@tangle-network/agent-provider-tangle 1.1.6 → 1.1.8

package/dist/tangle-workspace-branching.js

@@ -1,21 +1,8 @@
-import { ConfidentialAttestationSchema, ConfidentialExecutionRequestSchema, ForkedEnvironmentRefSchema, WorkspaceCheckpointRefSchema, WorkspaceCheckpointRequestSchema, WorkspaceCleanupAcknowledgementSchema, WorkspaceCleanupRequestSchema, WorkspaceForkRequestSchema, WorkspaceOperationLookupRequestSchema, WorkspaceCheckpointResultSchema, WorkspaceCheckpointLookupResultSchema, WorkspaceForkResultSchema, WorkspaceForkLookupResultSchema, canonicalCandidateDigest, confidentialExecutionVerified, sha256Bytes, } from "@tangle-network/agent-interface";
-import { awaitWithSignal, boundedIdentifier, boundedString, assertBoundedJson, MAX_LIST_RESULTS, MAX_STRING_LENGTH, SANDBOX_LIST_PAGE_SIZE, } from "./tangle-contract-safety.js";
-import { encodeTangleConfidentialAttestationQuote, MAX_TEE_EVIDENCE_BYTES, MAX_TEE_MEASUREMENT_BYTES, } from "./tangle-confidential-attestation.js";
-/**
- * Namespace used for provider recovery metadata.
- *
- * The values are identity markers, not security evidence. A marker can tell
- * the provider which request produced a resource, but only the Sandbox
- * operation ledger and the external verifier can prove an outcome.
- */
-const MARKER_PREFIX = "tangle-agent-ws-v1";
-/** Marker namespace used by releases before the 128-byte tag limit. */
-const LEGACY_MARKER_PREFIX = "tangle-agent-sdk:workspace:v1";
-const FORK_METADATA_KEY = "__tangle_agent_workspace_v1";
-const MAX_MARKER_TAG_LENGTH = 128;
-const MARKER_CHUNK_SIZE = 80;
-const LEGACY_MARKER_CHUNK_SIZE = 240;
-const MAX_MARKER_CHUNKS = 512;
+import { ConfidentialAttestationSchema, ConfidentialExecutionRequestSchema, ForkedEnvironmentRefSchema, WorkspaceCheckpointRequestSchema, WorkspaceCleanupAcknowledgementSchema, WorkspaceCleanupRequestSchema, WorkspaceForkRequestSchema, WorkspaceOperationLookupRequestSchema, WorkspaceCheckpointResultSchema, WorkspaceCheckpointLookupResultSchema, WorkspaceForkResultSchema, WorkspaceForkLookupResultSchema, canonicalCandidateDigest, confidentialExecutionVerified, sha256Bytes, } from "@tangle-network/agent-interface";
+import { awaitWithSignal, boundedIdentifier, boundedString, MAX_STRING_LENGTH, cloneJson, safeIdentifier, safeString, } from "./tangle-contract-safety.js";
+import { encodeTangleConfidentialAttestationQuote } from "./tangle-confidential-attestation.js";
+import { checkpointMarkerTags, forkMarkerMetadata, markerBelongsToSource, checkpointMarkerBelongsToSource, checkpointMarkerFromTags, forkMarkerFromMetadata, } from "./tangle-workspace-markers.js";
+import { checkpointRecordFromSnapshot, validSnapshotResult, reconcileCheckpoint, findManagedCheckpoint, findForkByKey, findForkChildById, completeForkChild, findBlockingForks, lookupOutcomeFromSandbox, isoDate, } from "./tangle-workspace-recovery.js";
 const TANGLE_ATTESTATION_NONCE_PATTERN = /^(?:0x)?[0-9a-fA-F]{64}(?:[0-9a-fA-F]{64})?$/;
 function confidentialForkRefusal(request) {
     const confidential = request.confidential;
@@ -532,30 +519,6 @@ function assertCleanupProvider(request, provider) {
         throw new Error("Tangle cleanup provider does not match this provider");
     }
 }
-function checkpointRecordFromSnapshot(request, snapshot) {
-    try {
-        const createdAt = isoDate(snapshot.createdAt);
-        const checkpoint = WorkspaceCheckpointRefSchema.parse({
-            checkpointId: boundedIdentifier(snapshot.snapshotId, "Tangle checkpoint id"),
-            provider: request.source.provider,
-            source: request.source,
-            idempotencyKey: request.idempotencyKey,
-            requestDigest: request.requestDigest,
-            createdAt,
-            ...(request.metadata === undefined
-                ? {}
-                : { metadata: cloneJson(request.metadata) }),
-        });
-        return {
-            request,
-            checkpoint,
-            snapshotId: checkpoint.checkpointId,
-        };
-    }
-    catch {
-        return undefined;
-    }
-}
 async function environmentFromChild(request, child, provider, createdAt, verifier, signal) {
     signal?.throwIfAborted();
     const environmentId = safeIdentifier(child.id);
@@ -621,15 +584,16 @@ async function confidentialAttestationForChild(request, child, provider, verifie
     }
     if (!response ||
         response.sandbox_id !== child.id ||
-        !validTeeReport(response.attestation) ||
+        !response.attestation ||
         safeIdentifier(response.attestationNonce) === undefined ||
         response.attestationNonce !== confidential.nonce) {
         return undefined;
     }
-    const measurement = sha256Bytes(Uint8Array.from(response.attestation.measurement));
+    // The canonical codec validates the complete report before its bytes are used.
