@keystrokehq/keystroke 0.1.2 → 0.1.3

package/dist/microsandbox-kL031wZw-DnkvZsHR.cjs

@@ -1,1662 +0,0 @@
-const require_dist = require("./dist-DCMRCBXO.cjs");
-let node_fs = require("node:fs");
-let node_module = require("node:module");
-let node_crypto = require("node:crypto");
-let node_path = require("node:path");
-let node_url = require("node:url");
-let node_fs_promises = require("node:fs/promises");
-//#region ../sandbox/dist/microsandbox-kL031wZw.mjs
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var MicrosandboxError = class extends Error {
-	code;
-	constructor(code, message, options) {
-		super(message, options);
-		this.code = code;
-		this.name = new.target.name;
-	}
-};
-var IoError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("io", message, options);
-	}
-};
-var HttpError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("http", message, options);
-	}
-};
-var LibkrunfwNotFoundError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("libkrunfwNotFound", message, options);
-	}
-};
-var DatabaseError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("database", message, options);
-	}
-};
-var InvalidConfigError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("invalidConfig", message, options);
-	}
-};
-var SandboxNotFoundError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("sandboxNotFound", message, options);
-	}
-};
-var SandboxStillRunningError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("sandboxStillRunning", message, options);
-	}
-};
-var RuntimeError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("runtime", message, options);
-	}
-};
-var JsonError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("json", message, options);
-	}
-};
-var ProtocolError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("protocol", message, options);
-	}
-};
-var NixError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("nix", message, options);
-	}
-};
-var ExecTimeoutError = class extends MicrosandboxError {
-	timeoutMs;
-	constructor(message, timeoutMs = null, options) {
-		super("execTimeout", message, options);
-		this.timeoutMs = timeoutMs;
-	}
-};
-var TerminalError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("terminal", message, options);
-	}
-};
-var SandboxFsError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("sandboxFs", message, options);
-	}
-};
-var ImageNotFoundError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("imageNotFound", message, options);
-	}
-};
-var ImageInUseError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("imageInUse", message, options);
-	}
-};
-var VolumeNotFoundError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("volumeNotFound", message, options);
-	}
-};
-var VolumeAlreadyExistsError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("volumeAlreadyExists", message, options);
-	}
-};
-var ImageError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("image", message, options);
-	}
-};
-var PatchFailedError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("patchFailed", message, options);
-	}
-};
-var MetricsDisabledError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("metricsDisabled", message, options);
-	}
-};
-var CustomError = class extends MicrosandboxError {
-	constructor(message, options) {
-		super("custom", message, options);
-	}
-};
-const PATTERN = /^\[(\w+)\] ([\s\S]*)$/;
-const CTORS = new Map([
-	["Io", (m, c) => new IoError(m, { cause: c })],
-	["Http", (m, c) => new HttpError(m, { cause: c })],
-	["LibkrunfwNotFound", (m, c) => new LibkrunfwNotFoundError(m, { cause: c })],
-	["Database", (m, c) => new DatabaseError(m, { cause: c })],
-	["InvalidConfig", (m, c) => new InvalidConfigError(m, { cause: c })],
-	["SandboxNotFound", (m, c) => new SandboxNotFoundError(m, { cause: c })],
-	["SandboxStillRunning", (m, c) => new SandboxStillRunningError(m, { cause: c })],
-	["Runtime", (m, c) => new RuntimeError(m, { cause: c })],
-	["Json", (m, c) => new JsonError(m, { cause: c })],
-	["Protocol", (m, c) => new ProtocolError(m, { cause: c })],
-	["Nix", (m, c) => new NixError(m, { cause: c })],
-	["ExecTimeout", (m, c) => new ExecTimeoutError(m, parseTimeoutMs(m), { cause: c })],
-	["Terminal", (m, c) => new TerminalError(m, { cause: c })],
-	["SandboxFs", (m, c) => new SandboxFsError(m, { cause: c })],
-	["ImageNotFound", (m, c) => new ImageNotFoundError(m, { cause: c })],
-	["ImageInUse", (m, c) => new ImageInUseError(m, { cause: c })],
-	["VolumeNotFound", (m, c) => new VolumeNotFoundError(m, { cause: c })],
-	["VolumeAlreadyExists", (m, c) => new VolumeAlreadyExistsError(m, { cause: c })],
-	["Image", (m, c) => new ImageError(m, { cause: c })],
-	["PatchFailed", (m, c) => new PatchFailedError(m, { cause: c })],
-	["MetricsDisabled", (m, c) => new MetricsDisabledError(m, { cause: c })],
-	["Custom", (m, c) => new CustomError(m, { cause: c })]
-]);
-function parseTimeoutMs(message) {
-	const m = /(\d+(?:\.\d+)?)\s*(ms|s|m|h)\b/.exec(message);
-	if (!m) return null;
-	const n = Number(m[1]);
-	switch (m[2]) {
-		case "ms": return n;
-		case "s": return n * 1e3;
-		case "m": return n * 6e4;
-		case "h": return n * 36e5;
-		default: return null;
-	}
-}
-function mapNapiError(err) {
-	if (!(err instanceof Error)) return err;
-	const m = PATTERN.exec(err.message);
-	if (!m) return err;
-	const ctor = CTORS.get(m[1]);
-	if (!ctor) return err;
-	return ctor(m[2], err);
-}
-async function withMappedErrors(fn) {
-	try {
-		return await fn();
-	} catch (e) {
-		throw mapNapiError(e);
-	}
-}
-function detectTriple() {
-	const p = process.platform;
-	const a = process.arch;
-	if (p === "darwin" && a === "arm64") return "darwin-arm64";
-	if (p === "linux" && a === "x64") return "linux-x64-gnu";
-	if (p === "linux" && a === "arm64") return "linux-arm64-gnu";
-	throw new Error(`microsandbox: unsupported platform ${p}-${a}`);
-}
-function resolutionBases() {
-	const bases = /* @__PURE__ */ new Set();
-	bases.add(require("url").pathToFileURL(__filename).href);
-	if (process.argv[1]) bases.add(`file://${process.argv[1]}`);
-	bases.add(`file://${process.cwd()}/`);
-	return Array.from(bases);
-}
-function resolvePlatformRoot() {
-	const triple = detectTriple();
-	for (const base of resolutionBases()) try {
-		const root = (0, node_path.dirname)((0, node_module.createRequire)(base).resolve(`@superradcompany/microsandbox-${triple}/package.json`));
-		if ((0, node_fs.existsSync)((0, node_path.join)(root, "bin", "msb"))) return root;
-	} catch {}
-	return null;
-}
-let cachedBinDir = null;
-function resolveBinDir() {
-	if (cachedBinDir) return cachedBinDir;
-	const root = resolvePlatformRoot();
-	if (root) {
-		cachedBinDir = (0, node_path.join)(root, "bin");
-		return cachedBinDir;
-	}
-	cachedBinDir = (0, node_path.join)(process.env.HOME ?? "", ".microsandbox", "bin");
-	return cachedBinDir;
-}
-/** Path to the bundled `msb` binary, or null if not yet installed. */
-function msbPath() {
-	const explicit = process.env.MSB_PATH;
-	if (explicit) return (0, node_fs.existsSync)(explicit) ? explicit : null;
-	const p = (0, node_path.join)(resolveBinDir(), "msb");
-	return (0, node_fs.existsSync)(p) ? p : null;
-}
-const resolvedMsbPath = process.env.MSB_PATH || msbPath();
