@mastra/apple-container 0.3.0 → 0.4.0

package/dist/index.js

@@ -1,944 +1,861 @@
-import { spawn } from 'child_process';
-import { createHash } from 'crypto';
-import { StringDecoder } from 'string_decoder';
-import { MastraSandbox, SandboxExecutionError, ProcessHandle } from '@mastra/core/workspace';
-
-// src/sandbox/index.ts
-var DEFAULT_COMMAND_TIMEOUT_MS = 3e5;
-var DEFAULT_IMAGE = "node:22-slim";
-var DEFAULT_COMMAND = ["sleep", "infinity"];
-var DEFAULT_WORKING_DIR = "/workspace";
-var APPLE_CONTAINER_CLI_GRACE_TIMEOUT_MS = 1e4;
-var APPLE_CONTAINER_READY_TIMEOUT_MS = 1e4;
-var APPLE_CONTAINER_READY_EXEC_TIMEOUT_MS = 5e3;
-var APPLE_CONTAINER_TIMEOUT_EXIT_CODE = 124;
-var APPLE_CONTAINER_TIMEOUT_MARKER = "__MASTRA_APPLE_CONTAINER_TIMEOUT__";
+import { spawn } from "child_process";
+import { createHash } from "crypto";
+import { StringDecoder } from "string_decoder";
+import { MastraSandbox, ProcessHandle, SandboxExecutionError, UnsupportedStdinCloseError } from "@mastra/core/workspace";
+//#region src/sandbox/index.ts
+/**
+* Apple container CLI sandbox provider.
+*
+* This provider maps Mastra's WorkspaceSandbox command execution contract to
+* Apple's `container` CLI. It starts a long-lived OCI Linux container and uses
+* `container exec` for commands.
+*
+* @see https://github.com/apple/container
+*/
+const DEFAULT_COMMAND_TIMEOUT_MS = 3e5;
+const DEFAULT_IMAGE = "node:22-slim";
+const DEFAULT_COMMAND = ["sleep", "infinity"];
+const DEFAULT_WORKING_DIR = "/workspace";
+const APPLE_CONTAINER_CLI_GRACE_TIMEOUT_MS = 1e4;
+const APPLE_CONTAINER_READY_TIMEOUT_MS = 1e4;
+const APPLE_CONTAINER_READY_EXEC_TIMEOUT_MS = 5e3;
+const APPLE_CONTAINER_TIMEOUT_EXIT_CODE = 124;
+const APPLE_CONTAINER_TIMEOUT_MARKER = "__MASTRA_APPLE_CONTAINER_TIMEOUT__";
 var DefaultAppleContainerCommandRunner = class {
-  constructor(binary = "container") {
-    this.binary = binary;
-  }
-  binary;
-  run(args, options = {}) {
-    return runAppleContainerCli(this.binary, args, options);
-  }
+	binary;
+	constructor(binary = "container") {
+		this.binary = binary;
+	}
+	run(args, options = {}) {
+		return runAppleContainerCli(this.binary, args, options);
+	}
 };
-var AppleContainerSandbox = class _AppleContainerSandbox extends MastraSandbox {
-  id;
-  name = "AppleContainerSandbox";
-  provider = "apple-container";
-  status = "pending";
-  _containerName;
-  _configuredName;
-  _image;
-  _command;
-  _env;
-  _volumes;
-  _mounts;
-  _network;
-  _publishedPorts;
-  _publishedSockets;
-  _cpus;
-  _memory;
-  _platform;
-  _arch;
-  _os;
-  _rosetta;
-  _readonlyRootfs;
-  _ssh;
-  _init;
-  _virtualization;
-  _capAdd;
-  _capDrop;
-  _tmpfs;
-  _dns;
-  _dnsSearch;
-  _noDns;
-  _userLabels;
-  _labels;
-  _configHash;
-  _workingDir;
-  _timeout;
-  _deleteOnDestroy;
-  _runner;
-  _instructionsOverride;
-  _createdAt;
-  _constructorOptions;
-  _containerId;
-  constructor(options = {}) {
-    super({
-      ...options,
-      name: "AppleContainerSandbox"
-    });
-    this.id = options.id ?? generateId();
-    this._configuredName = options.name;
-    this._containerName = sanitizeContainerName(options.name ?? this.id);
-    this._image = options.image ?? DEFAULT_IMAGE;
-    this._command = options.command ?? DEFAULT_COMMAND;
-    this._env = options.env ?? {};
-    this._volumes = options.volumes ?? {};
-    this._mounts = options.mounts ?? [];
-    this._network = options.network;
-    this._publishedPorts = options.publishedPorts ?? [];
-    this._publishedSockets = options.publishedSockets ?? [];
-    this._cpus = options.cpus;
-    this._memory = options.memory;
-    this._platform = options.platform;
-    this._arch = options.arch;
-    this._os = options.os;
-    this._rosetta = options.rosetta ?? false;
-    this._readonlyRootfs = options.readonlyRootfs ?? false;
-    this._ssh = options.ssh ?? false;
-    this._init = options.init ?? true;
-    this._virtualization = options.virtualization ?? false;
-    this._capAdd = options.capAdd ?? [];
-    this._capDrop = options.capDrop ?? [];
-    this._tmpfs = options.tmpfs ?? [];
-    validateTmpfsPaths(this._tmpfs);
-    this._dns = options.dns ?? [];
-    this._dnsSearch = options.dnsSearch ?? [];
-    this._noDns = options.noDns ?? false;
-    this._workingDir = options.workingDir ?? DEFAULT_WORKING_DIR;
-    this._userLabels = options.labels ?? {};
-    this._configHash = hashConfig(this._runtimeConfigForHash());
-    this._labels = {
-      ...this._userLabels,
-      "mastra.sandbox": "true",
-      "mastra.sandbox.id": this.id,
-      "mastra.sandbox.config-hash": this._configHash
-    };
-    this._timeout = options.timeout ?? DEFAULT_COMMAND_TIMEOUT_MS;
-    this._deleteOnDestroy = options.deleteOnDestroy ?? true;
-    this._runner = options.runner ?? new DefaultAppleContainerCommandRunner(options.containerBinary);
-    this._instructionsOverride = options.instructions;
-    this._createdAt = /* @__PURE__ */ new Date();
-    this._constructorOptions = { ...options };
-  }
-  /**
-   * Construct a sibling `AppleContainerSandbox` that inherits this sandbox's
-   * configuration (image, resources, network, security options, labels) with
-   * per-instance overrides.
-   *
-   * Performs no I/O — the sandbox clone provisions (or reconnects to an
-   * existing container labelled with the same logical `id`) on its own
-   * `start()`. Use it when one configured sandbox acts as the template for a
-   * fleet of independent sandboxes (e.g. one per project).
-   *
-   * `options.idleTimeoutMinutes` is ignored (Apple containers have no
-   * provider-side idle teardown; `timeout` here is a command timeout), and
-   * `options.sandboxId` is ignored because reconnection is by logical `id`.