     const quote = encodeTangleConfidentialAttestationQuote(response.attestation);
     if (quote === undefined)
         return undefined;
+    const measurement = sha256Bytes(Uint8Array.from(response.attestation.measurement));
     let verifiedAt;
     try {
         verifiedAt = new Date(response.attestation.timestamp * 1_000).toISOString();
@@ -703,447 +667,6 @@ async function confidentialAttestationForChild(request, child, provider, verifie
         ? attestation.data
         : undefined;
 }
-function validTeeReport(report) {
-    return (!!report &&
-        safeIdentifier(report.tee_type) !== undefined &&
-        Array.isArray(report.evidence) &&
-        report.evidence.length <= MAX_TEE_EVIDENCE_BYTES &&
-        report.evidence.every((value) => Number.isInteger(value) && value >= 0 && value <= 255) &&
-        Array.isArray(report.measurement) &&
-        report.measurement.length <= MAX_TEE_MEASUREMENT_BYTES &&
-        report.measurement.every((value) => Number.isInteger(value) && value >= 0 && value <= 255) &&
-        Number.isFinite(report.timestamp) &&
-        report.timestamp > 0);
-}
-function validSnapshotResult(result) {
-    return (!!result &&
-        safeIdentifier(result.snapshotId) !== undefined &&
-        validDate(result.createdAt) &&
-        Array.isArray(result.tags) &&
-        result.tags.every((tag) => safeString(tag) !== undefined));
-}
-function validSnapshotInfo(snapshot, sandboxId) {
-    return (validSnapshotResult(snapshot) &&
-        safeIdentifier(snapshot.sandboxId) !== undefined &&
-        (sandboxId === undefined || snapshot.sandboxId === sandboxId));
-}
-function validOperationRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function validOperationDate(value) {
-    return ((typeof value === "string" || value instanceof Date) && validDate(value));
-}
-function validSnapshotOperationResult(value) {
-    return (validOperationRecord(value) &&
-        safeIdentifier(value.snapshotId) !== undefined &&
-        validOperationDate(value.createdAt));
-}
-function validTaggedSnapshotOperationResult(value) {
-    return (validSnapshotOperationResult(value) &&
-        Array.isArray(value.tags) &&
-        value.tags.every((tag) => safeString(tag) !== undefined));
-}
-function validForkOperationChildResult(value) {
-    return (validOperationRecord(value) &&
-        safeIdentifier(value.sandboxId ?? value.id) !== undefined &&
-        (value.createdAt === undefined ||
-            value.createdAt === null ||
-            validOperationDate(value.createdAt)));
-}
-function checkpointMarkerTags(request) {
-    const marker = {
-        version: 1,
-        kind: "checkpoint",
-        idempotencyKey: request.idempotencyKey,
-        requestDigest: request.requestDigest,
-        request,
-    };
-    return markerTags("checkpoint", request.idempotencyKey, request.requestDigest, marker);
-}
-/** Rebuild the exact tags used by the release before the current safe format. */
-function legacyCheckpointMarkerTags(request) {
-    const marker = {
-        version: 1,
-        kind: "checkpoint",
-        idempotencyKey: request.idempotencyKey,
-        requestDigest: request.requestDigest,
-        request,
-    };
-    const encoded = encodeJson(marker);
-    if (encoded === undefined)
-        throw new Error("workspace marker is not JSON serializable");
-    const base = `${LEGACY_MARKER_PREFIX}:checkpoint`;
-    const chunks = splitIntoChunks(encoded, LEGACY_MARKER_CHUNK_SIZE);
-    if (chunks.length > MAX_MARKER_CHUNKS) {
-        throw new Error("workspace marker exceeds the recovery bound");
-    }
-    return [
-        `${base}:key:${encodeText(request.idempotencyKey)}`,
-        `${base}:digest:${request.requestDigest}`,
-        ...chunks.map((chunk, index) => `${base}:material:${index}:${chunks.length}:${chunk}`),
-    ];
-}
-function forkMarkerMetadata(request, materialization = "snapshot") {
-    if (request.metadata && Object.hasOwn(request.metadata, FORK_METADATA_KEY)) {
-        throw new Error(`fork metadata reserves ${FORK_METADATA_KEY}`);
-    }
-    const marker = {
-        version: 1,
-        kind: "fork",
-        idempotencyKey: request.idempotencyKey,
-        requestDigest: request.requestDigest,
-        request,
-        ...(materialization === "snapshot" ? { materialization } : {}),
-    };
-    assertBoundedJson(marker);
-    return {
-        ...(request.metadata === undefined ? {} : cloneJson(request.metadata)),
-        [FORK_METADATA_KEY]: marker,
-    };
-}
-/**
- * Ask the Sandbox operation ledger whether a marked checkpoint settled.
