eve 0.62.0 → 0.64.0

package/dist/src/public/sandbox/docker-sandbox.d.ts

@@ -1,46 +1,22 @@
-/**
- * Image pull behavior for the Docker sandbox backend.
- *
- * - `"if-not-present"` (default): pull the base image only when it is
- *   missing from the local image store.
- * - `"always"`: pull before every template build so the image floats to
- *   the registry's latest digest.
- * - `"never"`: never pull; fail when the image is missing locally.
- */
+import type { SandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxNetworkOptions, SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+/** Image pull behavior for Docker sandbox environments. */
 export type DockerSandboxPullPolicy = "if-not-present" | "always" | "never";
-/**
- * Initial network policy for sandboxes created by the Docker backend.
- * Docker supports coarse-grained egress control only: `"allow-all"`
- * attaches the container to the default bridge network, `"deny-all"`
- * runs it with networking disabled. Domain-level policies and
- * credential brokering require `vercel()`.
- */
-export type DockerSandboxNetworkPolicy = "allow-all" | "deny-all";
-/**
- * Options accepted by `docker(opts)`.
- */
-export interface DockerSandboxCreateOptions {
-    /**
-     * Base container image for templates and sessions. Defaults to eve's
-     * published `ghcr.io/vercel/eve` image, tagged with the installed eve
-     * version without build metadata or `EVE_SANDBOX_IMAGE_TAG` when set. Framework setup creates
-     * `/workspace` and verifies Bash. Install
-     * any authored runtime tools in sandbox bootstrap or provide them through a
-     * custom image.
-     */
+/** Coarse-grained egress policy for one live Docker sandbox. */
+export type DockerSandboxNetworkPolicy = Extract<SandboxNetworkPolicy, "allow-all" | "deny-all">;
+/** Options shared by every sandbox created from one Docker environment. */
+export interface DockerSandboxEnvironmentOptions {
+    /** Base container image. Defaults to eve's published sandbox image. */
     readonly image?: string;
-    /**
-     * Environment variables baked into every container the backend
-     * creates (template builds and sessions).
-     */
+    /** Environment variables baked into template builds and live containers. */
     readonly env?: Readonly<Record<string, string>>;
-    /**
-     * Base image pull behavior. Defaults to `"if-not-present"`.
-     */
+    /** Base image pull behavior. @default "if-not-present" */
     readonly pullPolicy?: DockerSandboxPullPolicy;
-    /**
-     * Initial network policy for created containers. Defaults to
-     * `"allow-all"`.
-     */
+    /** Idempotent setup captured in the prepared image. */
+    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
+}
+/** Options applied when eve creates one live Docker sandbox. */
+export interface DockerSandboxRuntimeOptions extends SandboxNetworkOptions {
+    /** Initial network policy for this container. @default "allow-all" */
     readonly networkPolicy?: DockerSandboxNetworkPolicy;
 }

package/dist/src/public/sandbox/docker.d.ts

@@ -1,2 +1,2 @@
-export { docker } from "#public/sandbox/backends/docker.js";
-export type { DockerSandboxCreateOptions, DockerSandboxNetworkPolicy, DockerSandboxPullPolicy, } from "#public/sandbox/docker-sandbox.js";
+export { DockerSandbox, type DockerSandboxEnvironmentOptions, type DockerSandboxRuntimeOptions, } from "#sandbox/providers/docker.js";
+export type { DockerSandboxNetworkPolicy, DockerSandboxPullPolicy, } from "#public/sandbox/docker-sandbox.js";

package/dist/src/public/sandbox/docker.js

@@ -1 +1 @@
-import{docker}from"#public/sandbox/backends/docker.js";export{docker};
+import{DockerSandbox}from"#sandbox/providers/docker.js";export{DockerSandbox};

package/dist/src/public/sandbox/index.d.ts

@@ -1,9 +1,4 @@
-/**
- * Sandbox authoring helpers for `agent/sandbox.ts` (or
- * `agent/sandbox/sandbox.ts` when paired with a `workspace/` folder).
- */
-export { defineSandbox, type SandboxAncestorReference, type SandboxBootstrapContext, type SandboxBootstrapUseFn, type SandboxCommandResult, type SandboxDefinition, type SandboxParentDefinition, type SandboxParentDefinitionContext, type SandboxParentValue, type SandboxProcess, type SandboxReadBinaryFileOptions, type SandboxReadFileOptions, type SandboxReadTextFileOptions, type SandboxRevalidationKeyFn, type SandboxRunOptions, type SandboxSession, type RuntimeSandboxSession, type SandboxSpawnOptions, type SandboxSessionContext, type SandboxSessionUseFn, type SandboxWriteBinaryFileOptions, type SandboxWriteFileOptions, type SandboxWriteTextFileOptions, } from "#public/definitions/sandbox.js";
-export type { SandboxBackend, SandboxBackendCreateInput, SandboxBackendHandle, SandboxBackendPrewarmInput, SandboxBackendRuntimeContext, SandboxBackendSessionState, SandboxDeleteOptions, SandboxSeedFile, } from "#public/definitions/sandbox-backend.js";
-export type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-export { SandboxTemplateNotProvisionedError } from "#public/definitions/sandbox-backend.js";
-export { defaultSandbox as defaultBackend, type DefaultSandboxOptions as DefaultBackendOptions, } from "#public/sandbox/backends/default.js";
+export { defineParentSandbox, defineSandbox, type SandboxOpenArguments, type SandboxEnvironment, type SandboxSelector, type SandboxSelectorContext, type SandboxCommandResult, type FixedNetworkSandboxSession, type MutableNetworkSandboxSession, type SandboxProcess, type SandboxReadBinaryFileOptions, type SandboxReadFileOptions, type SandboxReadTextFileOptions, type SandboxRunOptions, type SandboxSession, type RuntimeSandboxSession, type RuntimeSandboxSessionFor, type SandboxSpawnOptions, type SandboxWriteBinaryFileOptions, type SandboxWriteFileOptions, type SandboxWriteTextFileOptions, } from "#public/definitions/sandbox.js";
+export { DefaultSandbox } from "#sandbox/providers/default.js";
+export type { DefaultSandboxEnvironmentOptions } from "#sandbox/providers/default.js";
+export type { SandboxNetworkOptions, SandboxNetworkPolicy, } from "#shared/sandbox-network-policy.js";

package/dist/src/public/sandbox/index.js

@@ -1 +1 @@
-import{SandboxTemplateNotProvisionedError}from"#public/definitions/sandbox-backend.js";import{defineSandbox}from"#public/definitions/sandbox.js";import{defaultSandbox as defaultBackend}from"#public/sandbox/backends/default.js";export{SandboxTemplateNotProvisionedError,defaultBackend,defineSandbox};
+import{defineParentSandbox,defineSandbox}from"#public/definitions/sandbox.js";import{DefaultSandbox}from"#sandbox/providers/default.js";export{DefaultSandbox,defineParentSandbox,defineSandbox};

package/dist/src/public/sandbox/just-bash-sandbox.d.ts

@@ -1,19 +1,22 @@
 import type { CustomCommand, IFileSystem } from "just-bash";
+import type { SandboxSession } from "#shared/sandbox-session.js";
 /**
  * Context passed to a custom just-bash filesystem factory for each live handle.
  */
 export interface JustBashFilesystemContext {
-    /** Stable application root for this backend create call. */
-    readonly appRoot: string;
+    /** Resolves an application-relative path without exposing project layout. */
+    resolveProjectPath(path: string): string;
+    /** Stable provider-private storage directory for this sandbox. */
+    readonly storagePath: string;
     /** eve's durable, session-owned filesystem, including `/workspace`. */
     readonly defaultFilesystem: IFileSystem;
     /** The just-bash engine resolved by eve after its optional installation check. */
     readonly justBash: typeof import("just-bash");
 }
 /**
- * Options accepted by `justbash(opts)`.
+ * Options accepted by just-bash environment constructors.
  *
- * The just-bash backend runs the workspace under the pure-JS `just-bash`
+ * The just-bash provider runs the workspace under the pure-JS `just-bash`
  * interpreter with a virtual filesystem — no daemon or VM required, but
  * no real binaries either. The `just-bash` package is not bundled with
  * eve; it is loaded lazily from the application install.
@@ -31,7 +34,7 @@ export interface JustBashSandboxCreateOptions {
      * just-bash interpreter. Custom commands can participate in normal shell
      * composition, including pipelines and redirections.
      *
-     * Custom commands are not available during template prewarming. They run in
+     * Custom commands are not available during environment preparation. They run in
      * eve's host process, outside the virtual filesystem security boundary, and
      * are responsible for validating their own inputs and cleaning up host
      * resources.
@@ -45,7 +48,9 @@ export interface JustBashSandboxCreateOptions {
      *
      * This just-bash-specific escape hatch requires the application to install
      * a compatible `just-bash` version. It is not invoked during template
-     * prewarming.
+     * preparation.
      */
     readonly filesystem?: (context: JustBashFilesystemContext) => IFileSystem | Promise<IFileSystem>;
+    /** Idempotent setup captured in the prepared virtual filesystem. */
+    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
 }

