@tangle-network/sandbox 1.0.190 → 1.0.192

package/dist/{types-B-UsXSi6.d.ts → types-CiuGb4lZ.d.ts}

@@ -1,4 +1,4 @@
-import { $ as ProxySecretReceipt, At as SandboxCreateReceipt, G as AgentProfileConfidential, L as AgentExactRunControlRef, Q as ReasoningEffort, U as AgentProfile, V as InteractionRequest, W as AgentProfileCapabilities, Z as AgentProfileValidationResult, a as TerminalStreamOptions, b as SandboxSizePreset, g as TerminalReadyInfo, i as TerminalStreamHandlers, s as TerminalStreamToken, t as TerminalAttachTimings, tt as PlanContinuation, x as AgentRuntimeAttachments } from "./terminal-stream-types-1YKRrkZB.js";
+import { $ as ProxySecretReceipt, At as SandboxCreateReceipt, G as AgentProfileConfidential, L as AgentExactRunControlRef, Q as ReasoningEffort, U as AgentProfile, V as InteractionRequest, W as AgentProfileCapabilities, Z as AgentProfileValidationResult, a as TerminalStreamOptions, b as SandboxSizePreset, g as TerminalReadyInfo, i as TerminalStreamHandlers, s as TerminalStreamToken, t as TerminalAttachTimings, tt as PlanContinuation, x as AgentRuntimeAttachments } from "./terminal-stream-types-BqNv5EuG.js";
 import { t as CliAuthReference } from "./cli-auth-bundle-Wg3x2hd2.js";
 import { z } from "zod";
 //#region ../../../packages/runtime-contracts/dist/backend-types.d.ts
@@ -3667,11 +3667,13 @@ interface SdkRequestPhases {
  *   none did.
  * - `sdk.refresh`: one status read. `desc` is the reason it was sent, the same
  *   value the `x-tangle-refresh-reason` header carries.
+ * - `sdk.retry`: one create attempt the SDK retries; `desc` is its wire code
+ *   and Retry-After, `status` its HTTP status.
  * - `sdk.request`: one HTTP request. `durMs` runs from the call to the end of
  *   the body, or to the response headers when the body is not read here.
  */
 interface SdkTimingEntry {
-  name: "sdk.ensureRunning" | "sdk.refresh" | "sdk.request";
+  name: "sdk.ensureRunning" | "sdk.refresh" | "sdk.request" | "sdk.retry";
   durMs: number;
   desc: string;
   /** `sdk.request` only. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/sandbox",
-  "version": "1.0.190",
+  "version": "1.0.192",
   "description": "Client SDK for the Tangle Sandbox platform - build AI agent applications with dev containers",
   "type": "module",
   "sideEffects": [
@@ -155,13 +155,13 @@
     "yjs": "13.6.33",
     "@products/sandbox-test-utils": "0.0.0",
     "@repo/shared": "0.0.0",
-    "@tangle-network/cli-agent-registry": "0.15.0",
     "@tangle-network/agent-profile-materialize": "0.27.1",
+    "@tangle-network/cli-agent-registry": "0.15.0",
     "@tangle-network/runtime-contracts": "0.20.0"
   },
   "tangleRelease": {
-    "sourceSha": "f41fd1645824c17db6abeca83a9637311792837d",
-    "mergedAt": "2026-11-02T07:52:44-08:00"
+    "sourceSha": "4ebbdbe755569ab872dd1b5b540bbd0688c00dea",
+    "mergedAt": "2026-11-02T08:29:09-08:00"
   },
   "scripts": {
     "build": "node scripts/build-dist.mjs",

package/dist/errors-CaX0a5Ry.js

@@ -1,636 +0,0 @@
-import "./file-transfer-DTHgLccV.js";
-import { t as parseSandboxRetryAfterHeader } from "./retry-after-header-Bt-XvU-x.js";
-//#region src/error-classes.ts
-/**
-* Base error class for all Sandbox SDK errors.