- *
- * A marker only names a candidate resource. Nothing is returned to a caller
- * until the ledger reports the operation succeeded.
- */
-async function checkpointOperationLookup(box, marker, signal) {
-    signal?.throwIfAborted();
-    const lookup = await awaitWithSignal(box.getSnapshotOperation?.(marker.idempotencyKey, {
-        tags: marker.legacy
-            ? legacyCheckpointMarkerTags(marker.request)
-            : checkpointMarkerTags(marker.request),
-    }), signal);
-    return lookup;
-}
-/** Read the durable record by its owner-scoped key when no request body remains. */
-async function checkpointOperationLookupByKey(box, idempotencyKey, signal) {
-    signal?.throwIfAborted();
-    return await awaitWithSignal(box.getSnapshotOperation?.(idempotencyKey), signal);
-}
-async function checkpointOperationSucceeded(box, marker, signal) {
-    const lookup = await checkpointOperationLookup(box, marker, signal);
-    return (lookup?.outcome === "found" &&
-        lookup.kind === "checkpoint" &&
-        lookup.state === "succeeded");
-}
-/** Confirm a fork child through its marker or the legacy fork ledger. */
-async function forkOperationLookup(box, marker, signal) {
-    if (marker.materialization === "snapshot") {
-        return {
-            outcome: "found",
-            kind: "fork",
-            state: "succeeded",
-        };
-    }
-    const lookup = await awaitWithSignal(box.getForkOperation?.(marker.idempotencyKey, {
-        count: 1,
-        metadata: forkMarkerMetadata(marker.request, marker.materialization),
-    }), signal);
-    return lookup;
-}
-async function forkOperationSucceeded(box, marker, signal) {
-    const lookup = await forkOperationLookup(box, marker, signal);
-    return (lookup?.outcome === "found" &&
-        lookup.kind === "fork" &&
-        lookup.state === "succeeded");
-}
-function markerTags(kind, idempotencyKey, requestDigest, marker) {
-    const encoded = encodeJson(marker);
-    if (encoded === undefined)
-        throw new Error("workspace marker is not JSON serializable");
-    const base = `${MARKER_PREFIX}-${kind}`;
-    const chunks = split(encoded);
-    if (chunks.length > MAX_MARKER_CHUNKS) {
-        throw new Error("workspace marker exceeds the recovery bound");
-    }
-    return [
-        `${base}-key-${markerKeyDigest(idempotencyKey).replace(":", "-")}`,
-        `${base}-digest-${requestDigest.replace(":", "-")}`,
-        ...chunks.map((chunk, index) => `${base}-material-${index}-${chunks.length}-${chunk}`),
-    ].map((tag) => {
-        if (Buffer.byteLength(tag, "utf8") > MAX_MARKER_TAG_LENGTH) {
-            throw new Error("workspace marker tag exceeds the platform bound");
-        }
-        return tag;
-    });
-}
-async function findCheckpointByKey(box, provider, key, signal) {
-    let snapshots;
-    try {
-        signal?.throwIfAborted();
-        const listed = await awaitWithSignal(box.listSnapshots?.(), signal);
-        if (!Array.isArray(listed))
-            return undefined;
-        snapshots = listed;
-    }
-    catch {
-        signal?.throwIfAborted();
-        return undefined;
-    }
-    if (!Array.isArray(snapshots) || snapshots.length > MAX_LIST_RESULTS) {
-        return undefined;
-    }
-    const snapshotIds = new Set();
-    let found;
-    let unresolved = false;
-    for (const snapshot of snapshots) {
-        if (!validSnapshotInfo(snapshot, box.id))
-            return undefined;
-        if (snapshotIds.has(snapshot.snapshotId))
-            return undefined;
-        snapshotIds.add(snapshot.snapshotId);
-        const marker = checkpointMarkerFromTags(snapshot.tags, key);
-        if (!marker)
-            continue;
-        if (!checkpointMarkerBelongsToSource(marker, provider, box.id)) {
-            return undefined;
-        }
-        try {
-            const lookup = await checkpointOperationLookup(box, marker, signal);
-            if (lookup?.outcome === "found" &&
-                lookup.kind === "checkpoint" &&
-                lookup.state === "succeeded") {
-                const authoritative = snapshotFromOperationResult(snapshot, lookup);
-                if (authoritative === undefined)
-                    return undefined;
-                if (found !== undefined)
-                    return undefined;
-                found = { state: "found", snapshot: authoritative, marker };
-                continue;
-            }
-            unresolved = true;
-        }
-        catch {
-            signal?.throwIfAborted();
-            return undefined;
-        }
-    }
-    if (found !== undefined)
-        return found;
-    if (unresolved)
-        return undefined;
-    // Some storage backends retain the snapshot but omit caller tags from a
-    // later inventory read. The owner-scoped operation record retains the exact
-    // acknowledgement, including those tags. Bind that record to a currently
-    // live snapshot id before recovering it; neither record is sufficient alone.