package/dist/src/public/sandbox/just-bash.d.ts

@@ -1,2 +1,2 @@
-export { justbash } from "#public/sandbox/backends/just-bash.js";
-export type { JustBashFilesystemContext, JustBashSandboxCreateOptions, } from "#public/sandbox/just-bash-sandbox.js";
+export { JustBashSandbox, type JustBashEnvironmentOptions } from "#sandbox/providers/just-bash.js";
+export type { JustBashFilesystemContext } from "#public/sandbox/just-bash-sandbox.js";

package/dist/src/public/sandbox/just-bash.js

@@ -1 +1 @@
-import{justbash}from"#public/sandbox/backends/just-bash.js";export{justbash};
+import{JustBashSandbox}from"#sandbox/providers/just-bash.js";export{JustBashSandbox};

package/dist/src/public/sandbox/microsandbox-sandbox.d.ts

@@ -1,8 +1,9 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
+import type { SandboxSession } from "#shared/sandbox-session.js";
+import type { SandboxNetworkOptions, SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
 /**
- * Options accepted by `microsandbox(opts)`.
+ * Options accepted by microsandbox environment constructors.
  *
- * The microsandbox backend runs sandboxes in lightweight local VMs via
+ * The microsandbox provider runs sandboxes in lightweight local VMs via
  * [microsandbox](https://www.npmjs.com/package/microsandbox). Options
  * are eve-owned rather than a raw passthrough so the public surface can
  * stay stable while the underlying runtime evolves. Supported hosts:
@@ -12,8 +13,8 @@ export interface MicrosandboxSandboxCreateOptions {
     /**
      * OCI image used as the base runtime. eve prepares this image with
      * Bash, the framework workspace, and the sandbox user before authored
-     * bootstrap code runs. Install authored runtime tools such as Node,
-     * Python, or ripgrep in sandbox bootstrap or provide them through a
+     * environment preparation runs. Install authored runtime tools such as Node,
+     * Python, or ripgrep during preparation or provide them through a
      * custom image.
      *
      * @default The `ghcr.io/vercel/eve` tag matching the installed eve version without build metadata, or `EVE_SANDBOX_IMAGE_TAG` when set.
@@ -27,6 +28,8 @@ export interface MicrosandboxSandboxCreateOptions {
     readonly env?: Readonly<Record<string, string>>;
     /** OCI image pull policy. @default "if-missing" */
     readonly pullPolicy?: "always" | "if-missing" | "never";
+    /** Idempotent setup captured in the prepared VM snapshot. */
+    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
     /**
      * Installation behavior for the microsandbox npm package and its VM
      * runtime. By default eve installs both automatically when missing —
@@ -37,18 +40,9 @@ export interface MicrosandboxSandboxCreateOptions {
         readonly autoInstall?: boolean;
         readonly skipVerify?: boolean;
     };
-    /** Initial network policy applied to sandboxes after framework setup. */
-    readonly networkPolicy?: SandboxNetworkPolicy;
 }
-/**
- * Options accepted by the microsandbox backend's `bootstrap({ use })` hook.
- */
-export interface MicrosandboxBootstrapUseOptions {
-    readonly networkPolicy?: SandboxNetworkPolicy;
-}
-/**
- * Options accepted by the microsandbox backend's `onSession({ use })` hook.
- */
-export interface MicrosandboxSessionUseOptions {
+/** Options applied when eve creates one live microsandbox VM. */
+export interface MicrosandboxSandboxRuntimeOptions extends SandboxNetworkOptions {
+    /** Initial network policy for this VM. @default "allow-all" */
     readonly networkPolicy?: SandboxNetworkPolicy;
 }

package/dist/src/public/sandbox/microsandbox.d.ts

@@ -1,2 +1,2 @@
-export { microsandbox } from "#public/sandbox/backends/microsandbox.js";
-export type { MicrosandboxBootstrapUseOptions, MicrosandboxSandboxCreateOptions, MicrosandboxSessionUseOptions, } from "#public/sandbox/microsandbox-sandbox.js";
+export { MicrosandboxSandbox, type MicrosandboxEnvironmentOptions, } from "#sandbox/providers/microsandbox.js";
+export type { MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";

package/dist/src/public/sandbox/microsandbox.js

@@ -1 +1 @@
-import{microsandbox}from"#public/sandbox/backends/microsandbox.js";export{microsandbox};
+import{MicrosandboxSandbox}from"#sandbox/providers/microsandbox.js";export{MicrosandboxSandbox};

package/dist/src/public/sandbox/provider.d.ts

@@ -0,0 +1 @@
+export { defineSandboxProvider, type SandboxDeleteOptions, type SandboxPreparedArtifact, type SandboxProvider, type SandboxProviderDefinition, type SandboxProviderFiles, type SandboxProviderHandle, type SandboxProviderImplementation, type SandboxProviderPrepareContext, type SandboxProviderResourceFile, type SandboxProviderResources, type SandboxProviderResourceSource, type SandboxProviderResourceTree, type SandboxProviderSessionContext, type SandboxProviderTargetFile, } from "#shared/sandbox-provider.js";

package/dist/src/public/sandbox/provider.js

@@ -0,0 +1 @@
+import{defineSandboxProvider}from"#shared/sandbox-provider.js";export{defineSandboxProvider};

package/dist/src/public/sandbox/vercel-sandbox.d.ts

@@ -1,19 +1,19 @@
 import type * as Vercel from "#compiled/@vercel/sandbox/index.js";
+import type { SandboxNetworkOptions } from "#shared/sandbox-network-policy.js";
 type VercelCreateOptions = NonNullable<Parameters<typeof Vercel.Sandbox.create>[0]>;
-type VercelUpdateOptions = Parameters<Vercel.Sandbox["update"]>[0];
 type VercelSandboxInternalCreateOptions = {
     readonly [key: `__${string}`]: unknown;
 };
 type VercelSandboxAuthorCreateOptions<T> = T extends unknown ? Omit<T, "mounts" | "name" | "onResume" | "persistent" | "runtime" | "signal"> & VercelSandboxInternalCreateOptions : never;
 /**
- * Options accepted by `vercel(opts)`. Forwarded to Vercel
+ * Options accepted by Vercel sandbox environment constructors. Forwarded to Vercel
  * Sandbox creation for every fresh sandbox the framework creates
- * (template at prewarm time, session at first-time session-create).
+ * (template during preparation, session at first creation).
  * Skipped on resume (`Sandbox.get`) since no create happens there.
  *
  * `networkPolicy` is deferred until after framework-owned base setup
  * for fresh templates and template-less sessions, so eve can install
- * required packages before authored bootstrap code runs. Template-backed
+ * required packages before authored environment preparation runs. Template-backed
  * session creates receive it at creation time because the template
  * already contains the prepared base runtime.
  *
@@ -22,7 +22,7 @@ type VercelSandboxAuthorCreateOptions<T> = T extends unknown ? Omit<T, "mounts"
  * author-supplied values.
  *
  * `runtime` is excluded: eve defaults to its published
- * `vcr.vercel.com/vercel/eve/base` image tagged with the installed eve version without build metadata
+ * `vcr.vercel.com/vercel/eve/base` image tagged with the installed eve version
  * or `EVE_SANDBOX_IMAGE_TAG` when `image` is not supplied. Both are mutually
  * exclusive with a stock runtime.
  *
@@ -30,9 +30,9 @@ type VercelSandboxAuthorCreateOptions<T> = T extends unknown ? Omit<T, "mounts"
  * snapshot `source` takes precedence because the Vercel SDK makes it mutually
  * exclusive with `image`.
  *
- * `source` is honored only on the template create at prewarm time, so
+ * `source` is honored only on the template creation during preparation, so
  * an author-supplied snapshot, git revision, or tarball becomes the
- * base layer for the template. Framework setup, bootstrap, and seed
+ * base layer for the template. Framework setup, preparation, and seed
  * files all run on top, and the resulting
  * framework-owned snapshot is what every later session derives from,
  * so `source` is stripped from the session-create path. eve does not
@@ -48,40 +48,9 @@ export type VercelSandboxMount = Vercel.SandboxMounts[string];
 /** Drive mounts keyed by absolute sandbox path. */
 export type VercelSandboxMounts = Vercel.SandboxMounts;
 /** Options resolved when eve creates a fresh live session sandbox. */
-export interface VercelSandboxSessionCreateOptions {
+export interface VercelSandboxMountOptions {
     readonly mounts?: VercelSandboxMounts;
 }
-/** Context available while resolving fresh live-session creation options. */
-export interface VercelSandboxSessionCreateContext {
-    readonly session: {
-        readonly id: string;
-    };
-}
-/** Options accepted by `vercel(opts)`. */
-export type VercelSandboxOptions = VercelSandboxCreateOptions & {
-    /**
-     * Resolves options that apply only to fresh live sessions. It is not called
-     * while prewarming templates or resuming an existing sandbox.
-     */
-    readonly sessionCreateOptions?: (context: VercelSandboxSessionCreateContext) => Promise<VercelSandboxSessionCreateOptions> | VercelSandboxSessionCreateOptions;
-};
-/**
- * Options accepted by the Vercel backend's `bootstrap({ use })` hook.
- * Tracks the Vercel SDK's `Sandbox.update(...)` parameter because bootstrap
- * applies its options to the template via `sandbox.update(...)` after
- * `Sandbox.create()` and before the snapshot is captured. The Vercel
- * SDK persists `update`-d settings on the sandbox so they survive into
- * the snapshot, which becomes the seed for every later session.
- *
- * Today this is the same shape as
- * {@link VercelSandboxSessionUseOptions}; both are exposed as separate
- * named aliases so future divergence is non-breaking.
- */
-export type VercelSandboxBootstrapUseOptions = VercelUpdateOptions;
-/**
- * Options accepted by the Vercel backend's `onSession({ use })` hook.
- * Tracks the Vercel SDK's `Sandbox.update(...)` parameter; passed values are
- * applied to the live session via the SDK's `update`.
- */
-export type VercelSandboxSessionUseOptions = VercelUpdateOptions;
+/** Options accepted when creating one live Vercel sandbox from an environment. */
+export type VercelSandboxRuntimeOptions = Omit<VercelSandboxCreateOptions, "fetch" | "image" | "projectId" | "source" | "tags" | "teamId" | "token"> & SandboxNetworkOptions & VercelSandboxMountOptions;
 export {};