-const native = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href)("../../native/index.cjs");
-if (resolvedMsbPath) native.setRuntimeMsbPath?.(resolvedMsbPath);
-const napi = native;
-async function* mapAsyncIterable(source, normalize) {
-	for (;;) {
-		const raw = await withMappedErrors(() => source.recv());
-		if (raw === null) return;
-		yield normalize(raw);
-	}
-}
-function normalizeExecEvent(raw) {
-	switch (raw.eventType) {
-		case "started":
-			if (typeof raw.pid !== "number") throw new Error("exec event: missing pid on Started");
-			return {
-				kind: "started",
-				pid: raw.pid
-			};
-		case "stdout":
-			if (!raw.data) throw new Error("exec event: missing data on Stdout");
-			return {
-				kind: "stdout",
-				data: raw.data
-			};
-		case "stderr":
-			if (!raw.data) throw new Error("exec event: missing data on Stderr");
-			return {
-				kind: "stderr",
-				data: raw.data
-			};
-		case "exited":
-			if (typeof raw.code !== "number") throw new Error("exec event: missing code on Exited");
-			return {
-				kind: "exited",
-				code: raw.code
-			};
-	}
-}
-var ExecOutput = class {
-	inner;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	get code() {
-		return this.inner.code;
-	}
-	get success() {
-		return this.inner.success;
-	}
-	get status() {
-		return {
-			code: this.inner.code,
-			success: this.inner.success
-		};
-	}
-	/** Decode stdout as UTF-8. Lossy on invalid sequences. */
-	stdout() {
-		return this.inner.stdout();
-	}
-	/** Decode stderr as UTF-8. Lossy on invalid sequences. */
-	stderr() {
-		return this.inner.stderr();
-	}
-	/** Raw stdout bytes. */
-	stdoutBytes() {
-		return new Uint8Array(this.inner.stdoutBytes());
-	}
-	/** Raw stderr bytes. */
-	stderrBytes() {
-		return new Uint8Array(this.inner.stderrBytes());
-	}
-};
-var ExecSink = class {
-	inner;
-	closed = false;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	/** Write data to the process's stdin. */
-	async write(data) {
-		const buf = typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
-		await withMappedErrors(() => this.inner.write(buf));
-	}
-	/** Send EOF. Idempotent. */
-	async close() {
-		if (this.closed) return;
-		this.closed = true;
-		await withMappedErrors(() => this.inner.close());
-	}
-	async [Symbol.asyncDispose]() {
-		await this.close();
-	}
-};
-var ExecHandle = class {
-	inner;
-	stdinTaken = false;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	/** Receive the next event, or `null` once the stream ends. */
-	async recv() {
-		const raw = await withMappedErrors(() => this.inner.recv());
-		return raw === null ? null : normalizeExecEvent(raw);
-	}
-	/** Take ownership of the stdin sink. Returns `null` after the first call. */
-	async takeStdin() {
-		if (this.stdinTaken) return null;
-		const raw = await withMappedErrors(() => this.inner.takeStdin());
-		if (raw === null) return null;
-		this.stdinTaken = true;
-		return new ExecSink(raw);
-	}
-	/** Wait for the process to exit. */
-	async wait() {
-		return await withMappedErrors(() => this.inner.wait());
-	}
-	/** Drain stdout/stderr and wait for exit. */
-	async collect() {
-		return new ExecOutput(await withMappedErrors(() => this.inner.collect()));
-	}
-	async signal(signal) {
-		await withMappedErrors(() => this.inner.signal(signal));
-	}
-	async kill() {
-		await withMappedErrors(() => this.inner.kill());
-	}
-	[Symbol.asyncIterator]() {
-		return mapAsyncIterable(this.inner, normalizeExecEvent)[Symbol.asyncIterator]();
-	}
-	async [Symbol.asyncDispose]() {
-		await withMappedErrors(() => this.inner.kill()).catch(() => void 0);
-	}
-};
-var FsReadStream = class {
-	inner;
-	done = false;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	async recv() {
-		if (this.done) return null;
-		const buf = await withMappedErrors(() => this.inner.recv());
-		if (buf === null) {
-			this.done = true;
-			return null;
-		}
-		return new Uint8Array(buf);
-	}
-	/** Drain the stream into a single buffer. */
-	async collect() {
-		const chunks = [];
-		let total = 0;
-		for (;;) {
-			const c = await this.recv();
-			if (c === null) break;
-			chunks.push(c);
-			total += c.byteLength;
-		}
-		const out = new Uint8Array(total);
-		let off = 0;
-		for (const c of chunks) {
-			out.set(c, off);
-			off += c.byteLength;
-		}
-		return out;
-	}
-	[Symbol.asyncIterator]() {
-		return mapAsyncIterable({ recv: () => this.inner.recv() }, (buf) => new Uint8Array(buf))[Symbol.asyncIterator]();
-	}
-	async [Symbol.asyncDispose]() {
-		this.done = true;
-	}
-};
-var FsWriteSink = class {
-	inner;
-	closed = false;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	async write(data) {
-		const buf = typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
-		await withMappedErrors(() => this.inner.write(buf));
-	}
-	async close() {
-		if (this.closed) return;
-		this.closed = true;
-		await withMappedErrors(() => this.inner.close());
-	}
-	async [Symbol.asyncDispose]() {
-		await this.close();
-	}
-};
-var SandboxFs = class {
-	inner;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	async read(path) {
-		const buf = await withMappedErrors(() => this.inner.read(path));
-		return new Uint8Array(buf);
-	}
-	async readToString(path) {
-		return await withMappedErrors(() => this.inner.readString(path));
-	}
-	async readStream(path) {
-		return new FsReadStream(await withMappedErrors(() => this.inner.readStream(path)));
-	}
-	async writeStream(path) {
-		return new FsWriteSink(await withMappedErrors(() => this.inner.writeStream(path)));
-	}
-	async write(path, data) {
-		const buf = typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
-		await withMappedErrors(() => this.inner.write(path, buf));
-	}
-	async list(path) {
-		return (await withMappedErrors(() => this.inner.list(path))).map(napiFsEntryToFsEntry);
-	}
-	async mkdir(path) {
-		await withMappedErrors(() => this.inner.mkdir(path));
-	}
-	async removeDir(path) {
-		await withMappedErrors(() => this.inner.removeDir(path));
-	}
-	async remove(path) {
-		await withMappedErrors(() => this.inner.remove(path));
-	}
-	async copy(from, to) {
-		await withMappedErrors(() => this.inner.copy(from, to));
-	}
-	async rename(from, to) {
-		await withMappedErrors(() => this.inner.rename(from, to));
-	}
-	async stat(path) {
-		return napiFsMetadataToFsMetadata(await withMappedErrors(() => this.inner.stat(path)));
-	}
-	async exists(path) {
-		return await withMappedErrors(() => this.inner.exists(path));
-	}
-	/** Copy a host file into the guest. */
-	async copyFromHost(hostPath, guestPath) {
-		await withMappedErrors(() => this.inner.copyFromHost(hostPath, guestPath));
-	}
-	/** Copy a guest file out to the host. */
-	async copyToHost(guestPath, hostPath) {
-		await withMappedErrors(() => this.inner.copyToHost(guestPath, hostPath));
-	}
-};
-function napiFsEntryToFsEntry(e) {
-	return {
-		path: e.path,
-		kind: e.kind,
-		size: e.size,
-		mode: e.mode,
-		modified: typeof e.modified === "number" ? new Date(e.modified) : null
-	};
-}
-function napiFsMetadataToFsMetadata(m) {
-	return {
-		kind: m.kind,
-		size: m.size,
-		mode: m.mode,
-		readonly: m.readonly,
-		modified: typeof m.modified === "number" ? new Date(m.modified) : null,
-		created: typeof m.created === "number" ? new Date(m.created) : null
-	};
-}
-/**
-* One captured log entry from `exec.log`.
