@namzu/sandbox 1.1.0 → 2.0.1

package/dist/index.d.ts

@@ -1,69 +1,37 @@
 /**
- * @namzu/sandbox — pluggable sandbox provider for @namzu/sdk.
- *
- * The SDK already declares a `SandboxProvider` shape in
- * `@namzu/sdk` (`packages/sdk/src/types/sandbox/index.ts`). This
- * package implements that shape with concrete BACKENDS picked at
- * construction time. The set is aligned with the 2026 industrial
- * standard for AI-agent code-execution sandboxes:
- *
- *  • `docker` — plain OCI container per task, seccomp default
- *    profile, tmpfs workdir, no-network-by-default. The universal
- *    fallback every namzu host gets locally with `docker compose`
- *    and on every Linux replica in any cloud. What Northflank /
- *    Railway / Render / Compass-platform / GitHub Actions runners
- *    actually ship for code execution. Trust boundary: namespaces.
- *
- *  • `e2b` — adapter for E2B's managed Firecracker microVM service
- *    (`e2b.dev`). Sub-second cold-start via snapshot/restore, full
- *    kernel-level trust boundary. The SaaS-friendly path to real
- *    Firecracker isolation without running our own scheduler.
- *
- *  • `fly-machines` — adapter for Fly Machines (`fly.io/docs/machines`).
- *    Also Firecracker microVMs; closer to bare-metal control than
- *    E2B, useful when the workload is more "arbitrary tool calls"
- *    than "Python REPL".
- *
- *  • `firecracker` — self-hosted `firecracker-containerd` on bare
- *    metal (or KVM-enabled cloud instance). For hosts that need
- *    Firecracker isolation AND insist on running the scheduler
- *    themselves. Tier 3 isolation, highest operational cost.
- *
- *  • `gvisor` — adapter for `runsc` runtime (Google's userspace
- *    kernel). What OpenAI Code Interpreter and Modal Labs ship.
- *    Trusted-tenant tier with near-zero cold-start; runs on
- *    commodity Linux without nested virt. Locally via Linux Docker
- *    runtime; not available on macOS Docker Desktop.
- *
- *  • `passthrough` — no isolation, runs commands directly. For
- *    tests and trusted environments only. Off by default; opt-in.
- *
- * **What we deliberately do NOT build** is yet-another Firecracker
- * scheduler — that is E2B's and Fly's entire product, and writing
- * our own is a years-long detour. We adapt to theirs.
- *
- * **Cloud portability:** the backend interface is cloud-agnostic.
- * `docker` works on every cloud; `e2b` and `fly-machines` are
- * managed services not tied to any cloud; `firecracker` and
- * `gvisor` need infrastructure the host chooses (GKE Sandbox, AWS
- * Fargate, self-hosted KVM, etc.). Picking a stronger backend may
- * imply moving cloud — that's the host's call, not the SDK's.
- *
- * **Local dev story:** Phase 1 (`docker`) runs everywhere. Phase 2
- * (`e2b` / `fly-machines`) hits the managed service from a dev
- * laptop with no infra setup. Phase 3 (`firecracker` / `gvisor`)
- * needs Lima/Colima on macOS or native KVM on Linux — only the
- * adversarial-multi-tenant prod path needs that and it's clearly
- * documented as such.
- *
- * This file is the public surface. Concrete backend implementations
- * land under `./backends/<kind>/` in subsequent commits — the
- * `SandboxBackend` interface here is the contract they implement.
- *
- * Refs: `e2b.dev/docs/sandbox`, `fly.io/docs/machines`,
- * `firecracker-microvm.github.io`, `gvisor.dev/docs`,
- * `cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods`,
- * `aws.amazon.com/blogs/aws/firecracker-lightweight-virtualization-for-serverless-computing`.
+ * @namzu/sandbox — pluggable containment for @namzu/sdk.
+ *
+ * The SDK declares the `SandboxProvider` shape
+ * (`packages/sdk/src/types/sandbox/index.ts`); this package implements
+ * it with concrete BACKENDS chosen at construction time. A backend is
+ * named for the mechanism it drives, because that is what it has to
+ * speak on the wire — never for a system whose ideas it borrowed.
