eve 0.82.0 → 0.83.1

package/dist/src/execution/sandbox/bindings/microsandbox-create.d.ts

@@ -1,12 +0,0 @@
-import type { MicrosandboxError, Sandbox as MicrosandboxSandbox, SandboxBuilder as MicrosandboxSandboxBuilder } from "microsandbox";
-export declare function createMicrosandboxWithProgress(input: {
-    readonly builder: MicrosandboxSandboxBuilder;
-    readonly errorType: typeof MicrosandboxError;
-    readonly log?: (message: string) => void;
-    readonly source: string;
-}): Promise<MicrosandboxSandbox>;
-export declare function enrichMicrosandboxError(input: {
-    readonly context: string;
-    readonly error: unknown;
-    readonly errorType?: typeof MicrosandboxError;
-}): Error;

package/dist/src/execution/sandbox/bindings/microsandbox-create.js

@@ -1 +0,0 @@
-import{toErrorMessage}from"#shared/errors.js";async function createMicrosandboxWithProgress(e){let t={phase:`resolving the image`};try{let n=await e.builder.createWithPullProgress(),r=reportMicrosandboxCreateProgress(n,t,e.log);try{return await withHeartbeat(t,e.log,async()=>await n.awaitSandbox())}finally{await r.catch(()=>{})}}catch(n){throw enrichMicrosandboxError({context:`Failed to create microsandbox VM from ${e.source} while ${t.phase}`,error:n,errorType:e.errorType})}}function enrichMicrosandboxError(e){if(e.error instanceof MicrosandboxDiagnosticError)return e.error;let t=readMicrosandboxErrorCode(e.error,e.errorType),n=t===void 0?``:` [${t}]`,r=toErrorMessage(e.error),i=/[.!?]$/u.test(r)?r:`${r}.`;return new MicrosandboxDiagnosticError(`${e.context}${n}: ${i}`,{cause:e.error,hint:microsandboxErrorHint(t)})}var MicrosandboxDiagnosticError=class extends Error{hint;constructor(e,t){super(e,t),this.name=`MicrosandboxDiagnosticError`,t?.hint!==void 0&&(this.hint=t.hint)}};async function reportMicrosandboxCreateProgress(e,t,n){for await(let r of e){let e=microsandboxCreatePhase(r,t.phase);e!==t.phase&&(t.phase=e,n?.(e))}}function microsandboxCreatePhase(e,t){switch(e.kind){case`resolving`:case`resolved`:return`resolving the image`;case`layerDownloadProgress`:case`layerDownloadComplete`:case`layerDownloadVerifying`:case`layerMaterializeStarted`:case`layerMaterializeProgress`:case`layerMaterializeWriting`:case`layerMaterializeComplete`:return`downloading and materializing image layers`;case`stitchMergingTrees`:case`stitchWritingFsmeta`:case`stitchWritingVmdk`:case`stitchComplete`:return`assembling the image filesystem`;case`complete`:return`image ready; booting microsandbox VM`;default:return t}}async function withHeartbeat(e,t,n){if(t?.(e.phase),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{let n=Math.round((Date.now()-r)/1e3);t(`${e.phase} (${n}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}const MICROSANDBOX_ERROR_HINTS={database:`Check that the microsandbox npm package and installed VM runtime use the same version. If versions changed, use a clean MSB_HOME or migrate the existing database.`,imageNotFound:`Check that the image exists and that the registry credentials can pull it.`,libkrunfwNotFound:"Run `npx microsandbox install` and verify that MSB_PATH points to the installed runtime."};function readMicrosandboxErrorCode(e,t){if(t!==void 0&&e instanceof t||e instanceof Error&&`code`in e&&typeof e.code==`string`&&isMicrosandboxErrorCodeWithHint(e.code))return e.code}function isMicrosandboxErrorCodeWithHint(e){return e===`database`||e===`imageNotFound`||e===`libkrunfwNotFound`}function microsandboxErrorHint(e){return e===void 0?void 0:MICROSANDBOX_ERROR_HINTS[e]}export{createMicrosandboxWithProgress,enrichMicrosandboxError};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.d.ts

@@ -1,42 +0,0 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
-type NetworkPolicySandboxSession = SandboxSession & {
-    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
-};
-import { MICROSANDBOX_METADATA_VERSION } from "#execution/sandbox/bindings/microsandbox-metadata.js";
-import type { ResolvedMicrosandboxOptions } from "#execution/sandbox/bindings/microsandbox-options.js";
-import type { MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
-import { type SandboxProviderSessionContext, type SandboxProviderHandle, type SandboxProviderPrepareContext } from "#shared/sandbox-provider.js";
-export type MicrosandboxPreparedArtifact = {
-    readonly image: string | null;
-    readonly optionsHash: string;
-    readonly snapshotName: string;
-    readonly version: typeof MICROSANDBOX_METADATA_VERSION;
-};
-export declare function prewarmMicrosandboxTemplate(input: {
-    readonly providerName: string;
-    readonly options: ResolvedMicrosandboxOptions;
-    readonly optionsHash: string;
-    readonly context: SandboxProviderPrepareContext;
-    readonly dockerfile?: import("#execution/sandbox/dockerfile.js").SandboxDockerfile;
-    readonly prepare?: (sandbox: import("#shared/sandbox-session.js").SandboxSession) => Promise<void> | void;
-    readonly templateKey: string;
-}): Promise<MicrosandboxPreparedArtifact>;
-export declare function createMicrosandboxHandle(input: {
-    readonly artifact: MicrosandboxPreparedArtifact;
-    readonly context: SandboxProviderSessionContext;
-    readonly createIfMissing?: boolean;
-    readonly options: ResolvedMicrosandboxOptions;
-    readonly optionsHash: string;
-    readonly providerName: string;
-    readonly runtimeOptions?: MicrosandboxSandboxRuntimeOptions;
-    readonly sessionIdentity?: string;
-}): Promise<{
-    readonly handle: SandboxProviderHandle<NetworkPolicySandboxSession>;
-    readonly state: {
-        readonly optionsHash: string;
-        readonly sessionIdentity: string;
-        readonly version: 3;
-    };
-}>;
-export {};

