@tangle-network/sandbox 1.0.190 → 1.0.192

package/dist/errors-Mzq10WZq.js

@@ -0,0 +1,583 @@
+import { t as parseSandboxRetryAfterHeader } from "./retry-after-header-DUdCC0KJ.js";
+//#region ../../../packages/runtime-contracts/dist/error-catalog.js
+const ERROR_CATALOG = {
+	VALIDATION_ERROR: "400 final | The request is malformed or a field is invalid. | Fix the field the message names and send the request again.",
+	INVALID_REQUEST: "400 final | The request is malformed or a field is invalid. | Fix the field the message names and send the request again.",
+	INVALID_TEXT_PART: "400 final | A text part is missing its text or is not base64-encoded UTF-8. | Base64-encode every text part, then send the request again.",
+	UNAUTHORIZED: "401 final | The credential is missing, invalid or expired. | Sign in again or send a valid API key.",
+	PAYMENT_REQUIRED: "402 final | The account has no balance, credit or plan for this request. | Add credit or upgrade the plan, then retry.",
+	FORBIDDEN: "403 final | The caller is authenticated but not allowed to do this. | Use a credential with the role or scope the message names.",
+	FEATURE_DISABLED: "403 final | This capability is switched off for this deployment or account. | Ask the operator to enable it.",
+	NOT_FOUND: "404 final | The resource does not exist or this account cannot see it. | Check the id and the account or team that owns it.",
+	SIDECAR_NOT_FOUND: "404 final | The sandbox runtime does not exist or this account cannot see it. | Check the sandbox id, or create the sandbox again.",
+	CONFLICT: "409 final | The request conflicts with an existing resource or an earlier request. | Read the existing resource, or use a new name or idempotency key.",
+	STALE_STATE: "409 final | The caller's view of the resource is stale. | Read the resource again and repeat the request against its current state.",
+	INVALID_STATE: "409 final | The resource is in the wrong state for this operation. | Bring it to the state the message names, then retry.",
+	IN_PROGRESS: "409 retry | Another operation holds this resource. | Wait for that operation to finish, then retry.",
+	EGRESS_PROXY_RECOVERY_REQUIRED: "409 final | The egress proxy lost the credentials it serves. | Recreate the sandbox to rematerialize its egress credentials.",
+	EGRESS_PROXY_SECRETS_UNAVAILABLE: "409 final | The egress proxy rebuild found no value for secrets the box still references. | Send the missing secrets the response names in one retry, or recreate the sandbox.",
+	EGRESS_IN_PLACE_RELOAD_UNAVAILABLE: "409 final | The egress proxy cannot be re-keyed without a restart. | Re-key once no agent turn is streaming, allowing a proxy restart.",
+	EXPIRED: "410 final | The token, decision or grant has expired. | Request a new one.",
+	PAYLOAD_TOO_LARGE: "413 final | The body or artifact is over its size limit. | Send a smaller body, or split it.",
+	NOT_CONNECTED: "424 final | A required integration connection is missing. | Connect the integration the message names, then retry.",
+	QUOTA_EXCEEDED: "429 final | A plan or concurrency quota is reached. | Stop or delete resources, or raise the quota.",
+	RATE_LIMITED: "429 retry | Too many requests in the current window. | Wait for the Retry-After interval, then retry.",
+	RATE_LIMIT_EXCEEDED: "429 retry | Too many requests in the current window. | Wait for the Retry-After interval, then retry.",
+	INTERNAL_ERROR: "500 final | The server failed for a reason it did not classify. | Report the request id; the request itself did not cause it.",
+	OPERATION_FAILED: "500 final | A server-side operation failed. | Report the request id with the operation the message names.",
+	CONFIGURATION_ERROR: "500 final | The deployment is missing configuration or has an invalid value. | The operator sets the configuration key the message names.",
+	AGENT_EXECUTION_FAILED: "500 final | The agent run failed inside the sandbox. | Read the cause in the message; fix the prompt, model or credential it names.",
+	BACKEND_START_FAILED: "500 final | The agent backend cannot start, and a retry fails the same way. | Fix the configuration, credential or session the cause names.",
+	MESSAGE_RETRIEVAL_FAILED: "500 final | Message storage cannot serve this read. | Report the request id; the stored session needs repair.",
+	UNSUPPORTED: "501 final | This operation is not supported for this runtime, harness or driver. | Choose a runtime or option that supports it.",
+	UPSTREAM_ERROR: "502 retry | An upstream service failed or answered outside its contract. | Retry with backoff; report the request id if it persists.",
+	UNAVAILABLE: "503 retry | A dependency or capacity is temporarily unavailable. | Retry after the Retry-After interval.",
+	NOT_READY: "503 retry | The target is starting, restarting, recovering or draining. | Retry after the Retry-After interval.",
+	BACKEND_UNAVAILABLE: "503 retry | The agent backend did not answer. | Retry after the Retry-After interval.",
+	MESSAGE_RETRIEVAL_UNAVAILABLE: "503 retry | Message storage did not answer. | Retry after the Retry-After interval.",
+	TIMEOUT: "504 retry | The operation exceeded its deadline. | Retry; if it repeats, raise the timeout or split the work.",
+	KV_VALUE_TOO_LARGE: "413 final | A workflow KV value is over the per-value size cap. | Store a smaller value, or put the data in an artifact and keep its id in KV.",
+	KV_KEY_LIMIT: "409 final | The workflow has reached its KV key cap. | Delete keys the workflow no longer reads, then write again.",
+	KV_VERSION_CONFLICT: "409 final | Another writer changed the KV key since it was read. | Read the key again and retry the compare-and-swap against its current version.",
+	PRECONDITION_FAILED: "412 final | The stored version no longer matches the request's precondition. | Read the current version or etag and send it with the request.",
+	UNPROCESSABLE: "422 final | The input has nothing usable for this operation. | Record the history the message names, then ask again.",
+	BASE_IMAGE_NOT_FOUND: "400 final | The requested image does not exist. | Check the image name and tag, then create again.",
+	BASE_IMAGE_MISSING_BEFORE_CREATE: "400 final | The requested image does not exist; the host proved it before creating anything. | Check the image name and tag, then create again.",
+	UNSUPPORTED_EGRESS_POLICY: "400 final | This runtime cannot enforce the requested egress policy. | Choose a policy the runtime supports, or another runtime.",
