effect-agent 0.1.0-beta.14 → 0.1.0-beta.140

package/dist/sandbox/PageCrawl.mjs

@@ -0,0 +1,124 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { SandboxImplementation } from "./Sandbox.mjs";
+import { PageCaptureTargetUrl } from "./PageCapture.mjs";
+import { Context, Schema } from "effect";
+//#region src/sandbox/PageCrawl.ts
+var PageCrawl_exports = /* @__PURE__ */ __exportAll({
+	PageCrawl: () => PageCrawl,
+	PageCrawlError: () => PageCrawlError,
+	PageCrawlLimitError: () => PageCrawlLimitError,
+	PageCrawlLimits: () => PageCrawlLimits,
+	PageCrawlProtocolError: () => PageCrawlProtocolError,
+	PageCrawlPurpose: () => PageCrawlPurpose,
+	PageCrawlRateLimitedError: () => PageCrawlRateLimitedError,
+	PageCrawlRecord: () => PageCrawlRecord,
+	PageCrawlRecordMetadata: () => PageCrawlRecordMetadata,
+	PageCrawlRecordStatus: () => PageCrawlRecordStatus,
+	PageCrawlRequest: () => PageCrawlRequest,
+	PageCrawlStartUrl: () => PageCrawlStartUrl,
+	PageCrawlTerminalError: () => PageCrawlTerminalError
+});
+const MAX_PAGE_BYTES = 8388608;
+const MAX_TOTAL_BYTES = 67108864;
+const MAX_PAGES = 100;
+const MAX_DEPTH = 10;
+const MAX_DEADLINE_MILLIS = 6e5;
+const MAX_DIAGNOSTIC_LENGTH = 8e3;
+const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));
+const BoundedMarkdown = Schema.String.check(Schema.isMaxLength(MAX_PAGE_BYTES));
+const BoundedMessage = Schema.String.check(Schema.isMaxLength(MAX_DIAGNOSTIC_LENGTH));
+const HttpStatus = Schema.Int.check(Schema.isGreaterThanOrEqualTo(100), Schema.isLessThanOrEqualTo(599));
+/** One credential-free HTTPS URL. The first adapter confines every record to its exact host. */
+const PageCrawlStartUrl = PageCaptureTargetUrl;
+/** The declared uses Cloudflare evaluates against a site's Content Signals. */
+const PageCrawlPurpose = Schema.Literals([
+	"search",
+	"ai-input",
+	"ai-train"
+]);
+/** Immutable caller limits for one scoped crawl. */
+var PageCrawlLimits = class extends Schema.Class("PageCrawlLimits")({
+	maxPages: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_PAGES)),
+	maxDepth: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_DEPTH)),
+	maxPageBytes: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_PAGE_BYTES)),
+	maxTotalBytes: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_TOTAL_BYTES)),
+	deadlineMillis: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_DEADLINE_MILLIS))
+}) {};
+/** A rendered Markdown crawl rooted at one exact HTTPS host. */
+var PageCrawlRequest = class extends Schema.Class("PageCrawlRequest")({
+	startUrl: PageCrawlStartUrl,
+	purposes: Schema.Array(PageCrawlPurpose).check(Schema.isMinLength(1), Schema.isMaxLength(3), Schema.isUnique()),
+	limits: PageCrawlLimits
+}) {};
+/** Cloudflare's documented status for one discovered URL. */
+const PageCrawlRecordStatus = Schema.Literals([
+	"queued",
+	"completed",
+	"disallowed",
+	"skipped",
+	"errored",
+	"cancelled"
+]);
+/** Bounded origin metadata when Cloudflare reached the URL. */
+var PageCrawlRecordMetadata = class extends Schema.Class("PageCrawlRecordMetadata")({
+	status: HttpStatus,
+	url: PageCrawlStartUrl,
+	title: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096)))
+}) {};
+/** One untrusted page record. Non-completed statuses may have no Markdown. */
+var PageCrawlRecord = class extends Schema.Class("PageCrawlRecord")({
+	url: PageCrawlStartUrl,
+	status: PageCrawlRecordStatus,
+	markdown: Schema.optionalKey(BoundedMarkdown),
+	metadata: Schema.optionalKey(PageCrawlRecordMetadata)
+}) {};
+/** Cloudflare refused a request because of a request-rate or browser-quota limit. */
+var PageCrawlRateLimitedError = class extends Schema.TaggedError()("PageCrawlRateLimitedError", {
+	implementation: SandboxImplementation,
+	reason: Schema.Literals(["rate", "quota"]),
+	retryAfterMillis: Schema.optionalKey(Schema.Natural),
+	message: BoundedMessage,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/** The REST transport or provider response violated the crawl protocol. */
+var PageCrawlProtocolError = class extends Schema.TaggedError()("PageCrawlProtocolError", {
+	implementation: SandboxImplementation,
+	message: BoundedMessage,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/** The first record or operation that crossed one immutable caller limit. */
+var PageCrawlLimitError = class extends Schema.TaggedError()("PageCrawlLimitError", {
+	implementation: SandboxImplementation,
+	limit: Schema.Literals([
+		"pages",
+		"page-bytes",
+		"total-bytes",
+		"deadline"
+	]),
+	maximum: PositiveInt,
+	observed: Schema.Natural,
+	message: BoundedMessage
+}) {};
+/** A documented non-success terminal job status. */
+var PageCrawlTerminalError = class extends Schema.TaggedError()("PageCrawlTerminalError", {
+	implementation: SandboxImplementation,
+	status: Schema.Literals([
+		"errored",
+		"cancelled_by_user",
+		"cancelled_due_to_timeout",
+		"cancelled_due_to_limits"
+	]),
+	message: BoundedMessage
+}) {};
+const PageCrawlError = Schema.Union([
+	PageCrawlRateLimitedError,
+	PageCrawlProtocolError,
+	PageCrawlLimitError,
+	PageCrawlTerminalError
+]);
+/** Scoped exact-host crawl stream. Provider job identity and polling stay adapter-private. */
+var PageCrawl = class extends Context.Service()("@effect-agent/sandbox/PageCrawl") {};
+//#endregion
+export { PageCrawl, PageCrawlError, PageCrawlLimitError, PageCrawlLimits, PageCrawlProtocolError, PageCrawlPurpose, PageCrawlRateLimitedError, PageCrawlRecord, PageCrawlRecordMetadata, PageCrawlRecordStatus, PageCrawlRequest, PageCrawlStartUrl, PageCrawlTerminalError, PageCrawl_exports as t };
+
+//# sourceMappingURL=PageCrawl.mjs.map

