niceeval 0.12.2-canary.31 → 0.13.0

package/dist/sandbox/transfer-errors.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"transfer-errors.js","sourceRoot":"","sources":["transfer-errors.ts"],"names":[],"mappings":";;AA2BA,8CAiBC;AAKD,gDAcC;AAED,wDAOC;AAED,gCAEC;AACD,kCAaC;AA1FD,uCAAuC;AACvC,EAAE;AACF,8EAA8E;AAC9E,+CAA+C;AAC/C,gEAAgE;AAChE,mDAAmD;AACnD,0DAA0D;AAC1D,EAAE;AACF,yCAAyC;AACzC,mBAAmB;AACnB,+CAAiD;AACjD,yCAAiC;AACjC,+CAAqC;AAcrC,yDAAyD;AACzD,SAAgB,iBAAiB,CAAC,KAAc;IAC5C,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAA8C,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC;YACnF,OAAO,IAAI,CAAC;QAChB,IAAI,qGAAqG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,wEAAwE,CAAC,IAAI,CAAC,OAAO,CAAC;YACtF,OAAO,IAAI,CAAC;QAChB,OAAO,GAAG,MAAM,EAAE,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CAAI,MAAsB,EAAE,SAA2B;IAC3F,IAAI,CAAC;QACD,OAAO,MAAM,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YACzB,MAAM,KAAK,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,yBAAyB,EAAE;YACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,sBAAsB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SAC3F,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AACD,wCAAwC;AACxC,SAAgB,sBAAsB,CAAC,MAA4D;IAC/F,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AACD,oCAAoC;AACpC,SAAgB,UAAU,CAAC,QAA0C;IACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AACvH,CAAC;AACD,SAAgB,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,GAAG,IAAI;QACZ,OAAO,GAAG,KAAK,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,IAAI;YACZ,MAAM;QACV,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AACD,gDAAgD;AAChD,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAA,eAAI,EAAC,SAAS,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,MAAM,EAAE;YACX,OAAO,EAAE,CAAC,IAAI,CAAC;QACnB,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YACjB,OAAO,SAAS,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM,IAAA,kBAAO,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,qCAAqC;gBACrC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK;oBACtB,OAAO,SAAS,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,WAAW,EAAE;oBACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;qBACf,IAAI,KAAK,CAAC,MAAM,EAAE;oBACnB,KAAK,IAAI,CAAC,MAAM,IAAA,eAAI,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC","sourcesContent":["// 沙箱文件传输的超时报错质量:SDK / HTTP 往返超时不许原样透出。\n//\n// e2b 一类 provider 的 SDK 把往返超时抛成 `The operation was aborted due to timeout` ——\n// 三要素(哪个操作 / 对什么对象 / 预算多少谁定的)一样不带,读到它的人第一反应是去调\n// `--timeout`,而那是 attempt 预算,和这层完全无关(契约见 docs/error-feedback.md\n// 「超时报错的三要素」)。这里在 provider 中立层补齐三要素:操作名与传输对象由调用点给,\n// 「这是 SDK/HTTP 层而非 attempt 预算」由文案说死,原始错误留在 `cause` 里不丢证据。\n//\n// 只包超时形态:其它失败(权限、路径不存在、瞬时网络重试耗尽)照原样抛回,保持\n// 「重试耗尽抛回原始错误链」不变。\nimport { stat, readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { t } from \"../i18n/index.ts\";\n/** 一次传输的可描述对象:沙箱侧路径 + 本地侧来源(有则给)+ 字节数(知道才给)。 */\nexport interface TransferTarget {\n    /** 中性操作名,与 `Sandbox` 接口的方法同名(用户就是照这个名字调的)。 */\n    operation: string;\n    /** provider 名(超时报错要点名是谁的 SDK 在超时);拿不到时按 `sandbox` 说。 */\n    provider?: string;\n    /** 沙箱侧路径(已解析成绝对路径)。 */\n    path: string;\n    /** 本地侧来源路径(上传类操作有)。 */\n    localPath?: string;\n    /** 传输字节数;算不出来就不写——不猜也不填 0。 */\n    bytes?: number;\n}\n/** 超时形态判定:沿 cause 链找 SDK / HTTP / socket 各家的超时词法与错误码。 */\nexport function isTransferTimeout(error: unknown): boolean {\n    let current: unknown = error;\n    for (let depth = 0; depth < 5 && current != null; depth += 1) {\n        const record = typeof current === \"object\" ? (current as globalThis.Record<string, unknown>) : undefined;\n        const name = record && typeof record.name === \"string\" ? record.name : \"\";\n        const code = record && typeof record.code === \"string\" ? record.code : \"\";\n        const message = current instanceof Error ? current.message : String(current);\n        if (/TimeoutError|HeadersTimeoutError|BodyTimeoutError|ConnectTimeoutError/i.test(name))\n            return true;\n        if (/^(ETIMEDOUT|ESOCKETTIMEDOUT|UND_ERR_CONNECT_TIMEOUT|UND_ERR_HEADERS_TIMEOUT|UND_ERR_BODY_TIMEOUT)$/i.test(code)) {\n            return true;\n        }\n        if (/aborted due to timeout|timed? ?out|timeout exceeded|deadline exceeded/i.test(message))\n            return true;\n        current = record?.cause;\n    }\n    return false;\n}\n/**\n * 包一次传输:超时时抛出带三要素的错误(原始错误进 `cause`),其它错误原样上抛。\n * 字节数在**失败路径**上才现算(上传类可以量本地来源),正常路径不付任何代价。\n */\nexport async function withTransferErrors<T>(target: TransferTarget, operation: () => Promise<T>): Promise<T> {\n    try {\n        return await operation();\n    }\n    catch (error) {\n        if (!isTransferTimeout(error))\n            throw error;\n        const bytes = target.bytes ?? (target.localPath ? await measureLocalBytes(target.localPath) : undefined);\n        throw new Error(t(\"sandbox.transferTimeout\", {\n            provider: target.provider ?? \"sandbox\",\n            operation: target.operation,\n            object: describeTransferObject({ ...target, ...(bytes !== undefined ? { bytes } : {}) }),\n        }), { cause: error });\n    }\n}\n/** 「对什么对象」:沙箱侧路径、本地来源与字节数拼成一句可定位的描述。 */\nexport function describeTransferObject(target: Pick<TransferTarget, \"path\" | \"localPath\" | \"bytes\">): string {\n    const parts = [target.path];\n    if (target.localPath !== undefined)\n        parts.push(`← ${target.localPath}`);\n    if (target.bytes !== undefined)\n        parts.push(`(${formatBytes(target.bytes)})`);\n    return parts.join(\" \");\n}\n/** 内容字节数合计(文本按 UTF-8 字节算,不按字符数)。 */\nexport function totalBytes(contents: readonly (string | Uint8Array)[]): number {\n    return contents.reduce((sum, c) => sum + (typeof c === \"string\" ? Buffer.byteLength(c, \"utf8\") : c.byteLength), 0);\n}\nexport function formatBytes(bytes: number): string {\n    if (bytes < 1024)\n        return `${bytes} B`;\n    const units = [\"KiB\", \"MiB\", \"GiB\"];\n    let value = bytes / 1024;\n    let unit = units[0]!;\n    for (const next of units.slice(1)) {\n        if (value < 1024)\n            break;\n        value /= 1024;\n        unit = next;\n    }\n    return `${value.toFixed(1)} ${unit}`;\n}\n/** 失败路径专用的本地体积量测:递归 stat,量不到(权限 / 已删除)就当不知道。 */\nasync function measureLocalBytes(localPath: string): Promise<number | undefined> {\n    try {\n        const st = await stat(localPath);\n        if (st.isFile())\n            return st.size;\n        if (!st.isDirectory())\n            return undefined;\n        let total = 0;\n        let visited = 0;\n        const stack = [localPath];\n        while (stack.length > 0) {\n            const dir = stack.pop()!;\n            for (const entry of await readdir(dir, { withFileTypes: true })) {\n                // 只是给报错凑一个数量级,不为它遍历一个巨型树:够多就停,当作不知道。\n                if ((visited += 1) > 20000)\n                    return undefined;\n                const abs = join(dir, entry.name);\n                if (entry.isDirectory())\n                    stack.push(abs);\n                else if (entry.isFile())\n                    total += (await stat(abs)).size;\n            }\n        }\n        return total;\n    }\n    catch {\n        return undefined;\n    }\n}\n"]}
+{"version":3,"file":"transfer-errors.js","sourceRoot":"","sources":["transfer-errors.ts"],"names":[],"mappings":";;AA4BA,8CAiBC;AAKD,gDAUC;AAKD,oDAMC;AAkBD,oDAIC;AAED,wDAOC;AAED,gCAEC;AACD,kCAaC;AAxHD,uCAAuC;AACvC,EAAE;AACF,8EAA8E;AAC9E,+CAA+C;AAC/C,gEAAgE;AAChE,mDAAmD;AACnD,0DAA0D;AAC1D,EAAE;AACF,yCAAyC;AACzC,mBAAmB;AACnB,+CAAiD;AACjD,yCAAiC;AACjC,mCAAgC;AAChC,+CAAqC;AAcrC,yDAAyD;AACzD,SAAgB,iBAAiB,CAAC,KAAc;IAC5C,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAA8C,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC;YACnF,OAAO,IAAI,CAAC;QAChB,IAAI,qGAAqG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,wEAAwE,CAAC,IAAI,CAAC,OAAO,CAAC;YACtF,OAAO,IAAI,CAAC;QAChB,OAAO,GAAG,MAAM,EAAE,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CAAI,MAAsB,EAAE,SAA2B;IAC3F,IAAI,CAAC;QACD,OAAO,MAAM,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YACzB,MAAM,KAAK,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzG,MAAM,oBAAoB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;AACL,CAAC;AACD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,MAAsB,EAAE,KAAc;IACvE,OAAO,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,yBAAyB,EAAE;QAC1C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC;KACzC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1B,CAAC;AACD,uDAAuD;AACvD,SAAS,oBAAoB,CAAC,MAAsB;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QACrD,OAAO,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QACvC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;KAC1B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AACD;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAO,MAAsB;IAC7D,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,eAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAmC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACvG,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7J,CAAC,CAAC,eAAM,CAAC,IAAI,CAAI,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC;AACD,wCAAwC;AACxC,SAAgB,sBAAsB,CAAC,MAA4D;IAC/F,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AACD,oCAAoC;AACpC,SAAgB,UAAU,CAAC,QAA0C;IACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AACvH,CAAC;AACD,SAAgB,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,GAAG,IAAI;QACZ,OAAO,GAAG,KAAK,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,IAAI;YACZ,MAAM;QACV,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AACD,gDAAgD;AAChD,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAA,eAAI,EAAC,SAAS,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,MAAM,EAAE;YACX,OAAO,EAAE,CAAC,IAAI,CAAC;QACnB,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YACjB,OAAO,SAAS,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM,IAAA,kBAAO,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,qCAAqC;gBACrC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK;oBACtB,OAAO,SAAS,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,WAAW,EAAE;oBACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;qBACf,IAAI,KAAK,CAAC,MAAM,EAAE;oBACnB,KAAK,IAAI,CAAC,MAAM,IAAA,eAAI,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC","sourcesContent":["// 沙箱文件传输的超时报错质量:SDK / HTTP 往返超时不许原样透出。\n//\n// e2b 一类 provider 的 SDK 把往返超时抛成 `The operation was aborted due to timeout` ——\n// 三要素(哪个操作 / 对什么对象 / 预算多少谁定的)一样不带,读到它的人第一反应是去调\n// `--timeout`,而那是 attempt 预算,和这层完全无关(契约见 docs/error-feedback.md\n// 「超时报错的三要素」)。这里在 provider 中立层补齐三要素:操作名与传输对象由调用点给,\n// 「这是 SDK/HTTP 层而非 attempt 预算」由文案说死,原始错误留在 `cause` 里不丢证据。\n//\n// 只包超时形态:其它失败(权限、路径不存在、瞬时网络重试耗尽)照原样抛回,保持\n// 「重试耗尽抛回原始错误链」不变。\nimport { stat, readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { Effect } from \"effect\";\nimport { t } from \"../i18n/index.ts\";\n/** 一次传输的可描述对象:沙箱侧路径 + 本地侧来源(有则给)+ 字节数(知道才给)。 */\nexport interface TransferTarget {\n    /** 中性操作名,与 `Sandbox` 接口的方法同名(用户就是照这个名字调的)。 */\n    operation: string;\n    /** provider 名(超时报错要点名是谁的 SDK 在超时);拿不到时按 `sandbox` 说。 */\n    provider?: string;\n    /** 沙箱侧路径(已解析成绝对路径)。 */\n    path: string;\n    /** 本地侧来源路径(上传类操作有)。 */\n    localPath?: string;\n    /** 传输字节数;算不出来就不写——不猜也不填 0。 */\n    bytes?: number;\n}\n/** 超时形态判定:沿 cause 链找 SDK / HTTP / socket 各家的超时词法与错误码。 */\nexport function isTransferTimeout(error: unknown): boolean {\n    let current: unknown = error;\n    for (let depth = 0; depth < 5 && current != null; depth += 1) {\n        const record = typeof current === \"object\" ? (current as globalThis.Record<string, unknown>) : undefined;\n        const name = record && typeof record.name === \"string\" ? record.name : \"\";\n        const code = record && typeof record.code === \"string\" ? record.code : \"\";\n        const message = current instanceof Error ? current.message : String(current);\n        if (/TimeoutError|HeadersTimeoutError|BodyTimeoutError|ConnectTimeoutError/i.test(name))\n            return true;\n        if (/^(ETIMEDOUT|ESOCKETTIMEDOUT|UND_ERR_CONNECT_TIMEOUT|UND_ERR_HEADERS_TIMEOUT|UND_ERR_BODY_TIMEOUT)$/i.test(code)) {\n            return true;\n        }\n        if (/aborted due to timeout|timed? ?out|timeout exceeded|deadline exceeded/i.test(message))\n            return true;\n        current = record?.cause;\n    }\n    return false;\n}\n/**\n * 包一次传输:超时时抛出带三要素的错误(原始错误进 `cause`),其它错误原样上抛。\n * 字节数在**失败路径**上才现算(上传类可以量本地来源),正常路径不付任何代价。\n */\nexport async function withTransferErrors<T>(target: TransferTarget, operation: () => Promise<T>): Promise<T> {\n    try {\n        return await operation();\n    }\n    catch (error) {\n        if (!isTransferTimeout(error))\n            throw error;\n        const bytes = target.bytes ?? (target.localPath ? await measureLocalBytes(target.localPath) : undefined);\n        throw transferTimeoutError({ ...target, ...(bytes !== undefined ? { bytes } : {}) }, error);\n    }\n}\n/**\n * 纯错误映射:超时形态 → 带三要素的 Error(原始错误进 `cause`)。不含字节量测与任何\n * IO,调用方(含 Effect 组合器)在失败路径上自行补齐 bytes 后再调它。\n */\nexport function transferTimeoutError(target: TransferTarget, error: unknown): Error {\n    return new Error(t(\"sandbox.transferTimeout\", {\n        provider: target.provider ?? \"sandbox\",\n        operation: target.operation,\n        object: describeTransferObject(target),\n    }), { cause: error });\n}\n/** 失败路径专用的字节量测 Effect:已有 bytes 或没有本地来源时不测,量不到就当不知道。 */\nfunction measureTransferBytes(target: TransferTarget): Effect.Effect<number | undefined> {\n    const localPath = target.localPath;\n    if (target.bytes !== undefined || localPath === undefined)\n        return Effect.succeed(undefined);\n    return Effect.tryPromise({\n        try: () => measureLocalBytes(localPath),\n        catch: (error) => error,\n    }).pipe(Effect.catchAll(() => Effect.succeed(undefined)));\n}\n/**\n * Effect 组合器:retry 耗尽后的**终局失败**上做一次 transfer 超时 enrichment。\n *\n * 必须排在 withSandboxIoRetry 之外、之后:重试分类只看到 raw provider 失败(分类器按\n * 原始错误形态判定),只有不再重试的失败才替换成带三要素的超时 Error。非超时错误原样\n * 透传,defect / interruption 不经过这里(它们在 Cause 里,不进 typed failure 通道)。\n */\nexport function enrichTransferErrors<A, E>(target: TransferTarget): (self: Effect.Effect<A, E>) => Effect.Effect<A, E | Error> {\n    return (self) => Effect.catchAll(self, (error): Effect.Effect<never, E | Error> => isTransferTimeout(error)\n        ? Effect.flatMap(measureTransferBytes(target), (bytes) => Effect.fail(transferTimeoutError({ ...target, ...(bytes !== undefined ? { bytes } : {}) }, error)))\n        : Effect.fail<E>(error));\n}\n/** 「对什么对象」:沙箱侧路径、本地来源与字节数拼成一句可定位的描述。 */\nexport function describeTransferObject(target: Pick<TransferTarget, \"path\" | \"localPath\" | \"bytes\">): string {\n    const parts = [target.path];\n    if (target.localPath !== undefined)\n        parts.push(`← ${target.localPath}`);\n    if (target.bytes !== undefined)\n        parts.push(`(${formatBytes(target.bytes)})`);\n    return parts.join(\" \");\n}\n/** 内容字节数合计(文本按 UTF-8 字节算,不按字符数)。 */\nexport function totalBytes(contents: readonly (string | Uint8Array)[]): number {\n    return contents.reduce((sum, c) => sum + (typeof c === \"string\" ? Buffer.byteLength(c, \"utf8\") : c.byteLength), 0);\n}\nexport function formatBytes(bytes: number): string {\n    if (bytes < 1024)\n        return `${bytes} B`;\n    const units = [\"KiB\", \"MiB\", \"GiB\"];\n    let value = bytes / 1024;\n    let unit = units[0]!;\n    for (const next of units.slice(1)) {\n        if (value < 1024)\n            break;\n        value /= 1024;\n        unit = next;\n    }\n    return `${value.toFixed(1)} ${unit}`;\n}\n/** 失败路径专用的本地体积量测:递归 stat,量不到(权限 / 已删除)就当不知道。 */\nasync function measureLocalBytes(localPath: string): Promise<number | undefined> {\n    try {\n        const st = await stat(localPath);\n        if (st.isFile())\n            return st.size;\n        if (!st.isDirectory())\n            return undefined;\n        let total = 0;\n        let visited = 0;\n        const stack = [localPath];\n        while (stack.length > 0) {\n            const dir = stack.pop()!;\n            for (const entry of await readdir(dir, { withFileTypes: true })) {\n                // 只是给报错凑一个数量级,不为它遍历一个巨型树:够多就停,当作不知道。\n                if ((visited += 1) > 20000)\n                    return undefined;\n                const abs = join(dir, entry.name);\n                if (entry.isDirectory())\n                    stack.push(abs);\n                else if (entry.isFile())\n                    total += (await stat(abs)).size;\n            }\n        }\n        return total;\n    }\n    catch {\n        return undefined;\n    }\n}\n"]}