package/dist/src/execution/sandbox/bindings/microsandbox-lifecycle.js

@@ -1 +0,0 @@
-import{randomUUID}from"node:crypto";import{mkdir,rename,rm}from"node:fs/promises";import{dirname}from"node:path";import{withDevelopmentSandboxMetadataPathTag}from"#execution/sandbox/development-run.js";import{buildSandboxSession}from"#execution/sandbox/session.js";import{createFileBackedInternalSandboxSession,touchDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{assertDockerDaemonAvailable,createDockerCli}from"#execution/sandbox/bindings/docker-cli.js";import{buildSandboxDockerfile,dockerfileImageReference,publishDockerImageForMicrosandbox}from"#execution/sandbox/dockerfile.js";import{hydrateSandboxProviderResources,prepareImmutableResources}from"#execution/sandbox/bindings/immutable-resources.js";import{createLoggingSandboxSession}from"#execution/sandbox/logging-session.js";import{isSandboxPreparedArtifactRecord}from"#shared/sandbox-provider.js";import{SandboxTemplateNotProvisionedError}from"#shared/sandbox-template-error.js";import{MICROSANDBOX_METADATA_VERSION,readSessionMetadata,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeTemplateMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,loadMicrosandboxModule,removeSnapshotIfExists,sandboxExists,snapshotExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath}from"#execution/sandbox/bindings/microsandbox-templates.js";const activeMicrosandboxSessionHandles=new Map;async function prewarmMicrosandboxTemplate(e){e.context.log?.(`loading microsandbox runtime`);let t=await loadMicrosandboxModule({host:e.context.host,log:e.context.log,options:e.options}),n=e.context.storagePath,r=resolveMicrosandboxTemplateRootPath(n,e.templateKey),i=resolveMicrosandboxMetadataPath(r);e.context.log?.(`checking cached snapshot`);let a=await readTemplateMetadata(i);if(a?.optionsHash===e.optionsHash&&await snapshotExists(t,a.snapshotName))return e.context.log?.(`reusing cached snapshot`),await touchDirectory(r),microsandboxTemplateArtifact(a);let o=createProviderName(`eve-sbx-tpl`,e.templateKey,e.optionsHash),s=`${r}.${randomUUID()}.tmp`,c=createProviderName(`eve-sbx-tpl-tmp`,`${e.templateKey}:${randomUUID()}`);await removeSnapshotIfExists(t,o),await rm(s,{force:!0,recursive:!0}),await mkdir(s,{recursive:!0});let l=e.options;if(e.dockerfile!==void 0){let t=createDockerCli();await assertDockerDaemonAvailable(t);let n=dockerfileImageReference({dockerfile:e.dockerfile,templateKey:e.templateKey});e.context.log?.(`building sandbox Dockerfile "${e.dockerfile.path}"`),await buildSandboxDockerfile({cli:t,dockerfile:e.dockerfile,imageReference:n}),e.context.log?.(`publishing Dockerfile image for microsandbox`);let r=await publishDockerImageForMicrosandbox({cli:t,imageReference:n});l={...e.options,image:r,pullPolicy:`always`}}let u=e.context.resources.source,d=u.kind===`materialized`?await prepareImmutableResources({storagePath:e.context.storagePath,provider:e.providerName,resourcesKey:u.key,sourcePath:u.path}):void 0;e.context.log?.(`creating template VM from image "${l.image}"`);let f=await createPreparedMicrosandbox({log:e.context.log,module:t,name:c,networkPolicy:`allow-all`,options:l,resourcesPath:d,sessionKey:e.templateKey,setupBaseRuntime:!0,tags:void 0}),p=buildSandboxSession(createMicrosandboxInternalSession(f),async e=>{await f.setNetworkPolicy(e)});try{await hydrateSandboxProviderResources({copySkills:!0,log:e.context.log,resources:e.context.resources,session:p}),e.prepare!==void 0&&(e.context.log?.(`running sandbox preparation`),await e.prepare(createLoggingSandboxSession({log:e.context.log,session:p}))),e.context.log?.(`snapshotting template VM`),await f.stopAndSnapshot(o),await writeTemplateMetadata(resolveMicrosandboxMetadataPath(s),{image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION}),await mkdir(dirname(r),{recursive:!0}),await rm(r,{force:!0,recursive:!0});try{await rename(s,r)}catch(e){if(await doesPathExist(r)){let e=await readTemplateMetadata(i);if(e!==null)return microsandboxTemplateArtifact(e)}throw e}}finally{await f.removePersisted(),await rm(s,{force:!0,recursive:!0}).catch(()=>{})}return microsandboxTemplateArtifact({image:e.dockerfile===void 0?void 0:l.image,optionsHash:e.optionsHash,snapshotName:o,version:MICROSANDBOX_METADATA_VERSION})}async function createMicrosandboxHandle(e){let t=requirePreparedMicrosandboxTemplate(e.artifact,e.providerName),n=e.sessionIdentity??createStableHash(`${e.context.session.id}:${t.snapshotName}:${e.optionsHash}`).slice(0,32),r=resolveMicrosandboxSessionRootPath(e.context.storagePath,n),i=resolveMicrosandboxMetadataPath(r),a=await readSessionMetadata(i),o=resolveMicrosandboxImage(a,t,e.options),s={...e.options,...o,networkPolicy:e.runtimeOptions?.networkPolicy},c=await loadMicrosandboxModule({host:e.context.host,options:s}),l=createActiveMicrosandboxSessionKey(r,e.optionsHash),u=activeMicrosandboxSessionHandles.get(l),d={optionsHash:e.optionsHash,sessionIdentity:n,version:3};if(u!==void 0)return{handle:u,state:d};let f=withDevelopmentSandboxMetadataPathTag({sessionId:e.context.session.id},i);if(a?.optionsHash===e.optionsHash&&(await sandboxExists(c,a.sandboxName)||a.stateSnapshotName!==void 0&&await snapshotExists(c,a.stateSnapshotName))){let t=await connectMicrosandbox({metadata:a,metadataPath:i,module:c,options:s,sessionKey:e.context.session.id,tags:f});if(t!==null)return{handle:cacheHandle(l,createHandle(t,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}if(e.sessionIdentity!==void 0&&e.createIfMissing===!1)throw Error(`microsandbox session "${e.sessionIdentity}" is no longer available to resume.`);if(t.optionsHash!==e.optionsHash||!await snapshotExists(c,t.snapshotName))throw new SandboxTemplateNotProvisionedError({providerName:e.providerName,templateKey:t.snapshotName});let p=createProviderName(`eve-sbx-ses`,n),m=await createPreparedMicrosandbox({fromSnapshot:t.snapshotName,module:c,name:p,networkPolicy:s.networkPolicy,options:s,sessionKey:e.context.session.id,setupBaseRuntime:!1,tags:f});return await m.writeMetadata(i,e.optionsHash),{handle:cacheHandle(l,createHandle(m,e.optionsHash,()=>{activeMicrosandboxSessionHandles.delete(l)})),state:d}}function resolveMicrosandboxImage(e,t,n){return e?.image===void 0?t?.image===void 0?{image:n.image,pullPolicy:n.pullPolicy}:{image:t.image,pullPolicy:`always`}:{image:e.image,pullPolicy:`always`}}function microsandboxTemplateArtifact(e){return{image:e.image??null,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:e.version}}function requirePreparedMicrosandboxTemplate(e,t){if(!isSandboxPreparedArtifactRecord(e)||e.version!==MICROSANDBOX_METADATA_VERSION||typeof e.optionsHash!=`string`||typeof e.snapshotName!=`string`)throw new SandboxTemplateNotProvisionedError({providerName:t,templateKey:`invalid-artifact`});return{image:typeof e.image==`string`?e.image:void 0,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:MICROSANDBOX_METADATA_VERSION}}function createHandle(e,t,n){return{sandbox:buildSandboxSession(createMicrosandboxInternalSession(e),async t=>{await e.setNetworkPolicy(t)}),async onSandboxDelete(){await e.shutdown(),await e.removePersisted(),n?.()},async onSandboxStop(){await e.stop(),n?.()},async onRuntimeShutdown(){n?.(),await e.shutdown()}}}function createMicrosandboxInternalSession(e){return createFileBackedInternalSandboxSession({sandbox:e})}function createActiveMicrosandboxSessionKey(e,t){return`${e}\0${t}`}function cacheHandle(e,t){return activeMicrosandboxSessionHandles.set(e,t),t}export{createMicrosandboxHandle,prewarmMicrosandboxTemplate};

package/dist/src/execution/sandbox/bindings/microsandbox-metadata.d.ts

@@ -1,29 +0,0 @@
-import { type SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-export declare const MICROSANDBOX_METADATA_VERSION = 2;
-export declare const MICROSANDBOX_METADATA_FILE_NAME = "metadata.json";
-export interface MicrosandboxTemplateMetadata {
-    readonly image?: string;
-    readonly optionsHash: string;
-    readonly snapshotName: string;
-    readonly version: typeof MICROSANDBOX_METADATA_VERSION;
-}
-export interface MicrosandboxSessionMetadata {
-    readonly image?: string;
-    readonly networkPolicy?: SandboxNetworkPolicy;
-    readonly optionsHash: string;
-    readonly sandboxName: string;
-    readonly stateSnapshotName?: string;
-    readonly version: typeof MICROSANDBOX_METADATA_VERSION;
-}
-export declare function createMicrosandboxSessionMetadata(input: {
-    readonly networkPolicy: SandboxNetworkPolicy | undefined;
-    readonly optionsHash: string;
-    readonly sandboxName: string;
-    readonly stateSnapshotName: string | undefined;
-}): MicrosandboxSessionMetadata;
-export declare function resolveMicrosandboxMetadataPath(rootPath: string): string;
-export declare function readTemplateMetadata(path: string): Promise<MicrosandboxTemplateMetadata | null>;
-export declare function writeTemplateMetadata(path: string, metadata: MicrosandboxTemplateMetadata): Promise<void>;
-export declare function readSessionMetadata(path: string): Promise<MicrosandboxSessionMetadata | null>;
-export declare function readSessionMetadataRecord(value: unknown): MicrosandboxSessionMetadata | null;
-export declare function writeSessionMetadata(path: string, metadata: MicrosandboxSessionMetadata): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-metadata.js

@@ -1 +0,0 @@
-import{randomUUID}from"node:crypto";import{mkdir,readFile,rename,writeFile}from"node:fs/promises";import{dirname,join}from"node:path";import{isSandboxNetworkPolicy}from"#shared/sandbox-network-policy.js";const MICROSANDBOX_METADATA_VERSION=2,MICROSANDBOX_METADATA_FILE_NAME=`metadata.json`;function createMicrosandboxSessionMetadata(e){let t={optionsHash:e.optionsHash,sandboxName:e.sandboxName,version:2};return e.networkPolicy!==void 0&&(t.networkPolicy=e.networkPolicy),e.stateSnapshotName!==void 0&&(t.stateSnapshotName=e.stateSnapshotName),t}function resolveMicrosandboxMetadataPath(e){return join(e,MICROSANDBOX_METADATA_FILE_NAME)}async function readTemplateMetadata(e){let t=await readJsonFile(e);return t?.version!==2||typeof t.optionsHash!=`string`||typeof t.snapshotName!=`string`?null:{image:typeof t.image==`string`?t.image:void 0,optionsHash:t.optionsHash,snapshotName:t.snapshotName,version:2}}async function writeTemplateMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readSessionMetadata(e){return readSessionMetadataRecord(await readJsonFile(e))}function readSessionMetadataRecord(e){return!isRecord(e)||e.version!==2||typeof e.optionsHash!=`string`||typeof e.sandboxName!=`string`||e.networkPolicy!==void 0&&!isSandboxNetworkPolicy(e.networkPolicy)?null:{image:typeof e.image==`string`?e.image:void 0,networkPolicy:e.networkPolicy,optionsHash:e.optionsHash,sandboxName:e.sandboxName,stateSnapshotName:typeof e.stateSnapshotName==`string`?e.stateSnapshotName:void 0,version:2}}async function writeSessionMetadata(e,t){await writeJsonFileAtomically(e,t)}async function readJsonFile(e){try{let t=JSON.parse(await readFile(e,`utf8`));return isRecord(t)?t:null}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return null;throw e}}async function writeJsonFileAtomically(e,t){let n=`${e}.${randomUUID()}.tmp`;await mkdir(dirname(e),{recursive:!0}),await writeFile(n,`${JSON.stringify(t,null,2)}\n`),await rename(n,e)}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{MICROSANDBOX_METADATA_FILE_NAME,MICROSANDBOX_METADATA_VERSION,createMicrosandboxSessionMetadata,readSessionMetadata,readSessionMetadataRecord,readTemplateMetadata,resolveMicrosandboxMetadataPath,writeSessionMetadata,writeTemplateMetadata};