-   */
-  clone(options = {}) {
-    const { id: _id, name: _name, ...base } = this._constructorOptions;
-    return new _AppleContainerSandbox({
-      ...base,
-      ...options.id !== void 0 && { id: options.id },
-      ...options.env !== void 0 && { env: options.env }
-    });
-  }
-  get containerId() {
-    return this._containerId ?? this._containerName;
-  }
-  async start() {
-    await this._runPlainLifecycle("starting", "running", () => this._startContainer());
-  }
-  async stop() {
-    await this._runPlainLifecycle("stopping", "stopped", () => this._stopContainer());
-  }
-  async destroy() {
-    await this._runPlainLifecycle("destroying", "destroyed", () => this._destroyContainer());
-  }
-  async _startContainer() {
-    const existing = await this._inspectContainer();
-    if (existing) {
-      this._assertMastraOwned(existing);
-      this._assertCompatibleConfig(existing);
-      this._containerId = existing.configuration?.id ?? this._containerName;
-      if (!isRunning(existing)) {
-        const result2 = await this._runCli(["start", this.containerId]);
-        this._assertSuccess(result2, `start Apple container ${this.containerId}`);
-        await this._waitUntilContainerReady(`start Apple container ${this.containerId}`);
-      }
-      return;
-    }
-    const env = envFlags(this._env);
-    const result = await this._runCli(this._buildRunArgs(env.args), { env: env.env });
-    this._assertSuccess(result, `create Apple container ${this._containerName}`);
-    this._containerId = this._containerName;
-    try {
-      await this._waitUntilContainerReady(`create Apple container ${this._containerName}`);
-    } catch (error) {
-      if (this._deleteOnDestroy) {
-        await this._deleteContainerIgnoringMissing();
-      }
-      throw error;
-    }
-  }
-  async _stopContainer() {
-    const existing = await this._inspectContainer();
-    if (!existing) {
-      return;
-    }
-    this._assertMastraOwned(existing);
-    if (!isRunning(existing)) {
-      return;
-    }
-    const result = await this._runCli(["stop", this.containerId]);
-    if (!result.success && !isMissingContainerMessage(result.stderr)) {
-      this._assertSuccess(result, `stop Apple container ${this.containerId}`);
-    }
-  }
-  async _destroyContainer() {
-    if (!this._deleteOnDestroy) {
-      await this._stopContainer();
-      return;
-    }
-    const existing = await this._inspectContainer();
-    if (!existing) {
-      return;
-    }
-    this._assertMastraOwned(existing);
-    await this._deleteContainerIgnoringMissing();
-  }
-  async executeCommand(command, args = [], options = {}) {
-    await this.ensureRunning();
-    const commandTimeout = options.timeout ?? this._timeout;
-    const hasCommandTimeout = Number.isFinite(commandTimeout) && commandTimeout > 0;
-    const fullCommand = buildShellCommand(command, args);
-    const shellCommand = hasCommandTimeout ? buildTimeoutShellCommand(fullCommand, commandTimeout) : fullCommand;
-    const env = envFlags({ ...this._env, ...options.env });
-    const cliArgs = [
-      "exec",
-      ...env.args,
-      "--workdir",
-      options.cwd ?? this._workingDir,
-      this.containerId,
-      "sh",
-      "-lc",
-      shellCommand
-    ];
-    const result = await this._runner.run(cliArgs, {
-      timeout: hasCommandTimeout ? commandTimeout + APPLE_CONTAINER_CLI_GRACE_TIMEOUT_MS : void 0,
-      env: env.env,
-      abortSignal: options.abortSignal,
-      onStdout: options.onStdout,
-      onStderr: options.onStderr,
-      maxRetainedBytes: options.maxRetainedBytes
-    });
-    const timedOut = result.exitCode === APPLE_CONTAINER_TIMEOUT_EXIT_CODE && result.stderr.includes(APPLE_CONTAINER_TIMEOUT_MARKER);
-    const stderr = timedOut ? stripTimeoutMarker(result.stderr) : result.stderr;
-    return {
-      ...result,
-      stderr,
-      ...timedOut && { timedOut: true, killed: true },
-      command: fullCommand,
-      args
-    };
-  }
-  async getInfo() {
-    const inspect = this._containerId ? await this._inspectContainer() : void 0;
-    const resources = inspect?.configuration?.resources;
-    return {
-      id: this.id,
-      name: this.name,
-      provider: this.provider,
-      status: this.status,
-      createdAt: this._createdAt,
-      resources: resources ? {
-        cpuCores: resources.cpus,
-        memoryMB: resources.memoryInBytes ? Math.round(resources.memoryInBytes / 1024 / 1024) : void 0
-      } : void 0,
-      metadata: {
-        ...this._serializableConfig()
-      }
-    };
-  }
-  getInstructions(opts) {
-    const defaultInstructions = this._buildDefaultInstructions();
-    if (typeof this._instructionsOverride === "string") {
-      return this._instructionsOverride;
-    }
-    if (typeof this._instructionsOverride === "function") {
-      return this._instructionsOverride({ defaultInstructions, requestContext: opts?.requestContext });
-    }
-    return defaultInstructions;
-  }
-  _buildDefaultInstructions() {
-    const parts = [
-      `Apple container sandbox: commands run inside a local OCI Linux container from image ${this._image}.`,
-      `Working directory: ${this._workingDir}.`
-    ];
-    const volumeCount = Object.keys(this._volumes).length + this._mounts.length;
-    if (volumeCount > 0) {
-      parts.push(`${volumeCount} host mount(s) are configured.`);
-    }
-    if (this._timeout > 0) {
-      parts.push(`Default command timeout: ${Math.ceil(this._timeout / 1e3)}s.`);
-    }
-    return parts.join(" ");
-  }
-  async _runPlainLifecycle(activeStatus, completeStatus, operation) {
-    const managedByBaseWrapper = this.status === activeStatus;
-    if (!managedByBaseWrapper) {
-      this.status = activeStatus;
-    }
-    try {
-      await operation();
-      if (!managedByBaseWrapper) {
-        this.status = completeStatus;
-      }
-    } catch (error) {
-      if (!managedByBaseWrapper) {
-        this.status = "error";
-      }
-      throw error;
-    }
-  }
-  async _inspectContainer() {
-    const result = await this._runCli(["inspect", this.containerId]);
-    if (!result.success) {
-      if (isMissingContainerMessage(result.stderr)) return void 0;
-      this._assertSuccess(result, `inspect Apple container ${this.containerId}`);
-      return void 0;
-    }
-    try {
-      const parsed = JSON.parse(result.stdout);
-      return Array.isArray(parsed) ? parsed[0] : parsed;
-    } catch (error) {
-      throw new SandboxExecutionError(
-        `Failed to parse Apple container inspect output for ${this.containerId}: ${error instanceof Error ? error.message : String(error)}`,
-        1,
-        result.stdout,
-        result.stderr
-      );
-    }
-  }
-  _buildRunArgs(envArgs) {
-    const args = ["run", "-d", "--name", this._containerName, "--workdir", this._workingDir];
-    args.push(...envArgs);
-    for (const [hostPath, containerPath] of Object.entries(this._volumes)) {
-      args.push("--volume", `${hostPath}:${containerPath}`);
-    }
-    for (const mount of this._mounts) args.push("--mount", mount);
-    for (const [key, value] of Object.entries(this._labels)) args.push("--label", `${key}=${value}`);
-    for (const port of this._publishedPorts) args.push("--publish", port);
-    for (const socket of this._publishedSockets) args.push("--publish-socket", socket);
-    for (const cap of this._capAdd) args.push("--cap-add", cap);
-    for (const cap of this._capDrop) args.push("--cap-drop", cap);
-    for (const tmpfs of this._tmpfs) args.push("--tmpfs", tmpfs);
-    for (const dns of this._dns) args.push("--dns", dns);
-    for (const domain of this._dnsSearch) args.push("--dns-search", domain);
-    if (this._network) args.push("--network", this._network);
-    if (this._cpus !== void 0) args.push("--cpus", String(this._cpus));
-    if (this._memory !== void 0) args.push("--memory", this._memory);
-    if (this._platform) args.push("--platform", this._platform);
-    if (this._arch) args.push("--arch", this._arch);
