@tangle-network/agent-runtime 0.197.1 → 0.198.2

package/dist/environment-provider-1fKZh2zl.js

@@ -1,2281 +0,0 @@
-import { $ as promptOptionsFromAgentTurnInput, D as detachedSnapshot, Q as promptFromAgentTurnInput, R as awaitAbortable, X as sameControlCoordinates, o as finalizeRuntimeOwnedPendingExecutor, r as attestRuntimeOwnedPendingExecutor, u as newExecutionAttemptId } from "./materialization-Cy0oM8tb.js";
-import { d as sandboxProgressEvents, f as sandboxTerminalUsageField, n as canonicalStreamEventFromSandboxEvent, o as isSandboxTerminalEvent, r as createSandboxToolPartState } from "./sandbox-events-DbC2WKKS.js";
-import { a as concreteProfileModel, c as profileModelExecutionSettings, o as enforceTokenLimits } from "./model-policy-DKDyr-fc.js";
-import { AgentExactRunControlRefSchema, AgentInteractiveSessionRefSchema, AgentInteractiveSessionStartSchema, AgentRunCancellationRequestSchema, WorkspaceRequestSchema, agentInteractiveSessionRefMatchesStart, canonicalCandidateDigest, canonicalWorkspaceCwd, harnessSystemPromptIntents, workspaceCwdPathForBase } from "@tangle-network/agent-interface";
-import { randomUUID } from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
-import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
-//#region src/runtime/supervise/abortable.ts
-/**
-* One abort race, and one abort cascade, for the supervision tree.
-*
-* Every layer that can be cancelled needs the same three things: the reason a signal
-* carries, an `AbortError` built from it, and a settle-once race between the work and
-* the signal. Written per layer, each drifts — a listener stops being removed on one
-* path, a late resolution overwrites a cancellation that already won, or a cascade
-* forwards no reason and renames every downstream death to the layer's own fallback.
-*
-* The fallback message is the only thing a layer supplies, so the error still names
-* which layer cancelled.
-*/
-/**
-* The reason a signal carries, or `fallback` when it states none.
-*
-* A cascade that drops the upstream reason turns every downstream death into its own generic
-* message: the worker's `down` record then says nothing about WHY, which makes a whole class of
-* child mortality undiagnosable from the journal alone.
-*/
-function abortReason(signal, fallback) {
-	const reason = signal.reason;
-	if (typeof reason === "string" && reason.length > 0) return reason;
-	if (reason instanceof Error && reason.name !== "AbortError" && reason.message.length > 0) return reason.message;
-	return fallback;
-}
-/** An `AbortError` carrying the signal's own string reason, or `fallback` when it states none. */
-function abortError$1(signal, fallback) {
-	const reason = abortReason(signal, fallback);
-	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : fallback);
-	error.name = "AbortError";
-	return error;
-}
-/**
-* Cascade N abort signals into one downstream abort that fires when ANY of them does, carrying
-* that signal's own reason ({@link abortReason}). Node-portable: `AbortSignal.any` needs >=20.3
-* and the package floor is >=20, and it would drop the reason anyway.
-*
-* The one cascade every executor uses, so a reason forwarded here reaches every layer below.
-*/
-function linkAbort(...sources) {
-	const controller = new AbortController();
-	const listeners = [];
-	const release = () => {
-		for (const { source, onAbort } of listeners) source.removeEventListener("abort", onAbort);
-		listeners.length = 0;
-	};
-	const abort = (reason) => {
-		release();
-		controller.abort(reason);
-	};
-	const alreadyAborted = sources.find((source) => source.aborted);
-	if (alreadyAborted !== void 0) {
-		controller.abort(abortReason(alreadyAborted, "aborted by parent scope"));
-		return {
-			signal: controller.signal,
-			abort,
-			release
-		};
-	}
-	for (const source of sources) {
-		const onAbort = () => abort(abortReason(source, "aborted by parent scope"));
-		listeners.push({
-			source,
-			onAbort
-		});
-		source.addEventListener("abort", onAbort, { once: true });
-	}
-	return {
-		signal: controller.signal,
-		abort,
-		release
-	};
-}
-/**
-* Settle `act()` against `signal`. The first outcome wins and the listener is always
-* removed, so neither a late resolution nor a late abort can settle the promise twice.
-* The losing promise stays observed, so a late rejection cannot surface as an unhandled
-* process error.
-*
-* The abort rejection is deferred one microtask so a result the action had ALREADY
-* produced still wins. It does not hand the race to a listener the action registers
-* from inside `act()`: this function subscribes before it calls `act()`, so its own
-* abort handler runs first and settles the promise. A caller that must let the action
-* observe the abort itself has to hold a live promise and await that instead.
-*
-* A synchronous throw from `act()` propagates as the rejection, not as an abort.
-*/
-async function runAbortable(act, signal, fallback) {
-	if (signal.aborted) throw abortError$1(signal, fallback);
-	return await new Promise((resolve, reject) => {
-		let settled = false;
-		const cleanup = () => signal.removeEventListener("abort", onAbort);
-		const onAbort = () => {
-			queueMicrotask(() => {
-				if (settled) return;
-				settled = true;
-				cleanup();
-				reject(abortError$1(signal, fallback));
-			});
-		};
-		signal.addEventListener("abort", onAbort, { once: true });
-		let work;
-		try {
-			work = Promise.resolve(act());
-		} catch (error) {
-			cleanup();
-			reject(error);
-			return;
-		}
-		work.then((value) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			resolve(value);
-		}, (error) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			reject(error);
-		});
-	});
-}
-//#endregion
-//#region src/runtime/util.ts
-/**
-* Best-effort sandbox delete. Skips instances without a `delete` (test fakes);
-* swallows errors (the platform reaps on expiry). Returns `false` when delete
-* threw, `true` otherwise, so callers can surface a leak if they choose.
-*/
-async function deleteBoxSafe(box) {
-	if (!box || typeof box.delete !== "function") return true;
-	try {
-		await box.delete();
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** Short base36 id for trace correlation. Not cryptographic, not collision-free. */
-function randomSuffix(len = 8) {
-	return Math.random().toString(36).slice(2, 2 + len);
-}
-/** Collision-resistant id for sandbox naming (find-by-name recovery must be unique). */
-function randomUuid() {
-	return crypto.randomUUID();
-}
-/** Construct an AbortError. Downstream code pattern-matches on `err.name`. */
-function abortError() {
-	const err = /* @__PURE__ */ new Error("aborted");
-	err.name = "AbortError";
-	return err;
-}
-/** Throw an AbortError. */
-function throwAbort() {
-	throw abortError();
-}
-/** Throw if the signal is already aborted; otherwise no-op. */
-function throwIfAborted$1(signal) {
-	if (signal?.aborted) throw abortError();
-}
-/** True for any error whose `name` is `AbortError` (the cross-kernel abort contract). */
-function isAbortError(err) {
-	return err instanceof Error && err.name === "AbortError";
-}
-/**
-* Sleep that resolves early on abort and always clears its timer so it never
-* keeps the event loop alive. Resolves (does not reject) on abort — callers
-* re-check the signal explicitly after the sleep.
-*/
-function sleep(ms, signal) {
-	return new Promise((resolve) => {
-		if (signal?.aborted) {
-			resolve();
-			return;
-		}
-		let onAbort;
-		const timer = setTimeout(() => {
-			if (onAbort && signal) signal.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		if (signal) {
-			onAbort = () => {
-				clearTimeout(timer);
-				resolve();
-			};
-			signal.addEventListener("abort", onAbort, { once: true });
-		}
-	});
-}
-/**
-* Race a promise against a timeout. Resolves with the value if it settles in
-* time, otherwise resolves with `undefined`. Always clears the timer.
-*/
-function withTimeout(promise, ms) {
-	return new Promise((resolve) => {
-		const timer = setTimeout(() => resolve(void 0), ms);
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, () => {
-			clearTimeout(timer);
-			resolve(void 0);
-		});
-	});
-}
-/**
-* `JSON.stringify` with a `String()` fallback on throw (cyclic / non-JSON).
-* Strings pass through unstringified so a preview of a string output is the
-* string itself, not a quoted re-encoding.
-*/
-function stringifySafe(value, opts = {}) {
-	let s;
-	try {
-		if (typeof value === "string") s = value;
-		else s = (opts.pretty ? JSON.stringify(value, null, 2) : JSON.stringify(value)) ?? String(value);
-	} catch {
-		s = String(value);
-	}
-	if (opts.max !== void 0 && s.length > opts.max) return `${s.slice(0, opts.max)}…`;
-	return s;
-}
-/** A fresh zero token-usage accumulator. */
-function zeroTokenUsage() {
-	return {
-		input: 0,
-		output: 0
-	};
-}
-/**
-* Sum the catalog-priced part of a dollar total across spends, as a field to spread.
-*
-* Returns nothing when no input carried one. A fold of pure provider receipts must not gain a
-* `usdEstimated: 0`, which would read as "this runtime checked and priced none" on a path that
-* never prices at all.
-*/
-function usdEstimatedOf(...spends) {
-	let total = 0;
-	let priced = false;
-	for (const spend of spends) {
-		if (spend.usdEstimated === void 0) continue;
-		priced = true;
-		total += spend.usdEstimated;
-	}
-	return priced ? { usdEstimated: total } : {};
-}
-/** A conserved spend with every channel at zero and no completeness claim on it. */
-function zeroSpend() {
-	return {
-		iterations: 0,
-		tokens: zeroTokenUsage(),
-		usd: 0,
-		ms: 0
-	};
-}
-/**
-* The spend of work that HAPPENED and reported no usage receipt.
-*
-* Not the same value as {@link zeroSpend} even though both carry `{0,0}` tokens and `$0`. A bare
-* zero asserts a MEASUREMENT — "this ran and cost nothing" — and every consumer downstream reads it
-* that way: the pool keeps reporting `readout().tokensKnown === true`, the journal totals stay
-* clean, the OTEL span records a priced zero, and a caller's token-denominated ceiling can never
-* fire no matter how much the work really burned. A ceiling that cannot fire is worse than no
-* ceiling, because it reads as protection.
-*
-* `tokensKnown` is the marker the substrate already threads end to end for exactly this case
-* (`budget.ts`, `otel-spans.ts`, `spawn-journal.ts`, `supervisor.ts`): the work is recorded, the
-* zero is labelled a floor rather than a total, and every rollup that touches it reports its
-* balance as a ceiling rather than a measurement. Use this — never a bare zero — whenever a runtime
-* cannot see what its worker spent.
-*
-* The same rule applies to dollars. A dollar-capped run must refuse an executor whose billed spend
-* is unknowable; `budgetExempt` does not authorize Runtime to relabel unknown spend as a measured
-* zero. Callers that require dollar accounting must use a backend with a trusted billing receipt.
-*/
-function unmeteredSpend(ms) {
-	return {
-		iterations: 0,
-		tokens: zeroTokenUsage(),
-		tokensKnown: false,
-		usd: 0,
-		usdKnown: false,
-		ms
-	};
-}
-/** Copy a conserved spend without dropping a completeness marker or the catalog-priced part. */
-function cloneSpend(spend) {
-	return {
-		iterations: spend.iterations,
-		tokens: cloneTokenUsage(spend.tokens),
-		...spend.tokensKnown === false ? { tokensKnown: false } : {},
-		usd: spend.usd,
-		...spend.usdKnown === false ? { usdKnown: false } : {},
-		...spend.usdEstimated !== void 0 ? { usdEstimated: spend.usdEstimated } : {},
-		ms: spend.ms,
-		...boxMinutesOf(spend)
-	};
-}
-/**
-* Sum two conserved spends per channel. Tokens and dollars never fold into each other, an
-* incomplete input keeps the sum incomplete on that channel, and the catalog-priced part of the
-* dollar total is summed separately so `usd - usdEstimated` still names what a provider billed.
-*/
-function addSpend(a, b) {
-	const tokens = cloneTokenUsage(a.tokens);
-	addTokenUsage(tokens, b.tokens);
-	return {
-		iterations: a.iterations + b.iterations,
-		tokens,
-		...a.tokensKnown === false || b.tokensKnown === false ? { tokensKnown: false } : {},
-		usd: a.usd + b.usd,
-		...a.usdKnown === false || b.usdKnown === false ? { usdKnown: false } : {},
-		...usdEstimatedOf(a, b),
-		ms: a.ms + b.ms,
-		...boxMinutesOf(a, b),
-		...tokensProvenanceOf(a, b)
-	};
-}
-/**
-* Fold the token-provenance channel across spends, as a field to spread.
