void 0.21.8 → 0.22.0

package/dist/runtime/live-client.d.mts

@@ -1,4 +1,4 @@
-import { t as LiveClientEvent } from "../live-CKiJilLr.mjs";
+import { t as LiveClientEvent } from "../live-CKJlvlNp.mjs";
 //#region src/runtime/live-client.d.ts
 export type LiveSubscribeOptions<Data = unknown> = {
   id: string;

package/dist/runtime/live.d.mts

@@ -1,3 +1,3 @@
 /// <reference types="@cloudflare/workers-types" />
-import { _ as __getLiveBindingName, a as LiveControlErrorCode, c as LiveControlOptions, d as LiveHookContext, f as LiveLimits, g as LiveSubscribeHookContext, h as LiveStreamOptions, i as LiveControlError, l as LiveControlRequest, m as LiveStream, n as LiveConnectHookContext, o as LiveControlOperation, p as LivePublishOptions, r as LiveConnectOptions, s as LiveControlOperationResult, t as LiveClientEvent, u as LiveControlResponse, v as __setLiveBindingName, y as defineLiveStream } from "../live-CKiJilLr.mjs";
+import { _ as __getLiveBindingName, a as LiveControlErrorCode, c as LiveControlOptions, d as LiveHookContext, f as LiveLimits, g as LiveSubscribeHookContext, h as LiveStreamOptions, i as LiveControlError, l as LiveControlRequest, m as LiveStream, n as LiveConnectHookContext, o as LiveControlOperation, p as LivePublishOptions, r as LiveConnectOptions, s as LiveControlOperationResult, t as LiveClientEvent, u as LiveControlResponse, v as __setLiveBindingName, y as defineLiveStream } from "../live-CKJlvlNp.mjs";
 export { LiveClientEvent, LiveConnectHookContext, LiveConnectOptions, LiveControlError, LiveControlErrorCode, LiveControlOperation, LiveControlOperationResult, LiveControlOptions, LiveControlRequest, LiveControlResponse, LiveHookContext, LiveLimits, LivePublishOptions, LiveStream, LiveStreamOptions, LiveSubscribeHookContext, __getLiveBindingName, __setLiveBindingName, defineLiveStream };

package/dist/runtime/sandbox-container.d.mts

@@ -0,0 +1,3 @@
+/// <reference types="@cloudflare/workers-types" />
+import { a as SandboxInstance, c as SandboxProcessWire, i as SandboxExecOptions, l as validateSandboxOptions, n as SandboxCapability, o as SandboxNativeContainer, r as SandboxContainer, s as SandboxOptions, t as DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS } from "../sandbox-container-DdNEBfCc.mjs";
+export { DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS, SandboxCapability, SandboxContainer, SandboxExecOptions, SandboxInstance, SandboxNativeContainer, SandboxOptions, SandboxProcessWire, validateSandboxOptions };

package/dist/runtime/sandbox-container.mjs

@@ -0,0 +1,2 @@
+import { n as SandboxContainer, r as validateSandboxOptions, t as DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS } from "../sandbox-container-4fdqLnyb.mjs";
+export { DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS, SandboxContainer, validateSandboxOptions };