-*/
-var SandboxError = class extends Error {
-	/** HTTP status code if applicable */
-	status;
-	/** Error code for programmatic handling */
-	code;
-	/** Best-effort origin of the failing request */
-	origin;
-	/** Request path or endpoint when known */
-	endpoint;
-	/** Retry-after duration in ms when surfaced by the upstream */
-	retryAfterMs;
-	/** Sidecar version when the runtime emitted it */
-	sidecarVersion;
-	/** Sidecar image/tag/sha when the runtime emitted it */
-	containerImage;
-	/**
-	* Seconds the control plane expects to need before it can serve this
-	* request, when it published one. Today only a capacity refusal on create
-	* carries it: the cell sizes it from the host add already in flight plus
-	* the measured p95 host-birth time, so it is a real wait, not a backoff
-	* hint. `retryAfterMs` paces the SDK's own retry; this is the number to
-	* show a human or feed to a scheduler.
-	*/
-	etaSeconds;
-	/**
-	* On create's top-level error, proves this call's attempts admitted no
-	* sandbox. Absence is unknown. Earlier errors in `cause` describe only
-	* their attempt prefix, not subsequent attempts or earlier calls using
-	* the same idempotency key.
-	*/
-	createFailureDisposition;
-	/**
-	* The cell kept its last free slots for customer creates and refused this
-	* internal create at once. Only customers may take that room, so create()
-	* ends on it instead of re-POSTing; a caller records it as held for
-	* customers, not as a failure.
-	*/
-	capacityHold;
-	constructor(message, code, status, metadata) {
-		super(message);
-		this.name = "SandboxError";
-		this.code = code;
-		this.status = status;
-		this.origin = metadata?.origin;
-		this.endpoint = metadata?.endpoint;
-		this.retryAfterMs = metadata?.retryAfterMs;
-		this.sidecarVersion = metadata?.sidecarVersion;
-		this.containerImage = metadata?.containerImage;
-		this.etaSeconds = metadata?.etaSeconds;
-		this.createFailureDisposition = metadata?.createFailureDisposition;
-		this.capacityHold = metadata?.capacityHold;
-	}
-};
-/**
-* Authentication failed or API key is invalid.
-*/
-var AuthError = class extends SandboxError {
-	constructor(message = "Authentication failed", metadata) {
-		super(message, "AUTH_ERROR", 401, metadata);
-		this.name = "AuthError";
-	}
-};
-/**
-* The requested resource was not found.
-*/
-var NotFoundError = class extends SandboxError {
-	/** The resource type that was not found */
-	resourceType;
-	/** The resource ID that was not found */
-	resourceId;
-	constructor(resourceType, resourceId, metadata, message = `${resourceType} not found: ${resourceId}`, code = "NOT_FOUND") {
-		super(message, code, 404, metadata);
-		this.name = "NotFoundError";
-		this.resourceType = resourceType;
-		this.resourceId = resourceId;
-	}
-};
-/**
-* Account quota or rate limit exceeded.
-*/
-var QuotaError = class extends SandboxError {
-	/** The type of quota that was exceeded */
-	quotaType;
-	/** Current usage */
-	current;
-	/** Maximum allowed */
-	limit;
-	/** Suggested retry-after duration in ms */
-	retryAfterMs;
-	constructor(quotaType, message, current, limit, metadata, status = 429) {
-		super(message ?? `Quota exceeded: ${quotaType}`, "QUOTA_EXCEEDED", status, metadata);
-		this.name = "QuotaError";
-		this.quotaType = quotaType;
-		this.current = current;
-		this.limit = limit;
-		this.retryAfterMs = metadata?.retryAfterMs;
-	}
-};
-/** Sandbox create denials that cannot succeed while the account state stays fixed. */
-const NON_RETRYABLE_CREATE_QUOTA_REASONS = new Set([
-	"CONCURRENT_LIMIT",
-	"CREDIT_EXHAUSTED",
-	"EGRESS_LIMIT"
-]);
-/**
-* The requested capability is unavailable for the account, driver, or sandbox.
-*/
-var CapabilityError = class extends SandboxError {
-	/** Capability or feature that was rejected when known */
-	capability;
-	constructor(message, code = "CAPABILITY_UNSUPPORTED", status = 400, metadata, capability) {
-		super(message, code, status, metadata);
-		this.name = "CapabilityError";
-		this.capability = capability;
-	}
-};
-/**
-* No configured GPU provider can take the lease: none is configured, the
-* named one is not, or the provider refused its credential. Status 503, code
-* `GPU_PROVIDER_NOT_CONFIGURED`. The message names every supported provider
-* and the orchestrator variables it needs; `providers` carries the same.