-    if (this._os) args.push("--os", this._os);
-    if (this._rosetta) args.push("--rosetta");
-    if (this._readonlyRootfs) args.push("--read-only");
-    if (this._ssh) args.push("--ssh");
-    if (this._init) args.push("--init");
-    if (this._virtualization) args.push("--virtualization");
-    if (this._noDns) args.push("--no-dns");
-    args.push(this._image, ...this._command);
-    return args;
-  }
-  async _waitUntilContainerReady(action) {
-    const deadline = Date.now() + APPLE_CONTAINER_READY_TIMEOUT_MS;
-    let lastResult;
-    while (Date.now() < deadline) {
-      const inspect = await this._inspectContainer();
-      if (!inspect) {
-        throw new SandboxExecutionError(
-          `${action} failed because Apple container ${this.containerId} disappeared`,
-          1,
-          "",
-          ""
-        );
-      }
-      this._assertMastraOwned(inspect);
-      this._assertCompatibleConfig(inspect);
-      if (!isRunning(inspect)) {
-        const state = getContainerState(inspect) ?? "not running";
-        throw new SandboxExecutionError(
-          `${action} failed because Apple container ${this.containerId} is ${state}`,
-          1,
-          "",
-          ""
-        );
-      }
-      lastResult = await this._runCli(["exec", this.containerId, "sh", "-lc", "true"], {
-        timeout: APPLE_CONTAINER_READY_EXEC_TIMEOUT_MS
-      });
-      if (lastResult.success) return;
-      if (!isMissingContainerMessage(lastResult.stderr) && !/not running|not yet running/i.test(lastResult.stderr)) {
-        break;
-      }
-      await delay(100);
-    }
-    throw new SandboxExecutionError(
-      `${action} failed because Apple container ${this.containerId} did not become ready for exec`,
-      lastResult?.exitCode ?? 1,
-      lastResult?.stdout ?? "",
-      lastResult?.stderr ?? ""
-    );
-  }
-  async _deleteContainerIgnoringMissing() {
-    const result = await this._runCli(["delete", "--force", this.containerId]);
-    if (!result.success && !isMissingContainerMessage(result.stderr)) {
-      this._assertSuccess(result, `delete Apple container ${this.containerId}`);
-    }
-  }
-  _runtimeConfigForHash() {
-    return {
-      image: this._image,
-      command: this._command,
-      env: this._env,
-      volumes: this._volumes,
-      mounts: this._mounts,
-      network: this._network,
-      publishedPorts: this._publishedPorts,
-      publishedSockets: this._publishedSockets,
-      cpus: this._cpus,
-      memory: this._memory,
-      platform: this._platform,
-      arch: this._arch,
-      os: this._os,
-      rosetta: this._rosetta,
-      readonlyRootfs: this._readonlyRootfs,
-      ssh: this._ssh,
-      init: this._init,
-      virtualization: this._virtualization,
-      capAdd: this._capAdd,
-      capDrop: this._capDrop,
-      tmpfs: this._tmpfs,
-      dns: this._dns,
-      dnsSearch: this._dnsSearch,
-      noDns: this._noDns,
-      labels: this._userLabels,
-      workingDir: this._workingDir
-    };
-  }
-  _serializableConfig() {
-    return compactConfig({
-      id: this.id,
-      name: this._configuredName,
-      image: this._image,
-      command: this._command,
-      env: this._env,
-      volumes: this._volumes,
-      mounts: this._mounts,
-      network: this._network,
-      publishedPorts: this._publishedPorts,
-      publishedSockets: this._publishedSockets,
-      cpus: this._cpus,
-      memory: this._memory,
-      platform: this._platform,
-      arch: this._arch,
-      os: this._os,
-      rosetta: this._rosetta,
-      readonlyRootfs: this._readonlyRootfs,
-      ssh: this._ssh,
-      init: this._init,
-      virtualization: this._virtualization,
-      capAdd: this._capAdd,
-      capDrop: this._capDrop,
-      tmpfs: this._tmpfs,
-      dns: this._dns,
-      dnsSearch: this._dnsSearch,
-      noDns: this._noDns,
-      labels: this._userLabels,
-      workingDir: this._workingDir,
-      timeout: this._timeout,
-      deleteOnDestroy: this._deleteOnDestroy
-    });
-  }
-  _assertSuccess(result, action) {
-    if (result.success) return;
-    throw new SandboxExecutionError(
-      `${action} failed with exit code ${result.exitCode}: ${result.stderr}`,
-      result.exitCode,
-      result.stdout,
-      result.stderr
-    );
-  }
-  _assertMastraOwned(inspect) {
-    if (isMastraOwned(inspect, this.id)) return;
-    throw new SandboxExecutionError(
-      `Refusing to manage Apple container ${this.containerId} because it is not labeled as Mastra sandbox ${this.id}`,
-      1,
-      "",
-      ""
-    );
-  }
-  _assertCompatibleConfig(inspect) {
-    const existingHash = inspect.configuration?.labels?.["mastra.sandbox.config-hash"];
-    if (!existingHash || existingHash === this._configHash) return;
-    throw new SandboxExecutionError(
-      `Refusing to manage Apple container ${this.containerId} because its immutable configuration does not match sandbox ${this.id}`,
-      1,
-      "",
-      ""
-    );
-  }
-  _runCli(args, options = {}) {
-    return this._runner.run(args, {
-      timeout: this._timeout,
-      ...options
-    });
-  }
+var AppleContainerSandbox = class AppleContainerSandbox extends MastraSandbox {
+	id;
+	name = "AppleContainerSandbox";
+	provider = "apple-container";
+	status = "pending";
+	_containerName;
+	_configuredName;
+	_image;
+	_command;
+	_env;
+	_volumes;
+	_mounts;
+	_network;
+	_publishedPorts;
+	_publishedSockets;
+	_cpus;
+	_memory;
+	_platform;
+	_arch;
+	_os;
+	_rosetta;
+	_readonlyRootfs;
+	_ssh;
+	_init;
+	_virtualization;
+	_capAdd;
+	_capDrop;
+	_tmpfs;
+	_dns;
+	_dnsSearch;
+	_noDns;
+	_userLabels;
+	_labels;
+	_configHash;
+	_workingDir;
+	_timeout;
+	_deleteOnDestroy;
+	_runner;
+	_instructionsOverride;
+	_createdAt;
+	_constructorOptions;
+	_containerId;
+	constructor(options = {}) {
+		super({
+			...options,
+			name: "AppleContainerSandbox"
+		});
+		this.id = options.id ?? generateId();
+		this._configuredName = options.name;
+		this._containerName = sanitizeContainerName(options.name ?? this.id);
+		this._image = options.image ?? DEFAULT_IMAGE;
+		this._command = options.command ?? DEFAULT_COMMAND;
+		this._env = options.env ?? {};
+		this._volumes = options.volumes ?? {};
+		this._mounts = options.mounts ?? [];
+		this._network = options.network;
+		this._publishedPorts = options.publishedPorts ?? [];
+		this._publishedSockets = options.publishedSockets ?? [];
+		this._cpus = options.cpus;
+		this._memory = options.memory;
+		this._platform = options.platform;
+		this._arch = options.arch;
+		this._os = options.os;
+		this._rosetta = options.rosetta ?? false;
+		this._readonlyRootfs = options.readonlyRootfs ?? false;
+		this._ssh = options.ssh ?? false;
+		this._init = options.init ?? true;
+		this._virtualization = options.virtualization ?? false;
+		this._capAdd = options.capAdd ?? [];
+		this._capDrop = options.capDrop ?? [];
+		this._tmpfs = options.tmpfs ?? [];
+		validateTmpfsPaths(this._tmpfs);
+		this._dns = options.dns ?? [];
+		this._dnsSearch = options.dnsSearch ?? [];
+		this._noDns = options.noDns ?? false;
+		this._workingDir = options.workingDir ?? DEFAULT_WORKING_DIR;
+		this._userLabels = options.labels ?? {};
+		this._configHash = hashConfig(this._runtimeConfigForHash());
+		this._labels = {
+			...this._userLabels,
+			"mastra.sandbox": "true",
+			"mastra.sandbox.id": this.id,
+			"mastra.sandbox.config-hash": this._configHash
+		};
+		this._timeout = options.timeout ?? DEFAULT_COMMAND_TIMEOUT_MS;
+		this._deleteOnDestroy = options.deleteOnDestroy ?? true;
+		this._runner = options.runner ?? new DefaultAppleContainerCommandRunner(options.containerBinary);
+		this._instructionsOverride = options.instructions;
+		this._createdAt = /* @__PURE__ */ new Date();
+		this._constructorOptions = { ...options };
+	}
+	/**
+	* Construct a sibling `AppleContainerSandbox` that inherits this sandbox's
+	* configuration (image, resources, network, security options, labels) with
+	* per-instance overrides.