-*
-* Bytes are exposed via `data` as a `Uint8Array`. Use `text()` for a
-* UTF-8-lossy decode.
-*/
-var LogEntry = class {
-	/** Wall-clock capture time on the host. */
-	timestamp;
-	/** `"stdout"`, `"stderr"`, `"output"`, or `"system"`. */
-	source;
-	/**
-	* Exec session correlation id. `null` for `system` lifecycle
-	* markers, which aren't tied to a specific session. Useful when
-	* grouping entries by session: `entries.filter(e => e.sessionId
-	* === 42)`.
-	*/
-	sessionId;
-	/** The captured chunk's bytes. */
-	data;
-	constructor(timestamp, source, sessionId, data) {
-		this.timestamp = timestamp;
-		this.source = source;
-		this.sessionId = sessionId;
-		this.data = data;
-	}
-	/** UTF-8 decode of {@link data} (lossy — invalid bytes are replaced). */
-	text() {
-		return new TextDecoder("utf-8", { fatal: false }).decode(this.data);
-	}
-};
-/** @internal */
-function logEntryFromNapi(raw) {
-	const source = raw.source;
-	return new LogEntry(new Date(raw.timestampMs), source, raw.sessionId, new Uint8Array(raw.data));
-}
-/** @internal */
-function logReadOptionsToNapi(opts) {
-	if (!opts) return void 0;
-	return {
-		tail: opts.tail,
-		sinceMs: opts.since?.getTime(),
-		untilMs: opts.until?.getTime(),
-		sources: opts.sources ? Array.from(opts.sources) : void 0
-	};
-}
-function metricsFromNapi(raw) {
-	return {
-		cpuPercent: raw.cpuPercent,
-		memoryBytes: raw.memoryBytes,
-		memoryLimitBytes: raw.memoryLimitBytes,
-		diskReadBytes: raw.diskReadBytes,
-		diskWriteBytes: raw.diskWriteBytes,
-		netRxBytes: raw.netRxBytes,
-		netTxBytes: raw.netTxBytes,
-		uptimeMs: raw.uptimeMs,
-		timestamp: new Date(raw.timestampMs)
-	};
-}
-const READ_ONLY_MSG$1 = "SnapshotHandle is read-only — fetch a live handle via Snapshot.get(name) for lifecycle methods.";
-/**
-* Lightweight handle backed by an index row.
-*
-* Returned by `Snapshot.list()` and `Snapshot.get(...)`. Values are
-* snapshotted from the index at construction time — call
-* `Snapshot.get(...)` again for a fresh reading if needed.
-*/
-var SnapshotHandle = class {
-	inner;
-	/** Manifest digest (`sha256:hex`) — canonical identity. */
-	digest;
-	/** Convenience name. `null` for digest-only entries. */
-	name;
-	/** Manifest digest of the parent snapshot, or `null` for a root. */
-	parentDigest;
-	/** Image reference the snapshot was taken from. */
-	imageRef;
-	/** On-disk format of the upper layer. */
-	format;
-	/** Apparent size of the upper file at index time. */
-	sizeBytes;
-	/** Snapshot creation time (from manifest). */
-	createdAt;
-	/** Local artifact directory path. */
-	path;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-		this.digest = inner.digest;
-		this.name = inner.name ?? null;
-		this.parentDigest = inner.parentDigest ?? null;
-		this.imageRef = inner.imageRef;
-		this.format = inner.format;
-		this.sizeBytes = sizeBytesToBigInt(inner.sizeBytes);
-		this.createdAt = new Date(inner.createdAt);
-		this.path = inner.path;
-	}
-	/** Open and metadata-validate the underlying artifact. */
-	async open() {
-		if (typeof this.inner.open !== "function") throw new Error(READ_ONLY_MSG$1);
-		return new Snapshot(await withMappedErrors(() => this.inner.open()));
-	}
-	/**
-	* Remove the artifact and its index row. Refuses if the snapshot
-	* has indexed children unless `force` is set.
-	*/
-	async remove(opts) {
-		if (typeof this.inner.remove !== "function") throw new Error(READ_ONLY_MSG$1);
-		await withMappedErrors(() => this.inner.remove({ force: opts?.force ?? false }));
-	}
-};
-function sizeBytesToBigInt(v) {
-	if (v === null || v === void 0) return null;
-	return typeof v === "bigint" ? v : BigInt(v);
-}
-/** @internal */
-function snapshotInfoToHandle(info) {
-	return new SnapshotHandle(info);
-}
-/**
-* A snapshot artifact on disk.
-*
-* Returned by `Snapshot.builder(name).create()`, `Snapshot.open(...)`,
-* `SandboxHandle.snapshot(name)`, and `SandboxHandle.snapshotTo(path)`.
-*
-* The artifact is a directory containing `manifest.json` and the
-* captured `upper.ext4`. The directory is the source of truth; the
-* local DB index (used for queries like `Snapshot.list()`) is just a
-* cache and is rebuildable via `Snapshot.reindex()`.
-*/
-var Snapshot = class Snapshot {
-	/** @internal */
-	inner;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	/**
-	* Begin building a new snapshot of `sourceSandbox` (must be stopped).
-	*
-	* The bare-name and explicit-path destinations are mutually
-	* exclusive — call exactly one of `.name(s)` or `.path(p)`.
-	*/
-	static builder(sourceSandbox) {
-		const nb = new napi.SnapshotBuilder(sourceSandbox);
-		const origCreate = nb.create.bind(nb);
-		nb.create = async () => {
-			return new Snapshot(await withMappedErrors(() => origCreate()));
-		};
-		return nb;
-	}
-	/**
-	* Open an existing snapshot artifact. Bare names resolve under the
-	* default snapshots directory; anything else is treated as a path.
-	*
-	* Cheap metadata validation only — does not read the upper file.
-	* Use `verify()` for content checks.
-	*/
-	static async open(pathOrName) {
-		return new Snapshot(await withMappedErrors(() => napi.Snapshot.open(pathOrName)));
-	}
-	/** Look up an indexed snapshot by digest, name, or path. */
-	static async get(nameOrDigest) {
-		return new SnapshotHandle(await withMappedErrors(() => napi.Snapshot.get(nameOrDigest)));
-	}
-	/** List indexed snapshots from the local DB cache. */
-	static async list() {
-		return (await withMappedErrors(() => napi.Snapshot.list())).map(snapshotInfoToHandle);
-	}
-	/**
-	* Walk a directory and parse each subdirectory's manifest. Does
-	* not touch the index — useful for inspecting external snapshot
-	* collections that were never imported. Skips entries that don't
-	* look like snapshot artifacts.
-	*/
-	static async listDir(dir) {
-		return (await withMappedErrors(() => napi.Snapshot.listDir(dir))).map((s) => new Snapshot(s));
-	}
-	/**
-	* Remove a snapshot by path, name, or digest. Refuses if the
-	* snapshot has indexed children unless `force` is set.
