unfazed 0.8.1 → 0.10.0

package/dist/eve-sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/eve-sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAMxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,GAInB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAgClE,uFAAuF;AACvF,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,kEAAkE;AAClE,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,MAAM,CAAC,OAA8B;IAC5C,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1I,OAAO,WAAW,OAAO,CAAC,GAAG,UAAU,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEtH,kDAAkD;AAClD,MAAM,OAAO,aAAa;IAIb;IACQ;IAJF,OAAO,CAAY;IAEpC,YACW,IAAY,EACJ,MAA6B,EAC9C,OAAmB;QAFV,SAAI,GAAJ,IAAI,CAAQ;QACJ,WAAM,GAAN,MAAM,CAAuB;QAG9C,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,OAAsF,EAAE;QAClI,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC3F,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,QAAkB,EAAE,IAAY;QACvC,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QACjC,IAAI,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QACrC,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAC;YAC7E,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;YAC1B,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,QAA6B;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAgB,CAAC;IACjF,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAgB,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,MAAoB;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,+EAA+E;AAC/E,SAAS,IAAI,CAAC,KAAc,EAAE,SAAiB;IAC7C,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACjE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,SAAS,UAAU,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,aAAa,CAC1B,MAAqB,EACrB,EAAU,EACV,OAAsC,EACtC,MAAmB;IAEnB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,CACzB,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,EACjH,qBAAqB,CACtB,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAK,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,SAAS,CAAC;gBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,GAAW,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBACnC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;4BAAE,SAAS;wBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAiB,CAAC;wBACxD,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;wBAChB,QAAQ,GAAG,CAAC,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,CAAC;wBACf,IAAI,GAAG,IAAI,KAAK;4BAAE,OAAO,KAAK,CAAC,CAAC,CAAC;oBACnC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,KAAK,CAAC;YAChC,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,KAAK,CAAC;YAC5E,IAAI,EAAE,QAAQ,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAqB,EAAE,SAAiB,EAAE,OAAoB;IAC7E,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,SAAS;QAEhC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE;YAC3D,MAAM,GAAG,GAAG,MAAM,MAAM;iBACrB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;iBAC/H,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;iBAC5C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YACvE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;gBACtB,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/E,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,GAAiD,CAAC;YACtD,IAAI,GAAiD,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAChF,MAAM,YAAY,GAAG,CAAC,KAAe,EAAE,EAAE;gBACvC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC3B,IAAI,CAAC;wBACH,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACnD,CAAC;oBAAC,MAAM,CAAC;wBACP,iBAAiB;oBACnB,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAC1B,MAAM,EACN,EAAE,EACF,CAAC,KAAK,EAAE,EAAE;gBACR,IAAI,GAAG,IAAI,KAAK;oBAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxG,CAAC,EACD,MAAM,CAAC,MAAM,CACd,CAAC,IAAI,CACJ,CAAC,QAAQ,EAAE,EAAE;gBACX,YAAY,EAAE,CAAC;gBACf,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;gBACR,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,KAAK,CAAC;YACd,CAAC,CACF,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClC,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;;oBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK;gBACjB,CAAC,CAAC,IAAI,cAAc,CAAa;oBAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;wBACjC,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;oBAC1H,CAAC,CAAC,CAAC;oBACL,KAAK,EAAE,GAAG,EAAE,CACV,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;wBACjC,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;oBAC3H,CAAC,CAAC,CAAC;iBACN,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,MAAM;gBACN,MAAM;gBACN,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM;gBAClB,IAAI;aACL,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/I,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YACtE,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE;YAChC,IAAI,KAAK,GAAe,EAAE,CAAC;YAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;gBACtB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAC/B,MAAM,MAAM;qBACT,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,CAAC;qBAC7G,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBACpC,KAAK,GAAG,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,CAAC;YACX,CAAC,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,eAAe;oBAAE,MAAM,IAAI,EAAE,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAClC,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;YACjD,MAAM,MAAM;iBACT,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,EAAE,SAAS,EAAE,SAAS,KAAK,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;iBAC/J,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC;YAClE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO;YAC/B,MAAM,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3C,CAAC;QAED,yEAAyE;QACzE,iEAAiE;QACjE,KAAK,CAAC,KAAK,KAAI,CAAC;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,GAA0B;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,cAAc,CAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,GAAsB;QACjC,aAAa,EAAE,kBAAkB;QACjC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE;YACrB,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,wBAAwB,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CACb,wIAAwI,CACzI,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,IAAI,cAAc,CAAa;oBACrC,KAAK,CAAC,CAAC;wBACL,CAAC,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC;wBAC1D,CAAC,CAAC,KAAK,EAAE,CAAC;oBACZ,CAAC;iBACF,CAAC;gBACF,MAAM,EAAE,KAAK,EAAE;gBACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACnC,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;aACrB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;YACrB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE;YACjC,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;YAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,SAAS;gBAAE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;oBAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;wBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxG,CAAC;QACD,KAAK,CAAC,IAAI,KAAI,CAAC;KAChB,CAAC;IACF,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0DAA0D,KAAK,mBAAmB,kBAAkB,oBAAoB,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAMjC;IACF,IAAI,EAAE,SAAS;IACf,oBAAoB,EAAE,CAAC;IACvB,WAAW,CAAC,OAA8B;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7E,OAAO;YACL,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACxE,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAgB,EAAE,QAA0C;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM,KAAK,GAAwB,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBACrG,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;YACzE,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,SAA2C,EAAE,KAAoC;gBACjG,MAAM,SAAS,GAAG,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,OAAO,KAAK,IAAI;oBAAE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,SAAS,UAAU,CAAC,CAAC;gBAC5G,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,KAA2C,EAAE,EAAE,MAAM,EAAE;gBAC7E,MAAM,SAAS,GAAG,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1F,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,oEAAoE;YACpE,0DAA0D;YAC1D,YAAY,EAAE,IAAa;SAC5B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GACzB,qBAAqB,CAAC,wBAAwB,CAAC,CAAC","sourcesContent":["/**\n * `unfazed/eve-sandbox` — eve sandboxes backed by an unfazed box.\n *\n * ```ts title=\"agent/sandbox.ts\"\n * import { defineSandbox } from \"eve/sandbox\";\n * import { UnfazedSandbox } from \"unfazed/eve-sandbox\";\n *\n * export const environment = UnfazedSandbox.environment({ box: \"my-sandbox-box\" });\n * export default defineSandbox(() => environment.open());\n * ```\n *\n * The box runs the sandbox daemon (`unfazed eve-sandbox setup` inside it).\n * Each eve session gets its own Unix user, home and workspace on the box; the\n * box keeps them across restarts and redeploys until the session ends. The\n * app authenticates with its workload identity token (audience: the box's\n * URL), so it needs no stored secret; the box's allow list names the apps it\n * serves.\n *\n * Requires the optional peer `eve` (0.90 or newer).\n */\n\nimport type { SandboxSession } from \"eve/sandbox\";\nimport {\n  defineSandboxProvider,\n  SandboxSessionGoneError,\n  type SandboxConnection,\n  type SandboxPrepareContext,\n  type SandboxProvider,\n  type SandboxProviderDefinition,\n  type WithPrepareOption,\n} from \"eve/sandbox/provider\";\nimport { oidcToken } from \"../oidc.js\";\nimport {\n  API_PREFIX,\n  TEMPLATE_HOME,\n  TEMPLATE_WORKSPACE,\n  type ProcessEvent,\n  type SessionInfo,\n  type WireFile,\n} from \"./protocol.js\";\n\nexport { TEMPLATE_HOME, TEMPLATE_WORKSPACE } from \"./protocol.js\";\n\n/** Options of `UnfazedSandbox.environment()`. */\nexport interface UnfazedSandboxOptions {\n  /** The box's alias; its URL is `https://<box>.unfz.to`. */\n  readonly box?: string;\n  /** The box's URL, instead of `box`. */\n  readonly url?: string;\n  /** Token audience; the box's URL by default. */\n  readonly audience?: string;\n  /** Supplies the bearer token; the app's workload identity token by default. */\n  readonly token?: (audience: string) => Promise<string>;\n  /** `fetch` used for every call (tests). */\n  readonly fetch?: FetchLike;\n}\n\n/** The subset of `fetch` the client uses. */\nexport type FetchLike = (input: string, init: RequestInit) => Promise<Response>;\n\n/** The artifact `prepare()` ships with the deployment: the template files. */\nexport type UnfazedSandboxArtifact = {\n  readonly v: 1;\n  readonly files: readonly WireFile[];\n};\n\n/** What eve checkpoints for a session. */\nexport type UnfazedSandboxState = {\n  readonly v: 1;\n  readonly sessionId: string;\n  readonly workspace: string;\n};\n\n/** Template files larger than this in total belong on the box, not in the artifact. */\nconst MAX_TEMPLATE_BYTES = 8 * 1024 * 1024;\n/** One `writeFiles` request carries at most this much content. */\nconst MAX_WRITE_BATCH = 16 * 1024 * 1024;\nconst CONTROL_TIMEOUT_MS = 60_000;\n\nexport class UnfazedSandboxError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"UnfazedSandboxError\";\n  }\n}\n\nfunction boxUrl(options: UnfazedSandboxOptions): string {\n  if (options.url) return options.url.replace(/\\/+$/, \"\");\n  if (options.box) {\n    if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(options.box)) throw new Error(`unfazed eve sandbox: invalid box alias \"${options.box}\"`);\n    return `https://${options.box}.unfz.to`;\n  }\n  throw new Error(\"unfazed eve sandbox: pass { box } or { url }\");\n}\n\nconst toB64 = (bytes: Uint8Array) => Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString(\"base64\");\n\n/** The daemon's HTTP API, one per environment. */\nexport class SandboxClient {\n  private readonly doFetch: FetchLike;\n\n  constructor(\n    readonly base: string,\n    private readonly bearer: () => Promise<string>,\n    doFetch?: FetchLike,\n  ) {\n    this.doFetch = doFetch ?? ((input, init) => fetch(input, init));\n  }\n\n  async request(method: string, path: string, init: { body?: BodyInit; json?: unknown; signal?: AbortSignal; timeoutMs?: number } = {}): Promise<Response> {\n    const headers: Record<string, string> = { authorization: `Bearer ${await this.bearer()}` };\n    let body = init.body;\n    if (init.json !== undefined) {\n      headers[\"content-type\"] = \"application/json\";\n      body = JSON.stringify(init.json);\n    }\n    const signals = [AbortSignal.timeout(init.timeoutMs ?? CONTROL_TIMEOUT_MS), ...(init.signal ? [init.signal] : [])];\n    return await this.doFetch(`${this.base}${API_PREFIX}${path}`, { method, headers, body, signal: AbortSignal.any(signals) });\n  }\n\n  async ok(response: Response, what: string): Promise<Response> {\n    if (response.ok) return response;\n    let code = \"http_\" + response.status;\n    let message = \"\";\n    try {\n      const body = (await response.json()) as { error?: string; message?: string };\n      code = body.error ?? code;\n      message = body.message ?? \"\";\n    } catch {\n      // not JSON\n    }\n    throw new UnfazedSandboxError(response.status, code, `unfazed eve sandbox: ${what}: ${response.status} ${code}${message ? `: ${message}` : \"\"}`);\n  }\n\n  async ensure(sessionId: string, template: readonly WireFile[]): Promise<SessionInfo> {\n    const res = await this.request(\"PUT\", `/sessions/${encodeURIComponent(sessionId)}`, { json: { template } });\n    return (await (await this.ok(res, \"start the sandbox\")).json()) as SessionInfo;\n  }\n\n  /** The session, or `null` when the box no longer has it. */\n  async get(sessionId: string): Promise<SessionInfo | null> {\n    const res = await this.request(\"GET\", `/sessions/${encodeURIComponent(sessionId)}`);\n    if (res.status === 410) return null;\n    return (await (await this.ok(res, \"resume the sandbox\")).json()) as SessionInfo;\n  }\n\n  async delete(sessionId: string, signal?: AbortSignal): Promise<void> {\n    const res = await this.request(\"DELETE\", `/sessions/${encodeURIComponent(sessionId)}`, { signal });\n    await this.ok(res, \"delete the sandbox\");\n  }\n}\n\n/** A sandbox session that is gone answers 410: eve then starts a fresh one. */\nfunction gone(error: unknown, sessionId: string): never {\n  if (error instanceof UnfazedSandboxError && error.status === 410) {\n    throw new SandboxSessionGoneError(`unfazed sandbox for session ${sessionId} is gone`);\n  }\n  throw error;\n}\n\n/** Reads a process's event stream, reconnecting after a dropped connection. */\nasync function followProcess(\n  client: SandboxClient,\n  id: string,\n  onEvent: (event: ProcessEvent) => void,\n  signal: AbortSignal,\n): Promise<number> {\n  let after = 0;\n  let failures = 0;\n  for (;;) {\n    try {\n      const res = await client.ok(\n        await client.request(\"GET\", `/processes/${id}/events?after=${after}`, { signal, timeoutMs: 24 * 60 * 60 * 1000 }),\n        \"read process output\",\n      );\n      const reader = res.body!.getReader();\n      const decoder = new TextDecoder();\n      let buffer = \"\";\n      for (;;) {\n        const { value, done } = await reader.read();\n        if (done) break;\n        buffer += decoder.decode(value, { stream: true });\n        let cut: number;\n        while ((cut = buffer.indexOf(\"\\n\\n\")) >= 0) {\n          const frame = buffer.slice(0, cut);\n          buffer = buffer.slice(cut + 2);\n          for (const line of frame.split(\"\\n\")) {\n            if (!line.startsWith(\"data: \")) continue;\n            const event = JSON.parse(line.slice(6)) as ProcessEvent;\n            after = event.s;\n            failures = 0;\n            onEvent(event);\n            if (\"x\" in event) return event.x;\n          }\n        }\n      }\n    } catch (error) {\n      if (signal.aborted) throw error;\n      if (error instanceof UnfazedSandboxError && error.status < 500) throw error;\n      if (++failures > 8) throw error;\n    }\n    await new Promise((resolve) => setTimeout(resolve, Math.min(250 * 2 ** failures, 5000)));\n  }\n}\n\nfunction connect(client: SandboxClient, sessionId: string, session: SessionInfo): SandboxConnection {\n  const sid = encodeURIComponent(sessionId);\n  return {\n    workspaceRoot: session.workspace,\n\n    async spawn({ command, env, workingDirectory, stdin, signal }) {\n      const res = await client\n        .request(\"POST\", `/sessions/${sid}/processes`, { json: { command, cwd: workingDirectory, env, stdin: stdin === true }, signal })\n        .then((r) => client.ok(r, \"start a command\"))\n        .catch((error) => gone(error, sessionId));\n      const { id, pid } = (await res.json()) as { id: string; pid?: number };\n      const kill = async () => {\n        await client.request(\"POST\", `/processes/${id}/kill`).catch(() => undefined);\n      };\n      const follow = new AbortController();\n      let out!: ReadableStreamDefaultController<Uint8Array>;\n      let err!: ReadableStreamDefaultController<Uint8Array>;\n      const stdout = new ReadableStream<Uint8Array>({ start: (c) => void (out = c) });\n      const stderr = new ReadableStream<Uint8Array>({ start: (c) => void (err = c) });\n      const closeStreams = (error?: unknown) => {\n        for (const c of [out, err]) {\n          try {\n            error === undefined ? c.close() : c.error(error);\n          } catch {\n            // already closed\n          }\n        }\n      };\n      const exited = followProcess(\n        client,\n        id,\n        (event) => {\n          if (\"d\" in event) (event.f === 1 ? out : err).enqueue(new Uint8Array(Buffer.from(event.d, \"base64\")));\n        },\n        follow.signal,\n      ).then(\n        (exitCode) => {\n          closeStreams();\n          return { exitCode };\n        },\n        (error) => {\n          closeStreams(error);\n          throw error;\n        },\n      );\n      if (signal) {\n        const onAbort = () => void kill();\n        if (signal.aborted) onAbort();\n        else signal.addEventListener(\"abort\", onAbort, { once: true });\n        void exited.finally(() => signal.removeEventListener(\"abort\", onAbort)).catch(() => undefined);\n      }\n      let pending = Promise.resolve();\n      const input = stdin\n        ? new WritableStream<Uint8Array>({\n            write: (chunk) =>\n              (pending = pending.then(async () => {\n                await client.ok(await client.request(\"POST\", `/processes/${id}/stdin`, { body: new Uint8Array(chunk) }), \"write stdin\");\n              })),\n            close: () =>\n              (pending = pending.then(async () => {\n                await client.ok(await client.request(\"POST\", `/processes/${id}/stdin?eof=1`, { body: new Uint8Array() }), \"close stdin\");\n              })),\n          })\n        : undefined;\n      return {\n        pid,\n        stdin: input,\n        stdout,\n        stderr,\n        wait: () => exited,\n        kill,\n      };\n    },\n\n    async readFile({ path, signal }) {\n      const res = await client.request(\"GET\", `/sessions/${sid}/file?path=${encodeURIComponent(path)}`, { signal }).catch((e) => gone(e, sessionId));\n      if (res.status === 404) return null;\n      await client.ok(res, `read ${path}`).catch((e) => gone(e, sessionId));\n      return new Uint8Array(await res.arrayBuffer());\n    },\n\n    async writeFiles({ files, signal }) {\n      let batch: WireFile[] = [];\n      let size = 0;\n      const send = async () => {\n        if (batch.length === 0) return;\n        await client\n          .ok(await client.request(\"POST\", `/sessions/${sid}/files`, { json: { files: batch }, signal }), \"write files\")\n          .catch((e) => gone(e, sessionId));\n        batch = [];\n        size = 0;\n      };\n      for (const file of files) {\n        if (size + file.content.byteLength > MAX_WRITE_BATCH) await send();\n        batch.push({ path: file.path, b64: toB64(file.content) });\n        size += file.content.byteLength;\n      }\n      await send();\n    },\n\n    async removePath({ path, force, recursive, signal }) {\n      await client\n        .ok(await client.request(\"POST\", `/sessions/${sid}/remove`, { json: { path, force: force === true, recursive: recursive === true }, signal }), `remove ${path}`)\n        .catch((e) => gone(e, sessionId));\n    },\n\n    async stop() {\n      const res = await client.request(\"POST\", `/sessions/${sid}/stop`);\n      if (res.status === 410) return;\n      await client.ok(res, \"stop the sandbox\");\n    },\n\n    // The box keeps the session's processes (an open browser) between steps;\n    // its daemon stops a session's processes after it has been idle.\n    async close() {},\n  };\n}\n\n/**\n * Captures the workspace and skill files `ctx.populate()` writes at build\n * time, so every new session starts from them. A build-time command other\n * than eve's `$HOME` probe is refused: install tools on the box instead.\n */\nasync function captureTemplate(ctx: SandboxPrepareContext): Promise<WireFile[]> {\n  const files = new Map<string, Uint8Array>();\n  const empty = () => new ReadableStream<Uint8Array>({ start: (c) => c.close() });\n  const capture: SandboxConnection = {\n    workspaceRoot: TEMPLATE_WORKSPACE,\n    async spawn({ command }) {\n      if (command.trim() !