package/dist/sandbox/PageCrawl.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PageCrawl.mjs","names":[],"sources":["../../src/sandbox/PageCrawl.ts"],"sourcesContent":["import { Context, Schema, type Scope, type Stream } from \"effect\";\n\nimport { PageCaptureTargetUrl } from \"./PageCapture.ts\";\nimport { SandboxImplementation } from \"./Sandbox.ts\";\n\nconst MAX_PAGE_BYTES = 8 * 1024 * 1024;\nconst MAX_TOTAL_BYTES = 64 * 1024 * 1024;\nconst MAX_PAGES = 100;\nconst MAX_DEPTH = 10;\nconst MAX_DEADLINE_MILLIS = 10 * 60_000;\nconst MAX_DIAGNOSTIC_LENGTH = 8_000;\nconst PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));\nconst BoundedMarkdown = Schema.String.check(Schema.isMaxLength(MAX_PAGE_BYTES));\nconst BoundedMessage = Schema.String.check(Schema.isMaxLength(MAX_DIAGNOSTIC_LENGTH));\n\nconst HttpStatus = Schema.Int.check(\n  Schema.isGreaterThanOrEqualTo(100),\n  Schema.isLessThanOrEqualTo(599),\n);\n\n/** One credential-free HTTPS URL. The first adapter confines every record to its exact host. */\nexport const PageCrawlStartUrl = PageCaptureTargetUrl;\nexport type PageCrawlStartUrl = typeof PageCrawlStartUrl.Type;\n\n/** The declared uses Cloudflare evaluates against a site's Content Signals. */\nexport const PageCrawlPurpose = Schema.Literals([\"search\", \"ai-input\", \"ai-train\"]);\nexport type PageCrawlPurpose = typeof PageCrawlPurpose.Type;\n\n/** Immutable caller limits for one scoped crawl. */\nexport class PageCrawlLimits extends Schema.Class<PageCrawlLimits>(\"PageCrawlLimits\")({\n  maxPages: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_PAGES)),\n  maxDepth: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_DEPTH)),\n  maxPageBytes: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_PAGE_BYTES)),\n  maxTotalBytes: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_TOTAL_BYTES)),\n  deadlineMillis: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_DEADLINE_MILLIS)),\n}) {}\n\n/** A rendered Markdown crawl rooted at one exact HTTPS host. */\nexport class PageCrawlRequest extends Schema.Class<PageCrawlRequest>(\"PageCrawlRequest\")({\n  startUrl: PageCrawlStartUrl,\n  purposes: Schema.Array(PageCrawlPurpose).check(\n    Schema.isMinLength(1),\n    Schema.isMaxLength(3),\n    Schema.isUnique(),\n  ),\n  limits: PageCrawlLimits,\n}) {}\n\n/** Cloudflare's documented status for one discovered URL. */\nexport const PageCrawlRecordStatus = Schema.Literals([\n  \"queued\",\n  \"completed\",\n  \"disallowed\",\n  \"skipped\",\n  \"errored\",\n  \"cancelled\",\n]);\n\nexport type PageCrawlRecordStatus = typeof PageCrawlRecordStatus.Type;\n\n/** Bounded origin metadata when Cloudflare reached the URL. */\nexport class PageCrawlRecordMetadata extends Schema.Class<PageCrawlRecordMetadata>(\n  \"PageCrawlRecordMetadata\",\n)({\n  status: HttpStatus,\n  url: PageCrawlStartUrl,\n  title: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4_096))),\n}) {}\n\n/** One untrusted page record. Non-completed statuses may have no Markdown. */\nexport class PageCrawlRecord extends Schema.Class<PageCrawlRecord>(\"PageCrawlRecord\")({\n  url: PageCrawlStartUrl,\n  status: PageCrawlRecordStatus,\n  markdown: Schema.optionalKey(BoundedMarkdown),\n  metadata: Schema.optionalKey(PageCrawlRecordMetadata),\n}) {}\n\n/** Cloudflare refused a request because of a request-rate or browser-quota limit. */\nexport class PageCrawlRateLimitedError extends Schema.TaggedError<PageCrawlRateLimitedError>()(\n  \"PageCrawlRateLimitedError\",\n  {\n    implementation: SandboxImplementation,\n    reason: Schema.Literals([\"rate\", \"quota\"]),\n    retryAfterMillis: Schema.optionalKey(Schema.Natural),\n    message: BoundedMessage,\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\n/** The REST transport or provider response violated the crawl protocol. */\nexport class PageCrawlProtocolError extends Schema.TaggedError<PageCrawlProtocolError>()(\n  \"PageCrawlProtocolError\",\n  {\n    implementation: SandboxImplementation,\n    message: BoundedMessage,\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\n/** The first record or operation that crossed one immutable caller limit. */\nexport class PageCrawlLimitError extends Schema.TaggedError<PageCrawlLimitError>()(\n  \"PageCrawlLimitError\",\n  {\n    implementation: SandboxImplementation,\n    limit: Schema.Literals([\"pages\", \"page-bytes\", \"total-bytes\", \"deadline\"]),\n    maximum: PositiveInt,\n    observed: Schema.Natural,\n    message: BoundedMessage,\n  },\n) {}\n\n/** A documented non-success terminal job status. */\nexport class PageCrawlTerminalError extends Schema.TaggedError<PageCrawlTerminalError>()(\n  \"PageCrawlTerminalError\",\n  {\n    implementation: SandboxImplementation,\n    status: Schema.Literals([\n      \"errored\",\n      \"cancelled_by_user\",\n      \"cancelled_due_to_timeout\",\n      \"cancelled_due_to_limits\",\n    ]),\n    message: BoundedMessage,\n  },\n) {}\n\nexport const PageCrawlError = Schema.Union([\n  PageCrawlRateLimitedError,\n  PageCrawlProtocolError,\n  PageCrawlLimitError,\n  PageCrawlTerminalError,\n]);\n\nexport type PageCrawlError = typeof PageCrawlError.Type;\n\n/** Scoped exact-host crawl stream. Provider job identity and polling stay adapter-private. */\nexport class PageCrawl extends Context.Service<\n  PageCrawl,\n  {\n    readonly crawl: (\n      request: PageCrawlRequest,\n    ) => Stream.Stream<PageCrawlRecord, PageCrawlError, Scope.Scope>;\n  }\n>()(\"@effect-agent/sandbox/PageCrawl\") {}\n\nexport type PageCrawlCrawl = (\n  request: PageCrawlRequest,\n) => Stream.Stream<PageCrawlRecord, PageCrawlError, Scope.Scope>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AACxB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;AAC9B,MAAM,cAAc,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,cAAc,CAAC;AAC9E,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,YAAY,qBAAqB,CAAC;AAEpF,MAAM,aAAa,OAAO,IAAI,MAC5B,OAAO,uBAAuB,GAAG,GACjC,OAAO,oBAAoB,GAAG,CAChC;;AAGA,MAAa,oBAAoB;;AAIjC,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAU;CAAY;AAAU,CAAC;;AAIlF,IAAa,kBAAb,cAAqC,OAAO,MAAuB,iBAAiB,CAAC,CAAC;CACpF,UAAU,YAAY,MAAM,OAAO,oBAAoB,SAAS,CAAC;CACjE,UAAU,YAAY,MAAM,OAAO,oBAAoB,SAAS,CAAC;CACjE,cAAc,YAAY,MAAM,OAAO,oBAAoB,cAAc,CAAC;CAC1E,eAAe,YAAY,MAAM,OAAO,oBAAoB,eAAe,CAAC;CAC5E,gBAAgB,YAAY,MAAM,OAAO,oBAAoB,mBAAmB,CAAC;AACnF,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,mBAAb,cAAsC,OAAO,MAAwB,kBAAkB,CAAC,CAAC;CACvF,UAAU;CACV,UAAU,OAAO,MAAM,gBAAgB,CAAC,CAAC,MACvC,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,CAAC,GACpB,OAAO,SAAS,CAClB;CACA,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,wBAAwB,OAAO,SAAS;CACnD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAKD,IAAa,0BAAb,cAA6C,OAAO,MAClD,yBACF,CAAC,CAAC;CACA,QAAQ;CACR,KAAK;CACL,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAK,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,kBAAb,cAAqC,OAAO,MAAuB,iBAAiB,CAAC,CAAC;CACpF,KAAK;CACL,QAAQ;CACR,UAAU,OAAO,YAAY,eAAe;CAC5C,UAAU,OAAO,YAAY,uBAAuB;AACtD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA;CACE,gBAAgB;CAChB,QAAQ,OAAO,SAAS,CAAC,QAAQ,OAAO,CAAC;CACzC,kBAAkB,OAAO,YAAY,OAAO,OAAO;CACnD,SAAS;CACT,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA;CACE,gBAAgB;CAChB,SAAS;CACT,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA;CACE,gBAAgB;CAChB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAc;EAAe;CAAU,CAAC;CACzE,SAAS;CACT,UAAU,OAAO;CACjB,SAAS;AACX,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA;CACE,gBAAgB;CAChB,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;CACF,CAAC;CACD,SAAS;AACX,CACF,CAAC,CAAC,CAAC;AAEH,MAAa,iBAAiB,OAAO,MAAM;CACzC;CACA;CACA;CACA;AACF,CAAC;;AAKD,IAAa,YAAb,cAA+B,QAAQ,QAOrC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC"}