package/dist/src/public/sandbox/vercel.d.ts

@@ -1,3 +1,3 @@
-export { vercel } from "#public/sandbox/backends/vercel.js";
+export { VercelSandbox, type VercelSandboxEnvironmentOptions, type VercelSandboxRuntimeOptions, } from "#sandbox/providers/vercel.js";
 export { Drive } from "#compiled/@vercel/sandbox/index.js";
-export type { VercelSandboxBootstrapUseOptions, VercelSandboxCreateOptions, VercelSandboxMount, VercelSandboxMountMode, VercelSandboxMounts, VercelSandboxOptions, VercelSandboxSessionCreateContext, VercelSandboxSessionCreateOptions, VercelSandboxSessionUseOptions, } from "#public/sandbox/vercel-sandbox.js";
+export type { VercelSandboxMount, VercelSandboxMountMode, VercelSandboxMounts, } from "#public/sandbox/vercel-sandbox.js";

package/dist/src/public/sandbox/vercel.js

@@ -1 +1 @@
-import{vercel}from"#public/sandbox/backends/vercel.js";import{Drive}from"#compiled/@vercel/sandbox/index.js";export{Drive,vercel};
+import{VercelSandbox}from"#sandbox/providers/vercel.js";import{Drive}from"#compiled/@vercel/sandbox/index.js";export{Drive,VercelSandbox};

package/dist/src/public/tools/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Tool authoring helpers for `agent/tools/*.ts` files.
  */
-export { type BackgroundToolDefinition, type DisabledToolSentinel, defineTool, disableTool, isDisabledToolSentinel, type TaskExec, type TaskReceipt, type ToolLabelDefinition, type ToolAuthOptions, type ToolAuthProvider, type ToolDefinition, type ToolContext, type ToolModelOutput, type ToolModelOutputPart, } from "#tools/definition.js";
+export { type DisabledToolSentinel, defineTool, disableTool, isDisabledToolSentinel, type ToolLabelDefinition, type ToolAuthOptions, type ToolAuthProvider, type ToolDefinition, type ToolContext, type ToolModelOutput, type ToolModelOutputPart, } from "#tools/definition.js";
 export { defineDynamic } from "#dynamic/definition.js";
 export { defineDurableSchema } from "#tools/durable-schema.js";
 export { defineDurableCallback } from "#tools/durable-callbacks.js";
@@ -10,5 +10,5 @@ export type { DynamicEvents, DynamicResolveContext, DynamicSentinel } from "#dyn
 export type { DynamicToolEntry, DynamicToolEvents, DynamicToolSet, DynamicToolResult, } from "#tools/dynamic.js";
 export { type SessionContext } from "#public/definitions/callback-context.js";
 export { toolResultFrom, type MatchedConnectionResult, type MatchedToolResult, type ToolResultFromFn, } from "#public/tools/result.js";
-export { defineWorkflowTool, type WorkflowStepToolContext, type WorkflowToolContext, type WorkflowToolDefinition, type AgentInput, type WorkflowAgentMetadata, } from "#tools/workflow-definition.js";
+export { defineWorkflowTool, type WorkflowStepToolContext, type TaskReceipt, type WorkflowToolContext, type WorkflowToolDefinition, type AgentInput, type WorkflowAgentMetadata, } from "#tools/workflow-definition.js";
 export type { ToolInputRequest, ToolInputResponse } from "#tools/definition.js";