-    let lookup;
-    try {
-        lookup = await checkpointOperationLookupByKey(box, key, signal);
-    }
-    catch {
-        signal?.throwIfAborted();
-        return undefined;
-    }
-    if (lookup?.outcome === "not_found" && lookup.kind === "checkpoint") {
-        return null;
-    }
-    if (lookup?.outcome !== "found" ||
-        lookup.kind !== "checkpoint" ||
-        lookup.state !== "succeeded") {
-        return undefined;
-    }
-    if (snapshots.length === 0)
-        return { state: "retired" };
-    if (!validTaggedSnapshotOperationResult(lookup.result))
-        return undefined;
-    const live = snapshots.filter((snapshot) => snapshot.snapshotId === lookup.result?.snapshotId);
-    if (live.length === 0)
-        return { state: "retired" };
-    if (live.length !== 1)
-        return undefined;
-    const marker = checkpointMarkerFromTags(lookup.result.tags, key);
-    if (!marker ||
-        !checkpointMarkerBelongsToSource(marker, provider, box.id)) {
-        return undefined;
-    }
-    const authoritative = snapshotFromOperationResult(live[0], lookup);
-    return authoritative === undefined
-        ? undefined
-        : { state: "found", snapshot: authoritative, marker };
-}
-/** Normalize one remote checkpoint recovery attempt for every caller. */
-async function reconcileCheckpoint(box, provider, request, signal) {
-    const recovered = await findCheckpointByKey(box, provider, request.idempotencyKey, signal);
-    if (recovered === undefined) {
-        return { state: "undecided", reason: "inventory_unavailable" };
-    }
-    if (recovered === null)
-        return { state: "absent" };
-    if (recovered.state === "retired")
-        return recovered;
-    if (recovered.marker.requestDigest !== request.requestDigest) {
-        return {
-            state: "conflict",
-            existingRequestDigest: recovered.marker.requestDigest,
-        };
-    }
-    const record = checkpointRecordFromSnapshot(recovered.marker.request, recovered.snapshot);
-    return record === undefined
-        ? { state: "undecided", reason: "metadata_invalid" }
-        : { state: "found", record };
-}
-/**
- * Prefer the durable operation result over inventory metadata.
- *
- * Snapshot inventory and the operation ledger can expose different creation
- * timestamps. The ledger result is the acknowledgement returned by the
- * idempotent operation, so recovery must rebuild the exact checkpoint ref
- * from it when the service provides that result.
- */
-function snapshotFromOperationResult(snapshot, lookup) {
-    if (lookup.result === undefined)
-        return snapshot;
-    if (!validSnapshotOperationResult(lookup.result) ||
-        lookup.result.snapshotId !== snapshot.snapshotId) {
-        return undefined;
-    }
-    return { ...snapshot, createdAt: lookup.result.createdAt };
-}
-/**
- * Confirm that one snapshot id is a settled checkpoint this provider created.
- *
- * `expected` binds the answer to a specific checkpoint reference. A reference
- * that does not match its marker is absent, not unknown: the caller supplied a
- * checkpoint this source never produced.