+	UNSUPPORTED_FOR_RUNTIME: "400 final | The requested runtime cannot honour a create input. | Remove the input the message names, or choose another runtime.",
+	ROOT_USER_FORBIDDEN: "403 final | The sandbox may not run as root. | Run the workload as a non-root user.",
+	EGRESS_DOMAIN_NOT_ALLOWED: "403 final | The sandbox egress allowlist does not include this host. | Add the host to egressPolicy.allowDomains with box.egress.update.",
+	EGRESS_REQUEST_REFUSED: "403 final | The sandbox egress policy refused this request. | Read box.egress.denials() for the rule that refused it.",
+	NOT_MANAGED: "404 final | This host does not manage the named container. | Check the sandbox id; the platform resolves its host again on retry.",
+	SNAPSHOT_NOT_FOUND: "404 final | The snapshot does not exist or this account cannot see it. | List the sandbox snapshots and use an id from that list.",
+	BRANCH_PARENT_NOT_RUNNING: "409 final | The branch parent is not running. | Resume the parent sandbox, then branch again.",
+	CONTAINER_RESERVATION_CONFLICT: "409 retry | Another lifecycle operation holds this sandbox. | Wait for that operation to finish, then retry.",
+	CONTAINER_NETWORK_MISSING: "409 final | The stopped sandbox lost its network, so it cannot start in place; its files remain. | Resume the sandbox so the platform recreates it.",
+	EGRESS_DISABLED: "409 final | Egress is not enabled on this host. | Place the sandbox on a host with egress enabled.",
+	NATIVE_CAPTURE_UNAVAILABLE: "409 final | The host cannot prove the native capture image this create requires. | Retry on another host, or create without native capture.",
+	NETWORK_ISOLATION_REQUIRED: "409 final | The create requires its own network, and the host did not place one. | Retry on a host that supports network isolation.",
+	SESSION_CLAIM_MISMATCH: "409 final | The request names a session other than the one bound to this container. | Use the session id the container was created for.",
+	SNAPSHOT_NOT_SYNCED: "409 retry | The snapshot has not finished uploading. | Retry after the upload completes.",
+	WARM_CLAIM_REMOVED: "409 final | Another lifecycle operation removed the claimed warm sandbox. | Create the sandbox again.",
+	WORKSPACE_STORAGE_MISSING: "409 final | The stopped sandbox storage is gone or replaced, so the host refused to start it. | Restore the sandbox from a snapshot.",
+	RESTORE_QUOTA_EXCEEDED: "413 final | The snapshot is larger than the workspace quota. | Create with a larger disk, or restore a smaller snapshot.",
+	GIT_CLONE_REFUSED: "422 final | The repository refused the clone credential, or the credential cannot see it. | Fix the git credential or repository URL, then create again.",
+	BRANCH_FAILED: "500 final | The live branch of a running sandbox failed. | Report the request id; branch from a snapshot instead.",
+	CONTAINER_START_FAILED: "500 retry | The host started the sandbox and its runtime failed. | Retry; if it repeats, recreate the sandbox from a snapshot.",
+	GIT_CLONE_FAILED: "500 retry | Cloning the repository failed. | Retry; if it repeats, check that the repository URL is reachable.",
+	GIT_CLONE_TIMEOUT: "500 retry | Cloning the repository exceeded its deadline. | Retry, or clone a smaller repository.",
+	HOST_CLEANUP_UNCONFIRMED: "500 retry | The host cannot prove it removed what a failed create made. | Retry; the platform reconciles the earlier attempt first.",
+	HOST_RESERVATION_COMMIT_FAILED: "500 retry | The host could not record the create after cleaning it up. | Retry the create.",
+	MISSING_SIDECAR_AUTH_TOKEN: "500 final | The sandbox has no runtime auth token, so its host cannot route to it. | Recreate the sandbox.",
+	SNAPSHOT_RESTORE_FAILED: "500 final | Restoring the snapshot into the sandbox failed; no empty workspace was served. | Report the request id, or restore another snapshot.",
+	VM_START_FAILED: "500 retry | The microVM failed to start. | Retry; if it repeats, recreate the sandbox.",
+	SIDECAR_UPSTREAM_UNAVAILABLE: "502 retry | The host could not reach the sandbox runtime. | Retry; the request may have reached the sandbox.",
+	BRANCH_UFFD_UNAVAILABLE: "503 retry | The parent host cannot fork live memory now. | Retry, or branch from a snapshot.",
+	CAPACITY_EXHAUSTED: "503 retry | No host has room for this sandbox now. | Retry after the Retry-After interval.",
+	COMPLIANCE_CAPACITY_UNAVAILABLE: "503 retry | No verified compliance-scope host can take this sandbox now. | Retry after the Retry-After interval.",
+	FIRECRACKER_IMAGE_UNAVAILABLE: "503 final | No host carries the requested Firecracker image. | Choose an image the Firecracker hosts carry, or the Docker runtime.",
+	HOST_UNAVAILABLE: "503 retry | The host did not answer; the sandbox and its files remain. | Retry after the Retry-After interval.",
+	IN_BOX_DOCKER_UNAVAILABLE: "503 retry | Docker inside the sandbox is not available. | Retry, or create the sandbox with in-box Docker enabled.",
+	NO_IP: "503 retry | The sandbox has no network address yet. | Retry after the Retry-After interval.",
+	ROUTE_LOOKUP_FAILED: "503 retry | The host could not look up the sandbox route. | Retry after the Retry-After interval.",
+	SNAPSHOT_STORAGE_UNAVAILABLE: "503 retry | Snapshot storage did not answer. | Retry after the Retry-After interval.",
+	THIN_POOL_HEADROOM: "503 final | The sandbox host cannot grow this workspace. | Recreate the sandbox from a snapshot so it lands on another host.",
+	WARM_RECONNECT_MISS: "503 retry | The warm restore path is unavailable. | Retry; the platform restores through the cold path.",
+	WORKSPACE_IMAGE_BUILDER_BUSY: "503 retry | The workspace image builder is busy. | Retry after the Retry-After interval.",
+	WORKSPACE_IMAGE_BUILDER_UNAVAILABLE: "503 retry | The workspace image builder is unavailable. | Retry after the Retry-After interval.",
+	SIDECAR_HEALTH_TIMEOUT: "504 retry | The sandbox runtime did not become ready within its boot attempts. | Retry; if it repeats, recreate the sandbox.",
+	rate_limit_error: "429 retry | The model provider rate-limited this turn. | Wait for the provider's window, then send the turn again.",
+	provider_quota_exhausted: "429 final | The harness subscription quota is spent until its resetAt. | Wait until resetAt, or send the turn with another credential.",
+	native_api_error: "502 final | The harness's model API refused the turn; the message carries its answer. | Fix what the provider's answer names, then send the turn again.",