-*/
-var GpuProviderNotConfiguredError = class extends CapabilityError {
-	providers;
-	constructor(message, providers = [], status = 503, metadata) {
-		super(message, "GPU_PROVIDER_NOT_CONFIGURED", status, metadata, "gpu");
-		this.name = "GpuProviderNotConfiguredError";
-		this.providers = providers;
-	}
-};
-/**
-* A create that requires HIPAA placement was refused. `code` says why:
-* `COMPLIANCE_NOT_ENTITLED` (403) when the credential carries no HIPAA
-* entitlement, `COMPLIANCE_CELL_UNAVAILABLE` (503) when no HIPAA-designated
-* cell can take the create now. Either way nothing was created, and the
-* create was not placed in any other cell. The SDK does not retry it.
-*/
-var CompliancePlacementError = class extends SandboxError {
-	constructor(message, code, status, metadata) {
-		super(message, code, status, metadata);
-		this.name = "CompliancePlacementError";
-	}
-};
-/**
-* A multi-resource operation failed for one or more branches.
-*/
-var PartialFailureError = class extends SandboxError {
-	/** Per-resource failures returned by the API when available */
-	failures;
-	/** The operation that failed after another resource was already created. */
-	cause;
-	/** Allocation returned before create readiness failed. */
-	allocationId;
-	/** Key used for the create call that returned the allocation. */
-	idempotencyKey;
-	/** Ownership verdict returned by that create call, if available. */
-	createReceipt;
-	constructor(message, code = "PARTIAL_FAILURE", status = 502, metadata, failures, cause, createFailure) {
-		super(message, code, status, metadata);
-		this.name = "PartialFailureError";
-		this.failures = failures;
-		this.cause = cause;
-		this.allocationId = createFailure?.allocationId;
-		this.idempotencyKey = createFailure?.idempotencyKey;
-		this.createReceipt = createFailure?.createReceipt;
-	}
-};
-/**
-* The request was invalid or malformed.
-*/
-var ValidationError = class extends SandboxError {
-	/** Field-level validation errors */
-	fields;
-	constructor(message, fields, metadata, code = "VALIDATION_ERROR") {
-		super(message, code, 400, metadata);
-		this.name = "ValidationError";
-		this.fields = fields;
-	}
-};
-/**
-* A profile file mount the sandbox refuses; a retry with the same profile gets
-* the same refusal. `PROFILE_FILE_MOUNT_OUTSIDE_ROOTS` (422): an absolute path
-* outside `SANDBOX_FILE_API_ABSOLUTE_ROOTS`, refused before any write.
-* `PROFILE_FILE_CONFLICT` (409): the file changed both in the sandbox and in
-* the profile since its last mount, so a turn refuses to replace it.
-*/
-var ProfileFileMountPathError = class extends SandboxError {
-	/** The refused mount path, exactly as the profile gave it. */
-	path;
-	constructor(path, message, code, metadata, status = 422) {
-		super(message, code, status, metadata);
-		this.name = "ProfileFileMountPathError";
-		this.path = path;
-	}
-};
-/**
-* The sandbox is not in a valid state for the requested operation.
-*/
-var StateError = class extends SandboxError {
-	/** Current state of the sandbox */
-	currentState;
-	/** Required state for the operation */
-	requiredState;
-	constructor(message, currentState, requiredState, metadata, code = "INVALID_STATE") {
-		super(message, code, 409, metadata);
-		this.name = "StateError";
-		this.currentState = currentState;
-		this.requiredState = requiredState;
-	}
-};
-/**
-* The sandbox lifecycle is running, but its consumer-facing runtime edge is
-* still attaching or has failed to attach.
-*/
-var EdgeNotReadyError = class extends SandboxError {
-	/** Current public edge state. */
-	edgeStatus;
-	constructor(message, edgeStatus, metadata) {
-		super(message, "EDGE_NOT_READY", edgeStatus === "failed" ? 502 : 409, metadata);
-		this.name = "EdgeNotReadyError";
-		this.edgeStatus = edgeStatus;
-	}
-};
-var FileWriteConflictError = class extends SandboxError {
-	expectedHash;
-	constructor(message, path, expectedHash, currentHash, currentMtime, metadata) {
-		super(message, "FILE_WRITE_CONFLICT", 409, metadata);
-		this.path = path;
-		this.currentHash = currentHash;
-		this.currentMtime = currentMtime;
-		this.name = "FileWriteConflictError";
-		if (expectedHash !== void 0) this.expectedHash = expectedHash;
-	}
-};
-/**
-* The Platform key funding the request has no lifetime budget left.
