,WAAW,iBAAiB;IAE9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5H;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAO3D,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAAW,MAAM,KAAG,iBAAiB,GAAG,SAAuE,CAAC;AAK9I,eAAO,MAAM,mBAAmB,YAAa,MAAM,KAAG,MAAM,EAc3D,CAAC;AAOF,eAAO,MAAM,UAAU,YACnB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,EAGd,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAGjB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,eAAe,CACT,CAAC;AAIX,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAOjD,CAAC;AAKX,eAAO,MAAM,aAAa,UAAW,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAIxF,CAAC;AAKP,eAAO,MAAM,MAAM;aAAK,GAAG;aAA4C,QAAQ,EAAE,EAAE;aAAE,eAAe,EAAE,CAAC;CAAW,CAAC;AAyBnH,eAAO,MAAM,eAAe,cAAe,MAAM,KAAG,MAA0F,CAAC;AAS/I,eAAO,MAAM,cAAc,cAAe,MAAM,QAAQ,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SACgC,CAAC;AAEvH,eAAO,MAAM,sBAAsB,cAAe,MAAM,KAAG,MAA0D,CAAC;AAGtH,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAG3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAEtD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAGjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAG5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAUhC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAGzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC5B;AAKD,eAAO,MAAM,cAAc,QAAS,UAAU,KAAG,MAAM,EAsDtD,CAAC;AAIF,eAAO,MAAM,iBAAiB,QAAS,UAAU,KAAG,MAAsE,CAAC"}