package/dist/runtime/sandbox.d.mts

@@ -1,33 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
-import { Sandbox, SandboxOptions } from "@cloudflare/sandbox";
-//#region src/runtime/sandbox.d.ts
-export declare const DEFAULT_SANDBOX_ID = "default";
-export declare const DEFAULT_SANDBOX_BINDING = "SANDBOX";
-export declare const SANDBOX_SERVICE_BINDING = "__VOID_SANDBOX";
-export type VoidSandboxOptions = SandboxOptions & {
-  binding?: string;
-};
-export declare class SandboxLimitError extends Error {
-  override readonly name = "SandboxLimitError";
-  readonly reason: "concurrency" | "runtime_budget";
-  constructor(reason: "concurrency" | "runtime_budget", message?: string);
-}
-export declare class SandboxUnavailableError extends Error {
-  override readonly name = "SandboxUnavailableError";
-  constructor(message?: string);
-}
-export declare function __setSandboxBindingName(bindingName: string): void;
-/**
- * Retained for generated native/local Worker entries. Managed deployments host
- * the platform-owned Sandbox class in a separate Worker and never use this DO.
- */
-export declare class VoidPlatformSandbox<Env = unknown> extends Sandbox<Env> {
-  override onStart(): Promise<void>;
-}
-/** Resolve an isolated Sandbox on the current deployment. Starts on first use. */
-export declare function getSandbox<T extends Sandbox = Sandbox>(id?: string, options?: VoidSandboxOptions): Promise<T>;
-export declare const sandbox: {
-  get: typeof getSandbox;
-};
-//#endregion
-export { Sandbox, type SandboxOptions };
+import { i as SandboxExecOptions, s as SandboxOptions } from "../sandbox-container-DdNEBfCc.mjs";
+import { a as SandboxLimitError, c as VoidPlatformSandbox, d as getSandbox, f as sandbox, i as SandboxClient, l as VoidSandboxOptions, n as DEFAULT_SANDBOX_ID, o as SandboxProcess, r as SANDBOX_SERVICE_BINDING, s as SandboxUnavailableError, t as DEFAULT_SANDBOX_BINDING, u as __setSandboxBindingName } from "../sandbox-qpNBT8a3.mjs";
+export * from "@cloudflare/sandbox";
+export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, SANDBOX_SERVICE_BINDING, SandboxClient, type SandboxExecOptions, SandboxLimitError, type SandboxOptions, SandboxProcess, SandboxUnavailableError, VoidPlatformSandbox, VoidSandboxOptions, __setSandboxBindingName, getSandbox, sandbox };