-	*/
-	static async remove(pathOrName, opts) {
-		await withMappedErrors(() => napi.Snapshot.remove(pathOrName, { force: opts?.force ?? false }));
-	}
-	/**
-	* Walk the snapshots directory (default: configured snapshots dir)
-	* and rebuild the local index. Returns the number of artifacts
-	* indexed.
-	*/
-	static async reindex(dir) {
-		return withMappedErrors(() => napi.Snapshot.reindex(dir));
-	}
-	/**
-	* Bundle a snapshot into a `.tar.zst` archive. When the snapshot
-	* has no integrity hash yet, one is computed and embedded in the
-	* bundled manifest so the receiver can verify.
-	*/
-	static async export(nameOrPath, out, opts) {
-		await withMappedErrors(() => napi.Snapshot.export(nameOrPath, out, opts));
-	}
-	/**
-	* Unpack a snapshot archive (`.tar.zst` or `.tar`) into the
-	* snapshots directory, verifying recorded integrity on the way in.
-	* Compression is detected from magic bytes.
-	*/
-	static async import(archive, dest) {
-		return new SnapshotHandle(await withMappedErrors(() => napi.Snapshot.import(archive, dest)));
-	}
-	/** Path to the artifact directory. */
-	get path() {
-		return this.inner.path;
-	}
-	/** Canonical content digest (`sha256:hex`). The snapshot's identity. */
-	get digest() {
-		return this.inner.digest;
-	}
-	/** Apparent size of the captured upper layer in bytes (sparse on disk). */
-	get sizeBytes() {
-		return this.inner.sizeBytes;
-	}
-	/** Image reference the snapshot was taken from. */
-	get imageRef() {
-		return this.inner.imageRef;
-	}
-	/** OCI manifest digest of the pinned image. */
-	get imageManifestDigest() {
-		return this.inner.imageManifestDigest;
-	}
-	/** On-disk format of the upper layer. */
-	get format() {
-		return this.inner.format;
-	}
-	/** Filesystem type inside the upper (e.g. `"ext4"`). */
-	get fstype() {
-		return this.inner.fstype;
-	}
-	/** Manifest digest of the parent snapshot, or `null` for a root. */
-	get parent() {
-		return this.inner.parent ?? null;
-	}
-	/** RFC 3339 timestamp when the snapshot was created. */
-	get createdAt() {
-		return this.inner.createdAt;
-	}
-	/** User-supplied labels (sorted by key in canonical form). */
-	get labels() {
-		return Object.entries(this.inner.labels);
-	}
-	/** Best-effort source-sandbox name, if recorded. */
-	get sourceSandbox() {
-		return this.inner.sourceSandbox ?? null;
-	}
-	/**
-	* Recompute the upper layer's content hash and compare against the
-	* manifest. Walks data extents only, so a 4 GiB sparse file with a
-	* few MB of data verifies in milliseconds.
-	*
-	* Returns `{ upper: { kind: "notRecorded" } }` when the manifest
-	* has no integrity hash recorded.
-	*/
-	async verify() {
-		return verifyReportToTs(await withMappedErrors(() => this.inner.verify()));
-	}
-};
-/** @internal */
-function verifyReportToTs(r) {
-	if (r.upperKind === "verified") return {
-		digest: r.digest,
-		path: r.path,
-		upper: {
-			kind: "verified",
-			algorithm: r.upperAlgorithm ?? "",
-			digest: r.upperDigest ?? ""
-		}
-	};
-	return {
-		digest: r.digest,
-		path: r.path,
-		upper: { kind: "notRecorded" }
-	};
-}
-const READ_ONLY_MSG = "SandboxHandle is read-only — fetch a live handle via Sandbox.get(name) for lifecycle methods.";
-var SandboxHandle = class {
-	inner;
-	name;
-	status;
-	configJson;
-	createdAt;
-	updatedAt;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-		this.name = inner.name;
-		this.status = inner.status;
-		this.configJson = inner.configJson;
-		this.createdAt = typeof inner.createdAt === "number" ? new Date(inner.createdAt) : null;
-		this.updatedAt = typeof inner.updatedAt === "number" ? new Date(inner.updatedAt) : null;
-	}
-	requireLive() {
-		if (!isHandle(this.inner)) throw new Error(READ_ONLY_MSG);
-		return this.inner;
-	}
-	/** Get point-in-time metrics. */
-	async metrics() {
-		const live = this.requireLive();
-		return metricsFromNapi(await withMappedErrors(() => live.metrics()));
-	}
-	/** Resume in attached mode. */
-	async start() {
-		const live = this.requireLive();
-		return new Sandbox(await withMappedErrors(() => live.start()), this.name, true);
-	}
-	/** Resume in detached mode. */
-	async startDetached() {
-		const live = this.requireLive();
-		return new Sandbox(await withMappedErrors(() => live.startDetached()), this.name, false);
-	}
-	/** Connect to an already-running sandbox without taking lifecycle ownership. */
-	async connect() {
-		const live = this.requireLive();
-		return new Sandbox(await withMappedErrors(() => live.connect()), this.name, false);
-	}
-	async stop() {
-		const live = this.requireLive();
-		await withMappedErrors(() => live.stop());
-	}
-	async kill() {
-		const live = this.requireLive();
-		await withMappedErrors(() => live.kill());
-	}
-	async remove() {
-		const live = this.requireLive();
-		await withMappedErrors(() => live.remove());
-	}
-	/**
-	* Read captured output from `exec.log` for this sandbox.
-	*
-	* Works without starting the sandbox. Defaults to user output:
-	* `stdout`, `stderr`, and pty-merged `output`. Pass
-	* `{ sources: ["system"] }` for runtime/kernel diagnostics or
-	* `{ sources: ["all"] }` for everything.
-	*/
-	async logs(opts) {
-		const live = this.requireLive();
-		const napiOpts = logReadOptionsToNapi(opts);
-		return (await withMappedErrors(() => live.logs(napiOpts))).map(logEntryFromNapi);
-	}
-	/**
-	* Snapshot this (stopped) sandbox under a bare name. Resolves under
-	* `~/.microsandbox/snapshots/<name>/`. For an explicit filesystem
-	* destination, see `snapshotTo`.
-	*
-	* The sandbox must be stopped (or crashed); running sandboxes are
-	* rejected with a `SnapshotSandboxRunning` error.
-	*/
-	async snapshot(name) {
-		const live = this.requireLive();
-		return new Snapshot(await withMappedErrors(() => live.snapshot(name)));
-	}
-	/** Snapshot this (stopped) sandbox to an explicit filesystem path. */
-	async snapshotTo(path) {
-		const live = this.requireLive();
-		return new Snapshot(await withMappedErrors(() => live.snapshotTo(path)));
-	}
-};
-function isHandle(v) {
-	return typeof v.start === "function";
-}
-/** @internal */
-function sandboxInfoToHandle(info) {
-	return new SandboxHandle(info);
-}
-var MetricsStream = class {
-	inner;
-	done = false;
-	/** @internal */
-	constructor(inner) {
-		this.inner = inner;
-	}
-	async recv() {
-		if (this.done) return null;
-		const raw = await withMappedErrors(() => this.inner.recv());
-		if (raw === null) {
-			this.done = true;
-			return null;
-		}
-		return metricsFromNapi(raw);
-	}
-	[Symbol.asyncIterator]() {
-		return mapAsyncIterable({ recv: () => this.inner.recv() }, metricsFromNapi)[Symbol.asyncIterator]();
-	}
-	async [Symbol.asyncDispose]() {
-		this.done = true;
-	}
-};
-/**
-* Pair returned by `SandboxBuilder.createWithPullProgress()` —
-* the per-layer progress event stream plus a method to await the
-* final `Sandbox`.