package/dist/src/execution/sandbox/bindings/microsandbox-network.d.ts

@@ -1,18 +0,0 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-import type { NetworkPolicy as MicrosandboxNetworkPolicy, SandboxBuilder as MicrosandboxSandboxBuilder } from "microsandbox";
-interface MicrosandboxTransformHeaderRule {
-    readonly domain: string;
-    readonly headers: Readonly<Record<string, string>>;
-    readonly match?: unknown;
-    readonly placeholderHeaders: Readonly<Record<string, string>>;
-}
-interface MicrosandboxNetworkPlan {
-    readonly disabled: boolean;
-    readonly policy: MicrosandboxNetworkPolicy | null;
-    readonly transformHeaderRules: readonly MicrosandboxTransformHeaderRule[];
-}
-export declare function applyMicrosandboxNetwork(builder: MicrosandboxSandboxBuilder, networkPolicy: SandboxNetworkPolicy | undefined): MicrosandboxSandboxBuilder;
-export declare function serializeMicrosandboxNetworkPolicyJson(policy: MicrosandboxNetworkPolicy): string;
-export declare function createMicrosandboxNetworkPlan(policy: SandboxNetworkPolicy | undefined): MicrosandboxNetworkPlan;
-export declare function createTransformBrokerEnvironment(plan: MicrosandboxNetworkPlan): Readonly<Record<string, string>>;
-export {};

package/dist/src/execution/sandbox/bindings/microsandbox-network.js

@@ -1 +0,0 @@
-import{createHash}from"node:crypto";function applyMicrosandboxNetwork(e,t){let n=createMicrosandboxNetworkPlan(t);return n.disabled?e.disableNetwork():n.policy===null&&n.transformHeaderRules.length===0?e:e.network(e=>{let t=e.enabled(!0);if(n.policy!==null&&(t=t.policyJson(serializeMicrosandboxNetworkPolicyJson(n.policy))),n.transformHeaderRules.length===0)return t;t=t.trustHostCAs(!0);for(let e of n.transformHeaderRules)for(let[n,r]of Object.entries(e.headers)){let i=e.placeholderHeaders[n];if(i===void 0)continue;let a=createSecretEnvName(e.domain,n,r);t=t.secret(t=>{let n=t.env(a).value(r).placeholder(i).injectHeaders(!0).injectBasicAuth(!0).injectQuery(!1).injectBody(!1).requireTlsIdentity(!0);return n=e.domain===`*`?n.allowAnyHostDangerous(!0):e.domain.startsWith(`*.`)?n.allowHostPattern(e.domain):n.allowHost(e.domain),n})}return t})}function serializeMicrosandboxNetworkPolicyJson(e){let t={default_egress:e.defaultEgress,default_ingress:e.defaultIngress,rules:e.rules.map(e=>({action:e.action,destination:serializeMicrosandboxNetworkDestination(e.destination),direction:e.direction,ports:e.ports,protocols:e.protocols}))};return JSON.stringify(t)}function createMicrosandboxNetworkPlan(e){if(e===void 0||e===`allow-all`)return{disabled:!1,policy:{defaultEgress:`allow`,defaultIngress:`deny`,rules:[]},transformHeaderRules:[]};if(e===`deny-all`)return{disabled:!0,policy:null,transformHeaderRules:[]};let t=[],n=[],r=normalizeAllowEntries(e.allow),i=r.some(e=>e.domain===`*`),a=i?`allow`:`deny`;for(let n of e.subnets?.deny??[])t.push({action:`deny`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});for(let n of e.subnets?.allow??[])t.push({action:`allow`,destination:{cidr:n,kind:`cidr`},direction:`egress`,ports:[],protocols:[]});i||t.push({action:`allow`,destination:{kind:`any`},direction:`egress`,ports:[{start:53,end:53}],protocols:[`udp`,`tcp`]});for(let e of r)if(e.domain!==`*`){t.push({action:`allow`,destination:domainToDestination(e.domain),direction:`egress`,ports:[],protocols:[]});for(let t of e.rules)for(let r of normalizeTransforms(t.transform))Object.keys(r.headers).length!==0&&n.push({domain:e.domain,headers:r.headers,match:t.match,placeholderHeaders:createPlaceholderHeaders(e.domain,r.headers)})}return{disabled:!1,policy:{defaultEgress:a,defaultIngress:`deny`,rules:t},transformHeaderRules:n}}function createTransformBrokerEnvironment(e){if(e.transformHeaderRules.length===0)return{};let t=e.transformHeaderRules.flatMap(e=>Object.entries(e.placeholderHeaders).filter(([e])=>e.toLowerCase()===`authorization`).flatMap(([t,n])=>e.domain===`*`||e.domain.startsWith(`*.`)?[]:[{key:`http.https://${e.domain}/.extraheader`,value:`${t}: ${n}`}])),n={};return t.length>0&&(n.GIT_CONFIG_COUNT=String(t.length),t.forEach((e,t)=>{n[`GIT_CONFIG_KEY_${t}`]=e.key,n[`GIT_CONFIG_VALUE_${t}`]=e.value})),n}function normalizeAllowEntries(e){return e===void 0?[]:Array.isArray(e)?e.map(e=>({domain:e,rules:[]})):Object.entries(e).map(([e,t])=>({domain:e,rules:t}))}function normalizeTransforms(e){return e===void 0?[]:e.map(e=>({headers:e.headers??{}}))}function domainToDestination(e){return e.startsWith(`*.`)?{kind:`domainSuffix`,suffix:e.slice(2)}:{domain:e,kind:`domain`}}function serializeMicrosandboxNetworkDestination(e){switch(e.kind){case`any`:return`any`;case`cidr`:return{cidr:requireDestinationValue(e.cidr,`CIDR`)};case`domain`:return{domain:requireDestinationValue(e.domain,`domain`)};case`domainSuffix`:return{domain_suffix:requireDestinationValue(e.suffix,`domain suffix`)};case`group`:return{group:requireDestinationValue(e.group,`group`)};default:throw Error(`Unsupported microsandbox network destination kind.`)}}function requireDestinationValue(e,t){if(e===void 0||e.length===0)throw Error(`Microsandbox network destination is missing its ${t}.`);return e}function createPlaceholderHeaders(e,t){let n={};for(let[r,i]of Object.entries(t))n[r]=`__EVE_MSB_SECRET_${createStableHash(`${e}:${r}:${i}`).slice(0,24)}__`;return n}function createSecretEnvName(e,t,n){return`EVE_MSB_SECRET_${createStableHash(`${e}:${t}:${n}`).slice(0,24).toUpperCase()}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}export{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment,serializeMicrosandboxNetworkPolicyJson};

package/dist/src/execution/sandbox/bindings/microsandbox-options.d.ts

@@ -1,37 +0,0 @@
-import type { MicrosandboxSandboxCreateOptions } from "#public/sandbox/microsandbox-sandbox.js";
-export declare const MICROSANDBOX_DEFAULT_IMAGE: string;
-/** User every sandbox command runs as, mirroring hosted Vercel Sandbox. */
-export declare const MICROSANDBOX_USER = "vercel-sandbox";
-/**
- * Fully-defaulted microsandbox options consumed by the provider
- * implementation.
- */
-export interface ResolvedMicrosandboxOptions {
-    readonly cpus: number;
-    readonly env: Readonly<Record<string, string>>;
-    readonly image: string;
-    readonly memoryMiB: number;
-    readonly pullPolicy: "always" | "if-missing" | "never";
-    readonly setup: {
-        readonly autoInstall: boolean;
-        readonly skipVerify: boolean;
-    };
-}
-/**
- * Applies defaults to `microsandbox(opts)`.
- */
-export declare function resolveMicrosandboxOptions(options: MicrosandboxSandboxCreateOptions | undefined): ResolvedMicrosandboxOptions;
-/**
- * The subset of options that participates in template/session
- * compatibility hashing. Setup behavior intentionally stays out: how
- * the runtime got installed must not invalidate captured templates.
- */
-interface MicrosandboxTemplateOptions {
-    readonly cpus: number;
-    readonly env: Readonly<Record<string, string>>;
-    readonly image: string;
-    readonly memoryMiB: number;
-    readonly pullPolicy: ResolvedMicrosandboxOptions["pullPolicy"];
-}
-export declare function microsandboxOptionsForHash(options: ResolvedMicrosandboxOptions): MicrosandboxTemplateOptions;
-export {};

package/dist/src/execution/sandbox/bindings/microsandbox-options.js

@@ -1 +0,0 @@
-import{DEFAULT_EVE_SANDBOX_IMAGE}from"#execution/sandbox/bindings/eve-image.js";const MICROSANDBOX_DEFAULT_IMAGE=DEFAULT_EVE_SANDBOX_IMAGE,MICROSANDBOX_USER=`vercel-sandbox`;function resolveMicrosandboxOptions(e){return{cpus:e?.cpus??1,env:e?.env??{},image:e?.image??MICROSANDBOX_DEFAULT_IMAGE,memoryMiB:e?.memoryMiB??1024,pullPolicy:e?.pullPolicy??`if-missing`,setup:{autoInstall:e?.setup?.autoInstall??!0,skipVerify:e?.setup?.skipVerify??!1}}}function microsandboxOptionsForHash(e){return{cpus:e.cpus,env:e.env,image:e.image,memoryMiB:e.memoryMiB,pullPolicy:e.pullPolicy}}export{MICROSANDBOX_DEFAULT_IMAGE,MICROSANDBOX_USER,microsandboxOptionsForHash,resolveMicrosandboxOptions};

package/dist/src/execution/sandbox/bindings/microsandbox-platform.d.ts

@@ -1,21 +0,0 @@
-import type { Sandbox as MicrosandboxSandbox } from "microsandbox";
-/**
- * Synchronously reports whether this host can run microsandbox at all:
- * macOS on Apple Silicon, or Linux (glibc) with KVM available. Used by
- * `defaultSandbox()`'s availability chain.
- */
-export declare function isMicrosandboxPlatformSupported(): boolean;
-/**
- * Validates the host before loading the microsandbox package, turning
- * unsupported platforms into actionable errors instead of opaque
- * native-binding resolution failures.
- */
-export declare function assertMicrosandboxPlatformCandidate(): Promise<void>;
-/**
- * One-time setup applied to sandboxes created from the raw base image:
- * verifies Bash, creates the `vercel-sandbox` user, and hands it
- * `/workspace`.
- */
-export declare function ensureMicrosandboxBaseRuntime(sandbox: MicrosandboxSandbox, options?: {
-    readonly log?: (message: string) => void;
-}): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-platform.js