package/dist/sandbox/transfer-errors.d.cts

@@ -1,3 +1,4 @@
+import { Effect } from "effect";
 /** 一次传输的可描述对象:沙箱侧路径 + 本地侧来源(有则给)+ 字节数(知道才给)。 */
 export interface TransferTarget {
     /** 中性操作名,与 `Sandbox` 接口的方法同名(用户就是照这个名字调的)。 */
@@ -18,6 +19,19 @@ export declare function isTransferTimeout(error: unknown): boolean;
  * 字节数在**失败路径**上才现算(上传类可以量本地来源),正常路径不付任何代价。
  */
 export declare function withTransferErrors<T>(target: TransferTarget, operation: () => Promise<T>): Promise<T>;
+/**
+ * 纯错误映射:超时形态 → 带三要素的 Error(原始错误进 `cause`)。不含字节量测与任何
+ * IO,调用方(含 Effect 组合器)在失败路径上自行补齐 bytes 后再调它。
+ */
+export declare function transferTimeoutError(target: TransferTarget, error: unknown): Error;
+/**
+ * Effect 组合器:retry 耗尽后的**终局失败**上做一次 transfer 超时 enrichment。
+ *
+ * 必须排在 withSandboxIoRetry 之外、之后:重试分类只看到 raw provider 失败(分类器按
+ * 原始错误形态判定),只有不再重试的失败才替换成带三要素的超时 Error。非超时错误原样
+ * 透传,defect / interruption 不经过这里(它们在 Cause 里,不进 typed failure 通道)。
+ */
+export declare function enrichTransferErrors<A, E>(target: TransferTarget): (self: Effect.Effect<A, E>) => Effect.Effect<A, E | Error>;
 /** 「对什么对象」:沙箱侧路径、本地来源与字节数拼成一句可定位的描述。 */
 export declare function describeTransferObject(target: Pick<TransferTarget, "path" | "localPath" | "bytes">): string;
 /** 内容字节数合计(文本按 UTF-8 字节算,不按字符数)。 */

package/dist/sandbox/transfer-errors.d.mts

@@ -1,3 +1,4 @@
+import { Effect } from "effect";
 /** 一次传输的可描述对象:沙箱侧路径 + 本地侧来源(有则给)+ 字节数(知道才给)。 */
 export interface TransferTarget {
     /** 中性操作名,与 `Sandbox` 接口的方法同名(用户就是照这个名字调的)。 */
@@ -18,6 +19,19 @@ export declare function isTransferTimeout(error: unknown): boolean;
  * 字节数在**失败路径**上才现算(上传类可以量本地来源),正常路径不付任何代价。
  */
 export declare function withTransferErrors<T>(target: TransferTarget, operation: () => Promise<T>): Promise<T>;
+/**
+ * 纯错误映射:超时形态 → 带三要素的 Error(原始错误进 `cause`)。不含字节量测与任何
+ * IO,调用方(含 Effect 组合器)在失败路径上自行补齐 bytes 后再调它。
+ */
+export declare function transferTimeoutError(target: TransferTarget, error: unknown): Error;
+/**
+ * Effect 组合器:retry 耗尽后的**终局失败**上做一次 transfer 超时 enrichment。
+ *
+ * 必须排在 withSandboxIoRetry 之外、之后:重试分类只看到 raw provider 失败(分类器按
+ * 原始错误形态判定),只有不再重试的失败才替换成带三要素的超时 Error。非超时错误原样
+ * 透传,defect / interruption 不经过这里(它们在 Cause 里,不进 typed failure 通道)。
+ */
+export declare function enrichTransferErrors<A, E>(target: TransferTarget): (self: Effect.Effect<A, E>) => Effect.Effect<A, E | Error>;
 /** 「对什么对象」:沙箱侧路径、本地来源与字节数拼成一句可定位的描述。 */
 export declare function describeTransferObject(target: Pick<TransferTarget, "path" | "localPath" | "bytes">): string;
 /** 内容字节数合计(文本按 UTF-8 字节算,不按字符数)。 */

package/dist/sandbox/transfer-errors.d.ts

@@ -1,3 +1,4 @@
+import { Effect } from "effect";
 /** 一次传输的可描述对象:沙箱侧路径 + 本地侧来源(有则给)+ 字节数(知道才给)。 */
 export interface TransferTarget {
     /** 中性操作名,与 `Sandbox` 接口的方法同名(用户就是照这个名字调的)。 */
@@ -18,6 +19,19 @@ export declare function isTransferTimeout(error: unknown): boolean;
  * 字节数在**失败路径**上才现算(上传类可以量本地来源),正常路径不付任何代价。
  */
 export declare function withTransferErrors<T>(target: TransferTarget, operation: () => Promise<T>): Promise<T>;
+/**
+ * 纯错误映射:超时形态 → 带三要素的 Error(原始错误进 `cause`)。不含字节量测与任何
+ * IO,调用方(含 Effect 组合器)在失败路径上自行补齐 bytes 后再调它。
+ */
+export declare function transferTimeoutError(target: TransferTarget, error: unknown): Error;
+/**
+ * Effect 组合器:retry 耗尽后的**终局失败**上做一次 transfer 超时 enrichment。
+ *
+ * 必须排在 withSandboxIoRetry 之外、之后:重试分类只看到 raw provider 失败(分类器按
+ * 原始错误形态判定),只有不再重试的失败才替换成带三要素的超时 Error。非超时错误原样
+ * 透传,defect / interruption 不经过这里(它们在 Cause 里,不进 typed failure 通道)。
+ */
+export declare function enrichTransferErrors<A, E>(target: TransferTarget): (self: Effect.Effect<A, E>) => Effect.Effect<A, E | Error>;
 /** 「对什么对象」:沙箱侧路径、本地来源与字节数拼成一句可定位的描述。 */
 export declare function describeTransferObject(target: Pick<TransferTarget, "path" | "localPath" | "bytes">): string;
 /** 内容字节数合计(文本按 UTF-8 字节算,不按字符数)。 */

package/dist/sandbox/transfer-errors.js

@@ -3,12 +3,16 @@ const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
 const __niceevalCanonical = __niceevalRequire("./transfer-errors.cjs");
 const __niceevalExport0 = __niceevalCanonical["describeTransferObject"];
 export { __niceevalExport0 as describeTransferObject };
-const __niceevalExport1 = __niceevalCanonical["formatBytes"];
-export { __niceevalExport1 as formatBytes };
-const __niceevalExport2 = __niceevalCanonical["isTransferTimeout"];
-export { __niceevalExport2 as isTransferTimeout };
-const __niceevalExport3 = __niceevalCanonical["totalBytes"];
-export { __niceevalExport3 as totalBytes };
-const __niceevalExport4 = __niceevalCanonical["withTransferErrors"];
-export { __niceevalExport4 as withTransferErrors };
+const __niceevalExport1 = __niceevalCanonical["enrichTransferErrors"];
+export { __niceevalExport1 as enrichTransferErrors };
+const __niceevalExport2 = __niceevalCanonical["formatBytes"];
+export { __niceevalExport2 as formatBytes };
+const __niceevalExport3 = __niceevalCanonical["isTransferTimeout"];
+export { __niceevalExport3 as isTransferTimeout };
+const __niceevalExport4 = __niceevalCanonical["totalBytes"];
+export { __niceevalExport4 as totalBytes };
+const __niceevalExport5 = __niceevalCanonical["transferTimeoutError"];
+export { __niceevalExport5 as transferTimeoutError };
+const __niceevalExport6 = __niceevalCanonical["withTransferErrors"];
+export { __niceevalExport6 as withTransferErrors };
 //# sourceMappingURL=transfer-errors.js.map