package/dist/index.js

@@ -0,0 +1,131 @@
+import { DAEMON_PORT, LOCAL_PORT } from "@intentic/constants";
+import { shellQuote } from "./quote.js";
+export const ORIGIN_HOST = "intentic-sandbox-workspace";
+export const sandboxNames = (slug) => ({
+    container: `intentic-sandbox-${slug}`,
+    tunnelContainer: `intentic-sandbox-tunnel-${slug}`,
+    workspaceVolume: `intentic-workspace-${slug}`,
+    historyVolume: `intentic-history-${slug}`,
+    dockerVolume: `intentic-docker-${slug}`,
+    network: `intentic-workspace-${slug}`,
+});
+export const SANDBOX_CAPABILITIES = ["SYS_ADMIN", "SYS_PTRACE"];
+export const RUNTIME_DIRECTIVE_PREFIX = "# intentic:runtime ";
+export const RUNTIME_DIRECTIVES = ["--device=/dev/net/tun", "--cap-add=NET_ADMIN", "--privileged", "--gpus=all"];
+export const OPTIONAL_DIRECTIVES = [
+    {
+        token: "--gpus=all",
+        name: "NVIDIA GPU access",
+        env: "SANDBOX_GPU",
+        probe: { kind: "runtime", name: "nvidia" },
+    },
+];
+export const optionalDirective = (token) => OPTIONAL_DIRECTIVES.find((entry) => entry.token === token);
+export const runtimeDirectivesOf = (overlay) => {
+    const tokens = [];
+    for (const line of overlay.split("\n")) {
+        if (!line.startsWith(RUNTIME_DIRECTIVE_PREFIX)) {
+            continue;
+        }
+        for (const token of line.slice(RUNTIME_DIRECTIVE_PREFIX.length).trim().split(/\s+/)) {
+            if (!RUNTIME_DIRECTIVES.includes(token)) {
+                throw new Error(`unsupported runtime directive '${token}' in the approved overlay`);
+            }
+            tokens.push(token);
+        }
+    }
+    return tokens;
+};
+export const REPLAY_ENV = [
+    "WORKSPACE_ROOT",
+    "HISTORY_ROOT",
+    "AGENT_AUTH_DIR",
+    "SANDBOX_HOST",
+    "SANDBOX_PORT",
+    "SANDBOX_NAME",
+    "PREVIEW_PORT",
+    "GOOGLE_CLIENT_ID",
+    "CONNECT_TOKEN",
+    "OWNER_EMAIL",
+    "WEB_ORIGIN",
+    "SANDBOX_PUBLIC_URL",
+    "PLATFORM_URL",
+    "ZROK_TOKEN",
+    "ZROK_API",
+    "ZROK_NAMESPACE",
+    "CLOUDFLARE_API_TOKEN",
+    "HOST_SSH_KEY",
+    "SELF_HOST_USER",
+    "SYNC_PAIR_TOKEN",
+    "HOST_PAIR_TOKEN",
+    "HOST_PLATFORM",
+    "HOST_LABEL",
+    "SELF_HOST_ADDRESS",
+    "SELF_HOST_VIA",
+];
+export const parseNulEnv = (dump) => dump
+    .split("\0")
+    .filter((entry) => entry.includes("="))
+    .map((entry) => {
+    const eq = entry.indexOf("=");
+    return [entry.slice(0, eq), entry.slice(eq + 1)];
+});
+export const replayableEnv = (pairs) => REPLAY_ENV.flatMap((name) => {
+    const value = pairs.find(([key]) => key === name)?.[1];
+    return value === undefined || value === "" ? [] : [[name, value]];
+});
+export const HEALTH = { url: `http://localhost:${DAEMON_PORT}/health`, attempts: 15, intervalSeconds: 2 };
+const LOCAL_PORT_BASE = 28000;
+const LOCAL_PORT_SPAN = 4000;
+export const localDaemonPort = (sandboxId) => LOCAL_PORT_BASE + (Number.parseInt(sandboxId.slice(0, 6), 16) % LOCAL_PORT_SPAN);
+export const localDaemonUrl = (sandboxId, zone) => zone === undefined || zone === "" ? undefined : `https://local-${sandboxId}.${zone}:${localDaemonPort(sandboxId)}`;
+export const localDaemonUrlInsecure = (sandboxId) => `http://127.0.0.1:${localDaemonPort(sandboxId)}`;
+export const sandboxRunArgv = (run) => {
+    const asked = OPTIONAL_DIRECTIVES.filter((entry) => (run.runtime ?? []).includes(entry.token));
+    const dropped = new Set(asked.filter((entry) => (run.unsupported ?? []).includes(entry.token)).map((entry) => entry.token));
+    return [
+        "run",
+        "-d",
+        ...(run.init === false ? [] : ["--init"]),
+        "--restart",
+        "unless-stopped",
+        "--name",
+        run.names.container,
+        ...(run.labels ?? []).flatMap((label) => ["--label", label]),
+        "--network",
+        run.names.network,
+        ...(run.alias === false ? [] : ["--network-alias", ORIGIN_HOST]),
+        "--add-host",
+        "host.docker.internal:host-gateway",
+        ...(run.dns ?? []).flatMap((server) => ["--dns", server]),
+        "--log-opt",
+        "max-size=10m",
+        "--log-opt",
+        "max-file=3",
+        ...SANDBOX_CAPABILITIES.map((cap) => `--cap-add=${cap}`),
+        ...(run.runtime ?? []).filter((token) => !dropped.has(token)),
+        ...(run.ports ?? []).flatMap((port) => ["-p", port]),
+        ...(run.sandboxId !== undefined && run.localPublish !== false ? ["-p", `127.0.0.1:${localDaemonPort(run.sandboxId)}:${LOCAL_PORT}`] : []),
+        "-v",
+        `${run.names.workspaceVolume}:/work`,
+        "-v",
+        `${run.names.historyVolume}:/history`,
+        "-v",
+        `${run.names.dockerVolume}:/var/lib/docker`,
+        ...(run.mounts ?? []).flatMap((mount) => ["-v", mount]),
+        "-e",
+        `SANDBOX_NAME=${run.names.container}`,
+        "-e",
+        `SANDBOX_IMAGE=${run.image}`,
+        "-e",
+        `SANDBOX_BASE_IMAGE=${run.baseImage}`,
+        ...(run.environmentHash === undefined ? [] : ["-e", `SANDBOX_ENVIRONMENT_HASH=${run.environmentHash}`]),
+        ...(run.channel === undefined ? [] : ["-e", `SANDBOX_CHANNEL=${run.channel}`]),
+        ...(run.previousImage === undefined ? [] : ["-e", `SANDBOX_PREVIOUS_IMAGE=${run.previousImage}`]),
+        ...asked.flatMap((entry) => ["-e", `${entry.env}=${dropped.has(entry.token) ? "unsupported" : "all"}`]),
+        ...(run.env ?? []).flatMap(([name, value]) => ["-e", `${name}=${value}`]),
+        run.image,
+    ];
+};
+export const sandboxRunCommand = (run) => ["docker", ...sandboxRunArgv(run).map(shellQuote)].join(" ");
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA4BxC,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAWxD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAgB,EAAE,CAAC,CAAC;IACzD,SAAS,EAAE,oBAAoB,IAAI,EAAE;IACrC,eAAe,EAAE,2BAA2B,IAAI,EAAE;IAClD,eAAe,EAAE,sBAAsB,IAAI,EAAE;IAC7C,aAAa,EAAE,oBAAoB,IAAI,EAAE;IACzC,YAAY,EAAE,mBAAmB,IAAI,EAAE;IACvC,OAAO,EAAE,sBAAsB,IAAI,EAAE;CACxC,CAAC,CAAC;AAkBH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,YAAY,CAAU,CAAC;AAUzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAwC1H,MAAM,CAAC,MAAM,mBAAmB,GAAiC;IAC7D;QACI,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC7C;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAiC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAK9I,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAY,EAAE;IAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC7C,SAAS;QACb,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,IAAI,CAAE,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,2BAA2B,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,UAAU,GAAG;IACtB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,YAAY;IACZ,oBAAoB;IACpB,cAAc;IAGd,YAAY;IACZ,UAAU;IACV,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IAGjB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,eAAe;CACT,CAAC;AAIX,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC5D,IAAI;KACC,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IACX,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAA6C,EAAsB,EAAE,CAC/F,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAqB,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAKP,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,oBAAoB,WAAW,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAW,CAAC;AAmBnH,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,IAAI,CAAC;AAK7B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC;AAS/I,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,IAAwB,EAAsB,EAAE,CAC9F,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,IAAI,IAAI,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AAEvH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,oBAAoB,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AAuDtH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAY,EAAE;IAKxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5H,OAAO;QACH,KAAK;QACL,IAAI;QACJ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,WAAW;QACX,gBAAgB;QAChB,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,SAAS;QACnB,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5D,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO;QACjB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAChE,YAAY;QACZ,mCAAmC;QACnC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,WAAW;QACX,cAAc;QACd,WAAW;QACX,YAAY;QACZ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzI,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,QAAQ;QAKpC,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,WAAW;QACrC,IAAI;QACJ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,kBAAkB;QAC3C,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI;QACJ,gBAAgB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE;QACrC,IAAI;QACJ,iBAAiB,GAAG,CAAC,KAAK,EAAE;QAC5B,IAAI;QACJ,sBAAsB,GAAG,CAAC,SAAS,EAAE;QACrC,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,4BAA4B,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;QACvG,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,0BAA0B,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACjG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,KAAK;KACZ,CAAC;AACN,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAe,EAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}