package/dist/sandbox/PageScreenshot.d.mts

@@ -0,0 +1,48 @@
+import { p as SandboxImplementation } from "../Sandbox-CEsDWBLq.mjs";
+import { B as PageUrlTarget, E as PageCaptureUnsupportedError, M as PageNavigationOptions, N as PageResourcePolicy, V as PageViewport, h as PageCaptureNavigationError, k as PageHtmlTarget, v as PageCaptureProtocolError, y as PageCaptureRateLimitedError } from "../PageCapture-Df8Xwskw.mjs";
+import { Context, Effect, Schema } from "effect";
+declare namespace PageScreenshot_d_exports {
+  export { PageScreenshot, PageScreenshotCapture, PageScreenshotError, PageScreenshotLimits, PageScreenshotOutputLimitError, PageScreenshotRequest, PageScreenshotResult };
+}
+declare const PageScreenshotLimits_base: Schema.Class<PageScreenshotLimits, Schema.Struct<{
+  readonly maxOutputBytes: Schema.Int;
+}>, {}>;
+/** The byte limit and full-page choice are fixed before Browser Run starts. */
+export declare class PageScreenshotLimits extends PageScreenshotLimits_base {}
+declare const PageScreenshotRequest_base: Schema.Class<PageScreenshotRequest, Schema.Struct<{
+  readonly target: Schema.Union<readonly [typeof PageUrlTarget, typeof PageHtmlTarget]>;
+  readonly engine: Schema.Literals<readonly ["chromium", "kitesurf"]>;
+  readonly limits: typeof PageScreenshotLimits;
+  readonly fullPage: Schema.Boolean;
+  readonly navigation: Schema.optionalKey<typeof PageNavigationOptions>;
+  readonly viewport: Schema.optionalKey<typeof PageViewport>;
+  readonly resourcePolicy: Schema.optionalKey<typeof PageResourcePolicy>;
+}>, {}>;
+/** Schema-first request for exactly one PNG screenshot. */
+export declare class PageScreenshotRequest extends PageScreenshotRequest_base {}
+declare const PageScreenshotResult_base: Schema.Class<PageScreenshotResult, Schema.Struct<{
+  readonly implementation: typeof SandboxImplementation;
+  readonly mediaType: Schema.Literal<"image/png">;
+  readonly bytes: Schema.Uint8Array;
+}>, {}>;
+/** The only successful output: bytes are caller-owned and never durable framework data. */
+export declare class PageScreenshotResult extends PageScreenshotResult_base {}
+declare const PageScreenshotOutputLimitError_base: Schema.Class<PageScreenshotOutputLimitError, Schema.TaggedStruct<"PageScreenshotOutputLimitError", {
+  readonly implementation: typeof SandboxImplementation;
+  readonly limit: Schema.Int;
+  readonly observed: Schema.Natural;
+}>, import("effect/Cause").YieldableError>;
+/** The response crossed the request's PNG byte limit. */
+export declare class PageScreenshotOutputLimitError extends PageScreenshotOutputLimitError_base {}
+/** Expected screenshot failures. The shared capture errors keep identical semantics. */
+export declare const PageScreenshotError: Schema.Union<readonly [typeof PageCaptureRateLimitedError, typeof PageCaptureNavigationError, typeof PageCaptureUnsupportedError, typeof PageCaptureProtocolError, typeof PageScreenshotOutputLimitError]>;
+export type PageScreenshotError = typeof PageScreenshotError.Type;
+declare const PageScreenshot_base: Context.ServiceClass<PageScreenshot, "@effect-agent/sandbox/PageScreenshot", {
+  readonly capture: (request: PageScreenshotRequest) => Effect.Effect<PageScreenshotResult, PageScreenshotError>;
+}>;
+/** Stateless, one-output PNG capture port. It owns neither persistence nor later byte handoff. */
+export declare class PageScreenshot extends PageScreenshot_base {}
+export type PageScreenshotCapture = (request: PageScreenshotRequest) => Effect.Effect<PageScreenshotResult, PageScreenshotError>;
+//#endregion
+export { PageScreenshot_d_exports as t };
+//# sourceMappingURL=PageScreenshot.d.mts.map

package/dist/sandbox/PageScreenshot.mjs

@@ -0,0 +1,53 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { SandboxImplementation } from "./Sandbox.mjs";
+import { PageCaptureEngine, PageCaptureNavigationError, PageCaptureProtocolError, PageCaptureRateLimitedError, PageCaptureTarget, PageCaptureUnsupportedError, PageNavigationOptions, PageResourcePolicy, PageViewport } from "./PageCapture.mjs";
+import { Context, Schema } from "effect";
+//#region src/sandbox/PageScreenshot.ts
+var PageScreenshot_exports = /* @__PURE__ */ __exportAll({
+	PageScreenshot: () => PageScreenshot,
+	PageScreenshotError: () => PageScreenshotError,
+	PageScreenshotLimits: () => PageScreenshotLimits,
+	PageScreenshotOutputLimitError: () => PageScreenshotOutputLimitError,
+	PageScreenshotRequest: () => PageScreenshotRequest,
+	PageScreenshotResult: () => PageScreenshotResult
+});
+const MAX_SCREENSHOT_BYTES = 8388608;
+const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));
+/** The byte limit and full-page choice are fixed before Browser Run starts. */
+var PageScreenshotLimits = class extends Schema.Class("PageScreenshotLimits")({ maxOutputBytes: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_SCREENSHOT_BYTES)) }) {};
+/** Schema-first request for exactly one PNG screenshot. */
+var PageScreenshotRequest = class extends Schema.Class("PageScreenshotRequest")({
+	target: PageCaptureTarget,
+	engine: PageCaptureEngine,
+	limits: PageScreenshotLimits,
+	fullPage: Schema.Boolean,
+	navigation: Schema.optionalKey(PageNavigationOptions),
+	viewport: Schema.optionalKey(PageViewport),
+	resourcePolicy: Schema.optionalKey(PageResourcePolicy)
+}) {};
+/** The only successful output: bytes are caller-owned and never durable framework data. */
+var PageScreenshotResult = class extends Schema.Class("PageScreenshotResult")({
+	implementation: SandboxImplementation,
+	mediaType: Schema.Literal("image/png"),
+	bytes: Schema.Uint8Array.check(Schema.isMaxLength(MAX_SCREENSHOT_BYTES))
+}) {};
+/** The response crossed the request's PNG byte limit. */
+var PageScreenshotOutputLimitError = class extends Schema.TaggedError()("PageScreenshotOutputLimitError", {
+	implementation: SandboxImplementation,
+	limit: PositiveInt,
+	observed: Schema.Natural
+}) {};
+/** Expected screenshot failures. The shared capture errors keep identical semantics. */
+const PageScreenshotError = Schema.Union([
+	PageCaptureRateLimitedError,
+	PageCaptureNavigationError,
+	PageCaptureUnsupportedError,
+	PageCaptureProtocolError,
+	PageScreenshotOutputLimitError
+]);
+/** Stateless, one-output PNG capture port. It owns neither persistence nor later byte handoff. */
+var PageScreenshot = class extends Context.Service()("@effect-agent/sandbox/PageScreenshot") {};
+//#endregion
+export { PageScreenshot, PageScreenshotError, PageScreenshotLimits, PageScreenshotOutputLimitError, PageScreenshotRequest, PageScreenshotResult, PageScreenshot_exports as t };
+
+//# sourceMappingURL=PageScreenshot.mjs.map