package/dist/sandbox/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["// sandbox 域类型:运行中 Sandbox、生命周期 hook、命令与文件 IO 的形状。\n// 作者声明使用 layer.ts 的闭合 SandboxLayer；本文件不再保留旧 provider spec。\nimport type { ScopedFeedback } from \"../shared/types.ts\";\nexport interface CommandResult {\n    stdout: string;\n    stderr: string;\n    exitCode: number;\n    /**\n     * 这次执行的命令摘要(有界、已脱敏,与时间树 command 节点同一份文案)。由执行面在最外层\n     * 公开调用处附加;直接从 provider 拿到的裸结果可能没有。断言失败时用作 evidence\n     * (`commandSucceeded()` 的「命令行本身」),消费方按可选字段读。\n     */\n    command?: string;\n}\n/** 内置 provider 名；ProviderModule 的完成态计划使用普通 string 兼容自定义 provider。 */\nexport type SandboxProvider = \"docker\" | \"vercel\" | \"e2b\" | \"local\";\n/** 镜像/模板里的 Node 运行时版本。 */\nexport type SandboxRuntime = \"node20\" | \"node24\";\n/**\n * Sandbox hook 的窄上下文:只有 `experimentId`、`signal` 与作用域绑定的 `progress/diagnostic`,\n * 不借用包含 session / model / telemetry 的完整 `AgentContext`\n * (见 docs/feature/sandbox/library.md「环境层生命周期钩子」)。\n */\nexport interface SandboxHookContext extends ScopedFeedback {\n    /** 运行计划中已解析的实验 id；生命周期 hook 不在脱离 Experiment 的上下文执行。 */\n    readonly experimentId: string;\n    /** 当前物理 Sandbox 归属的 Eval Group；未分组 Sandbox 省略。 */\n    readonly evalGroup?: {\n        readonly id: string;\n        readonly definitionHash: string;\n    };\n    /** 当前 Invocation 的中止信号；物理 Sandbox 生命周期不从某条 Attempt 借用信号。 */\n    readonly signal: AbortSignal;\n    /**\n     * 写入所属 Run 的 generic custom fact document；这类事实不归属于某一条 Attempt。\n     * name 使用反向域格式且不能以 `niceeval.` 开头，同一 owner/name 只允许写一次。value 可以是任意\n     * JsonValue。完整 document 经 JSON.stringify 后最多 65,536 UTF-8 bytes；超限同步抛出\n     * `record-custom-fact-too-large`，且不留下部分文件。不影响判定、评分或指纹。\n     */\n    fact(key: string, value: string | number | boolean): void;\n}\n/** 沙箱级生命周期钩子(`SandboxLayer.setup()` / `.teardown()` 链式挂载)。 */\nexport type SandboxHook = (sandbox: Sandbox, ctx: SandboxHookContext) => void | Promise<void>;\nexport interface CommandOptions {\n    /**\n     * 这条命令已知会处理的敏感明文（例如 API key、token、HTTP header value）。Runner 仍把\n     * 原值交给 provider 执行，但在任何 timing / commands / execution / error 证据落盘前按\n     * 这些值做精确替换；本数组本身不落盘、不进指纹。空字符串被忽略。\n     *\n     * 这是显式 provenance，不是 secret 扫描器：没有登记的自由文本无法被可靠识别；值若先被\n     * 调用方编码或拆分，应把实际会出现在命令/输出里的编码形态一并登记。\n     */\n    readonly sensitiveValues?: readonly string[];\n    /**\n     * 追加/覆盖本命令的环境变量(与 Sandbox 默认环境叠加,不清空默认值)。`PATH` 是 Sandbox\n     * 受管变量,各 provider 保留自己算出的 `PATH`,不保证能被这里覆盖;需要扩展 PATH 用\n     * Sandbox factory 的 `pathPrepend`(见 docs/feature/sandbox/library.md「PATH:受管变量与\n     * pathPrepend」)。\n     */\n    readonly env?: Readonly<globalThis.Record<string, string>>;\n    /** 本命令的工作目录;省略时落到 `Sandbox.workdir`。相对路径按 workdir 解析,绝对路径原样使用。 */\n    readonly cwd?: string;\n    /**\n     * 把本命令的输出也送进 Sandbox 的「原生日志流」(于是 `docker logs` / Docker UI 的 Logs\n     * 标签页能实时看到它)。给 agent 命令(codex exec / bub run / claude)开它,就能在容器\n     * 日志里看到 agent 的【原始输出】。provider 各自实现(docker:tee 到 PID1 tail 的文件;\n     * 不支持的 provider 忽略)—— 日志怎么浮现是 provider 的事,adapter 只声明意图。\n     */\n    readonly stream?: boolean;\n    /**\n     * 命令 stdout 每到一块就调用一次。回调只用于运行中的短命反馈；完整 stdout 仍会原样\n     * 出现在返回的 `CommandResult` 里。provider 不支持真流时，至少会在命令结束后按完整\n     * stdout 调用一次，不能静默丢掉。\n     */\n    readonly onStdout?: (chunk: string) => void | Promise<void>;\n    /** `onStdout` 的 stderr 对应物；完整 stderr 仍保留在 `CommandResult`。 */\n    readonly onStderr?: (chunk: string) => void | Promise<void>;\n    /**\n     * 覆盖本条命令的执行身份;省略 = Sandbox 默认身份(沿用环境自己声明的身份——Docker 镜像 `USER`、\n     * Compose service `user:`、E2B template 默认用户、宿主当前用户,见\n     * docs/feature/sandbox/library.md「执行身份」)。\n     *\n     * 语义跨 provider 一致,各 provider 映射到自己的原生机制(docker:`exec --user`;E2B:\n     * `{ user }`;Vercel:只认 `\"root\"`,映射 `{ sudo: true }`,其它值报错;local:任何值都报错)。\n     * 本就全程 root 的 provider视作 no-op;完全无法换身份的 provider 可不支持(抛错)—— 但**省略与\n     * 显式值的语义保持一致**,不因 provider 而变。\n     */\n    readonly user?: string;\n    /**\n     * 这条命令自己的上限(毫秒)。**省略才是常态**:省略时上限 = attempt deadline 的剩余量\n     * (见 docs/feature/sandbox/architecture.md「时限归属」),provider 层没有独立默认。\n     * 显式传一个更短的值是有意声明,照常生效;撞线时归属记成「命令显式 timeout」。\n     */\n    readonly timeoutMs?: number;\n    /**\n     * 取消本次受管命令树。Provider 必须在 Promise settle 前确认命令树已经终止；无法精确\n     * 终止时应退休整个 Sandbox，不能只关闭 transport 后把进程留在后台。\n     */\n    readonly signal?: AbortSignal;\n}\nexport interface SuccessfulCommandResult extends CommandResult {\n    readonly exitCode: 0;\n}\n/** 三个运行中 Sandbox 视图共用的操作词汇；同名成员在不同视图中不得改变语义。 */\nexport interface SandboxOperations {\n    /** Sandbox 内项目/工作区根目录的绝对路径(agent 命令的默认 cwd,也是 git baseline 提交的位置)。各方法的相对路径都以此为基准解析,省略 `cwd`/`targetDir` 时也落到这里。 */\n    readonly workdir: string;\n    /**\n     * 执行单个命令,`args` 作为独立 argv 传递、不经 shell 解释(无 `&&`、管道、通配符展开)。\n     * 只想跑一个可执行文件、参数来自外部输入、担心注入时优先用它。\n     */\n    runCommand(cmd: string, args?: readonly string[], opts?: CommandOptions): Promise<CommandResult>;\n    /**\n     * 执行一整段脚本,经 shell(bash)解释,支持 `&&`、管道、`$()`、重定向等。\n     * 需要拼多条命令或做条件判断时用它。\n     */\n    runShell(script: string, opts?: CommandOptions): Promise<CommandResult>;\n    /**\n     * 像 `runCommand` 一样执行单个命令，但非零退出时抛出 `SandboxCommandExitError`。错误消息附带\n     * 有界、已清理和脱敏的 stderr 尾部；stderr 为空时回退 stdout。完整输出保留在异常的\n     * `result` 字段中。成功结果的 `exitCode` 在类型上固定为 `0`。\n     */\n    runCommandOrThrow(cmd: string, args?: readonly string[], opts?: CommandOptions): Promise<SuccessfulCommandResult>;\n    /**\n     * 像 `runShell` 一样执行 shell 脚本，但非零退出时抛出 `SandboxCommandExitError`。错误摘要、\n     * 完整输出和成功结果的语义与 `runCommandOrThrow` 相同。\n     */\n    runShellOrThrow(script: string, opts?: CommandOptions): Promise<SuccessfulCommandResult>;\n    /** 读取 Sandbox 内文件的文本内容(UTF-8)。文件不存在时抛错。 */\n    readText(path: string): Promise<string>;\n    /** 写入 Sandbox 内一个 UTF-8 文本文件；父目录不存在时自动创建。 */\n    writeText(path: string, content: string): Promise<void>;\n    /** 精确读取 Sandbox 内文件字节；公共契约不绑定 Node Buffer。 */\n    readBytes(path: string): Promise<Uint8Array>;\n    /** 精确写入 Sandbox 内文件字节；父目录不存在时自动创建。 */\n    writeBytes(path: string, content: Uint8Array): Promise<void>;\n    /** 检查 Sandbox 内文件或目录路径是否存在。 */\n    pathExists(path: string): Promise<boolean>;\n}\n/** 只用于宿主机与 Sandbox 之间真实传输；内存内容读写使用 read/writeText/Bytes。 */\nexport interface SandboxTransferOperations {\n    uploadFile(source: string | URL, targetPath: string): Promise<void>;\n    uploadDirectory(sourceDir: string | URL, targetDir?: string, options?: {\n        readonly ignore?: readonly string[];\n    }): Promise<void>;\n    downloadFile(sourcePath: string, target: string | URL): Promise<void>;\n    downloadDirectory(sourceDir: string, targetDir: string | URL, options?: {\n        readonly ignore?: readonly string[];\n    }): Promise<void>;\n}\nexport interface Sandbox extends SandboxOperations, SandboxTransferOperations {\n    /** 销毁 Sandbox 占用的计算资源(容器/microVM)。调用后 Sandbox 不可再用;是否可安全重复调用因 provider 而异,不要依赖这一点。 */\n    stop(): Promise<void>;\n    /** 本 Sandbox 的稳定标识(各 provider 原生 ID,如 Docker 容器 ID 前缀);用于跨调用关联同一 Sandbox 的会话状态,也用于日志展示。 */\n    readonly sandboxId: string;\n    /**\n     * OTLP receiver 的放置能力。\n     * - `string`:Sandbox 内可通过该 hostname 访问宿主 receiver。\n     * - `null`:provider 不承诺宿主回连；runner 尝试在 Sandbox 内启动 attempt-scope receiver。\n     *   这不保证 tracing 成功；镜像缺少 receiver 所需运行时时只记录 supplemental diagnostic。\n     * `defineConfig({ telemetry: { host } })` 可在作者已经提供受控 tunnel 时显式覆盖。\n     */\n    readonly otlpHost: string | null;\n    /**\n     * 可选:把一行写进容器的「主日志」(PID1 在 tail 它)——于是 `docker logs` /\n     * Docker UI 的 Logs 标签页能实时看到 agent 逐轮活动。docker provider 实现,其它可省略。\n     */\n    appendLog?(line: string): Promise<void>;\n}\n/** 复用调度需要的中立寿命确认能力。 */\nexport interface SandboxReuseCapability {\n    ensureLifetime(minRemainingMs: number): Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["types.ts"],"names":[],"mappings":"","sourcesContent":["// sandbox 域类型:运行中 Sandbox、生命周期 hook、命令与文件 IO 的形状。\n// 作者声明使用 layer.ts 的闭合 SandboxLayer；本文件不再保留旧 provider spec。\nimport type { ScopedFeedback } from \"../shared/types.ts\";\nexport interface CommandResult {\n    stdout: string;\n    stderr: string;\n    exitCode: number;\n    /**\n     * 这次执行的命令摘要(有界、已脱敏,与时间树 command 节点同一份文案)。由执行面在最外层\n     * 公开调用处附加;直接从 provider 拿到的裸结果可能没有。断言失败时用作 evidence\n     * (`commandSucceeded()` 的「命令行本身」),消费方按可选字段读。\n     */\n    command?: string;\n}\n/** 内置 provider 名；ProviderModule 的完成态计划使用普通 string 兼容自定义 provider。 */\nexport type SandboxProvider = \"docker\" | \"vercel\" | \"e2b\" | \"local\";\n/** 镜像/模板里的 Node 运行时版本。 */\nexport type SandboxRuntime = \"node20\" | \"node24\";\n/**\n * Sandbox hook 的窄上下文:只有 `experimentId`、`signal` 与作用域绑定的 `progress/diagnostic`,\n * 不借用包含 session / model / telemetry 的完整 `AgentContext`\n * (见 docs/feature/sandbox/library.md「环境层生命周期钩子」)。\n */\nexport interface SandboxHookContext extends ScopedFeedback {\n    /** 运行计划中已解析的实验 id；生命周期 hook 不在脱离 Experiment 的上下文执行。 */\n    readonly experimentId: string;\n    /** 当前物理 Sandbox 归属的 Eval Group；未分组 Sandbox 省略。 */\n    readonly evalGroup?: {\n        readonly id: string;\n        readonly definitionHash: string;\n    };\n    /** 当前 Invocation 的中止信号；物理 Sandbox 生命周期不从某条 Attempt 借用信号。 */\n    readonly signal: AbortSignal;\n}\n/** 沙箱级生命周期钩子(`SandboxLayer.setup()` / `.teardown()` 链式挂载)。 */\nexport type SandboxHook = (sandbox: Sandbox, ctx: SandboxHookContext) => void | Promise<void>;\nexport interface CommandOptions {\n    /**\n     * 这条命令已知会处理的敏感明文（例如 API key、token、HTTP header value）。Runner 仍把\n     * 原值交给 provider 执行，但在任何 timing / commands / execution / error 证据落盘前按\n     * 这些值做精确替换；本数组本身不落盘、不进指纹。空字符串被忽略。\n     *\n     * 这是显式 provenance，不是 secret 扫描器：没有登记的自由文本无法被可靠识别；值若先被\n     * 调用方编码或拆分，应把实际会出现在命令/输出里的编码形态一并登记。\n     */\n    readonly sensitiveValues?: readonly string[];\n    /**\n     * 追加/覆盖本命令的环境变量(与 Sandbox 默认环境叠加,不清空默认值)。`PATH` 是 Sandbox\n     * 受管变量,各 provider 保留自己算出的 `PATH`,不保证能被这里覆盖;需要扩展 PATH 用\n     * Sandbox factory 的 `pathPrepend`(见 docs/feature/sandbox/library.md「PATH:受管变量与\n     * pathPrepend」)。\n     */\n    readonly env?: Readonly<globalThis.Record<string, string>>;\n    /** 本命令的工作目录;省略时落到 `Sandbox.workdir`。相对路径按 workdir 解析,绝对路径原样使用。 */\n    readonly cwd?: string;\n    /**\n     * 把本命令的输出也送进 Sandbox 的「原生日志流」(于是 `docker logs` / Docker UI 的 Logs\n     * 标签页能实时看到它)。给 agent 命令(codex exec / bub run / claude)开它,就能在容器\n     * 日志里看到 agent 的【原始输出】。provider 各自实现(docker:tee 到 PID1 tail 的文件;\n     * 不支持的 provider 忽略)—— 日志怎么浮现是 provider 的事,adapter 只声明意图。\n     */\n    readonly stream?: boolean;\n    /**\n     * 命令 stdout 每到一块就调用一次。回调只用于运行中的短命反馈；完整 stdout 仍会原样\n     * 出现在返回的 `CommandResult` 里。provider 不支持真流时，至少会在命令结束后按完整\n     * stdout 调用一次，不能静默丢掉。\n     */\n    readonly onStdout?: (chunk: string) => void | Promise<void>;\n    /** `onStdout` 的 stderr 对应物；完整 stderr 仍保留在 `CommandResult`。 */\n    readonly onStderr?: (chunk: string) => void | Promise<void>;\n    /**\n     * 覆盖本条命令的执行身份;省略 = Sandbox 默认身份(沿用环境自己声明的身份——Docker 镜像 `USER`、\n     * Compose service `user:`、E2B template 默认用户、宿主当前用户,见\n     * docs/feature/sandbox/library.md「执行身份」)。\n     *\n     * 语义跨 provider 一致,各 provider 映射到自己的原生机制(docker:`exec --user`;E2B:\n     * `{ user }`;Vercel:只认 `\"root\"`,映射 `{ sudo: true }`,其它值报错;local:任何值都报错)。\n     * 本就全程 root 的 provider视作 no-op;完全无法换身份的 provider 可不支持(抛错)—— 但**省略与\n     * 显式值的语义保持一致**,不因 provider 而变。\n     */\n    readonly user?: string;\n    /**\n     * 这条命令自己的上限(毫秒)。**省略才是常态**:省略时上限 = attempt deadline 的剩余量\n     * (见 docs/feature/sandbox/architecture.md「时限归属」),provider 层没有独立默认。\n     * 显式传一个更短的值是有意声明,照常生效;撞线时归属记成「命令显式 timeout」。\n     */\n    readonly timeoutMs?: number;\n    /**\n     * 取消本次受管命令树。Provider 必须在 Promise settle 前确认命令树已经终止；无法精确\n     * 终止时应退休整个 Sandbox，不能只关闭 transport 后把进程留在后台。\n     */\n    readonly signal?: AbortSignal;\n}\nexport interface SuccessfulCommandResult extends CommandResult {\n    readonly exitCode: 0;\n}\n/** 三个运行中 Sandbox 视图共用的操作词汇；同名成员在不同视图中不得改变语义。 */\nexport interface SandboxOperations {\n    /** Sandbox 内项目/工作区根目录的绝对路径(agent 命令的默认 cwd,也是 git baseline 提交的位置)。各方法的相对路径都以此为基准解析,省略 `cwd`/`targetDir` 时也落到这里。 */\n    readonly workdir: string;\n    /**\n     * 执行单个命令,`args` 作为独立 argv 传递、不经 shell 解释(无 `&&`、管道、通配符展开)。\n     * 只想跑一个可执行文件、参数来自外部输入、担心注入时优先用它。\n     */\n    runCommand(cmd: string, args?: readonly string[], opts?: CommandOptions): Promise<CommandResult>;\n    /**\n     * 执行一整段脚本,经 shell(bash)解释,支持 `&&`、管道、`$()`、重定向等。\n     * 需要拼多条命令或做条件判断时用它。\n     */\n    runShell(script: string, opts?: CommandOptions): Promise<CommandResult>;\n    /**\n     * 像 `runCommand` 一样执行单个命令，但非零退出时抛出 `SandboxCommandExitError`。错误消息附带\n     * 有界、已清理和脱敏的 stderr 尾部；stderr 为空时回退 stdout。完整输出保留在异常的\n     * `result` 字段中。成功结果的 `exitCode` 在类型上固定为 `0`。\n     */\n    runCommandOrThrow(cmd: string, args?: readonly string[], opts?: CommandOptions): Promise<SuccessfulCommandResult>;\n    /**\n     * 像 `runShell` 一样执行 shell 脚本，但非零退出时抛出 `SandboxCommandExitError`。错误摘要、\n     * 完整输出和成功结果的语义与 `runCommandOrThrow` 相同。\n     */\n    runShellOrThrow(script: string, opts?: CommandOptions): Promise<SuccessfulCommandResult>;\n    /** 读取 Sandbox 内文件的文本内容(UTF-8)。文件不存在时抛错。 */\n    readText(path: string): Promise<string>;\n    /** 写入 Sandbox 内一个 UTF-8 文本文件；父目录不存在时自动创建。 */\n    writeText(path: string, content: string): Promise<void>;\n    /** 精确读取 Sandbox 内文件字节；公共契约不绑定 Node Buffer。 */\n    readBytes(path: string): Promise<Uint8Array>;\n    /** 精确写入 Sandbox 内文件字节；父目录不存在时自动创建。 */\n    writeBytes(path: string, content: Uint8Array): Promise<void>;\n    /** 检查 Sandbox 内文件或目录路径是否存在。 */\n    pathExists(path: string): Promise<boolean>;\n}\n/** 只用于宿主机与 Sandbox 之间真实传输；内存内容读写使用 read/writeText/Bytes。 */\nexport interface SandboxTransferOperations {\n    uploadFile(source: string | URL, targetPath: string): Promise<void>;\n    uploadDirectory(sourceDir: string | URL, targetDir?: string, options?: {\n        readonly ignore?: readonly string[];\n    }): Promise<void>;\n    downloadFile(sourcePath: string, target: string | URL): Promise<void>;\n    downloadDirectory(sourceDir: string, targetDir: string | URL, options?: {\n        readonly ignore?: readonly string[];\n    }): Promise<void>;\n}\nexport interface Sandbox extends SandboxOperations, SandboxTransferOperations {\n    /** 销毁 Sandbox 占用的计算资源(容器/microVM)。调用后 Sandbox 不可再用;是否可安全重复调用因 provider 而异,不要依赖这一点。 */\n    stop(): Promise<void>;\n    /** 本 Sandbox 的稳定标识(各 provider 原生 ID,如 Docker 容器 ID 前缀);用于跨调用关联同一 Sandbox 的会话状态,也用于日志展示。 */\n    readonly sandboxId: string;\n    /**\n     * OTLP receiver 的放置能力。\n     * - `string`:Sandbox 内可通过该 hostname 访问宿主 receiver。\n     * - `null`:provider 不承诺宿主回连；runner 尝试在 Sandbox 内启动 attempt-scope receiver。\n     *   这不保证 tracing 成功；镜像缺少 receiver 所需运行时时只记录 supplemental diagnostic。\n     * `defineConfig({ telemetry: { host } })` 可在作者已经提供受控 tunnel 时显式覆盖。\n     */\n    readonly otlpHost: string | null;\n    /**\n     * 可选:把一行写进容器的「主日志」(PID1 在 tail 它)——于是 `docker logs` /\n     * Docker UI 的 Logs 标签页能实时看到 agent 逐轮活动。docker provider 实现,其它可省略。\n     */\n    appendLog?(line: string): Promise<void>;\n}\n/** 复用调度需要的中立寿命确认能力。 */\nexport interface SandboxReuseCapability {\n    ensureLifetime(minRemainingMs: number): Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }>;\n}\n"]}