-*/
-var PullProgressCreate = class {
-	/** @internal */
-	inner;
-	/** @internal */
-	name;
-	/** @internal */
-	attached;
-	/** @internal */
-	constructor(inner, name, attached) {
-		this.inner = inner;
-		this.name = name;
-		this.attached = attached;
-	}
-	/**
-	* The progress event stream. Iterate with `for await...of` or poll
-	* with `.recv()`. The stream closes once the pull completes.
-	*/
-	get progress() {
-		return this.inner.progress;
-	}
-	/**
-	* Async iterator helper: equivalent to `for await (const ev of c.progress)`.
-	* Lets you write `for await (const ev of c) { … }` directly.
-	*/
-	[Symbol.asyncIterator]() {
-		return this.inner.progress[Symbol.asyncIterator]();
-	}
-	/** Await the sandbox. Resolves once pull + boot finishes. */
-	async awaitSandbox() {
-		return new Sandbox(await withMappedErrors(() => this.inner.awaitSandbox()), this.name, this.attached);
-	}
-};
-var Sandbox = class Sandbox {
-	/** @internal */
-	inner;
-	name;
-	ownsLifecycle;
-	/** @internal use `Sandbox.builder(name).create()` */
-	constructor(inner, name, ownsLifecycle = true) {
-		this.inner = inner;
-		this.name = name;
-		this.ownsLifecycle = ownsLifecycle;
-	}
-	/** Begin building a new sandbox. */
-	static builder(name) {
-		const nb = new napi.SandboxBuilder(name);
-		const origCreate = nb.create.bind(nb);
-		const origCreateDetached = nb.createDetached.bind(nb);
-		const origCreateWithPP = nb.createWithPullProgress.bind(nb);
-		const origCreateDetachedWithPP = nb.createDetachedWithPullProgress.bind(nb);
-		nb.create = async () => {
-			return new Sandbox(await withMappedErrors(() => origCreate()), name, true);
-		};
-		nb.createDetached = async () => {
-			return new Sandbox(await withMappedErrors(() => origCreateDetached()), name, false);
-		};
-		nb.createWithPullProgress = async () => {
-			return new PullProgressCreate(await withMappedErrors(() => origCreateWithPP()), name, true);
-		};
-		nb.createDetachedWithPullProgress = async () => {
-			return new PullProgressCreate(await withMappedErrors(() => origCreateDetachedWithPP()), name, false);
-		};
-		return nb;
-	}
-	/** Resume an existing stopped sandbox in attached mode. */
-	static async start(name) {
-		return new Sandbox(await withMappedErrors(() => napi.Sandbox.start(name)), name, true);
-	}
-	/** Resume an existing stopped sandbox in detached mode. */
-	static async startDetached(name) {
-		return new Sandbox(await withMappedErrors(() => napi.Sandbox.startDetached(name)), name, false);
-	}
-	/** Look up a database handle for an existing sandbox. */
-	static async get(name) {
-		return new SandboxHandle(await withMappedErrors(() => napi.Sandbox.get(name)));
-	}
-	/** List all known sandboxes. */
-	static async list() {
-		return (await withMappedErrors(() => napi.Sandbox.list())).map(sandboxInfoToHandle);
-	}
-	/** Remove a stopped sandbox from the database. */
-	static async remove(name) {
-		await withMappedErrors(() => napi.Sandbox.remove(name));
-	}
-	async exec(cmd, args) {
-		const argv = args ? Array.from(args) : void 0;
-		return new ExecOutput(await withMappedErrors(() => this.inner.exec(cmd, argv)));
-	}
-	async execWith(cmd, configure) {
-		const builder = configure(new napi.ExecOptionsBuilder());
-		return new ExecOutput(await withMappedErrors(() => this.inner.execWithBuilder(cmd, builder)));
-	}
-	async execStream(cmd, args) {
-		const argv = args ? Array.from(args) : void 0;
-		return new ExecHandle(await withMappedErrors(() => this.inner.execStream(cmd, argv)));
-	}
-	async execStreamWith(cmd, configure) {
-		const builder = configure(new napi.ExecOptionsBuilder());
-		return new ExecHandle(await withMappedErrors(() => this.inner.execStreamWithBuilder(cmd, builder)));
-	}
-	async shell(script) {
-		return new ExecOutput(await withMappedErrors(() => this.inner.shell(script)));
-	}
-	async shellStream(script) {
-		return new ExecHandle(await withMappedErrors(() => this.inner.shellStream(script)));
-	}
-	async attach(cmd, args) {
-		const argv = args ? Array.from(args) : void 0;
-		return await withMappedErrors(() => this.inner.attach(cmd, argv));
-	}
-	async attachWith(cmd, configure) {
-		const builder = configure(new napi.AttachOptionsBuilder());
-		return await withMappedErrors(() => this.inner.attachWithBuilder(cmd, builder));
-	}
-	async attachShell() {
-		return await withMappedErrors(() => this.inner.attachShell());
-	}
-	fs() {
-		return new SandboxFs(this.inner.fs());
-	}
-	/**
-	* The full configuration this sandbox was created with — image, cpus,
-	* memory, env, mounts, etc. The shape mirrors `SandboxBuilder.build()`.
-	*/
-	async config() {
-		const json = await withMappedErrors(() => this.inner.configJson());
-		return remapKeysToCamel(JSON.parse(json));
-	}
-	/**
-	* Read captured output from this sandbox's `exec.log`.
-	*
-	* Backed by an on-disk JSON Lines file the runtime writes via the
-	* relay tap. Works on running and stopped sandboxes alike — no
-	* protocol traffic. Default sources are user output: `stdout`,
-	* `stderr`, and pty-merged `output`.
-	*/
-	async logs(opts) {
-		const napiOpts = logReadOptionsToNapi(opts);
-		return (await withMappedErrors(() => this.inner.logs(napiOpts))).map(logEntryFromNapi);
-	}
-	async metrics() {
-		return metricsFromNapi(await withMappedErrors(() => this.inner.metrics()));
-	}
-	/** Stream metrics snapshots at the given interval (in milliseconds). */
-	async metricsStream(intervalMs) {
-		return new MetricsStream(await withMappedErrors(() => this.inner.metricsStream(intervalMs)));
-	}
-	async stop() {
-		await withMappedErrors(() => this.inner.stop());
-	}
-	async stopAndWait() {
-		return await withMappedErrors(() => this.inner.stopAndWait());
-	}
-	async kill() {
-		await withMappedErrors(() => this.inner.kill());
-	}
-	async drain() {
-		await withMappedErrors(() => this.inner.drain());
-	}
-	async wait() {
-		return await withMappedErrors(() => this.inner.wait());
-	}
-	async detach() {
-		await withMappedErrors(() => this.inner.detach());
-	}
-	async removePersisted() {
-		await withMappedErrors(() => this.inner.removePersisted());
-	}
-	async [Symbol.asyncDispose]() {
-		if (!this.ownsLifecycle) return;
-		try {
-			await this.inner.stop();
-		} catch {}
-	}
-};
-const snakeToCamel = (k) => k.replace(/_([a-z0-9])/g, (_m, c) => c.toUpperCase());
-function remapKeysToCamel(v) {
-	if (Array.isArray(v)) return v.map(remapKeysToCamel);
-	if (v && typeof v === "object") {
-		const out = {};
-		for (const [k, val] of Object.entries(v)) out[snakeToCamel(k)] = remapKeysToCamel(val);
-		return out;
-	}
-	return v;
-}
-/** True when the runtime binaries are present and runnable. */
-function isInstalled() {
-	return napi.isInstalled();
-}
-const empty = Object.freeze([]);
-const allowEgressRule = (destination) => ({
-	direction: "egress",
-	destination,
-	protocols: empty,
-	ports: empty,
-	action: "allow"
-});
-/**
-* Allow plain DNS (UDP/53 and TCP/53) to the sandbox gateway, i.e. the
-* in-process DNS forwarder. The standard one-liner for opening DNS
-* under a deny-by-default policy. DoT (TCP/853) is intentionally not
-* included; add an explicit `Group::Host tcp/853` allow rule if needed.