package/dist/sandbox/PageScreenshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PageScreenshot.mjs","names":[],"sources":["../../src/sandbox/PageScreenshot.ts"],"sourcesContent":["import { Context, Schema, type Effect } from \"effect\";\n\nimport {\n  PageCaptureEngine,\n  PageCaptureNavigationError,\n  PageCaptureProtocolError,\n  PageCaptureRateLimitedError,\n  PageCaptureTarget,\n  PageCaptureUnsupportedError,\n  PageNavigationOptions,\n  PageResourcePolicy,\n  PageViewport,\n} from \"./PageCapture.ts\";\nimport { SandboxImplementation } from \"./Sandbox.ts\";\n\nconst MAX_SCREENSHOT_BYTES = 8 * 1024 * 1024;\nconst PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));\n\n/** The byte limit and full-page choice are fixed before Browser Run starts. */\nexport class PageScreenshotLimits extends Schema.Class<PageScreenshotLimits>(\n  \"PageScreenshotLimits\",\n)({\n  maxOutputBytes: PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_SCREENSHOT_BYTES)),\n}) {}\n\n/** Schema-first request for exactly one PNG screenshot. */\nexport class PageScreenshotRequest extends Schema.Class<PageScreenshotRequest>(\n  \"PageScreenshotRequest\",\n)({\n  target: PageCaptureTarget,\n  engine: PageCaptureEngine,\n  limits: PageScreenshotLimits,\n  fullPage: Schema.Boolean,\n  navigation: Schema.optionalKey(PageNavigationOptions),\n  viewport: Schema.optionalKey(PageViewport),\n  resourcePolicy: Schema.optionalKey(PageResourcePolicy),\n}) {}\n\n/** The only successful output: bytes are caller-owned and never durable framework data. */\nexport class PageScreenshotResult extends Schema.Class<PageScreenshotResult>(\n  \"PageScreenshotResult\",\n)({\n  implementation: SandboxImplementation,\n  mediaType: Schema.Literal(\"image/png\"),\n  bytes: Schema.Uint8Array.check(Schema.isMaxLength(MAX_SCREENSHOT_BYTES)),\n}) {}\n\n/** The response crossed the request's PNG byte limit. */\nexport class PageScreenshotOutputLimitError extends Schema.TaggedError<PageScreenshotOutputLimitError>()(\n  \"PageScreenshotOutputLimitError\",\n  {\n    implementation: SandboxImplementation,\n    limit: PositiveInt,\n    observed: Schema.Natural,\n  },\n) {}\n\n/** Expected screenshot failures. The shared capture errors keep identical semantics. */\nexport const PageScreenshotError = Schema.Union([\n  PageCaptureRateLimitedError,\n  PageCaptureNavigationError,\n  PageCaptureUnsupportedError,\n  PageCaptureProtocolError,\n  PageScreenshotOutputLimitError,\n]);\n\nexport type PageScreenshotError = typeof PageScreenshotError.Type;\n\n/** Stateless, one-output PNG capture port. It owns neither persistence nor later byte handoff. */\nexport class PageScreenshot extends Context.Service<\n  PageScreenshot,\n  {\n    readonly capture: (\n      request: PageScreenshotRequest,\n    ) => Effect.Effect<PageScreenshotResult, PageScreenshotError>;\n  }\n>()(\"@effect-agent/sandbox/PageScreenshot\") {}\n\nexport type PageScreenshotCapture = (\n  request: PageScreenshotRequest,\n) => Effect.Effect<PageScreenshotResult, PageScreenshotError>;\n"],"mappings":";;;;;;;;;;;;;AAeA,MAAM,uBAAuB;AAC7B,MAAM,cAAc,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;;AAG5D,IAAa,uBAAb,cAA0C,OAAO,MAC/C,sBACF,CAAC,CAAC,EACA,gBAAgB,YAAY,MAAM,OAAO,oBAAoB,oBAAoB,CAAC,EACpF,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,uBACF,CAAC,CAAC;CACA,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,UAAU,OAAO;CACjB,YAAY,OAAO,YAAY,qBAAqB;CACpD,UAAU,OAAO,YAAY,YAAY;CACzC,gBAAgB,OAAO,YAAY,kBAAkB;AACvD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,uBAAb,cAA0C,OAAO,MAC/C,sBACF,CAAC,CAAC;CACA,gBAAgB;CAChB,WAAW,OAAO,QAAQ,WAAW;CACrC,OAAO,OAAO,WAAW,MAAM,OAAO,YAAY,oBAAoB,CAAC;AACzE,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA;CACE,gBAAgB;CAChB,OAAO;CACP,UAAU,OAAO;AACnB,CACF,CAAC,CAAC,CAAC;;AAGH,MAAa,sBAAsB,OAAO,MAAM;CAC9C;CACA;CACA;CACA;CACA;AACF,CAAC;;AAKD,IAAa,iBAAb,cAAoC,QAAQ,QAO1C,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/dist/sandbox/Sandbox.d.mts

@@ -0,0 +1,2 @@
+import { C as SandboxSpawnError, E as SandboxUnsupportedRequestError, S as SandboxSecretHandle, T as SandboxTimeoutError, _ as SandboxOutput, a as SandboxArtifact, b as SandboxResourceUse, c as SandboxError, d as SandboxExitError, f as SandboxExited, g as SandboxNetworkPolicy, h as SandboxMount, i as Sandbox, l as SandboxEvent, m as SandboxLimits, n as NetworkDisabled, o as SandboxArtifactRule, p as SandboxImplementation, r as SANDBOX_DIAGNOSTIC_MAX_LENGTH, s as SandboxEnvironment, t as NetworkAllowlist, u as SandboxExecute, v as SandboxOutputLimitError, w as SandboxStarted, x as SandboxRuntime, y as SandboxRequest } from "../Sandbox-CEsDWBLq.mjs";
+export { NetworkAllowlist, NetworkDisabled, SANDBOX_DIAGNOSTIC_MAX_LENGTH, Sandbox, SandboxArtifact, SandboxArtifactRule, SandboxEnvironment, SandboxError, SandboxEvent, SandboxExecute, SandboxExitError, SandboxExited, SandboxImplementation, SandboxLimits, SandboxMount, SandboxNetworkPolicy, SandboxOutput, SandboxOutputLimitError, SandboxRequest, SandboxResourceUse, SandboxRuntime, SandboxSecretHandle, SandboxSpawnError, SandboxStarted, SandboxTimeoutError, SandboxUnsupportedRequestError };