-*
-* Returns nothing when no contributor stated one, because ABSENT already means "the executor's own
-* live stream", which is what every path reported before a harness store was readable. A
-* contributor that stated one and a contributor that did not therefore disagree, and the sum is
-* `'mixed'` — the honest answer for a tree whose spend came from two kinds of receipt.
-*/
-function tokensProvenanceOf(...spends) {
-	let folded;
-	let sawStated = false;
-	for (const spend of spends) {
-		const stated = spend.tokensProvenance ?? "stream-receipt";
-		if (spend.tokensProvenance !== void 0) sawStated = true;
-		folded = folded === void 0 || folded === stated ? stated : "mixed";
-	}
-	return !sawStated || folded === void 0 || folded === "stream-receipt" ? {} : { tokensProvenance: folded };
-}
-/**
-* Fold the platform box-time channel across spends, as a field to spread.
-*
-* Returns nothing when no input carried the channel, so a fold over router or cli-bridge work —
-* which runs no box at all — never gains a `boxMinutesProvenance: 'uncaptured'` that would claim
-* a box ran and went unmetered.
-*
-* Three rules, one per field:
-*  - `boxMinutes` sums the numbers that are present, and stays ABSENT when none is. A missing
-*    measurement never enters the sum as a zero.
-*  - `boxMinutesKnown` is sticky-false, like `tokensKnown`: one contributor that could not state
-*    its box time makes the whole sum a floor.
-*  - `boxMinutesProvenance` degrades. `'observed'` survives only when every contributor that
-*    carried a number was observed; one derived number makes the sum `'estimated'`; no number at
-*    all is `'uncaptured'`.
-*/
-function boxMinutesOf(...spends) {
-	const present = spends.filter((spend) => spend.boxMinutesProvenance !== void 0);
-	if (present.length === 0) return {};
-	let minutes = 0;
-	let sawNumber = false;
-	let known = true;
-	let observedOnly = true;
-	for (const spend of present) {
-		if (typeof spend.boxMinutes === "number" && Number.isFinite(spend.boxMinutes)) {
-			minutes += spend.boxMinutes;
-			sawNumber = true;
-			if (spend.boxMinutesProvenance !== "observed") observedOnly = false;
-		}
-		if (spend.boxMinutesKnown !== true) known = false;
-	}
-	return {
-		...sawNumber ? { boxMinutes: roundBoxMinutes(minutes) } : {},
-		boxMinutesKnown: known,
-		boxMinutesProvenance: sawNumber ? observedOnly ? "observed" : "estimated" : "uncaptured"
-	};
-}
-/**
-* Box minutes at four decimals — a tenth of a second.
-*
-* Fine enough that a box alive for two seconds reports `0.0333` instead of a zero that would read
-* as a measured free box, and coarse enough that summing floats does not print
-* `1.5000000000000002`.
-*/
-function roundBoxMinutes(minutes) {
-	return Number(minutes.toFixed(4));
-}
-/** Copy a token subtotal without dropping optional provider cache telemetry. */
-function cloneTokenUsage(usage) {
-	const cacheBreakdownUnknown = usage.cacheBreakdownKnown === false || usage.input > 0 && !hasClassifiedCacheBreakdown(usage);
-	return {
-		input: usage.input,
-		output: usage.output,
-		...usage.tokensKnown === false ? { tokensKnown: false } : {},
-		...usage.freshInput !== void 0 ? { freshInput: usage.freshInput } : {},
-		...usage.cacheRead !== void 0 ? { cacheRead: usage.cacheRead } : {},
-		...usage.cacheWrite !== void 0 ? { cacheWrite: usage.cacheWrite } : {},
-		...cacheBreakdownUnknown ? { cacheBreakdownKnown: false } : {}
-	};
-}
-/** True only when every positive prompt token has a consistent cache classification. */
-function hasCompleteCacheBreakdown(usage) {
-	if (usage.cacheBreakdownKnown === false) return false;
-	return hasClassifiedCacheBreakdown(usage);
-}
-function hasClassifiedCacheBreakdown(usage) {
-	if (usage.input === 0) return true;
-	if (usage.freshInput === void 0 || usage.cacheRead === void 0 || usage.cacheWrite === void 0) return false;
-	return usage.freshInput + usage.cacheRead + usage.cacheWrite === usage.input;
-}
-/**
-* The token charge for one observation: every token counted ONCE, at the moment it first enters
-* the context — `input − cacheRead + output`.
-*
-* `input` is a rolled-up prompt total that re-counts a cached prefix on every turn that reads it,
-* so charging `input` makes a 100K prefix read 40 times cost 4.1M for content authored once. A
-* cache read is content that was already charged when it was written, so it is the one class the
-* charge subtracts. Under a complete split the result is exactly `freshInput + cacheWrite`. No
-* price weight is involved: this counts work, and money is a separate channel.
-*
-* The subtraction form is what makes the charge ADDITIVE. `input` and `cacheRead` both accumulate
-* through `addTokenUsage`, so the charge on an aggregate equals the sum of the charges on the
-* records that built it — including an aggregate that mixes classified and unclassified turns,
-* where the unclassified remainder is charged in full and only the reported cache reads are
-* credited. A form that read `freshInput + cacheWrite` directly loses that: one unclassified turn
-* would drop the whole aggregate to `input + output` and over-charge every classified turn with it.
-*
-* The one arithmetic guarantee: a set of classes that does not FIT inside the prompt total it
-* partitions credits nothing, so the charge is never below `output` and a class that overflows its
-* own total buys no tokens. It is not a guarantee against a provider that reports a cache read it
-* never served — that provider can under-report `input` just as easily, and the token channel is an
-* accounting unit, not a trust boundary. Prompt tokens the provider left unclassified are charged
-* in full, so a spend with no readable split charges an upper bound on newly-presented work rather
-* than a measurement, and every caller that enforces a ceiling must report the difference
-* (`BudgetPool` does it through `readout().cacheBreakdownKnown`).
-*/
-function chargedTokens(usage) {
-	return usage.input - creditedCacheRead(usage) + usage.output;
-}
-/** `cacheRead` if the reported classes fit inside `input`, else nothing. */
-function creditedCacheRead(usage) {
-	const { cacheRead } = usage;
-	if (cacheRead === void 0) return 0;
-	return classifiedTotal(usage, cacheRead) > usage.input ? 0 : cacheRead;
-}
-function classifiedTotal(usage, cacheRead) {
-	return (usage.freshInput ?? 0) + cacheRead + (usage.cacheWrite ?? 0);
-}
-/**
-* Translate one provider prompt-cache report into the prompt token classes `addTokenUsage` folds
-* and `chargedTokens` credits.
-*
-* The input is the open `promptCache` record an `llm_call` carries, keyed by the `PromptCacheUsage`
-* vocabulary (`readTokens`, `writeTokens`). Providers report that vocabulary unevenly, and the
-* three outcomes are different facts that must not collapse into one another:
-*
-*  - **Nothing reported** — no classes and no marker. The caller's own unknown handling decides,
-*    because a provider that says nothing about caching has not said the split is unknowable.
-*  - **Read and write both reported, and fitting inside `input`** — a complete partition, so
-*    `freshInput` is the remainder and the split is known.
-*  - **One counter reported, or classes that overflow `input`** — the counters that ARE measured
-*    pass through and `cacheBreakdownKnown` is false. A read with no write counter (OpenAI reports
-*    no write) still credits the read it measured, while declaring the rest unclassified so the
-*    charge stays a declared upper bound. An overflowing claim buys nothing: it cannot be a
-*    partition of a total it exceeds.
-*
-* A counter the provider did not report stays absent. A zero would claim the provider measured no
-* cache, which is a different fact from a provider that did not report.
-*/
-function promptCacheTokenClasses(input, promptCache) {
-	if (promptCache === void 0) return {};
-	const read = tokenCount(promptCache.readTokens);
-	const write = tokenCount(promptCache.writeTokens);
-	if (read === void 0 && write === void 0) return {};
-	if (input === void 0 || (read ?? 0) + (write ?? 0) > input) return { cacheBreakdownKnown: false };
-	if (read !== void 0 && write !== void 0) return {
-		freshInput: input - read - write,
-		cacheRead: read,
-		cacheWrite: write
-	};
-	return {
-		...read !== void 0 ? { cacheRead: read } : {},
-		...write !== void 0 ? { cacheWrite: write } : {},
-		cacheBreakdownKnown: false
-	};
-}
-function tokenCount(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
-}
-/**
-* Add the observed subtotal into `acc`; token and cache incompleteness are sticky.
-*
-* A delta whose classes do not FIT inside its own `input` contributes its prompt total and NO
-* classes. Folding them in would hide the overflow: the accumulator's larger `input` can absorb a
-* class total that overflowed the one delta that reported it, and `chargedTokens` would then credit
-* at the aggregate a cache read it refuses at the record. That is the one way the charge could come
-* out below the sum of the charges on the records that built it.
-*/
-function addTokenUsage(acc, delta) {
-	acc.input += delta.input ?? 0;
-	acc.output += delta.output ?? 0;
-	if (delta.tokensKnown === false) acc.tokensKnown = false;
-	const input = delta.input ?? 0;
-	const fits = classifiedTotal(delta, delta.cacheRead ?? 0) <= input;
-	if (fits) {
-		if (delta.freshInput !== void 0) acc.freshInput = (acc.freshInput ?? 0) + delta.freshInput;
-		if (delta.cacheRead !== void 0) acc.cacheRead = (acc.cacheRead ?? 0) + delta.cacheRead;
-		if (delta.cacheWrite !== void 0) acc.cacheWrite = (acc.cacheWrite ?? 0) + delta.cacheWrite;
-	}
-	const classified = fits && delta.freshInput !== void 0 && delta.cacheRead !== void 0 && delta.cacheWrite !== void 0 && delta.freshInput + delta.cacheRead + delta.cacheWrite === input;
-	if (delta.cacheBreakdownKnown === false || input > 0 && !classified) acc.cacheBreakdownKnown = false;
-}
-/**
-* Map `items` through `fn` with at most `limit` calls in flight at once,
-* preserving input order in the result. On the first `fn` rejection no NEW
-* items are picked up; already-in-flight calls are awaited, then the first
-* error is rethrown. `limit` is clamped to ≥ 1.
-*
-* Used where a burst of provisioning (e.g. forking N child boxes) must respect
-* the loop's concurrency bound instead of firing all N at once.
-*/
-async function mapWithConcurrency(items, limit, fn) {
-	const bound = Math.max(1, Math.floor(limit));
-	const results = new Array(items.length);
-	let next = 0;
-	let failed = false;
-	const worker = async () => {
-		while (!failed) {
-			const i = next;
-			next += 1;
-			if (i >= items.length) return;
-			try {
-				results[i] = await fn(items[i], i);
-			} catch (err) {
-				failed = true;
-				throw err;
-			}
-		}
-	};
-	const workerCount = Math.min(bound, items.length);
-	await Promise.all(Array.from({ length: workerCount }, () => worker()));
-	return results;
-}
-//#endregion
-//#region src/runtime/tangle-sandbox-exact-process-provider.ts
-const exactProcessProviderMarker = "agent-runtime.exact-process-provider";
-const exactProcessEgressMarker = "agent-runtime.exact-process-egress";
-/**
-* Adapt Tangle Sandbox's managed control runtime to Runtime's exact-process provider.
-*
-* The adapter deliberately exposes no ordinary agent environment: an exact experiment
-* must start a fresh Sandbox with no managed agent and launch its declared argv directly.