-*/
-const allowDnsRule = () => ({
-	direction: "egress",
-	destination: {
-		kind: "group",
-		group: "host"
-	},
-	protocols: ["udp", "tcp"],
-	ports: [{
-		start: 53,
-		end: 53
-	}],
-	action: "allow"
-});
-const NetworkPolicy$1 = {
-	/** Deny everything in both directions. */
-	none: () => ({
-		defaultEgress: "deny",
-		defaultIngress: "deny",
-		rules: []
-	}),
-	/** Allow everything in both directions. */
-	allowAll: () => ({
-		defaultEgress: "allow",
-		defaultIngress: "allow",
-		rules: []
-	}),
-	/** Egress allowed only to public destinations; ingress allowed by default. */
-	publicOnly: () => ({
-		defaultEgress: "deny",
-		defaultIngress: "allow",
-		rules: [allowDnsRule(), allowEgressRule({
-			kind: "group",
-			group: "public"
-		})]
-	}),
-	/** Egress allowed to public + private (LAN); ingress allowed by default. */
-	nonLocal: () => ({
-		defaultEgress: "deny",
-		defaultIngress: "allow",
-		rules: [
-			allowDnsRule(),
-			allowEgressRule({
-				kind: "group",
-				group: "public"
-			}),
-			allowEgressRule({
-				kind: "group",
-				group: "private"
-			})
-		]
-	})
-};
-var dist_exports = /* @__PURE__ */ __exportAll({
-	NetworkPolicy: () => NetworkPolicy,
-	isInstalled: () => isInstalled
-});
-function wrapMethodWithErrorMap(cls, method) {
-	const proto = cls.prototype;
-	const orig = proto[method];
-	if (typeof orig !== "function" || orig.__wrapped) return;
-	const wrapped = function(...args) {
-		try {
-			const result = orig.apply(this, args);
-			if (result && typeof result.then === "function") return result.catch((e) => {
-				throw mapNapiError(e);
-			});
-			return result;
-		} catch (e) {
-			throw mapNapiError(e);
-		}
-	};
-	wrapped.__wrapped = true;
-	proto[method] = wrapped;
-}
-wrapMethodWithErrorMap(napi.MountBuilder, "build");
-wrapMethodWithErrorMap(napi.SandboxBuilder, "create");
-wrapMethodWithErrorMap(napi.SandboxBuilder, "createDetached");
-wrapMethodWithErrorMap(napi.PatchBuilder, "build");
-wrapMethodWithErrorMap(napi.DnsBuilder, "build");
-wrapMethodWithErrorMap(napi.SecretBuilder, "build");
-wrapMethodWithErrorMap(napi.VolumeBuilder, "create");
-{
-	const proto = napi.SandboxBuilder.prototype;
-	if (!proto.__buildWrapped) {
-		const origBuild = proto.build;
-		const snakeToCamel = (k) => k.replace(/_([a-z0-9])/g, (_m, c) => c.toUpperCase());
-		const remapKeys = (v) => {
-			if (Array.isArray(v)) return v.map(remapKeys);
-			if (v && typeof v === "object") {
-				const out = {};
-				for (const [k, val] of Object.entries(v)) out[snakeToCamel(k)] = remapKeys(val);
-				return out;
-			}
-			return v;
-		};
-		proto.build = function() {
-			let json;
-			try {
-				json = origBuild.apply(this);
-			} catch (e) {
-				throw mapNapiError(e);
-			}
-			return remapKeys(JSON.parse(json));
-		};
-		Object.defineProperty(proto, "__buildWrapped", {
-			value: true,
-			enumerable: false,
-			writable: false,
-			configurable: false
-		});
-	}
-}
-function hideMethod(cls, name) {
-	if (Object.prototype.hasOwnProperty.call(cls.prototype, name)) {
-		const value = cls.prototype[name];
-		Object.defineProperty(cls.prototype, name, {
-			value,
-			enumerable: false,
-			writable: true,
-			configurable: true
-		});
-	}
-}
-hideMethod(napi.NetworkBuilder, "buildJson");
-hideMethod(napi.NetworkBuilder, "policyJson");
-hideMethod(napi.NetworkBuilder, "policyFromBuilder");
-hideMethod(napi.SandboxBuilder, "execWithBuilder");
-hideMethod(napi.SandboxBuilder, "execStreamWithBuilder");
-hideMethod(napi.SandboxBuilder, "attachWithBuilder");
-{
-	const proto = napi.NetworkBuilder.prototype;
-	if (!proto.__buildWrapped) {
-		const snakeToCamel = (k) => k.replace(/_([a-z0-9])/g, (_m, c) => c.toUpperCase());
-		const remapKeys = (v) => {
-			if (Array.isArray(v)) return v.map(remapKeys);
-			if (v && typeof v === "object") {
-				const out = {};
-				for (const [k, val] of Object.entries(v)) out[snakeToCamel(k)] = remapKeys(val);
-				return out;
-			}
-			return v;
-		};
-		proto.build = function() {
-			let json;
-			try {
-				json = this.buildJson();
-			} catch (e) {
-				throw mapNapiError(e);
-			}
-			return remapKeys(JSON.parse(json));
-		};
-		Object.defineProperty(proto, "__buildWrapped", {
-			value: true,
-			enumerable: false,
-			writable: false,
-			configurable: false
-		});
-	}
-}
-{
-	const camelToSnake = (k) => k.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
-	const isDestination = (v) => {
-		if (!v || typeof v !== "object" || Array.isArray(v)) return false;
-		const obj = v;
-		if (typeof obj.kind !== "string") return false;
-		return [
-			"any",
-			"cidr",
-			"domain",
-			"domainSuffix",
-			"group"
-		].includes(obj.kind);
-	};
-	const remapDestination = (v, deep) => {
-		const tag = camelToSnake(v.kind);
-		if (v.kind === "any") return tag;
-		const dataField = v.kind === "domainSuffix" ? "suffix" : v.kind;
-		return { [tag]: deep(v[dataField]) };
-	};
-	const remapKeys = (v) => {
-		if (Array.isArray(v)) return v.map(remapKeys);
-		if (isDestination(v)) return remapDestination(v, remapKeys);
-		if (v && typeof v === "object") {
-			const out = {};
-			for (const [k, val] of Object.entries(v)) out[camelToSnake(k)] = remapKeys(val);
-			return out;
-		}
-		return v;
-	};
-	const proto = napi.NetworkBuilder.prototype;
-	if (!proto.policy) proto.policy = function(p) {
-		if (p instanceof napi.NetworkPolicyBuilder) {
-			this.policyFromBuilder(p);
-			return this;
-		}
-		this.policyJson(JSON.stringify(remapKeys(p)));
-		return this;
-	};
-}
-napi.DnsBuilder;
-napi.TlsBuilder;
-napi.SecretBuilder;
-napi.NetworkBuilder;
-napi.MountBuilder;
-napi.PatchBuilder;
-napi.RegistryConfigBuilder;
-napi.ImageBuilder;
-napi.ExecOptionsBuilder;
-napi.InitOptionsBuilder;
-napi.AttachOptionsBuilder;
-napi.NetworkPolicyBuilder;
-napi.RuleBuilder;
-napi.RuleDestinationBuilder;
-napi.InterfaceOverridesBuilder;
-const NetworkPolicy = {
-	...NetworkPolicy$1,
-	/**
-	* Start building a `NetworkPolicy` via the native fluent builder.
