@larkup/sandbox 0.1.2 → 0.1.4

package/dist/providers/e2b.js

@@ -0,0 +1,70 @@
+/**
+ * E2B adapter — https://docs.e2b.dev/
+ *
+ * Uses the base `e2b` SDK (not `@e2b/code-interpreter`) so execution stays a
+ * plain "run this shell script, get stdout/stderr/exitCode" call, matching
+ * every other remote adapter and letting them share `runScriptedExecution`.
+ */
+import { DEFAULT_TIMEOUT_MS, failedResult, runScriptedExecution, safeCleanup, withTimeout, } from '../remote-exec.js';
+async function loadSdk() {
+    return (await import('e2b'));
+}
+async function verifyCredentials(credentials) {
+    const apiKey = credentials.apiKey?.trim();
+    if (!apiKey)
+        throw new Error('E2B API key is required.');
+    const { Sandbox } = await loadSdk();
+    await Sandbox.list({ apiKey }).nextItems();
+}
+async function healthCheck(credentials) {
+    if (!credentials.apiKey?.trim()) {
+        return { status: 'missing-credentials', backend: 'e2b', error: 'E2B API key is required.' };
+    }
+    try {
+        await verifyCredentials(credentials);
+        return { status: 'ready', backend: 'e2b' };
+    }
+    catch (err) {
+        return {
+            status: 'error',
+            backend: 'e2b',
+            error: err instanceof Error ? err.message : 'E2B health check failed.',
+        };
+    }
+}
+async function execute(request, credentials) {
+    const startTime = Date.now();
+    const apiKey = credentials.apiKey?.trim();
+    if (!apiKey)
+        return failedResult('E2B API key is required.', startTime);
+    const timeoutMs = request.timeout ?? DEFAULT_TIMEOUT_MS;
+    let sandbox;
+    try {
+        const { Sandbox } = await loadSdk();
+        const options = { apiKey, timeoutMs: timeoutMs + 60_000, allowInternetAccess: false };
+        const snapshotId = credentials.snapshotId?.trim();
+        sandbox = await withTimeout(snapshotId ? Sandbox.create(snapshotId, options) : Sandbox.create(options), timeoutMs + 30_000, 'E2B sandbox create');
+        const activeSandbox = sandbox;
+        return await runScriptedExecution(async (script) => {
+            const result = await activeSandbox.commands.run(script, { timeoutMs });
+            return {
+                stdout: result.stdout ?? '',
+                stderr: result.stderr ?? '',
+                exitCode: result.exitCode ?? 0,
+            };
+        }, request);
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'E2B execution failed.', startTime);
+    }
+    finally {
+        if (sandbox)
+            await safeCleanup(() => sandbox.kill());
+    }
+}
+export const e2bAdapter = {
+    id: 'e2b',
+    verifyCredentials,
+    healthCheck,
+    execute,
+};

package/dist/providers/flyio.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Fly.io Sprites adapter — https://fly.io/sprites/
+ *
+ * The `@fly/sprites` SDK is very early (0.2.x) and its docs don't confirm a
+ * dedicated whoami/list call. `verifyCredentials` falls back to creating and
+ * immediately deleting a throwaway sprite if no lighter check is exposed.
+ */
+import type { SandboxProviderAdapter } from '../types.js';
+export declare const flyioAdapter: SandboxProviderAdapter;