package/dist/sandbox/types.d.cts

@@ -29,13 +29,6 @@ export interface SandboxHookContext extends ScopedFeedback {
     };
     /** 当前 Invocation 的中止信号；物理 Sandbox 生命周期不从某条 Attempt 借用信号。 */
     readonly signal: AbortSignal;
-    /**
-     * 写入所属 Run 的 generic custom fact document；这类事实不归属于某一条 Attempt。
-     * name 使用反向域格式且不能以 `niceeval.` 开头，同一 owner/name 只允许写一次。value 可以是任意
-     * JsonValue。完整 document 经 JSON.stringify 后最多 65,536 UTF-8 bytes；超限同步抛出
-     * `record-custom-fact-too-large`，且不留下部分文件。不影响判定、评分或指纹。
-     */
-    fact(key: string, value: string | number | boolean): void;
 }
 /** 沙箱级生命周期钩子(`SandboxLayer.setup()` / `.teardown()` 链式挂载)。 */
 export type SandboxHook = (sandbox: Sandbox, ctx: SandboxHookContext) => void | Promise<void>;

package/dist/sandbox/types.d.mts

@@ -29,13 +29,6 @@ export interface SandboxHookContext extends ScopedFeedback {
     };
     /** 当前 Invocation 的中止信号；物理 Sandbox 生命周期不从某条 Attempt 借用信号。 */
     readonly signal: AbortSignal;
-    /**
-     * 写入所属 Run 的 generic custom fact document；这类事实不归属于某一条 Attempt。
-     * name 使用反向域格式且不能以 `niceeval.` 开头，同一 owner/name 只允许写一次。value 可以是任意
-     * JsonValue。完整 document 经 JSON.stringify 后最多 65,536 UTF-8 bytes；超限同步抛出
-     * `record-custom-fact-too-large`，且不留下部分文件。不影响判定、评分或指纹。
-     */
-    fact(key: string, value: string | number | boolean): void;
 }
 /** 沙箱级生命周期钩子(`SandboxLayer.setup()` / `.teardown()` 链式挂载)。 */
 export type SandboxHook = (sandbox: Sandbox, ctx: SandboxHookContext) => void | Promise<void>;

package/dist/sandbox/types.d.ts

@@ -29,13 +29,6 @@ export interface SandboxHookContext extends ScopedFeedback {
     };
     /** 当前 Invocation 的中止信号；物理 Sandbox 生命周期不从某条 Attempt 借用信号。 */
     readonly signal: AbortSignal;
-    /**
-     * 写入所属 Run 的 generic custom fact document；这类事实不归属于某一条 Attempt。
-     * name 使用反向域格式且不能以 `niceeval.` 开头，同一 owner/name 只允许写一次。value 可以是任意
-     * JsonValue。完整 document 经 JSON.stringify 后最多 65,536 UTF-8 bytes；超限同步抛出
-     * `record-custom-fact-too-large`，且不留下部分文件。不影响判定、评分或指纹。
-     */
-    fact(key: string, value: string | number | boolean): void;
 }
 /** 沙箱级生命周期钩子(`SandboxLayer.setup()` / `.teardown()` 链式挂载)。 */
 export type SandboxHook = (sandbox: Sandbox, ctx: SandboxHookContext) => void | Promise<void>;

package/dist/sandbox/vercel.cjs

@@ -5,6 +5,7 @@ exports.classifyProvisionError = classifyProvisionError;
 // Vercel Sandbox provider:用 @vercel/sandbox SDK 把 Vercel microVM 当隔离工作区跑 eval。
 // 契约对齐 ../types.ts 的 Sandbox 接口,与 DockerSandbox 可互换。
 const sandbox_1 = require("@vercel/sandbox");
+const effect_1 = require("effect");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
 const download_directory_ts_1 = require("./download-directory.cjs");
@@ -32,20 +33,15 @@ function classifyProvisionError(e) {
 const VERCEL_WORKDIR = "/vercel/sandbox";
 // rotate 时停掉旧 session 的等待上限:stop 挂起时不无限拖住当前命令。
 const STOP_OLD_SESSION_TIMEOUT_MS = 15000;
-/** 给 promise 套超时;到点 reject,并清掉计时器避免拖住事件循环。 */
-async function withTimeout(promise, ms) {
-    let timer;
-    try {
-        return await Promise.race([
-            promise,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
-            }),
-        ]);
-    }
-    finally {
-        clearTimeout(timer);
-    }
+/** 给 promise 套超时;到点 fail。计时用 Effect Clock/Sleep,超时分支中断等待 fiber,不再手工管 timer。 */
+function withTimeout(promise, ms) {
+    return effect_1.Effect.runPromise(effect_1.Effect.tryPromise({
+        try: () => promise,
+        catch: (cause) => cause,
+    }).pipe(effect_1.Effect.timeoutFail({
+        duration: ms,
+        onTimeout: () => new Error(`timed out after ${ms}ms`),
+    })));
 }
 class VercelSandbox {
     workdir = VERCEL_WORKDIR;