package/dist/src/runtime/agent/resolve-model.js

@@ -1 +1 @@
-import{localGatewayModel}from"#internal/model-auth/transport.js";import{RuntimeModelMetadataCacheKey}from"#context/keys.js";import{isDynamicModelDefinition}from"#shared/agent-definition.js";import{normalizeAgentDefinition}from"#internal/authored-definition/core.js";import{formatLanguageModelGatewayId,isAgentReasoningDefinition,isRuntimeLanguageModel}from"#internal/runtime-model.js";import{parseJsonObject}from"#shared/json.js";import{loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{resolveBootstrapRuntimeModel}from"#runtime/agent/bootstrap-model.js";import{resolveMockAuthoredRuntimeModel,shouldMockAuthoredRuntimeModels}from"#runtime/agent/mock-model-adapter.js";import{createRuntimeModelCatalog}from"#runtime/agent/model-catalog.js";async function resolveRuntimeModelReference(e,t){let n=resolveBootstrapRuntimeModel(e);if(n!==null)return n;let r=resolveMockAuthoredRuntimeModel(e);return r===null?isSourceBackedRuntimeModelReference(e)?await loadSourceBackedRuntimeModelReference(e,t):localGatewayModel(e.id)??e.id:r}async function loadSourceBackedRuntimeModelReference(e,t){if(t===void 0)throw Error(`Expected a compiled module-map scope to resolve the authored runtime model "${e.id}".`);let n=await loadResolvedModuleExport({definition:e.source,kindLabel:`runtime model "${e.id}"`,moduleMap:t.moduleMap,nodeId:t.nodeId}),r=normalizeAgentDefinition(n,`Expected the authored agent config export "${e.source.exportName??`default`}" from "${e.source.logicalPath}" to match the public eve shape.`).model;if(r===void 0)throw Error(`Expected the authored agent config export "${e.source.exportName??`default`}" from "${e.source.logicalPath}" to provide a runtime model.`);if(isDynamicModelDefinition(r))throw Error(`Expected the authored agent config export "${e.source.exportName??`default`}" from "${e.source.logicalPath}" to provide a static runtime model.`);return r}function isSourceBackedRuntimeModelReference(e){return e.source!==void 0}async function loadDynamicRuntimeModelDefinition(e){let t=await loadResolvedModuleExport({definition:e.dynamicModel,kindLabel:`dynamic runtime model`,moduleMap:e.scope.moduleMap,nodeId:e.scope.nodeId}),n=normalizeAgentDefinition(t,`Expected the authored agent config export "${e.dynamicModel.exportName??`default`}" from "${e.dynamicModel.logicalPath}" to match the public eve shape.`).model;if(!isDynamicModelDefinition(n))throw Error(`Expected the authored agent config export "${e.dynamicModel.exportName??`default`}" from "${e.dynamicModel.logicalPath}" to provide a dynamic model definition.`);return n}async function resolveRuntimeModelSelection(e){if(e.selection===null||e.selection===void 0)throw Error(`Dynamic model resolver returned no model. Every matching dynamic model handler must return a concrete model selection.`);let t=normalizeDynamicModelSelection(e.selection);validateDynamicModelSelection(t);let n=t.modelOptions?.providerOptions===void 0?void 0:parseProviderOptionsRecord(t.modelOptions.providerOptions),r=t.model,i=e.catalog??runtimeModelCatalogForState(e.state);if(typeof r==`string`){let a=formatLanguageModelGatewayId(r),o=await resolveSelectionMetadata({cacheKey:`gateway:${a}`,catalog:i,contextWindowTokens:t.modelContextWindowTokens,load:e=>e.getByGatewayId(a),modelLabel:a,state:e.state});return{reference:{id:o.resolvedModelId,contextWindowTokens:o.contextWindowTokens,maxOutputTokens:o.maxOutputTokens,providerOptions:n,reasoning:t.reasoning}}}if(validateRuntimeLanguageModel(r),e.durability===`durable`)throw Error(`Dynamic model selection returned a provider object, but durable model selections must be serializable. Return a model id string, or use a "step.started" model resolver.`);let a=formatLanguageModelGatewayId(r),o=r.provider.split(`.`)[0],s=await resolveSelectionMetadata({cacheKey:o===`gateway`?`gateway:${r.modelId}`:`provider:${r.provider}:${r.modelId}`,catalog:i,contextWindowTokens:t.modelContextWindowTokens,load:e=>o===`gateway`?e.getByGatewayId(r.modelId):e.getByProviderModelId(r.provider,r.modelId),modelLabel:a,state:e.state});return{model:r,reference:{id:s.resolvedModelId,contextWindowTokens:s.contextWindowTokens,maxOutputTokens:s.maxOutputTokens,providerOptions:n,reasoning:t.reasoning}}}const runtimeModelCatalogsByState=new WeakMap;function runtimeModelCatalogForState(e){let t=runtimeModelCatalogsByState.get(e);if(t!==void 0)return t;let n=createRuntimeModelCatalog();return runtimeModelCatalogsByState.set(e,n),n}async function resolveSelectionMetadata(e){if(e.contextWindowTokens!==void 0)return{contextWindowTokens:e.contextWindowTokens,resolvedModelId:e.modelLabel};let t=Date.now(),n=e.state.get(RuntimeModelMetadataCacheKey)?.[e.cacheKey];if(n!==void 0&&n.expiresAt>t)return n;let r=await e.load(e.catalog);if(r===null)throw Error(`Cannot select model "${e.modelLabel}" because AI Gateway did not provide context window metadata. Return modelContextWindowTokens with this selection for an unlisted or custom model.`);let i={...r,expiresAt:t+864e5};return e.state.set(RuntimeModelMetadataCacheKey,n=>({...Object.fromEntries(Object.entries(n??{}).filter(([,e])=>e.expiresAt>t)),[e.cacheKey]:i})),i}const DYNAMIC_MODEL_SELECTION_KEYS=new Set([`model`,`modelContextWindowTokens`,`modelOptions`,`reasoning`]);function validateDynamicModelSelection(e){let t=Object.keys(e).filter(e=>!DYNAMIC_MODEL_SELECTION_KEYS.has(e));if(t.length>0)throw Error(`Dynamic model resolver returned a selection with unknown key(s): ${t.join(`, `)}. Expected { model, reasoning?, modelContextWindowTokens?, modelOptions? }.`);if(e.reasoning!==void 0&&!isAgentReasoningDefinition(e.reasoning))throw Error(`Dynamic model resolver returned an invalid reasoning effort. Expected provider-default, none, minimal, low, medium, high, or xhigh.`);let n=e.modelContextWindowTokens;if(n!==void 0&&(!Number.isInteger(n)||n<=0))throw Error(`Dynamic model resolver returned an invalid modelContextWindowTokens value. Expected a positive integer.`);if(typeof e.model==`string`&&e.model.trim()===``)throw Error(`Dynamic model resolver returned an empty model id.`)}function normalizeDynamicModelSelection(e){return isModelSelectionDefinition(e)?e:{model:e}}function isModelSelectionDefinition(e){return typeof e==`object`&&!!e&&`model`in e&&!isRuntimeLanguageModel(e)}function validateRuntimeLanguageModel(e){if(!isRuntimeLanguageModel(e))throw Error(`Dynamic model resolver returned an invalid model. Return an AI Gateway model id string, an AI SDK language model, or { model, modelContextWindowTokens?, modelOptions? }.`)}function parseProviderOptionsRecord(e){if(e===void 0)return;let t={};for(let[n,r]of Object.entries(e))t[n]=parseJsonObject(r);return t}export{loadDynamicRuntimeModelDefinition,resolveRuntimeModelReference,resolveRuntimeModelSelection,shouldMockAuthoredRuntimeModels};
+import{localGatewayModel}from"#internal/model-auth/transport.js";import{RuntimeModelMetadataCacheKey}from"#context/keys.js";import{parseJsonObject}from"#shared/json.js";import{isDynamicModelDefinition}from"#shared/agent-definition.js";import{normalizeAgentDefinition}from"#internal/authored-definition/core.js";import{formatLanguageModelGatewayId,isAgentReasoningDefinition,isRuntimeLanguageModel}from"#internal/runtime-model.js";import{loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{resolveBootstrapRuntimeModel}from"#runtime/agent/bootstrap-model.js";import{resolveMockAuthoredRuntimeModel,shouldMockAuthoredRuntimeModels}from"#runtime/agent/mock-model-adapter.js";import{createRuntimeModelCatalog}from"#runtime/agent/model-catalog.js";async function resolveRuntimeModelReference(e,t){let n=resolveBootstrapRuntimeModel(e);if(n!==null)return n;let r=resolveMockAuthoredRuntimeModel(e);return r===null?isSourceBackedRuntimeModelReference(e)?await loadSourceBackedRuntimeModelReference(e,t):localGatewayModel(e.id)??e.id:r}async function loadSourceBackedRuntimeModelReference(e,t){if(t===void 0)throw Error(`Expected a compiled module-map scope to resolve the authored runtime model "${e.id}".`);let n=await loadResolvedModuleExport({definition:e.source,kindLabel:`runtime model "${e.id}"`,moduleMap:t.moduleMap,nodeId:t.nodeId}),r=normalizeAgentDefinition(n,`Expected the authored agent config export "${e.source.exportName??`default`}" from "${e.source.logicalPath}" to match the public eve shape.`).model;if(r===void 0)throw Error(`Expected the authored agent config export "${e.source.exportName??`default`}" from "${e.source.logicalPath}" to provide a runtime model.`);if(isDynamicModelDefinition(r))throw Error(`Expected the authored agent config export "${e.source.exportName??`default`}" from "${e.source.logicalPath}" to provide a static runtime model.`);return r}function isSourceBackedRuntimeModelReference(e){return e.source!==void 0}async function loadDynamicRuntimeModelDefinition(e){let t=await loadResolvedModuleExport({definition:e.dynamicModel,kindLabel:`dynamic runtime model`,moduleMap:e.scope.moduleMap,nodeId:e.scope.nodeId}),n=normalizeAgentDefinition(t,`Expected the authored agent config export "${e.dynamicModel.exportName??`default`}" from "${e.dynamicModel.logicalPath}" to match the public eve shape.`).model;if(!isDynamicModelDefinition(n))throw Error(`Expected the authored agent config export "${e.dynamicModel.exportName??`default`}" from "${e.dynamicModel.logicalPath}" to provide a dynamic model definition.`);return n}async function resolveRuntimeModelSelection(e){if(e.selection===null||e.selection===void 0)throw Error(`Dynamic model resolver returned no model. Every matching dynamic model handler must return a concrete model selection.`);let t=normalizeDynamicModelSelection(e.selection);validateDynamicModelSelection(t);let n=t.modelOptions?.providerOptions===void 0?void 0:parseProviderOptionsRecord(t.modelOptions.providerOptions),r=t.model,i=e.catalog??runtimeModelCatalogForState(e.state);if(typeof r==`string`){let a=formatLanguageModelGatewayId(r),o=await resolveSelectionMetadata({cacheKey:`gateway:${a}`,catalog:i,contextWindowTokens:t.modelContextWindowTokens,load:e=>e.getByGatewayId(a),modelLabel:a,state:e.state});return{reference:{id:o.resolvedModelId,contextWindowTokens:o.contextWindowTokens,maxOutputTokens:o.maxOutputTokens,providerOptions:n,reasoning:t.reasoning}}}if(validateRuntimeLanguageModel(r),e.durability===`durable`)throw Error(`Dynamic model selection returned a provider object, but durable model selections must be serializable. Return a model id string, or use a "step.started" model resolver.`);let a=formatLanguageModelGatewayId(r),o=r.provider.split(`.`)[0],s=await resolveSelectionMetadata({cacheKey:o===`gateway`?`gateway:${r.modelId}`:`provider:${r.provider}:${r.modelId}`,catalog:i,contextWindowTokens:t.modelContextWindowTokens,load:e=>o===`gateway`?e.getByGatewayId(r.modelId):e.getByProviderModelId(r.provider,r.modelId),modelLabel:a,state:e.state});return{model:r,reference:{id:s.resolvedModelId,contextWindowTokens:s.contextWindowTokens,maxOutputTokens:s.maxOutputTokens,providerOptions:n,reasoning:t.reasoning}}}const runtimeModelCatalogsByState=new WeakMap;function runtimeModelCatalogForState(e){let t=runtimeModelCatalogsByState.get(e);if(t!==void 0)return t;let n=createRuntimeModelCatalog();return runtimeModelCatalogsByState.set(e,n),n}async function resolveSelectionMetadata(e){if(e.contextWindowTokens!==void 0)return{contextWindowTokens:e.contextWindowTokens,resolvedModelId:e.modelLabel};let t=Date.now(),n=e.state.get(RuntimeModelMetadataCacheKey)?.[e.cacheKey];if(n!==void 0&&n.expiresAt>t)return n;let r=await e.load(e.catalog);if(r===null)throw Error(`Cannot select model "${e.modelLabel}" because AI Gateway did not provide context window metadata. Return modelContextWindowTokens with this selection for an unlisted or custom model.`);let i={...r,expiresAt:t+864e5};return e.state.set(RuntimeModelMetadataCacheKey,n=>({...Object.fromEntries(Object.entries(n??{}).filter(([,e])=>e.expiresAt>t)),[e.cacheKey]:i})),i}const DYNAMIC_MODEL_SELECTION_KEYS=new Set([`model`,`modelContextWindowTokens`,`modelOptions`,`reasoning`]);function validateDynamicModelSelection(e){let t=Object.keys(e).filter(e=>!DYNAMIC_MODEL_SELECTION_KEYS.has(e));if(t.length>0)throw Error(`Dynamic model resolver returned a selection with unknown key(s): ${t.join(`, `)}. Expected { model, reasoning?, modelContextWindowTokens?, modelOptions? }.`);if(e.reasoning!==void 0&&!isAgentReasoningDefinition(e.reasoning))throw Error(`Dynamic model resolver returned an invalid reasoning effort. Expected provider-default, none, minimal, low, medium, high, or xhigh.`);let n=e.modelContextWindowTokens;if(n!==void 0&&(!Number.isInteger(n)||n<=0))throw Error(`Dynamic model resolver returned an invalid modelContextWindowTokens value. Expected a positive integer.`);if(typeof e.model==`string`&&e.model.trim()===``)throw Error(`Dynamic model resolver returned an empty model id.`)}function normalizeDynamicModelSelection(e){return isModelSelectionDefinition(e)?e:{model:e}}function isModelSelectionDefinition(e){return typeof e==`object`&&!!e&&`model`in e&&!isRuntimeLanguageModel(e)}function validateRuntimeLanguageModel(e){if(!isRuntimeLanguageModel(e))throw Error(`Dynamic model resolver returned an invalid model. Return an AI Gateway model id string, an AI SDK language model, or { model, modelContextWindowTokens?, modelOptions? }.`)}function parseProviderOptionsRecord(e){if(e===void 0)return;let t={};for(let[n,r]of Object.entries(e))t[n]=parseJsonObject(r);return t}export{loadDynamicRuntimeModelDefinition,resolveRuntimeModelReference,resolveRuntimeModelSelection,shouldMockAuthoredRuntimeModels};