package/dist/providers/flyio.js

@@ -0,0 +1,98 @@
+/**
+ * Fly.io Sprites adapter — https://fly.io/sprites/
+ *
+ * The `@fly/sprites` SDK is very early (0.2.x) and its docs don't confirm a
+ * dedicated whoami/list call. `verifyCredentials` falls back to creating and
+ * immediately deleting a throwaway sprite if no lighter check is exposed.
+ */
+import { randomUUID } from 'node:crypto';
+import { DEFAULT_TIMEOUT_MS, failedResult, runScriptedExecution, safeCleanup, withTimeout, } from '../remote-exec.js';
+async function loadSdk() {
+    // @ts-ignore
+    return (await import(/* webpackIgnore: true */ '@fly/sprites'));
+}
+function requireToken(credentials) {
+    const token = credentials.token?.trim();
+    if (!token)
+        throw new Error('Fly Sprites token is required.');
+    return token;
+}
+async function verifyCredentials(credentials) {
+    const token = requireToken(credentials);
+    const { SpritesClient } = await loadSdk();
+    const client = new SpritesClient(token);
+    if (typeof client.listSprites === 'function') {
+        await client.listSprites();
+        return;
+    }
+    const sprite = await client.createSprite(`larkup-verify-${randomUUID().slice(0, 8)}`);
+    await safeCleanup(() => sprite.delete());
+}
+async function healthCheck(credentials) {
+    if (!credentials.token?.trim()) {
+        return {
+            status: 'missing-credentials',
+            backend: 'flyio',
+            error: 'Fly Sprites token is required.',
+        };
+    }
+    try {
+        await verifyCredentials(credentials);
+        return { status: 'ready', backend: 'flyio' };
+    }
+    catch (err) {
+        return {
+            status: 'error',
+            backend: 'flyio',
+            error: err instanceof Error ? err.message : 'Fly Sprites health check failed.',
+        };
+    }
+}
+async function execute(request, credentials) {
+    const startTime = Date.now();
+    let token;
+    try {
+        token = requireToken(credentials);
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Missing Fly Sprites token.', startTime);
+    }
+    const timeoutMs = request.timeout ?? DEFAULT_TIMEOUT_MS;
+    let sprite;
+    try {
+        const { SpritesClient } = await loadSdk();
+        const client = new SpritesClient(token);
+        sprite = await withTimeout(client.createSprite(`larkup-${randomUUID().slice(0, 8)}`), timeoutMs + 30_000, 'Fly Sprite create');
+        const activeSprite = sprite;
+        return await withTimeout(runScriptedExecution(async (script) => {
+            try {
+                const result = await activeSprite.exec(script);
+                return { stdout: result.stdout ?? '', stderr: result.stderr ?? '', exitCode: 0 };
+            }
+            catch (err) {
+                const execErr = err;
+                if (execErr && typeof execErr.exitCode === 'number') {
+                    return {
+                        stdout: execErr.stdout ?? '',
+                        stderr: execErr.stderr ?? execErr.message,
+                        exitCode: execErr.exitCode,
+                    };
+                }
+                throw err;
+            }
+        }, request), timeoutMs + 15_000, 'Fly Sprite execution');
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Fly Sprites execution failed.', startTime);
+    }
+    finally {
+        if (sprite)
+            await safeCleanup(() => sprite.delete());
+    }
+}
+export const flyioAdapter = {
+    id: 'flyio',
+    verifyCredentials,
+    healthCheck,
+    execute,
+};

package/dist/providers/index.d.ts

@@ -0,0 +1,13 @@
+import type { SandboxBackend, SandboxProviderAdapter } from '../types.js';
+import { e2bAdapter } from './e2b.js';
+import { vercelAdapter } from './vercel.js';
+import { modalAdapter } from './modal.js';
+import { daytonaAdapter } from './daytona.js';
+import { browserbaseAdapter } from './browserbase.js';
+import { flyioAdapter } from './flyio.js';
+import { northflankAdapter } from './northflank.js';
+import { cloudflareAdapter } from './cloudflare.js';
+import { webcontainersAdapter } from './webcontainers.js';
+export declare const SANDBOX_PROVIDER_ADAPTERS: Record<Exclude<SandboxBackend, 'local' | 'docker' | 'custom'>, SandboxProviderAdapter>;
+export declare function getSandboxProviderAdapter(id: SandboxBackend): SandboxProviderAdapter | undefined;
+export { e2bAdapter, vercelAdapter, modalAdapter, daytonaAdapter, browserbaseAdapter, flyioAdapter, northflankAdapter, cloudflareAdapter, webcontainersAdapter, };