+	empty_visible_output: "502 retry | The turn ended without visible output from the model. | Send the turn again; if it repeats, change the model or the prompt.",
+	session_rehydration_failed: "409 final | The session's stored transcript cannot be replayed into a new harness session. | Start a new session; this one cannot resume.",
+	SESSION_DIED: "500 final | The harness session process died during the turn; the message says why. | Send the turn again in a new session.",
+	MEMORY_LIMIT_KILLED: "500 final | The harness ran out of memory and was killed. | Give the sandbox more memory or split the work, then send the turn again.",
+	PROCESS_OUTPUT_GAP: "410 final | A process log reader fell behind the spool, so output was evicted before it was read. | Read faster or redirect output to a file; missedBytes says how much.",
+	SESSION_CREDENTIAL_NOT_RETAINED: "409 final | A restored session's model credential is not kept in session storage. | Send the model credential with the turn.",
+	interaction_kind_unsupported: "400 final | The turn asks for an interaction kind this harness cannot originate. | Drop the interaction toggle or choose a harness that supports it.",
+	invalid_attachment: "400 final | An attachment has no url or path, or content the harness cannot take. | Fix the attachment the message names, then send the turn again.",
+	PROFILE_NOT_CACHED: "409 final | The turn names a profile by hash that this runtime does not hold. | Send the full profile object instead of its hash.",
+	MODEL_CALL_LIMIT_REACHED: "400 final | The bounded turn needed more model calls than it allowed. | Raise the turn's model-call limit or split the task.",
+	MODEL_CALL_LIMIT_UNSUPPORTED: "400 final | This harness's model calls cannot be counted, so a call limit cannot hold. | Drop the limit or choose a harness that supports it.",
+	TOOL_DISABLED_TURN_UNSUPPORTED: "400 final | This harness cannot run a turn with its tools disabled. | Allow tools, or choose a harness that supports tool-free turns.",
+	EXECUTION_TTL_EXPIRED: "504 final | The execution ran past its time limit and was stopped. | Raise ttlMs up to the deployment ceiling, or split the work.",
+	EXECUTION_TTL_EXCEEDS_LIMIT: "400 final | The requested execution time limit is above this deployment's ceiling. | Send a ttlMs at or below the ceiling the message names.",
+	MESSAGE_ADMISSION_EXPIRED: "409 final | The message's admission deadline passed before the harness was invoked. | Dispatch the message again with a new deadline.",
+	BACKEND_HARNESS_CONFLICT: "400 final | Running the turn would run a harness other than the one the caller named. | Name one harness for the session and its turns.",
+	HARNESS_MODEL_UNSUPPORTED: "400 final | The named harness cannot run the named model. | Choose a model the harness supports, or another harness.",
+	HARNESS_RUNTIME_UNAVAILABLE: "503 retry | The harness's local daemon exited before it could serve the session. | Retry after the Retry-After interval; the message carries the daemon's reason.",
+	GPU_PROVIDER_NOT_CONFIGURED: "503 final | No GPU provider is configured for this deployment. | Create the sandbox without a GPU, or ask the operator to configure a provider.",
+	COMPLIANCE_NOT_ENTITLED: "403 final | The account is not entitled to the requested compliance placement. | Enable the compliance plan for the account, or create without it.",
+	COMPLIANCE_CELL_UNAVAILABLE: "503 final | No cell serves the requested compliance placement. | Choose another region or compliance mode, or ask the operator.",
+	NETWORK_ERROR: "503 retry | The request did not reach the platform, or its answer was lost. | Check connectivity, then retry; a keyed create joins its earlier attempt.",
+	STREAM_INTERRUPTED: "503 retry | The execution's stream ended without its terminal event; its outcome is unknown. | Rejoin with its executionId and lastEventId, or read the session status.",
+	PUBLIC_PROFILE_PIN_REFUSED: "400 final | The runtime refused the pinned public profile revision this turn named. | Send the turn with the revision and digest the profile has now.",
+	model_credential_refused: "403 final | The account owner refused the model credential for this seat. | Reconnect or replace that seat's credential, or choose another seat.",
+	TEMPLATE_PUBLICATION_WAIT_INTERRUPTED: "504 retry | The SDK stopped waiting for a template publication; the job keeps running. | Resume the wait with resumeJobId instead of publishing again."
+};
+function catalogEntry(code) {
+	const [head = "", cause = "", nextStep = ""] = ERROR_CATALOG[code].split(" | ");
+	return {
+		code,
+		status: Number(head.slice(0, 3)),
+		retryable: head.endsWith("retry"),
+		cause,
+		nextStep,
+		docs: `https://sandbox.tangle.tools/docs/errors#${code.toLowerCase()}`
+	};
+}
+//#endregion
+//#region src/error-classes.ts
+/**
+* Sandbox SDK Errors
+*
+* One error class, `SandboxError`. Its `code` is the catalog's `ErrorCode`
+* (the runtime contracts' error catalog), and `status`,
+* `retryable` and `nextStep` come from that code's catalog entry.
+*/
+const STATUS_CODE = {
+	400: "VALIDATION_ERROR",
+	401: "UNAUTHORIZED",
+	402: "PAYMENT_REQUIRED",
+	403: "FORBIDDEN",
+	404: "NOT_FOUND",
+	408: "TIMEOUT",
+	409: "INVALID_STATE",
+	410: "EXPIRED",
+	413: "PAYLOAD_TOO_LARGE",
+	422: "VALIDATION_ERROR",
+	424: "NOT_CONNECTED",
+	425: "NOT_READY",
+	429: "RATE_LIMITED",
+	501: "UNSUPPORTED",
+	502: "UPSTREAM_ERROR",
+	503: "UNAVAILABLE",
+	504: "TIMEOUT",
+	524: "TIMEOUT"
+};
+/** Cluster of a wire code the catalog does not list yet, by its name (design note, section 2). */
+const NAME_CODE = [
+	[/QUOTA_EXCEEDED$|CREDIT_EXHAUSTED$/, "QUOTA_EXCEEDED"],
+	[/RATE_LIMIT/, "RATE_LIMITED"],
+	[/_IN_PROGRESS$|_BUSY$|_PENDING$|_RECONCILING$|_CONTENDED$/, "IN_PROGRESS"],
+	[/_NOT_READY$|_RESTARTING$|_STARTING$/, "NOT_READY"],
+	[/_DISABLED$|_NOT_ENABLED$/, "FEATURE_DISABLED"],
+	[/_NOT_CONFIGURED$|CONFIGURATION/, "CONFIGURATION_ERROR"],
+	[/_NOT_FOUND$/, "NOT_FOUND"],
+	[/_CONFLICT$/, "CONFLICT"],
+	[/PARTIAL_FAILURE$/, "OPERATION_FAILED"],
+	[/_TIMEOUT$|_TIMED_OUT$/, "TIMEOUT"],
+	[/^TRANSPORT$/, "NETWORK_ERROR"],
+	[/UNSUPPORTED$|NOT_IMPLEMENTED$/, "UNSUPPORTED"]
+];
+/**
+* The catalog code for a wire code: the code itself when the catalog lists
+* it, else its cluster by name, else by HTTP status, else `fallback`.