package/dist/sandbox/vercel.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.js","sourceRoot":"","sources":["vercel.ts"],"names":[],"mappings":";;;AAqBA,wDAKC;AA1BD,+EAA+E;AAC/E,qDAAqD;AACrD,6CAAgE;AAChE,+CAA8D;AAC9D,yCAAoC;AAEpC,mEAAkE;AAClE,qDAA8E;AAC9E,yCAAkE;AAClE,yCAAwC;AACxC,+CAA6C;AAC7C,+CAAqC;AACrC,wDAA8E;AAC9E,2CAA6F;AAC7F,mDAA0D;AAC1D,6CAAqH;AACrH;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,CAAU;IAC7C,IAAI,CAAC,YAAY,kBAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;QAClD,OAAO,YAAY,CAAC;IACxB,6DAA6D;IAC7D,OAAO,IAAA,0CAA8B,EAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AACD,iDAAiD;AACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,+CAA+C;AAC/C,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,8CAA8C;AAC9C,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,EAAU;IACzD,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACtB,OAAO;YACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC7B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC;SACL,CAAC,CAAC;IACP,CAAC;YACO,CAAC;QACL,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACL,CAAC;AACD,MAAa,aAAa;IACb,OAAO,GAAG,cAAc,CAAC;IACzB,QAAQ,GAAG,IAAI,CAAC;IACjB,GAAG,CAAgC;IACnC,gBAAgB,CAAU;IAC1B,UAAU,CAAU;IACpB,UAAU,CAAU;IACpB,gBAAgB,CAAS;IACzB,OAAO,CAAS;IACxB,sDAAsD;IACrC,WAAW,CAAoB;IACvC,SAAS,CAAS;IAClB,YAAY,GAAG;QACpB,YAAY,EAAE,IAAA,uCAA0B,EAAC,IAAa,CAAC;QACvD,SAAS,EAAE,yCAA4B;QACvC,OAAO,EAAE,IAAA,uCAA0B,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzD,cAAc,EAAE,IAAA,uCAA0B,EAAC,CAAC,cAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAC3G,kBAAkB,EAAE,IAAA,uCAA0B,EAAC,CAAC,UAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;KAC/G,CAAC;IACF,YAAoB,GAAkC,EAAE,EAAU,EAAE,gBAAoC,EAAE,OAAe,EAAE,cAAiC,EAAE,EAAE,UAAmB,EAAE,UAAmB;QACpM,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,2DAA2D;IAC3D,kBAAkB,CAAC,UAAmB;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAchB,EAAE;QACF,+DAA+D;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;QAClF,+DAA+D;QAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC;QACtC,6CAA6C;QAC7C,kEAAkE;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,gCAAgC,CAAC;QACpF,MAAM,UAAU,GAAG,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,uDAAuD;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,4DAA4D;QAC5D,iBAAiB;QACjB,MAAM,GAAG,GAAG,MAAM,iBAAQ,CAAC,MAAM,CAAC;YAC9B,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,YAAY;YACf,GAAG,UAAU;SACyB,CAAC,CAAC;QAC5C,8DAA8D;QAC9D,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QACpB,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3H,CAAC;IACD,qDAAqD;IACrD,6CAA6C;IACrC,KAAK,CAAC,cAAc,CAAC,cAAkC;QAC3D,IAAI,cAAc,KAAK,SAAS;YAC5B,OAAO;QACX,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7F,IAAI,WAAW,IAAI,cAAc;YAC7B,OAAO;QACX,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,gCAAgC,CAAC;QACpF,MAAM,UAAU,GAAG,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,iBAAQ,CAAC,MAAM,CAAC;gBACjC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE;gBACxC,GAAG,UAAU;aACyB,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;YACxB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;YAClB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,6DAA6D;YAC7D,4DAA4D;YAC5D,uDAAuD;YACvD,yCAAyC;YACzC,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC3E,IAAA,0BAAgB,EAAC;oBACb,GAAG,EAAE,oCAAoC;oBACzC,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,wGAAwG,MAAM,CAAC,OAAO,CAAC,EAAE;oBAClI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;iBAC9D,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,IAAA,wBAAc,EAAC,IAAA,YAAC,EAAC,gBAAgB,EAAE;gBAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnC,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,SAAS;aAC/C,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACT,IAAA,0BAAgB,EAAC;gBACb,GAAG,EAAE,sBAAsB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,IAAA,YAAC,EAAC,qBAAqB,EAAE;oBAC9B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;oBACnC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;iBACrB,CAAC,CAAC,OAAO,EAAE;gBACZ,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;aAC1D,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,cAAsB;QAOvC,MAAM,WAAW,GAAG,GAAW,EAAE;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtE,CAAC,CAAC;QACF,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,cAAc;gBACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACnF,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,GAAG,MAAM,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,OAAO,KAAK,IAAI,cAAc;gBAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;gBACxE,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,uBAAuB,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gDAAgD;wBACnG,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,kDAAkD;iBAC7F,CAAC;QACV,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,OAAO;gBACH,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,sGAAsG;oBAC1G,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aAC1E,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACjF,kEAAkE;QAClE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAuB,EAAE;QACpD,iEAAiE;QACjE,+CAA+C;QAC/C,+DAA+D;QAC/D,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,QAAQ,IAAA,qBAAU,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,MAAM,EAAE;YACrE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,uEAAuE;IAC/D,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,IAAuB,EAAE,IAAoB;QAC/E,0EAA0E;QAC1E,6CAA6C;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,0BAAY,EAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3G,sDAAsD;QACtD,mDAAmD;QACnD,gDAAgD;QAChD,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACvC,GAAG;YACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,GAAG,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM;YAC1B,8DAA8D;YAC9D,uCAAuC;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,uDAAuD;QACvD,sCAAsC;QACtC,IAAI,MAAM;YACN,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM;YACN,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO;YACH,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC9B,CAAC;IACN,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACxF,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,OAAuB,EAAE;QAC3D,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YACJ,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,gEAAgE;IAChE,uDAAuD;IAC/C,KAAK,CAAC,mBAAmB,CAAC,KAAoC,EAAE,SAAkB;QACtF,MAAM,IAAI,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,EAAE,IAAI,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO;QACX,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QACzC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY;QACxB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YACJ,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC;IACf,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAAmB;QAC9C,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACnB,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBAC5C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAoB,EAAE,UAAkB;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,IAAA,mBAAQ,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,SAAuB,EAAE,SAAkB,EAAE,OAE/D,EAAE;QACF,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAA,kCAAiB,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5H,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,MAAoB;QACvD,MAAM,WAAW,GAAG,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAA,oBAAS,EAAC,WAAW,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,SAAuB,EAAE,OAEhE,EAAE;QACF,MAAM,SAAS,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,IAAA,+CAAuB,EAAC;YAC1B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;YAC/D,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;SAClE,CAAC,CAAC;IACP,CAAC;IACD,KAAK,CAAC,IAAI;QACN,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,OAAO;QACT,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACJ;AAnTD,sCAmTC","sourcesContent":["// Vercel Sandbox provider:用 @vercel/sandbox SDK 把 Vercel microVM 当隔离工作区跑 eval。\n// 契约对齐 ../types.ts 的 Sandbox 接口,与 DockerSandbox 可互换。\nimport { Sandbox as VSandbox, APIError } from \"@vercel/sandbox\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { CommandResult, CommandOptions, SandboxReuseCapability, SuccessfulCommandResult, } from \"../types.ts\";\nimport { downloadDirectoryByList } from \"./download-directory.ts\";\nimport { collectLocalFiles, type CollectedLocalFile } from \"./local-files.ts\";\nimport { resolveLocalPath, resolveSandboxPath } from \"./paths.ts\";\nimport { shellQuote } from \"./shell.ts\";\nimport { commandLimit } from \"./deadline.ts\";\nimport { t } from \"../i18n/index.ts\";\nimport { reportActivity, reportDiagnostic } from \"../runner/feedback/sink.ts\";\nimport { classifyProvisionErrorFallback, type SandboxProvisionErrorKind } from \"./errors.ts\";\nimport { successfulCommandResult } from \"./operations.ts\";\nimport { supportedBackendCapability, unsupportedBackendCapability, type SandboxProviderBackend } from \"./backend.ts\";\n/**\n * vercel SDK 对单次 fetch 的 429 已有内部重试(见 @vercel/sandbox 的 with-retry.js,\n * 5 次指数退避);这里再分类是为了给 create() 整体重试兜底——耗尽内部重试后仍返回 429\n * 响应的 APIError,或 create() 轮询 session 状态过程里撞到的限流,都会走到这里。\n */\nexport function classifyProvisionError(e: unknown): SandboxProvisionErrorKind {\n    if (e instanceof APIError && e.response.status === 429)\n        return \"rate_limit\";\n    // SDK 没有按元数据检索实例的通道:歧义类不重试、第一次抛出(见 retry.ts 的 reconcile 语义)。\n    return classifyProvisionErrorFallback(e);\n}\n// Vercel Sandbox 的默认工作区路径(SDK writeFiles 默认落这里)。\nconst VERCEL_WORKDIR = \"/vercel/sandbox\";\n// rotate 时停掉旧 session 的等待上限:stop 挂起时不无限拖住当前命令。\nconst STOP_OLD_SESSION_TIMEOUT_MS = 15000;\n/** 给 promise 套超时;到点 reject,并清掉计时器避免拖住事件循环。 */\nasync function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    try {\n        return await Promise.race([\n            promise,\n            new Promise<never>((_, reject) => {\n                timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);\n            }),\n        ]);\n    }\n    finally {\n        clearTimeout(timer);\n    }\n}\nexport class VercelSandbox implements SandboxProviderBackend, SandboxReuseCapability {\n    readonly workdir = VERCEL_WORKDIR;\n    readonly otlpHost = null;\n    private vsb: InstanceType<typeof VSandbox>;\n    private commandTimeoutMs?: number;\n    private deadlineAt?: number;\n    private lifetimeMs?: number;\n    private sessionCreatedAt: number;\n    private runtime: string;\n    /** factory `pathPrepend`;按声明顺序前置到受管 PATH,省略 = 空数组。 */\n    private readonly pathPrepend: readonly string[];\n    readonly sandboxId: string;\n    readonly capabilities = {\n        rootCommands: supportedBackendCapability(true as const),\n        appendLog: unsupportedBackendCapability,\n        suspend: supportedBackendCapability(() => this.suspend()),\n        ensureLifetime: supportedBackendCapability((minRemainingMs: number) => this.ensureLifetime(minRemainingMs)),\n        setCommandDeadline: supportedBackendCapability((deadlineAt?: number) => this.setCommandDeadline(deadlineAt)),\n    };\n    private constructor(vsb: InstanceType<typeof VSandbox>, id: string, commandTimeoutMs: number | undefined, runtime: string, pathPrepend: readonly string[] = [], lifetimeMs?: number, deadlineAt?: number) {\n        this.vsb = vsb;\n        this.sandboxId = id;\n        this.commandTimeoutMs = commandTimeoutMs;\n        this.deadlineAt = deadlineAt;\n        this.sessionCreatedAt = Date.now();\n        this.runtime = runtime;\n        this.pathPrepend = pathPrepend;\n        this.lifetimeMs = lifetimeMs;\n    }\n    /** 复用下由池在每次借出时换成承接者自己的 deadline(见 sandbox/deadline.ts)。 */\n    setCommandDeadline(deadlineAt?: number): void {\n        this.deadlineAt = deadlineAt;\n    }\n    static async create(opts: {\n        timeout?: number;\n        /** attempt deadline 的截止时刻(epoch ms);单条命令按剩余量取上限。 */\n        deadlineAt?: number;\n        runtime?: \"node20\" | \"node24\";\n        snapshotId?: string;\n        /** 实例 session 寿命；由当前 Vercel project plan 在 create 时真实校验。 */\n        lifetimeMs?: number;\n        feedback?: import(\"../types.ts\").ScopedFeedback;\n        /**\n         * 按序前置到受管 `PATH` 的目录;省略 = 不改 PATH(见 docs/feature/sandbox/library.md\n         * 「PATH:受管变量与 pathPrepend」)。\n         */\n        pathPrepend?: readonly string[];\n    } = {}): Promise<VercelSandbox> {\n        // Vercel 支持 node22/node24/node26/python3.13;node20 回退到 node22。\n        const runtime = opts.runtime === \"node20\" ? \"node22\" : (opts.runtime ?? \"node24\");\n        // 单条命令没有 provider 级默认:上限恒从 attempt deadline 派生(见 deadline.ts)。