-*
-* A budgeted key funds any number of sandboxes until its budget is spent;
-* then every create, resume, and model credential it funds is refused with
-* this error. The refusal is decided: retrying cannot succeed until the
-* budget is raised or another key is used, so the SDK never retries it.
-*/
-var KeyBudgetExhaustedError = class extends SandboxError {
-	/**
-	* The key the refusal names: the budgeted key with nothing left when
-	* Platform refused a delegation, or the presented key when authentication
-	* refused it. Absent when the server named none.
-	*/
-	keyId;
-	/** That key's lifetime budget, in USD, when Platform reported it. */
-	budgetUsd;
-	/** What that key has spent, in USD. */
-	spentUsd;
-	/** What that key has reserved for budgeted children, in USD. */
-	reservedUsd;
-	constructor(message, details = {}, metadata) {
-		super(message, "KEY_BUDGET_EXHAUSTED", 402, metadata);
-		this.name = "KeyBudgetExhaustedError";
-		this.keyId = details.keyId;
-		this.budgetUsd = details.budgetUsd;
-		this.spentUsd = details.spentUsd;
-		this.reservedUsd = details.reservedUsd;
-	}
-};
-var EgressProxyRecoveryError = class extends SandboxError {
-	phase;
-	constructor(message, metadata) {
-		super(message, "EGRESS_PROXY_RECOVERY_REQUIRED", 409, metadata);
-		this.name = "EgressProxyRecoveryError";
-		this.phase = "egress_proxy_recovery";
-	}
-};
-/**
-* Resume must build a new runtime, and that runtime needs public env values
-* the platform does not store at rest: a per-run coordination or capability
-* token, or a secret passed at create. Resume again with each key in
-* `missingEnvKeys` in `ResumeOptions.env`.
-*/
-var ResumeEnvRequiredError = class extends SandboxError {
-	/** The env keys the next resume must carry. */
-	missingEnvKeys;
-	constructor(message, missingEnvKeys, metadata) {
-		super(message, "RESUME_ENV_REQUIRED", 409, metadata);
-		this.name = "ResumeEnvRequiredError";
-		this.missingEnvKeys = missingEnvKeys;
-	}
-};
-/**
-* A branch asked for more children than the parent's host has memory for.
-* Children can only live on the parent's host (their clone is local to its
-* volume), so no other host can take the rest. `maxChildren` is how many
-* children that host admits now; branch that many or fewer, or wait for the
-* host to free memory. Nothing was created and nothing is held.
-*
-* A retry under the same idempotency key replays this refusal unchanged,
-* `maxChildren` included, so the count is the host's room when the key was
-* first used. To branch fewer children, use a new key.
-*/
-var BranchFanoutExceedsHostError = class extends SandboxError {
-	/** Children the parent's host admitted when it refused (0 when none). */
-	maxChildren;
-	/** The fan-out width this request asked for. */
-	requestedChildren;
-	constructor(message, counts, metadata) {
-		super(message, "BRANCH_FANOUT_EXCEEDS_HOST", 409, metadata);
-		this.name = "BranchFanoutExceedsHostError";
-		this.maxChildren = counts.maxChildren;
-		this.requestedChildren = counts.requestedChildren;
-	}
-};
-/**
-* The request timed out.
-*/
-var TimeoutError = class extends SandboxError {
-	/** The operation's configured budget, in milliseconds. NOT how long it ran. */
-	timeoutMs;
-	/**
-	* How long the operation actually ran before this error, in milliseconds,
-	* when the thrower measured it.
-	*
-	* `create()` can end before its budget: when a server-supplied `Retry-After`
-	* outlasts the remaining budget, no further attempt can follow that sleep,
-	* so the create ends there rather than idling. Reading `timeoutMs` as the
-	* duration would record a two-minute timeout for a three-second refusal.
-	* Absent means the thrower did not measure it; it never means `timeoutMs`.
-	*/
-	elapsedMs;
-	/**
-	* The last typed failure the operation had already received when the
-	* deadline fired, when there was one.