-*/
-function createTangleSandboxExactProcessProvider(client, options = {}) {
-	const name = options.name ?? "tangle-sandbox-exact-process";
-	if (!name.trim()) throw new Error("Tangle Sandbox exact-process provider name must not be empty");
-	return {
-		name,
-		exactProcess: {
-			async create(input) {
-				throwIfAborted(input.signal);
-				assertNoProviderOptions(input.providerOptions);
-				const egressPolicy = sandboxEgressPolicy(input.egress);
-				const metadata = exactMetadata(input.metadata, name, egressPolicy);
-				const sandbox = await client.create({
-					environment: requiredText(input.image, "exact-process image"),
-					agent: false,
-					bare: false,
-					ephemeral: true,
-					egressPolicy,
-					resources: sandboxResources(input),
-					maxLifetimeSeconds: sandboxLifetimeSeconds(input.maxLifetimeMs),
-					metadata,
-					idempotencyKey: requiredText(input.idempotencyKey, "exact-process idempotency key")
-				}, {
-					...input.provisionTimeoutMs === void 0 ? {} : { timeoutMs: positiveInteger(input.provisionTimeoutMs, "provision timeout") },
-					...input.signal === void 0 ? {} : { signal: input.signal }
-				});
-				try {
-					throwIfAborted(input.signal);
-					assertExactSandboxMetadata(sandbox, metadata);
-					await assertExactSandboxEgress(sandbox, egressPolicy);
-				} catch (error) {
-					await discardInvalidSandbox(sandbox, error);
-				}
-				return sandboxAsExactProcessEnvironment(sandbox, name);
-			},
-			async get(id) {
-				const sandbox = await client.get(id);
-				if (!sandbox || !isExactSandbox(sandbox, name)) return null;
-				await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
-				return sandboxAsExactProcessEnvironment(sandbox, name);
-			},
-			async list(query) {
-				assertNoProviderOptions(query?.providerOptions);
-				const sandboxes = await client.list();
-				return Promise.all(sandboxes.filter((sandbox) => isExactSandbox(sandbox, name)).filter((sandbox) => metadataMatches(sandbox.metadata, query?.metadata)).map(async (sandbox) => {
-					await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata));
-					return sandboxAsExactProcessEnvironment(sandbox, name);
-				}));
-			}
-		},
-		capabilities: exactProcessOnlyCapabilities,
-		async create() {
-			throw new Error(`agent environment provider "${name}" supports exactProcess.create() only`);
-		}
-	};
-}
-function sandboxAsExactProcessEnvironment(sandbox, provider) {
-	return {
-		id: requiredText(sandbox.id, "Sandbox id"),
-		provider,
-		...sandbox.metadata ? { metadata: sandbox.metadata } : {},
-		process: {
-			async list() {
-				return (await sandbox.process.list()).map((status) => exactProcessStatus(status));
-			},
-			async get(pid) {
-				const process = await sandbox.process.get(pid);
-				return process ? sandboxProcessAsExactProcess(process) : null;
-			},
-			async spawn(input, options) {
-				return sandboxProcessAsExactProcess(await afterAbortCheck(options?.signal, () => sandbox.process.spawnExact(input.executable, [...input.args], {
-					cwd: input.cwd,
-					env: { ...input.env },
-					inheritEnv: false,
-					...input.stdin === void 0 ? {} : { stdin: input.stdin },
-					timeoutMs: input.timeoutMs
-				})));
-			}
-		},
-		async writeFile(path, bytes, options) {
-			if (sandbox.fs.supportsWriteMode !== true) throw new Error("Tangle Sandbox does not declare exact file-mode support");
-			await afterAbortCheck(options.signal, () => sandbox.fs.write(path, Buffer.from(bytes).toString("base64"), {
-				encoding: "base64",
-				mode: fileMode(options.mode)
-			}));
-		},
-		async readFile(path, options) {
-			const maxBytes = nonnegativeInteger(options.maxBytes, "exact-process file read maximum");
-			const initialSize = nonnegativeInteger((await afterAbortCheck(options.signal, () => sandbox.fs.stat(path))).size, `Tangle Sandbox file size for "${path}"`);
-			if (initialSize > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
-			const result = await afterAbortCheck(options.signal, () => sandbox.fs.readBatch([path], { encoding: "base64" }));
-			const failure = result.errors.find((entry) => entry.path === path);
-			if (failure) throw new Error(`Tangle Sandbox failed to read "${path}": ${failure.error}`);
-			const files = result.files.filter((entry) => entry.path === path);
-			if (files.length !== 1) throw new Error(`Tangle Sandbox returned ${files.length} files for exact read "${path}"`);
-			const file = files[0];
-			if (file.encoding !== "base64") throw new Error(`Tangle Sandbox returned non-binary content for exact read "${path}"`);
-			const size = nonnegativeInteger(file.size, `Tangle Sandbox file size for "${path}"`);
-			if (size !== initialSize) throw new Error(`Tangle Sandbox file "${path}" changed during exact read`);
-			if (size > maxBytes) throw new Error(`Tangle Sandbox file "${path}" exceeds the ${maxBytes}-byte exact read maximum`);
-			const bytes = Buffer.from(file.content, "base64");
-			if (bytes.byteLength !== size || bytes.toString("base64") !== file.content) throw new Error(`Tangle Sandbox returned an invalid binary payload for exact read "${path}"`);
-			return Uint8Array.from(bytes);
-		},
-		async destroy() {
-			await sandbox.delete();
-		}
-	};
-}
-function sandboxProcessAsExactProcess(process) {
-	const pid = positiveInteger(process.pid, "Tangle Sandbox process pid");
-	return {
-		pid,
-		async status() {
-			return exactProcessStatus(await process.status(), pid);
-		},
-		async wait() {
-			const waitExitCode = await process.wait();
-			if (!Number.isSafeInteger(waitExitCode)) throw new Error("Tangle Sandbox process wait returned an invalid exit code");
-			const status = exactProcessStatus(await process.status(), pid);
-			if (status.running || !status.termination) throw new Error("Tangle Sandbox process wait returned before terminal status");
-			if (status.termination.kind === "exit" && status.termination.exitCode !== waitExitCode) throw new Error("Tangle Sandbox process wait and status disagree on exit code");
-			return status.termination;
-		},
-		async kill() {
-			await process.kill("SIGKILL", { tree: true });
-		},
-		async *stdout() {
-			yield* process.stdout();
-		},
-		async *stderr() {
-			yield* process.stderr();
-		}
-	};
-}
-function exactProcessStatus(status, expectedPid) {
-	const pid = positiveInteger(status.pid, "Tangle Sandbox process pid");
-	if (expectedPid !== void 0 && pid !== expectedPid) throw new Error("Tangle Sandbox process status changed process identity");
-	if (typeof status.running !== "boolean") throw new Error("Tangle Sandbox process status is missing running state");
-	if (!Number.isSafeInteger(status.exitCode)) throw new Error("Tangle Sandbox process status is missing an integer exit code");
-	const exitSignal = optionalText(status.exitSignal, "Tangle Sandbox process exit signal");
-	if (status.running) {
-		if (status.exitCode !== -1) throw new Error("Tangle Sandbox running process must report exit code -1");
-		if (exitSignal) throw new Error("Tangle Sandbox running process must not report an exit signal");
-		return {
-			pid,
-			running: true,
-			exitCode: -1
-		};
-	}
-	const termination = exitSignal ? {
-		kind: "signal",
-		signal: exitSignal
-	} : status.exitCode >= 0 ? {
-		kind: "exit",
-		exitCode: status.exitCode
-	} : void 0;
-	if (!termination) throw new Error("Tangle Sandbox stopped process has no terminal reason");
-	return {
-		pid,
-		running: false,
-		exitCode: status.exitCode,
-		...exitSignal ? { exitSignal } : {},
-		termination
-	};
-}
-function exactMetadata(metadata, provider, egressPolicy) {
-	for (const marker of [exactProcessProviderMarker, exactProcessEgressMarker]) if (Object.hasOwn(metadata, marker)) throw new Error(`exact-process metadata must not set "${marker}"`);
-	return {
-		...metadata,
-		[exactProcessProviderMarker]: provider,
-		[exactProcessEgressMarker]: serializeEgressPolicy(egressPolicy)
-	};
-}
-function isExactSandbox(sandbox, provider) {
-	return sandbox.metadata?.[exactProcessProviderMarker] === provider;
-}
-function metadataMatches(metadata, expected) {
-	return expected === void 0 || Object.entries(expected).every(([key, value]) => isDeepStrictEqual(metadata?.[key], value));
-}
-function assertExactSandboxMetadata(sandbox, expected) {
-	if (!metadataMatches(sandbox.metadata, expected)) throw new Error("Tangle Sandbox did not persist exact-process metadata");
-}
-function egressFromMetadata(metadata) {
-	const encoded = metadata?.[exactProcessEgressMarker];
-	if (typeof encoded !== "string") throw new Error("Tangle Sandbox exact-process environment is missing egress metadata");
-	try {
-		const parsed = JSON.parse(encoded);
-		if (!parsed || typeof parsed !== "object") throw new Error("expected egress object");
-		const policy = parsed;
-		if (policy.mode === "blocked" && policy.allowDomains === void 0) return { mode: "blocked" };
-		if (policy.mode === "strict" && policy.includeImplicitDomains === false && Array.isArray(policy.allowDomains) && policy.allowDomains.every((domain) => typeof domain === "string")) {
-			const allowDomains = sortedDomains(policy.allowDomains);
-			if (new Set(allowDomains).size === allowDomains.length) return {
-				mode: "strict",
-				allowDomains,
-				includeImplicitDomains: false
-			};
-		}
-	} catch {
-		throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
-	}
-	throw new Error("Tangle Sandbox exact-process environment has invalid egress metadata");
-}
-async function assertExactSandboxEgress(sandbox, expected) {
-	const actual = (await sandbox.egress.get()).policy;
-	if (actual.mode !== expected.mode) throw new Error(`Tangle Sandbox egress mismatch: expected ${expected.mode}, received ${actual.mode}`);
-	if (expected.mode === "blocked") {
-		const allowDomains = actual.allowDomains;
-		if (actual.mode === "blocked" && (allowDomains === void 0 || Array.isArray(allowDomains) && allowDomains.length === 0)) return;
-		throw new Error("Tangle Sandbox blocked egress retained an allowlist");
-	}
-	if (actual.mode !== "strict") throw new Error("Tangle Sandbox did not return strict egress policy");
-	const expectedDomains = sortedDomains(expected.allowDomains);
-	if (!isDeepStrictEqual(sortedDomains(actual.allowDomains ?? []), expectedDomains)) throw new Error("Tangle Sandbox strict egress differs from the exact allowlist");
-	if (actual.includeImplicitDomains !== false) throw new Error("Tangle Sandbox strict egress retained implicit domains");
-}
-function sandboxEgressPolicy(input) {
-	if (input.mode === "blocked") return { mode: "blocked" };
-	const allowDomains = input.allowDomains.map((domain) => requiredText(domain, "strict egress domain"));
-	if (new Set(allowDomains).size !== allowDomains.length) throw new Error("strict egress domains must not contain duplicates");
-	return {
-		mode: "strict",
-		allowDomains,
-		includeImplicitDomains: false
-	};
-}
-function serializeEgressPolicy(policy) {
-	return JSON.stringify(policy.mode === "blocked" ? { mode: "blocked" } : {
-		mode: "strict",
-		allowDomains: sortedDomains(policy.allowDomains),
-		includeImplicitDomains: false
-	});
-}
-function sandboxResources(input) {
-	const cpuCores = positiveNumber(input.resources.cpu, "exact-process cpu");
-	const memoryMB = positiveInteger(input.resources.memoryMb, "exact-process memory");
-	const diskMb = positiveInteger(input.resources.diskMb, "exact-process disk");
-	if (diskMb % 1024 !== 0) throw new Error("Tangle Sandbox exact-process disk must be a whole GiB");
-	return {
-		cpuCores,
-		memoryMB,
-		diskGB: diskMb / 1024
-	};
-}
-function sandboxLifetimeSeconds(maxLifetimeMs) {
-	const milliseconds = positiveInteger(maxLifetimeMs, "exact-process maximum lifetime");
-	if (milliseconds % 1e3 !== 0) throw new Error("Tangle Sandbox exact-process maximum lifetime must be a whole number of seconds");
-	return milliseconds / 1e3;
-}
-function fileMode(value) {
-	const mode = nonnegativeInteger(value, "exact-process file mode");
-	if (mode > 4095) throw new Error("exact-process file mode exceeds POSIX mode bits");
-	return mode;
-}
-function assertNoProviderOptions(providerOptions) {
-	if (providerOptions && Object.keys(providerOptions).length > 0) throw new Error("Tangle Sandbox exact-process provider does not accept providerOptions");
-}
-function exactProcessOnlyCapabilities() {
-	return {
-		profile: {
-			namedProfiles: false,
-			systemPrompt: {
-				replace: false,
-				append: false
-			},
-			instructions: false,
-			tools: false,
-			permissions: false,
-			mcp: false,
-			subagents: false,
-			resources: {
-				files: false,
-				instructions: false,
-				tools: false,
-				skills: false,
-				agents: false,
-				commands: false
-			},
-			hooks: false,
-			modes: false,
-			runtimeUpdate: false,
-			validation: false
-		},
-		streaming: {
-			live: false,
-			replay: false,
-			detach: false,
-			turnIdempotency: false
-		},
-		sessions: {
-			continue: false,
-			list: false,
-			messages: false
-		},
-		workspace: {
-			read: false,
-			write: false,
-			exec: false,
-			git: false,
-			upload: false,
-			download: false
-		},
-		branching: {
-			checkpoint: false,
-			fork: false
-		},
-		placement: false,
-		usage: false,
-		confidential: false,
-		exactProcess: { egress: ["blocked", "strict"] }
-	};
-}
-async function discardInvalidSandbox(sandbox, cause) {
-	try {
-		await sandbox.delete();
-	} catch (destroyError) {
-		throw new AggregateError([cause, destroyError], "Tangle Sandbox exact-process creation failed and cleanup failed");
-	}
-	throw cause;
-}
-function sortedDomains(domains) {
-	return [...domains].sort((left, right) => left.localeCompare(right));
-}
-function requiredText(value, label) {
-	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} must be a non-empty string`);
-	return value;
-}
-function optionalText(value, label) {
-	if (value === void 0) return void 0;
-	return requiredText(value, label);
-}
-function positiveNumber(value, label) {
-	if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be positive`);
-	return value;
-}
-function positiveInteger(value, label) {
-	if (!Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
-	return value;
-}
-function nonnegativeInteger(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative integer`);
-	return value;
-}
-function throwIfAborted(signal) {
-	signal?.throwIfAborted();
-}
-async function afterAbortCheck(signal, operation) {
-	throwIfAborted(signal);
-	const result = await operation();
-	throwIfAborted(signal);
-	return result;
-}
-//#endregion
-//#region src/runtime/environment-provider.ts
-var ValidationError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "ValidationError";
-	}
-};
-/** Create a registry that resolves provider names to concrete provider instances.