package/dist/src/runtime/cache-key.js

@@ -1 +1 @@
-import{getRuntimeCompiledArtifactsCacheKey}from"#runtime/compiled-artifacts-source.js";import{loadCompileMetadata}from"#runtime/loaders/compile-metadata.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";async function resolveRuntimeCompiledArtifactsVersionedCacheKey(e){let t=getRuntimeCompiledArtifactsCacheKey(e),n=await resolveCompileMetadataMtimeMs(e);try{let r=(await loadCompileMetadata({compiledArtifactsSource:e}))?.discovery.sourceGraphHash;return r===void 0||r.length===0?n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`:n===void 0?`${t}:${r}`:`${t}:${r}:mtime-${formatMtimeMsForCacheKey(n)}`}catch{return n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`}}async function resolveCompileMetadataMtimeMs(e){if(e.kind!==`disk`)return;let{stat:t}=await import(`node:fs/promises`),{compileMetadataPath:n}=resolveRuntimeCompilerArtifactPaths(e.appRoot);try{return(await t(n)).mtimeMs}catch{return}}function formatMtimeMsForCacheKey(e){return Math.floor(e).toString(36)}export{resolveRuntimeCompiledArtifactsVersionedCacheKey};
+import{getRuntimeCompiledArtifactsCacheKey}from"#runtime/compiled-artifacts-source.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{loadCompileMetadata}from"#runtime/loaders/compile-metadata.js";async function resolveRuntimeCompiledArtifactsVersionedCacheKey(e){let t=getRuntimeCompiledArtifactsCacheKey(e),n=await resolveCompileMetadataMtimeMs(e);try{let r=(await loadCompileMetadata({compiledArtifactsSource:e}))?.discovery.sourceGraphHash;return r===void 0||r.length===0?n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`:n===void 0?`${t}:${r}`:`${t}:${r}:mtime-${formatMtimeMsForCacheKey(n)}`}catch{return n===void 0?t:`${t}:mtime-${formatMtimeMsForCacheKey(n)}`}}async function resolveCompileMetadataMtimeMs(e){if(e.kind!==`disk`)return;let{stat:t}=await import(`node:fs/promises`),{compileMetadataPath:n}=resolveRuntimeCompilerArtifactPaths(e.appRoot);try{return(await t(n)).mtimeMs}catch{return}}function formatMtimeMsForCacheKey(e){return Math.floor(e).toString(36)}export{resolveRuntimeCompiledArtifactsVersionedCacheKey};

package/dist/src/runtime/compiled-artifacts-source.d.ts

@@ -8,6 +8,8 @@ export type RuntimeCompiledArtifactsSource = RuntimeBundledCompiledArtifactsSour
  */
 export interface RuntimeBundledCompiledArtifactsSource {
     readonly kind: "bundled";
+    /** Stable app partition embedded by a production build for local providers. */
+    readonly sandboxScope?: string;
 }
 /**
  * Disk-backed compiled artifacts rooted at one authored application.
@@ -23,6 +25,8 @@ export interface RuntimeDiskCompiledArtifactsSource {
      * emitted by the build.
      */
     readonly moduleMapLoaderPath?: string;
+    /** Stable app partition shared by production build preparation and runtime. */
+    readonly sandboxScope?: string;
     /**
      * Stable application root used for local sandbox template/session caches.
      * In development, `appRoot` can point at an immutable runtime snapshot
@@ -41,7 +45,7 @@ export interface RuntimeDiskCompiledArtifactsSource {
 /**
  * Creates the bundled compiled-artifact source.
  */
-export declare function createBundledRuntimeCompiledArtifactsSource(): RuntimeBundledCompiledArtifactsSource;
+export declare function createBundledRuntimeCompiledArtifactsSource(sandboxScope?: string): RuntimeBundledCompiledArtifactsSource;
 /**
  * Creates the disk-backed compiled-artifact source for one authored app root.
  */
@@ -49,6 +53,7 @@ export declare function createDiskRuntimeCompiledArtifactsSource(appRoot: string
     readonly durableReference?: "development-generation";
     readonly moduleMapLoaderPath?: string;
     readonly sandboxAppRoot?: string;
+    readonly sandboxScope?: string;
 }): RuntimeDiskCompiledArtifactsSource;
 /**
  * Returns the disk-backed app root when one exists for the artifact source.

package/dist/src/runtime/compiled-artifacts-source.js

@@ -1 +1 @@
-function createBundledRuntimeCompiledArtifactsSource(){return{kind:`bundled`}}function createDiskRuntimeCompiledArtifactsSource(e,t={}){return t.moduleMapLoaderPath!==void 0||t.sandboxAppRoot!==void 0||t.durableReference!==void 0?{appRoot:e,durableReference:t.durableReference,kind:`disk`,moduleMapLoaderPath:t.moduleMapLoaderPath,sandboxAppRoot:t.sandboxAppRoot}:{appRoot:e,kind:`disk`}}function getRuntimeCompiledArtifactsAppRoot(e){return e.kind===`disk`?e.appRoot:void 0}function getRuntimeCompiledArtifactsSandboxAppRoot(e){return e.kind===`disk`?e.sandboxAppRoot??e.appRoot:void 0}function getRuntimeCompiledArtifactsCacheKey(e){return e.kind===`disk`?e.moduleMapLoaderPath===void 0?`disk:${e.appRoot}`:`disk:${e.appRoot}:authored-source:${e.moduleMapLoaderPath}`:`bundled`}export{createBundledRuntimeCompiledArtifactsSource,createDiskRuntimeCompiledArtifactsSource,getRuntimeCompiledArtifactsAppRoot,getRuntimeCompiledArtifactsCacheKey,getRuntimeCompiledArtifactsSandboxAppRoot};
+function createBundledRuntimeCompiledArtifactsSource(e){return e===void 0?{kind:`bundled`}:{kind:`bundled`,sandboxScope:e}}function createDiskRuntimeCompiledArtifactsSource(e,t={}){return t.moduleMapLoaderPath!==void 0||t.sandboxAppRoot!==void 0||t.sandboxScope!==void 0||t.durableReference!==void 0?{appRoot:e,durableReference:t.durableReference,kind:`disk`,moduleMapLoaderPath:t.moduleMapLoaderPath,sandboxAppRoot:t.sandboxAppRoot,sandboxScope:t.sandboxScope}:{appRoot:e,kind:`disk`}}function getRuntimeCompiledArtifactsAppRoot(e){return e.kind===`disk`?e.appRoot:void 0}function getRuntimeCompiledArtifactsSandboxAppRoot(e){return e.kind===`disk`?e.sandboxAppRoot??e.appRoot:void 0}function getRuntimeCompiledArtifactsCacheKey(e){return e.kind===`disk`?e.moduleMapLoaderPath===void 0?`disk:${e.appRoot}`:`disk:${e.appRoot}:authored-source:${e.moduleMapLoaderPath}`:`bundled`}export{createBundledRuntimeCompiledArtifactsSource,createDiskRuntimeCompiledArtifactsSource,getRuntimeCompiledArtifactsAppRoot,getRuntimeCompiledArtifactsCacheKey,getRuntimeCompiledArtifactsSandboxAppRoot};