+*/
+function catalogCode(wireCode, status, fallback = "INTERNAL_ERROR") {
+	if (Object.hasOwn(ERROR_CATALOG, wireCode)) return wireCode;
+	return NAME_CODE.find(([pattern]) => pattern.test(wireCode))?.[1] ?? (status === void 0 ? void 0 : STATUS_CODE[status]) ?? fallback;
+}
+/**
+* The one SDK error. `code` is the catalog code callers branch on; `wireCode`
+* is the code the server sent (it differs while servers still send
+* pre-catalog codes). `retryable` is the catalog's verdict on whether a later
+* retry can succeed, and `nextStep` is what the caller does about it.
+*/
+var SandboxError = class extends Error {
+	code;
+	wireCode;
+	/** HTTP status the server answered, else the catalog status of `code`. */
+	status;
+	retryable;
+	nextStep;
+	docs;
+	/** Best-effort origin of the failing request */
+	origin;
+	/** Request path or endpoint when known */
+	endpoint;
+	/** Retry-after duration in ms when surfaced by the upstream */
+	retryAfterMs;
+	sidecarVersion;
+	containerImage;
+	/**
+	* Seconds the cell measured it needs before it can serve this request (a
+	* capacity refusal on create). A real wait to show a human or a scheduler,
+	* unlike `retryAfterMs`, which paces the SDK's own retry.
+	*/
+	etaSeconds;
+	/** How long the operation ran before this error, when the thrower measured it; never `timeoutMs`. */
+	elapsedMs;
+	/**
+	* On create's top-level error, proves this call's attempts admitted no
+	* sandbox. Absence is unknown.
+	*/
+	createFailureDisposition;
+	/** The cell kept its last free slots for customers and refused this internal create; create() ends on it. */
+	capacityHold;
+	resourceType;
+	resourceId;
+	/** Quota reason: `CONCURRENT_LIMIT`, `CREDIT_EXHAUSTED`, `EGRESS_LIMIT`, or `rate_limit`. */
+	quotaType;
+	current;
+	limit;
+	capability;
+	/** Every supported GPU provider and the orchestrator variables it needs. */
+	providers;
+	/** Per-resource failures of a multi-resource operation. */
+	failures;
+	/** Allocation a create returned before its readiness failed. */
+	allocationId;
+	idempotencyKey;
+	createReceipt;
+	/** Field-level validation errors */
+	fields;
+	path;
+	currentState;
+	requiredState;
+	edgeStatus;
+	expectedHash;
+	currentHash;
+	currentMtime;
+	/** The budgeted key a `KEY_BUDGET_EXHAUSTED` refusal names, and its USD budget, spend and reserve. */
+	keyId;
+	budgetUsd;
+	spentUsd;
+	reservedUsd;
+	/** The env keys the next resume must carry in `ResumeOptions.env`. */
+	missingEnvKeys;
+	/** Children the parent's host admitted when a branch fan-out was refused. */
+	maxChildren;
+	requestedChildren;
+	/** The operation's configured budget, in milliseconds. NOT how long it ran. */
+	timeoutMs;
+	executionId;
+	sessionId;
+	/** The last event id delivered to the caller; a rejoin resumes after it. */
+	lastEventId;
+	reason;
+	lastReplayStatus;
+	lastExecutionStatus;
+	/** A terminal socket that never reached OPEN. */
+	beforeOpen;
+	constructor(message, metadata = {}) {
+		const { code, status, cause, ...fields } = metadata;
+		super(message, cause === void 0 ? void 0 : { cause });
+		const fallback = ALIAS_CODE.get(new.target) ?? "INTERNAL_ERROR";
+		this.wireCode = code ?? (status === void 0 ? void 0 : STATUS_CODE[status]) ?? fallback;
+		this.code = catalogCode(this.wireCode, status, fallback);
+		const entry = catalogEntry(this.code);
+		this.status = status ?? entry.status;
+		this.retryable = entry.retryable;
+		this.nextStep = entry.nextStep;
+		this.docs = entry.docs;
+		Object.assign(this, fields);
+		this.name = new.target.name;
+	}
+};
+/** @deprecated Removed in 0.62; check `code === "UNAUTHORIZED"`. */
+var AuthError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "NOT_FOUND"`. */
+var NotFoundError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "QUOTA_EXCEEDED"` or `"RATE_LIMITED"`. */
+var QuotaError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "UNSUPPORTED"` or `"FEATURE_DISABLED"`. */
+var CapabilityError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `wireCode === "GPU_PROVIDER_NOT_CONFIGURED"`. */
+var GpuProviderNotConfiguredError = class extends CapabilityError {};
+/** @deprecated Removed in 0.62; check `wireCode` for `COMPLIANCE_NOT_ENTITLED` or `COMPLIANCE_CELL_UNAVAILABLE`. */
+var CompliancePlacementError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; read `failures`. */
+var PartialFailureError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "VALIDATION_ERROR"`. */
+var ValidationError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `wireCode` and read `path`. */
+var ProfileFileMountPathError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "INVALID_STATE"`. */
+var StateError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `wireCode === "EDGE_NOT_READY"`. */
+var EdgeNotReadyError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `wireCode === "FILE_WRITE_CONFLICT"`. */
+var FileWriteConflictError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `wireCode === "KEY_BUDGET_EXHAUSTED"`. */
+var KeyBudgetExhaustedError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "EGRESS_PROXY_RECOVERY_REQUIRED"`. */
+var EgressProxyRecoveryError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `wireCode === "RESUME_ENV_REQUIRED"` and read `missingEnvKeys`. */
+var ResumeEnvRequiredError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `wireCode === "BRANCH_FANOUT_EXCEEDS_HOST"` and read `maxChildren`. */
+var BranchFanoutExceedsHostError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "TIMEOUT"`. */
+var TimeoutError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `code === "NETWORK_ERROR"`. */
+var NetworkError = class extends SandboxError {};
+/**
+* The stream of an admitted execution ended without its terminal event and
+* the SDK could not rejoin it. The outcome is UNKNOWN, never a failure
+* verdict: rejoin with `streamPrompt(message, { executionId, lastEventId,
+* sessionId })`, or read the session status.