package/dist/sandbox/Sandbox.mjs

@@ -0,0 +1,208 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { Context, Duration, Schema } from "effect";
+//#region src/sandbox/Sandbox.ts
+var Sandbox_exports = /* @__PURE__ */ __exportAll({
+	NetworkAllowlist: () => NetworkAllowlist,
+	NetworkDisabled: () => NetworkDisabled,
+	SANDBOX_DIAGNOSTIC_MAX_LENGTH: () => SANDBOX_DIAGNOSTIC_MAX_LENGTH,
+	Sandbox: () => Sandbox,
+	SandboxArtifact: () => SandboxArtifact,
+	SandboxArtifactRule: () => SandboxArtifactRule,
+	SandboxEnvironment: () => SandboxEnvironment,
+	SandboxError: () => SandboxError,
+	SandboxEvent: () => SandboxEvent,
+	SandboxExitError: () => SandboxExitError,
+	SandboxExited: () => SandboxExited,
+	SandboxImplementation: () => SandboxImplementation,
+	SandboxLimits: () => SandboxLimits,
+	SandboxMount: () => SandboxMount,
+	SandboxNetworkPolicy: () => SandboxNetworkPolicy,
+	SandboxOutput: () => SandboxOutput,
+	SandboxOutputLimitError: () => SandboxOutputLimitError,
+	SandboxRequest: () => SandboxRequest,
+	SandboxResourceUse: () => SandboxResourceUse,
+	SandboxRuntime: () => SandboxRuntime,
+	SandboxSecretHandle: () => SandboxSecretHandle,
+	SandboxSpawnError: () => SandboxSpawnError,
+	SandboxStarted: () => SandboxStarted,
+	SandboxTimeoutError: () => SandboxTimeoutError,
+	SandboxUnsupportedRequestError: () => SandboxUnsupportedRequestError
+});
+const BoundedName = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+const BoundedPath = Schema.NonEmptyString.check(Schema.isMaxLength(4096));
+const BoundedArgument = Schema.String.check(Schema.isMaxLength(32768));
+const MAX_OUTPUT_BYTES = 16777216;
+const MAX_ARTIFACT_RULES = 64;
+const BoundedOutputText = Schema.String.check(Schema.isMaxLength(MAX_OUTPUT_BYTES));
+const SANDBOX_DIAGNOSTIC_MAX_LENGTH = 8192;
+const BoundedDiagnostic = Schema.String.check(Schema.isMaxLength(SANDBOX_DIAGNOSTIC_MAX_LENGTH));
+const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));
+const PositiveNumber = Schema.Finite.check(Schema.isGreaterThan(0));
+const MaxOutputBytes = PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES));
+const BoundedArguments = Schema.Array(BoundedArgument).check(Schema.isMaxLength(256));
+const BoundedEnvironmentNames = Schema.Array(BoundedName).check(Schema.isMaxLength(128));
+const FinitePositiveDuration = Schema.Duration.pipe(Schema.refine((duration) => Duration.isFinite(duration) && Duration.isPositive(duration), { expected: "a finite positive duration" }));
+const FiniteNonNegativeDuration = Schema.Duration.pipe(Schema.refine((duration) => Duration.isFinite(duration) && !Duration.isNegative(duration), { expected: "a finite non-negative duration" }));
+/** A requested runtime image or executable environment. */
+var SandboxRuntime = class extends Schema.Class("SandboxRuntime")({
+	kind: Schema.Literals([
+		"container",
+		"microvm",
+		"wasm",
+		"unisolated-process"
+	]),
+	identity: BoundedName
+}) {};
+/** The implementation and its isolation posture that executed a request. */
+var SandboxImplementation = class extends Schema.Class("SandboxImplementation")({
+	isolation: Schema.Literals(["isolated", "unisolated"]),
+	identity: BoundedName
+}) {};
+/** A host path made available to the requested runtime. */
+var SandboxMount = class extends Schema.Class("SandboxMount")({
+	source: BoundedPath,
+	target: BoundedPath,
+	access: Schema.Literals(["read-only", "read-write"])
+}) {};
+/** Explicitly denies all workload network access. */
+var NetworkDisabled = class extends Schema.TaggedClass()("NetworkDisabled", {}) {};
+/** Explicitly permits connections only to the named destination and port allowlists. */
+var NetworkAllowlist = class extends Schema.TaggedClass()("NetworkAllowlist", {
+	domains: Schema.Array(BoundedName).check(Schema.isMaxLength(256)),
+	ports: Schema.Array(PositiveInt.check(Schema.isLessThanOrEqualTo(65535))).check(Schema.isMaxLength(256))
+}) {};
+/** Network access policy supplied to a sandbox implementation. */
+const SandboxNetworkPolicy = Schema.Union([NetworkDisabled, NetworkAllowlist]);
+/** Names of ambient variables that may be copied into the workload environment. */
+var SandboxEnvironment = class extends Schema.Class("SandboxEnvironment")({ allow: BoundedEnvironmentNames }) {};
+/** Limits that a sandbox implementation must either enforce or reject. */
+var SandboxLimits = class extends Schema.Class("SandboxLimits")({
+	cpuCores: Schema.optionalKey(PositiveNumber.check(Schema.isLessThanOrEqualTo(1024))),
+	memoryBytes: Schema.optionalKey(PositiveInt.check(Schema.isLessThanOrEqualTo(1099511627776))),
+	maxOutputBytes: MaxOutputBytes,
+	maxWallTime: FinitePositiveDuration
+}) {};
+/** A secret reference; raw secret values are never part of a sandbox request. */
+var SandboxSecretHandle = class extends Schema.Class("SandboxSecretHandle")({
+	id: BoundedName,
+	purpose: Schema.NonEmptyString.check(Schema.isMaxLength(2048))
+}) {};
+/** Rules for copying selected workload output out of an isolated runtime. */
+var SandboxArtifactRule = class extends Schema.Class("SandboxArtifactRule")({
+	path: BoundedPath,
+	maxBytes: MaxOutputBytes
+}) {};
+/** Metadata for an artifact that a sandbox implementation released after applying its rules. */
+var SandboxArtifact = class extends Schema.Class("SandboxArtifact")({
+	path: BoundedPath,
+	bytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES)),
+	digest: BoundedName,
+	mediaType: Schema.optionalKey(BoundedName)
+}) {};
+/** Schema-first command execution request. Command and arguments are intentionally separate. */
+var SandboxRequest = class extends Schema.Class("SandboxRequest")({
+	runtime: SandboxRuntime,
+	command: BoundedPath,
+	args: BoundedArguments,
+	cwd: BoundedPath,
+	environment: SandboxEnvironment,
+	mounts: Schema.Array(SandboxMount).check(Schema.isMaxLength(64)),
+	network: SandboxNetworkPolicy,
+	limits: SandboxLimits,
+	secretHandles: Schema.Array(SandboxSecretHandle).check(Schema.isMaxLength(64)),
+	artifactRules: Schema.Array(SandboxArtifactRule).check(Schema.isMaxLength(MAX_ARTIFACT_RULES))
+}) {};
+/** Accounting that a sandbox implementation was able to observe for one execution. */
+var SandboxResourceUse = class extends Schema.Class("SandboxResourceUse")({
+	wallTime: FiniteNonNegativeDuration,
+	stdoutBytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES)),
+	stderrBytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES)),
+	cpuMillis: Schema.optionalKey(Schema.Natural),
+	memoryBytes: Schema.optionalKey(Schema.Natural)
+}) {};
+const SandboxEventBase = {
+	eventVersion: Schema.Literal(1),
+	implementation: SandboxImplementation
+};
+/** Signals that the implementation has accepted the request and started its workload. */
+var SandboxStarted = class extends Schema.TaggedClass()("SandboxStarted", {
+	...SandboxEventBase,
+	runtime: SandboxRuntime
+}) {};
+/** A bounded text fragment from stdout or stderr. Sandbox output is sensitive by default. */
+var SandboxOutput = class extends Schema.TaggedClass()("SandboxOutput", {
+	...SandboxEventBase,
+	stream: Schema.Literals(["stdout", "stderr"]),
+	text: BoundedOutputText,
+	bytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES))
+}) {};
+/** The terminal process status and observed bounded resource usage. */
+var SandboxExited = class extends Schema.TaggedClass()("SandboxExited", {
+	...SandboxEventBase,
+	exitCode: Schema.Int,
+	resourceUse: SandboxResourceUse,
+	artifacts: Schema.Array(SandboxArtifact).check(Schema.isMaxLength(MAX_ARTIFACT_RULES))
+}) {};
+/** Versioned execution event stream. */
+const SandboxEvent = Schema.Union([
+	SandboxStarted,
+	SandboxOutput,
+	SandboxExited
+]);
+/** The runtime could not start the requested process. */
+var SandboxSpawnError = class extends Schema.TaggedError()("SandboxSpawnError", {
+	implementation: SandboxImplementation,
+	command: BoundedPath,
+	message: BoundedDiagnostic,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/** The process ended unsuccessfully after starting. */
+var SandboxExitError = class extends Schema.TaggedError()("SandboxExitError", {
+	implementation: SandboxImplementation,
+	exitCode: Schema.Int,
+	message: BoundedDiagnostic,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/** The wall-clock execution limit elapsed and the owned process was interrupted. */
+var SandboxTimeoutError = class extends Schema.TaggedError()("SandboxTimeoutError", {
+	implementation: SandboxImplementation,
+	maxWallTime: FinitePositiveDuration
+}) {};
+/** A stdout or stderr stream exceeded its configured bounded-output limit. */
+var SandboxOutputLimitError = class extends Schema.TaggedError()("SandboxOutputLimitError", {
+	implementation: SandboxImplementation,
+	stream: Schema.Literals(["stdout", "stderr"]),
+	limit: PositiveInt,
+	observed: PositiveInt
+}) {};
+/** The selected implementation cannot honestly enforce one requested security or resource feature. */
+var SandboxUnsupportedRequestError = class extends Schema.TaggedError()("SandboxUnsupportedRequestError", {
+	implementation: SandboxImplementation,
+	feature: Schema.Literals([
+		"runtime",
+		"mounts",
+		"network",
+		"cpu-limit",
+		"memory-limit",
+		"secret-handles",
+		"artifacts"
+	]),
+	message: BoundedDiagnostic
+}) {};
+/** Expected sandbox execution failures. Interruption remains an Effect interruption, never a fabricated exit. */
+const SandboxError = Schema.Union([
+	SandboxSpawnError,
+	SandboxExitError,
+	SandboxTimeoutError,
+	SandboxOutputLimitError,
+	SandboxUnsupportedRequestError
+]);
+/**
+* Scoped command/code execution capability. Implementations must identify their isolation posture
+* in every emitted event; an `unisolated` implementation is never a security sandbox.
+*/
+var Sandbox = class extends Context.Service()("@effect-agent/sandbox/Sandbox") {};
+//#endregion
+export { NetworkAllowlist, NetworkDisabled, SANDBOX_DIAGNOSTIC_MAX_LENGTH, Sandbox, SandboxArtifact, SandboxArtifactRule, SandboxEnvironment, SandboxError, SandboxEvent, SandboxExitError, SandboxExited, SandboxImplementation, SandboxLimits, SandboxMount, SandboxNetworkPolicy, SandboxOutput, SandboxOutputLimitError, SandboxRequest, SandboxResourceUse, SandboxRuntime, SandboxSecretHandle, SandboxSpawnError, SandboxStarted, SandboxTimeoutError, SandboxUnsupportedRequestError, Sandbox_exports as t };
+
+//# sourceMappingURL=Sandbox.mjs.map