package/dist/runtime/sandbox.mjs

@@ -1,6 +1,7 @@
 import { a as getRawRuntimeEnv } from "../env-raw-Cx8ElDdj.mjs";
 import { a as requireRuntimeBinding } from "../env-D5liuQYR.mjs";
-import { Sandbox, getSandbox as getSandbox$1 } from "@cloudflare/sandbox";
+import { n as SandboxContainer, r as validateSandboxOptions } from "../sandbox-container-4fdqLnyb.mjs";
+export * from "@cloudflare/sandbox";
 //#region src/runtime/sandbox.ts
 const DEFAULT_SANDBOX_ID = "default";
 const DEFAULT_SANDBOX_BINDING = "SANDBOX";
@@ -29,96 +30,141 @@ function rethrowSandboxError(error) {
 	if (message.includes("VOID_SANDBOX_unavailable")) throw new SandboxUnavailableError();
 	throw error;
 }
-function managedClient(capability) {
-	const call = async (target, operation, args) => {
+function encodeOptions(value) {
+	if (!value || typeof value !== "object") return {
+		options: value,
+		finish() {}
+	};
+	const { signal, ...options } = value;
+	if (!signal) return {
+		options,
+		finish() {}
+	};
+	signal.throwIfAborted();
+	let closed = false;
+	let remove;
+	let finish;
+	const abort = new ReadableStream({
+		start(controller) {
+			const listener = () => finish();
+			remove = () => signal.removeEventListener("abort", listener);
+			finish = () => {
+				remove();
+				if (!closed) {
+					closed = true;
+					controller.close();
+				}
+			};
+			signal.addEventListener("abort", listener, { once: true });
+		},
+		cancel() {
+			closed = true;
+			remove();
+		}
+	});
+	return {
+		options: {
+			...options,
+			abort
+		},
+		finish
+	};
+}
+function client(capability) {
+	const call = async (operation, args) => {
 		try {
-			return decodeManagedResult(await target.invoke(operation, prepareManagedArgs(operation, args)));
+			return await capability.invoke(operation, args);
 		} catch (error) {
 			rethrowSandboxError(error);
 		}
 	};
-	return new Proxy(Object.create(null), { get(_target, property) {
-		if (typeof property !== "string" || property === "then") return;
-		if (property === "tunnels") return new Proxy(Object.create(null), { get(_tunnels, method) {
-			if (typeof method !== "string" || method === "then") return;
-			return (...args) => call(capability, "tunnels", [method, ...args]);
-		} });
-		return (...args) => call(capability, property, args);
-	} });
-	function decodeManagedResult(value) {
-		if (Array.isArray(value)) return value.map(decodeManagedResult);
-		if (!value || typeof value !== "object") return value;
-		const record = value;
-		if (record.__voidSandboxType === "process") {
-			const { capability: processCapability, __voidSandboxType: _type, ...snapshot } = value;
-			return Object.assign(snapshot, {
-				kill: (...args) => call(processCapability, "kill", args),
-				getStatus: (...args) => call(processCapability, "getStatus", args),
-				getLogs: (...args) => call(processCapability, "getLogs", args),
-				waitForLog: (...args) => call(processCapability, "waitForLog", args),
-				waitForPort: (...args) => call(processCapability, "waitForPort", args),
-				waitForExit: (...args) => call(processCapability, "waitForExit", args)
-			});
+	const callWithOptions = async (operation, args, index) => {
+		const encoded = encodeOptions(args[index]);
+		args[index] = encoded.options;
+		try {
+			return await call(operation, args);
+		} catch (error) {
+			encoded.finish();
+			throw error;
 		}
-		if (record.__voidSandboxType === "session") {
-			const session = value;
-			return new Proxy({ id: session.id }, { get(target, property) {
-				if (property === "id") return target.id;
-				if (typeof property !== "string" || property === "then") return;
-				return (...args) => call(session.capability, property, args);
-			} });
+	};
+	return {
+		files: new Proxy(Object.create(null), { get(_target, method) {
+			if (typeof method !== "string" || method === "then") return;
+			return (...args) => {
+				const index = method === "writeFile" || method === "rename" ? 3 : 2;
+				return callWithOptions("files", [method, ...args], index);
+			};
+		} }),
+		async exec(argv, options) {
+			const wire = await callWithOptions("exec", [argv, options], 1);
+			let exitCode;
+			let output;
+			const process = {
+				pid: wire.pid,
+				isPty: wire.isPty,
+				stdin: wire.stdin,
+				stdout: wire.stdout,
+				stderr: wire.stderr,
+				get exitCode() {
+					return exitCode ??= wire.capability.invoke("exitCode", []);
+				},
+				output() {
+					return output ??= Promise.all([
+						wire.stdout ? new Response(wire.stdout).arrayBuffer() : /* @__PURE__ */ new ArrayBuffer(0),
+						wire.stderr ? new Response(wire.stderr).arrayBuffer() : /* @__PURE__ */ new ArrayBuffer(0),
+						process.exitCode
+					]).then(([stdout, stderr, exitCode]) => ({
+						stdout,
+						stderr,
+						exitCode
+					}));
+				},
+				kill: async (signal) => {
+					await wire.capability.invoke("kill", [signal]);
+				},
+				resize: async (cols, rows) => {
+					await wire.capability.invoke("resize", [cols, rows]);
+				}
+			};
+			return process;
+		},
+		fetch: async (port, request) => await call("fetch", [port, request]),
+		running: async () => await call("running", []),
+		destroy: async () => {
+			await call("destroy", []);
 		}
-		return value;
-	}
-	function prepareManagedArgs(operation, args) {
-		if (operation !== "startProcess") return args;
-		const [command, options, ...rest] = args;
-		if (!options || typeof options !== "object" || Array.isArray(options)) return args;
-		const onStart = options.onStart;
-		if (typeof onStart !== "function") return args;
-		return [
-			command,
-			{
-				...options,
-				onStart: (process) => onStart(decodeManagedResult(process))
-			},
-			...rest
-		];
-	}
+	};
 }
-/**
-* Retained for generated native/local Worker entries. Managed deployments host
-* the platform-owned Sandbox class in a separate Worker and never use this DO.
-*/
-var VoidPlatformSandbox = class extends Sandbox {
-	async onStart() {
+/** Generated local/native DO. Managed execution uses the trusted controller. */
+var VoidPlatformSandbox = class extends SandboxContainer {
+	async beforeStart() {
 		const env = this.env;
 		if (env.__PROJECT_ID !== void 0 || env.__VOID_PROXY !== void 0) throw new SandboxUnavailableError("Managed Sandboxes require the platform Sandbox controller. Redeploy this application.");
-		await super.onStart();
 	}
 };
-/** Resolve an isolated Sandbox on the current deployment. Starts on first use. */
-async function getSandbox(id = DEFAULT_SANDBOX_ID, options) {
-	const { binding = sandboxBindingName, ...sandboxOptions } = options ?? {};
-	const runtimeEnv = getRawRuntimeEnv();
-	const service = runtimeEnv[SANDBOX_SERVICE_BINDING];
+/** Resolve a container by name. Starts on the first command, file or port operation. */
+async function getSandbox(id = DEFAULT_SANDBOX_ID, options = {}) {
+	const { binding = sandboxBindingName, normalizeId = true, ...sandboxOptions } = options;
+	if (typeof normalizeId !== "boolean") throw new TypeError("Sandbox normalizeId must be a boolean.");
+	validateSandboxOptions(sandboxOptions);
+	if (typeof id !== "string" || id.length === 0 || id.length > 63) throw new TypeError("Sandbox id must contain between 1 and 63 characters.");
+	if (normalizeId) id = id.toLowerCase();
+	const env = getRawRuntimeEnv();
+	const service = env[SANDBOX_SERVICE_BINDING];
 	if (service) {
 		if (binding !== sandboxBindingName) throw new SandboxUnavailableError(`Managed Sandbox binding ${binding} is unavailable.`);
 		try {
-			return managedClient(await service.getSandbox(id, {
-				normalizeId: true,
-				...sandboxOptions
-			}));
+			return client(await service.getSandbox(id, sandboxOptions));
 		} catch (error) {
 			rethrowSandboxError(error);
 		}
 	}
-	if (runtimeEnv.__PROJECT_ID !== void 0 || runtimeEnv.__VOID_PROXY !== void 0) throw new SandboxUnavailableError("This deployment has no managed Sandbox controller. Redeploy this application.");
-	return getSandbox$1(requireRuntimeBinding(binding), id, {
-		normalizeId: true,
-		...sandboxOptions
-	});
+	if (env.__PROJECT_ID !== void 0 || env.__VOID_PROXY !== void 0) throw new SandboxUnavailableError("This deployment has no managed Sandbox controller. Redeploy this application.");
+	const stub = requireRuntimeBinding(binding).getByName(id);
+	await stub.configure(sandboxOptions);
+	return client(stub);
 }
 const sandbox = { get: getSandbox };
 //#endregion
-export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, SANDBOX_SERVICE_BINDING, Sandbox, SandboxLimitError, SandboxUnavailableError, VoidPlatformSandbox, __setSandboxBindingName, getSandbox, sandbox };
+export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, SANDBOX_SERVICE_BINDING, SandboxLimitError, SandboxUnavailableError, VoidPlatformSandbox, __setSandboxBindingName, getSandbox, sandbox };