+* @deprecated Removed in 0.62; check `code === "STREAM_INTERRUPTED"`.
+*/
+var StreamInterruptedError = class extends SandboxError {};
+/** @deprecated Removed in 0.62; check `status >= 500`. */
+var ServerError = class extends SandboxError {};
+/** Each alias, its default code, and the wire codes the parse point builds it for. */
+const ALIASES = [
+	[AuthError, "UNAUTHORIZED"],
+	[NotFoundError, "NOT_FOUND"],
+	[QuotaError, "QUOTA_EXCEEDED"],
+	[
+		CapabilityError,
+		"UNSUPPORTED",
+		"CAPABILITY_NOT_ENABLED",
+		"CAPABILITY_UNSUPPORTED",
+		"UNSUPPORTED_CAPABILITY",
+		"FLEET_SHARED_WORKSPACE_UNSUPPORTED",
+		"SHARED_WORKSPACE_UNSUPPORTED"
+	],
+	[
+		GpuProviderNotConfiguredError,
+		"CONFIGURATION_ERROR",
+		"GPU_PROVIDER_NOT_CONFIGURED",
+		"GPU_PROVIDERS_NOT_CONFIGURED"
+	],
+	[
+		CompliancePlacementError,
+		"FORBIDDEN",
+		"COMPLIANCE_NOT_ENTITLED",
+		"COMPLIANCE_CELL_UNAVAILABLE"
+	],
+	[
+		PartialFailureError,
+		"OPERATION_FAILED",
+		"PARTIAL_FAILURE",
+		"FLEET_PARTIAL_FAILURE",
+		"FLEET_DISPATCH_PARTIAL_FAILURE",
+		"FLEET_DEPROVISION_FAILED"
+	],
+	[ValidationError, "VALIDATION_ERROR"],
+	[
+		ProfileFileMountPathError,
+		"VALIDATION_ERROR",
+		"PROFILE_FILE_MOUNT_OUTSIDE_ROOTS"
+	],
+	[StateError, "INVALID_STATE"],
+	[
+		EdgeNotReadyError,
+		"NOT_READY",
+		"EDGE_NOT_READY"
+	],
+	[
+		FileWriteConflictError,
+		"CONFLICT",
+		"FILE_WRITE_CONFLICT"
+	],
+	[
+		KeyBudgetExhaustedError,
+		"PAYMENT_REQUIRED",
+		"KEY_BUDGET_EXHAUSTED"
+	],
+	[
+		EgressProxyRecoveryError,
+		"EGRESS_PROXY_RECOVERY_REQUIRED",
+		"EGRESS_PROXY_RECOVERY_REQUIRED"
+	],
+	[
+		ResumeEnvRequiredError,
+		"INVALID_STATE",
+		"RESUME_ENV_REQUIRED"
+	],
+	[
+		BranchFanoutExceedsHostError,
+		"QUOTA_EXCEEDED",
+		"BRANCH_FANOUT_EXCEEDS_HOST"
+	],
+	[TimeoutError, "TIMEOUT"],
+	[NetworkError, "NETWORK_ERROR"],
+	[StreamInterruptedError, "STREAM_INTERRUPTED"],
+	[ServerError, "INTERNAL_ERROR"]
+];
+const ALIAS_CODE = new Map(ALIASES.map(([alias, code]) => [alias, code]));
+//#endregion
+//#region src/errors.ts
+/**
+* Sandbox SDK Errors
+*
+* The one parse point from an error response to a `SandboxError`.
+*/
+/**
+* The one retry rule: retry a failure when the catalog marks its code
+* retryable. A loop adds only its own deliberate exception.
+*/
+function retryWhen(error) {
+	return error instanceof SandboxError && error.retryable;
+}
+/** A file write or part PUT to resend: retryable, and answered 429 or 5xx, or timed out. */
+function isTransientWrite(error) {
+	return retryWhen(error) && (error.status >= 500 || error.status === 429 || error instanceof TimeoutError);
+}
+const ALIAS_BY_WIRE_CODE = new Map(ALIASES.flatMap(([alias, , ...wireCodes]) => wireCodes.map((code) => [code, alias])));
+const ALIAS_BY_STATUS = {
+	400: ValidationError,
+	401: AuthError,
+	404: NotFoundError,
+	408: TimeoutError,
+	409: StateError,
+	429: QuotaError
+};
+/** Detail fields a refusal body may carry at its top level, in `error`, or in `details`. */
+const WIRE_FIELDS = [
+	"resourceType",
+	"resourceId",
+	"quotaType",
+	"current",
+	"limit",
+	"capability",
+	"providers",
+	"fields",
+	"path",
+	"currentState",
+	"requiredState",
+	"expectedHash",
+	"currentHash",
+	"currentMtime",
+	"keyId",
+	"budgetUsd",
+	"spentUsd",
+	"reservedUsd",
+	"missingEnvKeys",
+	"maxChildren",
+	"requestedChildren",
+	"timeoutMs"
+];
+function wireFields(...sources) {
+	const fields = {};
+	for (const source of sources) {
+		if (!isFailureDetail(source)) continue;
+		for (const key of WIRE_FIELDS) fields[key] ??= source[key];
+	}
+	return fields;
+}
+function parseRetryAfterMs(rawValue, data) {
+	if (typeof data.retryAfterMs === "number" && Number.isFinite(data.retryAfterMs)) return Math.max(0, data.retryAfterMs);
+	return parseSandboxRetryAfterHeader(rawValue);
+}
+/**
+* The server's published wait, in seconds. Only a positive finite number is
+* a wait; anything else is absent. Never derived from `Retry-After` — that
+* header is a pacing hint every refusal carries, while `etaSeconds` is a
+* measurement the cell only publishes when it has one.
+*/
+function parseEtaSeconds(data) {
+	const raw = data.etaSeconds;
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return;
+	return raw;
+}
+/**
+* What a capacity refusal publishes: the cell's measured wait, and whether its
+* customer floor refused an internal create (SandboxError.capacityHold).