== `printf '%s\\\\n' \"$HOME\"`) {\n        throw new Error(\n          \"unfazed eve sandbox: commands in prepare() do not run at build time; install tools on the box itself (see `unfazed eve-sandbox setup`)\",\n        );\n      }\n      return {\n        stdout: new ReadableStream<Uint8Array>({\n          start(c) {\n            c.enqueue(new TextEncoder().encode(`${TEMPLATE_HOME}\\n`));\n            c.close();\n          },\n        }),\n        stderr: empty(),\n        wait: async () => ({ exitCode: 0 }),\n        kill: async () => {},\n      };\n    },\n    async readFile({ path }) {\n      return files.get(path) ?? null;\n    },\n    async writeFiles({ files: written }) {\n      for (const file of written) files.set(file.path, file.content);\n    },\n    async removePath({ path, recursive }) {\n      files.delete(path);\n      if (recursive) for (const key of [...files.keys()]) if (key.startsWith(`${path}/`)) files.delete(key);\n    },\n    async stop() {},\n  };\n  await ctx.populate(capture);\n  let total = 0;\n  const out: WireFile[] = [];\n  for (const [path, content] of files) {\n    total += content.byteLength;\n    out.push({ path, b64: toB64(content) });\n  }\n  if (total > MAX_TEMPLATE_BYTES) {\n    throw new Error(`unfazed eve sandbox: the workspace and skill files are ${total} bytes; at most ${MAX_TEMPLATE_BYTES} fit in a template`);\n  }\n  return out.sort((a, b) => a.path.localeCompare(b.path));\n}\n\n/** The provider's implementation (for tests); eve apps use {@link UnfazedSandbox}. */\nexport const unfazedSandboxDefinition: SandboxProviderDefinition<\n  UnfazedSandboxOptions,\n  undefined,\n  UnfazedSandboxArtifact,\n  UnfazedSandboxState,\n  {}\n> = {\n  name: \"unfazed\",\n  stateProtocolVersion: 1,\n  environment(options: UnfazedSandboxOptions) {\n    const base = boxUrl(options);\n    const audience = options.audience ?? base;\n    const token = options.token ?? ((aud: string) => oidcToken(aud));\n    const client = new SandboxClient(base, () => token(audience), options.fetch);\n    return {\n      async prepare(ctx): Promise<UnfazedSandboxArtifact> {\n        return { v: 1, files: ctx.isEmpty ? [] : await captureTemplate(ctx) };\n      },\n      async start(ctx, _open: undefined, artifact: Readonly<UnfazedSandboxArtifact>) {\n        const session = await client.ensure(ctx.session.id, artifact?.files ?? []);\n        const state: UnfazedSandboxState = { v: 1, sessionId: ctx.session.id, workspace: session.workspace };\n        return { connection: connect(client, ctx.session.id, session), state };\n      },\n      async resume(ctx, _artifact: Readonly<UnfazedSandboxArtifact>, state: Readonly<UnfazedSandboxState>) {\n        const sessionId = typeof state?.sessionId === \"string\" ? state.sessionId : ctx.session.id;\n        const session = await client.get(sessionId);\n        if (session === null) throw new SandboxSessionGoneError(`unfazed sandbox for session ${sessionId} is gone`);\n        return connect(client, sessionId, session);\n      },\n      async onSessionEnd(ctx, state: Readonly<UnfazedSandboxState> | null, { signal }) {\n        const sessionId = typeof state?.sessionId === \"string\" ? state.sessionId : ctx.session.id;\n        await client.delete(sessionId, signal);\n      },\n      // Keyed MCP tool sessions keep their sandbox between calls; the box\n      // deletes a sandbox nobody used for its retention period.\n      toolSessions: true as const,\n    };\n  },\n};\n\n/** The eve sandbox provider backed by an unfazed box. */\nexport const UnfazedSandbox: SandboxProvider<WithPrepareOption<UnfazedSandboxOptions, SandboxSession>, undefined, SandboxSession> =\n  defineSandboxProvider(unfazedSandboxDefinition);\n"]}

package/dist/eve-sandbox/protocol.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Wire contract between the eve sandbox provider (`unfazed/eve-sandbox`) and
+ * the sandbox daemon that runs inside an unfazed box (`daemon.ts`).
+ *
+ * Every route but `GET /v1/health` takes `Authorization: Bearer <OIDC JWT>`:
+ * a workload identity token of the calling app (issuer
+ * `https://unfazed.dev/oidc`) whose audience is the box's URL. The daemon
+ * namespaces every sandbox by the token's `app_id`, so two apps sharing a box
+ * never see each other's sessions.
+ */
+/** Version segment of every route. */
+export declare const API_PREFIX = "/v1";
+/** The daemon's own version, reported by `GET /v1/health`. */
+export declare const DAEMON_VERSION = "1";
+/**
+ * Template files captured at build time name these placeholder roots; the
+ * daemon maps them onto the session's workspace and home when it creates the
+ * session.
+ */
+export declare const TEMPLATE_WORKSPACE = "/__unfazed_eve_workspace__";
+export declare const TEMPLATE_HOME = "/__unfazed_eve_home__";
+/** A file as it travels in JSON: an absolute path and base64 content. */
+export type WireFile = {
+    readonly path: string;
+    readonly b64: string;
+};
+/** `PUT /v1/sessions/:id` body. */
+export interface EnsureSessionRequest {
+    readonly template?: readonly WireFile[];
+}
+/** A session as the daemon reports it. */
+export interface SessionInfo {
+    readonly name: string;
+    readonly home: string;
+    readonly workspace: string;
+    readonly created?: boolean;
+}
+/** `POST /v1/sessions/:id/processes` body. */
+export interface SpawnRequest {
+    readonly command: string;
+    readonly cwd: string;
+    readonly env: Readonly<Record<string, string>>;
+    readonly stdin: boolean;
+}
+/**
+ * One server-sent event of `GET /v1/processes/:id/events`: output of stream
+ * `f` (1 stdout, 2 stderr) as base64 `d`, or the exit code `x`, numbered `s`
+ * from 1 so a client can resume with `?after=<s>`.
+ */
+export type ProcessEvent = {
+    readonly s: number;
+    readonly f: 1 | 2;
+    readonly d: string;
+} | {
+    readonly s: number;
+    readonly x: number;
+};
+/** `POST /v1/sessions/:id/remove` body. */
+export interface RemoveRequest {
+    readonly path: string;
+    readonly force?: boolean;
+    readonly recursive?: boolean;
+}
+/** Error body of every non-2xx answer. */
+export interface ErrorBody {
+    readonly error: string;
+    readonly message?: string;
+}

package/dist/eve-sandbox/protocol.js

@@ -0,0 +1,22 @@
+/**
+ * Wire contract between the eve sandbox provider (`unfazed/eve-sandbox`) and
+ * the sandbox daemon that runs inside an unfazed box (`daemon.ts`).
+ *
+ * Every route but `GET /v1/health` takes `Authorization: Bearer <OIDC JWT>`:
+ * a workload identity token of the calling app (issuer
+ * `https://unfazed.dev/oidc`) whose audience is the box's URL. The daemon
+ * namespaces every sandbox by the token's `app_id`, so two apps sharing a box
+ * never see each other's sessions.
+ */
+/** Version segment of every route. */
+export const API_PREFIX = "/v1";
+/** The daemon's own version, reported by `GET /v1/health`. */
+export const DAEMON_VERSION = "1";
+/**
+ * Template files captured at build time name these placeholder roots; the
+ * daemon maps them onto the session's workspace and home when it creates the
+ * session.