@@ -1,21 +0,0 @@
-import{access}from"node:fs/promises";import{existsSync}from"node:fs";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";function isMicrosandboxPlatformSupported(){return process.platform===`darwin`&&process.arch===`arm64`?!0:process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)&&isGlibcLinux()?process.env.MSB_PATH!==void 0||existsSync(`/dev/kvm`):!1}function isGlibcLinux(){try{return typeof(process.report?.getReport())?.header?.glibcVersionRuntime==`string`}catch{return!1}}async function assertMicrosandboxPlatformCandidate(){if(process.platform!==`darwin`||process.arch!==`arm64`){if(process.platform===`linux`&&(process.arch===`x64`||process.arch===`arm64`)){if(!isGlibcLinux())throw Error(`The microsandbox sandbox provider requires a glibc-based Linux distribution; musl hosts are not supported. Use DockerSandbox or VercelSandbox instead.`);if(process.env.MSB_PATH!==void 0||await doesPathExist(`/dev/kvm`))return;throw Error("The microsandbox sandbox provider requires Linux with KVM enabled. `/dev/kvm` is not available on this host. Enable KVM, set MSB_PATH for a custom runtime, or use DockerSandbox or VercelSandbox.")}throw Error(`The microsandbox sandbox provider supports Linux with KVM or macOS on Apple Silicon. Current host is ${process.platform}/${process.arch}. Use DockerSandbox or VercelSandbox on this host.`)}}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function ensureMicrosandboxBaseRuntime(e,t={}){let n=await collectMicrosandboxBaseRuntimeOutput(await e.execStreamWith(`bash`,e=>e.args([`-lc`,MICROSANDBOX_BASE_SETUP_SCRIPT]).cwd(`/`).user(`root`)),t.log);if(n.exitCode!==0)throw Error(`Failed to initialize the microsandbox base runtime. ${n.stderr||n.stdout}`.trim())}async function collectMicrosandboxBaseRuntimeOutput(e,t){let n=new TextDecoder,r=new TextDecoder,i=``,a=``,o=``,s=``,c;for await(let l of e)if(l.kind===`stdout`){let e=n.decode(l.data,{stream:!0});i=appendOutput(i,e),o=emitMicrosandboxBaseRuntimeLogs(o+e,t)}else if(l.kind===`stderr`){let e=r.decode(l.data,{stream:!0});a=appendOutput(a,e),s=emitMicrosandboxBaseRuntimeLogs(s+e,t)}else if(l.kind===`exited`){c=l.code;break}let l=n.decode(),u=r.decode();if(l.length>0&&(i=appendOutput(i,l),o=emitMicrosandboxBaseRuntimeLogs(o+l,t)),u.length>0&&(a=appendOutput(a,u),s=emitMicrosandboxBaseRuntimeLogs(s+u,t)),emitMicrosandboxBaseRuntimeLogLine(o,t),emitMicrosandboxBaseRuntimeLogLine(s,t),c===void 0)throw Error(`Microsandbox base runtime setup ended without an exit event.`);return{exitCode:c,stderr:a,stdout:i}}function emitMicrosandboxBaseRuntimeLogs(e,t){let n=e.split(/\r?\n/u),r=n.pop()??``;for(let e of n)emitMicrosandboxBaseRuntimeLogLine(e,t);return r}function emitMicrosandboxBaseRuntimeLogLine(e,t){let n=e.match(/^eve-base-runtime: ?(.*)$/u)?.[1];n!==void 0&&n.length>0&&t?.(n)}function appendOutput(e,t){let n=e+t;return n.length>2e4?n.slice(-2e4):n}const MICROSANDBOX_BASE_SETUP_SCRIPT=`
-set -euo pipefail
-
-log_step() {
-  printf 'eve-base-runtime: %s\\n' "$*" >&2
-}
-
-log_step "checking bash"
-command -v bash >/dev/null 2>&1
-
-log_step "checking sandbox user"
-if ! id -u ${MICROSANDBOX_USER} >/dev/null 2>&1; then
-  command -v useradd >/dev/null 2>&1
-  log_step "create sandbox user: ${MICROSANDBOX_USER}"
-  useradd -m -s /bin/bash ${MICROSANDBOX_USER}
-fi
-
-log_step "prepare workspace directory: ${WORKSPACE_ROOT}"
-mkdir -p ${WORKSPACE_ROOT}
-chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${WORKSPACE_ROOT}
-`;export{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime,isMicrosandboxPlatformSupported};

package/dist/src/execution/sandbox/bindings/microsandbox-process.d.ts

@@ -1,3 +0,0 @@
-import type { SandboxProcess } from "#shared/sandbox-session.js";
-import type { ExecHandle as MicrosandboxExecHandle } from "microsandbox";
-export declare function adaptMicrosandboxExecToSandboxProcess(command: MicrosandboxExecHandle): SandboxProcess;

package/dist/src/execution/sandbox/bindings/microsandbox-process.js

@@ -1 +0,0 @@
-function adaptMicrosandboxExecToSandboxProcess(e){let t,n,r,i,a,o=new Promise((e,t)=>{i=e,a=t}),s=new ReadableStream({start(e){t=e}}),c=new ReadableStream({start(e){n=e}});return(async()=>{let o=e[Symbol.asyncIterator]();try{for(;;){let e=r===void 0?await o.next():await nextWithTimeout(o,100);if(e===`timeout`||e.done===!0)break;let i=e.value;i.kind===`stdout`?t?.enqueue(i.data):i.kind===`stderr`?n?.enqueue(i.data):i.kind===`exited`&&(r=i.code)}}catch(e){t?.error(e),n?.error(e),a?.(e)}finally{if(o.return?.().catch(()=>{}),r===void 0){let e=Error(`Microsandbox command ended without an exit event.`);t?.error(e),n?.error(e),a?.(e)}else t?.close(),n?.close(),i?.()}})(),{stdout:s,stderr:c,async wait(){return await o,{exitCode:r??0}},async kill(){await e.kill()}}}async function nextWithTimeout(e,t){let n;try{return await Promise.race([e.next(),new Promise(e=>{n=setTimeout(()=>e(`timeout`),t)})])}finally{n!==void 0&&clearTimeout(n)}}export{adaptMicrosandboxExecToSandboxProcess};

package/dist/src/execution/sandbox/bindings/microsandbox-provider-state.d.ts

@@ -1,11 +0,0 @@
-import type { MicrosandboxModule } from "#execution/sandbox/bindings/microsandbox-runtime.js";
-/**
- * Classifies provider errors by message because the microsandbox SDK
- * exposes no structured error codes for these conditions.
- */
-export declare function isMicrosandboxNotFoundError(error: unknown): boolean;
-export declare function isMicrosandboxStillRunningError(error: unknown): boolean;
-export declare function isMicrosandboxSnapshotSourceRunningError(error: unknown): boolean;
-export declare function snapshotExists(module: MicrosandboxModule, snapshotName: string): Promise<boolean>;
-export declare function sandboxExists(module: MicrosandboxModule, sandboxName: string): Promise<boolean>;
-export declare function removeSnapshotIfExists(module: MicrosandboxModule, snapshotName: string): Promise<void>;

package/dist/src/execution/sandbox/bindings/microsandbox-provider-state.js

@@ -1 +0,0 @@
-function isMicrosandboxNotFoundError(e){return e instanceof Error&&/not found|not exist|no such/i.test(e.message)}function isMicrosandboxStillRunningError(e){return e instanceof Error&&/still running/i.test(e.message)}function isMicrosandboxSnapshotSourceRunningError(e){return e instanceof Error&&/snapshot source sandbox .*not stopped|SnapshotSandboxRunning/i.test(e.message)}async function snapshotExists(e,t){try{return await e.Snapshot.get(t),!0}catch{return!1}}async function sandboxExists(e,t){try{return await e.Sandbox.get(t),!0}catch(e){if(isMicrosandboxNotFoundError(e))return!1;throw e}}async function removeSnapshotIfExists(e,t){try{await e.Snapshot.remove(t,{force:!0})}catch(e){if(!isMicrosandboxNotFoundError(e))throw e}}export{isMicrosandboxNotFoundError,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,sandboxExists,snapshotExists};