package/dist/providers/index.js

@@ -0,0 +1,26 @@
+import { e2bAdapter } from './e2b.js';
+import { vercelAdapter } from './vercel.js';
+import { modalAdapter } from './modal.js';
+import { daytonaAdapter } from './daytona.js';
+import { browserbaseAdapter } from './browserbase.js';
+import { flyioAdapter } from './flyio.js';
+import { northflankAdapter } from './northflank.js';
+import { cloudflareAdapter } from './cloudflare.js';
+import { webcontainersAdapter } from './webcontainers.js';
+export const SANDBOX_PROVIDER_ADAPTERS = {
+    e2b: e2bAdapter,
+    vercel: vercelAdapter,
+    modal: modalAdapter,
+    daytona: daytonaAdapter,
+    browserbase: browserbaseAdapter,
+    flyio: flyioAdapter,
+    northflank: northflankAdapter,
+    cloudflare: cloudflareAdapter,
+    webcontainers: webcontainersAdapter,
+};
+export function getSandboxProviderAdapter(id) {
+    if (id === 'local' || id === 'docker' || id === 'custom')
+        return undefined;
+    return SANDBOX_PROVIDER_ADAPTERS[id];
+}
+export { e2bAdapter, vercelAdapter, modalAdapter, daytonaAdapter, browserbaseAdapter, flyioAdapter, northflankAdapter, cloudflareAdapter, webcontainersAdapter, };

package/dist/providers/modal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Modal adapter — https://modal.com/docs/guide/sandboxes
+ *
+ * The Modal JavaScript SDK is client-based: create a ModalClient with the
+ * configured credentials, then create sandboxes through `modal.sandboxes`.
+ */
+import type { SandboxProviderAdapter } from '../types.js';
+export declare const modalAdapter: SandboxProviderAdapter;

package/dist/providers/modal.js

@@ -0,0 +1,96 @@
+/**
+ * Modal adapter — https://modal.com/docs/guide/sandboxes
+ *
+ * The Modal JavaScript SDK is client-based: create a ModalClient with the
+ * configured credentials, then create sandboxes through `modal.sandboxes`.
+ */
+import { DEFAULT_TIMEOUT_MS, failedResult, runScriptedExecution, safeCleanup, withTimeout, } from '../remote-exec.js';
+async function loadSdk() {
+    return (await import('modal'));
+}
+function requireFields(credentials) {
+    const tokenId = credentials.tokenId?.trim();
+    const tokenSecret = credentials.tokenSecret?.trim();
+    if (!tokenId || !tokenSecret)
+        throw new Error('Modal token ID and token secret are both required.');
+    return { tokenId, tokenSecret };
+}
+async function createClient(tokenId, tokenSecret) {
+    const { ModalClient } = await loadSdk();
+    return new ModalClient({ tokenId, tokenSecret });
+}
+async function verifyCredentials(credentials) {
+    const { tokenId, tokenSecret } = requireFields(credentials);
+    const modal = await createClient(tokenId, tokenSecret);
+    try {
+        await withTimeout(modal.getImageBuilderVersion(), 20_000, 'Modal credential check');
+    }
+    finally {
+        modal.close();
+    }
+}
+async function healthCheck(credentials) {
+    if (!credentials.tokenId?.trim() || !credentials.tokenSecret?.trim()) {
+        return {
+            status: 'missing-credentials',
+            backend: 'modal',
+            error: 'Modal token ID and secret are required.',
+        };
+    }
+    try {
+        await verifyCredentials(credentials);
+        return { status: 'ready', backend: 'modal' };
+    }
+    catch (err) {
+        return {
+            status: 'error',
+            backend: 'modal',
+            error: err instanceof Error ? err.message : 'Modal health check failed.',
+        };
+    }
+}
+async function execute(request, credentials) {
+    const startTime = Date.now();
+    let fields;
+    try {
+        fields = requireFields(credentials);
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Missing Modal credentials.', startTime);
+    }
+    const timeoutMs = request.timeout ?? DEFAULT_TIMEOUT_MS;
+    const modal = await createClient(fields.tokenId, fields.tokenSecret);
+    let sandbox;
+    try {
+        const app = await withTimeout(modal.apps.fromName('larkup-sandbox', { createIfMissing: true }), timeoutMs + 15_000, 'Modal app setup');
+        const image = modal.images.fromRegistry(request.language === 'python' ? 'python:3.13-slim' : 'node:22-bookworm-slim');
+        sandbox = await withTimeout(modal.sandboxes.create(app, image, {
+            timeoutMs: timeoutMs + 60_000,
+            idleTimeoutMs: timeoutMs + 30_000,
+        }), timeoutMs + 30_000, 'Modal sandbox create');
+        const activeSandbox = sandbox;
+        return await withTimeout(runScriptedExecution(async (script) => {
+            const process = await activeSandbox.exec(['bash', '-lc', script], { timeoutMs });
+            const [stdout, stderr, exitCode] = await Promise.all([
+                process.stdout.readText(),
+                process.stderr.readText(),
+                process.wait(),
+            ]);
+            return { stdout, stderr, exitCode };
+        }, request), timeoutMs + 15_000, 'Modal execution');
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Modal execution failed.', startTime);
+    }
+    finally {
+        if (sandbox)
+            await safeCleanup(() => sandbox.terminate());
+        modal.close();
+    }
+}
+export const modalAdapter = {
+    id: 'modal',
+    verifyCredentials,
+    healthCheck,
+    execute,
+};