package/dist/sandbox/Sandbox.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sandbox.mjs","names":[],"sources":["../../src/sandbox/Sandbox.ts"],"sourcesContent":["import { Context, Duration, Schema, type Stream } from \"effect\";\n\nconst BoundedName = Schema.NonEmptyString.check(Schema.isMaxLength(256));\nconst BoundedPath = Schema.NonEmptyString.check(Schema.isMaxLength(4 * 1024));\nconst BoundedArgument = Schema.String.check(Schema.isMaxLength(32 * 1024));\nconst MAX_OUTPUT_BYTES = 16 * 1024 * 1024;\nconst MAX_ARTIFACT_RULES = 64;\nconst BoundedOutputText = Schema.String.check(Schema.isMaxLength(MAX_OUTPUT_BYTES));\n\nexport const SANDBOX_DIAGNOSTIC_MAX_LENGTH = 8 * 1024;\nconst BoundedDiagnostic = Schema.String.check(Schema.isMaxLength(SANDBOX_DIAGNOSTIC_MAX_LENGTH));\nconst PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));\nconst PositiveNumber = Schema.Finite.check(Schema.isGreaterThan(0));\nconst MaxOutputBytes = PositiveInt.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES));\nconst BoundedArguments = Schema.Array(BoundedArgument).check(Schema.isMaxLength(256));\nconst BoundedEnvironmentNames = Schema.Array(BoundedName).check(Schema.isMaxLength(128));\n\nconst FinitePositiveDuration = Schema.Duration.pipe(\n  Schema.refine(\n    (duration): duration is Duration.Duration =>\n      Duration.isFinite(duration) && Duration.isPositive(duration),\n    { expected: \"a finite positive duration\" },\n  ),\n);\n\nconst FiniteNonNegativeDuration = Schema.Duration.pipe(\n  Schema.refine(\n    (duration): duration is Duration.Duration =>\n      Duration.isFinite(duration) && !Duration.isNegative(duration),\n    { expected: \"a finite non-negative duration\" },\n  ),\n);\n\n/** A requested runtime image or executable environment. */\nexport class SandboxRuntime extends Schema.Class<SandboxRuntime>(\"SandboxRuntime\")({\n  kind: Schema.Literals([\"container\", \"microvm\", \"wasm\", \"unisolated-process\"]),\n  identity: BoundedName,\n}) {}\n\n/** The implementation and its isolation posture that executed a request. */\nexport class SandboxImplementation extends Schema.Class<SandboxImplementation>(\n  \"SandboxImplementation\",\n)({\n  isolation: Schema.Literals([\"isolated\", \"unisolated\"]),\n  identity: BoundedName,\n}) {}\n\n/** A host path made available to the requested runtime. */\nexport class SandboxMount extends Schema.Class<SandboxMount>(\"SandboxMount\")({\n  source: BoundedPath,\n  target: BoundedPath,\n  access: Schema.Literals([\"read-only\", \"read-write\"]),\n}) {}\n\n/** Explicitly denies all workload network access. */\nexport class NetworkDisabled extends Schema.TaggedClass<NetworkDisabled>()(\"NetworkDisabled\", {}) {}\n\n/** Explicitly permits connections only to the named destination and port allowlists. */\nexport class NetworkAllowlist extends Schema.TaggedClass<NetworkAllowlist>()(\"NetworkAllowlist\", {\n  domains: Schema.Array(BoundedName).check(Schema.isMaxLength(256)),\n  ports: Schema.Array(PositiveInt.check(Schema.isLessThanOrEqualTo(65_535))).check(\n    Schema.isMaxLength(256),\n  ),\n}) {}\n\n/** Network access policy supplied to a sandbox implementation. */\nexport const SandboxNetworkPolicy = Schema.Union([NetworkDisabled, NetworkAllowlist]);\nexport type SandboxNetworkPolicy = typeof SandboxNetworkPolicy.Type;\n\n/** Names of ambient variables that may be copied into the workload environment. */\nexport class SandboxEnvironment extends Schema.Class<SandboxEnvironment>(\"SandboxEnvironment\")({\n  allow: BoundedEnvironmentNames,\n}) {}\n\n/** Limits that a sandbox implementation must either enforce or reject. */\nexport class SandboxLimits extends Schema.Class<SandboxLimits>(\"SandboxLimits\")({\n  cpuCores: Schema.optionalKey(PositiveNumber.check(Schema.isLessThanOrEqualTo(1_024))),\n  memoryBytes: Schema.optionalKey(\n    PositiveInt.check(Schema.isLessThanOrEqualTo(1024 * 1024 * 1024 * 1024)),\n  ),\n  maxOutputBytes: MaxOutputBytes,\n  maxWallTime: FinitePositiveDuration,\n}) {}\n\n/** A secret reference; raw secret values are never part of a sandbox request. */\nexport class SandboxSecretHandle extends Schema.Class<SandboxSecretHandle>(\"SandboxSecretHandle\")({\n  id: BoundedName,\n  purpose: Schema.NonEmptyString.check(Schema.isMaxLength(2 * 1024)),\n}) {}\n\n/** Rules for copying selected workload output out of an isolated runtime. */\nexport class SandboxArtifactRule extends Schema.Class<SandboxArtifactRule>(\"SandboxArtifactRule\")({\n  path: BoundedPath,\n  maxBytes: MaxOutputBytes,\n}) {}\n\n/** Metadata for an artifact that a sandbox implementation released after applying its rules. */\nexport class SandboxArtifact extends Schema.Class<SandboxArtifact>(\"SandboxArtifact\")({\n  path: BoundedPath,\n  bytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES)),\n  digest: BoundedName,\n  mediaType: Schema.optionalKey(BoundedName),\n}) {}\n\n/** Schema-first command execution request. Command and arguments are intentionally separate. */\nexport class SandboxRequest extends Schema.Class<SandboxRequest>(\"SandboxRequest\")({\n  runtime: SandboxRuntime,\n  command: BoundedPath,\n  args: BoundedArguments,\n  cwd: BoundedPath,\n  environment: SandboxEnvironment,\n  mounts: Schema.Array(SandboxMount).check(Schema.isMaxLength(64)),\n  network: SandboxNetworkPolicy,\n  limits: SandboxLimits,\n  secretHandles: Schema.Array(SandboxSecretHandle).check(Schema.isMaxLength(64)),\n  artifactRules: Schema.Array(SandboxArtifactRule).check(Schema.isMaxLength(MAX_ARTIFACT_RULES)),\n}) {}\n\n/** Accounting that a sandbox implementation was able to observe for one execution. */\nexport class SandboxResourceUse extends Schema.Class<SandboxResourceUse>(\"SandboxResourceUse\")({\n  wallTime: FiniteNonNegativeDuration,\n  stdoutBytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES)),\n  stderrBytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES)),\n  cpuMillis: Schema.optionalKey(Schema.Natural),\n  memoryBytes: Schema.optionalKey(Schema.Natural),\n}) {}\n\nconst SandboxEventBase = {\n  eventVersion: Schema.Literal(1),\n  implementation: SandboxImplementation,\n};\n\n/** Signals that the implementation has accepted the request and started its workload. */\nexport class SandboxStarted extends Schema.TaggedClass<SandboxStarted>()(\"SandboxStarted\", {\n  ...SandboxEventBase,\n  runtime: SandboxRuntime,\n}) {}\n\n/** A bounded text fragment from stdout or stderr. Sandbox output is sensitive by default. */\nexport class SandboxOutput extends Schema.TaggedClass<SandboxOutput>()(\"SandboxOutput\", {\n  ...SandboxEventBase,\n  stream: Schema.Literals([\"stdout\", \"stderr\"]),\n  text: BoundedOutputText,\n  bytes: Schema.Natural.check(Schema.isLessThanOrEqualTo(MAX_OUTPUT_BYTES)),\n}) {}\n\n/** The terminal process status and observed bounded resource usage. */\nexport class SandboxExited extends Schema.TaggedClass<SandboxExited>()(\"SandboxExited\", {\n  ...SandboxEventBase,\n  exitCode: Schema.Int,\n  resourceUse: SandboxResourceUse,\n  artifacts: Schema.Array(SandboxArtifact).check(Schema.isMaxLength(MAX_ARTIFACT_RULES)),\n}) {}\n\n/** Versioned execution event stream. */\nexport const SandboxEvent = Schema.Union([SandboxStarted, SandboxOutput, SandboxExited]);\nexport type SandboxEvent = typeof SandboxEvent.Type;\n\n/** The runtime could not start the requested process. */\nexport class SandboxSpawnError