-	*
-	* An operation that spends its budget across several attempts (create's
-	* bounded POST retry) usually learns the server's failure class on an
-	* earlier attempt — `CONTAINER_START_FAILED`, `PROVISIONING_ERROR`,
-	* `RATE_LIMIT_EXCEEDED`. Without this field that class dies at the
-	* deadline and the caller is left with a timeout that names no cause,
-	* which is the last discard in a chain built specifically to deliver it.
-	*/
-	cause;
-	constructor(timeoutMs, message, metadata, cause) {
-		super(message ?? `Request timed out after ${timeoutMs}ms`, "TIMEOUT", 408, metadata);
-		this.name = "TimeoutError";
-		this.timeoutMs = timeoutMs;
-		this.elapsedMs = metadata?.elapsedMs;
-		this.cause = cause;
-	}
-};
-/**
-* A network or connection error occurred.
-*/
-var NetworkError = class extends SandboxError {
-	/** The underlying error */
-	cause;
-	constructor(message, causeOrMetadata, metadata) {
-		const cause = causeOrMetadata instanceof Error ? causeOrMetadata : void 0;
-		const resolvedMetadata = causeOrMetadata instanceof Error ? metadata : causeOrMetadata ?? metadata;
-		super(message, "NETWORK_ERROR", void 0, resolvedMetadata);
-		this.name = "NetworkError";
-		this.cause = cause;
-	}
-};
-/**
-* The stream of an admitted execution ended without its terminal event, and
-* the SDK could not rejoin it. The execution's outcome is UNKNOWN: it may
-* still be running, or it may have finished while no reader was attached.
-* This is never a failure verdict. Rejoin later with `streamPrompt(message,
-* { executionId, lastEventId, sessionId })`, or read the session status.
-*/
-var StreamInterruptedError = class extends SandboxError {
-	executionId;
-	sessionId;
-	/** The last event id delivered to the caller; replay resumes after it. */
-	lastEventId;
-	reason;
-	/** Last HTTP status the replay endpoint answered, when it answered. */
-	lastReplayStatus;
-	/** Last execution status the runtime reported, when it reported one. */
-	lastExecutionStatus;
-	cause;
-	constructor(details) {
-		super(details.message, "STREAM_INTERRUPTED", void 0, {
-			origin: "runtime",
-			endpoint: `/agents/run/${details.executionId}/events`
-		});
-		this.name = "StreamInterruptedError";
-		this.executionId = details.executionId;
-		this.sessionId = details.sessionId;
-		this.lastEventId = details.lastEventId;
-		this.reason = details.reason;
-		this.lastReplayStatus = details.lastReplayStatus;
-		this.lastExecutionStatus = details.lastExecutionStatus;
-		this.cause = details.cause;
-	}
-};
-/**
-* The server returned an unexpected error.
-*/
-var ServerError = class extends SandboxError {
-	constructor(message, status = 500, metadata, code = "SERVER_ERROR") {
-		super(message, code, status, metadata);
-		this.name = "ServerError";
-	}
-};
-//#endregion
-//#region src/errors.ts
-/**
-* Sandbox SDK Errors
-*
-* Error classes for the Sandbox client SDK.
-*/
-function quotaTypeFromResponse(data, reason) {
-	const normalizedReason = reason?.trim().toUpperCase();
-	if (normalizedReason && NON_RETRYABLE_CREATE_QUOTA_REASONS.has(normalizedReason)) return normalizedReason;
-	if (typeof data.quotaType === "string" && data.quotaType.trim()) return data.quotaType;
-	return "rate_limit";
-}
-function readGpuProviderRequirements(data) {
-	return (Array.isArray(data.providers) ? data.providers : []).flatMap((entry) => {
-		if (!isFailureDetail(entry)) return [];
-		const provider = asString(entry.provider);
-		const state = asString(entry.state);
-		const envVars = Array.isArray(entry.envVars) ? entry.envVars : [];
-		if (!provider || !state) return [];
-		return [{
-			provider,
-			state,
-			envVars: envVars.filter((name) => typeof name === "string")
-		}];
-	});
-}
-function parseRetryAfterMs(rawValue, data) {
-	if (typeof data.retryAfterMs === "number" && Number.isFinite(data.retryAfterMs)) return Math.max(0, data.retryAfterMs);
-	return parseSandboxRetryAfterHeader(rawValue);
-}
-/**
-* The server's published wait, in seconds. Only a positive finite number is
-* a wait; anything else is absent. Never derived from `Retry-After` — that
-* header is a pacing hint every refusal carries, while `etaSeconds` is a
-* measurement the cell only publishes when it has one.