+ *
+ * Two tiers, each a trust boundary:
+ *
+ *  • `container` — one OCI container per task, seccomp on, tmpfs
+ *    workdir, no network unless asked. The same path on a laptop and
+ *    on a Linux replica anywhere. The tier for trusted prompts and
+ *    contained workloads. Boundary: kernel namespaces, or a
+ *    userspace-kernel runtime where one is installed.
+ *
+ *  • `microvm` — one hardware-virtualized guest per task. The boundary
+ *    to reach for when the prompt itself is adversarial, at the cost
+ *    of running or renting the machinery that starts them.
+ *
+ * Every shape in {@link SandboxBackendConfig} has a backend behind it,
+ * which used not to be true: a `process` tier, a `passthrough` tier and
+ * two adapters to third-party schedulers were declared here and never
+ * written, so four of the shapes this package offered could only ever
+ * type-check and then throw. They are gone rather than pending.
+ * Confining an agent to the operator's own host is the SDK's local
+ * sandbox provider, which is implemented; a host that wants no
+ * confinement configures no sandbox.
+ *
+ * namzu does not build its own microVM scheduler. That is a years-long
+ * detour from an agent kernel, and the boundary a guest gives is the
+ * same whoever started it — so the microvm tier is an interface to a
+ * scheduler, not a scheduler.
  */
 import type { ContainerSandboxLayout, Sandbox, SandboxProvider } from '@namzu/sdk';
 export type { ContainerSandboxLayout, ContainerSandboxLayoutMount, ContainerSandboxMountSource, ContainerSandboxSkillMount, ResolvedContainerSandboxLayout, } from '@namzu/sdk';
@@ -71,48 +39,40 @@ export { SANDBOX_DEFAULT_OUTPUTS_PATH, SANDBOX_DEFAULT_SKILLS_PARENT, SANDBOX_DE
 export type { FirecrackerBackendInternalConfig, OrchestratorTokenProvider, } from './backends/firecracker/index.js';
 export { type SandboxAgentHandle, type VsockTransportOptions, VsockAgentTransport, } from './backends/firecracker/transport.js';
 /**
- * Top-level sandbox tier. Each tier is a use-case bucket:
- *
- *   - `process` — the agent runs on the developer's own host;
- *     the sandbox keeps it from reading `~/.ssh` or running
- *     `rm -rf ~`. Single-user; no multi-tenancy. What Anthropic
- *     ships with Claude Code via `@anthropic-ai/sandbox-runtime`.
- *
- *   - `container` — the agent runs inside an OCI container per
- *     task. Same code path locally (`docker compose`) and on
- *     Linux replicas in any cloud. The default for "trusted
- *     prompts, contained workloads" — Northflank, Railway,
- *     Render, Compass-platform, GitHub Actions runners all
- *     ship this tier.
- *
- *   - `microvm` — the agent runs inside a Firecracker microVM
- *     per task. Hardware-virtualization trust boundary; the
- *     industry standard for adversarial multi-tenancy
- *     (AWS Lambda/Fargate, Fly Machines, Replit, E2B, Daytona
- *     all converged here). Sub-second cold-start via
- *     snapshot/restore.
- *
- *   - `passthrough` — no isolation; for tests and explicitly
- *     trusted environments.
+ * Top-level sandbox tier, and the trust boundary it buys:
+ *
+ *   - `container` — one OCI container per task. Namespaces. The
+ *     default for trusted prompts and contained workloads, and the
+ *     same code path on a laptop and on a Linux replica anywhere.
+ *
+ *   - `microvm` — one hardware-virtualized guest per task. The
+ *     boundary to reach for when the prompt itself is adversarial.
+ *
+ * Two tiers, not four. A `process` tier and a `passthrough` tier were
+ * declared here and never built: every construction threw, so the
+ * only thing they offered a caller was a shape that compiles and an
+ * exception at runtime. Confining the agent to the operator's own
+ * host is the SDK's local sandbox provider, which is implemented; a
+ * host that wants no confinement configures no sandbox.
  *
  * The concrete implementation inside a tier is picked via the
- * tier-specific config (see {@link ProcessBackendConfig},
- * {@link ContainerBackendConfig}, {@link MicroVMBackendConfig}).
+ * tier-specific config (see {@link ContainerBackendConfig},
+ * {@link MicroVMBackendConfig}).