-	* Equivalent to `new NetworkPolicyBuilder()`.
-	*/
-	builder: () => new napi.NetworkPolicyBuilder()
-};
-const DEFAULT_IMAGE = "node:22";
-const DEFAULT_VM_IMAGE = DEFAULT_IMAGE;
-const DEFAULT_NETWORK = "public-only";
-function applyNetwork(builder, preset) {
-	switch (preset) {
-		case "none": return builder.disableNetwork();
-		case "allow-all": return builder.network((n) => n.policy(NetworkPolicy.allowAll()));
-		case "non-local": return builder.network((n) => n.policy(NetworkPolicy.nonLocal()));
-		default: return builder.network((n) => n.policy(NetworkPolicy.publicOnly()));
-	}
-}
-function applyVolume(builder, mount) {
-	return builder.volume(mount.guestPath, (m) => {
-		if ("bind" in mount) {
-			let bind = m.bind(mount.bind);
-			if (mount.readonly) bind = bind.readonly();
-			return bind;
-		}
-		if ("named" in mount) {
-			let named = m.named(mount.named);
-			if (mount.readonly) named = named.readonly();
-			return named;
-		}
-		const tmpfs = m.tmpfs();
-		return mount.sizeMiB !== void 0 ? tmpfs.size(mount.sizeMiB) : tmpfs;
-	});
-}
-function buildMicrosandbox(name, workspaceRoot, options = {}) {
-	const workdir = options.workdir ?? "/workspace";
-	let builder = Sandbox.builder(name).workdir(workdir);
-	if (options.snapshot) builder = builder.fromSnapshot(options.snapshot);
-	else builder = builder.image(options.image ?? DEFAULT_IMAGE);
-	if (options.memory !== void 0) builder = builder.memory(options.memory);
-	if (options.cpus !== void 0) builder = builder.cpus(options.cpus);
-	if (options.env) builder = builder.envs(options.env);
-	if (options.idleTimeout !== void 0) builder = builder.idleTimeout(options.idleTimeout);
-	if (options.maxDuration !== void 0) builder = builder.maxDuration(options.maxDuration);
-	if (options.replace !== false) builder = builder.replace();
-	builder = applyNetwork(builder, options.network ?? DEFAULT_NETWORK);
-	builder = builder.volume(require_dist.WORKSPACE_MOUNT, (m) => m.bind(workspaceRoot));
-	for (const mount of options.volumes ?? []) builder = applyVolume(builder, mount);
-	return builder;
-}
-const NODE_RUNTIME_REQUIRED_MESSAGE = "js-exec requires Node.js in the VM image. Use a Node-based image such as node:22 (the default VM image), or install Node in your custom image.";
-function nodeRuntimeMissingResult(image) {
-	return {
-		stdout: "",
-		stderr: `${NODE_RUNTIME_REQUIRED_MESSAGE}${image ? ` Configured image: ${image}.` : ""}\n`,
-		exitCode: 127
-	};
-}
-async function probeNodeRuntime(sb) {
-	return (await sb.execWith("sh", (builder) => builder.args(["-lc", "command -v node >/dev/null 2>&1"]))).code === 0;
-}
-/** Split a shell-style argument string, respecting single and double quotes. */
-function splitShellArgs(input) {
-	const args = [];
-	let current = "";
-	let quote = null;
-	let escaped = false;
-	for (let i = 0; i < input.length; i++) {
-		const char = input[i];
-		if (escaped) {
-			current += char;
-			escaped = false;
-			continue;
-		}
-		if (quote === "'") {
-			if (char === "'") quote = null;
-			else current += char;
-			continue;
-		}
-		if (quote === "\"") {
-			if (char === "\\") escaped = true;
-			else if (char === "\"") quote = null;
-			else current += char;
-			continue;
-		}
-		if (char === "'" || char === "\"") {
-			quote = char;
-			continue;
-		}
-		if (/\s/.test(char)) {
-			if (current.length > 0) {
-				args.push(current);
-				current = "";
-			}
-			continue;
-		}
-		current += char;
-	}
-	if (current.length > 0) args.push(current);
-	return args;
-}
-/** Return js-exec argv when `script` is a direct js-exec invocation. */
-function parseJsExecCommand(script) {
-	const trimmed = script.trim();
-	if (!trimmed.startsWith("js-exec")) return null;
-	const rest = trimmed.slice(7).trim();
-	if (rest.length === 0) return null;
-	return { argv: splitShellArgs(rest) };
-}
-const CODEMODE_GUEST_DIR = "/opt/keystroke";
-const CODEMODE_GUEST_RUNNER = `${CODEMODE_GUEST_DIR}/runner.mjs`;
-function findPackageRoot(from) {
-	let dir = from;
-	while (dir !== (0, node_path.dirname)(dir)) {
-		const manifest = (0, node_path.join)(dir, "package.json");
-		if ((0, node_fs.existsSync)(manifest)) {
-			if (JSON.parse((0, node_fs.readFileSync)(manifest, "utf8")).name === "@keystrokehq/sandbox") return dir;
-		}
-		dir = (0, node_path.dirname)(dir);
-	}
-	throw new Error("@keystrokehq/sandbox package root not found");
-}
-/** Locate the shipped codemode runner on the host filesystem. */
-function resolveCodemodeRunnerDir(fromModuleUrl) {
-	const packageRoot = findPackageRoot((0, node_path.dirname)((0, node_url.fileURLToPath)(fromModuleUrl)));
-	const candidates = [(0, node_path.join)(packageRoot, "dist", "providers", "microsandbox", "codemode"), (0, node_path.join)(packageRoot, "src", "providers", "microsandbox", "codemode")];
-	for (const candidate of candidates) if ((0, node_fs.existsSync)((0, node_path.join)(candidate, "runner.mjs"))) return candidate;
-	throw new Error("codemode runner.mjs not found on host");
-}
-function codemodeDir(workspaceRoot) {
-	return (0, node_path.join)(workspaceRoot, ".codemode");
-}
-async function prepareCodemodeDir(workspaceRoot) {
-	await (0, node_fs_promises.rm)(codemodeDir(workspaceRoot), {
-		recursive: true,
-		force: true
-	});
-	await (0, node_fs_promises.mkdir)(codemodeDir(workspaceRoot), { recursive: true });
-}
-async function handleToolRequest(workspaceRoot, filename, invokeTool, handled) {
-	if (!filename.endsWith(".request.json")) return;
-	if (handled.has(filename)) return;
-	handled.add(filename);
-	const requestPath = (0, node_path.join)(codemodeDir(workspaceRoot), filename);
-	let request;
-	try {
-		request = JSON.parse(await (0, node_fs_promises.readFile)(requestPath, "utf8"));
-	} catch {
-		handled.delete(filename);
-		return;
-	}
-	const responsePath = (0, node_path.join)(codemodeDir(workspaceRoot), `${request.id}.response.json`);
-	try {
-		const result = await invokeTool(request.path, request.argsJson);
-		const response = {
-			id: request.id,
-			result
-		};
-		await (0, node_fs_promises.writeFile)(responsePath, JSON.stringify(response));
-	} catch (error) {
-		const response = {