-*/
-function parseEtaSeconds(data) {
-	const raw = data.etaSeconds;
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return;
-	return raw;
-}
-/**
-* What a capacity refusal publishes: the cell's measured wait, and whether its
-* customer floor refused an internal create (SandboxError.capacityHold).
-*/
-function capacityRefusalMetadata(data) {
-	return {
-		etaSeconds: parseEtaSeconds(data),
-		capacityHold: data.code === "CAPACITY_EXHAUSTED" && data.reason === "customer_floor" ? "customer_floor" : void 0
-	};
-}
-function inferOrigin(headers, context) {
-	const derivedPath = context?.path ?? headers?.get("x-tangle-request-path") ?? void 0;
-	if (!headers) return context?.path ? "sandbox-api" : void 0;
-	if (headers.has("x-sidecar-version") || headers.has("x-sidecar-image") || headers.has("x-sidecar-image-tag")) return "sidecar";
-	if (headers.has("x-orchestrator-version")) return "control-plane";
-	if (derivedPath?.startsWith("/v1/")) return "sandbox-api";
-	if (derivedPath) {
-		if (derivedPath.startsWith("/projects") || derivedPath.startsWith("/sidecars") || derivedPath.startsWith("/instances")) return "control-plane";
-		return "runtime";
-	}
-	return "unknown";
-}
-function isQuotaCode(code) {
-	return code === "QUOTA_EXCEEDED" || code?.endsWith("_QUOTA_EXCEEDED") === true;
-}
-function isCapabilityCode(code) {
-	return code === "CAPABILITY_NOT_ENABLED" || code === "CAPABILITY_UNSUPPORTED" || code === "UNSUPPORTED_CAPABILITY" || code === "FLEET_SHARED_WORKSPACE_UNSUPPORTED" || code === "SHARED_WORKSPACE_UNSUPPORTED";
-}
-function isPartialFailureCode(code) {
-	return code === "PARTIAL_FAILURE" || code === "FLEET_PARTIAL_FAILURE" || code === "FLEET_DISPATCH_PARTIAL_FAILURE" || code === "FLEET_DEPROVISION_FAILED";
-}
-function asString(value) {
-	return typeof value === "string" && value.trim().length > 0 ? value : void 0;
-}
-const ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
-function asErrorCode(value) {
-	return typeof value === "string" && ERROR_CODE_PATTERN.test(value) ? value : void 0;
-}
-function isFailureDetail(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function finiteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function readKeyBudgetDetails(value) {
-	if (!isFailureDetail(value)) return {};
-	return {
-		keyId: asString(value.keyId),
-		budgetUsd: finiteNumber(value.budgetUsd),
-		spentUsd: finiteNumber(value.spentUsd),
-		reservedUsd: finiteNumber(value.reservedUsd)
-	};
-}
-function readCapability(data, errorObj) {
-	const nested = typeof errorObj === "object" && errorObj !== null ? asString(errorObj.capability) : void 0;
-	return asString(data.capability) ?? nested;
-}
-function readFileWriteConflictDetails(errorObj) {
-	if (typeof errorObj !== "object" || errorObj === null) return void 0;
-	const path = asString(errorObj.path);
-	const expectedHash = errorObj.expectedHash === void 0 ? void 0 : asString(errorObj.expectedHash);
-	const currentHash = errorObj.currentHash === null ? null : asString(errorObj.currentHash);
-	const currentMtime = errorObj.currentMtime === null && Object.hasOwn(errorObj, "currentMtime") ? null : typeof errorObj.currentMtime === "number" && Number.isFinite(errorObj.currentMtime) ? errorObj.currentMtime : void 0;
-	if (path === void 0 || errorObj.expectedHash !== void 0 && expectedHash === void 0 || currentHash === void 0 || currentMtime === void 0) return;
-	return {
-		path,
-		expectedHash,
-		currentHash,
-		currentMtime
-	};
-}
-function readFailures(data, errorObj) {
-	if (Array.isArray(data.failures)) return data.failures.filter(isFailureDetail);
-	if (Array.isArray(data.results)) {
-		const failures = data.results.filter((result) => typeof result === "object" && result !== null && result.ok === false);
-		if (failures.length > 0) return failures.filter(isFailureDetail);
-	}
-	if (typeof errorObj === "object" && errorObj !== null && Array.isArray(errorObj.failures)) return errorObj.failures.filter(isFailureDetail);
-}
-/**
-* Parse an error response from the API.