- */
-async function findManagedCheckpoint(box, provider, id, expected, signal) {
-    try {
-        const snapshots = await awaitWithSignal(box.listSnapshots?.(), signal);
-        if (!Array.isArray(snapshots) || snapshots.length > MAX_LIST_RESULTS) {
-            return "unknown";
-        }
-        const snapshot = snapshots.find((candidate) => candidate.snapshotId === id);
-        if (!snapshot)
-            return false;
-        if (!validSnapshotInfo(snapshot, box.id))
-            return "unknown";
-        const marker = checkpointMarkerFromTags(snapshot.tags, expected?.idempotencyKey);
-        if (!marker)
-            return expected ? false : "unknown";
-        if (marker.request.source.provider !== provider ||
-            marker.request.source.environmentId !== box.id) {
-            return expected ? false : "unknown";
-        }
-        if (expected &&
-            (marker.requestDigest !== expected.requestDigest ||
-                canonicalCandidateDigest(marker.request.source) !==
-                    canonicalCandidateDigest(expected.source))) {
-            return false;
-        }
-        return (await checkpointOperationSucceeded(box, marker, signal))
-            ? true
-            : "unknown";
-    }
-    catch {
-        signal?.throwIfAborted();
-        return "unknown";
-    }
-}
-async function findForkByKey(client, box, provider, key, signal) {
-    const candidates = await listMarkedForkChildren(client, box, provider, key, signal);
-    if (candidates === undefined)
-        return undefined;
-    let unresolved = false;
-    for (const candidate of candidates) {
-        try {
-            const lookup = await forkOperationLookup(box, candidate.marker, signal);
-            if (lookup?.outcome === "found" &&
-                lookup.kind === "fork" &&
-                lookup.state === "succeeded") {
-                const authoritative = childFromOperationResult(candidate.child, lookup);
-                if (authoritative === undefined)
-                    return undefined;
-                return { ...authoritative, marker: candidate.marker };
-            }
-            unresolved = true;
-        }
-        catch {
-            signal?.throwIfAborted();
-            return undefined;
-        }
-    }
-    return unresolved ? undefined : null;
-}
-/**
- * Prefer the durable fork result over account-inventory metadata.
- *
- * Fork inventory can report a child timestamp from a later registry read. The
- * operation ledger stores the original child acknowledgement, which is the
- * stable value required to replay one exact fork reference after a restart.
- * Some Sandbox responses omit that timestamp, so the validated inventory
- * record supplies it only when the operation result does not.
- */
-function childFromOperationResult(child, lookup) {
-    if (lookup.result === undefined) {
-        return { child, createdAt: child.createdAt };
-    }
-    const result = lookup.result;
-    if (!validOperationRecord(result))
-        return undefined;
-    const children = result.children;
-    if (!Array.isArray(children))
-        return undefined;
-    const operationChild = children.find((candidate) => validForkOperationChildResult(candidate) &&
-        (candidate.sandboxId ?? candidate.id) === child.id);
-    if (!operationChild)
-        return undefined;
-    const createdAt = operationChild.createdAt ?? child.createdAt;
-    if (!validOperationDate(createdAt))
-        return undefined;
-    return { child, createdAt };
-}
-async function findForkChildById(client, box, provider, id, signal) {
-    try {
-        if (typeof client.get !== "function")
-            return undefined;
-        const child = await awaitWithSignal(client.get(id, signal ? { signal } : undefined), signal);
-        if (child === null)
-            return null;
-        if (child.id !== id)
-            return undefined;
-        const marker = forkMarkerFromMetadata(child.metadata);
-        if (!marker || !markerBelongsToSource(marker, provider, box.id))
-            return undefined;
-        return (await forkOperationSucceeded(box, marker, signal))
-            ? child
-            : undefined;
-    }
-    catch {
-        signal?.throwIfAborted();
-        return undefined;
-    }
-}
-/**
- * Resolve a complete child identity when an acknowledgement omits durable data.
- *
- * A branch response can precede a richer registry read during a rolling
- * deployment. Recover the exact child when its creation time or provider
- * marker is absent. Never invent either field from the request.
- */
-async function completeForkChild(client, child, signal) {
-    if (child.createdAt !== undefined &&
-        forkMarkerFromMetadata(child.metadata) !== undefined) {
-        return child;
-    }
-    if (typeof client.get !== "function" ||
-        safeIdentifier(child.id) === undefined) {
-        return undefined;
-    }
-    try {
-        const resolved = await awaitWithSignal(client.get(child.id, signal ? { signal } : undefined), signal);
-        if (!resolved ||
-            resolved.id !== child.id ||
-            resolved.createdAt === undefined) {
-            return undefined;
-        }
-        return resolved;
-    }
-    catch {
-        signal?.throwIfAborted();
-        return undefined;
-    }
-}
 /** Remove only a child this exact create call confirmed it created. */
 async function compensateCreatedForkChild(child, outcome, signal) {
     if (outcome !== "created")
@@ -1164,255 +687,6 @@ async function compensateCreatedForkChild(child, outcome, signal) {
         return "unconfirmed";
     }
 }
-async function findBlockingForks(box, client, provider, checkpointId, signal) {
-    const candidates = await listMarkedForkChildren(client, box, provider, undefined, signal);
-    if (candidates === undefined)
-        return undefined;
-    const blocking = new Set();
-    for (const { child, marker } of candidates) {
-        if (marker.request.checkpoint.checkpointId !== checkpointId)
-            continue;
-        try {
-            // A candidate that cannot be confirmed leaves the dependency set
-            // unknown, so cleanup must not proceed on a partial answer.