-* @experimental */
-function createAgentEnvironmentProviderRegistry(providers = []) {
-	const entries = /* @__PURE__ */ new Map();
-	const registry = {
-		register(provider, options = {}) {
-			if (!provider.name) throw new ValidationError("agent environment provider registry: provider.name required");
-			if (!options.replace && entries.has(provider.name)) throw new ValidationError(`agent environment provider registry: provider "${provider.name}" already registered`);
-			entries.set(provider.name, provider);
-		},
-		has(name) {
-			return entries.has(name);
-		},
-		get(name) {
-			return entries.get(name);
-		},
-		require(name) {
-			const provider = entries.get(name);
-			if (!provider) {
-				const available = Array.from(entries.keys()).sort();
-				throw new ValidationError(`agent environment provider registry: provider "${name}" is not registered${available.length > 0 ? `; available: ${available.join(", ")}` : ""}`);
-			}
-			return provider;
-		},
-		names() {
-			return Array.from(entries.keys()).sort();
-		},
-		providers() {
-			return registry.names().map((name) => registry.require(name));
-		},
-		async capabilities(name) {
-			return registry.require(name).capabilities();
-		}
-	};
-	for (const provider of providers) registry.register(provider);
-	return registry;
-}
-/** Resolve a provider instance or registry name, failing loudly when a name is unknown.
-* @experimental */
-function resolveAgentEnvironmentProvider(provider, registry) {
-	if (typeof provider !== "string") return provider;
-	if (!registry) throw new ValidationError(`agent environment provider "${provider}" requires an AgentEnvironmentProviderRegistry`);
-	return registry.require(provider);
-}
-/** Adapt a neutral environment provider to the `SandboxClient` interface used by existing loop paths.
-* @experimental */
-function providerAsSandboxClient(provider, options = {}) {
-	return { async create(createOptions) {
-		const defaults = options.defaults ?? {};
-		const sandboxInput = createInputFromSandboxOptions(createOptions);
-		const customInput = options.mapCreateOptions?.(createOptions) ?? {};
-		const mapped = {
-			...defaults,
-			...sandboxInput,
-			...customInput,
-			providerOptions: {
-				...defaults.providerOptions ?? {},
-				...sandboxInput.providerOptions ?? {},
-				...customInput.providerOptions ?? {}
-			}
-		};
-		if (mapped.backend === void 0) delete mapped.backend;
-		if (mapped.profile === void 0) throw new ValidationError(`providerAsSandboxClient(${provider.name}): profile required in defaults or CreateSandboxOptions.backend.profile`);
-		if (options.requireSession) {
-			const capabilities = await provider.capabilities();
-			if (!capabilities.streaming.live || !capabilities.sessions.continue) throw new ValidationError(`providerAsSandboxClient(${provider.name}): live session continuation is required`);
-		}
-		const environment = await provider.create(mapped);
-		if (options.requireSession && !environment.session) {
-			await environment.destroy?.();
-			throw new ValidationError(`providerAsSandboxClient(${provider.name}): session() is required`);
-		}
-		return environmentAsSandboxInstance(environment, { requireTerminalEvent: options.requireTerminalEvent ?? true });
-	} };
-}
-/**
-* Adapt a `SandboxClient` into the shared `AgentEnvironmentProvider` contract.
-* The provider declares the public SDK contract before it creates an environment.
-* Each environment exposes interactive methods only when its deployment declares every required capability.
-* @experimental */
-function sandboxClientAsProvider(client, options = {}) {
-	const providerName = options.name ?? "tangle-sandbox";
-	const providerCapabilities = async () => {
-		const resolved = await (options.capabilities ? typeof options.capabilities === "function" ? options.capabilities() : options.capabilities : defaultTangleSandboxCapabilities({
-			namedProfiles: options.resolveProfile !== void 0,
-			rediscover: hasGet(client)
-		}));
-		if (hasGet(client)) return resolved;
-		const { interactiveAgent: _interactiveAgent, ...withoutInteractive } = resolved;
-		return withoutInteractive;
-	};
-	return {
-		name: providerName,
-		capabilities: providerCapabilities,
-		...options.validateProfile ? { validateProfile: options.validateProfile } : {},
-		async create(input) {
-			const createOptions = options.mapCreateInput?.(input) ?? await sandboxOptionsFromCreateInput(input, options.defaultBackend ?? "opencode", options.resolveProfile, providerName);
-			const capabilities = await providerCapabilities();
-			return sandboxInstanceAsEnvironment(await client.create(createOptions, input.signal === void 0 ? void 0 : { signal: input.signal }), providerName, client, capabilities);
-		},
-		...hasGet(client) ? { async get(id) {
-			const capabilities = await providerCapabilities();
-			const box = await client.get(id);
-			return box ? sandboxInstanceAsEnvironment(box, providerName, client, capabilities) : null;
-		} } : {},
-		...hasList(client) ? { async list(query) {
-			return (await client.list(query?.providerOptions)).map((box) => ({
-				id: String(box.id),
-				provider: providerName,
-				name: typeof box.name === "string" ? box.name : void 0,
-				status: statusFromUnknown(readBoxStatus(box)),
-				metadata: readBoxMetadata(box)
-			}));
-		} } : {}
-	};
-}
-/**
-* Lower the seam's prompt options onto turn fields, through the one mapper this module already
-* uses to raise a sandbox prompt into a provider turn. Reusing it is what keeps the two directions
-* from drifting: whatever `turnInputFromPrompt` decides a prompt option configures, the seam
-* declares the same way.
-*/
-function providerTurnDefaults(options, context) {
-	if (options === void 0) return void 0;
-	if (options.model !== void 0) throw new ValidationError(`${context}: promptOptions.model is refused — this executor's materialization names AgentProfile's model, so a turn-level override would record a model the provider did not run`);
-	const { prompt: _prompt, parts: _parts, model: _model, sessionId: _sessionId, signal: _signal, ...turn } = turnInputFromPrompt("", options);
-	return turn;
-}
-/**
-* Merge the declared turn defaults under one mapped turn.
-*
-* `providerOptions` is merged one level rather than replaced: the defaults carry the caller's
-* session credential and a `taskToTurn` that sets an unrelated provider option would otherwise
-* remove it, and a run that silently loses its credential fails inside the environment as an
-* authorization error that names nothing.
-*/
-function providerTurnWithDefaults(defaults, turn, signal) {
-	if (defaults === void 0) return {
-		...turn,
-		signal
-	};
-	const providerOptions = defaults.providerOptions === void 0 && turn.providerOptions === void 0 ? void 0 : {
-		...defaults.providerOptions ?? {},
-		...turn.providerOptions ?? {}
-	};
-	return {
-		...defaults,
-		...turn,
-		...providerOptions === void 0 ? {} : { providerOptions },
-		signal
-	};
-}
-/** Adapt an environment provider into an `ExecutorFactory` for `createExecutor`.
-*
-* `createExecutor({ backend: 'provider', provider })` is the composition most callers want; it
-* builds this factory and injects the seam. See `examples/provider-executor/`.
-*
-* Still `@experimental`: the entry point that consumes it, `createExecutor`, carries no stability
-* tag and is therefore experimental by default, so a stable promise here would be reachable only
-* through an experimental symbol.