-			id: request.id,
-			error: error instanceof Error ? error.message : String(error)
-		};
-		await (0, node_fs_promises.writeFile)(responsePath, JSON.stringify(response));
-	}
-}
-/** Poll interval (ms) backing up fs.watch, which silently drops events under load. */
-const REQUEST_POLL_INTERVAL_MS = 25;
-function watchToolRequests(workspaceRoot, invokeTool) {
-	const dir = codemodeDir(workspaceRoot);
-	const handled = /* @__PURE__ */ new Set();
-	const handle = (filename) => {
-		if (!filename) return;
-		handleToolRequest(workspaceRoot, filename, invokeTool, handled).catch(() => {});
-	};
-	const watcher = (0, node_fs.watch)(dir, (_event, filename) => handle(filename));
-	const poll = setInterval(() => {
-		(0, node_fs_promises.readdir)(dir).then((entries) => {
-			for (const entry of entries) handle(entry);
-		}).catch(() => {});
-	}, REQUEST_POLL_INTERVAL_MS);
-	return { close: () => {
-		watcher.close();
-		clearInterval(poll);
-	} };
-}
-function isJsExecCommand(script) {
-	return parseJsExecCommand(script) !== null;
-}
-async function runCodemode(options) {
-	const invocation = parseJsExecCommand(options.script);
-	if (!invocation) return {
-		stdout: "",
-		stderr: "js-exec: malformed command\n",
-		exitCode: 2
-	};
-	await prepareCodemodeDir(options.workspaceRoot);
-	const requestWatcher = options.invokeTool !== void 0 ? watchToolRequests(options.workspaceRoot, options.invokeTool) : null;
-	try {
-		const cwd = options.execOptions?.cwd ?? options.workdir ?? "/workspace";
-		const runnerArgs = options.invokeTool ? ["--tools", ...invocation.argv] : [...invocation.argv];
-		const out = await options.sb.execWith("node", (builder) => {
-			let configured = builder.args([CODEMODE_GUEST_RUNNER, ...runnerArgs]).cwd(cwd);
-			if (options.execOptions?.env) configured = configured.envs(options.execOptions.env);
-			return configured;
-		});
-		return {
-			stdout: out.stdout(),
-			stderr: out.stderr(),
-			exitCode: out.code
-		};
-	} finally {
-		requestWatcher?.close();
-		await (0, node_fs_promises.rm)(codemodeDir(options.workspaceRoot), {
-			recursive: true,
-			force: true
-		});
-	}
-}
-function sandboxName(agentId, sessionId) {
-	return `agent-${(0, node_crypto.createHash)("sha256").update(`${agentId}:${sessionId}`).digest("hex").slice(0, 16)}`;
-}
-/** Recursively create the parent directory of a guest file (mkdir is non-recursive). */
-async function ensureGuestDir(fs, filePath) {
-	const segments = node_path.posix.dirname(filePath).split("/").filter(Boolean);
-	let current = "";
-	for (const segment of segments) {
-		current += `/${segment}`;
-		try {
-			await fs.mkdir(current);
-		} catch {}
-	}
-}
-function createMicrosandboxProvider(options = {}) {
-	return { async create(providerOptions) {
-		await require_dist.ensureWorkspaceDir(providerOptions.workspaceRoot);
-		const runnerHostDir = resolveCodemodeRunnerDir(require("url").pathToFileURL(__filename).href);
-		const sb = await buildMicrosandbox(sandboxName(providerOptions.agentId, providerOptions.sessionId), providerOptions.workspaceRoot, {
-			...options,
-			volumes: [...options.volumes ?? [], {
-				guestPath: CODEMODE_GUEST_DIR,
-				bind: runnerHostDir,
-				readonly: true
-			}]
-		}).create();
-		const hooks = providerOptions.hooks;
-		const guestFs = sb.fs();
-		let nodeAvailable;
-		async function ensureNodeRuntime() {
-			if (nodeAvailable === void 0) nodeAvailable = await probeNodeRuntime(sb);
-			if (!nodeAvailable) return nodeRuntimeMissingResult(options.image);
-			return null;
-		}
-		const runtime = {
-			agentId: providerOptions.agentId,
-			sessionId: providerOptions.sessionId,
-			workspaceRoot: providerOptions.workspaceRoot,
-			async exec(script, execOptions) {
-				const hookCtx = {
-					agentId: providerOptions.agentId,
-					sessionId: providerOptions.sessionId,
-					workspaceRoot: providerOptions.workspaceRoot
-				};
-				await hooks?.beforeExec?.({
-					...hookCtx,
-					script
-				});
-				let execResult;
-				if (isJsExecCommand(script)) execResult = await ensureNodeRuntime() ?? await runCodemode({
-					sb,
-					workspaceRoot: providerOptions.workspaceRoot,
-					script,
-					execOptions,
-					invokeTool: providerOptions.invokeTool,
-					workdir: options.workdir
-				});
-				else {
-					const out = await sb.execWith("sh", (e) => {
-						let builder = e.args(["-lc", script]).cwd(execOptions?.cwd ?? options.workdir ?? "/workspace");
-						if (execOptions?.env) builder = builder.envs(execOptions.env);
-						if (execOptions?.stdin !== void 0) builder = builder.stdinBytes(typeof execOptions.stdin === "string" ? Buffer.from(execOptions.stdin) : execOptions.stdin);
-						return builder;
-					});
-					execResult = {
-						stdout: out.stdout(),
-						stderr: out.stderr(),
-						exitCode: out.code
-					};
-				}
-				await hooks?.afterExec?.({
-					...hookCtx,
-					script,
-					result: execResult
-				});
-				return execResult;
-			},
-			async readFile(path) {
-				return guestFs.readToString(path);
-			},
-			async writeFile(path, content) {
-				await ensureGuestDir(guestFs, path);
-				await guestFs.write(path, content);
-			},
-			async dispose() {
-				await hooks?.onDispose?.({
-					agentId: providerOptions.agentId,
-					sessionId: providerOptions.sessionId,
-					workspaceRoot: providerOptions.workspaceRoot
-				});
-				await sb.stopAndWait();
-			}
-		};
-		return {
-			runtime,
-			tools: require_dist.createCodingTools(runtime)
-		};
-	} };
-}
-let cached;
-/** True when the optional `microsandbox` package is installed and usable. */
-async function isMicrosandboxAvailable() {
-	if (cached !== void 0) return cached;
-	try {
-		cached = (await Promise.resolve().then(() => dist_exports)).isInstalled();
-	} catch {
-		cached = false;
-	}
-	return cached;
-}
-var microsandbox_exports = /* @__PURE__ */ __exportAll({
-	DEFAULT_VM_IMAGE: () => DEFAULT_VM_IMAGE,
-	createMicrosandboxProvider: () => createMicrosandboxProvider,
-	isMicrosandboxAvailable: () => isMicrosandboxAvailable
-});
-//#endregion
-exports.t = microsandbox_exports;
-
-//# sourceMappingURL=microsandbox-kL031wZw-DnkvZsHR.cjs.map