+ */
+export const TEMPLATE_WORKSPACE = "/__unfazed_eve_workspace__";
+export const TEMPLATE_HOME = "/__unfazed_eve_home__";
+//# sourceMappingURL=protocol.js.map

package/dist/eve-sandbox/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/eve-sandbox/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAEhC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC","sourcesContent":["/**\n * Wire contract between the eve sandbox provider (`unfazed/eve-sandbox`) and\n * the sandbox daemon that runs inside an unfazed box (`daemon.ts`).\n *\n * Every route but `GET /v1/health` takes `Authorization: Bearer <OIDC JWT>`:\n * a workload identity token of the calling app (issuer\n * `https://unfazed.dev/oidc`) whose audience is the box's URL. The daemon\n * namespaces every sandbox by the token's `app_id`, so two apps sharing a box\n * never see each other's sessions.\n */\n\n/** Version segment of every route. */\nexport const API_PREFIX = \"/v1\";\n\n/** The daemon's own version, reported by `GET /v1/health`. */\nexport const DAEMON_VERSION = \"1\";\n\n/**\n * Template files captured at build time name these placeholder roots; the\n * daemon maps them onto the session's workspace and home when it creates the\n * session.\n */\nexport const TEMPLATE_WORKSPACE = \"/__unfazed_eve_workspace__\";\nexport const TEMPLATE_HOME = \"/__unfazed_eve_home__\";\n\n/** A file as it travels in JSON: an absolute path and base64 content. */\nexport type WireFile = {\n  readonly path: string;\n  readonly b64: string;\n};\n\n/** `PUT /v1/sessions/:id` body. */\nexport interface EnsureSessionRequest {\n  readonly template?: readonly WireFile[];\n}\n\n/** A session as the daemon reports it. */\nexport interface SessionInfo {\n  readonly name: string;\n  readonly home: string;\n  readonly workspace: string;\n  readonly created?: boolean;\n}\n\n/** `POST /v1/sessions/:id/processes` body. */\nexport interface SpawnRequest {\n  readonly command: string;\n  readonly cwd: string;\n  readonly env: Readonly<Record<string, string>>;\n  readonly stdin: boolean;\n}\n\n/**\n * One server-sent event of `GET /v1/processes/:id/events`: output of stream\n * `f` (1 stdout, 2 stderr) as base64 `d`, or the exit code `x`, numbered `s`\n * from 1 so a client can resume with `?after=<s>`.\n */\nexport type ProcessEvent =\n  | { readonly s: number; readonly f: 1 | 2; readonly d: string }\n  | { readonly s: number; readonly x: number };\n\n/** `POST /v1/sessions/:id/remove` body. */\nexport interface RemoveRequest {\n  readonly path: string;\n  readonly force?: boolean;\n  readonly recursive?: boolean;\n}\n\n/** Error body of every non-2xx answer. */\nexport interface ErrorBody {\n  readonly error: string;\n  readonly message?: string;\n}\n"]}

package/dist/index.d.ts

@@ -35,8 +35,22 @@ export type { AppRef, ClientTimings, CommitDeploymentTarget, CommitDetail, Commi
 export { help, REFERENCE } from "./reference.js";
 export { UnfazedClient, DEFAULT_BASE_URL, DEFAULT_ENDPOINT, ENDPOINT_ENV_VAR, GRAPHQL_PATH, TOKEN_ENV_VAR, VERSION, } from "./client.js";
 export type { ClientOptions, FetchLike, GraphQLDocument, RequestOptions, ResultOf, VariablesOf, } from "./client.js";
-export { DEPLOYMENT_NOT_FOUND, UnfazedAuthError, UnfazedConfigError, UnfazedConflictError, UnfazedDeployError, UnfazedError, UnfazedGraphQLError, UnfazedHTTPError, UnfazedNotFoundError, UnfazedRunError, UnfazedTimeoutError, UnfazedUnconfirmedAppsError, UnfazedWriteError, WORKSPACE_NOT_FOUND, isDuplicateWorkspaceName, isNotFoundSentinel, isTooManyWaits, } from "./errors.js";
-export type { GraphQLResponseError } from "./errors.js";
+/**
+ * Workload identity: OIDC tokens the platform issues to the app this code
+ * runs in, with only its `UNFZ_STATE_TOKEN`. `oidc` is the process's own
+ * {@link UnfazedOIDC}; `new Unfazed().oidc` is the same with the instance's
+ * endpoint and fetch.
+ *
+ * ```ts
+ * import { oidc, oidcToken } from "unfazed";
+ * const jwt = await oidcToken("https://api.example.com");
+ * const fetch = oidc.fetchWithToken(process.env.PRIVATEINFERENCE_AUDIENCE);
+ * ```
+ */
+export { OIDC_TOKEN_PATH, STATE_TOKEN_ENV_VAR, UnfazedOIDC, oidc, oidcToken } from "./oidc.js";
+export type { FetchWithTokenOptions, OIDCOptions, OIDCToken, OIDCTokenOptions, OIDCTransport, TokenFetch, } from "./oidc.js";
+export { DEPLOYMENT_NOT_FOUND, UnfazedAuthError, UnfazedConfigError, UnfazedConflictError, UnfazedDeployError, UnfazedError, UnfazedGraphQLError, UnfazedHTTPError, UnfazedNotFoundError, UnfazedOIDCError, UnfazedRunError, UnfazedTimeoutError, UnfazedUnconfirmedAppsError, UnfazedWriteError, WORKSPACE_NOT_FOUND, isDuplicateWorkspaceName, isNotFoundSentinel, isTooManyWaits, } from "./errors.js";
+export type { GraphQLResponseError, OIDCErrorCode } from "./errors.js";
 export type { WaitOptions } from "./wait.js";
 /**
  * The stored login of `npx unfazed login`, which {@link UnfazedClient} uses when

package/dist/index.js

@@ -32,7 +32,20 @@ export { Unfazed, parseDeploymentTimings } from "./unfazed.js";
  */
 export { help, REFERENCE } from "./reference.js";
 export { UnfazedClient, DEFAULT_BASE_URL, DEFAULT_ENDPOINT, ENDPOINT_ENV_VAR, GRAPHQL_PATH, TOKEN_ENV_VAR, VERSION, } from "./client.js";
-export { DEPLOYMENT_NOT_FOUND, UnfazedAuthError, UnfazedConfigError, UnfazedConflictError, UnfazedDeployError, UnfazedError, UnfazedGraphQLError, UnfazedHTTPError, UnfazedNotFoundError, UnfazedRunError, UnfazedTimeoutError, UnfazedUnconfirmedAppsError, UnfazedWriteError, WORKSPACE_NOT_FOUND, isDuplicateWorkspaceName, isNotFoundSentinel, isTooManyWaits, } from "./errors.js";
+/**
+ * Workload identity: OIDC tokens the platform issues to the app this code
+ * runs in, with only its `UNFZ_STATE_TOKEN`. `oidc` is the process's own
+ * {@link UnfazedOIDC}; `new Unfazed().oidc` is the same with the instance's
+ * endpoint and fetch.