  */
-export type SandboxTier = 'process' | 'container' | 'microvm' | 'passthrough';
+export type SandboxTier = 'container' | 'microvm';
 /**
  * Discriminated union of sandbox backend configurations. Each
  * tier has its own configuration shape — picking a tier picks the
  * shape automatically via TS narrowing.
  */
-export type SandboxBackendConfig = ProcessBackendConfig | ContainerBackendConfig | ACIStandbyPoolBackendConfig | MicroVMBackendConfig | PassthroughBackendConfig;
+export type SandboxBackendConfig = ContainerBackendConfig | ACIStandbyPoolBackendConfig | MicroVMBackendConfig;
 /**
  * Azure Container Instances Standby Pool backend. Container tier,
  * managed-microvm-ish: every claim is a fresh ACI container group
  * pre-warmed in an Azure-managed standby pool (`Microsoft.StandbyPool`).
  * ~1.5 s claim latency vs ~10-30 s for cold ACI spawn. Trust boundary
- * = Microsoft's ACI isolation host (gVisor-equivalent depending on
- * SKU; AMD SEV-SNP TEE when the pool is created with sku=Confidential).
+ * = the provider's isolation host, whose strength varies by SKU; the
+ * Confidential SKU adds an AMD SEV-SNP trusted execution environment.
  *
  * No host filesystem — workspace mounts ride `azureFileShare` sources
  * (the host provisions a per-task Azure Files share upstream and
@@ -154,33 +114,17 @@ export interface ACIStandbyPoolBackendConfig {
      */
     readonly containerNamePrefix?: string;
 }
-/**
- * `process` tier. Auto-detects the platform's native primitive
- * unless overridden:
- *
- *   - `bubblewrap` on Linux / WSL2 (`bwrap`)
- *   - `seatbelt` on macOS (`sandbox-exec`)
- *
- * Both are what `@anthropic-ai/sandbox-runtime` ships. Cold-start
- * is process spawn (~ms). Use this when the agent runs on the
- * end-user's developer machine — Claude Code's deployment model.
- */
-export interface ProcessBackendConfig {
-    readonly tier: 'process';
-    readonly engine?: 'auto' | 'bubblewrap' | 'seatbelt';
-}
 /**
  * `container` tier. Two runtime options:
  *
  *   - `docker` (default) — plain OCI container on the host's
  *     Docker daemon. No special runtime required.
- *   - `runsc` — Google's gVisor userspace-kernel runtime. Stronger
- *     isolation (syscall-table separation), runs on commodity
- *     Linux without nested virt. Trusted-tenant tier; what OpenAI
- *     Code Interpreter and Modal Labs ship. Requires the
- *     `runsc` runtime installed on the Docker daemon (Linux only;
- *     Docker Desktop on macOS does not support it). See
- *     `gvisor.dev/docs/user_guide/quick_start/docker`.
+ *   - `runsc` — a userspace-kernel runtime: the guest's syscalls
+ *     are served by a user-space implementation rather than the
+ *     host kernel, which is a stronger boundary than namespaces and
+ *     runs on commodity Linux without nested virtualization.
+ *     Requires the runtime installed on the container daemon (Linux
+ *     only).
  *
  * `image` is the container image to spawn per task. The package
  * ships a reference Dockerfile (compass-platform pattern) with
@@ -227,63 +171,38 @@ export interface ContainerBackendConfig {
     readonly labels?: Readonly<Record<string, string>>;
 }
 /**
- * `microvm` tier. Three concrete services, all Firecracker under
- * the hood:
- *
- *   - `e2b` — adapter for E2B's managed sandbox service
- *     (`e2b.dev`). TS SDK does the scheduler work; namzu wraps it.
- *     ~150ms cold-start (snapshot/restore). Apache-2.0 server side,
- *     so the same code path can run against self-hosted E2B if
- *     the host eventually wants to leave the managed service.
- *   - `fly-machines` — adapter for Fly Machines
- *     (`fly.io/docs/machines`). Closer to bare-metal control than
- *     E2B; the right tier when the workload is "arbitrary tool
- *     calls" rather than "Python REPL".
- *   - `self-hosted` — direct `firecracker-containerd` against a
- *     KVM-enabled host. For deployments where E2B and Fly are
- *     both off the table for policy reasons. Operationally the
- *     heaviest path; everything below ships first.