-            if (!(await forkOperationSucceeded(box, marker, signal)))
-                return undefined;
-            blocking.add(child.id);
-        }
-        catch {
-            signal?.throwIfAborted();
-            return undefined;
-        }
-    }
-    return [...blocking].sort();
-}
-/**
- * Read the complete account inventory through Sandbox offset pages.
- *
- * Sandbox returns only an array, so a short page is the terminal marker. A
- * full page requires another request; stopping there would make recovery
- * report a false absence. Duplicate ids or an inventory above the safety
- * bound make completeness unknowable and therefore fail closed.
- */
-async function listAllSandboxChildren(client, signal) {
-    if (typeof client.list !== "function")
-        return undefined;
-    const children = [];
-    const seen = new Set();
-    let offset = 0;
-    while (true) {
-        signal?.throwIfAborted();
-        let page;
-        try {
-            const listed = await awaitWithSignal(client.list({
-                scope: "all",
-                limit: SANDBOX_LIST_PAGE_SIZE,
-                offset,
-            }), signal);
-            if (!Array.isArray(listed) || listed.length > SANDBOX_LIST_PAGE_SIZE) {
-                return undefined;
-            }
-            page = listed;
-        }
-        catch {
-            signal?.throwIfAborted();
-            return undefined;
-        }
-        for (const child of page) {
-            if (!child ||
-                typeof child !== "object" ||
-                safeIdentifier(child.id) === undefined ||
-                seen.has(child.id)) {
-                return undefined;
-            }
-            seen.add(child.id);
-        }
-        if (children.length + page.length > MAX_LIST_RESULTS)
-            return undefined;
-        children.push(...page);
-        if (page.length < SANDBOX_LIST_PAGE_SIZE)
-            return children;
-        if (offset > Number.MAX_SAFE_INTEGER - SANDBOX_LIST_PAGE_SIZE) {
-            return undefined;
-        }
-        offset += SANDBOX_LIST_PAGE_SIZE;
-    }
-}
-/**
- * Read every account child that carries a fork marker this source produced.
- *
- * The scan is the shared front half of fork recovery and cleanup. It returns
- * undefined when the inventory itself cannot be trusted, so both callers fail
- * closed on the same condition.
- */
-async function listMarkedForkChildren(client, box, provider, key, signal) {
-    const children = await listAllSandboxChildren(client, signal);
-    if (children === undefined)
-        return undefined;
-    const marked = [];
-    for (const child of children) {
-        if (!child ||
-            typeof child !== "object" ||
-            safeIdentifier(child.id) === undefined) {
-            return undefined;
-        }
-        if (child.id === box.id)
-            continue;
-        const marker = forkMarkerFromMetadata(child.metadata, key);
-        if (!marker || !markerBelongsToSource(marker, provider, box.id))
-            continue;
-        marked.push({ child, marker });
-    }
-    return marked;
-}
-function markerBelongsToSource(marker, provider, sourceEnvironmentId) {
-    return (marker.request.checkpoint.provider === provider &&
-        marker.request.checkpoint.source.environmentId === sourceEnvironmentId);
-}
-function checkpointMarkerBelongsToSource(marker, provider, sourceEnvironmentId) {
-    return (marker.request.source.provider === provider &&
-        marker.request.source.environmentId === sourceEnvironmentId);
-}
-function checkpointMarkerFromTags(tags, key) {
-    if (!Array.isArray(tags) ||
-        tags.length > MAX_MARKER_CHUNKS + 3 ||
-        !tags.every((tag) => safeString(tag) !== undefined)) {
-        return undefined;
-    }
-    const currentBase = `${MARKER_PREFIX}-checkpoint`;
-    const legacyBase = `${LEGACY_MARKER_PREFIX}:checkpoint`;
-    const hasCurrentTags = tags.some((tag) => tag.startsWith(`${currentBase}-`));
-    const hasLegacyTags = tags.some((tag) => tag.startsWith(`${legacyBase}:`));
-    if (hasCurrentTags === hasLegacyTags)
-        return undefined;
-    if (hasLegacyTags)
-        return legacyCheckpointMarkerFromTags(tags, key, legacyBase);
-    if (tags.some((tag) => Buffer.byteLength(tag, "utf8") > MAX_MARKER_TAG_LENGTH)) {
-        return undefined;
-    }
-    return currentCheckpointMarkerFromTags(tags, key, currentBase);
-}
-function currentCheckpointMarkerFromTags(tags, key, base) {
-    const keyTag = tags.find((tag) => tag.startsWith(`${base}-key-`));
-    if (keyTag &&
-        key !== undefined &&
-        keyTag.slice(`${base}-key-`.length) !==