package/dist/providers/northflank.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Northflank adapter — https://northflank.com/docs/v1/application/sandboxes/sandboxes-on-northflank
+ *
+ * Northflank has no dedicated "Sandbox" primitive — a sandbox here is a
+ * short-lived service deployment (`sleep infinity` container) we exec
+ * commands into over a session, then tear down.
+ */
+import type { SandboxProviderAdapter } from '../types.js';
+export declare const northflankAdapter: SandboxProviderAdapter;

package/dist/providers/northflank.js

@@ -0,0 +1,122 @@
+/**
+ * Northflank adapter — https://northflank.com/docs/v1/application/sandboxes/sandboxes-on-northflank
+ *
+ * Northflank has no dedicated "Sandbox" primitive — a sandbox here is a
+ * short-lived service deployment (`sleep infinity` container) we exec
+ * commands into over a session, then tear down.
+ */
+import { randomUUID } from 'node:crypto';
+import { DEFAULT_TIMEOUT_MS, failedResult, runScriptedExecution, safeCleanup, withTimeout, } from '../remote-exec.js';
+async function loadSdk() {
+    return (await import('@northflank/js-client'));
+}
+function requireFields(credentials) {
+    const token = credentials.token?.trim();
+    const projectId = credentials.projectId?.trim();
+    if (!token || !projectId)
+        throw new Error('Northflank API token and project ID are both required.');
+    return { token, projectId };
+}
+async function buildClient(token) {
+    const { ApiClient, ApiClientInMemoryContextProvider } = await loadSdk();
+    const ctx = new ApiClientInMemoryContextProvider();
+    await ctx.addContext({ name: 'larkup', token });
+    return new ApiClient(ctx, { throwErrorOnHttpErrorCode: true });
+}
+async function verifyCredentials(credentials) {
+    const { token, projectId } = requireFields(credentials);
+    const client = await buildClient(token);
+    await withTimeout(client.get.project({ parameters: { projectId } }), 20_000, 'Northflank credential check');
+}
+async function healthCheck(credentials) {
+    if (!credentials.token?.trim() || !credentials.projectId?.trim()) {
+        return {
+            status: 'missing-credentials',
+            backend: 'northflank',
+            error: 'Northflank API token and project ID are required.',
+        };
+    }
+    try {
+        await verifyCredentials(credentials);
+        return { status: 'ready', backend: 'northflank' };
+    }
+    catch (err) {
+        return {
+            status: 'error',
+            backend: 'northflank',
+            error: err instanceof Error ? err.message : 'Northflank health check failed.',
+        };
+    }
+}
+async function waitForServiceReady(client, projectId, serviceId, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const service = await client.get.service({ parameters: { projectId, serviceId } });
+        const status = service.data?.status;
+        if (status === 'COMPLETED' || status === undefined)
+            return; // running, or status field not modeled — proceed
+        if (status === 'FAILED')
+            throw new Error('Northflank sandbox service failed to start.');
+        await new Promise((resolve) => setTimeout(resolve, 1500));
+    }
+    throw new Error('Timed out waiting for the Northflank sandbox service to become ready.');
+}
+async function execute(request, credentials) {
+    const startTime = Date.now();
+    let fields;
+    try {
+        fields = requireFields(credentials);
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Missing Northflank credentials.', startTime);
+    }
+    const timeoutMs = request.timeout ?? DEFAULT_TIMEOUT_MS;
+    const serviceId = `larkup-${randomUUID().slice(0, 8)}`;
+    const { projectId } = fields;
+    let client;
+    try {
+        client = await buildClient(fields.token);
+        await withTimeout(client.create.service.deployment({
+            parameters: { projectId },
+            data: {
+                name: serviceId,
+                billing: { deploymentPlan: 'nf-compute-200' },
+                deployment: {
+                    instances: 1,
+                    docker: { configType: 'customCommand', customCommand: 'sleep infinity' },
+                    external: { imagePath: 'ubuntu:22.04' },
+                    storage: { ephemeralStorage: { storageSize: 2048 } },
+                },
+            },
+        }), 30_000, 'Northflank service create');
+        await waitForServiceReady(client, projectId, serviceId, 60_000);
+        return await withTimeout(runScriptedExecution(async (script) => {
+            const activeClient = client;
+            const handle = await activeClient.exec.execServiceSession({ projectId, serviceId }, { shell: 'bash -c', command: script });
+            const stdoutChunks = [];
+            const stderrChunks = [];
+            handle.stdOut.on('data', (chunk) => stdoutChunks.push(chunk.toString()));
+            handle.stdErr.on('data', (chunk) => stderrChunks.push(chunk.toString()));
+            const result = await handle.waitForCommandResult();
+            return {
+                stdout: stdoutChunks.join(''),
+                stderr: stderrChunks.join(''),
+                exitCode: result.exitCode ?? 0,
+            };
+        }, request), timeoutMs + 15_000, 'Northflank execution');
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Northflank execution failed.', startTime);
+    }
+    finally {
+        if (client) {
+            await safeCleanup(() => client.delete.service({ parameters: { projectId, serviceId } }));
+        }
+    }
+}
+export const northflankAdapter = {
+    id: 'northflank',
+    verifyCredentials,
+    healthCheck,
+    execute,
+};