+	*
+	* Performs no I/O — the sandbox clone provisions (or reconnects to an
+	* existing container labelled with the same logical `id`) on its own
+	* `start()`. Use it when one configured sandbox acts as the template for a
+	* fleet of independent sandboxes (e.g. one per project).
+	*
+	* `options.idleTimeoutMinutes` is ignored (Apple containers have no
+	* provider-side idle teardown; `timeout` here is a command timeout), and
+	* `options.sandboxId` is ignored because reconnection is by logical `id`.
+	*/
+	clone(options = {}) {
+		const { id: _id, name: _name, ...base } = this._constructorOptions;
+		return new AppleContainerSandbox({
+			...base,
+			...options.id !== void 0 && { id: options.id },
+			...options.env !== void 0 && { env: options.env }
+		});
+	}
+	get containerId() {
+		return this._containerId ?? this._containerName;
+	}
+	async start() {
+		await this._runPlainLifecycle("starting", "running", () => this._startContainer());
+	}
+	async stop() {
+		await this._runPlainLifecycle("stopping", "stopped", () => this._stopContainer());
+	}
+	async destroy() {
+		await this._runPlainLifecycle("destroying", "destroyed", () => this._destroyContainer());
+	}
+	async _startContainer() {
+		const existing = await this._inspectContainer();
+		if (existing) {
+			this._assertMastraOwned(existing);
+			this._assertCompatibleConfig(existing);
+			this._containerId = existing.configuration?.id ?? this._containerName;
+			if (!isRunning(existing)) {
+				const result = await this._runCli(["start", this.containerId]);
+				this._assertSuccess(result, `start Apple container ${this.containerId}`);
+				await this._waitUntilContainerReady(`start Apple container ${this.containerId}`);
+			}
+			return;
+		}
+		const env = envFlags(this._env);
+		const result = await this._runCli(this._buildRunArgs(env.args), { env: env.env });
+		this._assertSuccess(result, `create Apple container ${this._containerName}`);
+		this._containerId = this._containerName;
+		try {
+			await this._waitUntilContainerReady(`create Apple container ${this._containerName}`);
+		} catch (error) {
+			if (this._deleteOnDestroy) await this._deleteContainerIgnoringMissing();
+			throw error;
+		}
+	}
+	async _stopContainer() {
+		const existing = await this._inspectContainer();
+		if (!existing) return;
+		this._assertMastraOwned(existing);
+		if (!isRunning(existing)) return;
+		const result = await this._runCli(["stop", this.containerId]);
+		if (!result.success && !isMissingContainerMessage(result.stderr)) this._assertSuccess(result, `stop Apple container ${this.containerId}`);
+	}
+	async _destroyContainer() {
+		if (!this._deleteOnDestroy) {
+			await this._stopContainer();
+			return;
+		}
+		const existing = await this._inspectContainer();
+		if (!existing) return;
+		this._assertMastraOwned(existing);
+		await this._deleteContainerIgnoringMissing();
+	}
+	async executeCommand(command, args = [], options = {}) {
+		await this.ensureRunning();
+		const commandTimeout = options.timeout ?? this._timeout;
+		const hasCommandTimeout = Number.isFinite(commandTimeout) && commandTimeout > 0;
+		const fullCommand = buildShellCommand(command, args);
+		const shellCommand = hasCommandTimeout ? buildTimeoutShellCommand(fullCommand, commandTimeout) : fullCommand;
+		const env = envFlags({
+			...this._env,
+			...options.env
+		});
+		const cliArgs = [
+			"exec",
+			...env.args,
+			"--workdir",
+			options.cwd ?? this._workingDir,
+			this.containerId,
+			"sh",
+			"-lc",
+			shellCommand
+		];
+		const result = await this._runner.run(cliArgs, {
+			timeout: hasCommandTimeout ? commandTimeout + APPLE_CONTAINER_CLI_GRACE_TIMEOUT_MS : void 0,
+			env: env.env,
+			abortSignal: options.abortSignal,
+			onStdout: options.onStdout,
+			onStderr: options.onStderr,
+			maxRetainedBytes: options.maxRetainedBytes
+		});
+		const timedOut = result.exitCode === APPLE_CONTAINER_TIMEOUT_EXIT_CODE && result.stderr.includes(APPLE_CONTAINER_TIMEOUT_MARKER);
+		const stderr = timedOut ? stripTimeoutMarker(result.stderr) : result.stderr;
+		return {
+			...result,
+			stderr,
+			...timedOut && {
+				timedOut: true,
+				killed: true
+			},
+			command: fullCommand,
+			args
+		};
+	}
+	async getInfo() {
+		const resources = (this._containerId ? await this._inspectContainer() : void 0)?.configuration?.resources;
+		return {
+			id: this.id,
+			name: this.name,
+			provider: this.provider,
+			status: this.status,
+			createdAt: this._createdAt,
+			resources: resources ? {
+				cpuCores: resources.cpus,
+				memoryMB: resources.memoryInBytes ? Math.round(resources.memoryInBytes / 1024 / 1024) : void 0
+			} : void 0,
+			metadata: { ...this._serializableConfig() }
+		};
+	}
+	getInstructions(opts) {
+		const defaultInstructions = this._buildDefaultInstructions();
+		if (typeof this._instructionsOverride === "string") return this._instructionsOverride;
+		if (typeof this._instructionsOverride === "function") return this._instructionsOverride({
+			defaultInstructions,
+			requestContext: opts?.requestContext
+		});
+		return defaultInstructions;
+	}
+	_buildDefaultInstructions() {
+		const parts = [`Apple container sandbox: commands run inside a local OCI Linux container from image ${this._image}.`, `Working directory: ${this._workingDir}.`];
+		const volumeCount = Object.keys(this._volumes).length + this._mounts.length;
+		if (volumeCount > 0) parts.push(`${volumeCount} host mount(s) are configured.`);
+		if (this._timeout > 0) parts.push(`Default command timeout: ${Math.ceil(this._timeout / 1e3)}s.`);
+		return parts.join(" ");
+	}
+	async _runPlainLifecycle(activeStatus, completeStatus, operation) {
+		const managedByBaseWrapper = this.status === activeStatus;
+		if (!managedByBaseWrapper) this.status = activeStatus;
+		try {
+			await operation();
+			if (!managedByBaseWrapper) this.status = completeStatus;
+		} catch (error) {
+			if (!managedByBaseWrapper) this.status = "error";
+			throw error;
+		}
+	}
+	async _inspectContainer() {
+		const result = await this._runCli(["inspect", this.containerId]);
+		if (!result.success) {
+			if (isMissingContainerMessage(result.stderr)) return void 0;
+			this._assertSuccess(result, `inspect Apple container ${this.containerId}`);
+			return;
+		}
+		try {
+			const parsed = JSON.parse(result.stdout);
+			return Array.isArray(parsed) ? parsed[0] : parsed;
+		} catch (error) {
+			throw new SandboxExecutionError(`Failed to parse Apple container inspect output for ${this.containerId}: ${error instanceof Error ? error.message : String(error)}`, 1, result.stdout, result.stderr);
+		}
+	}
+	_buildRunArgs(envArgs) {
+		const args = [
+			"run",
+			"-d",
+			"--name",
+			this._containerName,
+			"--workdir",
+			this._workingDir
+		];
+		args.push(...envArgs);
+		for (const [hostPath, containerPath] of Object.entries(this._volumes)) args.push("--volume", `${hostPath}:${containerPath}`);
+		for (const mount of this._mounts) args.push("--mount", mount);