- *
- * Local dev: `e2b` and `fly-machines` work from any laptop with
- * an API key (no infra setup). `self-hosted` requires Linux + KVM
- * (Lima/Colima on macOS).
+ * `microvm` tier, against namzu's own guest orchestrator.
+ *
+ * Two adapters to third-party managed schedulers were declared here
+ * and never written: both threw on construction, and each demanded
+ * required credentials for a call that was never made. A config
+ * shape whose only reachable outcome is an exception is worse than
+ * no shape, because it type-checks.
+ *
+ * What remains is the orchestrator namzu runs: the control plane
+ * mints a guest per task and resumes it copy-on-write from a golden
+ * snapshot, so a cold start is a resume rather than a boot.
  */
 export type MicroVMBackendConfig = {
-    readonly tier: 'microvm';
-    readonly service: 'e2b';
-    readonly apiKey: string;
-    readonly template?: string;
-} | {
-    readonly tier: 'microvm';
-    readonly service: 'fly-machines';
-    readonly apiToken: string;
-    readonly app: string;
-    readonly image: string;
-    readonly region?: string;
-} | {
     readonly tier: 'microvm';
     readonly service: 'self-hosted';
-    readonly firecrackerBinary: string;
-    readonly kernelImage: string;
-    readonly rootfsImage: string;
     /**
-     * The owned-platform seam (ses_051). When these are present the
-     * `self-hosted` arm targets the OWNED Azure Firecracker
-     * orchestrator (`backends/firecracker/`), not a local
-     * `firecracker-containerd`: `orchestratorEndpoint` is the
-     * control-plane base URL, `getToken` mints a bearer for it
-     * (the ACI `getArmToken` closure pattern, so this package keeps
-     * zero Azure-SDK deps), and `template` selects the golden
-     * snapshot revision to CoW-resume.
+     * Control-plane base URL, and the bearer minted for it.
+     *
+     * Both are REQUIRED, which is a correction: they were optional
+     * beside three required fields (`firecrackerBinary`,
+     * `kernelImage`, `rootfsImage`) belonging to a local-daemon shape
+     * that was never implemented. So the only working configuration
+     * had to supply three values nothing reads, and omitting these
+     * two type-checked its way to a runtime throw.
      *
-     * The legacy local-`firecracker-containerd` shape
-     * (`firecrackerBinary`/`kernelImage`/`rootfsImage` only) is
-     * still NOT implemented and throws
-     * {@link SandboxBackendNotImplementedError}; supplying
-     * `orchestratorEndpoint` is what routes to the owned backend.
+     * `getToken` is a closure rather than a credential, so this
+     * package carries no cloud SDK: the host runtime owns how the
+     * bearer is obtained.
      */
-    readonly orchestratorEndpoint?: string;
-    readonly getToken?: () => Promise<string>;
+    readonly orchestratorEndpoint: string;
+    readonly getToken: () => Promise<string>;
+    /** Golden snapshot revision to resume copy-on-write. */
     readonly template?: string;
     /**
      * Resume this per-agent captured snapshot (layered on its base
@@ -357,13 +276,6 @@ export interface AgentSnapshotRef {
     readonly agentId: string;
     readonly version: string;
 }
-/**
- * `passthrough` tier. No isolation — runs commands directly in
- * the host process. Tests and trusted environments only.
- */
-export interface PassthroughBackendConfig {
-    readonly tier: 'passthrough';
-}
 /**
  * Egress allowlist resolution. Host-supplied policy decides whether
  * an outbound request is allowed before the proxy opens a socket.
@@ -384,6 +296,8 @@ export interface PassthroughBackendConfig {
  *     problem — the host owns the closure, the SDK runtime
  *     doesn't have to forward identity through `provider.create`.
  */
+export { EgressProxy, isHostAllowed, splitAuthority, } from './egress/index.js';
+export type { BrokeredCredential, EgressProxyOptions, RunningEgressProxy, } from './egress/index.js';
 export type EgressPolicy = {
     readonly kind: 'deny-all';
 } | {
@@ -478,7 +392,7 @@ export type SandboxProviderConfig = (SandboxProviderConfigBase & {
     readonly backend: ContainerBackendConfig;
     readonly layout: ContainerSandboxLayout;
 }) | (SandboxProviderConfigBase & {
-    readonly backend: ProcessBackendConfig | MicroVMBackendConfig | PassthroughBackendConfig;
+    readonly backend: MicroVMBackendConfig;
 });
 interface SandboxProviderConfigBase {
     readonly defaultEgress?: EgressPolicy;
@@ -493,25 +407,22 @@ interface SandboxProviderConfigBase {
  * the chosen backend.