+ *
+ * ```ts
+ * import { oidc, oidcToken } from "unfazed";
+ * const jwt = await oidcToken("https://api.example.com");
+ * const fetch = oidc.fetchWithToken(process.env.PRIVATEINFERENCE_AUDIENCE);
+ * ```
+ */
+export { OIDC_TOKEN_PATH, STATE_TOKEN_ENV_VAR, UnfazedOIDC, oidc, oidcToken } from "./oidc.js";
+export { DEPLOYMENT_NOT_FOUND, UnfazedAuthError, UnfazedConfigError, UnfazedConflictError, UnfazedDeployError, UnfazedError, UnfazedGraphQLError, UnfazedHTTPError, UnfazedNotFoundError, UnfazedOIDCError, UnfazedRunError, UnfazedTimeoutError, UnfazedUnconfirmedAppsError, UnfazedWriteError, WORKSPACE_NOT_FOUND, isDuplicateWorkspaceName, isNotFoundSentinel, isTooManyWaits, } from "./errors.js";
 /**
  * The stored login of `npx unfazed login`, which {@link UnfazedClient} uses when
  * no token is passed and `UNFZ_API_TOKEN` is unset. The helpers that read,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAoD/D;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,OAAO,GACR,MAAM,aAAa,CAAC;AAUrB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,GACf,MAAM,aAAa,CAAC;AAKrB;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA4B;IAC5D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC","sourcesContent":["/**\n * unfazed — official TypeScript SDK.\n *\n * The code-mode companion to the unfazed MCP server: write one script that\n * deploys, waits, reads logs and filters them locally, instead of chaining a\n * dozen tool calls through a model's context.\n *\n * ```ts\n * import { Unfazed } from \"unfazed\";\n *\n * const unfazed = new Unfazed();       // UNFZ_API_TOKEN, else your `npx unfazed login`\n * const ws = await unfazed.createWorkspace(\"hello\");\n * await unfazed.writeFiles(ws.id, {\n *   \"server.ts\": `export default { fetch: () => new Response(\"hi\") }`,\n * });\n * const app = await unfazed.deployService({ workspaceId: ws.id, alias: \"hello\", wait: true });\n * console.log(app.url);\n * ```\n *\n * `help()` returns the reference: every method with its signature.\n *\n * Two layers, both public:\n *  - {@link Unfazed} — the workflow layer (deploy + wait, one-commit batch\n *    writes, history and restore, errors, events, one-call rollback).\n *  - {@link UnfazedClient} — the typed GraphQL transport, for anything not wrapped.\n */\n\nimport type { RemoteWorld, RemoteWorldOptions } from \"./remote/world.js\";\n\nexport { Unfazed, parseDeploymentTimings } from \"./unfazed.js\";\nexport type {\n  AppRef,\n  ClientTimings,\n  CommitDeploymentTarget,\n  CommitDetail,\n  CommitPage,\n  CommitsLanded,\n  CreateRunOptions,\n  FollowUpRunOptions,\n  DeleteAppOptions,\n  DeleteAppResult,\n  DeleteDeploymentOptions,\n  DeleteWorkspaceOptions,\n  Deployment,\n  DeploymentEvent,\n  DeployBoxOptions,\n  DeployOptions,\n  DeployResult,\n  DeployServiceOptions,\n  DeployStaticOptions,\n  DeployTimings,\n  EnvVar,\n  ErrorGroup,\n  ErrorGroupDetail,\n  ErrorGroupPage,\n  ErrorGroupRef,\n  EventPage,\n  EventsInput,\n  EventType,\n  FileCommit,\n  FileContent,\n  FilesMap,\n  FileWriteOutcome,\n  ListErrorsOptions,\n  ListRunsFilter,\n  LiveApp,\n  PlatformEvent,\n  PlatformTimings,\n  RestoreVersionOptions,\n  RestoreVersionResult,\n  RollbackOptions,\n  Run,\n  TimingEvent,\n  UnfazedOptions,\n  Workspace,\n  WorkspaceFile,\n  WriteFilesOptions,\n  WriteFilesResult,\n  WrittenFile,\n} from \"./unfazed.js\";\n\n/**\n * The SDK's reference — every method with its signature — as a string:\n * `help()` for the page, `help(\"writeFiles\")` for one entry. The same page\n * ships as REFERENCE.md and is served at https://unfazed.dev/sdk.md.\n */\nexport { help, REFERENCE } from \"./reference.js\";\n\nexport {\n  UnfazedClient,\n  DEFAULT_BASE_URL,\n  DEFAULT_ENDPOINT,\n  ENDPOINT_ENV_VAR,\n  GRAPHQL_PATH,\n  TOKEN_ENV_VAR,\n  VERSION,\n} from \"./client.js\";\nexport type {\n  ClientOptions,\n  FetchLike,\n  GraphQLDocument,\n  RequestOptions,\n  ResultOf,\n  VariablesOf,\n} from \"./client.js\";\n\nexport {\n  DEPLOYMENT_NOT_FOUND,\n  UnfazedAuthError,\n  UnfazedConfigError,\n  UnfazedConflictError,\n  UnfazedDeployError,\n  UnfazedError,\n  UnfazedGraphQLError,\n  UnfazedHTTPError,\n  UnfazedNotFoundError,\n  UnfazedRunError,\n  UnfazedTimeoutError,\n  UnfazedUnconfirmedAppsError,\n  UnfazedWriteError,\n  WORKSPACE_NOT_FOUND,\n  isDuplicateWorkspaceName,\n  isNotFoundSentinel,\n  isTooManyWaits,\n} from \"./errors.js\";\nexport type { GraphQLResponseError } from \"./errors.js\";\n\nexport type { WaitOptions } from \"./wait.js\";\n\n/**\n * The stored login of `npx unfazed login`, which {@link UnfazedClient} uses when\n * no token is passed and `UNFZ_API_TOKEN` is unset. The helpers that read,\n * write and refresh it are in `unfazed/credentials`.\n */\nexport { CREDENTIALS_FILE, LOGIN_COMMAND, credentialsPath } from \"./credentials.js\";\nexport type { StoredCredentials } from \"./credentials.js\";\n\nexport { UnfazedInspectError } from \"./errors.js\";\nexport { APP_ENV_VAR } from \"./remote/app.js\";\nexport type { RemoteWorld, RemoteWorldOptions } from \"./remote/world.js\";\n\n/**\n * The `unfazed` backend of Workflow SDK's CLI: a read-mostly World over the\n * platform's workflow inspection API, for one app.\n *\n * ```sh\n * npx unfazed login                      # once: signs you in, in the browser\n * UNFZ_APP=birthday-card npx workflow inspect runs --backend unfazed\n * ```\n *\n * The token is `UNFZ_API_TOKEN` when set, else the stored login of\n * `npx unfazed login`, refreshed as it expires.\n *\n * The CLI (and its `--web` UI) resolve `unfazed` from the project and call\n * this with no arguments. The app is `UNFZ_APP`, else the `alias` (or the\n * single `apps[]` entry) of `unfazed.json` in the current directory. Reads\n * and `workflow cancel` work; every other write throws, since an app's own\n * World is `unfazed/workflow`. The module behind it loads on first call, so\n * `import \"unfazed\"` stays as light as before.\n */\nexport async function createWorld(options?: RemoteWorldOptions): Promise<RemoteWorld> {\n  const { createRemoteWorld } = await import(\"./remote/world.js\");\n  return createRemoteWorld(options);\n}\n\n/**\n * Every operation document the workflow layer uses, for callers that want the\n * typed documents but not the wrapper methods.\n */\nexport * as operations from \"./operations.js\";\n\n/**\n * Schema types generated from the platform's `graph/schema.graphqls`: enums\n * (`DeploymentStatus`, `ServiceMode`, ...), input objects\n * (`CreateDeploymentInput`, ...) and every operation's result type.\n */\nexport type * from \"./generated/graphql.