+		for (const [key, value] of Object.entries(this._labels)) args.push("--label", `${key}=${value}`);
+		for (const port of this._publishedPorts) args.push("--publish", port);
+		for (const socket of this._publishedSockets) args.push("--publish-socket", socket);
+		for (const cap of this._capAdd) args.push("--cap-add", cap);
+		for (const cap of this._capDrop) args.push("--cap-drop", cap);
+		for (const tmpfs of this._tmpfs) args.push("--tmpfs", tmpfs);
+		for (const dns of this._dns) args.push("--dns", dns);
+		for (const domain of this._dnsSearch) args.push("--dns-search", domain);
+		if (this._network) args.push("--network", this._network);
+		if (this._cpus !== void 0) args.push("--cpus", String(this._cpus));
+		if (this._memory !== void 0) args.push("--memory", this._memory);
+		if (this._platform) args.push("--platform", this._platform);
+		if (this._arch) args.push("--arch", this._arch);
+		if (this._os) args.push("--os", this._os);
+		if (this._rosetta) args.push("--rosetta");
+		if (this._readonlyRootfs) args.push("--read-only");
+		if (this._ssh) args.push("--ssh");
+		if (this._init) args.push("--init");
+		if (this._virtualization) args.push("--virtualization");
+		if (this._noDns) args.push("--no-dns");
+		args.push(this._image, ...this._command);
+		return args;
+	}
+	async _waitUntilContainerReady(action) {
+		const deadline = Date.now() + APPLE_CONTAINER_READY_TIMEOUT_MS;
+		let lastResult;
+		while (Date.now() < deadline) {
+			const inspect = await this._inspectContainer();
+			if (!inspect) throw new SandboxExecutionError(`${action} failed because Apple container ${this.containerId} disappeared`, 1, "", "");
+			this._assertMastraOwned(inspect);
+			this._assertCompatibleConfig(inspect);
+			if (!isRunning(inspect)) {
+				const state = getContainerState(inspect) ?? "not running";
+				throw new SandboxExecutionError(`${action} failed because Apple container ${this.containerId} is ${state}`, 1, "", "");
+			}
+			lastResult = await this._runCli([
+				"exec",
+				this.containerId,
+				"sh",
+				"-lc",
+				"true"
+			], { timeout: APPLE_CONTAINER_READY_EXEC_TIMEOUT_MS });
+			if (lastResult.success) return;
+			if (!isMissingContainerMessage(lastResult.stderr) && !/not running|not yet running/i.test(lastResult.stderr)) break;
+			await delay(100);
+		}
+		throw new SandboxExecutionError(`${action} failed because Apple container ${this.containerId} did not become ready for exec`, lastResult?.exitCode ?? 1, lastResult?.stdout ?? "", lastResult?.stderr ?? "");
+	}
+	async _deleteContainerIgnoringMissing() {
+		const result = await this._runCli([
+			"delete",
+			"--force",
+			this.containerId
+		]);
+		if (!result.success && !isMissingContainerMessage(result.stderr)) this._assertSuccess(result, `delete Apple container ${this.containerId}`);
+	}
+	_runtimeConfigForHash() {
+		return {
+			image: this._image,
+			command: this._command,
+			env: this._env,
+			volumes: this._volumes,
+			mounts: this._mounts,
+			network: this._network,
+			publishedPorts: this._publishedPorts,
+			publishedSockets: this._publishedSockets,
+			cpus: this._cpus,
+			memory: this._memory,
+			platform: this._platform,
+			arch: this._arch,
+			os: this._os,
+			rosetta: this._rosetta,
+			readonlyRootfs: this._readonlyRootfs,
+			ssh: this._ssh,
+			init: this._init,
+			virtualization: this._virtualization,
+			capAdd: this._capAdd,
+			capDrop: this._capDrop,
+			tmpfs: this._tmpfs,
+			dns: this._dns,
+			dnsSearch: this._dnsSearch,
+			noDns: this._noDns,
+			labels: this._userLabels,
+			workingDir: this._workingDir
+		};
+	}
+	_serializableConfig() {
+		return compactConfig({
+			id: this.id,
+			name: this._configuredName,
+			image: this._image,
+			command: this._command,
+			env: this._env,
+			volumes: this._volumes,
+			mounts: this._mounts,
+			network: this._network,
+			publishedPorts: this._publishedPorts,
+			publishedSockets: this._publishedSockets,
+			cpus: this._cpus,
+			memory: this._memory,
+			platform: this._platform,
+			arch: this._arch,
+			os: this._os,
+			rosetta: this._rosetta,
+			readonlyRootfs: this._readonlyRootfs,
+			ssh: this._ssh,
+			init: this._init,
+			virtualization: this._virtualization,
+			capAdd: this._capAdd,
+			capDrop: this._capDrop,
+			tmpfs: this._tmpfs,
+			dns: this._dns,
+			dnsSearch: this._dnsSearch,
+			noDns: this._noDns,
+			labels: this._userLabels,
+			workingDir: this._workingDir,
+			timeout: this._timeout,
+			deleteOnDestroy: this._deleteOnDestroy
+		});
+	}
+	_assertSuccess(result, action) {
+		if (result.success) return;
+		throw new SandboxExecutionError(`${action} failed with exit code ${result.exitCode}: ${result.stderr}`, result.exitCode, result.stdout, result.stderr);
+	}
+	_assertMastraOwned(inspect) {
+		if (isMastraOwned(inspect, this.id)) return;
+		throw new SandboxExecutionError(`Refusing to manage Apple container ${this.containerId} because it is not labeled as Mastra sandbox ${this.id}`, 1, "", "");
+	}
+	_assertCompatibleConfig(inspect) {
+		const existingHash = inspect.configuration?.labels?.["mastra.sandbox.config-hash"];
+		if (!existingHash || existingHash === this._configHash) return;
+		throw new SandboxExecutionError(`Refusing to manage Apple container ${this.containerId} because its immutable configuration does not match sandbox ${this.id}`, 1, "", "");
+	}
+	_runCli(args, options = {}) {
+		return this._runner.run(args, {
+			timeout: this._timeout,
+			...options
+		});
+	}
 };
 function runAppleContainerCli(binary, args, options = {}) {
-  const handle = new AppleContainerCliProcess(binary, args, options);
-  return handle.wait();
+	return new AppleContainerCliProcess(binary, args, options).wait();
 }
 var AppleContainerCliProcess = class extends ProcessHandle {
-  pid;
-  exitCode;
-  child;
-  waitPromise;
-  startedAt = Date.now();
-  killed = false;
-  timedOut = false;
-  forceKillTimeout;
-  constructor(binary, args, options = {}) {
-    super({
-      maxRetainedBytes: options.maxRetainedBytes,
-      onStdout: options.onStdout,
-      onStderr: options.onStderr
-    });
-    this.child = spawn(binary, args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      env: options.env ? { ...process.env, ...options.env } : process.env
-    });
-    this.pid = this.child.pid ? String(this.child.pid) : `${binary}:${args.join(" ")}`;
-    let settled = false;
-    const stdoutDecoder = new StringDecoder();
-    const stderrDecoder = new StringDecoder();
-    let stdoutDecoderEnded = false;
-    let stderrDecoderEnded = false;
-    let timeout;
-    const onAbort = () => {
-      void this.kill();
-    };
-    const flushStdout = () => {
-      if (stdoutDecoderEnded) return;
-      stdoutDecoderEnded = true;
-      const data = stdoutDecoder.end();
-      if (data) this.emitStdout(data);
-    };
-    const flushStderr = () => {
-      if (stderrDecoderEnded) return;
-      stderrDecoderEnded = true;
-      const data = stderrDecoder.end();