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.d.ts

@@ -1,82 +0,0 @@
-import { type ResolvedMicrosandboxOptions } from "#execution/sandbox/bindings/microsandbox-options.js";
-import { type MicrosandboxSessionMetadata } from "#execution/sandbox/bindings/microsandbox-metadata.js";
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-import type { SandboxProviderHost } from "#shared/sandbox-provider.js";
-import type { SandboxProcess, SandboxRemovePathOptions, SandboxSpawnOptions } from "#shared/sandbox-session.js";
-import type { Sandbox as MicrosandboxSandbox } from "microsandbox";
-export { isMicrosandboxNotFoundError, removeSnapshotIfExists, sandboxExists, snapshotExists, } from "#execution/sandbox/bindings/microsandbox-provider-state.js";
-export type MicrosandboxModule = typeof import("microsandbox");
-export declare class MicrosandboxVm {
-    #private;
-    constructor(input: {
-        readonly module: MicrosandboxModule;
-        readonly options: ResolvedMicrosandboxOptions;
-        readonly sessionKey: string;
-        readonly tags?: Readonly<Record<string, string>>;
-    }, sandbox: MicrosandboxSandbox, sandboxName: string, networkPolicy: SandboxNetworkPolicy | undefined, metadataPath?: string, optionsHash?: string, stateSnapshotName?: string);
-    get id(): string;
-    get name(): string;
-    captureState(optionsHash: string): Promise<MicrosandboxSessionMetadata>;
-    detach(): Promise<void>;
-    /**
-     * Stops the VM and releases the SDK client for server shutdown. The
-     * stopped sandbox persists on disk, so a later `connect` restarts it
-     * (dev) or restores from the last captured snapshot (production).
-     */
-    shutdown(): Promise<void>;
-    stop(): Promise<void>;
-    readFileBytes(path: string): Promise<Buffer | null>;
-    removePath(options: SandboxRemovePathOptions): Promise<void>;
-    removePersisted(): Promise<void>;
-    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
-    spawn(options: SandboxSpawnOptions): Promise<SandboxProcess>;
-    stopAndSnapshot(snapshotName: string): Promise<void>;
-    writeFiles(files: ReadonlyArray<{
-        path: string;
-        content: string | Uint8Array;
-    }>): Promise<void>;
-    writeMetadata(path: string, optionsHash: string): Promise<void>;
-    private runInternalCommand;
-}
-export declare function createPreparedMicrosandbox(input: {
-    readonly fromSnapshot?: string;
-    readonly log?: (message: string) => void;
-    readonly module: MicrosandboxModule;
-    readonly name: string;
-    readonly networkPolicy?: SandboxNetworkPolicy;
-    readonly options: ResolvedMicrosandboxOptions;
-    readonly resourcesPath?: string;
-    readonly sessionKey: string;
-    readonly setupBaseRuntime: boolean;
-    readonly tags?: Readonly<Record<string, string>>;
-}): Promise<MicrosandboxVm>;
-export declare function connectMicrosandbox(input: {
-    readonly metadata: MicrosandboxSessionMetadata;
-    readonly metadataPath: string;
-    readonly module: MicrosandboxModule;
-    readonly options: ResolvedMicrosandboxOptions;
-    readonly sessionKey: string;
-    readonly tags?: Readonly<Record<string, string>>;
-}): Promise<MicrosandboxVm | null>;
-/**
- * Loads the microsandbox npm package and ensures its VM runtime is
- * installed. During `eve dev`, both are installed automatically when
- * missing (unless `setup.autoInstall: false`): the package with the
- * project's package manager, the runtime via microsandbox's installer.
- * Production processes never install — they fail with actionable
- * errors instead.
- */
-export declare function loadMicrosandboxModule(input: {
-    readonly host: SandboxProviderHost;
-    readonly log?: (message: string) => void;
-    readonly options: ResolvedMicrosandboxOptions;
-}): Promise<MicrosandboxModule>;
-/**
- * Loads microsandbox only when its package and runtime are already
- * present — used by cleanup paths that must never trigger installs.
- */
-export declare function loadMicrosandboxWithoutInstall(appRoot: string): Promise<MicrosandboxModule | null>;
-export declare function stopAndSnapshotMicrosandboxSandbox(module: MicrosandboxModule, sandboxName: string, snapshotName: string): Promise<void>;
-export declare function createProviderName(prefix: string, key: string, extra?: string): string;
-export declare function createStableHash(value: string): string;
-export declare function doesPathExist(path: string): Promise<boolean>;