extends Schema.TaggedError<SandboxSpawnError>()(\n  \"SandboxSpawnError\",\n  {\n    implementation: SandboxImplementation,\n    command: BoundedPath,\n    message: BoundedDiagnostic,\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\n/** The process ended unsuccessfully after starting. */\nexport class SandboxExitError extends Schema.TaggedError<SandboxExitError>()(\"SandboxExitError\", {\n  implementation: SandboxImplementation,\n  exitCode: Schema.Int,\n  message: BoundedDiagnostic,\n  cause: Schema.optionalKey(Schema.Defect()),\n}) {}\n\n/** The wall-clock execution limit elapsed and the owned process was interrupted. */\nexport class SandboxTimeoutError extends Schema.TaggedError<SandboxTimeoutError>()(\n  \"SandboxTimeoutError\",\n  {\n    implementation: SandboxImplementation,\n    maxWallTime: FinitePositiveDuration,\n  },\n) {}\n\n/** A stdout or stderr stream exceeded its configured bounded-output limit. */\nexport class SandboxOutputLimitError extends Schema.TaggedError<SandboxOutputLimitError>()(\n  \"SandboxOutputLimitError\",\n  {\n    implementation: SandboxImplementation,\n    stream: Schema.Literals([\"stdout\", \"stderr\"]),\n    limit: PositiveInt,\n    observed: PositiveInt,\n  },\n) {}\n\n/** The selected implementation cannot honestly enforce one requested security or resource feature. */\nexport class SandboxUnsupportedRequestError extends Schema.TaggedError<SandboxUnsupportedRequestError>()(\n  \"SandboxUnsupportedRequestError\",\n  {\n    implementation: SandboxImplementation,\n    feature: Schema.Literals([\n      \"runtime\",\n      \"mounts\",\n      \"network\",\n      \"cpu-limit\",\n      \"memory-limit\",\n      \"secret-handles\",\n      \"artifacts\",\n    ]),\n    message: BoundedDiagnostic,\n  },\n) {}\n\n/** Expected sandbox execution failures. Interruption remains an Effect interruption, never a fabricated exit. */\nexport const SandboxError = Schema.Union([\n  SandboxSpawnError,\n  SandboxExitError,\n  SandboxTimeoutError,\n  SandboxOutputLimitError,\n  SandboxUnsupportedRequestError,\n]);\n\nexport type SandboxError = typeof SandboxError.Type;\n\n/**\n * Scoped command/code execution capability. Implementations must identify their isolation posture\n * in every emitted event; an `unisolated` implementation is never a security sandbox.\n */\nexport class Sandbox extends Context.Service<\n  Sandbox,\n  {\n    readonly execute: (request: SandboxRequest) => Stream.Stream<SandboxEvent, SandboxError>;\n  }\n>()(\"@effect-agent/sandbox/Sandbox\") {}\n\n/** Type helper for implementations that preserve the public Sandbox service contract. */\nexport type SandboxExecute = (\n  request: SandboxRequest,\n) => Stream.Stream<SandboxEvent, SandboxError, never>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,MAAM,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AACvE,MAAM,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,IAAQ,CAAC;AAC5E,MAAM,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,KAAS,CAAC;AACzE,MAAM,mBAAmB;AACzB,MAAM,qBAAqB;AAC3B,MAAM,oBAAoB,OAAO,OAAO,MAAM,OAAO,YAAY,gBAAgB,CAAC;AAElF,MAAa,gCAAgC;AAC7C,MAAM,oBAAoB,OAAO,OAAO,MAAM,OAAO,YAAY,6BAA6B,CAAC;AAC/F,MAAM,cAAc,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,iBAAiB,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAClE,MAAM,iBAAiB,YAAY,MAAM,OAAO,oBAAoB,gBAAgB,CAAC;AACrF,MAAM,mBAAmB,OAAO,MAAM,eAAe,CAAC,CAAC,MAAM,OAAO,YAAY,GAAG,CAAC;AACpF,MAAM,0BAA0B,OAAO,MAAM,WAAW,CAAC,CAAC,MAAM,OAAO,YAAY,GAAG,CAAC;AAEvF,MAAM,yBAAyB,OAAO,SAAS,KAC7C,OAAO,QACJ,aACC,SAAS,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAC7D,EAAE,UAAU,6BAA6B,CAC3C,CACF;AAEA,MAAM,4BAA4B,OAAO,SAAS,KAChD,OAAO,QACJ,aACC,SAAS,SAAS,QAAQ,KAAK,CAAC,SAAS,WAAW,QAAQ,GAC9D,EAAE,UAAU,iCAAiC,CAC/C,CACF;;AAGA,IAAa,iBAAb,cAAoC,OAAO,MAAsB,gBAAgB,CAAC,CAAC;CACjF,MAAM,OAAO,SAAS;EAAC;EAAa;EAAW;EAAQ;CAAoB,CAAC;CAC5E,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,uBACF,CAAC,CAAC;CACA,WAAW,OAAO,SAAS,CAAC,YAAY,YAAY,CAAC;CACrD,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,cAAc,CAAC,CAAC;CAC3E,QAAQ;CACR,QAAQ;CACR,QAAQ,OAAO,SAAS,CAAC,aAAa,YAAY,CAAC;AACrD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;;AAGnG,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAAC,oBAAoB;CAC/F,SAAS,OAAO,MAAM,WAAW,CAAC,CAAC,MAAM,OAAO,YAAY,GAAG,CAAC;CAChE,OAAO,OAAO,MAAM,YAAY,MAAM,OAAO,oBAAoB,KAAM,CAAC,CAAC,CAAC,CAAC,MACzE,OAAO,YAAY,GAAG,CACxB;AACF,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,uBAAuB,OAAO,MAAM,CAAC,iBAAiB,gBAAgB,CAAC;;AAIpF,IAAa,qBAAb,cAAwC,OAAO,MAA0B,oBAAoB,CAAC,CAAC,EAC7F,OAAO,wBACT,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gBAAb,cAAmC,OAAO,MAAqB,eAAe,CAAC,CAAC;CAC9E,UAAU,OAAO,YAAY,eAAe,MAAM,OAAO,oBAAoB,IAAK,CAAC,CAAC;CACpF,aAAa,OAAO,YAClB,YAAY,MAAM,OAAO,oBAAoB,aAAyB,CAAC,CACzE;CACA,gBAAgB;CAChB,aAAa;AACf,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,sBAAb,cAAyC,OAAO,MAA2B,qBAAqB,CAAC,CAAC;CAChG,IAAI;CACJ,SAAS,OAAO,eAAe,MAAM,OAAO,YAAY,IAAQ,CAAC;AACnE,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,sBAAb,cAAyC,OAAO,MAA2B,qBAAqB,CAAC,CAAC;CAChG,MAAM;CACN,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,kBAAb,cAAqC,OAAO,MAAuB,iBAAiB,CAAC,CAAC;CACpF,MAAM;CACN,OAAO,OAAO,QAAQ,MAAM,OAAO,oBAAoB,gBAAgB,CAAC;CACxE,QAAQ;CACR,WAAW,OAAO,YAAY,WAAW;AAC3C,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,iBAAb,cAAoC,OAAO,MAAsB,gBAAgB,CAAC,CAAC;CACjF,SAAS;CACT,SAAS;CACT,MAAM;CACN,KAAK;CACL,aAAa;CACb,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC/D,SAAS;CACT,QAAQ;CACR,eAAe,OAAO,MAAM,mBAAmB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC7E,eAAe,OAAO,MAAM,mBAAmB,CAAC,CAAC,MAAM,OAAO,YAAY,kBAAkB,CAAC;AAC/F,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,MAA0B,oBAAoB,CAAC,CAAC;CAC7F,UAAU;CACV,aAAa,OAAO,QAAQ,MAAM,OAAO,oBAAoB,gBAAgB,CAAC;CAC9E,aAAa,OAAO,QAAQ,MAAM,OAAO,oBAAoB,gBAAgB,CAAC;CAC9E,WAAW,OAAO,YAAY,OAAO,OAAO;CAC5C,aAAa,OAAO,YAAY,OAAO,OAAO;AAChD,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,mBAAmB;CACvB,cAAc,OAAO,QAAQ,CAAC;CAC9B,gBAAgB;AAClB;;AAGA,IAAa,iBAAb,cAAoC,OAAO,YAA4B,CAAC,CAAC,kBAAkB;CACzF,GAAG;CACH,SAAS;AACX,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gBAAb,cAAmC,OAAO,YAA2B,CAAC,CAAC,iBAAiB;CACtF,GAAG;CACH,QAAQ,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;CAC5C,MAAM;CACN,OAAO,OAAO,QAAQ,MAAM,OAAO,oBAAoB,gBAAgB,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gBAAb,cAAmC,OAAO,YAA2B,CAAC,CAAC,iBAAiB;CACtF,GAAG;CACH,UAAU,OAAO;CACjB,aAAa;CACb,WAAW,OAAO,MAAM,eAAe,CAAC,CAAC,MAAM,OAAO,YAAY,kBAAkB,CAAC;AACvF,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,eAAe,OAAO,MAAM;CAAC;CAAgB;CAAe;AAAa,CAAC;;AAIvF,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA;CACE,gBAAgB;CAChB,SAAS;CACT,SAAS;CACT,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAAC,oBAAoB;CAC/F,gBAAgB;CAChB,UAAU,OAAO;CACjB,SAAS;CACT,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA;CACE,gBAAgB;CAChB,aAAa;AACf,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA;CACE,gBAAgB;CAChB,QAAQ,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;CAC5C,OAAO;CACP,UAAU;AACZ,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA;CACE,gBAAgB;CAChB,SAAS,OAAO,SAAS;EACvB;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,SAAS;AACX,CACF,CAAC,CAAC,CAAC;;AAGH,MAAa,eAAe,OAAO,MAAM;CACvC;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAQD,IAAa,UAAb,cAA6B,QAAQ,QAKnC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC"}