\n        const commandTimeoutMs = opts.timeout;\n        // 凭据:优先从 env 显式传入(绕过 OIDC flow,非 TTY 环境也能用)。\n        // 需要同时设 VERCEL_API_TOKEN + VERCEL_TEAM_ID + VERCEL_PROJECT_ID 三个。\n        const token = process.env.VERCEL_API_TOKEN;\n        const teamId = process.env.VERCEL_TEAM_ID;\n        const projectId = process.env.VERCEL_PROJECT_ID ?? \"vercel-sandbox-default-project\";\n        const credParams = token && teamId ? { token, teamId, projectId } : {};\n        // 给了 snapshotId 就从快照起 microVM(预制模板:烘焙好 agent CLI 的快照)。\n        const sourceParams = opts.snapshotId ? { source: { type: \"run\", snapshotId: opts.snapshotId } } : {};\n        // 未声明 lifetimeMs 时交给 provider 选择默认值；声明后原值交给 provider 校验，绝不按\n        // 本地假定的账号上限静默压短。\n        const vsb = await VSandbox.create({\n            runtime,\n            ...(opts.lifetimeMs !== undefined ? { timeout: opts.lifetimeMs } : {}),\n            ...sourceParams,\n            ...credParams,\n        } as Parameters<typeof VSandbox.create>[0]);\n        // sandboxId = 沙箱的持久 name(留存唤醒的查找键),不是当前 session 的 sessionId——\n        // session 在 rotate / stop-resume 之间会变,name 才是 `Sandbox.get({ name })` 能找回的\n        // 稳定身份(SDK 与官方文档都按 name 索引,见 vercel.com/docs/sandbox/cli-reference)。\n        const id = vsb.name;\n        return new VercelSandbox(vsb, id, commandTimeoutMs, runtime, opts.pathPrepend ?? [], opts.lifetimeMs, opts.deadlineAt);\n    }\n    // 当前 session 的真实剩余寿命不足以覆盖即将执行的命令时，拍快照并请求一条新 session。\n    // 是否允许该请求由当前 project plan 裁决，不维护一张会漂移的本地上限表。\n    private async rotateIfNeeded(minRemainingMs: number | undefined): Promise<void> {\n        if (minRemainingMs === undefined)\n            return;\n        const currentSession = this.vsb.currentSession();\n        const remainingMs = currentSession.createdAt.getTime() + currentSession.timeout - Date.now();\n        if (remainingMs >= minRemainingMs)\n            return;\n        const requestedLifetimeMs = this.lifetimeMs ?? Math.max(currentSession.timeout, minRemainingMs);\n        const elapsed = Date.now() - this.sessionCreatedAt;\n        const token = process.env.VERCEL_API_TOKEN;\n        const teamId = process.env.VERCEL_TEAM_ID;\n        const projectId = process.env.VERCEL_PROJECT_ID ?? \"vercel-sandbox-default-project\";\n        const credParams = token && teamId ? { token, teamId, projectId } : {};\n        try {\n            const snap = await this.vsb.snapshot();\n            const snapshotId = snap.snapshotId;\n            const newVsb = await VSandbox.create({\n                runtime: this.runtime,\n                timeout: requestedLifetimeMs,\n                source: { type: \"snapshot\", snapshotId },\n                ...credParams,\n            } as Parameters<typeof VSandbox.create>[0]);\n            const oldVsb = this.vsb;\n            this.vsb = newVsb;\n            this.sessionCreatedAt = Date.now();\n            // 旧 session 的 microVM 不随快照 / 新 session 创建自动回收,必须显式 stop,否则每次\n            // rotate 都泄漏一台在计费的 microVM。stop 与新 session 无数据依赖,不 await ——\n            // 挂起的 stop(最长 15s)不该拖住触发 rotate 的那条命令,还烧新 session 的时长。\n            // 失败只警告不静默(旧的到 session timeout 也会被平台回收)。\n            void withTimeout(oldVsb.stop(), STOP_OLD_SESSION_TIMEOUT_MS).catch((stopErr) => {\n                reportDiagnostic({\n                    key: \"vercel-stop-rotated-session-failed\",\n                    severity: \"warning\",\n                    message: `[VercelSandbox] warning: failed to stop rotated-out session, microVM may leak until session timeout: ${String(stopErr)}`,\n                    data: { sandboxId: this.sandboxId, error: String(stopErr) },\n                });\n            });\n            reportActivity(t(\"vercel.rotated\", {\n                seconds: Math.round(elapsed / 1000),\n                sessionId: newVsb.currentSession().sessionId,\n            }).trimEnd());\n        }\n        catch (err) {\n            reportDiagnostic({\n                key: \"vercel-rotate-failed\",\n                severity: \"warning\",\n                message: t(\"vercel.rotateFailed\", {\n                    seconds: Math.round(elapsed / 1000),\n                    error: String(err),\n                }).trimEnd(),\n                data: { sandboxId: this.sandboxId, error: String(err) },\n            });\n        }\n    }\n    /**\n     * 寿命确认:两次都读**当前 session 的远端元数据**(`createdAt + timeout`),不拿本地时钟记账,\n     * 也不复读我们请求的续期值——vercel 的 plan 上限决定实际给多少,`extendTimeout` 在超出计划\n     * 上限时直接抛 HTTP 400(本仓库真实跑分里恒抛,rotateIfNeeded 那条快照轮换路径就是为它写的)。\n     * 请求值当答案会把「平台不给续」伪装成「续上了」,而症状要到实例中途消失才出现。\n     */\n    async ensureLifetime(minRemainingMs: number): Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }> {\n        const remainingMs = (): number => {\n            const session = this.vsb.currentSession();\n            return session.createdAt.getTime() + session.timeout - Date.now();\n        };\n        try {\n            const before = remainingMs();\n            if (before >= minRemainingMs)\n                return { ready: true, expiresAt: new Date(Date.now() + before).toISOString() };\n            await this.vsb.extendTimeout(minRemainingMs - before);\n            const after = remainingMs();\n            return after >= minRemainingMs\n                ? { ready: true, expiresAt: new Date(Date.now() + after).toISOString() }\n                : {\n                    ready: false,\n                    reason: `vercel granted only ${Math.round(after / 1000)}s after extendTimeout; the next attempt needs ` +\n                        `${Math.round(minRemainingMs / 1000)}s (the plan's maximum execution timeout caps it)`,\n                };\n        }\n        catch (e) {\n            return {\n                ready: false,\n                reason: \"vercel refused to extend this sandbox's session (extendTimeout is rejected above the plan's maximum \" +\n                    `execution timeout): ${e instanceof Error ? e.message : String(e)}`,\n            };\n        }\n    }\n    async runCommand(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<CommandResult> {\n        // pathPrepend 只能在 bash 里靠 `$PATH` 展开;直接 exec 的 cmd/args 不经 shell,\n        // 因此路过 runShell 走同一条 bash -c 通道(与 docker `opts.stream` 的 tee 重路由同构)。\n        if (this.pathPrepend.length > 0) {\n            const joined = [cmd, ...args.map(shellQuote)].join(\" \");\n            return this.runShell(joined, opts);\n        }\n        return this.execDirect(cmd, args, opts);\n    }\n    async runShell(script: string, opts: CommandOptions = {}): Promise<CommandResult> {\n        // pathPrepend 是受管 PATH,在脚本自己的 shell 里对 `$PATH` 前置——env 走的是 SDK 的\n        // env 参数(可能被 opts.env.PATH 覆盖),而这一行在它之后执行,始终生效\n        // (见 docs/feature/sandbox/library.md「PATH:受管变量与 pathPrepend」)。\n        const scriptWithPath = this.pathPrepend.length > 0\n            ? `PATH=${shellQuote(this.pathPrepend.join(\":\"))}:\"$PATH\"\\n${script}`\n            : script;\n        return this.execDirect(\"bash\", [\"-c\", scriptWithPath], opts);\n    }\n    /** 实际发起 Vercel `runCommand` 调用的唯一出口;`runCommand`/`runShell` 都收敛到这里。 */\n    private async execDirect(cmd: string, args: readonly string[], opts: CommandOptions): Promise<CommandResult> {\n        // Vercel 命令级只认 `user: \"root\"`(映射 `sudo: true`);其它显式值报错,省略 = `sudo: false`\n        // (见 docs/feature/sandbox/library.md「执行身份」)。\n        if (opts.user !== undefined && opts.user !== \"root\") {\n            throw new Error(t(\"vercel.userUnsupported\", { user: opts.user }));\n        }\n        const limit = commandLimit(opts, { commandTimeoutMs: this.commandTimeoutMs, deadlineAt: this.deadlineAt });\n        // 只有 runner 交付的 attempt deadline 才是「当前物理实例必须承接多久」的请求。\n        // 普通 provider 调用或显式的单命令 timeout 只是这条命令的执行上限，不能为此读取\n        // currentSession()/轮换实例；前者在留存、文件传输等常规操作中甚至未必可用。\n        await this.rotateIfNeeded(this.deadlineAt === undefined ? undefined : limit.timeoutMs);\n        const finished = await this.vsb.runCommand({\n            cmd,\n            args: [...args],\n            cwd: resolveSandboxPath(this.workdir, opts.cwd),\n            env: opts.env,\n            sudo: opts.user === \"root\",\n            // per-command 上限从 attempt deadline 的剩余量派生(显式传 timeout 时按显式值);\n            // 没有 deadline 就不设,provider 层不发明一条自己的线。\n            ...(limit.timeoutMs !== undefined ? { timeoutMs: limit.timeoutMs } : {}),\n            signal: opts.signal,\n        });\n        const stdout = await finished.stdout();\n        const stderr = await finished.stderr();\n        // Vercel SDK 的命令 API 只在结束后给完整输出；仍兑现 CommandOptions 回调的\n        // 「至少一次」语义，让 adapter 不必按 provider 分叉。\n        if (stdout)\n            await opts.onStdout?.(stdout);\n        if (stderr)\n            await opts.onStderr?.(stderr);\n        return {\n            stdout,\n            stderr,\n            exitCode: finished.exitCode,\n        };\n    }\n    async runCommandOrThrow(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runCommand(cmd, args, opts), opts.sensitiveValues);\n    }\n    async runShellOrThrow(script: string, opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runShell(script, opts), opts.sensitiveValues);\n    }\n    async readText(path: string): Promise<string> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        const buf = await this.vsb.readFileToBuffer({ path: absPath });\n        if (!buf)\n            throw new Error(t(\"vercel.fileNotFound\", { path: absPath }));\n        return buf.toString(\"utf8\");\n    }\n    async pathExists(path: string): Promise<boolean> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        return this.vsb.fs.exists(absPath);\n    }\n    // targetDir 已由 paths.ts 的 normalizeSandboxPaths 解析成绝对路径;这里再解析一次\n    // 只是对直接使用 provider 实例(未包 normalize)的幂等防御,提到 map 外只算一次。\n    private async writeCollectedFiles(files: readonly CollectedLocalFile[], targetDir?: string): Promise<void> {\n        const base = resolveSandboxPath(this.workdir, targetDir);\n        const entries = files.map(({ path, content }) => ({\n            path: resolveSandboxPath(base, path),\n            content: Buffer.from(content),\n        }));\n        if (entries.length === 0)\n            return;\n        await this.vsb.writeFiles(entries);\n    }\n    async writeText(path: string, content: string): Promise<void> {\n        await this.vsb.writeFiles([{ path: resolveSandboxPath(this.workdir, path), content }]);\n    }\n    async readBytes(path: string): Promise<Uint8Array> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        const buf = await this.vsb.readFileToBuffer({ path: absPath });\n        if (!buf)\n            throw new Error(t(\"vercel.fileNotFound\", { path: absPath }));\n        return buf;\n    }\n    async writeBytes(path: string, content: Uint8Array): Promise<void> {\n        await this.vsb.writeFiles([{\n                path: resolveSandboxPath(this.workdir, path),\n                content: Buffer.from(content),\n            }]);\n    }\n    async uploadFile(source: string | URL, targetPath: string): Promise<void> {\n        await this.writeBytes(targetPath, await readFile(resolveLocalPath(undefined, source)));\n    }\n    async uploadDirectory(sourceDir: string | URL, targetDir?: string, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        await this.writeCollectedFiles(await collectLocalFiles(resolveLocalPath(undefined, sourceDir), opts.ignore), targetDir);\n    }\n    /**\n     * 递归下载沙箱内一个目录到本地磁盘,与 uploadDirectory 对称:两阶段模板(与 e2b provider\n     * 共用)——find 列路径 + 逐文件 readFileToBuffer(独立 HTTP GET)读取,写回本地磁盘。\n     */\n    async downloadFile(sourcePath: string, target: string | URL): Promise<void> {\n        const destination = resolveLocalPath(undefined, target);\n        await mkdir(dirname(destination), { recursive: true });\n        await writeFile(destination, await this.readBytes(sourcePath));\n    }\n    async downloadDirectory(sourceDir: string, targetDir: string | URL, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        const remoteDir = resolveSandboxPath(this.workdir, sourceDir);\n        await downloadDirectoryByList({\n            localDir: resolveLocalPath(undefined, targetDir),\n            ignore: opts.ignore ?? [],\n            runShell: (script) => this.runShell(script, { cwd: remoteDir }),\n            readOne: (relPath) => this.readBytes(`${remoteDir}/${relPath}`),\n        });\n    }\n    async stop(): Promise<void> {\n        await this.vsb.stop();\n    }\n    /**\n     * 留存休眠(suspend):vercel `stop`——sandbox 默认持久,stop 保存文件系统,之后经\n     * `Sandbox.get` 恢复(SDK 原生能力);内存态不保留,唤醒后进程要重新启动。\n     */\n    async suspend(): Promise<void> {\n        await this.vsb.stop();\n    }\n}\n"]}