-      if (data) this.emitStderr(data);
-    };
-    const finish = (exitCode) => {
-      this.exitCode = exitCode;
-      return {
-        success: exitCode === 0,
-        exitCode,
-        stdout: this.stdout,
-        stderr: this.stderr,
-        executionTimeMs: Date.now() - this.startedAt,
-        killed: this.killed,
-        timedOut: this.timedOut
-      };
-    };
-    const cleanup = () => {
-      if (timeout) clearTimeout(timeout);
-      if (this.forceKillTimeout) clearTimeout(this.forceKillTimeout);
-      options.abortSignal?.removeEventListener("abort", onAbort);
-    };
-    this.waitPromise = new Promise((resolve, reject) => {
-      const settle = (callback) => {
-        if (settled) return;
-        settled = true;
-        cleanup();
-        callback();
-      };
-      this.child.stdout.on("data", (chunk) => {
-        const data = stdoutDecoder.write(chunk);
-        if (data) this.emitStdout(data);
-      });
-      this.child.stderr.on("data", (chunk) => {
-        const data = stderrDecoder.write(chunk);
-        if (data) this.emitStderr(data);
-      });
-      this.child.stdout.on("end", flushStdout);
-      this.child.stderr.on("end", flushStderr);
-      this.child.on("error", (error) => {
-        settle(() => {
-          flushStdout();
-          flushStderr();
-          reject(
-            error instanceof Error && "code" in error && error.code === "ENOENT" ? new SandboxExecutionError(`Apple container CLI not found: ${binary}`, 127, this.stdout, error.message) : error
-          );
-        });
-      });
-      this.child.on("close", (code) => {
-        settle(() => {
-          flushStdout();
-          flushStderr();
-          resolve(finish(code ?? (this.killed ? 137 : 1)));
-        });
-      });
-    });
-    timeout = options.timeout && options.timeout > 0 ? setTimeout(() => {
-      this.timedOut = true;
-      void this.kill();
-    }, options.timeout) : void 0;
-    if (options.abortSignal) {
-      if (options.abortSignal.aborted) {
-        void this.kill();
-      } else {
-        options.abortSignal.addEventListener("abort", onAbort, { once: true });
-      }
-    }
-  }
-  async wait() {
-    return this.waitPromise;
-  }
-  async kill() {
-    if (this.exitCode !== void 0 || this.child.killed) return false;
-    this.killed = true;
-    this.child.kill("SIGTERM");
-    this.forceKillTimeout = setTimeout(() => {
-      if (this.exitCode === void 0 && this.child.exitCode === null && this.child.signalCode === null) {
-        this.child.kill("SIGKILL");
-      }
-    }, 1e3);
-    this.forceKillTimeout.unref();
-    return true;
-  }
-  async sendStdin() {
-    throw new Error("Apple container CLI runner does not support stdin");
-  }
+	pid;
+	exitCode;
+	child;
+	waitPromise;
+	startedAt = Date.now();
+	killed = false;
+	timedOut = false;
+	forceKillTimeout;
+	constructor(binary, args, options = {}) {
+		super({
+			maxRetainedBytes: options.maxRetainedBytes,
+			onStdout: options.onStdout,
+			onStderr: options.onStderr
+		});
+		this.child = spawn(binary, args, {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: options.env ? {
+				...process.env,
+				...options.env
+			} : process.env
+		});
+		this.pid = this.child.pid ? String(this.child.pid) : `${binary}:${args.join(" ")}`;
+		let settled = false;
+		const stdoutDecoder = new StringDecoder();
+		const stderrDecoder = new StringDecoder();
+		let stdoutDecoderEnded = false;
+		let stderrDecoderEnded = false;
+		let timeout;
+		const onAbort = () => {
+			this.kill();
+		};
+		const flushStdout = () => {
+			if (stdoutDecoderEnded) return;
+			stdoutDecoderEnded = true;
+			const data = stdoutDecoder.end();
+			if (data) this.emitStdout(data);
+		};
+		const flushStderr = () => {
+			if (stderrDecoderEnded) return;
+			stderrDecoderEnded = true;
+			const data = stderrDecoder.end();
+			if (data) this.emitStderr(data);
+		};
+		const finish = (exitCode) => {
+			this.exitCode = exitCode;
+			return {
+				success: exitCode === 0,
+				exitCode,
+				stdout: this.stdout,
+				stderr: this.stderr,
+				executionTimeMs: Date.now() - this.startedAt,
+				killed: this.killed,
+				timedOut: this.timedOut
+			};
+		};
+		const cleanup = () => {
+			if (timeout) clearTimeout(timeout);
+			if (this.forceKillTimeout) clearTimeout(this.forceKillTimeout);
+			options.abortSignal?.removeEventListener("abort", onAbort);
+		};
+		this.waitPromise = new Promise((resolve, reject) => {
+			const settle = (callback) => {
+				if (settled) return;
+				settled = true;
+				cleanup();
+				callback();
+			};
+			this.child.stdout.on("data", (chunk) => {
+				const data = stdoutDecoder.write(chunk);
+				if (data) this.emitStdout(data);
+			});
+			this.child.stderr.on("data", (chunk) => {
+				const data = stderrDecoder.write(chunk);
+				if (data) this.emitStderr(data);
+			});
+			this.child.stdout.on("end", flushStdout);
+			this.child.stderr.on("end", flushStderr);
+			this.child.on("error", (error) => {
+				settle(() => {
+					flushStdout();
+					flushStderr();
+					reject(error instanceof Error && "code" in error && error.code === "ENOENT" ? new SandboxExecutionError(`Apple container CLI not found: ${binary}`, 127, this.stdout, error.message) : error);
+				});
+			});
+			this.child.on("close", (code) => {
+				settle(() => {
+					flushStdout();
+					flushStderr();
+					resolve(finish(code ?? (this.killed ? 137 : 1)));
+				});
+			});
+		});
+		timeout = options.timeout && options.timeout > 0 ? setTimeout(() => {
+			this.timedOut = true;
+			this.kill();
+		}, options.timeout) : void 0;
+		if (options.abortSignal) if (options.abortSignal.aborted) this.kill();
+		else options.abortSignal.addEventListener("abort", onAbort, { once: true });
+	}
+	async wait() {
+		return this.waitPromise;
+	}
+	async kill() {
+		if (this.exitCode !== void 0 || this.child.killed) return false;
+		this.killed = true;
+		this.child.kill("SIGTERM");
+		this.forceKillTimeout = setTimeout(() => {
+			if (this.exitCode === void 0 && this.child.exitCode === null && this.child.signalCode === null) this.child.kill("SIGKILL");
+		}, 1e3);
+		this.forceKillTimeout.unref();
+		return true;
+	}
+	async sendStdin() {
+		throw new Error("Apple container CLI runner does not support stdin");
+	}
+	async closeStdin() {
+		throw new UnsupportedStdinCloseError("Apple container CLI runner does not support closing stdin");
+	}
 };
 function generateId() {
-  return `apple-container-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+	return `apple-container-sandbox-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
 function sanitizeContainerName(name) {
-  const sanitized = name.replace(/[^a-zA-Z0-9_.-]/g, "-");
-  return /^[a-zA-Z0-9]/.test(sanitized) ? sanitized : `c-${sanitized}`;
+	const sanitized = name.replace(/[^a-zA-Z0-9_.-]/g, "-");
+	return /^[a-zA-Z0-9]/.test(sanitized) ? sanitized : `c-${sanitized}`;
 }
 function buildShellCommand(command, args) {