-*
-* @experimental */
-function providerAsExecutor(provider, options = {}) {
-	return (spec, ctx) => createProviderExecutor(provider, spec.profile, ctx, options);
-}
-function createProviderExecutor(provider, profile, ctx, options) {
-	const controller = linkAbort(ctx.signal);
-	let environment;
-	let artifact;
-	let destroyed = false;
-	const runtime = options.runtime ?? provider.name;
-	const createProfile = options.profileForCreate?.(profile) ?? profile;
-	const executionId = ctx.node?.nodeId ?? `provider-run-${randomUUID()}`;
-	const attemptId = ctx.node?.attemptId ?? newExecutionAttemptId(executionId);
-	const providerModel = concreteProfileModel(createProfile);
-	const tokenLimits = enforceTokenLimits(profileModelExecutionSettings(createProfile, `providerAsExecutor(${provider.name})`).tokenLimits, "provider", `providerAsExecutor(${provider.name})`);
-	const plannedDeclaration = {
-		effectiveProfile: createProfile,
-		backend: provider.name,
-		model: providerModel ? {
-			status: "known",
-			id: providerModel
-		} : {
-			status: "unknown",
-			reason: "provider environment selected its default model"
-		},
-		execution: {
-			kind: "environment",
-			id: executionId
-		},
-		materializer: "environment-provider-create",
-		plan: {
-			kind: "agent-environment",
-			provider: provider.name,
-			destroyOnSettle: options.destroyOnSettle ?? true,
-			requireTerminalEvent: options.requireTerminalEvent ?? true,
-			tokenLimits,
-			environmentId: null
-		}
-	};
-	const plannedBinding = {
-		attemptId,
-		binding: {
-			provider: provider.name,
-			executionId,
-			model: providerModel ?? null
-		},
-		descriptor: {
-			kind: "agent-environment",
-			transport: "provider",
-			backend: provider.name
-		}
-	};
-	let executor;
-	executor = {
-		runtime,
-		execute(task, signal) {
-			return streamProviderExecutor({
-				provider,
-				profile,
-				createProfile,
-				task,
-				signal,
-				controller,
-				options,
-				onEnvironment: (env) => {
-					environment = env;
-					finalizeRuntimeOwnedPendingExecutor(executor, {
-						...plannedDeclaration,
-						execution: {
-							kind: "environment",
-							id: env.id
-						},
-						plan: {
-							...plannedDeclaration.plan,
-							environmentId: env.id
-						}
-					}, plannedBinding);
-				},
-				onArtifact: (next) => {
-					artifact = next;
-				},
-				onDestroyed: () => {
-					destroyed = true;
-				}
-			});
-		},
-		async cancel(request) {
-			controller.abort();
-			return {
-				status: "unknown",
-				effect: "cancel_requested",
-				observedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				detail: `providerAsExecutor(${provider.name}): the streamed turn carries no durable run reference, so the provider acknowledged nothing`,
-				evidence: {
-					operationId: request.operationId,
-					...environment ? { environmentId: environment.id } : {}
-				}
-			};
-		},
-		async teardown(_grace) {
-			controller.abort();
-			if (destroyed || environment === void 0) return { destroyed: true };
-			try {
-				await environment.destroy?.();
-				destroyed = true;
-				return { destroyed: true };
-			} catch (error) {
-				return {
-					destroyed: false,
-					detail: `providerAsExecutor(${provider.name}): environment.destroy() failed — ${error instanceof Error ? error.message : String(error)}`
-				};
-			}
-		},
-		resultArtifact() {
-			if (!artifact) throw new ValidationError(`providerAsExecutor(${provider.name}): resultArtifact() read before stream drained`);
-			return artifact;
-		}
-	};
-	return attestRuntimeOwnedPendingExecutor(executor, runtime, plannedDeclaration, plannedBinding);
-}
-async function* streamProviderExecutor(args) {
-	const started = Date.now();
-	const linked = linkAbort(args.signal, args.controller.signal).signal;
-	const environment = await args.provider.create({
-		...args.options.defaults ?? {},
-		profile: args.createProfile,
-		signal: linked
-	});
-	args.onEnvironment(environment);
-	const turn = providerTurnWithDefaults(providerTurnDefaults(args.options.promptOptions, `providerAsExecutor(${args.provider.name})`), args.options.taskToTurn?.(args.task, args.profile) ?? taskToTurnInput(args.task, linked), linked);
-	const events = [];
-	const tokens = zeroTokenUsage();
-	let sawCompleteTokenReceipt = false;
-	let sawIncompleteTokenReceipt = false;
-	let usd = 0;
-	let text = "";
-	let terminal = false;
-	let explicitFailure = false;
-	let settled;
-	let failure;
-	let failed = false;
-	try {
-		const toolParts = createSandboxToolPartState();
-		const outcomeTracker = createAgentRunOutcomeTracker();
-		for await (const event of environment.stream(turn)) {
-			events.push(event);
-			text += textFromEnvironmentEvent(event);
-			const sandboxEvent = sandboxEventFromEnvironmentEvent(event);
-			const failureEvent = providerFailureEvent(event, sandboxEvent);
-			if (failureEvent) {
-				explicitFailure = true;
-				outcomeTracker.observe(failureEvent);
-			}
-			for (const progress of sandboxProgressEvents(sandboxEvent, toolParts)) yield {
-				kind: "progress",
-				progress
-			};
-			const usage = usageFromEnvironmentEvent(event);
-			if (usage.hasTokenReceipt) if (usage.hasInput && usage.hasOutput) sawCompleteTokenReceipt = true;
-			else sawIncompleteTokenReceipt = true;
-			if (usage.input || usage.output) {
-				tokens.input += usage.input;
-				tokens.output += usage.output;
-				yield {
-					kind: "tokens",
-					input: usage.input,
-					output: usage.output
-				};
-			}
-			if (usage.usd) {
-				usd += usage.usd;
-				yield {
-					kind: "cost",
-					usdKnown: false,
-					usd: usage.usd,
-					provenance: "uncaptured"
-				};
-			}
-			if (isTerminalEnvironmentEvent(event)) terminal = true;
-		}
-		if ((args.options.requireTerminalEvent ?? true) && !terminal) throw new ValidationError(`providerAsExecutor(${args.provider.name}): stream ended without a terminal result/done/status event`);
-		yield { kind: "iteration" };
-		const result = {
-			...resultFromEvents(events, text),
-			...explicitFailure ? { outcome: outcomeTracker.finish() } : {}
-		};
-		const spent = {
-			iterations: 1,
-			tokens,
-			...sawCompleteTokenReceipt && !sawIncompleteTokenReceipt ? {} : { tokensKnown: false },
-			usd,
-			usdKnown: false,
-			ms: Date.now() - started
-		};
-		const verdict = await args.options.validator?.validate(result, {
-			iteration: 0,
-			box: environmentAsSandboxInstance(environment, { requireTerminalEvent: args.options.requireTerminalEvent ?? true }),
-			signal: linked
-		});
-		settled = {
-			outRef: contentRef(`provider:${args.provider.name}`, result),
-			out: result,
-			...verdict ? { verdict } : {},
-			spent
-		};
-		args.onArtifact(settled);
-	} catch (error) {
-		failure = error;
-		failed = true;
-	} finally {
-		if (args.options.destroyOnSettle ?? true) try {
-			await environment.destroy?.();
-			args.onDestroyed();
-		} catch (error) {
-			if (settled !== void 0) args.onArtifact({
-				...settled,
-				teardown: {
-					failed: true,
-					error: error instanceof Error ? error.message : String(error),
-					at: (/* @__PURE__ */ new Date()).toISOString()
-				}
-			});
-			else if (!failed) {
-				failure = error;
-				failed = true;
-			} else failure = failure instanceof Error ? Object.assign(failure, { cause: failure.cause ?? error }) : failure;
-		}
-	}
-	if (failed) throw failure;
-}
-function createInputFromSandboxOptions(options) {
-	const profile = options?.backend?.profile;
-	const backend = options?.backend?.type;
-	const cwd = options?.cwd === void 0 ? void 0 : canonicalWorkspaceCwd({
-		base: "repository",
-		path: options.cwd
-	});
-	const workspace = {
-		...options?.environment ? { environment: options.environment } : {},
-		...options?.git?.url ? { repoUrl: options.git.url } : {},
-		...options?.git?.ref ? { gitRef: options.git.ref } : {},
-		...cwd === void 0 ? {} : { cwd }
-	};
-	return {
-		...profile !== void 0 ? { profile } : {},
-		...backend ? { backend } : {},
-		...Object.keys(workspace).length > 0 ? { workspace } : {},
-		...options?.resources ? { resources: options.resources } : {},
-		...options?.env ? { env: options.env } : {},
-		...Array.isArray(options?.secrets) ? { secrets: options.secrets } : {},
-		...options?.metadata ? { metadata: options.metadata } : {},
-		...options?.name ? { name: options.name } : {},
-		...options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {},
-		providerOptions: { sandboxCreateOptions: options ?? {} }
-	};
-}
-async function sandboxOptionsFromCreateInput(input, defaultBackend, resolveProfile, providerName = "tangle-sandbox") {
-	const backendType = input.backend ?? defaultBackend;
-	const workspace = WorkspaceRequestSchema.parse(input.workspace ?? {});
-	const environment = sandboxEnvironmentFromWorkspace(workspace);
-	const cwd = workspaceCwdPathForBase(workspace.cwd, "repository", providerName);
-	const providerOptions = input.providerOptions?.sandboxCreateOptions;
-	const base = providerOptions && typeof providerOptions === "object" ? { ...providerOptions } : {};
-	assertSandboxSecretNames(input.secrets);
-	assertSandboxSecretNames(base.secrets);
-	const profile = await sandboxProfileFromReference(input.profile, resolveProfile);
-	const { profile: _baseProfile, ...baseBackend } = base.backend ?? {};
-	return {
-		...base,
-		...environment ? { environment } : {},
-		...workspace.repoUrl ? { git: {
-			url: workspace.repoUrl,
-			ref: workspace.gitRef
-		} } : {},
-		...cwd === void 0 ? {} : { cwd },
-		...input.resources ? { resources: input.resources } : {},
-		...input.env ? { env: input.env } : {},
-		...Array.isArray(input.secrets) ? { secrets: input.secrets } : {},
-		...input.metadata ? { metadata: input.metadata } : {},
-		...input.name ? { name: input.name } : {},
-		...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
-		backend: {
-			...baseBackend,
-			type: backendType,
-			profile
-		}
-	};
-}
-function assertSandboxSecretNames(secrets) {
-	if (secrets !== void 0 && secrets !== "all" && (!Array.isArray(secrets) || secrets.some((secret) => typeof secret !== "string" || secret.trim().length === 0))) throw new ValidationError("Tangle Sandbox secret names must be non-empty strings; secret values are unsupported");
-}
-function sandboxEnvironmentFromWorkspace(workspace) {
-	if (workspace.environment !== void 0 && workspace.image !== void 0 && workspace.environment !== workspace.image) throw new ValidationError("Tangle Sandbox accepts one environment value; workspace.environment and workspace.image must match");
-	return workspace.environment ?? workspace.image;
-}
-async function sandboxProfileFromReference(profile, resolveProfile) {
-	if (typeof profile !== "string") return profile;
-	if (!resolveProfile) throw new ValidationError(`Tangle Sandbox requires an inline AgentProfile; named profile "${profile}" needs SandboxClientProviderOptions.resolveProfile`);
-	return resolveProfile(profile);
-}
-function environmentAsSandboxInstance(environment, options) {
-	return {
-		id: environment.id,
-		name: environment.name,
-		status: "running",
-		async refresh() {
-			await environment.refresh?.();
-		},
-		async *streamPrompt(message, promptOptions) {
-			let terminal = false;
-			const input = turnInputFromPrompt(message, promptOptions);
-			let cancellation;
-			let cancellationStarted = false;
-			let cancellationFailed = false;
-			let cancellationError;
-			const cancel = () => {
-				if (cancellationStarted || !input.sessionId || !environment.session) return;
-				cancellationStarted = true;
-				try {
-					const session = environment.session(input.sessionId, {
-						...input.controlRef === void 0 ? {} : { controlRef: input.controlRef },
-						...input.signal === void 0 ? {} : { signal: input.signal }
-					});
-					assertScopedSessionForInput(session, input);
-					cancellation = session.cancel().catch((error) => {
-						cancellationFailed = true;
-						cancellationError = error;
-					});
-				} catch (error) {
-					cancellationFailed = true;
-					cancellationError = error;
-				}
-			};
-			input.signal?.addEventListener("abort", cancel, { once: true });
-			if (input.signal?.aborted) cancel();
-			let streamFailed = false;
-			let streamError;
-			try {
-				for await (const event of environment.stream(input)) {
-					if (isTerminalEnvironmentEvent(event)) terminal = true;
-					const usageEvent = usageSandboxEvent(event);
-					if (usageEvent) yield usageEvent;
-					yield sandboxEventFromEnvironmentEvent(event);
-				}
-			} catch (error) {
-				streamFailed = true;
-				streamError = error;
-			} finally {
-				input.signal?.removeEventListener("abort", cancel);
-				if (input.signal?.aborted) {
-					cancel();
-					await cancellation;
-				}
-			}
-			if (input.signal?.aborted) {