package/dist/providers/vercel.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Vercel Sandbox adapter — https://vercel.com/docs/sandbox
+ *
+ * Uses the access-token auth path (token + team + project) rather than the
+ * OIDC path, since credentials here come from the Settings UI, not a
+ * Vercel-managed environment.
+ */
+import type { SandboxProviderAdapter } from '../types.js';
+export declare const vercelAdapter: SandboxProviderAdapter;

package/dist/providers/vercel.js

@@ -0,0 +1,79 @@
+/**
+ * Vercel Sandbox adapter — https://vercel.com/docs/sandbox
+ *
+ * Uses the access-token auth path (token + team + project) rather than the
+ * OIDC path, since credentials here come from the Settings UI, not a
+ * Vercel-managed environment.
+ */
+import { DEFAULT_TIMEOUT_MS, failedResult, runScriptedExecution, safeCleanup, withTimeout, } from '../remote-exec.js';
+async function loadSdk() {
+    return (await import('@vercel/sandbox'));
+}
+function requireFields(credentials) {
+    const token = credentials.token?.trim();
+    const teamId = credentials.teamId?.trim();
+    const projectId = credentials.projectId?.trim();
+    if (!token || !teamId || !projectId) {
+        throw new Error('Vercel access token, team ID, and project ID are all required.');
+    }
+    return { token, teamId, projectId };
+}
+async function verifyCredentials(credentials) {
+    const { token, teamId, projectId } = requireFields(credentials);
+    const { Sandbox } = await loadSdk();
+    await (await Sandbox.list({ token, teamId, projectId })).toArray();
+}
+async function healthCheck(credentials) {
+    try {
+        await verifyCredentials(credentials);
+        return { status: 'ready', backend: 'vercel' };
+    }
+    catch (err) {
+        const missing = !credentials.token || !credentials.teamId || !credentials.projectId;
+        return {
+            status: missing ? 'missing-credentials' : 'error',
+            backend: 'vercel',
+            error: err instanceof Error ? err.message : 'Vercel Sandbox health check failed.',
+        };
+    }
+}
+async function execute(request, credentials) {
+    const startTime = Date.now();
+    let fields;
+    try {
+        fields = requireFields(credentials);
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Missing Vercel credentials.', startTime);
+    }
+    const timeoutMs = request.timeout ?? DEFAULT_TIMEOUT_MS;
+    let sandbox;
+    try {
+        const { Sandbox } = await loadSdk();
+        const snapshotId = credentials.snapshotId?.trim();
+        sandbox = await withTimeout(Sandbox.create({
+            ...fields,
+            timeout: timeoutMs + 60_000,
+            ...(snapshotId ? { source: { type: 'snapshot', snapshotId } } : {}),
+        }), timeoutMs + 30_000, 'Vercel sandbox create');
+        const activeSandbox = sandbox;
+        return await withTimeout(runScriptedExecution(async (script) => {
+            const result = await activeSandbox.runCommand('bash', ['-c', script]);
+            const [stdout, stderr] = await Promise.all([result.stdout(), result.stderr()]);
+            return { stdout, stderr, exitCode: result.exitCode };
+        }, request), timeoutMs + 15_000, 'Vercel Sandbox execution');
+    }
+    catch (err) {
+        return failedResult(err instanceof Error ? err.message : 'Vercel Sandbox execution failed.', startTime);
+    }
+    finally {
+        if (sandbox)
+            await safeCleanup(() => sandbox.stop());
+    }
+}
+export const vercelAdapter = {
+    id: 'vercel',
+    verifyCredentials,
+    healthCheck,
+    execute,
+};