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["vercel.ts"],"names":[],"mappings":";;;AAsBA,wDAKC;AA3BD,+EAA+E;AAC/E,qDAAqD;AACrD,6CAAgE;AAChE,mCAAgC;AAChC,+CAA8D;AAC9D,yCAAoC;AAEpC,mEAAkE;AAClE,qDAA8E;AAC9E,yCAAkE;AAClE,yCAAwC;AACxC,+CAA6C;AAC7C,+CAAqC;AACrC,wDAA8E;AAC9E,2CAA6F;AAC7F,mDAA0D;AAC1D,6CAAqH;AACrH;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,CAAU;IAC7C,IAAI,CAAC,YAAY,kBAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;QAClD,OAAO,YAAY,CAAC;IACxB,6DAA6D;IAC7D,OAAO,IAAA,0CAA8B,EAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AACD,iDAAiD;AACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,+CAA+C;AAC/C,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,+EAA+E;AAC/E,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACnD,OAAO,eAAM,CAAC,UAAU,CAAC,eAAM,CAAC,UAAU,CAAC;QACvC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;KAC1B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,WAAW,CAAC;QACvB,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC;KACxD,CAAC,CAAC,CAAC,CAAC;AACT,CAAC;AACD,MAAa,aAAa;IACb,OAAO,GAAG,cAAc,CAAC;IACzB,QAAQ,GAAG,IAAI,CAAC;IACjB,GAAG,CAAgC;IACnC,gBAAgB,CAAU;IAC1B,UAAU,CAAU;IACpB,UAAU,CAAU;IACpB,gBAAgB,CAAS;IACzB,OAAO,CAAS;IACxB,sDAAsD;IACrC,WAAW,CAAoB;IACvC,SAAS,CAAS;IAClB,YAAY,GAAG;QACpB,YAAY,EAAE,IAAA,uCAA0B,EAAC,IAAa,CAAC;QACvD,SAAS,EAAE,yCAA4B;QACvC,OAAO,EAAE,IAAA,uCAA0B,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzD,cAAc,EAAE,IAAA,uCAA0B,EAAC,CAAC,cAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAC3G,kBAAkB,EAAE,IAAA,uCAA0B,EAAC,CAAC,UAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;KAC/G,CAAC;IACF,YAAoB,GAAkC,EAAE,EAAU,EAAE,gBAAoC,EAAE,OAAe,EAAE,cAAiC,EAAE,EAAE,UAAmB,EAAE,UAAmB;QACpM,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,2DAA2D;IAC3D,kBAAkB,CAAC,UAAmB;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAchB,EAAE;QACF,+DAA+D;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;QAClF,+DAA+D;QAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC;QACtC,6CAA6C;QAC7C,kEAAkE;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,gCAAgC,CAAC;QACpF,MAAM,UAAU,GAAG,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,uDAAuD;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,4DAA4D;QAC5D,iBAAiB;QACjB,MAAM,GAAG,GAAG,MAAM,iBAAQ,CAAC,MAAM,CAAC;YAC9B,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,YAAY;YACf,GAAG,UAAU;SACyB,CAAC,CAAC;QAC5C,8DAA8D;QAC9D,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QACpB,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3H,CAAC;IACD,qDAAqD;IACrD,6CAA6C;IACrC,KAAK,CAAC,cAAc,CAAC,cAAkC;QAC3D,IAAI,cAAc,KAAK,SAAS;YAC5B,OAAO;QACX,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7F,IAAI,WAAW,IAAI,cAAc;YAC7B,OAAO;QACX,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,gCAAgC,CAAC;QACpF,MAAM,UAAU,GAAG,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,iBAAQ,CAAC,MAAM,CAAC;gBACjC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE;gBACxC,GAAG,UAAU;aACyB,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;YACxB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;YAClB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,6DAA6D;YAC7D,4DAA4D;YAC5D,uDAAuD;YACvD,yCAAyC;YACzC,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC3E,IAAA,0BAAgB,EAAC;oBACb,GAAG,EAAE,oCAAoC;oBACzC,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,wGAAwG,MAAM,CAAC,OAAO,CAAC,EAAE;oBAClI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;iBAC9D,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,IAAA,wBAAc,EAAC,IAAA,YAAC,EAAC,gBAAgB,EAAE;gBAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnC,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,SAAS;aAC/C,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACT,IAAA,0BAAgB,EAAC;gBACb,GAAG,EAAE,sBAAsB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,IAAA,YAAC,EAAC,qBAAqB,EAAE;oBAC9B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;oBACnC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;iBACrB,CAAC,CAAC,OAAO,EAAE;gBACZ,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;aAC1D,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,cAAsB;QAOvC,MAAM,WAAW,GAAG,GAAW,EAAE;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtE,CAAC,CAAC;QACF,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,cAAc;gBACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACnF,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,GAAG,MAAM,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,OAAO,KAAK,IAAI,cAAc;gBAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;gBACxE,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,uBAAuB,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gDAAgD;wBACnG,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,kDAAkD;iBAC7F,CAAC;QACV,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,OAAO;gBACH,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,sGAAsG;oBAC1G,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aAC1E,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACjF,kEAAkE;QAClE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAuB,EAAE;QACpD,iEAAiE;QACjE,+CAA+C;QAC/C,+DAA+D;QAC/D,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,QAAQ,IAAA,qBAAU,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,MAAM,EAAE;YACrE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,uEAAuE;IAC/D,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,IAAuB,EAAE,IAAoB;QAC/E,0EAA0E;QAC1E,6CAA6C;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,0BAAY,EAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3G,sDAAsD;QACtD,mDAAmD;QACnD,gDAAgD;QAChD,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACvC,GAAG;YACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,GAAG,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM;YAC1B,8DAA8D;YAC9D,uCAAuC;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,uDAAuD;QACvD,sCAAsC;QACtC,IAAI,MAAM;YACN,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM;YACN,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO;YACH,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC9B,CAAC;IACN,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACxF,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,OAAuB,EAAE;QAC3D,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YACJ,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,gEAAgE;IAChE,uDAAuD;IAC/C,KAAK,CAAC,mBAAmB,CAAC,KAAoC,EAAE,SAAkB;QACtF,MAAM,IAAI,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,EAAE,IAAI,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO;QACX,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QACzC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY;QACxB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YACJ,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC;IACf,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAAmB;QAC9C,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACnB,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBAC5C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAoB,EAAE,UAAkB;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,IAAA,mBAAQ,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,SAAuB,EAAE,SAAkB,EAAE,OAE/D,EAAE;QACF,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAA,kCAAiB,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5H,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,MAAoB;QACvD,MAAM,WAAW,GAAG,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAA,oBAAS,EAAC,WAAW,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,SAAuB,EAAE,OAEhE,EAAE;QACF,MAAM,SAAS,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,IAAA,+CAAuB,EAAC;YAC1B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;YAC/D,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;SAClE,CAAC,CAAC;IACP,CAAC;IACD,KAAK,CAAC,IAAI;QACN,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,OAAO;QACT,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACJ;AAnTD,sCAmTC","sourcesContent":["// Vercel Sandbox provider:用 @vercel/sandbox SDK 把 Vercel microVM 当隔离工作区跑 eval。\n// 契约对齐 ../types.ts 的 Sandbox 接口,与 DockerSandbox 可互换。\nimport { Sandbox as VSandbox, APIError } from \"@vercel/sandbox\";\nimport { Effect } from \"effect\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { CommandResult, CommandOptions, SandboxReuseCapability, SuccessfulCommandResult, } from \"../types.ts\";\nimport { downloadDirectoryByList } from \"./download-directory.ts\";\nimport { collectLocalFiles, type CollectedLocalFile } from \"./local-files.ts\";\nimport { resolveLocalPath, resolveSandboxPath } from \"./paths.ts\";\nimport { shellQuote } from \"./shell.ts\";\nimport { commandLimit } from \"./deadline.ts\";\nimport { t } from \"../i18n/index.ts\";\nimport { reportActivity, reportDiagnostic } from \"../runner/feedback/sink.ts\";\nimport { classifyProvisionErrorFallback, type SandboxProvisionErrorKind } from \"./errors.ts\";\nimport { successfulCommandResult } from \"./operations.ts\";\nimport { supportedBackendCapability, unsupportedBackendCapability, type SandboxProviderBackend } from \"./backend.ts\";\n/**\n * vercel SDK 对单次 fetch 的 429 已有内部重试(见 @vercel/sandbox 的 with-retry.js,\n * 5 次指数退避);这里再分类是为了给 create() 整体重试兜底——耗尽内部重试后仍返回 429\n * 响应的 APIError,或 create() 轮询 session 状态过程里撞到的限流,都会走到这里。\n */\nexport function classifyProvisionError(e: unknown): SandboxProvisionErrorKind {\n    if (e instanceof APIError && e.response.status === 429)\n        return \"rate_limit\";\n    // SDK 没有按元数据检索实例的通道:歧义类不重试、第一次抛出(见 retry.ts 的 reconcile 语义)。\n    return classifyProvisionErrorFallback(e);\n}\n// Vercel Sandbox 的默认工作区路径(SDK writeFiles 默认落这里)。\nconst VERCEL_WORKDIR = \"/vercel/sandbox\";\n// rotate 时停掉旧 session 的等待上限:stop 挂起时不无限拖住当前命令。\nconst STOP_OLD_SESSION_TIMEOUT_MS = 15000;\n/** 给 promise 套超时;到点 fail。计时用 Effect Clock/Sleep,超时分支中断等待 fiber,不再手工管 timer。 */\nfunction withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {\n    return Effect.runPromise(Effect.tryPromise({\n        try: () => promise,\n        catch: (cause) => cause,\n    }).pipe(Effect.timeoutFail({\n        duration: ms,\n        onTimeout: () => new Error(`timed out after ${ms}ms`),\n    })));\n}\nexport class VercelSandbox implements SandboxProviderBackend, SandboxReuseCapability {\n    readonly workdir = VERCEL_WORKDIR;\n    readonly otlpHost = null;\n    private vsb: InstanceType<typeof VSandbox>;\n    private commandTimeoutMs?: number;\n    private deadlineAt?: number;\n    private lifetimeMs?: number;\n    private sessionCreatedAt: number;\n    private runtime: string;\n    /** factory `pathPrepend`;按声明顺序前置到受管 PATH,省略 = 空数组。 */\n    private readonly pathPrepend: readonly string[];\n    readonly sandboxId: string;\n    readonly capabilities = {\n        rootCommands: supportedBackendCapability(true as const),\n        appendLog: unsupportedBackendCapability,\n        suspend: supportedBackendCapability(() => this.suspend()),\n        ensureLifetime: supportedBackendCapability((minRemainingMs: number) => this.ensureLifetime(minRemainingMs)),\n        setCommandDeadline: supportedBackendCapability((deadlineAt?: number) => this.setCommandDeadline(deadlineAt)),\n    };\n    private constructor(vsb: InstanceType<typeof VSandbox>, id: string, commandTimeoutMs: number | undefined, runtime: string, pathPrepend: readonly string[] = [], lifetimeMs?: number, deadlineAt?: number) {\n        this.vsb = vsb;\n        this.sandboxId = id;\n        this.commandTimeoutMs = commandTimeoutMs;\n        this.deadlineAt = deadlineAt;\n        this.sessionCreatedAt = Date.now();\n        this.runtime = runtime;\n        this.pathPrepend = pathPrepend;\n        this.lifetimeMs = lifetimeMs;\n    }\n    /** 复用下由池在每次借出时换成承接者自己的 deadline(见 sandbox/deadline.ts)。 */\n    setCommandDeadline(deadlineAt?: number): void {\n        this.deadlineAt = deadlineAt;\n    }\n    static async create(opts: {\n        timeout?: number;\n        /** attempt deadline 的截止时刻(epoch ms);单条命令按剩余量取上限。 */\n        deadlineAt?: number;\n        runtime?: \"node20\" | \"node24\";\n        snapshotId?: string;\n        /** 实例 session 寿命；由当前 Vercel project plan 在 create 时真实校验。 */\n        lifetimeMs?: number;\n        feedback?: import(\"../types.ts\").ScopedFeedback;\n        /**\n         * 按序前置到受管 `PATH` 的目录;省略 = 不改 PATH(见 docs/feature/sandbox/library.md\n         * 「PATH:受管变量与 pathPrepend」)。\n         */\n        pathPrepend?: readonly string[];\n    } = {}): Promise<VercelSandbox> {\n        // Vercel 支持 node22/node24/node26/python3.13;node20 回退到 node22。\n        const runtime = opts.runtime === \"node20\" ? \"node22\" : (opts.runtime ?? \"node24\");\n        // 单条命令没有 provider 级默认:上限恒从 attempt deadline 派生(见 deadline.ts)。