  *
  * Backends are loaded lazily — the package only imports the
- * platform-specific modules (Anthropic's sandbox-runtime, the
- * Docker SDK, the E2B SDK, …) when the corresponding backend is
+ * platform-specific modules (the host sandbox runtime, the
+ * Docker SDK, the microVM SDK, …) when the corresponding backend is
  * requested. That keeps `@namzu/sandbox` reasonable to install in
  * environments where one backend is genuinely impossible.
  *
- * **Not implemented in this commit** — this file declares the
- * surface; backends arrive in subsequent commits per the ses_004
- * phase plan:
- *
- *   - **P3.1** — `container` (docker runtime). Phase 1: ship now.
- *   - **P3.2** — `EgressPolicy` plumbing + reference egress proxy.
- *   - **P3.3** — `microvm` (E2B + Fly Machines adapters). Phase 2.
- *   - **P3.4** — `process` (Anthropic sandbox-runtime adapter).
- *   - **P3.5** — `microvm` (self-hosted firecracker-containerd) +
- *     `container` (gVisor runtime). Phase 3 adversarial-multi-tenant.
- *
- * Calling this function now throws
- * {@link SandboxBackendNotImplementedError} so consumers get a
- * clear signal during the staged rollout.
+ * Every shape in {@link SandboxBackendConfig} has a backend behind
+ * it. That is a recent property: this file used to declare a staged
+ * roadmap of tiers and adapters, most of which threw, so the surface
+ * described a plan and the runtime described the truth. The shapes
+ * that were never built are gone rather than pending — a config that
+ * type-checks and can only throw teaches a caller the wrong thing
+ * about what this package does.
+ *
+ * {@link SandboxBackendNotImplementedError} survives for the untyped
+ * caller: a JS host that invents a tier gets a named refusal instead
+ * of a provider that confines nothing.
  */
 export declare function createSandboxProvider(config: SandboxProviderConfig): SandboxProvider;
 /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AASnB,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAM5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,CAAA;AAE7E;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,oBAAoB,GACpB,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,GACpB,wBAAwB,CAAA;AAE3B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,UAAU,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,oBAAoB,GAC7B;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CACzB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACvB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACA,CAAA;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,GAAG,wBAAwB,CAAA;CACvF,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CA+BpF;AAyHD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AASnB,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAM5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,CAAA;AAEvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CA+BpF;AAuHD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}

package/dist/index.js

@@ -1,69 +1,37 @@
 /**
- * @namzu/sandbox — pluggable sandbox provider for @namzu/sdk.
+ * @namzu/sandbox — pluggable containment for @namzu/sdk.
  *
- * The SDK already declares a `SandboxProvider` shape in
- * `@namzu/sdk` (`packages/sdk/src/types/sandbox/index.ts`). This
- * package implements that shape with concrete BACKENDS picked at
- * construction time. The set is aligned with the 2026 industrial
- * standard for AI-agent code-execution sandboxes:
+ * The SDK declares the `SandboxProvider` shape
+ * (`packages/sdk/src/types/sandbox/index.ts`); this package implements
+ * it with concrete BACKENDS chosen at construction time. A backend is
+ * named for the mechanism it drives, because that is what it has to
+ * speak on the wire — never for a system whose ideas it borrowed.
  *
- *  • `docker` — plain OCI container per task, seccomp default
- *    profile, tmpfs workdir, no-network-by-default. The universal
- *    fallback every namzu host gets locally with `docker compose`
- *    and on every Linux replica in any cloud. What Northflank /
- *    Railway / Render / Compass-platform / GitHub Actions runners
- *    actually ship for code execution. Trust boundary: namespaces.
+ * Two tiers, each a trust boundary:
  *
- *  • `e2b` — adapter for E2B's managed Firecracker microVM service
- *    (`e2b.dev`). Sub-second cold-start via snapshot/restore, full
- *    kernel-level trust boundary. The SaaS-friendly path to real
- *    Firecracker isolation without running our own scheduler.