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAoD/D;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,OAAO,GACR,MAAM,aAAa,CAAC;AAUrB;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAU/F,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,GACf,MAAM,aAAa,CAAC;AAKrB;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA4B;IAC5D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC","sourcesContent":["/**\n * unfazed — official TypeScript SDK.\n *\n * The code-mode companion to the unfazed MCP server: write one script that\n * deploys, waits, reads logs and filters them locally, instead of chaining a\n * dozen tool calls through a model's context.\n *\n * ```ts\n * import { Unfazed } from \"unfazed\";\n *\n * const unfazed = new Unfazed();       // UNFZ_API_TOKEN, else your `npx unfazed login`\n * const ws = await unfazed.createWorkspace(\"hello\");\n * await unfazed.writeFiles(ws.id, {\n *   \"server.ts\": `export default { fetch: () => new Response(\"hi\") }`,\n * });\n * const app = await unfazed.deployService({ workspaceId: ws.id, alias: \"hello\", wait: true });\n * console.log(app.url);\n * ```\n *\n * `help()` returns the reference: every method with its signature.\n *\n * Two layers, both public:\n *  - {@link Unfazed} — the workflow layer (deploy + wait, one-commit batch\n *    writes, history and restore, errors, events, one-call rollback).\n *  - {@link UnfazedClient} — the typed GraphQL transport, for anything not wrapped.\n */\n\nimport type { RemoteWorld, RemoteWorldOptions } from \"./remote/world.js\";\n\nexport { Unfazed, parseDeploymentTimings } from \"./unfazed.js\";\nexport type {\n  AppRef,\n  ClientTimings,\n  CommitDeploymentTarget,\n  CommitDetail,\n  CommitPage,\n  CommitsLanded,\n  CreateRunOptions,\n  FollowUpRunOptions,\n  DeleteAppOptions,\n  DeleteAppResult,\n  DeleteDeploymentOptions,\n  DeleteWorkspaceOptions,\n  Deployment,\n  DeploymentEvent,\n  DeployBoxOptions,\n  DeployOptions,\n  DeployResult,\n  DeployServiceOptions,\n  DeployStaticOptions,\n  DeployTimings,\n  EnvVar,\n  ErrorGroup,\n  ErrorGroupDetail,\n  ErrorGroupPage,\n  ErrorGroupRef,\n  EventPage,\n  EventsInput,\n  EventType,\n  FileCommit,\n  FileContent,\n  FilesMap,\n  FileWriteOutcome,\n  ListErrorsOptions,\n  ListRunsFilter,\n  LiveApp,\n  PlatformEvent,\n  PlatformTimings,\n  RestoreVersionOptions,\n  RestoreVersionResult,\n  RollbackOptions,\n  Run,\n  TimingEvent,\n  UnfazedOptions,\n  Workspace,\n  WorkspaceFile,\n  WriteFilesOptions,\n  WriteFilesResult,\n  WrittenFile,\n} from \"./unfazed.js\";\n\n/**\n * The SDK's reference — every method with its signature — as a string:\n * `help()` for the page, `help(\"writeFiles\")` for one entry. The same page\n * ships as REFERENCE.md and is served at https://unfazed.dev/sdk.md.\n */\nexport { help, REFERENCE } from \"./reference.js\";\n\nexport {\n  UnfazedClient,\n  DEFAULT_BASE_URL,\n  DEFAULT_ENDPOINT,\n  ENDPOINT_ENV_VAR,\n  GRAPHQL_PATH,\n  TOKEN_ENV_VAR,\n  VERSION,\n} from \"./client.js\";\nexport type {\n  ClientOptions,\n  FetchLike,\n  GraphQLDocument,\n  RequestOptions,\n  ResultOf,\n  VariablesOf,\n} from \"./client.js\";\n\n/**\n * Workload identity: OIDC tokens the platform issues to the app this code\n * runs in, with only its `UNFZ_STATE_TOKEN`. `oidc` is the process's own\n * {@link UnfazedOIDC}; `new Unfazed().oidc` is the same with the instance's\n * endpoint and fetch.\n *\n * ```ts\n * import { oidc, oidcToken } from \"unfazed\";\n * const jwt = await oidcToken(\"https://api.example.com\");\n * const fetch = oidc.fetchWithToken(process.env.PRIVATEINFERENCE_AUDIENCE);\n * ```\n */\nexport { OIDC_TOKEN_PATH, STATE_TOKEN_ENV_VAR, UnfazedOIDC, oidc, oidcToken } from \"./oidc.js\";\nexport type {\n  FetchWithTokenOptions,\n  OIDCOptions,\n  OIDCToken,\n  OIDCTokenOptions,\n  OIDCTransport,\n  TokenFetch,\n} from \"./oidc.js\";\n\nexport {\n  DEPLOYMENT_NOT_FOUND,\n  UnfazedAuthError,\n  UnfazedConfigError,\n  UnfazedConflictError,\n  UnfazedDeployError,\n  UnfazedError,\n  UnfazedGraphQLError,\n  UnfazedHTTPError,\n  UnfazedNotFoundError,\n  UnfazedOIDCError,\n  UnfazedRunError,\n  UnfazedTimeoutError,\n  UnfazedUnconfirmedAppsError,\n  UnfazedWriteError,\n  WORKSPACE_NOT_FOUND,\n  isDuplicateWorkspaceName,\n  isNotFoundSentinel,\n  isTooManyWaits,\n} from \"./errors.js\";\nexport type { GraphQLResponseError, OIDCErrorCode } from \"./errors.js\";\n\nexport type { WaitOptions } from \"./wait.js\";\n\n/**\n * The stored login of `npx unfazed login`, which {@link UnfazedClient} uses when\n * no token is passed and `UNFZ_API_TOKEN` is unset. The helpers that read,\n * write and refresh it are in `unfazed/credentials`.\n */\nexport { CREDENTIALS_FILE, LOGIN_COMMAND, credentialsPath } from \"./credentials.js\";\nexport type { StoredCredentials } from \"./credentials.js\";\n\nexport { UnfazedInspectError } from \"./errors.js\";\nexport { APP_ENV_VAR } from \"./remote/app.js\";\nexport type { RemoteWorld, RemoteWorldOptions } from \"./remote/world.js\";\n\n/**\n * The `unfazed` backend of Workflow SDK's CLI: a read-mostly World over the\n * platform's workflow inspection API, for one app.\n *\n * ```sh\n * npx unfazed login                      # once: signs you in, in the browser\n * UNFZ_APP=birthday-card npx workflow inspect runs --backend unfazed\n * ```\n *\n * The token is `UNFZ_API_TOKEN` when set, else the stored login of\n * `npx unfazed login`, refreshed as it expires.\n *\n * The CLI (and its `--web` UI) resolve `unfazed` from the project and call\n * this with no arguments. The app is `UNFZ_APP`, else the `alias` (or the\n * single `apps[]` entry) of `unfazed.json` in the current directory. Reads\n * and `workflow cancel` work; every other write throws, since an app's own\n * World is `unfazed/workflow`. The module behind it loads on first call, so\n * `import \"unfazed\"` stays as light as before.\n */\nexport async function createWorld(options?: RemoteWorldOptions): Promise<RemoteWorld> {\n  const { createRemoteWorld } = await import(\"./remote/world.js\");\n  return createRemoteWorld(options);\n}\n\n/**\n * Every operation document the workflow layer uses, for callers that want the\n * typed documents but not the wrapper methods.\n */\nexport * as operations from \"./operations.js\";\n\n/**\n * Schema types generated from the platform's `graph/schema.graphqls`: enums\n * (`DeploymentStatus`, `ServiceMode`, ...), input objects\n * (`CreateDeploymentInput`, ...) and every operation's result type.\n */\nexport type * from \"./generated/graphql.js\";\n"]}

package/dist/oidc.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Workload identity: OIDC tokens the platform issues to an app.