\n        const commandTimeoutMs = opts.timeout;\n        // 凭据:优先从 env 显式传入(绕过 OIDC flow,非 TTY 环境也能用)。\n        // 需要同时设 VERCEL_API_TOKEN + VERCEL_TEAM_ID + VERCEL_PROJECT_ID 三个。\n        const token = process.env.VERCEL_API_TOKEN;\n        const teamId = process.env.VERCEL_TEAM_ID;\n        const projectId = process.env.VERCEL_PROJECT_ID ?? \"vercel-sandbox-default-project\";\n        const credParams = token && teamId ? { token, teamId, projectId } : {};\n        // 给了 snapshotId 就从快照起 microVM(预制模板:烘焙好 agent CLI 的快照)。\n        const sourceParams = opts.snapshotId ? { source: { type: \"run\", snapshotId: opts.snapshotId } } : {};\n        // 未声明 lifetimeMs 时交给 provider 选择默认值；声明后原值交给 provider 校验，绝不按\n        // 本地假定的账号上限静默压短。\n        const vsb = await VSandbox.create({\n            runtime,\n            ...(opts.lifetimeMs !== undefined ? { timeout: opts.lifetimeMs } : {}),\n            ...sourceParams,\n            ...credParams,\n        } as Parameters<typeof VSandbox.create>[0]);\n        // sandboxId = 沙箱的持久 name(留存唤醒的查找键),不是当前 session 的 sessionId——\n        // session 在 rotate / stop-resume 之间会变,name 才是 `Sandbox.get({ name })` 能找回的\n        // 稳定身份(SDK 与官方文档都按 name 索引,见 vercel.com/docs/sandbox/cli-reference)。\n        const id = vsb.name;\n        return new VercelSandbox(vsb, id, commandTimeoutMs, runtime, opts.pathPrepend ?? [], opts.lifetimeMs, opts.deadlineAt);\n    }\n    // 当前 session 的真实剩余寿命不足以覆盖即将执行的命令时，拍快照并请求一条新 session。\n    // 是否允许该请求由当前 project plan 裁决，不维护一张会漂移的本地上限表。\n    private async rotateIfNeeded(minRemainingMs: number | undefined): Promise<void> {\n        if (minRemainingMs === undefined)\n            return;\n        const currentSession = this.vsb.currentSession();\n        const remainingMs = currentSession.createdAt.getTime() + currentSession.timeout - Date.now();\n        if (remainingMs >= minRemainingMs)\n            return;\n        const requestedLifetimeMs = this.lifetimeMs ?? Math.max(currentSession.timeout, minRemainingMs);\n        const elapsed = Date.now() - this.sessionCreatedAt;\n        const token = process.env.VERCEL_API_TOKEN;\n        const teamId = process.env.VERCEL_TEAM_ID;\n        const projectId = process.env.VERCEL_PROJECT_ID ?? \"vercel-sandbox-default-project\";\n        const credParams = token && teamId ? { token, teamId, projectId } : {};\n        try {\n            const snap = await this.vsb.snapshot();\n            const snapshotId = snap.snapshotId;\n            const newVsb = await VSandbox.create({\n                runtime: this.runtime,\n                timeout: requestedLifetimeMs,\n                source: { type: \"snapshot\", snapshotId },\n                ...credParams,\n            } as Parameters<typeof VSandbox.create>[0]);\n            const oldVsb = this.vsb;\n            this.vsb = newVsb;\n            this.sessionCreatedAt = Date.now();\n            // 旧 session 的 microVM 不随快照 / 新 session 创建自动回收,必须显式 stop,否则每次\n            // rotate 都泄漏一台在计费的 microVM。stop 与新 session 无数据依赖,不 await ——\n            // 挂起的 stop(最长 15s)不该拖住触发 rotate 的那条命令,还烧新 session 的时长。\n            // 失败只警告不静默(旧的到 session timeout 也会被平台回收)。\n            void withTimeout(oldVsb.stop(), STOP_OLD_SESSION_TIMEOUT_MS).catch((stopErr) => {\n                reportDiagnostic({\n                    key: \"vercel-stop-rotated-session-failed\",\n                    severity: \"warning\",\n                    message: `[VercelSandbox] warning: failed to stop rotated-out session, microVM may leak until session timeout: ${String(stopErr)}`,\n                    data: { sandboxId: this.sandboxId, error: String(stopErr) },\n                });\n            });\n            reportActivity(t(\"vercel.rotated\", {\n                seconds: Math.round(elapsed / 1000),\n                sessionId: newVsb.currentSession().sessionId,\n            }).trimEnd());\n        }\n        catch (err) {\n            reportDiagnostic({\n                key: \"vercel-rotate-failed\",\n                severity: \"warning\",\n                message: t(\"vercel.rotateFailed\", {\n                    seconds: Math.round(elapsed / 1000),\n                    error: String(err),\n                }).trimEnd(),\n                data: { sandboxId: this.sandboxId, error: String(err) },\n            });\n        }\n    }\n    /**\n     * 寿命确认:两次都读**当前 session 的远端元数据**(`createdAt + timeout`),不拿本地时钟记账,\n     * 也不复读我们请求的续期值——vercel 的 plan 上限决定实际给多少,`extendTimeout` 在超出计划\n     * 上限时直接抛 HTTP 400(本仓库真实跑分里恒抛,rotateIfNeeded 那条快照轮换路径就是为它写的)。\n     * 请求值当答案会把「平台不给续」伪装成「续上了」,而症状要到实例中途消失才出现。\n     */\n    async ensureLifetime(minRemainingMs: number): Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }> {\n        const remainingMs = (): number => {\n            const session = this.vsb.currentSession();\n            return session.createdAt.getTime() + session.timeout - Date.now();\n        };\n        try {\n            const before = remainingMs();\n            if (before >= minRemainingMs)\n                return { ready: true, expiresAt: new Date(Date.now() + before).toISOString() };\n            await this.vsb.extendTimeout(minRemainingMs - before);\n            const after = remainingMs();\n            return after >= minRemainingMs\n                ? { ready: true, expiresAt: new Date(Date.now() + after).toISOString() }\n                : {\n                    ready: false,\n                    reason: `vercel granted only ${Math.round(after / 1000)}s after extendTimeout; the next attempt needs ` +\n                        `${Math.round(minRemainingMs / 1000)}s (the plan's maximum execution timeout caps it)`,\n                };\n        }\n        catch (e) {\n            return {\n                ready: false,\n                reason: \"vercel refused to extend this sandbox's session (extendTimeout is rejected above the plan's maximum \" +\n                    `execution timeout): ${e instanceof Error ? e.message : String(e)}`,\n            };\n        }\n    }\n    async runCommand(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<CommandResult> {\n        // pathPrepend 只能在 bash 里靠 `$PATH` 展开;直接 exec 的 cmd/args 不经 shell,\n        // 因此路过 runShell 走同一条 bash -c 通道(与 docker `opts.stream` 的 tee 重路由同构)。\n        if (this.pathPrepend.length > 0) {\n            const joined = [cmd, ...args.map(shellQuote)].join(\" \");\n            return this.runShell(joined, opts);\n        }\n        return this.execDirect(cmd, args, opts);\n    }\n    async runShell(script: string, opts: CommandOptions = {}): Promise<CommandResult> {\n        // pathPrepend 是受管 PATH,在脚本自己的 shell 里对 `$PATH` 前置——env 走的是 SDK 的\n        // env 参数(可能被 opts.env.PATH 覆盖),而这一行在它之后执行,始终生效\n        // (见 docs/feature/sandbox/library.md「PATH:受管变量与 pathPrepend」)。\n        const scriptWithPath = this.pathPrepend.length > 0\n            ? `PATH=${shellQuote(this.pathPrepend.join(\":\"))}:\"$PATH\"\\n${script}`\n            : script;\n        return this.execDirect(\"bash\", [\"-c\", scriptWithPath], opts);\n    }\n    /** 实际发起 Vercel `runCommand` 调用的唯一出口;`runCommand`/`runShell` 都收敛到这里。 */\n    private async execDirect(cmd: string, args: readonly string[], opts: CommandOptions): Promise<CommandResult> {\n        // Vercel 命令级只认 `user: \"root\"`(映射 `sudo: true`);其它显式值报错,省略 = `sudo: false`\n        // (见 docs/feature/sandbox/library.md「执行身份」)。\n        if (opts.user !== undefined && opts.user !== \"root\") {\n            throw new Error(t(\"vercel.userUnsupported\", { user: opts.user }));\n        }\n        const limit = commandLimit(opts, { commandTimeoutMs: this.commandTimeoutMs, deadlineAt: this.deadlineAt });\n        // 只有 runner 交付的 attempt deadline 才是「当前物理实例必须承接多久」的请求。\n        // 普通 provider 调用或显式的单命令 timeout 只是这条命令的执行上限，不能为此读取\n        // currentSession()/轮换实例；前者在留存、文件传输等常规操作中甚至未必可用。\n        await this.rotateIfNeeded(this.deadlineAt === undefined ? undefined : limit.timeoutMs);\n        const finished = await this.vsb.runCommand({\n            cmd,\n            args: [...args],\n            cwd: resolveSandboxPath(this.workdir, opts.cwd),\n            env: opts.env,\n            sudo: opts.user === \"root\",\n            // per-command 上限从 attempt deadline 的剩余量派生(显式传 timeout 时按显式值);\n            // 没有 deadline 就不设,provider 层不发明一条自己的线。\n            ...(limit.timeoutMs !== undefined ? { timeoutMs: limit.timeoutMs } : {}),\n            signal: opts.signal,\n        });\n        const stdout = await finished.stdout();\n        const stderr = await finished.stderr();\n        // Vercel SDK 的命令 API 只在结束后给完整输出；仍兑现 CommandOptions 回调的\n        // 「至少一次」语义，让 adapter 不必按 provider 分叉。\n        if (stdout)\n            await opts.onStdout?.(stdout);\n        if (stderr)\n            await opts.onStderr?.(stderr);\n        return {\n            stdout,\n            stderr,\n            exitCode: finished.exitCode,\n        };\n    }\n    async runCommandOrThrow(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runCommand(cmd, args, opts), opts.sensitiveValues);\n    }\n    async runShellOrThrow(script: string, opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runShell(script, opts), opts.sensitiveValues);\n    }\n    async readText(path: string): Promise<string> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        const buf = await this.vsb.readFileToBuffer({ path: absPath });\n        if (!buf)\n            throw new Error(t(\"vercel.fileNotFound\", { path: absPath }));\n        return buf.toString(\"utf8\");\n    }\n    async pathExists(path: string): Promise<boolean> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        return this.vsb.fs.exists(absPath);\n    }\n    // targetDir 已由 paths.ts 的 normalizeSandboxPaths 解析成绝对路径;这里再解析一次\n    // 只是对直接使用 provider 实例(未包 normalize)的幂等防御,提到 map 外只算一次。\n    private async writeCollectedFiles(files: readonly CollectedLocalFile[], targetDir?: string): Promise<void> {\n        const base = resolveSandboxPath(this.workdir, targetDir);\n        const entries = files.map(({ path, content }) => ({\n            path: resolveSandboxPath(base, path),\n            content: Buffer.from(content),\n        }));\n        if (entries.length === 0)\n            return;\n        await this.vsb.writeFiles(entries);\n    }\n    async writeText(path: string, content: string): Promise<void> {\n        await this.vsb.writeFiles([{ path: resolveSandboxPath(this.workdir, path), content }]);\n    }\n    async readBytes(path: string): Promise<Uint8Array> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        const buf = await this.vsb.readFileToBuffer({ path: absPath });\n        if (!buf)\n            throw new Error(t(\"vercel.fileNotFound\", { path: absPath }));\n        return buf;\n    }\n    async writeBytes(path: string, content: Uint8Array): Promise<void> {\n        await this.vsb.writeFiles([{\n                path: resolveSandboxPath(this.workdir, path),\n                content: Buffer.from(content),\n            }]);\n    }\n    async uploadFile(source: string | URL, targetPath: string): Promise<void> {\n        await this.writeBytes(targetPath, await readFile(resolveLocalPath(undefined, source)));\n    }\n    async uploadDirectory(sourceDir: string | URL, targetDir?: string, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        await this.writeCollectedFiles(await collectLocalFiles(resolveLocalPath(undefined, sourceDir), opts.ignore), targetDir);\n    }\n    /**\n     * 递归下载沙箱内一个目录到本地磁盘,与 uploadDirectory 对称:两阶段模板(与 e2b provider\n     * 共用)——find 列路径 + 逐文件 readFileToBuffer(独立 HTTP GET)读取,写回本地磁盘。\n     */\n    async downloadFile(sourcePath: string, target: string | URL): Promise<void> {\n        const destination = resolveLocalPath(undefined, target);\n        await mkdir(dirname(destination), { recursive: true });\n        await writeFile(destination, await this.readBytes(sourcePath));\n    }\n    async downloadDirectory(sourceDir: string, targetDir: string | URL, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        const remoteDir = resolveSandboxPath(this.workdir, sourceDir);\n        await downloadDirectoryByList({\n            localDir: resolveLocalPath(undefined, targetDir),\n            ignore: opts.ignore ?? [],\n            runShell: (script) => this.runShell(script, { cwd: remoteDir }),\n            readOne: (relPath) => this.readBytes(`${remoteDir}/${relPath}`),\n        });\n    }\n    async stop(): Promise<void> {\n        await this.vsb.stop();\n    }\n    /**\n     * 留存休眠(suspend):vercel `stop`——sandbox 默认持久,stop 保存文件系统,之后经\n     * `Sandbox.get` 恢复(SDK 原生能力);内存态不保留,唤醒后进程要重新启动。\n     */\n    async suspend(): Promise<void> {\n        await this.vsb.stop();\n    }\n}\n"]}