package/dist/src/runtime/connections/scoped-authorization.js

@@ -1 +1 @@
-import{contextStorage,loadContext}from"#context/container.js";import{consumeAuthorizationResult,createAuthorizationAttempt,requestAuthorization}from"#harness/authorization.js";import{isAsyncIterable}from"#shared/async-iterable.js";import{ConnectionAuthorizationFailedError,ConnectionAuthorizationRequiredError,isConnectionAuthorizationRequiredError}from"#connections/errors.js";import{supportsInteractiveAuthorization}from"#shared/connection-types.js";import{evictCachedToken,readCachedToken,writeCachedToken}from"#runtime/connections/authorization-tokens.js";import{principalKey,resolveConnectionPrincipal,resolveConnectionPrincipalFromAuth}from"#runtime/connections/principal.js";const LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES=new Set([`127.0.0.1`,`[::1]`]);function createAuthorizationExecution(e={}){let t=new Set;async function complete(n){let r=n.instanceId??n.scope;!t.has(r)&&await(e.completeAuthorization??completeScopedAuthorization)(n)&&t.add(r)}function requireAuth(e,n){throw new ScopedAuthorizationRequiredError(e,t.has(e.instanceId??e.scope),n)}return{complete,async getToken(e){await complete(e);try{return await resolveScopedToken(e)}catch(t){if(!isConnectionAuthorizationRequiredError(t))throw t;return requireAuth(e,t)}},requireAuth,async handleError(e,n){return n!==void 0&&isConnectionAuthorizationRequiredError(e)?await handleAuthorizationError(new ScopedAuthorizationRequiredError(n,t.has(n.instanceId??n.scope),e),{evictToken:!1}):await handleAuthorizationError(e)},run:executeWithAuthorization}}var ScopedAuthorizationRequiredError=class extends Error{scoped;justAuthorized;constructor(e,t,n){super(`Authorization required.`,{cause:n}),this.name=`ScopedAuthorizationRequiredError`,this.scoped=e,this.justAuthorized=t}};function isScopedAuthorizationRequiredError(e){return e instanceof Error&&e.name===`ScopedAuthorizationRequiredError`}async function handleAuthorizationError(e,t={evictToken:!0}){if(!isScopedAuthorizationRequiredError(e))throw e;let{scoped:n}=e;if(e.justAuthorized)throw new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" failed: the service rejected the token immediately after authorization.`,reason:`token_rejected_after_authorization`,retryable:!1});t.evictToken&&await evictScopedToken(n);let r=await startScopedAuthorization(n);if(r!==void 0)return r;throw supportsInteractiveAuthorization(n.authorization)?new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" requires sign-in, but no authorization callback URL could be minted for this run (missing session context).`,reason:`authorization_callback_unavailable`,retryable:!1}):e.cause??new ConnectionAuthorizationRequiredError(n.scope)}function executeWithAuthorization(e){try{let t=e();return isAsyncIterable(t)?handleIterable(t):Promise.resolve(t).catch(handleAuthorizationError)}catch(e){return handleAuthorizationError(e)}}async function*handleIterable(e){try{for await(let t of e)yield t}catch(e){yield await handleAuthorizationError(e)}}async function resolveScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore(),o=resolveScopedPrincipal(e,a);if(a===void 0)return await n.getToken({connection:r,principal:o});let s=principalKey(o),c=readCachedToken(a,i,s);if(c!==void 0)return c;let l=await n.getToken({connection:r,principal:o});return writeCachedToken(a,i,s,l),l}async function evictScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore();if(a===void 0)return;let o;try{o=resolveScopedPrincipal(e,a),evictCachedToken(a,i,principalKey(o))}catch{return}try{await n.evict?.({connection:r,principal:o})}catch{}}async function completeScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return!1;let i=consumeAuthorizationResult(t,e.instanceId);if(i===void 0)return!1;let a=n,o=loadContext(),s=i.principal??resolveScopedPrincipal(e,o),c=await a.completeAuthorization({callbackUrl:i.hookUrl,connection:r,principal:s,resume:i.resume,callback:i.callback});return writeCachedToken(o,e.instanceId??t,principalKey(s),c),!0}async function startScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return;let i=createAuthorizationAttempt(t);if(i===void 0)return;let a=n,o=resolveScopedPrincipal(e),s=resolveAuthorizationCallbackUrl({authorization:n,callbackUrl:i.hookUrl}),{challenge:c,resume:l}=await a.startAuthorization({callbackUrl:s,connection:r,principal:o});return requestAuthorization([{attemptId:i.attemptId,challenge:stampChallengeDisplayName(c,n),hookUrl:s,instanceId:e.instanceId,name:t,principal:o,resume:l}])}function resolveScopedPrincipal(e,t){return e.boundResponder===void 0?resolveConnectionPrincipal(e.scope,e.authorization,t):resolveConnectionPrincipalFromAuth(e.scope,e.authorization,e.boundResponder,t)}function resolveAuthorizationCallbackUrl(e){if(e.authorization.vercelConnect===void 0)return e.callbackUrl;let t;try{t=new URL(e.callbackUrl)}catch{return e.callbackUrl}return t.protocol!==`http:`||!LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES.has(t.hostname)?e.callbackUrl:(t.hostname=`localhost`,t.toString())}function stampChallengeDisplayName(e,t){let n=t.displayName??e.displayName;return n===e.displayName?e:{...e,displayName:n}}export{completeScopedAuthorization,createAuthorizationExecution,evictScopedToken,handleAuthorizationError,resolveAuthorizationCallbackUrl,resolveScopedToken,stampChallengeDisplayName,startScopedAuthorization};
+import{contextStorage,loadContext}from"#context/container.js";import{consumeAuthorizationResult,createAuthorizationAttempt,requestAuthorization}from"#harness/authorization.js";import{ConnectionAuthorizationFailedError,ConnectionAuthorizationRequiredError,isConnectionAuthorizationRequiredError}from"#connections/errors.js";import{supportsInteractiveAuthorization}from"#shared/connection-types.js";import{isAsyncIterable}from"#shared/async-iterable.js";import{evictCachedToken,readCachedToken,writeCachedToken}from"#runtime/connections/authorization-tokens.js";import{principalKey,resolveConnectionPrincipal,resolveConnectionPrincipalFromAuth}from"#runtime/connections/principal.js";const LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES=new Set([`127.0.0.1`,`[::1]`]);function createAuthorizationExecution(e={}){let t=new Set;async function complete(n){let r=n.instanceId??n.scope;!t.has(r)&&await(e.completeAuthorization??completeScopedAuthorization)(n)&&t.add(r)}function requireAuth(e,n){throw new ScopedAuthorizationRequiredError(e,t.has(e.instanceId??e.scope),n)}return{complete,async getToken(e){await complete(e);try{return await resolveScopedToken(e)}catch(t){if(!isConnectionAuthorizationRequiredError(t))throw t;return requireAuth(e,t)}},requireAuth,async handleError(e,n){return n!==void 0&&isConnectionAuthorizationRequiredError(e)?await handleAuthorizationError(new ScopedAuthorizationRequiredError(n,t.has(n.instanceId??n.scope),e),{evictToken:!1}):await handleAuthorizationError(e)},run:executeWithAuthorization}}var ScopedAuthorizationRequiredError=class extends Error{scoped;justAuthorized;constructor(e,t,n){super(`Authorization required.`,{cause:n}),this.name=`ScopedAuthorizationRequiredError`,this.scoped=e,this.justAuthorized=t}};function isScopedAuthorizationRequiredError(e){return e instanceof Error&&e.name===`ScopedAuthorizationRequiredError`}async function handleAuthorizationError(e,t={evictToken:!0}){if(!isScopedAuthorizationRequiredError(e))throw e;let{scoped:n}=e;if(e.justAuthorized)throw new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" failed: the service rejected the token immediately after authorization.`,reason:`token_rejected_after_authorization`,retryable:!1});t.evictToken&&await evictScopedToken(n);let r=await startScopedAuthorization(n);if(r!==void 0)return r;throw supportsInteractiveAuthorization(n.authorization)?new ConnectionAuthorizationFailedError(n.scope,{message:`Authorization for "${n.scope}" requires sign-in, but no authorization callback URL could be minted for this run (missing session context).`,reason:`authorization_callback_unavailable`,retryable:!1}):e.cause??new ConnectionAuthorizationRequiredError(n.scope)}function executeWithAuthorization(e){try{let t=e();return isAsyncIterable(t)?handleIterable(t):Promise.resolve(t).catch(handleAuthorizationError)}catch(e){return handleAuthorizationError(e)}}async function*handleIterable(e){try{for await(let t of e)yield t}catch(e){yield await handleAuthorizationError(e)}}async function resolveScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore(),o=resolveScopedPrincipal(e,a);if(a===void 0)return await n.getToken({connection:r,principal:o});let s=principalKey(o),c=readCachedToken(a,i,s);if(c!==void 0)return c;let l=await n.getToken({connection:r,principal:o});return writeCachedToken(a,i,s,l),l}async function evictScopedToken(e){let{scope:t,authorization:n,connection:r}=e,i=e.instanceId??t,a=contextStorage.getStore();if(a===void 0)return;let o;try{o=resolveScopedPrincipal(e,a),evictCachedToken(a,i,principalKey(o))}catch{return}try{await n.evict?.({connection:r,principal:o})}catch{}}async function completeScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return!1;let i=consumeAuthorizationResult(t,e.instanceId);if(i===void 0)return!1;let a=n,o=loadContext(),s=i.principal??resolveScopedPrincipal(e,o),c=await a.completeAuthorization({callbackUrl:i.hookUrl,connection:r,principal:s,resume:i.resume,callback:i.callback});return writeCachedToken(o,e.instanceId??t,principalKey(s),c),!0}async function startScopedAuthorization(e){let{scope:t,authorization:n,connection:r}=e;if(!supportsInteractiveAuthorization(n))return;let i=createAuthorizationAttempt(t);if(i===void 0)return;let a=n,o=resolveScopedPrincipal(e),s=resolveAuthorizationCallbackUrl({authorization:n,callbackUrl:i.hookUrl}),{challenge:c,resume:l}=await a.startAuthorization({callbackUrl:s,connection:r,principal:o});return requestAuthorization([{attemptId:i.attemptId,challenge:stampChallengeDisplayName(c,n),hookUrl:s,instanceId:e.instanceId,name:t,principal:o,resume:l}])}function resolveScopedPrincipal(e,t){return e.boundResponder===void 0?resolveConnectionPrincipal(e.scope,e.authorization,t):resolveConnectionPrincipalFromAuth(e.scope,e.authorization,e.boundResponder,t)}function resolveAuthorizationCallbackUrl(e){if(e.authorization.vercelConnect===void 0)return e.callbackUrl;let t;try{t=new URL(e.callbackUrl)}catch{return e.callbackUrl}return t.protocol!==`http:`||!LOCAL_HTTP_VERCEL_CONNECT_HOSTNAMES.has(t.hostname)?e.callbackUrl:(t.hostname=`localhost`,t.toString())}function stampChallengeDisplayName(e,t){let n=t.displayName??e.displayName;return n===e.displayName?e:{...e,displayName:n}}export{completeScopedAuthorization,createAuthorizationExecution,evictScopedToken,handleAuthorizationError,resolveAuthorizationCallbackUrl,resolveScopedToken,stampChallengeDisplayName,startScopedAuthorization};