+*/
+function capacityRefusalMetadata(data) {
+	return {
+		etaSeconds: parseEtaSeconds(data),
+		capacityHold: data.code === "CAPACITY_EXHAUSTED" && data.reason === "customer_floor" ? "customer_floor" : void 0
+	};
+}
+function inferOrigin(headers, context) {
+	const derivedPath = context?.path ?? headers?.get("x-tangle-request-path") ?? void 0;
+	if (!headers) return context?.path ? "sandbox-api" : void 0;
+	if (headers.has("x-sidecar-version") || headers.has("x-sidecar-image") || headers.has("x-sidecar-image-tag")) return "sidecar";
+	if (headers.has("x-orchestrator-version")) return "control-plane";
+	if (derivedPath?.startsWith("/v1/")) return "sandbox-api";
+	if (derivedPath) {
+		if (derivedPath.startsWith("/projects") || derivedPath.startsWith("/sidecars") || derivedPath.startsWith("/instances")) return "control-plane";
+		return "runtime";
+	}
+	return "unknown";
+}
+const ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+function asErrorCode(value) {
+	return typeof value === "string" && ERROR_CODE_PATTERN.test(value) ? value : void 0;
+}
+function isFailureDetail(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readFailures(data, errorObj) {
+	if (Array.isArray(data.failures)) return data.failures.filter(isFailureDetail);
+	if (Array.isArray(data.results)) {
+		const failures = data.results.filter((result) => typeof result === "object" && result !== null && result.ok === false);
+		if (failures.length > 0) return failures.filter(isFailureDetail);
+	}
+	if (typeof errorObj === "object" && errorObj !== null && Array.isArray(errorObj.failures)) return errorObj.failures.filter(isFailureDetail);
+}
+/**
+* Parse an error response from the API.
+* @param status - HTTP status code
+* @param body - Response body text
+* @param context - Optional request context for better error messages
+*/
+function parseErrorResponse(status, body, context, headers) {
+	let data;
+	try {
+		data = JSON.parse(body);
+	} catch {
+		data = { message: body };
+	}
+	const errorObj = data.error;
+	const nestedMessage = typeof errorObj === "object" && errorObj !== null ? errorObj.message : void 0;
+	const nestedCode = typeof errorObj === "object" && errorObj !== null ? typeof errorObj.code === "string" ? asErrorCode(errorObj.code) : void 0 : void 0;
+	const baseMessage = data.message || nestedMessage || (typeof errorObj === "string" ? errorObj : void 0) || body || "Unknown error";
+	const details = typeof data.details === "string" && data.details.trim().length > 0 ? data.details.trim() : void 0;
+	const shouldAppendDetails = !!details && details !== baseMessage && (baseMessage === "Unknown error" || /^failed\b/i.test(baseMessage) || /^provision failed\b/i.test(baseMessage) || /^deprovision failed\b/i.test(baseMessage));
+	const rawReason = typeof data.reason === "string" ? data.reason : typeof errorObj === "object" && errorObj !== null ? errorObj.reason : void 0;
+	const reason = typeof rawReason === "string" && rawReason.trim().length > 0 ? rawReason.trim() : void 0;
+	const code = (typeof data.code === "string" ? asErrorCode(data.code) : void 0) ?? nestedCode;
+	const rawLog = typeof errorObj === "object" && errorObj !== null ? errorObj.log : void 0;
+	const logTail = typeof rawLog === "string" && rawLog.trim().length > 0 ? rawLog.trim() : void 0;
+	const prefix = context?.method || context?.path ? `${context.method ?? "REQUEST"} ${context.path ?? ""}: ` : "";
+	const composedMessage = shouldAppendDetails ? `${baseMessage}: ${details}` : baseMessage;
+	const messageWithReason = `${prefix}${reason && !composedMessage.includes(reason) ? `${composedMessage}: ${reason}` : composedMessage}`;
+	const message = logTail && !messageWithReason.includes(logTail) ? `${messageWithReason}\n${logTail}` : messageWithReason;
+	const metadata = {
+		origin: inferOrigin(headers, context),
+		endpoint: context?.path ?? headers?.get("x-tangle-request-path") ?? void 0,
+		retryAfterMs: parseRetryAfterMs(headers?.get("retry-after") ?? void 0, data),
+		...capacityRefusalMetadata(data),
+		sidecarVersion: headers?.get("x-sidecar-version") ?? void 0,
+		containerImage: headers?.get("x-sidecar-image") ?? headers?.get("x-sidecar-image-tag") ?? void 0,
+		createFailureDisposition: context?.allPreviousCreateAttemptsRefused === true && (context.method ?? headers?.get("x-tangle-request-method")) === "POST" && (context.path ?? headers?.get("x-tangle-request-path")) === "/v1/sandboxes" && status === 429 && (code === "RATE_LIMIT_EXCEEDED" || code === "QUOTA_EXCEEDED" || code === "PLATFORM_RATE_LIMITED") ? "not-admitted" : void 0
+	};
+	const source = wireFields(data, errorObj, data.details);
+	const Alias = ALIAS_BY_WIRE_CODE.get(code ?? "") ?? (code && catalogCode(code) === "QUOTA_EXCEEDED" ? QuotaError : void 0) ?? ALIAS_BY_STATUS[status] ?? (status >= 500 && status !== 501 ? ServerError : SandboxError);
+	return new Alias(message, {
+		...source,
+		...metadata,
+		code,
+		status,
+		failures: readFailures(data, errorObj),
+		quotaType: Alias === QuotaError ? asErrorCode(reason) ?? source.quotaType ?? "rate_limit" : void 0,
+		currentState: source.currentState ?? (Alias === StateError ? "unknown" : void 0)
+	});
+}
+/** Read a failed HTTP response without changing its typed error or retry metadata. */
+async function parseResponseError(response) {
+	const body = await response.text();
+	return parseErrorResponse(response.status, body, void 0, response.headers);
+}
+/** Read a checked response once; callers interpret its JSON wire value. */
+function readResponseJson(response) {
+	if (response.ok) return response.json();
+	return parseResponseError(response).then((error) => {
+		throw error;
+	});
+}
+/**
+* A terminal protocol `error` frame (`wireCode` is its protocol code, e.g.
+* `INIT_FAILED`) or a socket fault (`TRANSPORT`). `beforeOpen` is true when
+* the socket never reached OPEN, so no PTY work started on this dial.
+* @deprecated Removed in 0.62; check `code`.