-				const abortError = new DOMException("Provider session stream aborted", "AbortError");
-				const causes = [...streamFailed ? [streamError] : [], ...cancellationFailed ? [cancellationError] : []];
-				if (causes.length > 0) Object.defineProperty(abortError, "cause", { value: causes.length === 1 ? causes[0] : new AggregateError(causes, "Provider stream and cancellation failed") });
-				throw abortError;
-			}
-			if (streamFailed) throw streamError;
-			if (cancellationFailed) throw cancellationError;
-			if (options.requireTerminalEvent && !terminal) throw new ValidationError(`providerAsSandboxClient(${environment.provider}): stream ended without a terminal result/done/status event`);
-		},
-		async prompt(message, promptOptions) {
-			const events = [];
-			let text = "";
-			let usage;
-			let terminal = false;
-			for await (const event of environment.stream(turnInputFromPrompt(message, promptOptions))) {
-				events.push(event);
-				if (isTerminalEnvironmentEvent(event)) terminal = true;
-				text += textFromEnvironmentEvent(event);
-				usage = mergeTokenUsage(usage, event.usage);
-			}
-			if (options.requireTerminalEvent && !terminal) throw new ValidationError(`providerAsSandboxClient(${environment.provider}): prompt ended without a terminal result/done/status event`);
-			return {
-				response: resultFromEvents(events, text).content,
-				success: true,
-				status: "success",
-				durationMs: 0,
-				...usage ? { usage } : {}
-			};
-		},
-		...environment.dispatch && environment.session ? { async dispatchPrompt(message, promptOptions) {
-			const session = await environment.dispatch?.(turnInputFromPrompt(message, promptOptions));
-			if (!session) throw new ValidationError("providerAsSandboxClient: dispatch returned no session");
-			return sandboxDispatchResultFromSessionRef(session);
-		} } : {},
-		...environment.session ? { session(id, sessionOptions) {
-			return sandboxSessionFromAgentSession(environment.session?.(id, sessionOptions), sessionOptions?.controlRef);
-		} } : {},
-		...environment.read ? { read: environment.read.bind(environment) } : {},
-		...environment.write ? { write: environment.write.bind(environment) } : {},
-		...environment.exec ? { exec: environment.exec.bind(environment) } : {},
-		...environment.checkpoint ? { async checkpoint(checkpointOptions) {
-			const checkpoint = await environment.checkpoint?.(checkpointOptions);
-			return {
-				checkpointId: checkpoint?.id,
-				id: checkpoint?.id
-			};
-		} } : {},
-		...environment.fork ? { async fork(checkpointId, forkOptions) {
-			const forked = await environment.fork?.({ id: checkpointId }, forkOptions);
-			if (!forked) throw new ValidationError("providerAsSandboxClient: fork returned no environment");
-			return environmentAsSandboxInstance(forked, options);
-		} } : {},
-		async delete() {
-			await environment.destroy?.();
-		}
-	};
-}
-async function sandboxInstanceAsEnvironment(box, providerName, client, providerCapabilities) {
-	const capabilities = await sandboxEnvironmentCapabilities(box, providerCapabilities);
-	const interactiveAgent = capabilities.interactiveAgent;
-	return {
-		id: String(box.id),
-		provider: providerName,
-		capabilities,
-		...typeof box.name === "string" ? { name: box.name } : {},
-		...readBoxMetadata(box) ? { metadata: readBoxMetadata(box) } : {},
-		async status() {
-			await maybeRefresh(box);
-			return statusFromUnknown(readBoxStatus(box));
-		},
-		async *stream(input) {
-			for await (const event of box.streamPrompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input))) yield environmentEventFromSandboxEvent(event);
-		},
-		...hasDispatchPrompt(box) ? { async dispatch(input) {
-			return sessionRefFromSandboxDispatch(await box.dispatchPrompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input)), providerName);
-		} } : {},
-		...hasSession(box) ? {
-			session(id, sessionOptions) {
-				return sandboxSessionAsAgentSession(box.session(id), sessionOptions?.controlRef);
-			},
-			async respondToInteraction(command, options) {
-				return (await box.session(command.binding.sessionId).respondToInteraction(command, options)).acknowledgement;
-			}
-		} : {},
-		...interactiveAgent ? {
-			async startInteractive(request, options) {
-				const exactRequest = AgentInteractiveSessionStartSchema.parse(request);
-				assertSandboxInteractiveBinding(exactRequest.run, box, providerName);
-				const result = await box.session(exactRequest.run.sessionId).interactive().start(exactRequest, options);
-				if (result.state !== "running") throw new ValidationError("sandbox interactive process settled before attachment");
-				const ref = detachedSnapshot(AgentInteractiveSessionRefSchema.parse(result.ref), "sandbox interactive start reference");
-				if (!agentInteractiveSessionRefMatchesStart(exactRequest, ref)) throw new ValidationError("sandbox interactive start returned a different exact process");
-				return ref;
-			},
-			interactive(ref) {
-				const exactRef = detachedSnapshot(AgentInteractiveSessionRefSchema.parse(ref), "sandbox interactive reference");
-				assertSandboxInteractiveBinding(exactRef.run, box, providerName);
-				const session = box.session(exactRef.run.sessionId).interactive({ ref: exactRef });
-				const controlledSessions = /* @__PURE__ */ new Map();
-				const controlledSession = (control) => {
-					const key = canonicalCandidateDigest(control);
-					const existing = controlledSessions.get(key);
-					if (existing) return existing;
-					const created = box.session(exactRef.run.sessionId).interactive({
-						ref: exactRef,
-						control
-					});
-					controlledSessions.set(key, created);
-					return created;
-				};
-				return {
-					ref: exactRef,
-					claimControl: (request, options) => session.claimControl(request, options),
-					async status(options) {
-						const status = await session.status(options);
-						if (status === null) throw new ValidationError(`sandbox interactive session "${exactRef.run.sessionId}" is unavailable`);
-						return status;
-					},
-					attach: (request, options) => {
-						const controlled = controlledSession(request.control);
-						if (typeof controlled.attachAgentTerminal !== "function") return Promise.reject(new ValidationError("sandbox interactive session does not expose the exact terminal adapter"));
-						return controlled.attachAgentTerminal(request, options);
-					},
-					sendPrompt: (command, options) => controlledSession(command.control).sendPrompt(command, options),
-					stop: (command, options) => controlledSession(command.control).stop(command, options)
-				};
-			}
-		} : {},
-		...hasRead(box) ? { read: box.read.bind(box) } : {},
-		...hasWrite(box) ? { write: box.write.bind(box) } : {},
-		...hasExec(box) ? { async exec(command, options) {
-			return execResultFromSandboxExecResult(await box.exec(command, options));
-		} } : {},
-		async checkpoint(options) {
-			return {
-				id: (await box.snapshot({ ...options?.name ? { tags: [options.name] } : {} })).snapshotId,
-				provider: providerName,
-				...options?.metadata ? { metadata: options.metadata } : {}
-			};
-		},
-		async fork(checkpoint, options) {
-			return sandboxInstanceAsEnvironment(await client.create({
-				fromSnapshot: checkpoint.id,
-				fromSandboxId: String(box.id),
-				...options?.name ? { name: options.name } : {},
-				...options?.metadata ? { metadata: options.metadata } : {}
-			}), providerName, client, providerCapabilities);
-		},
-		async placement() {
-			return placementInfoFromLoopPlacement(client.describePlacement?.(box), box);
-		},
-		async refresh() {
-			await maybeRefresh(box);
-		},
-		async destroy() {
-			await destroyBox(box);
-		}
-	};
-}
-function sandboxSessionAsAgentSession(session, expectedControlRef) {
-	const controlRef = resolveSessionControlRef(session.controlRef, expectedControlRef, { allowExpectedWhenActualAbsent: true });
-	return {
-		id: session.id,
-		...controlRef === void 0 ? {} : { controlRef },
-		async status() {
-			const status = await session.status();
-			if (!status) return null;
-			assertSandboxStatusBinding(status, controlRef);
-			return sessionStatusFromUnknown(status.status);
-		},
-		async *events(options) {
-			const executionId = scopedExecutionId(controlRef, options?.executionId);
-			for await (const event of session.events({
-				...options?.since === void 0 ? {} : { since: options.since },
-				...executionId === void 0 ? {} : { executionId },
-				...options?.signal === void 0 ? {} : { signal: options.signal }
-			})) yield environmentEventFromSandboxEvent(event);
-		},
-		async result(options) {
-			return agentTurnResultFromPromptResult(await awaitAbortable(Promise.resolve().then(() => session.result({ ...controlRef?.executionId === void 0 ? {} : { executionId: controlRef.executionId } })), options?.signal));
-		},
-		async prompt(input) {
-			return agentTurnResultFromPromptResult(await session.prompt(promptFromAgentTurnInput(input), promptOptionsFromAgentTurnInput(input)));
-		},
-		...session.respondToInteraction ? { async respondToInteraction(command, options) {
-			assertInteractionCommandScope(command, controlRef);
-			return (await session.respondToInteraction(command, options)).acknowledgement;
-		} } : {},
-		...session.cancelRun ? { async cancelRun(request, options) {
-			assertCancellationScope(request, controlRef);
-			return session.cancelRun(request, options);
-		} } : {},
-		cancel() {
-			return session.interrupt(controlRef?.executionId === void 0 ? void 0 : { executionId: controlRef.executionId }).then(() => void 0);
-		}
-	};
-}
-function sandboxSessionFromAgentSession(session, expectedControlRef) {
-	if (!session) throw new ValidationError("providerAsSandboxClient: session is unavailable");
-	const controlRef = resolveSessionControlRef(session.controlRef, expectedControlRef);
-	return {
-		id: session.id,
-		...controlRef === void 0 ? {} : { controlRef },
-		async status() {
-			const status = await session.status();
-			if (!status) return null;
-			return {
-				id: session.id,
-				status: sandboxSessionStatusFromAgentSessionStatus(status)
-			};
-		},
-		async *events(options) {
-			const executionId = scopedExecutionId(controlRef, options?.executionId);
-			for await (const event of session.events({
-				...options?.since === void 0 ? {} : { since: options.since },
-				...executionId === void 0 ? {} : { executionId },
-				...options?.signal === void 0 ? {} : { signal: options.signal }
-			})) yield sandboxEventFromEnvironmentEvent(event);
-		},
-		async result(options) {
-			scopedExecutionId(controlRef, options?.executionId);
-			return promptResultFromAgentTurnResult(await session.result());
-		},
-		async prompt(message, options) {
-			return promptResultFromAgentTurnResult(await session.prompt(turnInputFromPrompt(message, options)));
-		},
-		...session.respondToInteraction ? { async respondToInteraction(command, options) {
-			assertInteractionCommandScope(command, controlRef);
-			return { acknowledgement: await session.respondToInteraction(command, options) };
-		} } : {},
-		...session.cancelRun ? { async cancelRun(request, options) {
-			assertCancellationScope(request, controlRef);
-			return session.cancelRun(request, options);
-		} } : {},
-		async interrupt(options) {
-			scopedExecutionId(controlRef, options?.executionId);
-			await session.cancel();
-			return { cancelled: true };
-		}
-	};
-}
-function sandboxSessionStatusFromAgentSessionStatus(status) {
-	switch (status) {
-		case "pending":
-		case "provisioning": return "queued";
-		case "running": return "running";
-		case "completed": return "completed";
-		case "cancelled": return "cancelled";
-		case "stopped":
-		case "failed":
-		case "expired":
-		case "unknown": return "failed";
-	}
-}
-function promptResultFromAgentTurnResult(result) {
-	return {
-		response: result.text,
-		success: result.success,
-		status: result.success ? "success" : "failed",
-		durationMs: 0,
-		...result.error ? { error: result.error } : {},
-		...result.usage ? {
-			usage: {
-				inputTokens: result.usage.inputTokens,
-				outputTokens: result.usage.outputTokens
-			},
-			...result.usage.cost === void 0 ? {} : { costUsd: result.usage.cost }
-		} : {}
-	};
-}
-function environmentEventFromSandboxEvent(event) {
-	const data = event.data && typeof event.data === "object" ? event.data : {};
-	const normalized = canonicalStreamEventFromSandboxEvent(event);
-	const usage = tokenUsageFromData(data);
-	const receipt = tokenUsageReceipt(tokenUsageRecord(data));
-	return {
-		type: String(event.type),
-		data,
-		...event.id ? { id: event.id } : {},
-		...normalized ? { normalized } : {},
-		...usage && receipt.complete ? { usage } : {},
-		providerEvent: event
-	};
-}
-function sandboxEventFromEnvironmentEvent(event) {
-	const normalized = event.normalized;