package/dist/src/runtime/loaders/artifact-paths.d.ts

@@ -10,6 +10,7 @@ export interface RuntimeCompilerArtifactPaths {
     readonly discoveryManifestPath: string;
     readonly discoveryDirectoryPath: string;
     readonly moduleMapPath: string;
+    readonly sandboxPreparedArtifactsPath: string;
 }
 /**
  * Resolves the stable eve artifact paths for one application root without

package/dist/src/runtime/loaders/artifact-paths.js

@@ -1 +1 @@
-function resolveRuntimeCompilerArtifactPaths(e){let t=normalizeFilesystemPath(e),n=`${t}/.eve/discovery`,r=`${t}/.eve/compile`;return{appRoot:t,compiledManifestPath:`${r}/compiled-agent-manifest.json`,compileDirectoryPath:r,compileMetadataPath:`${r}/compile-metadata.json`,diagnosticsPath:`${n}/diagnostics.json`,discoveryDirectoryPath:n,discoveryManifestPath:`${n}/agent-discovery-manifest.json`,moduleMapPath:`${r}/module-map.mjs`}}function normalizeFilesystemPath(e){let t=e.replaceAll(`\\`,`/`);return t===`/`?t:t.replace(/\/+$/,``)}export{resolveRuntimeCompilerArtifactPaths};
+function resolveRuntimeCompilerArtifactPaths(e){let t=normalizeFilesystemPath(e),n=`${t}/.eve/discovery`,r=`${t}/.eve/compile`;return{appRoot:t,compiledManifestPath:`${r}/compiled-agent-manifest.json`,compileDirectoryPath:r,compileMetadataPath:`${r}/compile-metadata.json`,diagnosticsPath:`${n}/diagnostics.json`,discoveryDirectoryPath:n,discoveryManifestPath:`${n}/agent-discovery-manifest.json`,moduleMapPath:`${r}/module-map.mjs`,sandboxPreparedArtifactsPath:`${r}/sandbox-prepared-artifacts.json`}}function normalizeFilesystemPath(e){let t=e.replaceAll(`\\`,`/`);return t===`/`?t:t.replace(/\/+$/,``)}export{resolveRuntimeCompilerArtifactPaths};

package/dist/src/runtime/loaders/bundled-artifacts.d.ts

@@ -1,6 +1,7 @@
 import type { CompileMetadata } from "#compiler/artifacts.js";
 import type { CompiledAgentManifest } from "#compiler/manifest.js";
 import type { CompiledModuleMap } from "#compiler/module-map.js";
+import type { SandboxPreparedArtifactsManifest } from "#shared/sandbox-prepared-artifacts.js";
 /**
  * Bundled compiled artifacts installed by Nitro when authored runtime state is
  * embedded directly into the server bundle.
@@ -9,6 +10,7 @@ export interface BundledCompiledArtifacts {
     manifest: CompiledAgentManifest;
     metadata?: CompileMetadata;
     moduleMap: CompiledModuleMap;
+    sandboxPreparedArtifacts?: SandboxPreparedArtifactsManifest;
 }
 /**
  * Input for running code against one isolated bundled compiled-artifact
@@ -33,4 +35,5 @@ export declare function withBundledCompiledArtifacts<T>(input: WithBundledCompil
  * Reads the bundled compiled-artifact snapshot for the active runtime
  * session, or `null` if none has been installed.
  */
+export declare function updateBundledSandboxPreparedArtifacts(sandboxPreparedArtifacts: SandboxPreparedArtifactsManifest): boolean;
 export declare function readBundledCompiledArtifacts(): BundledCompiledArtifacts | null;

package/dist/src/runtime/loaders/bundled-artifacts.js

@@ -1 +1 @@
-import{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession}from"#runtime/sessions/runtime-session.js";function installBundledCompiledArtifacts(e){setRuntimeSessionCompiledArtifacts(getActiveRuntimeSession(),{manifest:e.manifest,metadata:e.metadata,moduleMap:e.moduleMap})}async function withBundledCompiledArtifacts(e,t){let n=createRuntimeSession(e.sessionId??`bundled-compiled-artifacts`);return await withRuntimeSession(n,async()=>(installBundledCompiledArtifacts(e),await t()))}function readBundledCompiledArtifacts(){return getActiveRuntimeSession().compiledArtifacts}export{installBundledCompiledArtifacts,readBundledCompiledArtifacts,withBundledCompiledArtifacts};
+import{createRuntimeSession,getActiveRuntimeSession,setRuntimeSessionCompiledArtifacts,withRuntimeSession}from"#runtime/sessions/runtime-session.js";function installBundledCompiledArtifacts(e){setRuntimeSessionCompiledArtifacts(getActiveRuntimeSession(),{manifest:e.manifest,metadata:e.metadata,moduleMap:e.moduleMap,sandboxPreparedArtifacts:e.sandboxPreparedArtifacts})}async function withBundledCompiledArtifacts(e,t){let n=createRuntimeSession(e.sessionId??`bundled-compiled-artifacts`);return await withRuntimeSession(n,async()=>(installBundledCompiledArtifacts(e),await t()))}function updateBundledSandboxPreparedArtifacts(e){let t=getActiveRuntimeSession(),n=t.compiledArtifacts;return n!==null&&(setRuntimeSessionCompiledArtifacts(t,{...n,sandboxPreparedArtifacts:e}),!0)}function readBundledCompiledArtifacts(){return getActiveRuntimeSession().compiledArtifacts}export{installBundledCompiledArtifacts,readBundledCompiledArtifacts,updateBundledSandboxPreparedArtifacts,withBundledCompiledArtifacts};

package/dist/src/runtime/loaders/compile-metadata.js

@@ -1 +1 @@
-import{z}from"#compiled/zod/index.js";import{COMPILE_METADATA_KIND,COMPILE_METADATA_VERSION}from"#compiler/artifacts.js";import{formatValidationError}from"#runtime/validation.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";const compileArtifactDigestSchema=z.object({path:z.string(),sha256:z.string()}).strict(),compileMetadataSchema=z.object({compile:z.object({manifest:compileArtifactDigestSchema,moduleMap:compileArtifactDigestSchema}).strict(),discovery:z.object({diagnostics:compileArtifactDigestSchema,manifest:compileArtifactDigestSchema,sourceGraphHash:z.string(),summary:z.object({errors:z.number().finite(),warnings:z.number().finite()}).strict()}).strict(),generator:z.object({name:z.string(),version:z.string()}).strict(),kind:z.literal(COMPILE_METADATA_KIND),status:z.union([z.literal(`failed`),z.literal(`ready`)]),version:z.literal(COMPILE_METADATA_VERSION)}).strict();var LoadCompileMetadataError=class extends Error{metadataPath;constructor(e,t){super(e),this.name=`LoadCompileMetadataError`,t!==void 0&&(this.metadataPath=t)}};async function loadCompileMetadata(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compileMetadataPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompileMetadataError(formatLoadErrorMessage(e),t)}return parseCompileMetadata(n,t)}let n=readBundledCompiledArtifacts()?.metadata;return n===void 0?null:parseCompileMetadata(n,`bundled compile metadata`)}function parseCompileMetadata(e,t){let n=compileMetadataSchema.safeParse(e);if(!n.success)throw new LoadCompileMetadataError(`Expected "${t}" to contain valid eve compile metadata. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown compile metadata load failure.`}export{loadCompileMetadata};
+import{z}from"#compiled/zod/index.js";import{COMPILE_METADATA_KIND,COMPILE_METADATA_VERSION}from"#compiler/artifacts.js";import{formatValidationError}from"#runtime/validation.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";const compileArtifactDigestSchema=z.object({path:z.string(),sha256:z.string()}).strict(),compileMetadataSchema=z.object({compile:z.object({manifest:compileArtifactDigestSchema,moduleMap:compileArtifactDigestSchema}).strict(),discovery:z.object({diagnostics:compileArtifactDigestSchema,manifest:compileArtifactDigestSchema,sourceGraphHash:z.string(),summary:z.object({errors:z.number().finite(),warnings:z.number().finite()}).strict()}).strict(),generator:z.object({name:z.string(),version:z.string()}).strict(),kind:z.literal(COMPILE_METADATA_KIND),status:z.union([z.literal(`failed`),z.literal(`ready`)]),version:z.literal(COMPILE_METADATA_VERSION)}).strict();var LoadCompileMetadataError=class extends Error{metadataPath;constructor(e,t){super(e),this.name=`LoadCompileMetadataError`,t!==void 0&&(this.metadataPath=t)}};async function loadCompileMetadata(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compileMetadataPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompileMetadataError(formatLoadErrorMessage(e),t)}return parseCompileMetadata(n,t)}let n=readBundledCompiledArtifacts()?.metadata;return n===void 0?null:parseCompileMetadata(n,`bundled compile metadata`)}function parseCompileMetadata(e,t){let n=compileMetadataSchema.safeParse(e);if(!n.success)throw new LoadCompileMetadataError(`Expected "${t}" to contain valid eve compile metadata. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown compile metadata load failure.`}export{loadCompileMetadata};