+*/
+var TerminalStreamError = class extends SandboxError {};
+//#endregion
+export { ServerError as C, ValidationError as D, TimeoutError as E, SandboxError as S, StreamInterruptedError as T, NotFoundError as _, readResponseJson as a, QuotaError as b, BranchFanoutExceedsHostError as c, EdgeNotReadyError as d, EgressProxyRecoveryError as f, NetworkError as g, KeyBudgetExhaustedError as h, parseResponseError as i, CapabilityError as l, GpuProviderNotConfiguredError as m, isTransientWrite as n, retryWhen as o, FileWriteConflictError as p, parseErrorResponse as r, AuthError as s, TerminalStreamError as t, CompliancePlacementError as u, PartialFailureError as v, StateError as w, ResumeEnvRequiredError as x, ProfileFileMountPathError as y };

package/dist/{file-download-BXgu9BNh.js → file-download-CKOxcATB.js}

@@ -1,5 +1,5 @@
 import { n as bytesToHex, t as sha256 } from "./sha2-vu4U-x2L.js";
-import { E as ValidationError } from "./errors-CaX0a5Ry.js";
+import { D as ValidationError } from "./errors-Mzq10WZq.js";
 //#region src/lib/file-download.ts
 function downloadBounds(options) {
 	for (const [name, value] of Object.entries({

package/dist/{index-DDIymnCZ.d.ts → index-DKsOu5sq.d.ts}

@@ -1,9 +1,9 @@
-import { $ as ProxySecretReceipt, At as SandboxCreateReceipt, B as InteractionAcknowledgement, C as AgentInteractiveSessionAttach, D as AgentInteractiveSessionPromptAcknowledgement, E as AgentInteractiveSessionControlClaimRequest, F as TerminalOutputEvent, H as InteractionResponseCommand, I as TerminalReplayWindow, M as AgentInteractiveSessionStopCommand, N as AgentInteractiveTerminalSession, O as AgentInteractiveSessionPromptCommand, R as AgentRunCancellationAcknowledgement, S as AgentInteractiveSessionStart, T as AgentInteractiveSessionControlClaimAcknowledgement, U as AgentProfile, V as InteractionRequest, bt as SandboxError, et as InteractionData, g as TerminalReadyInfo, i as TerminalStreamHandlers, j as AgentInteractiveSessionStopAcknowledgement, k as AgentInteractiveSessionRef, l as MintScopedTokenOptions, o as TerminalStreamReconnectAuthority, q as AgentProfileFileMount, u as ScopedToken, w as AgentInteractiveSessionControlClaim, z as AgentRunCancellationRequest } from "./terminal-stream-types-1YKRrkZB.js";
-import { $a as RawEvidenceBoxDirectoryExport, $r as ForkCounts, An as SandboxShape, Ar as DriverInfo, Bi as CreateSessionOptions, C as WorkspaceOperationLookup, Ci as IntelligenceReportWindow, Cn as TerminalStream, D as ProvisionResult, Di as SandboxEvent, E as ProvisionEvent, Ei as PromptResult, Fi as CommitTaskSessionOptions, Fn as EgressManager, G as GitBranch, Ga as ExecResult, Gi as ListMessagesOptions, Ha as CodeExecutionResult, Hi as DispatchPromptOptions, Ia as WorkspaceImagePublishInput, J as GitStatus, Ja as SandboxEnvRecoveryView, Ji as SendSessionMessageRequest, K as GitCommit, Ka as WriteFileRequest, Ki as PublicProfileConflict, Kt as SandboxFleetTraceBundle, La as WorkspaceImagePublishResult, Li as CompletedTurnResult, Ln as NetworkManager, Lr as GpuLeaseManager, Mi as SandboxTraceOptions, Mn as SandboxResourceUsage, Mr as GpuLease, N as WaitForOptions, Nn as SandboxRuntimeCapabilities, Pi as TurnBackendConfig, Qi as SessionExecutionInfo, Qr as BranchOptions, Ri as ConversationTurnOptions, S as StopOptions, Sn as TeePublicKeyResponse, Ti as PromptOptions, Tn as CreateSandboxOptions, U as PreviewLinkManager, Ua as CodeLanguage, Ui as DispatchedSession, Ur as CodeExecutionOptions, Vi as CreateTaskSessionOptions, Wi as DriveTurnOptions, Xa as RawEvidenceArchiveManifest, Xr as HttpClient, Yi as SentSessionMessage, Zi as SessionEventStreamOptions, _ as SnapshotInfo, _r as SearchMatch, aa as SessionMessage, ai as WaitForRolloutOptions, an as SandboxInfo, bi as IntelligenceReportBudget, bn as TeeAttestationResponse, c as SandboxDeleteOptions, ca as SessionResultOptions, co as InteractionResolutionAcknowledgement, cr as FileWriteResult, d as SandboxOperationKind, ei as ForkIdempotency, eo as RawEvidenceBoxExportOptions, f as SandboxOperationState, fa as TaskSessionInfo, ga as BackendConfig, gn as StartupDiagnostics, gr as WriteManyOptions, hi as DurablePlanDecisionResult, hn as SandboxTerminals, hr as WriteManyFile, ia as SessionListOptions, ii as RolloutStartResult, in as SandboxConnection, k as ResumeOptions, ki as SandboxTraceBundle, kn as SandboxStatus, la as TaskSessionChanges, ln as SandboxRuntimeHealth, m as SnapshotDeleteAcknowledgement, ma as TurnDriveResult, mi as DurablePlanDecisionOptions, mr as WriteFileOptions, na as SessionInfo, ni as Rollout, nn as SSHCommandDescriptor, no as RawEvidenceExportOptions, nr as FileSystem, o as RestoreSnapshotOptions, oa as SessionMessageAdmission, on as SandboxPortBinding, oo as RawEvidenceUnavailable, pi as DurablePlan, q as GitDiff, qa as SandboxEnvRecovery, qi as SendSessionMessageOptions, ra as SessionInterruptOptions, ri as RolloutOptions, rn as SSHCredentials, s as SandboxDeleteAcknowledgement, ta as SessionForkOptions, ti as ForkLookupOptions, to as RawEvidenceDirectoryExport, u as SandboxOperationInfo, ua as TaskSessionCommitResult, un as SandboxTerminalAttachOptions, v as SnapshotOptions, va as BackendManager, vi as EventStreamOptions, vn as TeeAttestationOptions, vr as SearchOptions, wi as PromptInputPart, x as SnapshotResult, xi as IntelligenceReportCompareTo, y as SnapshotProvenance, yi as IntelligenceReport, yr as ExecOptions, z as ProcessManager, zi as ConversationTurnResult } from "./types-B-UsXSi6.js";