+ *  • `container` — one OCI container per task, seccomp on, tmpfs
+ *    workdir, no network unless asked. The same path on a laptop and
+ *    on a Linux replica anywhere. The tier for trusted prompts and
+ *    contained workloads. Boundary: kernel namespaces, or a
+ *    userspace-kernel runtime where one is installed.
  *
- *  • `fly-machines` — adapter for Fly Machines (`fly.io/docs/machines`).
- *    Also Firecracker microVMs; closer to bare-metal control than
- *    E2B, useful when the workload is more "arbitrary tool calls"
- *    than "Python REPL".
+ *  • `microvm` — one hardware-virtualized guest per task. The boundary
+ *    to reach for when the prompt itself is adversarial, at the cost
+ *    of running or renting the machinery that starts them.
  *
- *  • `firecracker` — self-hosted `firecracker-containerd` on bare
- *    metal (or KVM-enabled cloud instance). For hosts that need
- *    Firecracker isolation AND insist on running the scheduler
- *    themselves. Tier 3 isolation, highest operational cost.
+ * Every shape in {@link SandboxBackendConfig} has a backend behind it,
+ * which used not to be true: a `process` tier, a `passthrough` tier and
+ * two adapters to third-party schedulers were declared here and never
+ * written, so four of the shapes this package offered could only ever
+ * type-check and then throw. They are gone rather than pending.
+ * Confining an agent to the operator's own host is the SDK's local
+ * sandbox provider, which is implemented; a host that wants no
+ * confinement configures no sandbox.
  *
- *  • `gvisor` — adapter for `runsc` runtime (Google's userspace
- *    kernel). What OpenAI Code Interpreter and Modal Labs ship.
- *    Trusted-tenant tier with near-zero cold-start; runs on
- *    commodity Linux without nested virt. Locally via Linux Docker
- *    runtime; not available on macOS Docker Desktop.
- *
- *  • `passthrough` — no isolation, runs commands directly. For
- *    tests and trusted environments only. Off by default; opt-in.
- *
- * **What we deliberately do NOT build** is yet-another Firecracker
- * scheduler — that is E2B's and Fly's entire product, and writing
- * our own is a years-long detour. We adapt to theirs.
- *
- * **Cloud portability:** the backend interface is cloud-agnostic.
- * `docker` works on every cloud; `e2b` and `fly-machines` are
- * managed services not tied to any cloud; `firecracker` and
- * `gvisor` need infrastructure the host chooses (GKE Sandbox, AWS
- * Fargate, self-hosted KVM, etc.). Picking a stronger backend may
- * imply moving cloud — that's the host's call, not the SDK's.
- *
- * **Local dev story:** Phase 1 (`docker`) runs everywhere. Phase 2
- * (`e2b` / `fly-machines`) hits the managed service from a dev
- * laptop with no infra setup. Phase 3 (`firecracker` / `gvisor`)
- * needs Lima/Colima on macOS or native KVM on Linux — only the
- * adversarial-multi-tenant prod path needs that and it's clearly
- * documented as such.
- *
- * This file is the public surface. Concrete backend implementations
- * land under `./backends/<kind>/` in subsequent commits — the
- * `SandboxBackend` interface here is the contract they implement.
- *
- * Refs: `e2b.dev/docs/sandbox`, `fly.io/docs/machines`,
- * `firecracker-microvm.github.io`, `gvisor.dev/docs`,
- * `cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods`,
- * `aws.amazon.com/blogs/aws/firecracker-lightweight-virtualization-for-serverless-computing`.
+ * namzu does not build its own microVM scheduler. That is a years-long
+ * detour from an agent kernel, and the boundary a guest gives is the
+ * same whoever started it — so the microvm tier is an interface to a
+ * scheduler, not a scheduler.
  */
 import { buildAciStandbyPoolBackend } from './backends/aci-standby-pool/index.js';
 import { buildDockerBackend, resolveLayout } from './backends/docker/index.js';
@@ -75,6 +43,27 @@ import { buildFirecrackerBackend } from './backends/firecracker/index.js';
 // `SANDBOX_DEFAULT_OUTPUTS_PATH` instead of hard-coding the string.
 export { SANDBOX_DEFAULT_OUTPUTS_PATH, SANDBOX_DEFAULT_SKILLS_PARENT, SANDBOX_DEFAULT_TOOL_RESULTS_PATH, SANDBOX_DEFAULT_TRANSCRIPTS_PATH, SANDBOX_DEFAULT_UPLOADS_PATH, } from '@namzu/sdk';
 export { VsockAgentTransport, } from './backends/firecracker/transport.js';
+/**
+ * Egress allowlist resolution. Host-supplied policy decides whether
+ * an outbound request is allowed before the proxy opens a socket.