-* @param status - HTTP status code
-* @param body - Response body text
-* @param context - Optional request context for better error messages
-*/
-function parseErrorResponse(status, body, context, headers) {
-	let data;
-	try {
-		data = JSON.parse(body);
-	} catch {
-		data = { message: body };
-	}
-	const errorObj = data.error;
-	const nestedMessage = typeof errorObj === "object" && errorObj !== null ? errorObj.message : void 0;
-	const nestedCode = typeof errorObj === "object" && errorObj !== null ? typeof errorObj.code === "string" ? asErrorCode(errorObj.code) : void 0 : void 0;
-	const baseMessage = data.message || nestedMessage || (typeof errorObj === "string" ? errorObj : void 0) || body || "Unknown error";
-	const details = typeof data.details === "string" && data.details.trim().length > 0 ? data.details.trim() : void 0;
-	const shouldAppendDetails = !!details && details !== baseMessage && (baseMessage === "Unknown error" || /^failed\b/i.test(baseMessage) || /^provision failed\b/i.test(baseMessage) || /^deprovision failed\b/i.test(baseMessage));
-	const rawReason = typeof data.reason === "string" ? data.reason : typeof errorObj === "object" && errorObj !== null ? errorObj.reason : void 0;
-	const reason = typeof rawReason === "string" && rawReason.trim().length > 0 ? rawReason.trim() : void 0;
-	const code = (typeof data.code === "string" ? asErrorCode(data.code) : void 0) ?? nestedCode;
-	const rawLog = typeof errorObj === "object" && errorObj !== null ? errorObj.log : void 0;
-	const logTail = typeof rawLog === "string" && rawLog.trim().length > 0 ? rawLog.trim() : void 0;
-	const prefix = context?.method || context?.path ? `${context.method ?? "REQUEST"} ${context.path ?? ""}: ` : "";
-	const composedMessage = shouldAppendDetails ? `${baseMessage}: ${details}` : baseMessage;
-	const messageWithReason = `${prefix}${reason && !composedMessage.includes(reason) ? `${composedMessage}: ${reason}` : composedMessage}`;
-	const message = logTail && !messageWithReason.includes(logTail) ? `${messageWithReason}\n${logTail}` : messageWithReason;
-	const metadata = {
-		origin: inferOrigin(headers, context),
-		endpoint: context?.path ?? headers?.get("x-tangle-request-path") ?? void 0,
-		retryAfterMs: parseRetryAfterMs(headers?.get("retry-after") ?? void 0, data),
-		...capacityRefusalMetadata(data),
-		sidecarVersion: headers?.get("x-sidecar-version") ?? void 0,
-		containerImage: headers?.get("x-sidecar-image") ?? headers?.get("x-sidecar-image-tag") ?? void 0,
-		createFailureDisposition: context?.allPreviousCreateAttemptsRefused === true && (context.method ?? headers?.get("x-tangle-request-method")) === "POST" && (context.path ?? headers?.get("x-tangle-request-path")) === "/v1/sandboxes" && status === 429 && (code === "RATE_LIMIT_EXCEEDED" || code === "QUOTA_EXCEEDED" || code === "PLATFORM_RATE_LIMITED") ? "not-admitted" : void 0
-	};
-	if (isQuotaCode(code)) return new QuotaError(quotaTypeFromResponse(data, reason), message, data.current, data.limit, metadata, status);
-	if (code === "GPU_PROVIDER_NOT_CONFIGURED" || code === "GPU_PROVIDERS_NOT_CONFIGURED") return new GpuProviderNotConfiguredError(message, readGpuProviderRequirements(data), status, metadata);
-	if (isCapabilityCode(code)) return new CapabilityError(message, code, status, metadata, readCapability(data, errorObj));
-	if (isPartialFailureCode(code)) return new PartialFailureError(message, code, status, metadata, readFailures(data, errorObj));
-	if (code === "COMPLIANCE_NOT_ENTITLED" || code === "COMPLIANCE_CELL_UNAVAILABLE") return new CompliancePlacementError(message, code, status, metadata);
-	if (code === "EGRESS_PROXY_RECOVERY_REQUIRED") return new EgressProxyRecoveryError(message, metadata);
-	if (code === "PROFILE_FILE_MOUNT_OUTSIDE_ROOTS" && typeof data.path === "string") return new ProfileFileMountPathError(data.path, message, code, metadata);