-            markerKeyDigest(key).replace(":", "-")) {
-        return undefined;
-    }
-    const chunks = tags
-        .map((tag) => {
-        const match = tag.match(new RegExp(`^${escapeRegExp(base)}-material-(\\d+)-(\\d+)-([A-Za-z0-9_-]+)$`));
-        return match
-            ? { index: Number(match[1]), total: Number(match[2]), chunk: match[3] }
-            : undefined;
-    })
-        .filter((value) => value !== undefined)
-        .sort((left, right) => left.index - right.index);
-    if (chunks.length === 0 ||
-        chunks[0].total < 1 ||
-        chunks[0].total > MAX_MARKER_CHUNKS ||
-        chunks[0].total !== chunks.length ||
-        chunks.some((chunk, index) => !Number.isSafeInteger(chunk.index) ||
-            !Number.isSafeInteger(chunk.total) ||
-            chunk.index !== index ||
-            chunk.total !== chunks[0].total)) {
-        return undefined;
-    }
-    const decoded = decodeJson(chunks.map((chunk) => chunk.chunk).join(""));
-    return checkpointMarkerFromUnknown(decoded, key);
-}
-function legacyCheckpointMarkerFromTags(tags, key, base) {
-    const keyTag = tags.find((tag) => tag.startsWith(`${base}:key:`));
-    if (keyTag &&
-        key !== undefined &&
-        decodeText(keyTag.slice(`${base}:key:`.length)) !== key) {
-        return undefined;
-    }
-    const chunks = tags
-        .map((tag) => {
-        const match = tag.match(new RegExp(`^${escapeRegExp(base)}:material:(\\d+):(\\d+):([A-Za-z0-9_-]+)$`));
-        return match
-            ? { index: Number(match[1]), total: Number(match[2]), chunk: match[3] }
-            : undefined;
-    })
-        .filter((value) => value !== undefined)
-        .sort((left, right) => left.index - right.index);
-    if (chunks.length === 0 ||
-        chunks[0].total < 1 ||
-        chunks[0].total > MAX_MARKER_CHUNKS ||
-        chunks[0].total !== chunks.length ||
-        chunks.some((chunk, index) => !Number.isSafeInteger(chunk.index) ||
-            !Number.isSafeInteger(chunk.total) ||
-            chunk.index !== index ||
-            chunk.total !== chunks[0].total)) {
-        return undefined;
-    }
-    const decoded = decodeJson(chunks.map((chunk) => chunk.chunk).join(""));
-    return checkpointMarkerFromUnknown(decoded, key, true);
-}
-function checkpointMarkerFromUnknown(value, key, legacy = false) {
-    if (!value || typeof value !== "object")
-        return undefined;
-    const parsed = value;
-    if (parsed.version !== 1 ||
-        parsed.kind !== "checkpoint" ||
-        typeof parsed.idempotencyKey !== "string" ||
-        typeof parsed.requestDigest !== "string")
-        return undefined;
-    if (key !== undefined && parsed.idempotencyKey !== key)
-        return undefined;
-    const request = WorkspaceCheckpointRequestSchema.safeParse(parsed.request);
-    if (!request.success ||
-        request.data.idempotencyKey !== parsed.idempotencyKey ||
-        request.data.requestDigest !== parsed.requestDigest)
-        return undefined;
-    return {
-        version: 1,
-        kind: "checkpoint",
-        idempotencyKey: parsed.idempotencyKey,
-        requestDigest: parsed.requestDigest,
-        request: request.data,
-        ...(legacy ? { legacy: true } : {}),
-    };
-}
-function forkMarkerFromMetadata(metadata, key) {
-    if (!metadata ||
-        typeof metadata !== "object" ||
-        !Object.hasOwn(metadata, FORK_METADATA_KEY)) {
-        return undefined;
-    }
-    const value = metadata[FORK_METADATA_KEY];
-    if (!value || typeof value !== "object")
-        return undefined;
-    const parsed = value;
-    if (parsed.version !== 1 ||
-        parsed.kind !== "fork" ||
-        typeof parsed.idempotencyKey !== "string" ||
-        typeof parsed.requestDigest !== "string")
-        return undefined;
-    if (parsed.materialization !== undefined &&
-        parsed.materialization !== "snapshot") {
-        return undefined;
-    }
-    if (key !== undefined && parsed.idempotencyKey !== key)
-        return undefined;
-    const request = WorkspaceForkRequestSchema.safeParse(parsed.request);
-    if (!request.success ||
-        request.data.idempotencyKey !== parsed.idempotencyKey ||
-        request.data.requestDigest !== parsed.requestDigest)
-        return undefined;
-    return {
-        version: 1,
-        kind: "fork",
-        idempotencyKey: parsed.idempotencyKey,
-        requestDigest: parsed.requestDigest,
-        request: request.data,
-        ...(parsed.materialization === "snapshot"
-            ? { materialization: "snapshot" }
-            : {}),
-    };
-}
 /**
  * Turn a failed create into a conflict only from provider-owned material.