package/dist/src/execution/sandbox/bindings/microsandbox-runtime.js

@@ -1 +0,0 @@
-import{createHash,randomUUID}from"node:crypto";import{access}from"node:fs/promises";import{posix}from"node:path";import{withDevelopmentSandboxTags}from"#execution/sandbox/development-run.js";import{importInstalledEnginePackage,isEveDevEnvironment}from"#internal/application/optional-package-install.js";import{shellQuote}from"#execution/sandbox/shell-quote.js";import{WORKSPACE_ROOT}from"#runtime/workspace/types.js";import{SANDBOX_AGENT_ENV}from"#execution/sandbox/session.js";import{assertMicrosandboxPlatformCandidate,ensureMicrosandboxBaseRuntime}from"#execution/sandbox/bindings/microsandbox-platform.js";import{MICROSANDBOX_METADATA_VERSION,createMicrosandboxSessionMetadata,writeSessionMetadata}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{MICROSANDBOX_USER}from"#execution/sandbox/bindings/microsandbox-options.js";import{createMicrosandboxWithProgress}from"#execution/sandbox/bindings/microsandbox-create.js";import{applyMicrosandboxNetwork,createMicrosandboxNetworkPlan,createTransformBrokerEnvironment}from"#execution/sandbox/bindings/microsandbox-network.js";import{adaptMicrosandboxExecToSandboxProcess}from"#execution/sandbox/bindings/microsandbox-process.js";import{readInstalledPackageVersion}from"#internal/application/optional-package-import.js";import{isMicrosandboxNotFoundError,isMicrosandboxNotFoundError as isMicrosandboxNotFoundError$1,isMicrosandboxSnapshotSourceRunningError,isMicrosandboxStillRunningError,removeSnapshotIfExists,removeSnapshotIfExists as removeSnapshotIfExists$1,sandboxExists,snapshotExists,snapshotExists as snapshotExists$1}from"#execution/sandbox/bindings/microsandbox-provider-state.js";const MICROSANDBOX_PACKAGE_NAME=`microsandbox`,MICROSANDBOX_INSTALL_SPECIFIER=`${MICROSANDBOX_PACKAGE_NAME}@0.5.5`,MICROSANDBOX_STOP_TIMEOUT_MS=1e4,MICROSANDBOX_HOME=`/home/${MICROSANDBOX_USER}`;var MicrosandboxVm=class{#e;#t;#n;#r;#i;#a;#o;constructor(e,t,n,r,i,a,o){this.#e=e,this.#i=t,this.#a=n,this.#n=r,this.#t=i,this.#r=a,this.#o=o}get id(){return this.#e.sessionKey}get name(){return this.#a}async captureState(e){if(this.#r=e,isEveDevEnvironment())return this.#t!==void 0&&await this.writeMetadata(this.#t,e),createMicrosandboxSessionMetadata({networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:this.#o});let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`);return await this.stopAndSnapshot(n),this.#o=n,this.#t!==void 0&&await this.writeMetadata(this.#t,e),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t),createMicrosandboxSessionMetadata({networkPolicy:this.#n,optionsHash:e,sandboxName:this.#a,stateSnapshotName:n})}async detach(){await this.#i.detach().catch(()=>{})}async shutdown(){await this.#i.stop().catch(()=>{}),await this.detach()}async stop(){await this.#i.stop(),await this.detach()}async readFileBytes(e){try{let t=this.#i.fs();return await t.exists(e)?Buffer.from(await t.read(e)):null}catch{return null}}async removePath(e){let t=`${e.force===!0?`f`:``}${e.recursive===!0?`r`:``}`,n=`${t.length>0?`rm -${t}`:`rm`} -- ${shellQuote(e.path)}`;await this.runInternalCommand({abortSignal:e.abortSignal,command:n,user:MICROSANDBOX_USER})}async removePersisted(){await removeSandboxIfExists(this.#e.module,this.#a);let e=this.#o;e!==void 0&&(await removeSnapshotIfExists$1(this.#e.module,e),this.#o=void 0)}async setNetworkPolicy(e){let t=this.#o,n=createProviderName(`eve-sbx-state`,`${this.#e.sessionKey}:${randomUUID()}`),r=this.#a;await this.stopAndSnapshot(n),await removeSandboxIfExists(this.#e.module,r);let i=createProviderName(`eve-sbx-ses`,`${this.#e.sessionKey}:${randomUUID()}`);this.#i=await createMicrosandbox({fromSnapshot:n,module:this.#e.module,name:i,networkPolicy:e,options:this.#e.options,tags:this.#e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT}),this.#a=i,this.#n=e,this.#o=void 0,this.#t!==void 0&&this.#r!==void 0&&await this.writeMetadata(this.#t,this.#r),await removeSnapshotIfExists$1(this.#e.module,n),t!==void 0&&await removeSnapshotIfExists$1(this.#e.module,t)}async spawn(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t={...SANDBOX_AGENT_ENV,...this.#e.options.env,HOME:MICROSANDBOX_HOME,...createTransformBrokerEnvironment(createMicrosandboxNetworkPlan(this.#n)),...e.env},n=await this.#i.execStreamWith(`bash`,n=>n.args([`-lc`,e.command]).cwd(e.workingDirectory??WORKSPACE_ROOT).envs(t).user(MICROSANDBOX_USER));return e.abortSignal!==void 0&&e.abortSignal.addEventListener(`abort`,()=>{n.kill().catch(()=>{})},{once:!0}),adaptMicrosandboxExecToSandboxProcess(n)}async stopAndSnapshot(e){await this.#i.stop().catch(()=>{}),await stopAndSnapshotMicrosandboxSandbox(this.#e.module,this.#a,e)}async writeFiles(e){let t=this.#i.fs();for(let n of e){let e=posix.dirname(n.path);await this.runInternalCommand({command:`mkdir -p ${shellQuote(e)}`,user:MICROSANDBOX_USER}),await t.write(n.path,n.content),await this.runInternalCommand({command:`chown ${MICROSANDBOX_USER}:${MICROSANDBOX_USER} ${shellQuote(n.path)}`,user:`root`})}}async writeMetadata(e,t){this.#t=e,this.#r=t,await writeSessionMetadata(e,{image:this.#e.options.image,networkPolicy:this.#n,optionsHash:t,sandboxName:this.#a,stateSnapshotName:this.#o,version:MICROSANDBOX_METADATA_VERSION})}async runInternalCommand(e){if(e.abortSignal?.aborted)throw new DOMException(`The operation was aborted.`,`AbortError`);let t=await this.#i.execWith(`bash`,t=>t.args([`-lc`,e.command]).cwd(WORKSPACE_ROOT).user(e.user));if(t.code!==0){let n=e.failureMessage??`Microsandbox command failed.`;throw Error(`${n} ${t.stderr()}`.trim())}}};async function createPreparedMicrosandbox(e){let t=e.setupBaseRuntime?`allow-all`:e.networkPolicy,n=await createMicrosandbox({fromSnapshot:e.fromSnapshot,log:e.log,module:e.module,name:e.name,networkPolicy:t,options:e.options,resourcesPath:e.resourcesPath,tags:e.tags,user:e.setupBaseRuntime?void 0:MICROSANDBOX_USER,workdir:e.setupBaseRuntime?`/`:WORKSPACE_ROOT}),r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.name,t);return e.setupBaseRuntime&&(await withProgressHeartbeat(`preparing base runtime inside VM`,e.log,async()=>{await ensureMicrosandboxBaseRuntime(n,{log:e.log})}),e.networkPolicy!==void 0&&e.networkPolicy!==`allow-all`&&(e.log?.(`applying network policy`),await r.setNetworkPolicy(e.networkPolicy))),r}async function connectMicrosandbox(e){let t;try{t=await e.module.Sandbox.get(e.metadata.sandboxName)}catch(t){if(!isMicrosandboxNotFoundError$1(t))throw t;return e.metadata.stateSnapshotName===void 0?null:await restoreMicrosandboxSessionSnapshot(e)}if(t.status!==`running`&&t.status!==`draining`&&e.metadata.stateSnapshotName!==void 0)return await restoreMicrosandboxSessionSnapshot(e);let n=t.status===`running`||t.status===`draining`?await t.connectWithTimeout(1e4):await t.startDetached();return new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,e.metadata.sandboxName,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName)}async function restoreMicrosandboxSessionSnapshot(e){if(e.metadata.stateSnapshotName===void 0||!await snapshotExists$1(e.module,e.metadata.stateSnapshotName))return null;let t=createProviderName(`eve-sbx-ses`,`${e.sessionKey}:${randomUUID()}`),n=await createMicrosandbox({fromSnapshot:e.metadata.stateSnapshotName,module:e.module,name:t,networkPolicy:e.metadata.networkPolicy,options:e.options,tags:e.tags,user:MICROSANDBOX_USER,workdir:WORKSPACE_ROOT});await removeSandboxIfExists(e.module,e.metadata.sandboxName);let r=new MicrosandboxVm({module:e.module,options:e.options,sessionKey:e.sessionKey,tags:e.tags},n,t,e.metadata.networkPolicy,e.metadataPath,e.metadata.optionsHash,e.metadata.stateSnapshotName);return await r.writeMetadata(e.metadataPath,e.metadata.optionsHash),r}const MICROSANDBOX_MISSING_PACKAGE_MESSAGE=`The microsandbox sandbox provider requires the \`microsandbox\` package, which is not bundled with eve. Install it in your application (for example \`pnpm add -D ${MICROSANDBOX_INSTALL_SPECIFIER}\`), or use DockerSandbox or VercelSandbox instead.`;async function loadMicrosandboxModule(e){e.log?.(`checking microsandbox platform support`),await assertMicrosandboxPlatformCandidate();let t=await withProgressHeartbeat(`loading microsandbox npm package`,e.log,()=>e.host.loadOptionalPackage({autoInstall:e.options.setup.autoInstall,importModule:async()=>await import(`microsandbox`),installPackageName:MICROSANDBOX_INSTALL_SPECIFIER,missingMessage:MICROSANDBOX_MISSING_PACKAGE_MESSAGE,packageName:MICROSANDBOX_PACKAGE_NAME}));if(await assertSupportedMicrosandboxApi(t,e.host),e.log?.(`checking microsandbox VM runtime`),!t.isInstalled()){if(!e.options.setup.autoInstall||!isEveDevEnvironment())throw Error("The microsandbox VM runtime is not installed. Run `npx microsandbox install`, set MSB_PATH for a custom install, or let `eve dev` install it automatically with microsandbox({ setup: { autoInstall: true } }).");await withProgressHeartbeat(`installing microsandbox VM runtime`,e.log,async()=>{await t.setup().skipVerify(e.options.setup.skipVerify).install()})}return e.log?.(`microsandbox runtime ready`),t}async function assertSupportedMicrosandboxApi(e,t){let n=e;if(typeof n.isInstalled==`function`&&typeof n.setup==`function`)return;let r=await readInstalledPackageVersion({appRoot:t.resolveProjectPath(`.`),packageName:MICROSANDBOX_PACKAGE_NAME}).catch(()=>void 0),i=r===void 0?"The installed `microsandbox`":`\`microsandbox@${r}\``;throw Error(`${i} is not supported by eve. Install the supported version with \`pnpm add -D ${MICROSANDBOX_INSTALL_SPECIFIER}\`, or use DockerSandbox or VercelSandbox instead.`)}async function withProgressHeartbeat(e,t,n){if(t?.(e),t===void 0)return await n();let r=Date.now(),i=setInterval(()=>{t(`${e} (${Math.round((Date.now()-r)/1e3)}s elapsed)`)},1e4);i.unref?.();try{return await n()}finally{clearInterval(i)}}async function loadMicrosandboxWithoutInstall(e){try{let t=await importInstalledEnginePackage({appRoot:e,packageName:MICROSANDBOX_PACKAGE_NAME});return t.isInstalled()?t:null}catch{return null}}async function stopAndSnapshotMicrosandboxSandbox(e,t,n){for(let r=0;r<3;r+=1){let i=await e.Sandbox.get(t);await i.stopWithTimeout(r===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{});try{await i.snapshot(n);return}catch(e){if(!isMicrosandboxSnapshotSourceRunningError(e)||r===2)throw e;await i.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250))}}}function createProviderName(e,t,n=``){return`${e}-${createStableHash(`${t}:${n}`).slice(0,32)}`}function createStableHash(e){return createHash(`sha256`).update(e).digest(`hex`)}async function doesPathExist(e){try{return await access(e),!0}catch{return!1}}async function createMicrosandbox(e){let t=e.module.Sandbox.builder(e.name).cpus(e.options.cpus).detached(!0).envs({...e.options.env,HOME:MICROSANDBOX_HOME}).labels(resolveMicrosandboxLabels(e.tags)).memory(e.options.memoryMiB).pullPolicy(e.options.pullPolicy).replace().workdir(e.workdir);t=e.fromSnapshot===void 0?t.image(e.options.image):t.fromSnapshot(e.fromSnapshot),e.options.image.startsWith(`127.0.0.1:`)&&(t=t.registry(e=>e.insecure())),e.resourcesPath!==void 0&&(t=t.volume(`/eve/resources`,t=>t.bind(e.resourcesPath).readonly())),e.user!==void 0&&(t=t.user(e.user));let n=e.fromSnapshot===void 0?`image "${e.options.image}"`:`snapshot "${e.fromSnapshot}"`;return await createMicrosandboxWithProgress({builder:applyMicrosandboxNetwork(t,e.networkPolicy),errorType:e.module.MicrosandboxError,log:e.log,source:n})}async function removeSandboxIfExists(e,t){for(let n=0;n<3;n+=1)try{let r=await e.Sandbox.get(t);await r.stopWithTimeout(n===0?MICROSANDBOX_STOP_TIMEOUT_MS:0).catch(()=>{}),await r.remove();return}catch(r){if(isMicrosandboxNotFoundError$1(r))return;if(isMicrosandboxStillRunningError(r)&&n<2){await(await e.Sandbox.get(t).catch(()=>null))?.kill().catch(()=>{}),await new Promise(e=>setTimeout(e,250));continue}throw r}}function resolveMicrosandboxLabels(e){return{"eve.provider":`microsandbox`,...withDevelopmentSandboxTags(e)}}export{MicrosandboxVm,connectMicrosandbox,createPreparedMicrosandbox,createProviderName,createStableHash,doesPathExist,isMicrosandboxNotFoundError,loadMicrosandboxModule,loadMicrosandboxWithoutInstall,removeSnapshotIfExists,sandboxExists,snapshotExists,stopAndSnapshotMicrosandboxSandbox};

package/dist/src/execution/sandbox/bindings/microsandbox-templates.d.ts

@@ -1,12 +0,0 @@
-/**
- * Removes stale microsandbox template metadata directories (and their
- * captured snapshots) for one application.
- */
-export declare function pruneMicrosandboxTemplates(input: {
-    readonly appRoot: string;
-    readonly now?: number;
-    readonly recentWindowMs?: number;
-    readonly retainCount?: number;
-}): Promise<void>;
-export declare function resolveMicrosandboxTemplateRootPath(cacheDirectory: string, templateKey: string): string;
-export declare function resolveMicrosandboxSessionRootPath(cacheDirectory: string, sessionKey: string): string;