-	if (code === "RESUME_ENV_REQUIRED") {
-		const keys = data.missingEnvKeys;
-		return new ResumeEnvRequiredError(message, Array.isArray(keys) ? keys.filter((key) => typeof key === "string") : [], metadata);
-	}
-	if (code === "BRANCH_FANOUT_EXCEEDS_HOST") {
-		const count = (raw) => typeof raw === "number" && Number.isSafeInteger(raw) && raw >= 0 ? raw : void 0;
-		return new BranchFanoutExceedsHostError(message, {
-			maxChildren: count(data.maxChildren),
-			requestedChildren: count(data.requestedChildren)
-		}, metadata);
-	}
-	if (code === "KEY_BUDGET_EXHAUSTED") return new KeyBudgetExhaustedError(message, readKeyBudgetDetails(data.details), metadata);
-	if (code === "FILE_WRITE_CONFLICT") {
-		const conflict = readFileWriteConflictDetails(errorObj);
-		if (!conflict) return new ServerError(`${message}: malformed FILE_WRITE_CONFLICT response`, 502, metadata, "INVALID_ERROR_RESPONSE");
-		return new FileWriteConflictError(message, conflict.path, conflict.expectedHash, conflict.currentHash, conflict.currentMtime, metadata);
-	}
-	switch (status) {
-		case 400: return new ValidationError(message, data.fields, metadata, code);
-		case 401: return new AuthError(message, metadata);
-		case 404: return new NotFoundError(data.resourceType || "Resource", data.resourceId || "unknown", metadata, message, code);
-		case 408: return new TimeoutError(data.timeoutMs || 3e4, message, metadata);
-		case 409: return new StateError(message, data.currentState || "unknown", data.requiredState, metadata, code);
-		case 429: return new QuotaError(quotaTypeFromResponse(data, reason), message, data.current, data.limit, metadata);
-		case 501: return new SandboxError(message, code || "NOT_IMPLEMENTED", status, metadata);
-		default:
-			if (status >= 500) return new ServerError(message, status, metadata, code);
-			return new SandboxError(message, code || "UNKNOWN_ERROR", status, metadata);
-	}
-}
-/** Read a failed HTTP response without changing its typed error or retry metadata. */
-async function parseResponseError(response) {
-	const body = await response.text();
-	return parseErrorResponse(response.status, body, void 0, response.headers);
-}
-/** Read a checked response once; callers interpret its JSON wire value. */
-function readResponseJson(response) {
-	if (response.ok) return response.json();
-	return parseResponseError(response).then((error) => {
-		throw error;
-	});
-}
-/** A protocol `error` control frame or a transport failure. */
-var TerminalStreamError = class extends Error {
-	/** Protocol error code (e.g. `INIT_FAILED`) or `TRANSPORT` for socket faults. */
-	code;
-	/**
-	* True when the socket never reached OPEN: the upgrade was refused (a
-	* WebSocket client cannot read the HTTP status, so a 401 and a network drop
-	* look alike) or the runtime rejected the dial's options. No PTY work had
-	* started on the client's side of that dial.
-	*/
-	beforeOpen;
-	constructor(message, code, options = {}) {
-		super(message);
-		this.name = "TerminalStreamError";
-		this.code = code;
-		this.beforeOpen = options.beforeOpen === true;
-	}
-};
-//#endregion
-export { StateError as C, ValidationError as E, ServerError as S, TimeoutError as T, PartialFailureError as _, AuthError as a, ResumeEnvRequiredError as b, CompliancePlacementError as c, FileWriteConflictError as d, GpuProviderNotConfiguredError as f, NotFoundError as g, NetworkError as h, readResponseJson as i, EdgeNotReadyError as l, NON_RETRYABLE_CREATE_QUOTA_REASONS as m, parseErrorResponse as n, BranchFanoutExceedsHostError as o, KeyBudgetExhaustedError as p, parseResponseError as r, CapabilityError as s, TerminalStreamError as t, EgressProxyRecoveryError as u, ProfileFileMountPathError as v, StreamInterruptedError as w, SandboxError as x, QuotaError as y };