package/dist/providers/webcontainers.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WebContainers adapter — https://webcontainers.io/
+ *
+ * `@webcontainer/api` boots a WebAssembly Node.js runtime that only runs
+ * inside a cross-origin-isolated browser tab (it needs SharedArrayBuffer) —
+ * there is no Node.js/server-side entry point at all, so `execute()` fails
+ * fast. The optional "license key" field is a StackBlitz-issued commercial
+ * key consumed by `WebContainer.configureAPIKey()` in the browser; there is
+ * no server-reachable endpoint to validate it against, so `verifyCredentials`
+ * says so honestly rather than reporting a false positive.
+ */
+import type { SandboxProviderAdapter } from '../types.js';
+export declare const webcontainersAdapter: SandboxProviderAdapter;

package/dist/providers/webcontainers.js

@@ -0,0 +1,28 @@
+/**
+ * WebContainers adapter — https://webcontainers.io/
+ *
+ * `@webcontainer/api` boots a WebAssembly Node.js runtime that only runs
+ * inside a cross-origin-isolated browser tab (it needs SharedArrayBuffer) —
+ * there is no Node.js/server-side entry point at all, so `execute()` fails
+ * fast. The optional "license key" field is a StackBlitz-issued commercial
+ * key consumed by `WebContainer.configureAPIKey()` in the browser; there is
+ * no server-reachable endpoint to validate it against, so `verifyCredentials`
+ * says so honestly rather than reporting a false positive.
+ */
+import { failedResult } from '../remote-exec.js';
+import { SANDBOX_PROVIDERS } from '../registry.js';
+async function verifyCredentials(_credentials) {
+    throw new Error('WebContainers has no server-side credential check — the license key is only validated by StackBlitz when WebContainer.boot() runs in the browser.');
+}
+async function healthCheck(_credentials) {
+    return { status: 'unsupported', backend: 'webcontainers', error: SANDBOX_PROVIDERS.webcontainers.executionCaveat };
+}
+async function execute(_request, _credentials) {
+    return failedResult(SANDBOX_PROVIDERS.webcontainers.executionCaveat, Date.now());
+}
+export const webcontainersAdapter = {
+    id: 'webcontainers',
+    verifyCredentials,
+    healthCheck,
+    execute,
+};

package/dist/registry.d.ts

@@ -0,0 +1,20 @@
+import type { SandboxBackend, SandboxProviderDescriptor } from './types.js';
+/**
+ * Declarative registry of the remote sandbox providers @larkup/sandbox can
+ * execute code on, besides the always-available local Docker backend.
+ *
+ * This single object powers two consumers:
+ *  1. The Settings UI — renders `fields` dynamically so each provider asks
+ *     for exactly the credentials it needs, the same way vector store and
+ *     embedding provider fields are rendered from their own registries.
+ *  2. `SandboxManager` / the provider adapters — read `id` to route
+ *     execution and `executionSupport` to fail fast with a clear message
+ *     instead of pretending every provider can run arbitrary code.
+ *
+ * Adding a new provider = one entry here + one adapter in `./providers`.
+ */
+export declare const SANDBOX_PROVIDERS: Record<Exclude<SandboxBackend, 'local' | 'docker' | 'custom'>, SandboxProviderDescriptor>;
+export declare const SANDBOX_PROVIDER_LIST: SandboxProviderDescriptor[];
+export declare function getSandboxProvider(id: SandboxBackend): SandboxProviderDescriptor | undefined;
+/** Validates credentials against a provider's registered fields, mirroring validateStoreConfig. */
+export declare function validateSandboxCredentials(provider: SandboxProviderDescriptor, values: Record<string, string>): Record<string, string>;