package/dist/src/execution/sandbox/bindings/microsandbox-templates.js

@@ -1 +0,0 @@
-import{readdir,rm,stat}from"node:fs/promises";import"node:fs";import{join}from"node:path";import{resolveSandboxCacheDirectory}from"#internal/application/paths.js";import{resolveLocalProviderSessionRootPath,resolveLocalProviderTemplateRootPath,resolveLocalProviderTemplatesDirectory}from"#execution/sandbox/bindings/local-provider-utils.js";import{LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT}from"#execution/sandbox/bindings/local-template-prune.js";import{readTemplateMetadata,resolveMicrosandboxMetadataPath}from"#execution/sandbox/bindings/microsandbox-metadata.js";import{loadMicrosandboxWithoutInstall,removeSnapshotIfExists}from"#execution/sandbox/bindings/microsandbox-runtime.js";const MICROSANDBOX_CACHE_DIRECTORY_NAME=`microsandbox`;async function pruneMicrosandboxTemplates(e){let t=resolveMicrosandboxTemplatesDirectory(resolveSandboxCacheDirectory(e.appRoot)),n=e.now??Date.now(),r=e.recentWindowMs??LOCAL_SANDBOX_TEMPLATE_RECENT_WINDOW_MS,i=e.retainCount??LOCAL_SANDBOX_TEMPLATE_RETAIN_COUNT,a=await readMicrosandboxTemplateDirectories(t),o=a.filter(e=>!e.isTemporary);await Promise.all([...o.map(async(t,a)=>{a<i||n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)}),...a.filter(e=>e.isTemporary).map(async t=>{n-t.mtimeMs<=r||await removeTemplateDirectory(e.appRoot,t.path,t.metadata)})])}function resolveMicrosandboxTemplateRootPath(e,t){return resolveLocalProviderTemplateRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}function resolveMicrosandboxTemplatesDirectory(e){return resolveLocalProviderTemplatesDirectory(e,MICROSANDBOX_CACHE_DIRECTORY_NAME)}function resolveMicrosandboxSessionRootPath(e,t){return resolveLocalProviderSessionRootPath(e,MICROSANDBOX_CACHE_DIRECTORY_NAME,t)}async function readMicrosandboxTemplateDirectories(e){let t;try{t=await readdir(e,{withFileTypes:!0})}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return[];throw e}return(await Promise.all(t.filter(e=>e.isDirectory()).map(async t=>{let n=join(e,t.name);return{isTemporary:t.name.endsWith(`.tmp`),metadata:await readTemplateMetadata(resolveMicrosandboxMetadataPath(n)),mtimeMs:(await stat(n)).mtimeMs,path:n}}))).sort((e,t)=>t.mtimeMs-e.mtimeMs)}async function removeTemplateDirectory(e,t,n){if(await rm(t,{force:!0,recursive:!0}),n===null)return;let r=await loadMicrosandboxWithoutInstall(e);r!==null&&await removeSnapshotIfExists(r,n.snapshotName)}export{pruneMicrosandboxTemplates,resolveMicrosandboxSessionRootPath,resolveMicrosandboxTemplateRootPath};

package/dist/src/execution/sandbox/bindings/microsandbox.d.ts

@@ -1,16 +0,0 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
-type NetworkPolicySandboxSession = SandboxSession & {
-    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
-};
-import { type MicrosandboxPreparedArtifact } from "#execution/sandbox/bindings/microsandbox-lifecycle.js";
-import type { MicrosandboxSandboxCreateOptions, MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
-import { type SandboxProviderImplementation } from "#shared/sandbox-provider.js";
-export { pruneMicrosandboxTemplates } from "#execution/sandbox/bindings/microsandbox-templates.js";
-export declare const MICROSANDBOX_PROVIDER_NAME = "microsandbox";
-export type MicrosandboxProviderSessionState = {
-    readonly optionsHash: string;
-    readonly sessionIdentity: string;
-    readonly version: 3;
-};
-export declare function createMicrosandboxSandboxProvider(authoredOptions?: MicrosandboxSandboxCreateOptions | undefined): SandboxProviderImplementation<MicrosandboxSandboxRuntimeOptions, MicrosandboxPreparedArtifact, MicrosandboxProviderSessionState, NetworkPolicySandboxSession>;

package/dist/src/execution/sandbox/bindings/microsandbox.js

@@ -1 +0,0 @@
-import{materializeSandboxDockerfile}from"#execution/sandbox/dockerfile.js";import{createSandboxProviderIdentity}from"#execution/sandbox/provider-identity.js";import{isSandboxPreparedArtifactRecord,sandboxProviderResourceIdentity}from"#shared/sandbox-provider.js";import{createStableHash}from"#execution/sandbox/bindings/microsandbox-runtime.js";import{pruneMicrosandboxTemplates}from"#execution/sandbox/bindings/microsandbox-templates.js";import{microsandboxOptionsForHash,resolveMicrosandboxOptions}from"#execution/sandbox/bindings/microsandbox-options.js";import{enrichMicrosandboxError}from"#execution/sandbox/bindings/microsandbox-create.js";import{createMicrosandboxHandle,prewarmMicrosandboxTemplate}from"#execution/sandbox/bindings/microsandbox-lifecycle.js";const MICROSANDBOX_PROVIDER_NAME=`microsandbox`;function createMicrosandboxSandboxProvider(e=void 0){let t=e??{},n=resolveMicrosandboxOptions(t),r=createStableHash(JSON.stringify(microsandboxOptionsForHash(n))).slice(0,20);return{async prepare(e){let i=await materializeSandboxDockerfile({files:e.files,storagePath:e.storagePath}),a=createSandboxProviderIdentity({dockerfile:i?.contentHash,optionsHash:r,resources:sandboxProviderResourceIdentity(e.resources),sourceRevision:e.sourceRevision,version:2}).slice(0,24);try{return await prewarmMicrosandboxTemplate({context:e,dockerfile:i,options:n,optionsHash:r,prepare:t.prepare,providerName:MICROSANDBOX_PROVIDER_NAME,templateKey:a})}catch(e){throw enrichMicrosandboxError({context:`Failed to prepare microsandbox`,error:e})}},async resume(e,t,i){let a=requireArtifact(t),o=requireState(i);if(o.optionsHash!==r||a.optionsHash!==r||o.sessionIdentity!==microsandboxSessionIdentity(e.session.id,a,r))throw Error(`microsandbox session state is incompatible with this environment.`);return(await createMicrosandboxHandle({artifact:a,context:e,createIfMissing:!1,sessionIdentity:o.sessionIdentity,options:n,optionsHash:r,providerName:MICROSANDBOX_PROVIDER_NAME})).handle},async start(e,t,i){let a=requireArtifact(i);return await createMicrosandboxHandle({artifact:a,context:e,options:n,optionsHash:r,providerName:MICROSANDBOX_PROVIDER_NAME,runtimeOptions:t})}}}function microsandboxSessionIdentity(e,t,n){return createStableHash(`${e}:${t.snapshotName}:${n}`).slice(0,32)}function requireArtifact(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==2||typeof e.optionsHash!=`string`||typeof e.snapshotName!=`string`)throw Error(`Invalid prepared microsandbox artifact.`);return{image:typeof e.image==`string`?e.image:null,optionsHash:e.optionsHash,snapshotName:e.snapshotName,version:2}}function requireState(e){if(!isSandboxPreparedArtifactRecord(e)||e.version!==3||typeof e.optionsHash!=`string`||typeof e.sessionIdentity!=`string`)throw Error(`Invalid microsandbox session state.`);return{optionsHash:e.optionsHash,sessionIdentity:e.sessionIdentity,version:3}}export{MICROSANDBOX_PROVIDER_NAME,createMicrosandboxSandboxProvider,pruneMicrosandboxTemplates};

package/dist/src/execution/sandbox/provider-host-development.d.ts

@@ -1,2 +0,0 @@
-import type { SandboxProviderHost } from "#shared/sandbox-provider.js";
-export declare function createDevelopmentSandboxProviderHost(appRoot: string): SandboxProviderHost;

package/dist/src/execution/sandbox/provider-host-development.js

@@ -1 +0,0 @@
-import{resolve}from"node:path";import{loadOptionalEnginePackage}from"#internal/application/optional-package-install.js";function createDevelopmentSandboxProviderHost(e){return{async loadOptionalPackage(t){return await loadOptionalEnginePackage({appRoot:e,...t})},resolveProjectPath(t){return resolve(e,t)}}}export{createDevelopmentSandboxProviderHost};

package/dist/src/execution/sandbox/provider-host.d.ts

@@ -1,2 +0,0 @@
-import type { SandboxProviderHost } from "#shared/sandbox-provider.js";
-export declare function createSandboxProviderHost(appRoot: string): SandboxProviderHost;

package/dist/src/execution/sandbox/provider-host.js

@@ -1 +0,0 @@
-import{resolve}from"node:path";import{importInstalledEnginePackage}from"#internal/application/optional-package-import.js";function createSandboxProviderHost(e){return{async loadOptionalPackage(t){try{return await t.importModule()}catch(n){try{return await importInstalledEnginePackage({appRoot:e,packageName:t.packageName})}catch(e){throw Error(t.missingMessage,{cause:AggregateError([n,e])})}}},resolveProjectPath(t){return resolve(e,t)}}}export{createSandboxProviderHost};