-  return args.length > 0 ? [command, ...args].map(shellQuote).join(" ") : command;
+	return args.length > 0 ? [command, ...args].map(shellQuote).join(" ") : command;
 }
 function buildTimeoutShellCommand(command, timeoutMs) {
-  const timeoutSeconds = formatTimeoutSeconds(timeoutMs);
-  const innerScript = [
-    `sh -lc ${shellQuote(command)} & child=$!`,
-    `trap 'kill -TERM "$child" 2>/dev/null; wait "$child" 2>/dev/null; exit ${APPLE_CONTAINER_TIMEOUT_EXIT_CODE}' TERM INT`,
-    'wait "$child"; code=$?',
-    "trap - TERM INT",
-    'printf "%s" "$code" > "$MASTRA_TIMEOUT_RESULT_FILE"',
-    'exit "$code"'
-  ].join("; ");
-  return [
-    'result_file="/tmp/.mastra-apple-container-exit-$$"',
-    'rm -f "$result_file"',
-    `MASTRA_TIMEOUT_RESULT_FILE="$result_file" timeout ${timeoutSeconds}s sh -lc ${shellQuote(innerScript)}`,
-    "timeout_code=$?",
-    'if [ -f "$result_file" ]; then code="$(cat "$result_file")"; rm -f "$result_file"; exit "$code"; fi',
-    'rm -f "$result_file"',
-    `case "$timeout_code" in 124|137|143) printf '%s\\n' ${shellQuote(APPLE_CONTAINER_TIMEOUT_MARKER)} >&2; exit ${APPLE_CONTAINER_TIMEOUT_EXIT_CODE};; *) exit "$timeout_code";; esac`
-  ].join("; ");
+	return [
+		"result_file=\"/tmp/.mastra-apple-container-exit-$$\"",
+		"rm -f \"$result_file\"",
+		`MASTRA_TIMEOUT_RESULT_FILE="$result_file" timeout ${formatTimeoutSeconds(timeoutMs)}s sh -lc ${shellQuote([
+			`sh -lc ${shellQuote(command)} & child=$!`,
+			`trap 'kill -TERM "$child" 2>/dev/null; wait "$child" 2>/dev/null; exit ${APPLE_CONTAINER_TIMEOUT_EXIT_CODE}' TERM INT`,
+			"wait \"$child\"; code=$?",
+			"trap - TERM INT",
+			"printf \"%s\" \"$code\" > \"$MASTRA_TIMEOUT_RESULT_FILE\"",
+			"exit \"$code\""
+		].join("; "))}`,
+		"timeout_code=$?",
+		"if [ -f \"$result_file\" ]; then code=\"$(cat \"$result_file\")\"; rm -f \"$result_file\"; exit \"$code\"; fi",
+		"rm -f \"$result_file\"",
+		`case "$timeout_code" in 124|137|143) printf '%s\\n' ${shellQuote(APPLE_CONTAINER_TIMEOUT_MARKER)} >&2; exit ${APPLE_CONTAINER_TIMEOUT_EXIT_CODE};; *) exit "$timeout_code";; esac`
+	].join("; ");
 }
 function formatTimeoutSeconds(timeoutMs) {
-  return Math.max(timeoutMs / 1e3, 1e-3).toFixed(3).replace(/0+$/, "").replace(/\.$/, "");
+	return Math.max(timeoutMs / 1e3, .001).toFixed(3).replace(/0+$/, "").replace(/\.$/, "");
 }
 function shellQuote(arg) {
-  if (/^[a-zA-Z0-9._\-\/=:@]+$/.test(arg)) return arg;
-  return `'${arg.replace(/'/g, "'\\''")}'`;
+	if (/^[a-zA-Z0-9._\-\/=:@]+$/.test(arg)) return arg;
+	return `'${arg.replace(/'/g, "'\\''")}'`;
 }
 function stripTimeoutMarker(stderr) {
-  return stderr.split("\n").filter((line) => line.trim() !== APPLE_CONTAINER_TIMEOUT_MARKER).join("\n").replace(/^\n+|\n+$/g, "");
+	return stderr.split("\n").filter((line) => line.trim() !== APPLE_CONTAINER_TIMEOUT_MARKER).join("\n").replace(/^\n+|\n+$/g, "");
 }
 function envFlags(env) {
-  const args = [];
-  const childEnv = {};
-  for (const [key, value] of Object.entries(env)) {
-    if (value === void 0) continue;
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      throw new Error(`Invalid environment variable name for Apple container command: ${key}`);
-    }
-    args.push("--env", key);
-    childEnv[key] = value;
-  }
-  return { args, env: childEnv };
+	const args = [];
+	const childEnv = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`Invalid environment variable name for Apple container command: ${key}`);
+		args.push("--env", key);
+		childEnv[key] = value;
+	}
+	return {
+		args,
+		env: childEnv
+	};
 }
 function isRunning(inspect) {
-  return getContainerState(inspect) === "running";
+	return getContainerState(inspect) === "running";
 }
 function getContainerState(inspect) {
-  return typeof inspect.status === "string" ? inspect.status : inspect.status?.state;
+	return typeof inspect.status === "string" ? inspect.status : inspect.status?.state;
 }
 function isMastraOwned(inspect, sandboxId) {
-  const labels = inspect.configuration?.labels;
-  return labels?.["mastra.sandbox"] === "true" && labels["mastra.sandbox.id"] === sandboxId;
+	const labels = inspect.configuration?.labels;
+	return labels?.["mastra.sandbox"] === "true" && labels["mastra.sandbox.id"] === sandboxId;
 }
 function isMissingContainerMessage(message) {
-  return /not found|no such|does not exist|unknown container/i.test(message);
+	return /not found|no such|does not exist|unknown container/i.test(message);
 }
 function validateTmpfsPaths(tmpfs) {
-  for (const entry of tmpfs) {
-    if (!entry.startsWith("/") || /[:,]/.test(entry)) {
-      throw new Error(
-        `Invalid Apple container tmpfs path "${entry}". Apple container --tmpfs accepts container paths only, for example "/tmp".`
-      );
-    }
-  }
+	for (const entry of tmpfs) if (!entry.startsWith("/") || /[:,]/.test(entry)) throw new Error(`Invalid Apple container tmpfs path "${entry}". Apple container --tmpfs accepts container paths only, for example "/tmp".`);
 }
 function compactConfig(config) {
-  const result = {};
-  for (const [key, value] of Object.entries(config)) {
-    if (value === void 0) continue;
-    if (Array.isArray(value) && value.length === 0) continue;
-    if (isPlainRecord(value) && Object.keys(value).length === 0) continue;
-    result[key] = value;
-  }
-  return result;
+	const result = {};
+	for (const [key, value] of Object.entries(config)) {
+		if (value === void 0) continue;
+		if (Array.isArray(value) && value.length === 0) continue;
+		if (isPlainRecord(value) && Object.keys(value).length === 0) continue;
+		result[key] = value;
+	}
+	return result;
 }
 function hashConfig(config) {
-  return createHash("sha256").update(stableStringify(compactConfig(config))).digest("hex").slice(0, 16);
+	return createHash("sha256").update(stableStringify(compactConfig(config))).digest("hex").slice(0, 16);
 }
 function stableStringify(value) {
-  if (Array.isArray(value)) {
-    return `[${value.map(stableStringify).join(",")}]`;
-  }
-  if (isPlainRecord(value)) {
-    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (isPlainRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	return JSON.stringify(value);
 }
 function isPlainRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+	return new Promise((resolve) => setTimeout(resolve, ms));
 }
-
-// src/provider.ts
-var appleContainerSandboxProvider = {
-  id: "apple-container",
-  name: "Apple Container Sandbox",
-  description: "Local OCI Linux container sandbox powered by Apple container",
-  configSchema: {
-    type: "object",
-    additionalProperties: false,
-    properties: {
-      id: {
-        type: "string",
-        description: "Stable sandbox ID used for reconnecting to the same Apple container."
-      },
-      image: {
-        type: "string",
-        description: "OCI image to use",
-        default: "node:22-slim"
-      },
-      name: {
-        type: "string",
-        description: "Apple container name. Defaults to the sandbox ID."