-	const type = normalized?.type ?? event.type;
-	const baseData = normalized ? sandboxDataFromNormalizedEvent(event.data, normalized) : event.data;
-	const usage = event.usage ? tokenUsageData(event.usage) : void 0;
-	return {
-		type,
-		data: (() => {
-			if (!usage) return baseData;
-			if (isUsageType(type)) return {
-				...baseData,
-				tokensIn: event.usage?.inputTokens,
-				tokensOut: event.usage?.outputTokens,
-				...event.usage?.cost !== void 0 ? { costUsd: event.usage.cost } : {},
-				...usage
-			};
-			if (isNestedUsageType(type)) return {
-				...baseData,
-				usage
-			};
-			if (type === "done") return {
-				...baseData,
-				tokenUsage: usage,
-				...usage.totalCostUsd !== void 0 ? { totalCostUsd: usage.totalCostUsd } : {}
-			};
-			return baseData;
-		})(),
-		...event.id ? { id: event.id } : {}
-	};
-}
-function providerFailureEvent(event, sandboxEvent) {
-	if (event.type === "error") {
-		const errorCode = failureCode(sandboxEvent.data);
-		return {
-			type: "error",
-			data: {
-				...sandboxEvent.data,
-				...errorCode ? { code: errorCode } : {}
-			}
-		};
-	}
-	const normalized = event.normalized;
-	const failedStatus = event.type === "status" && event.data.status === "failed" || normalized?.type === "status" && normalized.status === "failed";
-	const terminalFrame = sandboxEvent.type === "done" || sandboxEvent.type === "result";
-	const outcome = recordValue(sandboxEvent.data.outcome);
-	const result = recordValue(sandboxEvent.data.result);
-	const failedTerminal = terminalFrame && (sandboxEvent.data.success === false || sandboxEvent.data.status === "failed" || outcome?.type === "failed" || outcome?.status === "failed" || result?.status === "failed");
-	if (!failedStatus && !failedTerminal) return void 0;
-	const detail = failureDetail(sandboxEvent.data) ?? failureDetail(outcome) ?? failureDetail(result) ?? (normalized?.type === "status" ? normalized.detail : void 0);
-	const errorCode = failureCode(sandboxEvent.data) ?? failureCode(outcome) ?? failureCode(result);
-	return {
-		type: "result",
-		data: {
-			status: "failed",
-			...detail ? { error: detail } : {},
-			...errorCode ? { errorCode } : {}
-		}
-	};
-}
-function recordValue(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function failureDetail(value) {
-	if (!value) return void 0;
-	const error = value.error;
-	if (typeof error === "string") return error;
-	const nestedError = recordValue(error);
-	if (typeof nestedError?.message === "string") return nestedError.message;
-	if (typeof value.message === "string") return value.message;
-	return typeof value.detail === "string" ? value.detail : void 0;
-}
-function failureCode(value) {
-	if (!value) return void 0;
-	const error = recordValue(value.error);
-	return stringValue(value.errorCode) ?? stringValue(value.code) ?? stringValue(error?.errorCode) ?? stringValue(error?.code);
-}
-function usageSandboxEvent(event) {
-	const type = event.normalized?.type ?? event.type;
-	if (!event.usage || isUsageType(type) || isNestedUsageType(type) || type === "done") return;
-	const usage = tokenUsageData(event.usage);
-	if (usage.inputTokens === void 0 && usage.outputTokens === void 0 && usage.totalCostUsd === void 0) return;
-	return {
-		type: "llm_call",
-		data: usage
-	};
-}
-function sandboxDataFromNormalizedEvent(rawData, normalized) {
-	const { type: _type, ...normalizedData } = normalized;
-	return {
-		...rawData,
-		...normalizedData,
-		...normalized.type === "message.part.updated" && normalized.part.type === "text" ? { text: normalized.part.text } : {}
-	};
-}
-function tokenUsageData(usage) {
-	return {
-		inputTokens: usage.inputTokens,
-		outputTokens: usage.outputTokens,
-		...usage.totalTokens !== void 0 ? { totalTokens: usage.totalTokens } : {},
-		...usage.cacheReadInputTokens !== void 0 ? { cacheReadInputTokens: usage.cacheReadInputTokens } : {},
-		...usage.cacheCreationInputTokens !== void 0 ? { cacheCreationInputTokens: usage.cacheCreationInputTokens } : {},
-		...usage.reasoningTokens !== void 0 ? { reasoningTokens: usage.reasoningTokens } : {},
-		...usage.cost !== void 0 ? { totalCostUsd: usage.cost } : {}
-	};
-}
-function turnInputFromPrompt(message, options) {
-	return {
-		...typeof message === "string" ? { prompt: message } : { parts: message },
-		...options?.sessionId ? { sessionId: options.sessionId } : {},
-		...options?.model ? { model: options.model } : {},
-		...options?.timeoutMs ? { timeoutMs: options.timeoutMs } : {},
-		...options?.executionId ? { executionId: options.executionId } : {},
-		...options?.lastEventId ? { lastEventId: options.lastEventId } : {},
-		...options?.turnId ? { turnId: options.turnId } : {},
-		...options?.detach !== void 0 ? { detach: options.detach } : {},
-		...options?.context ? { context: options.context } : {},
-		...options?.runControlRef ? { controlRef: options.runControlRef } : {},
-		...options?.backend?.interactions ? { interactions: options.backend.interactions } : {},
-		...options?.signal ? { signal: options.signal } : {},
-		...options?.backend ? { providerOptions: { backend: options.backend } } : {}
-	};
-}
-function resolveSessionControlRef(actual, expected, options = {}) {
-	if (expected === void 0) {
-		if (actual === void 0) return void 0;
-		return AgentExactRunControlRefSchema.parse(actual);
-	}
-	const expectedExact = AgentExactRunControlRefSchema.parse(expected);
-	if (actual === void 0) {
-		if (options.allowExpectedWhenActualAbsent === true) return expectedExact;
-		throw new ValidationError("provider session omitted the required exact run control reference");
-	}
-	const actualExact = AgentExactRunControlRefSchema.safeParse(actual);
-	if (!actualExact.success) throw new ValidationError("provider session returned an invalid exact run control reference");
-	if (!sameControlCoordinates(actualExact.data, expectedExact)) throw new ValidationError("provider session returned a different exact run control reference");
-	return actualExact.data;
-}
-function assertSandboxStatusBinding(status, controlRef) {
-	if (!status || typeof status !== "object" || controlRef === void 0) return;
-	const record = status;
-	if (record.runControlRef !== void 0) {
-		if (!sameControlCoordinates(AgentExactRunControlRefSchema.parse(record.runControlRef), controlRef)) throw new ValidationError("sandbox status returned a different exact run control reference");
-	}
-	for (const key of ["activeExecutionId", "latestExecutionId"]) {
-		const executionId = record[key];
-		if (executionId !== void 0 && executionId !== controlRef.executionId) throw new ValidationError("sandbox status returned a different execution");
-	}
-}
-function assertInteractionCommandScope(command, controlRef) {
-	if (controlRef === void 0) return;
-	if (command.binding.runId !== controlRef.runId || command.binding.provider !== controlRef.provider || command.binding.environmentId !== controlRef.environmentId || command.binding.sessionId !== controlRef.sessionId || command.binding.executionId !== controlRef.executionId) throw new ValidationError("interaction response targeted a different execution");
-}
-function assertCancellationScope(request, controlRef) {
-	if (controlRef === void 0) throw new ValidationError("durable cancellation requires an exact wrapper run control reference");
-	if (!sameControlCoordinates(AgentRunCancellationRequestSchema.parse(request).run, controlRef)) throw new ValidationError("cancellation targeted a different execution");
-}
-function scopedExecutionId(controlRef, requested) {
-	if (controlRef?.executionId !== void 0 && requested !== void 0 && controlRef.executionId !== requested) throw new ValidationError("session operation targeted a different execution");
-	return controlRef?.executionId ?? requested;
-}
-function assertScopedSessionForInput(session, input) {
-	if (input.executionId === void 0 && input.controlRef === void 0) return;
-	const sessionControlRef = AgentExactRunControlRefSchema.safeParse(session.controlRef);
-	if (!sessionControlRef.success) throw new ValidationError("provider session did not expose an exact run control reference for scoped cancellation");
-	const expectedControlRef = input.controlRef === void 0 ? void 0 : AgentExactRunControlRefSchema.parse(input.controlRef);
-	if (input.executionId !== void 0 && sessionControlRef.data.executionId !== input.executionId || expectedControlRef !== void 0 && !sameControlCoordinates(sessionControlRef.data, expectedControlRef)) throw new ValidationError("provider session returned a different exact run control reference");
-}
-function taskToTurnInput(task, signal) {
-	return {
-		prompt: taskToPrompt(task),
-		signal
-	};
-}
-function taskToPrompt(task) {
-	if (typeof task === "string") return task;
-	if (task && typeof task === "object") {
-		const record = task;
-		for (const key of [
-			"prompt",
-			"content",
-			"task",
-			"message"
-		]) if (typeof record[key] === "string") return record[key];
-	}
-	return JSON.stringify(task);
-}
-function resultFromEvents(events, fallbackText) {
-	for (let i = events.length - 1; i >= 0; i -= 1) {
-		const event = events[i];
-		const text = event ? resultTextFromData(event.data) : void 0;
-		if (text !== void 0) return {
-			content: text,
-			events
-		};
-	}
-	return {
-		content: fallbackText,
-		events
-	};
-}
-function textFromEnvironmentEvent(event) {
-	if (typeof event.normalized === "object" && event.normalized && event.normalized.type === "message.part.updated") return typeof event.normalized.delta === "string" ? event.normalized.delta : "";
-	const data = event.data;
-	for (const key of [
-		"delta",
-		"chunk",
-		"content",
-		"text"
-	]) if (typeof data[key] === "string" && !isTerminalEnvironmentEvent(event)) return data[key];
-	return "";
-}
-function resultTextFromData(data) {
-	for (const key of [
-		"finalText",
-		"text",
-		"response",
-		"resultSummary",
-		"content"
-	]) if (typeof data[key] === "string") return data[key];
-}
-function isTerminalEnvironmentEvent(event) {
-	if (isTerminalEventShape(event.type, event.data)) return true;
-	const normalized = event.normalized;
-	return normalized?.type === "status" && (normalized.status === "completed" || normalized.status === "failed");
-}
-function isTerminalEventShape(type, data) {
-	if (isSandboxTerminalEvent(type)) return true;
-	if (type.endsWith(".completed") || type.endsWith(".failed")) return true;
-	if (type !== "status") return false;
-	return data.status === "completed" || data.status === "failed" || data.status === "cancelled";
-}
-function isUsageType(type) {
-	return type === "llm_call" || type === "usage" || type === "cost.usage";
-}
-/** A terminal event whose usage rides `data.usage` — the nested shape this transport unwraps. */
-function isNestedUsageType(type) {
-	return isSandboxTerminalEvent(type) && sandboxTerminalUsageField(type) === "usage";
-}
-function usageFromEnvironmentEvent(event) {
-	const receipt = tokenUsageReceipt(event.usage ?? tokenUsageRecord(event.data));
-	const usage = event.usage ?? tokenUsageFromData(event.data);
-	const input = finiteNumber(usage?.inputTokens);
-	const output = finiteNumber(usage?.outputTokens);
-	return {
-		input: input ?? 0,
-		output: (output ?? 0) + (finiteNumber(usage?.reasoningTokens) ?? 0),
-		usd: finiteNumber(usage?.cost) ?? finiteNumber(event.data.costUsd) ?? finiteNumber(event.data.totalCostUsd) ?? 0,
-		hasInput: receipt.hasInput,
-		hasOutput: receipt.hasOutput,
-		hasTokenReceipt: receipt.hasTokens
-	};
-}
-function tokenUsageFromData(data) {
-	const usageRecord = tokenUsageRecord(data);
-	const inputTokens = inputTokensFromUsage(usageRecord);
-	const outputTokens = outputTokensFromUsage(usageRecord);
-	const totalTokens = finiteNumber(usageRecord.totalTokens);
-	const cacheReadInputTokens = finiteNumber(usageRecord.cacheReadInputTokens);
-	const cacheCreationInputTokens = finiteNumber(usageRecord.cacheCreationInputTokens);
-	const reasoningTokens = finiteNumber(usageRecord.reasoningTokens);
-	const cost = finiteNumber(usageRecord.cost) ?? finiteNumber(usageRecord.costUsd) ?? finiteNumber(usageRecord.totalCostUsd) ?? finiteNumber(data.costUsd) ?? finiteNumber(data.totalCostUsd);
-	if (inputTokens === void 0 && outputTokens === void 0 && totalTokens === void 0 && cacheReadInputTokens === void 0 && cacheCreationInputTokens === void 0 && reasoningTokens === void 0 && cost === void 0) return void 0;
-	return {
-		inputTokens: inputTokens ?? 0,
-		outputTokens: outputTokens ?? 0,
-		...totalTokens !== void 0 ? { totalTokens } : {},
-		...cacheReadInputTokens !== void 0 ? { cacheReadInputTokens } : {},
-		...cacheCreationInputTokens !== void 0 ? { cacheCreationInputTokens } : {},
-		...reasoningTokens !== void 0 ? { reasoningTokens } : {},
-		...cost !== void 0 ? { cost } : {}
-	};
-}