+ *
+ * Four shapes:
+ *
+ *   - `deny-all` — default. Reject every outbound request.
+ *   - `allow-all` — accept every outbound request. Tests only.
+ *   - `static` — fixed allowlist of hostnames at construction.
+ *   - `resolver` — async closure returning the allowlist.
+ *     Parameterless **on purpose**: the resolver is a closure that
+ *     captures whatever context the host has (tenantId, runId,
+ *     auth token, etc.) at provider-construction time. Compass-
+ *     platform's JWT-minting flow already works this way: the
+ *     server knows the tenant when it issues the JWT, and the
+ *     allowlist claim is baked in there. This avoids the
+ *     "where does the resolver get its context from" plumbing
+ *     problem — the host owns the closure, the SDK runtime
+ *     doesn't have to forward identity through `provider.create`.
+ */
+export { EgressProxy, isHostAllowed, splitAuthority, } from './egress/index.js';
 /**
  * Build a {@link SandboxProvider} the SDK can wire into
  * `drainQuery`'s `sandboxProvider` field. Selects the backend at
@@ -82,25 +71,22 @@ export { VsockAgentTransport, } from './backends/firecracker/transport.js';
  * the chosen backend.
  *
  * Backends are loaded lazily — the package only imports the
- * platform-specific modules (Anthropic's sandbox-runtime, the
- * Docker SDK, the E2B SDK, …) when the corresponding backend is
+ * platform-specific modules (the host sandbox runtime, the
+ * Docker SDK, the microVM SDK, …) when the corresponding backend is
  * requested. That keeps `@namzu/sandbox` reasonable to install in
  * environments where one backend is genuinely impossible.
  *
- * **Not implemented in this commit** — this file declares the
- * surface; backends arrive in subsequent commits per the ses_004
- * phase plan:
- *
- *   - **P3.1** — `container` (docker runtime). Phase 1: ship now.
- *   - **P3.2** — `EgressPolicy` plumbing + reference egress proxy.
- *   - **P3.3** — `microvm` (E2B + Fly Machines adapters). Phase 2.
- *   - **P3.4** — `process` (Anthropic sandbox-runtime adapter).
- *   - **P3.5** — `microvm` (self-hosted firecracker-containerd) +
- *     `container` (gVisor runtime). Phase 3 adversarial-multi-tenant.
+ * Every shape in {@link SandboxBackendConfig} has a backend behind
+ * it. That is a recent property: this file used to declare a staged
+ * roadmap of tiers and adapters, most of which threw, so the surface
+ * described a plan and the runtime described the truth. The shapes
+ * that were never built are gone rather than pending — a config that
+ * type-checks and can only throw teaches a caller the wrong thing
+ * about what this package does.
  *
- * Calling this function now throws
- * {@link SandboxBackendNotImplementedError} so consumers get a
- * clear signal during the staged rollout.
+ * {@link SandboxBackendNotImplementedError} survives for the untyped
+ * caller: a JS host that invents a tier gets a named refusal instead
+ * of a provider that confines nothing.
  */
 export function createSandboxProvider(config) {
     const backend = pickBackend(config);
@@ -235,16 +221,12 @@ function pickBackend(config) {
 /**
  * Human-readable backend label for error messages. Returns the
  * tier plus the concrete service / runtime when present, e.g.
- * `'microvm:e2b'` or `'container:runsc'`.
+ * `'microvm:self-hosted'` or `'container:runsc'`.
  */
 function describeBackend(config) {
     if (config.tier === 'microvm')
         return `microvm:${config.service}`;
-    if (config.tier === 'container')
-        return `container:${config.runtime ?? 'docker'}`;
-    if (config.tier === 'process')
-        return `process:${config.engine ?? 'auto'}`;
-    return config.tier;
+    return `container:${config.runtime ?? 'docker'}`;
 }
 // ---------------------------------------------------------------------------
 // Errors