+ *
+ * An app running on unfazed (a service or a cron job) asks the control plane
+ * for a short-lived JWT that names it, for one audience, and presents it to a
+ * service that trusts the issuer `https://unfazed.dev/oidc` instead of a
+ * static API key. The only credential is the app's own `UNFZ_STATE_TOKEN`,
+ * which the platform puts into each of its VMs; no `UNFZ_API_TOKEN` is
+ * involved.
+ *
+ * ```ts
+ * import { oidcToken } from "unfazed";
+ * const jwt = await oidcToken("https://api.example.com");
+ * ```
+ *
+ * Wire contract: `POST <platform>/oidc/token` with
+ * `Authorization: Bearer $UNFZ_STATE_TOKEN` and `{ audience, ttl_seconds? }`;
+ * 200 is `{ token, expires_at, token_type: "Bearer" }`, an error
+ * `{ error, error_description }`.
+ */
+/** Environment variable holding the app's state token, set in every unfazed service and cron VM. */
+export declare const STATE_TOKEN_ENV_VAR = "UNFZ_STATE_TOKEN";
+/** Path of the token endpoint under the platform origin. */
+export declare const OIDC_TOKEN_PATH = "/oidc/token";
+/**
+ * The `fetch` the token request goes through: the global `fetch`, or anything
+ * shaped like it (the client's `FetchLike` fits). `headers` on the response
+ * is read for `Retry-After` when present.
+ */
+export type OIDCTransport = (input: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    headers?: {
+        get(name: string): string | null;
+    };
+    text(): Promise<string>;
+}>;
+/** A `fetch` as the OpenAI SDK (and most HTTP clients) take one. */
+export type TokenFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export interface OIDCOptions {
+    /** The app's state token. Default: `UNFZ_STATE_TOKEN`, read on every call. */
+    stateToken?: string;
+    /**
+     * Full GraphQL endpoint; tokens come from its origin. Wins over `baseUrl`.
+     * Falls back to `UNFZ_API_URL`, then `https://unfazed.dev` (as the client).
+     */
+    endpoint?: string;
+    /** Platform origin; `/oidc/token` is appended. */
+    baseUrl?: string;
+    /** Where `UNFZ_STATE_TOKEN` and `UNFZ_API_URL` are read from. Default: `process.env`. */
+    env?: Record<string, string | undefined>;
+    /**
+     * The transport of the token request. Default: the global `fetch`. An
+     * instance with its own `fetch` (or `now`) keeps its own cache; every other
+     * one shares the process's.
+     */
+    fetch?: OIDCTransport;
+    /** Overrides the default `unfazed-sdk/<version>` User-Agent. */
+    userAgent?: string;
+    /** Timeout of one attempt, in ms. Default 10_000; 0 disables it. */
+    timeoutMs?: number;
+    /** Injected wall clock, ms (tests). */
+    now?: () => number;
+    /** Injected sleep between retries (tests). */
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface OIDCTokenOptions {
+    /** Token lifetime, a whole number of seconds from 60 to 3600. Default: the platform's. */
+    ttlSeconds?: number;
+    /**
+     * Stops waiting, with {@link UnfazedTimeoutError}. A request other callers
+     * wait on too keeps going (and fills the cache).
+     */
+    signal?: AbortSignal;
+}
+/** A token with its expiry, from {@link UnfazedOIDC.tokenResponse}. */
+export interface OIDCToken {
+    /** The JWT. */
+    token: string;
+    /** When it expires (the platform's `expires_at`). */
+    expiresAt: Date;
+}
+export interface FetchWithTokenOptions {
+    /** Token lifetime, a whole number of seconds from 60 to 3600. Default: the platform's. */
+    ttlSeconds?: number;
+    /** The `fetch` that sends the request. Default: the global `fetch`, at call time. */
+    fetch?: TokenFetch;
+}
+/**
+ * Workload identity tokens for the app this code runs in: `unfazed.oidc` on an
+ * {@link import("./unfazed.js").Unfazed} instance, or the standalone `oidc`.
+ *
+ * Tokens are cached per (audience, ttl) and reused until 80% of their
+ * lifetime has passed; concurrent calls for the same pair share one request.
+ * 503 (and a gateway's 502/504), 429 and network failures are retried up to 3
+ * times (200, 400, 800 ms; a 429's or 503's `Retry-After` up to 10 s is waited
+ * out instead); no other 4xx is retried. When a refresh fails for one of
+ * those passing reasons, the token it was replacing is returned while it is
+ * still valid.
+ */
+export declare class UnfazedOIDC {
+    #private;
+    constructor(options?: OIDCOptions);
+    /**
+     * A JWT for `audience`, from the cache while it is fresh.
+     *
+     * ```ts
+     * const jwt = await unfazed.oidc.token("https://api.example.com", { ttlSeconds: 300 });
+     * ```
+     *
+     * Throws {@link UnfazedOIDCError}: `not_in_app` without `UNFZ_STATE_TOKEN`,
+     * `invalid_audience`, `invalid_request` (`ttlSeconds`), or the platform's
+     * code.
+     */
+    token(audience: string | undefined, options?: OIDCTokenOptions): Promise<string>;
+    /** {@link token}, with the token's expiry: `{ token, expiresAt }`. */
+    tokenResponse(audience: string | undefined, options?: OIDCTokenOptions): Promise<OIDCToken>;
+    /**
+     * A `fetch` that sends every request with `Authorization: Bearer <token>`,
+     * a fresh token for `audience` each time (from the cache while it lasts).
+     * Every other header, the body and the signal pass through; an
+     * `Authorization` already there is replaced.
+     *
+     * ```ts
+     * const openai = new OpenAI({
+     *   baseURL: process.env.PRIVATEINFERENCE_BASE_URL,
+     *   apiKey: "unused",
+     *   fetch: unfazed.oidc.fetchWithToken(process.env.PRIVATEINFERENCE_AUDIENCE),
+     * });
+     * ```
+     *
+     * An invalid `audience` (an unset variable among them) throws here, at
+     * once; a missing `UNFZ_STATE_TOKEN` on the first request.
+     */
+    fetchWithToken(audience: string | undefined, options?: FetchWithTokenOptions): TokenFetch;
+}
+/**
+ * The process's own {@link UnfazedOIDC}: `UNFZ_STATE_TOKEN` and `UNFZ_API_URL`
+ * read on every call, the global `fetch`, one cache.
+ *
+ * ```ts
+ * import { oidc } from "unfazed";
+ * const fetchWithToken = oidc.fetchWithToken(process.env.PRIVATEINFERENCE_AUDIENCE);
+ * ```
+ */
+export declare const oidc: UnfazedOIDC;
+/**
+ * A JWT for `audience`, issued to the app this code runs in:
+ * {@link UnfazedOIDC.token} on the process's {@link oidc}. Needs only
+ * `UNFZ_STATE_TOKEN`.
+ *
+ * ```ts
+ * import { oidcToken } from "unfazed";
+ * const res = await fetch(url, { headers: { Authorization: `Bearer ${await oidcToken(url)}` } });
+ * ```
+ */
+export declare function oidcToken(audience: string | undefined, options?: OIDCTokenOptions): Promise<string>;