-function tokenUsageRecord(data) {
-	return recordValue(data.usage) ?? recordValue(data.tokenUsage) ?? data;
-}
-function inputTokensFromUsage(value) {
-	const usage = recordValue(value);
-	if (!usage) return void 0;
-	return finiteNumber(usage.inputTokens) ?? finiteNumber(usage.tokensIn) ?? finiteNumber(usage.prompt_tokens);
-}
-function outputTokensFromUsage(value) {
-	const usage = recordValue(value);
-	if (!usage) return void 0;
-	return finiteNumber(usage.outputTokens) ?? finiteNumber(usage.tokensOut) ?? finiteNumber(usage.completion_tokens);
-}
-function tokenUsageReceipt(value) {
-	const usage = recordValue(value);
-	const hasInput = inputTokensFromUsage(usage) !== void 0;
-	const hasOutput = outputTokensFromUsage(usage) !== void 0;
-	return {
-		hasInput,
-		hasOutput,
-		hasTokens: hasInput || hasOutput || finiteNumber(usage?.totalTokens) !== void 0 || finiteNumber(usage?.cacheReadInputTokens) !== void 0 || finiteNumber(usage?.cacheCreationInputTokens) !== void 0 || finiteNumber(usage?.reasoningTokens) !== void 0,
-		complete: hasInput && hasOutput
-	};
-}
-function mergeTokenUsage(left, right) {
-	if (!left) return right;
-	if (!right) return left;
-	return {
-		inputTokens: left.inputTokens + right.inputTokens,
-		outputTokens: left.outputTokens + right.outputTokens,
-		...left.totalTokens !== void 0 || right.totalTokens !== void 0 ? { totalTokens: (left.totalTokens ?? 0) + (right.totalTokens ?? 0) } : {},
-		...left.cacheReadInputTokens !== void 0 || right.cacheReadInputTokens !== void 0 ? { cacheReadInputTokens: (left.cacheReadInputTokens ?? 0) + (right.cacheReadInputTokens ?? 0) } : {},
-		...left.cacheCreationInputTokens !== void 0 || right.cacheCreationInputTokens !== void 0 ? { cacheCreationInputTokens: (left.cacheCreationInputTokens ?? 0) + (right.cacheCreationInputTokens ?? 0) } : {},
-		...left.reasoningTokens !== void 0 || right.reasoningTokens !== void 0 ? { reasoningTokens: (left.reasoningTokens ?? 0) + (right.reasoningTokens ?? 0) } : {},
-		...left.cost !== void 0 || right.cost !== void 0 ? { cost: (left.cost ?? 0) + (right.cost ?? 0) } : {}
-	};
-}
-function finiteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function stringValue(value) {
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function agentTurnResultFromPromptResult(result) {
-	const record = result;
-	return {
-		text: typeof record.response === "string" ? record.response : typeof record.text === "string" ? record.text : typeof record.finalText === "string" ? record.finalText : "",
-		success: typeof record.success === "boolean" ? record.success : true,
-		...typeof record.error === "string" ? { error: record.error } : {},
-		usage: tokenUsageFromData(record)
-	};
-}
-function sandboxDispatchResultFromSessionRef(session) {
-	const controlRef = session.controlRef === void 0 ? void 0 : AgentExactRunControlRefSchema.parse(session.controlRef);
-	const metadataExecutionId = optionalDispatchIdentity(session.metadata?.executionId, "executionId");
-	if (controlRef !== void 0) {
-		if (controlRef.sessionId !== session.id) throw new ValidationError("provider dispatch returned a control reference for another session");
-		if (session.provider !== void 0 && controlRef.provider !== session.provider) throw new ValidationError("provider dispatch returned a control reference for another provider");
-		if (metadataExecutionId !== void 0 && metadataExecutionId !== controlRef.executionId) throw new ValidationError("provider dispatch returned conflicting execution identities");
-	}
-	const status = session.metadata && Object.hasOwn(session.metadata, "status") ? sessionStatusFromUnknown(session.metadata?.status) : "running";
-	return {
-		sessionId: session.id,
-		status,
-		alreadyExisted: session.metadata?.alreadyExisted === true,
-		...session.metadata?.dispatched === void 0 ? {} : { dispatched: session.metadata.dispatched === true },
-		...controlRef === void 0 ? metadataExecutionId === void 0 ? {} : { executionId: metadataExecutionId } : {
-			executionId: controlRef.executionId,
-			runControlRef: controlRef
-		}
-	};
-}
-function sessionRefFromSandboxDispatch(dispatched, providerName) {
-	const record = dispatched && typeof dispatched === "object" ? dispatched : void 0;
-	const id = record?.sessionId ?? record?.id;
-	if (typeof id !== "string" || id.length === 0) throw new ValidationError("sandboxClientAsProvider: dispatch returned no session id");
-	if (!record) throw new ValidationError("sandboxClientAsProvider: dispatch returned no session record");
-	const executionId = optionalDispatchIdentity(record.executionId, "executionId");
-	const controlRef = record.runControlRef === void 0 ? void 0 : AgentExactRunControlRefSchema.parse(record.runControlRef);
-	if (controlRef !== void 0) {
-		if (controlRef.sessionId !== id || controlRef.provider !== providerName) throw new ValidationError("sandbox dispatch returned a control reference for another session");
-		if (executionId !== void 0 && controlRef.executionId !== executionId) throw new ValidationError("sandbox dispatch returned conflicting execution identities");
-	}
-	if (record.alreadyExisted !== void 0 && typeof record.alreadyExisted !== "boolean") throw new ValidationError("sandbox dispatch returned an invalid alreadyExisted flag");
-	if (record.dispatched !== void 0 && typeof record.dispatched !== "boolean") throw new ValidationError("sandbox dispatch returned an invalid dispatched flag");
-	if (record.status !== void 0 && !isSandboxSessionStatus(record.status)) throw new ValidationError("sandbox dispatch returned an invalid session status");
-	return {
-		id,
-		provider: providerName,
-		...controlRef === void 0 ? {} : { controlRef },
-		metadata: {
-			...record.status ? { status: record.status } : {},
-			...executionId === void 0 ? {} : { executionId },
-			...record.alreadyExisted !== void 0 ? { alreadyExisted: record.alreadyExisted } : {},
-			...record.dispatched !== void 0 ? { dispatched: record.dispatched } : {}
-		}
-	};
-}
-function optionalDispatchIdentity(value, label) {
-	if (value === void 0) return void 0;
-	if (typeof value !== "string" || value.length === 0) throw new ValidationError(`sandbox dispatch returned an invalid ${label}`);
-	return value;
-}
-function isSandboxSessionStatus(value) {
-	return value === "queued" || value === "running" || value === "completed" || value === "failed" || value === "cancelled";
-}
-function execResultFromSandboxExecResult(result) {
-	const record = result;
-	const exitCode = finiteNumber(record.exitCode) ?? finiteNumber(record.code);
-	if (exitCode === void 0) throw new ValidationError("sandboxClientAsProvider: exec returned no exit code");
-	return {
-		exitCode,
-		stdout: typeof record.stdout === "string" ? record.stdout : "",
-		stderr: typeof record.stderr === "string" ? record.stderr : ""
-	};
-}
-function statusFromUnknown(status) {
-	if (status === "pending" || status === "provisioning" || status === "running") return status;
-	if (status === "stopped" || status === "failed" || status === "expired") return status;
-	if (status === "completed") return "stopped";
-	if (status === "cancelled") return "stopped";
-	return "unknown";
-}
-function sessionStatusFromUnknown(status) {
-	if (status === "completed" || status === "cancelled") return status;
-	return statusFromUnknown(status);
-}
-function readBoxStatus(box) {
-	return box.status;
-}
-function readBoxMetadata(box) {
-	const metadata = box.metadata;
-	return metadata && typeof metadata === "object" ? metadata : void 0;
-}
-async function maybeRefresh(box) {
-	const refresh = box.refresh;
-	if (typeof refresh === "function") await refresh.call(box);
-}
-async function destroyBox(box) {
-	const deleteBox = box.delete;
-	if (typeof deleteBox === "function") await deleteBox.call(box);
-}
-function placementInfoFromLoopPlacement(placement, box) {
-	if (!placement) return {
-		kind: "sandbox",
-		sandboxId: String(box.id)
-	};
-	return {
-		kind: placement.kind === "fleet" ? "fleet" : placement.kind === "in-process" ? "local" : "sandbox",
-		...placement.sandboxId ? { sandboxId: placement.sandboxId } : { sandboxId: String(box.id) },
-		...placement.fleetId ? { fleetId: placement.fleetId } : {},
-		...placement.machineId ? { machineId: placement.machineId } : {}
-	};
-}
-const completeInteractiveAgentCapabilities = {
-	start: true,
-	control: true,
-	status: true,
-	attach: true,
-	reattach: true,
-	sendPrompt: true,
-	input: true,
-	resize: true,
-	stop: true
-};
-async function sandboxEnvironmentCapabilities(box, providerCapabilities) {
-	const { interactiveAgent: providerInteractive, ...baseCapabilities } = providerCapabilities;
-	if (!hasCompleteInteractiveAgentCapabilities(providerInteractive)) return baseCapabilities;
-	let deployed;
-	try {
-		deployed = await box.capabilities();
-	} catch {
-		return baseCapabilities;
-	}
-	if (!hasCompleteInteractiveAgentCapabilities(deployed?.interactiveAgent)) return baseCapabilities;
-	if (!hasExactInteractiveTerminalAdapter(box)) return baseCapabilities;
-	return {
-		...baseCapabilities,
-		interactiveAgent: { ...completeInteractiveAgentCapabilities }
-	};
-}
-function hasExactInteractiveTerminalAdapter(box) {
-	if (!hasSession(box)) return false;
-	try {
-		const session = box.session("__runtime-capability-probe__");
-		const interactive = session.interactive;
-		if (typeof interactive !== "function") return false;
-		return typeof interactive.call(session).attachAgentTerminal === "function";
-	} catch {
-		return false;
-	}
-}
-function hasCompleteInteractiveAgentCapabilities(value) {
-	return value?.start === true && value.control === true && value.status === true && value.attach === true && value.reattach === true && value.sendPrompt === true && value.input === true && value.resize === true && value.stop === true;
-}
-function assertSandboxInteractiveBinding(run, box, providerName) {
-	if (run.provider !== providerName || run.environmentId !== String(box.id)) throw new ValidationError("sandbox interactive request targets another environment");
-}
-function defaultTangleSandboxCapabilities(options) {
-	return {
-		profile: {
-			namedProfiles: options.namedProfiles,
-			systemPrompt: { ...harnessSystemPromptIntents(void 0) },
-			instructions: true,
-			tools: true,
-			permissions: true,
-			mcp: true,
-			subagents: true,
-			resources: {
-				files: true,
-				instructions: true,
-				tools: true,
-				skills: true,
-				agents: true,
-				commands: true
-			},
-			hooks: true,
-			modes: true,
-			runtimeUpdate: true,
-			validation: true
-		},
-		streaming: {
-			live: true,
-			replay: true,
-			detach: true,
-			turnIdempotency: true
-		},
-		sessions: {
-			continue: true,
-			list: true,
-			messages: true
-		},
-		workspace: {
-			read: true,
-			write: true,
-			exec: true,
-			git: true,
-			upload: true,
-			download: true,
-			cwdBases: {
-				repository: true,
-				host: false
-			}
-		},
-		branching: {
-			checkpoint: false,
-			fork: false
-		},
-		...options.rediscover ? { interactiveAgent: { ...completeInteractiveAgentCapabilities } } : {},
-		placement: true,
-		usage: true,
-		confidential: false
-	};
-}
-function contentRef(prefix, value) {
-	let str;
-	try {
-		str = JSON.stringify(value) ?? String(value);
-	} catch {
-		str = String(value);
-	}
-	let hash = 2166136261;
-	for (let i = 0; i < str.length; i += 1) {
-		hash ^= str.charCodeAt(i);
-		hash = Math.imul(hash, 16777619);
-	}
-	return `${prefix}:${(hash >>> 0).toString(16).padStart(8, "0")}`;
-}
-function hasGet(client) {
-	return typeof client.get === "function";
-}
-function hasList(client) {
-	return typeof client.list === "function";
-}
-function hasDispatchPrompt(box) {
-	return typeof box.dispatchPrompt === "function";
-}
-function hasSession(box) {
-	return typeof box.session === "function";
-}
-function hasRead(box) {
-	return typeof box.read === "function";
-}
-function hasWrite(box) {
-	return typeof box.write === "function";
-}
-function hasExec(box) {
-	return typeof box.exec === "function";
-}
-//#endregion
-export { runAbortable as A, throwIfAborted$1 as C, zeroTokenUsage as D, zeroSpend as E, abortError$1 as O, throwAbort as S, withTimeout as T, randomSuffix as _, sandboxClientAsProvider as a, sleep as b, addTokenUsage as c, cloneTokenUsage as d, deleteBoxSafe as f, promptCacheTokenClasses as g, mapWithConcurrency as h, resolveAgentEnvironmentProvider as i, linkAbort as k, chargedTokens as l, isAbortError as m, providerAsExecutor as n, createTangleSandboxExactProcessProvider as o, hasCompleteCacheBreakdown as p, providerAsSandboxClient as r, addSpend as s, createAgentEnvironmentProviderRegistry as t, cloneSpend as u, randomUuid as v, unmeteredSpend as w, stringifySafe as x, roundBoxMinutes as y };
-
-//# sourceMappingURL=environment-provider-1fKZh2zl.js.map