package/dist/src/runtime/loaders/manifest.js

@@ -1 +1 @@
-import{compiledAgentManifestSchema}from"#compiler/manifest.js";import{formatValidationError}from"#runtime/validation.js";import{validateCompiledAgentManifest}from"#compiler/validate-artifact.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";const BUNDLED_MANIFEST_SOURCE=`bundled compiled manifest`;var LoadCompiledManifestError=class extends Error{manifestPath;constructor(e,t){super(e),this.name=`LoadCompiledManifestError`,t!==void 0&&(this.manifestPath=t)}};async function loadCompiledManifest(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compiledManifestPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompiledManifestError(formatLoadErrorMessage(e),t)}return parseCompiledManifest(n,t)}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledManifest(n.manifest,BUNDLED_MANIFEST_SOURCE);throw new LoadCompiledManifestError(`Compiled manifest is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MANIFEST_SOURCE)}function parseCompiledManifest(e,t){let n=compiledAgentManifestSchema.safeParse(e);if(!n.success)throw new LoadCompiledManifestError(`Expected "${t}" to contain a valid compiled eve agent manifest. ${formatValidationError(n.error)}`,t);try{validateCompiledAgentManifest(n.data)}catch(e){throw new LoadCompiledManifestError(`Expected "${t}" to contain a semantically valid compiled eve agent manifest. ${formatLoadErrorMessage(e)}`,t)}return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown manifest load failure.`}export{LoadCompiledManifestError,loadCompiledManifest};
+import{compiledAgentManifestSchema}from"#compiler/manifest.js";import{formatValidationError}from"#runtime/validation.js";import{validateCompiledAgentManifest}from"#compiler/validate-artifact.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";const BUNDLED_MANIFEST_SOURCE=`bundled compiled manifest`;var LoadCompiledManifestError=class extends Error{manifestPath;constructor(e,t){super(e),this.name=`LoadCompiledManifestError`,t!==void 0&&(this.manifestPath=t)}};async function loadCompiledManifest(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compiledManifestPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompiledManifestError(formatLoadErrorMessage(e),t)}return parseCompiledManifest(n,t)}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledManifest(n.manifest,BUNDLED_MANIFEST_SOURCE);throw new LoadCompiledManifestError(`Compiled manifest is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MANIFEST_SOURCE)}function parseCompiledManifest(e,t){let n=compiledAgentManifestSchema.safeParse(e);if(!n.success)throw new LoadCompiledManifestError(`Expected "${t}" to contain a valid compiled eve agent manifest. ${formatValidationError(n.error)}`,t);try{validateCompiledAgentManifest(n.data)}catch(e){throw new LoadCompiledManifestError(`Expected "${t}" to contain a semantically valid compiled eve agent manifest. ${formatLoadErrorMessage(e)}`,t)}return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown manifest load failure.`}export{LoadCompiledManifestError,loadCompiledManifest};

package/dist/src/runtime/loaders/module-map.js

@@ -1 +1 @@
-import{compiledModuleMapSchema}from"#compiler/module-map.js";import{formatValidationError}from"#runtime/validation.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";const BUNDLED_MODULE_MAP_SOURCE=`bundled compiled module map`;var LoadCompiledModuleMapError=class extends Error{moduleMapPath;constructor(e,t){super(e),this.name=`LoadCompiledModuleMapError`,t!==void 0&&(this.moduleMapPath=t)}};async function loadCompiledModuleMap(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).moduleMapPath:void 0;if(t!==void 0){let e=createFileImportSpecifier(t);try{let n=await import(e);return parseCompiledModuleMap(n.moduleMap??n.default,t)}catch(e){throw new LoadCompiledModuleMapError(formatLoadErrorMessage(e),t)}}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledModuleMap(n.moduleMap,BUNDLED_MODULE_MAP_SOURCE);throw new LoadCompiledModuleMapError(`Compiled module map is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MODULE_MAP_SOURCE)}function parseCompiledModuleMap(e,t){let n=compiledModuleMapSchema.safeParse(e);if(!n.success)throw new LoadCompiledModuleMapError(`Expected "${t}" to export a valid compiled eve module map. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown module-map load failure.`}function createFileImportSpecifier(e){let t=e.replaceAll(`\\`,`/`);return/^[A-Za-z]:\//.test(t)?`file:///${encodeURI(t)}`:t.startsWith(`/`)?`file://${encodeURI(t)}`:t}export{LoadCompiledModuleMapError,loadCompiledModuleMap};
+import{compiledModuleMapSchema}from"#compiler/module-map.js";import{formatValidationError}from"#runtime/validation.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";const BUNDLED_MODULE_MAP_SOURCE=`bundled compiled module map`;var LoadCompiledModuleMapError=class extends Error{moduleMapPath;constructor(e,t){super(e),this.name=`LoadCompiledModuleMapError`,t!==void 0&&(this.moduleMapPath=t)}};async function loadCompiledModuleMap(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).moduleMapPath:void 0;if(t!==void 0){let e=createFileImportSpecifier(t);try{let n=await import(e);return parseCompiledModuleMap(n.moduleMap??n.default,t)}catch(e){throw new LoadCompiledModuleMapError(formatLoadErrorMessage(e),t)}}let n=readBundledCompiledArtifacts();if(n!==null)return parseCompiledModuleMap(n.moduleMap,BUNDLED_MODULE_MAP_SOURCE);throw new LoadCompiledModuleMapError(`Compiled module map is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MODULE_MAP_SOURCE)}function parseCompiledModuleMap(e,t){let n=compiledModuleMapSchema.safeParse(e);if(!n.success)throw new LoadCompiledModuleMapError(`Expected "${t}" to export a valid compiled eve module map. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown module-map load failure.`}function createFileImportSpecifier(e){let t=e.replaceAll(`\\`,`/`);return/^[A-Za-z]:\//.test(t)?`file:///${encodeURI(t)}`:t.startsWith(`/`)?`file://${encodeURI(t)}`:t}export{LoadCompiledModuleMapError,loadCompiledModuleMap};

package/dist/src/runtime/local-dev-capability.d.ts

@@ -1,12 +1,11 @@
 export declare const LOCAL_DEV_INTERACTIVE_CLIENT_HEADER = "x-eve-dev-interactive-client";
 /**
- * Capabilities available to authored code in an execution initiated by a
- * same-machine request to `eve dev`.
+ * Host facilities available to authored code running on an `eve dev` server.
  *
- * Absence is the signal, not a disabled flag: a deployed runtime has no
- * authored tree to mutate or watcher to pause, and a request from a remote
- * client is not authorized to mutate the server's authored tree.
- * {@link getLocalDevCapability} returns `undefined` in both cases.
+ * Absence means this host has no authored tree to mutate or watcher to pause.
+ * When present, the capability is available to every execution on that host;
+ * callers admitted to the development server are trusted with enabled local
+ * editing tools.
  */
 export interface LocalDevCapability {
     /**
@@ -15,8 +14,9 @@ export interface LocalDevCapability {
      */
     readonly appRoot: string;
     /**
-     * Whether the requesting client is the dev TUI and can therefore run a flow
-     * that asks questions in its terminal.
+     * Whether the originating client is the dev TUI and can run a flow that asks
+     * questions in its terminal. This inherited hint is not proof that the
+     * current sender has a live terminal.
      */
     readonly interactiveClient: boolean;
     /**
@@ -39,13 +39,15 @@ export declare function installLocalDevCapabilityEnvironment(input: {
     readonly serverUrl: string;
 }): () => void;
 /**
- * Seeds durable local-dev provenance only when the parent host signed a
- * loopback peer address. Public address headers cannot grant access.
+ * Seeds the inherited dev-TUI hint only when the dev host signed a loopback
+ * peer address. Client-supplied address headers cannot create that hint.
  */
 export declare function withLocalDevRequestScope<T>(request: Request, callback: () => Promise<T>): Promise<T>;
 /**
- * Resolves the local dev capability, or `undefined` outside an execution
- * initiated by an authorized local request to `eve dev`.
+ * Resolves local development host facilities, or `undefined` when this host
+ * lacks the authored root or watcher control origin installed by `eve dev`.
+ * Request provenance affects only the optional dev-TUI hint, never access to
+ * the authored tree.
  *
  * This is deliberately not a {@link import("#public/definitions/tool.js").ToolContext}
  * field: both values are meaningless in a deployed runtime, and a capability