package/dist/utf8-BYfhEkcj.mjs

@@ -0,0 +1,11 @@
+import { Encoding } from "effect";
+//#region src/capabilities/internal/utf8.ts
+/** Encode through Effect without requiring browser or Node ambient types in consumers. */
+const utf8Bytes = (value) => {
+	const hex = Encoding.encodeHex(value);
+	return Uint8Array.from({ length: hex.length / 2 }, (_, index) => Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16));
+};
+//#endregion
+export { utf8Bytes as t };
+
+//# sourceMappingURL=utf8-BYfhEkcj.mjs.map

package/dist/utf8-BYfhEkcj.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utf8-BYfhEkcj.mjs","names":[],"sources":["../src/capabilities/internal/utf8.ts"],"sourcesContent":["import { Encoding } from \"effect\";\n\n/** Encode through Effect without requiring browser or Node ambient types in consumers. */\nexport const utf8Bytes = (value: string): Uint8Array => {\n  const hex = Encoding.encodeHex(value);\n\n  return Uint8Array.from({ length: hex.length / 2 }, (_, index) =>\n    Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16),\n  );\n};\n"],"mappings":";;;AAGA,MAAa,aAAa,UAA8B;CACtD,MAAM,MAAM,SAAS,UAAU,KAAK;CAEpC,OAAO,WAAW,KAAK,EAAE,QAAQ,IAAI,SAAS,EAAE,IAAI,GAAG,UACrD,OAAO,SAAS,IAAI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,CACzD;AACF"}

package/dist/utf8-DchGZRBd.mjs

@@ -0,0 +1,23 @@
+//#region src/core/internal/utf8.ts
+/** UTF-8 width, including the replacement encoding used for lone UTF-16 surrogates. */
+const codePointUtf8Length = (codePoint) => {
+	if (codePoint < 128) return 1;
+	if (codePoint < 2048) return 2;
+	if (codePoint < 65536) return 3;
+	return 4;
+};
+/** Count encoded bytes without allocating an encoded copy of the text. */
+const utf8ByteLength = (value) => {
+	let bytes = 0;
+	let index = 0;
+	while (index < value.length) {
+		const codePoint = value.codePointAt(index) ?? 0;
+		bytes += codePointUtf8Length(codePoint);
+		index += codePoint > 65535 ? 2 : 1;
+	}
+	return bytes;
+};
+//#endregion
+export { utf8ByteLength as n, codePointUtf8Length as t };
+
+//# sourceMappingURL=utf8-DchGZRBd.mjs.map

package/dist/utf8-DchGZRBd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utf8-DchGZRBd.mjs","names":[],"sources":["../src/core/internal/utf8.ts"],"sourcesContent":["/** UTF-8 width, including the replacement encoding used for lone UTF-16 surrogates. */\nexport const codePointUtf8Length = (codePoint: number): number => {\n  if (codePoint < 0x80) return 1;\n  if (codePoint < 0x800) return 2;\n  if (codePoint < 0x10000) return 3;\n\n  return 4;\n};\n\n/** Count encoded bytes without allocating an encoded copy of the text. */\nexport const utf8ByteLength = (value: string): number => {\n  let bytes = 0;\n  let index = 0;\n\n  while (index < value.length) {\n    const codePoint = value.codePointAt(index) ?? 0;\n\n    bytes += codePointUtf8Length(codePoint);\n    index += codePoint > 0xffff ? 2 : 1;\n  }\n\n  return bytes;\n};\n"],"mappings":";;AACA,MAAa,uBAAuB,cAA8B;CAChE,IAAI,YAAY,KAAM,OAAO;CAC7B,IAAI,YAAY,MAAO,OAAO;CAC9B,IAAI,YAAY,OAAS,OAAO;CAEhC,OAAO;AACT;;AAGA,MAAa,kBAAkB,UAA0B;CACvD,IAAI,QAAQ;CACZ,IAAI,QAAQ;CAEZ,OAAO,QAAQ,MAAM,QAAQ;EAC3B,MAAM,YAAY,MAAM,YAAY,KAAK,KAAK;EAE9C,SAAS,oBAAoB,SAAS;EACtC,SAAS,YAAY,QAAS,IAAI;CACpC;CAEA,OAAO;AACT"}