+import { $ as ProxySecretReceipt, At as SandboxCreateReceipt, B as InteractionAcknowledgement, C as AgentInteractiveSessionAttach, D as AgentInteractiveSessionPromptAcknowledgement, E as AgentInteractiveSessionControlClaimRequest, F as TerminalOutputEvent, H as InteractionResponseCommand, I as TerminalReplayWindow, M as AgentInteractiveSessionStopCommand, N as AgentInteractiveTerminalSession, O as AgentInteractiveSessionPromptCommand, R as AgentRunCancellationAcknowledgement, S as AgentInteractiveSessionStart, T as AgentInteractiveSessionControlClaimAcknowledgement, U as AgentProfile, V as InteractionRequest, bt as SandboxError, et as InteractionData, g as TerminalReadyInfo, i as TerminalStreamHandlers, j as AgentInteractiveSessionStopAcknowledgement, k as AgentInteractiveSessionRef, l as MintScopedTokenOptions, o as TerminalStreamReconnectAuthority, q as AgentProfileFileMount, u as ScopedToken, w as AgentInteractiveSessionControlClaim, z as AgentRunCancellationRequest } from "./terminal-stream-types-BqNv5EuG.js";
+import { $a as RawEvidenceBoxDirectoryExport, $r as ForkCounts, An as SandboxShape, Ar as DriverInfo, Bi as CreateSessionOptions, C as WorkspaceOperationLookup, Ci as IntelligenceReportWindow, Cn as TerminalStream, D as ProvisionResult, Di as SandboxEvent, E as ProvisionEvent, Ei as PromptResult, Fi as CommitTaskSessionOptions, Fn as EgressManager, G as GitBranch, Ga as ExecResult, Gi as ListMessagesOptions, Ha as CodeExecutionResult, Hi as DispatchPromptOptions, Ia as WorkspaceImagePublishInput, J as GitStatus, Ja as SandboxEnvRecoveryView, Ji as SendSessionMessageRequest, K as GitCommit, Ka as WriteFileRequest, Ki as PublicProfileConflict, Kt as SandboxFleetTraceBundle, La as WorkspaceImagePublishResult, Li as CompletedTurnResult, Ln as NetworkManager, Lr as GpuLeaseManager, Mi as SandboxTraceOptions, Mn as SandboxResourceUsage, Mr as GpuLease, N as WaitForOptions, Nn as SandboxRuntimeCapabilities, Pi as TurnBackendConfig, Qi as SessionExecutionInfo, Qr as BranchOptions, Ri as ConversationTurnOptions, S as StopOptions, Sn as TeePublicKeyResponse, Ti as PromptOptions, Tn as CreateSandboxOptions, U as PreviewLinkManager, Ua as CodeLanguage, Ui as DispatchedSession, Ur as CodeExecutionOptions, Vi as CreateTaskSessionOptions, Wi as DriveTurnOptions, Xa as RawEvidenceArchiveManifest, Xr as HttpClient, Yi as SentSessionMessage, Zi as SessionEventStreamOptions, _ as SnapshotInfo, _r as SearchMatch, aa as SessionMessage, ai as WaitForRolloutOptions, an as SandboxInfo, bi as IntelligenceReportBudget, bn as TeeAttestationResponse, c as SandboxDeleteOptions, ca as SessionResultOptions, co as InteractionResolutionAcknowledgement, cr as FileWriteResult, d as SandboxOperationKind, ei as ForkIdempotency, eo as RawEvidenceBoxExportOptions, f as SandboxOperationState, fa as TaskSessionInfo, ga as BackendConfig, gn as StartupDiagnostics, gr as WriteManyOptions, hi as DurablePlanDecisionResult, hn as SandboxTerminals, hr as WriteManyFile, ia as SessionListOptions, ii as RolloutStartResult, in as SandboxConnection, k as ResumeOptions, ki as SandboxTraceBundle, kn as SandboxStatus, la as TaskSessionChanges, ln as SandboxRuntimeHealth, m as SnapshotDeleteAcknowledgement, ma as TurnDriveResult, mi as DurablePlanDecisionOptions, mr as WriteFileOptions, na as SessionInfo, ni as Rollout, nn as SSHCommandDescriptor, no as RawEvidenceExportOptions, nr as FileSystem, o as RestoreSnapshotOptions, oa as SessionMessageAdmission, on as SandboxPortBinding, oo as RawEvidenceUnavailable, pi as DurablePlan, q as GitDiff, qa as SandboxEnvRecovery, qi as SendSessionMessageOptions, ra as SessionInterruptOptions, ri as RolloutOptions, rn as SSHCredentials, s as SandboxDeleteAcknowledgement, ta as SessionForkOptions, ti as ForkLookupOptions, to as RawEvidenceDirectoryExport, u as SandboxOperationInfo, ua as TaskSessionCommitResult, un as SandboxTerminalAttachOptions, v as SnapshotOptions, va as BackendManager, vi as EventStreamOptions, vn as TeeAttestationOptions, vr as SearchOptions, wi as PromptInputPart, x as SnapshotResult, xi as IntelligenceReportCompareTo, y as SnapshotProvenance, yi as IntelligenceReport, yr as ExecOptions, z as ProcessManager, zi as ConversationTurnResult } from "./types-CiuGb4lZ.js";
 import { t as CliAuthReference } from "./cli-auth-bundle-Wg3x2hd2.js";
-import { n as SandboxLines } from "./lines-Br3ygqhP.js";
-import { _ as InteractiveSessionStatus, f as InteractiveAttachOptions, g as InteractiveRequestOptions, h as InteractiveObserveOptions, m as InteractiveControlClaimOptions, p as InteractiveControlClaimAcknowledgement } from "./browser-interactive-control-controller-DIvMQyer.js";
-import { r as InteractiveAttachRequest } from "./interactive-controller-DXGWBdYK.js";
+import { n as SandboxLines } from "./lines-CCHDUfQg.js";
+import { _ as InteractiveSessionStatus, f as InteractiveAttachOptions, g as InteractiveRequestOptions, h as InteractiveObserveOptions, m as InteractiveControlClaimOptions, p as InteractiveControlClaimAcknowledgement } from "./browser-interactive-control-controller-KOK6qn2s.js";
+import { r as InteractiveAttachRequest } from "./interactive-controller-YyZEsoB0.js";
 import { z } from "zod";
 import { OtlpTraceExport } from "@tangle-network/agent-trace-contract/otlp";