package/dist/src/execution/tool-session/sandbox.d.ts

@@ -1,22 +0,0 @@
-import type { RuntimeSandboxRegistry } from "#runtime/sandbox/registry.js";
-import type { SandboxProviderHandle } from "#shared/sandbox-provider.js";
-/** What a binding that keeps tool-session sandboxes tells the calls that use them. */
-export interface ToolSessionSandboxSupport {
-    /**
-     * Frees what a call's handle holds in this process once the call ends,
-     * leaving the session's sandbox for later and overlapping calls. Absent
-     * when a handle holds nothing of its own, such as a client to a remote
-     * sandbox.
-     */
-    releaseHandle?(handle: SandboxProviderHandle): Promise<void>;
-}
-/** Marks a binding whose `start` reopens a session's sandbox by session id. */
-export declare function withToolSessionSandboxes<Implementation extends object>(implementation: Implementation, support?: ToolSessionSandboxSupport): Implementation;
-/** Raised when a keyed tool session opens a sandbox on a provider that cannot keep it. */
-export declare class ToolSessionSandboxUnsupportedError extends Error {
-    constructor(providerName: string);
-}
-/** Throws unless the registry's sandbox provider can keep tool-session sandboxes. */
-export declare function assertToolSessionSandboxSupport(registry: RuntimeSandboxRegistry): void;
-/** Frees what a keyed call's handle holds in this process; the sandbox itself stays. */
-export declare function releaseToolSessionHandle(registry: RuntimeSandboxRegistry, handle: SandboxProviderHandle): Promise<void>;

package/dist/src/execution/tool-session/sandbox.js

@@ -1 +0,0 @@
-import{getSandboxEnvironmentRuntime}from"#shared/sandbox-environment.js";const supported=new WeakMap;function withToolSessionSandboxes(e,t={}){return supported.set(e,t),e}var ToolSessionSandboxUnsupportedError=class extends Error{constructor(e){super(`Sandbox provider "${e}" cannot keep a sandbox between invokeTool calls, so a call with a key cannot open one. Call without a key for a sandbox that lasts one call, or use Vercel Sandbox or just-bash.`),this.name=`ToolSessionSandboxUnsupportedError`}};function assertToolSessionSandboxSupport(e){let t=registeredProvider(e);if(t!==void 0&&!supported.has(t.implementation))throw new ToolSessionSandboxUnsupportedError(t.providerName)}async function releaseToolSessionHandle(e,t){let n=registeredProvider(e);n!==void 0&&await supported.get(n.implementation)?.releaseHandle?.(t)}function registeredProvider(e){let t=e.sandbox,n=t?.inheritance?.definition??t?.definition;if(n?.kind===`independent`)return getSandboxEnvironmentRuntime(n.environment)}export{ToolSessionSandboxUnsupportedError,assertToolSessionSandboxSupport,releaseToolSessionHandle,withToolSessionSandboxes};

package/dist/src/public/sandbox/microsandbox-sandbox.d.ts

@@ -1,48 +0,0 @@
-import type { SandboxSession } from "#shared/sandbox-session.js";
-import type { SandboxNetworkOptions, SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-/**
- * Options accepted by microsandbox environment constructors.
- *
- * The microsandbox provider runs sandboxes in lightweight local VMs via
- * [microsandbox](https://www.npmjs.com/package/microsandbox). Options
- * are eve-owned rather than a raw passthrough so the public surface can
- * stay stable while the underlying runtime evolves. Supported hosts:
- * macOS on Apple Silicon, or Linux (glibc) with KVM enabled.
- */
-export interface MicrosandboxSandboxCreateOptions {
-    /**
-     * OCI image used as the base runtime. eve prepares this image with
-     * Bash, the framework workspace, and the sandbox user before authored
-     * environment preparation runs. Install authored runtime tools such as Node,
-     * Python, or ripgrep during preparation or provide them through a
-     * custom image.
-     *
-     * @default The `ghcr.io/vercel/eve` tag matching the installed eve version without build metadata, or `EVE_SANDBOX_IMAGE_TAG` when set.
-     */
-    readonly image?: string;
-    /** Number of virtual CPUs assigned to each sandbox. @default 1 */
-    readonly cpus?: number;
-    /** Memory assigned to each sandbox in MiB. @default 1024 */
-    readonly memoryMiB?: number;
-    /** Environment variables applied to every sandbox command. */
-    readonly env?: Readonly<Record<string, string>>;
-    /** OCI image pull policy. @default "if-missing" */
-    readonly pullPolicy?: "always" | "if-missing" | "never";
-    /** Idempotent setup captured in the prepared VM snapshot. */
-    readonly prepare?: (sandbox: SandboxSession) => Promise<void> | void;
-    /**
-     * Installation behavior for the microsandbox npm package and its VM
-     * runtime. By default eve installs both automatically when missing —
-     * the npm package with the project's package manager (during
-     * `eve dev` only), the runtime via microsandbox's own installer.
-     */
-    readonly setup?: {
-        readonly autoInstall?: boolean;
-        readonly skipVerify?: boolean;
-    };
-}
-/** Options applied when eve creates one live microsandbox VM. */
-export interface MicrosandboxSandboxRuntimeOptions extends SandboxNetworkOptions {
-    /** Initial network policy for this VM. @default "allow-all" */
-    readonly networkPolicy?: SandboxNetworkPolicy;
-}

package/dist/src/public/sandbox/microsandbox-sandbox.js

@@ -1 +0,0 @@
-export{};

package/dist/src/public/sandbox/microsandbox.d.ts

@@ -1,9 +0,0 @@
-import type { SandboxNetworkPolicy } from "#shared/sandbox-network-policy.js";
-import type { SandboxSession } from "#shared/sandbox-session.js";
-/** Live sandbox capabilities exposed by a microsandbox environment. */
-export interface MicrosandboxSandboxSession extends SandboxSession {
-    /** Applies a firewall policy to the live microsandbox VM. */
-    setNetworkPolicy(policy: SandboxNetworkPolicy): Promise<void>;
-}
-export { MicrosandboxSandbox, type MicrosandboxEnvironmentOptions, } from "#sandbox/providers/microsandbox.js";
-export type { MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";

package/dist/src/public/sandbox/microsandbox.js

@@ -1 +0,0 @@
-import{MicrosandboxSandbox}from"#sandbox/providers/microsandbox.js";export{MicrosandboxSandbox};

package/dist/src/sandbox/providers/microsandbox.d.ts

@@ -1,12 +0,0 @@
-import type { MicrosandboxSandboxSession } from "#public/sandbox/microsandbox.js";
-import type { MicrosandboxSandboxCreateOptions, MicrosandboxSandboxRuntimeOptions } from "#public/sandbox/microsandbox-sandbox.js";
-import type { SandboxEnvironment } from "#shared/sandbox-environment.js";
-export type MicrosandboxEnvironmentOptions = MicrosandboxSandboxCreateOptions;
-type DockerfileEnvironmentInput = Omit<MicrosandboxEnvironmentOptions, "image">;
-export declare const MicrosandboxSandbox: {
-    name: string;
-    environment(options?: Readonly<MicrosandboxSandboxCreateOptions> | undefined): SandboxEnvironment<MicrosandboxSandboxRuntimeOptions, MicrosandboxSandboxSession>;
-    dockerfile(options?: DockerfileEnvironmentInput): SandboxEnvironment<MicrosandboxSandboxRuntimeOptions, MicrosandboxSandboxSession>;
-    image(reference: string, options?: DockerfileEnvironmentInput): SandboxEnvironment<MicrosandboxSandboxRuntimeOptions, MicrosandboxSandboxSession>;
-};
-export {};

package/dist/src/sandbox/providers/microsandbox.js

@@ -1 +0,0 @@
-import{defineSandboxProvider}from"#shared/sandbox-provider.js";import{createMicrosandboxSandboxProvider}from"#execution/sandbox/bindings/microsandbox.js";const provider=defineSandboxProvider({name:`microsandbox`,stateProtocolVersion:3,environment:e=>createMicrosandboxSandboxProvider(e)}),MicrosandboxSandbox={...provider,dockerfile(e={}){return provider.environment(e)},image(e,t={}){return provider.environment({...t,image:e})}};export{MicrosandboxSandbox};

package/docs/sandbox/microsandbox.mdx

@@ -1,31 +0,0 @@
----
-title: "microsandbox"
-description: "Create local lightweight VMs from an OCI image or Dockerfile."
----
-
-microsandbox environments use eve's default image, an existing OCI image, or `agent/sandbox/Dockerfile`.
-
-```ts
-import { defineSandbox } from "eve/sandbox";
-import { MicrosandboxSandbox } from "eve/sandbox/microsandbox";
-
-export const environment = MicrosandboxSandbox.dockerfile({
-  setup: { autoInstall: false },
-});
-
-export default defineSandbox(() => environment.open({ networkPolicy: "deny-all" }));
-```
-
-Supported hosts are macOS on Apple Silicon and Linux with glibc and KVM.
-
-## Environment options
-
-Image, CPU, memory, pull policy, environment variables, VM setup, and `prepare` belong to the reusable environment. `eve build` builds a Dockerfile image when present, prepares a VM, and records its snapshot and image references.
-
-## Live VM options
-
-Pass `networkPolicy` to `open()`. The policy applies to the live VM, not the prepared snapshot. microsandbox accepts domain policies and credential transforms.
-
-Session creation uses the recorded snapshot and image directly. Writable VM state persists through the provider's session snapshot lifecycle.
-
-See the [sandbox overview](/docs/sandbox) for managed workspace, skills, parent inheritance, and custom providers.