  *
@@ -1450,38 +724,6 @@ async function forkConflictFromRemote(client, box, provider, request, verifier,
         ? undefined
         : forkSuccess(request, environment, "replayed");
 }
-/**
- * Read a fork ledger answer for a key that left no marked resource behind.
- *
- * `absent` is the settled answer: a decided operation with no inventory marker
- * means the child was cleaned after creation, and the provider must not
- * resurrect it from the ledger. Every other state is undecided for the caller.
- */
-function lookupOutcomeFromSandbox(lookup, kind) {
-    if (!lookup || lookup.kind !== kind) {
-        return {
-            absent: false,
-            message: `Sandbox returned no ${kind} lookup`,
-            retryable: true,
-        };
-    }
-    if (lookup.outcome === "conflict") {
-        return {
-            absent: false,
-            message: "Sandbox found a conflicting operation without provider identity",
-            retryable: false,
-        };
-    }
-    if (lookup.outcome !== "not_found" &&
-        (lookup.outcome === "unknown" || lookup.state !== "succeeded")) {
-        return {
-            absent: false,
-            message: `Sandbox ${kind} operation is not decided`,
-            retryable: true,
-        };
-    }
-    return { absent: true };
-}
 function checkpointSuccess(request, checkpoint, status) {
     return WorkspaceCheckpointResultSchema.parse({
         status,
@@ -1640,85 +882,7 @@ function cleanupTransportFailure(request, message, retryable) {
         retryable,
     });
 }
-function isoDate(value) {
-    const date = value instanceof Date ? value : new Date(value);
-    if (!Number.isFinite(date.getTime()))
-        throw new Error("Sandbox returned an invalid workspace timestamp");
-    return date.toISOString();
-}
-function validDate(value) {
-    if (value === undefined)
-        return false;
-    const date = value instanceof Date ? value : new Date(value);
-    return Number.isFinite(date.getTime());
-}
-function cloneJson(value) {
-    assertBoundedJson(value);
-    return structuredClone(value);
-}
-function safeIdentifier(value) {
-    if (typeof value !== "string" ||
-        value.length === 0 ||
-        value.length > 512 ||
-        value.trim() !== value)
-        return undefined;
-    return value;
-}
-function safeString(value) {
-    if (typeof value !== "string" ||
-        value.length === 0 ||
-        value.length > MAX_STRING_LENGTH)
-        return undefined;
-    return value;
-}
 function safeError(error) {
     const message = error instanceof Error ? error.message : "transport error";
     return message.slice(0, MAX_STRING_LENGTH);
 }
-function encodeText(value) {
-    return Buffer.from(value, "utf8").toString("base64url");
-}
-function decodeText(value) {
-    try {
-        const decoded = Buffer.from(value, "base64url").toString("utf8");
-        return encodeText(decoded) === value ? decoded : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function markerKeyDigest(value) {
-    return sha256Bytes(Buffer.from(value, "utf8"));
-}
-function encodeJson(value) {
-    try {
-        const serialized = JSON.stringify(value);
-        if (serialized === undefined)
-            return undefined;
-        return encodeText(serialized);
-    }
-    catch {
-        return undefined;
-    }
-}
-function decodeJson(value) {
-    try {
-        return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-    }
-    catch {
-        return undefined;
-    }
-}
-function split(value) {
-    return splitIntoChunks(value, MARKER_CHUNK_SIZE);
-}
-function splitIntoChunks(value, chunkSize) {
-    const chunks = [];
-    for (let index = 0; index < value.length; index += chunkSize) {
-        chunks.push(value.slice(index, index + chunkSize));
-    }
-    return chunks;
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}