package/dist/quote.d.ts

@@ -0,0 +1,6 @@
+export declare const shellQuote: (word: string) => string;
+export declare const sqlLiteral: (value: string) => string;
+export declare const sqlIdentifier: (name: string) => string;
+export declare const envLine: (key: string, value: string) => string;
+export declare const dockerEnvLine: (key: string, value: string) => string;
+//# sourceMappingURL=quote.d.ts.map

package/dist/quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.d.ts","sourceRoot":"","sources":["../src/quote.ts"],"names":[],"mappings":"AAoCA,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,MAA+E,CAAC;AAM1H,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,MAA4C,CAAC;AASxF,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAA2C,CAAC;AA0BzF,eAAO,MAAM,OAAO,QAAS,MAAM,SAAS,MAAM,KAAG,MAMpD,CAAC;AASF,eAAO,MAAM,aAAa,QAAS,MAAM,SAAS,MAAM,KAAG,MAO1D,CAAC"}

package/dist/quote.js

@@ -0,0 +1,18 @@
+const PLAIN_WORD = /^[\w@%+=:,./-]+$/;
+export const shellQuote = (word) => (PLAIN_WORD.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`);
+export const sqlLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
+export const sqlIdentifier = (name) => `"${name.replaceAll(`"`, `""`)}"`;
+export const envLine = (key, value) => {
+    const delimiter = [`'`, `"`, "`"].find((candidate) => !value.includes(candidate));
+    if (delimiter === undefined) {
+        throw new Error(`cannot write ${key} to a .env: the value contains all three quote characters, which its parser cannot express`);
+    }
+    return `${key}=${delimiter}${value}${delimiter}\n`;
+};
+export const dockerEnvLine = (key, value) => {
+    if (value.includes("\n")) {
+        throw new Error(`cannot write ${key} to a docker --env-file: the value contains a newline, which that file's parser reads as the start of another variable`);
+    }
+    return `${key}=${value}\n`;
+};
+//# sourceMappingURL=quote.js.map

package/dist/quote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.js","sourceRoot":"","sources":["../src/quote.ts"],"names":[],"mappings":"AA+BA,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAKtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;AAM1H,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AASxF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AA0BzF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE;IAC1D,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,4FAA4F,CAAC,CAAC;IACrI,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,SAAS,GAAG,KAAK,GAAG,SAAS,IAAI,CAAC;AACvD,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACX,gBAAgB,GAAG,wHAAwH,CAC9I,CAAC;IACN,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/B,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@intentic/sandbox-run",
+  "version": "1.176.3",
+  "description": "The sandbox container's run contract — names, capability posture, env allowlist, runtime directives, and the docker-run emitter every creation path composes from",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/intentic/intentic.git",
+    "directory": "_sandbox/sandbox-run"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": {
+        "@intentic/src": "./src/index.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "@intentic/src": "./src/index.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./fly": {
+      "types": "./dist/fly.d.ts",
+      "import": {
+        "@intentic/src": "./src/fly.ts",
+        "default": "./dist/fly.js"
+      },
+      "require": {
+        "@intentic/src": "./src/fly.ts",
+        "default": "./dist/fly.js"
+      }
+    },
+    "./quote": {
+      "types": "./dist/quote.d.ts",
+      "import": {
+        "@intentic/src": "./src/quote.ts",
+        "default": "./dist/quote.js"
+      },
+      "require": {
+        "@intentic/src": "./src/quote.ts",
+        "default": "./dist/quote.js"
+      }
+    }
+  },
+  "dependencies": {
+    "tslib": "2.8.1",
+    "@intentic/constants": "1.176.3"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.2",
+    "@typescript/native-preview": "7.0.0-dev.20260707.2",
+    "vitest": "4.1.10",
+    "@intentic/testing": "0.0.0",
+    "@intentic/tsconfig": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsgo",
+    "typecheck": "tsgo --noEmit -p tsconfig.test.json",
+    "watch": "tsgo --build --watch",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}