-      },
-      command: {
-        type: "array",
-        description: "Container init command. Must keep the container alive for exec-based command execution.",
-        items: { type: "string" }
-      },
-      env: {
-        type: "object",
-        description: "Environment variables",
-        additionalProperties: { type: "string" }
-      },
-      volumes: {
-        type: "object",
-        description: "Host-to-container bind mounts (host path -> container path)",
-        additionalProperties: { type: "string" }
-      },
-      mounts: {
-        type: "array",
-        description: "Raw Apple container --mount specs",
-        items: { type: "string" }
-      },
-      network: {
-        type: "string",
-        description: "Apple container network attachment spec"
-      },
-      publishedPorts: {
-        type: "array",
-        description: "Port publish specs",
-        items: { type: "string" }
-      },
-      publishedSockets: {
-        type: "array",
-        description: "Socket publish specs",
-        items: { type: "string" }
-      },
-      cpus: {
-        anyOf: [{ type: "number" }, { type: "string" }],
-        description: "Number of CPUs to allocate"
-      },
-      memory: {
-        type: "string",
-        description: "Memory allocation, for example 1G"
-      },
-      platform: {
-        type: "string",
-        description: "OCI platform, for example linux/arm64"
-      },
-      arch: {
-        type: "string",
-        description: "Image architecture for multi-arch images"
-      },
-      os: {
-        type: "string",
-        description: "Operating system for multi-platform images"
-      },
-      rosetta: {
-        type: "boolean",
-        description: "Enable Rosetta in the container",
-        default: false
-      },
-      readonlyRootfs: {
-        type: "boolean",
-        description: "Mount the container root filesystem as read-only",
-        default: false
-      },
-      ssh: {
-        type: "boolean",
-        description: "Forward the host SSH agent socket",
-        default: false
-      },
-      init: {
-        type: "boolean",
-        description: "Enable Apple's init process in the container",
-        default: true
-      },
-      virtualization: {
-        type: "boolean",
-        description: "Expose virtualization capabilities to the container",
-        default: false
-      },
-      capAdd: {
-        type: "array",
-        description: "Linux capabilities to add",
-        items: { type: "string" }
-      },
-      capDrop: {
-        type: "array",
-        description: "Linux capabilities to drop",
-        items: { type: "string" }
-      },
-      tmpfs: {
-        type: "array",
-        description: "tmpfs destination paths",
-        items: { type: "string" }
-      },
-      dns: {
-        type: "array",
-        description: "DNS nameserver IPs",
-        items: { type: "string" }
-      },
-      dnsSearch: {
-        type: "array",
-        description: "DNS search domains",
-        items: { type: "string" }
-      },
-      noDns: {
-        type: "boolean",
-        description: "Do not configure DNS in the container",
-        default: false
-      },
-      labels: {
-        type: "object",
-        description: "Container labels",
-        additionalProperties: { type: "string" }
-      },
-      workingDir: {
-        type: "string",
-        description: "Working directory inside the container",
-        default: "/workspace"
-      },
-      timeout: {
-        type: "number",
-        description: "Default command timeout in milliseconds",
-        default: 3e5
-      },
-      deleteOnDestroy: {
-        type: "boolean",
-        description: "Delete the Apple container on destroy",
-        default: true
-      }
-    }
-  },
-  createSandbox: (config) => {
-    const {
-      id,
-      image,
-      name,
-      command,
-      env,
-      volumes,
-      mounts,
-      network,
-      publishedPorts,
-      publishedSockets,
-      cpus,
-      memory,
-      platform,
-      arch,
-      os,
-      rosetta,
-      readonlyRootfs,
-      ssh,
-      init,
-      virtualization,
-      capAdd,
-      capDrop,
-      tmpfs,
-      dns,
-      dnsSearch,
-      noDns,
-      labels,
-      workingDir,
-      timeout,
-      deleteOnDestroy
-    } = config;
-    return new AppleContainerSandbox({
-      id,
-      image,
-      name,
-      command,
-      env,
-      volumes,
-      mounts,
-      network,
-      publishedPorts,
-      publishedSockets,
-      cpus,
-      memory,
-      platform,
-      arch,
-      os,
-      rosetta,
-      readonlyRootfs,
-      ssh,
-      init,
-      virtualization,
-      capAdd,
-      capDrop,
-      tmpfs,
-      dns,
-      dnsSearch,
-      noDns,
-      labels,
-      workingDir,
-      timeout,
-      deleteOnDestroy
-    });
-  }
+//#endregion
+//#region src/provider.ts
+const appleContainerSandboxProvider = {
+	id: "apple-container",
+	name: "Apple Container Sandbox",
+	description: "Local OCI Linux container sandbox powered by Apple container",
+	configSchema: {
+		type: "object",
+		additionalProperties: false,
+		properties: {
+			id: {
+				type: "string",
+				description: "Stable sandbox ID used for reconnecting to the same Apple container."
+			},
+			image: {
+				type: "string",
+				description: "OCI image to use",
+				default: "node:22-slim"
+			},
+			name: {
+				type: "string",
+				description: "Apple container name. Defaults to the sandbox ID."
+			},
+			command: {
+				type: "array",
+				description: "Container init command. Must keep the container alive for exec-based command execution.",
+				items: { type: "string" }
+			},
+			env: {
+				type: "object",
+				description: "Environment variables",
+				additionalProperties: { type: "string" }
+			},
+			volumes: {
+				type: "object",
+				description: "Host-to-container bind mounts (host path -> container path)",
+				additionalProperties: { type: "string" }
+			},
+			mounts: {
+				type: "array",
+				description: "Raw Apple container --mount specs",
+				items: { type: "string" }
+			},
+			network: {
+				type: "string",
+				description: "Apple container network attachment spec"
+			},
+			publishedPorts: {
+				type: "array",
+				description: "Port publish specs",
+				items: { type: "string" }
+			},
+			publishedSockets: {
+				type: "array",
+				description: "Socket publish specs",
+				items: { type: "string" }
+			},
+			cpus: {
+				anyOf: [{ type: "number" }, { type: "string" }],
+				description: "Number of CPUs to allocate"
+			},
+			memory: {
+				type: "string",
+				description: "Memory allocation, for example 1G"
+			},
+			platform: {
+				type: "string",
+				description: "OCI platform, for example linux/arm64"
+			},
+			arch: {
+				type: "string",
+				description: "Image architecture for multi-arch images"
+			},
+			os: {
+				type: "string",
+				description: "Operating system for multi-platform images"
+			},
+			rosetta: {
+				type: "boolean",
+				description: "Enable Rosetta in the container",
+				default: false
+			},
+			readonlyRootfs: {
+				type: "boolean",
+				description: "Mount the container root filesystem as read-only",
+				default: false
+			},
+			ssh: {
+				type: "boolean",
+				description: "Forward the host SSH agent socket",
+				default: false
+			},
+			init: {
+				type: "boolean",
+				description: "Enable Apple's init process in the container",
+				default: true
+			},
+			virtualization: {
+				type: "boolean",
+				description: "Expose virtualization capabilities to the container",
+				default: false
+			},
+			capAdd: {
+				type: "array",
+				description: "Linux capabilities to add",
+				items: { type: "string" }
+			},
+			capDrop: {
+				type: "array",
+				description: "Linux capabilities to drop",
+				items: { type: "string" }
+			},
+			tmpfs: {
+				type: "array",
+				description: "tmpfs destination paths",
+				items: { type: "string" }
+			},
+			dns: {
+				type: "array",
+				description: "DNS nameserver IPs",
+				items: { type: "string" }
+			},
+			dnsSearch: {
+				type: "array",
+				description: "DNS search domains",
+				items: { type: "string" }
+			},
+			noDns: {
+				type: "boolean",
+				description: "Do not configure DNS in the container",
+				default: false
+			},
+			labels: {
+				type: "object",
+				description: "Container labels",
+				additionalProperties: { type: "string" }
+			},
+			workingDir: {
+				type: "string",
+				description: "Working directory inside the container",
+				default: "/workspace"
+			},
+			timeout: {
+				type: "number",
+				description: "Default command timeout in milliseconds",
+				default: 3e5
+			},
+			deleteOnDestroy: {
+				type: "boolean",
+				description: "Delete the Apple container on destroy",
+				default: true
+			}
+		}
+	},
+	createSandbox: (config) => {
+		const { id, image, name, command, env, volumes, mounts, network, publishedPorts, publishedSockets, cpus, memory, platform, arch, os, rosetta, readonlyRootfs, ssh, init, virtualization, capAdd, capDrop, tmpfs, dns, dnsSearch, noDns, labels, workingDir, timeout, deleteOnDestroy } = config;
+		return new AppleContainerSandbox({
+			id,
+			image,
+			name,
+			command,
+			env,
+			volumes,
+			mounts,
+			network,
+			publishedPorts,
+			publishedSockets,
+			cpus,
+			memory,
+			platform,
+			arch,
+			os,
+			rosetta,
+			readonlyRootfs,
+			ssh,
+			init,
+			virtualization,
+			capAdd,
+			capDrop,
+			tmpfs,
+			dns,
+			dnsSearch,
+			noDns,
+			labels,
+			workingDir,
+			timeout,
+			deleteOnDestroy
+		});
+	}
 };
-
+//#endregion
 export { AppleContainerSandbox, DefaultAppleContainerCommandRunner, appleContainerSandboxProvider };
-//# sourceMappingURL=index.js.map
+
 //# sourceMappingURL=index.js.map