package/dist/runtime/validator.d.mts

@@ -1,2 +1,2 @@
-import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-BXJTXd02.mjs";
+import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-HEcZsaij.mjs";
 export { HandlerInput, ValidatorSlots, runValidation };

package/dist/runtime/ws-server.d.mts

@@ -1,6 +1,6 @@
 import { n as AuthState } from "../auth-DkcFflXV.mjs";
 import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-BVkjZ3vM.mjs";
-import { t as AnyWebSocketDefinition } from "../ws-BwcqizuH.mjs";
+import { t as AnyWebSocketDefinition } from "../ws-BoY7vQML.mjs";
 //#region src/runtime/ws-server.d.ts
 export type WebSocketRouteMeta = {
   pattern: string;

package/dist/runtime/ws.d.mts

@@ -1,2 +1,2 @@
-import { a as RoomDefinition, c as VoidSocket, d as WebSocketConnection, f as connect, i as RoomController, l as VoidSocketCloseEvent, m as defineWebSocket, n as ConnectCommonOptions, o as SocketContext, p as defineRoom, r as RoomContext, s as SocketDefinition, t as AnyWebSocketDefinition, u as WebSocketBaseContext } from "../ws-BwcqizuH.mjs";
+import { a as RoomDefinition, c as VoidSocket, d as WebSocketConnection, f as connect, i as RoomController, l as VoidSocketCloseEvent, m as defineWebSocket, n as ConnectCommonOptions, o as SocketContext, p as defineRoom, r as RoomContext, s as SocketDefinition, t as AnyWebSocketDefinition, u as WebSocketBaseContext } from "../ws-BoY7vQML.mjs";
 export { AnyWebSocketDefinition, ConnectCommonOptions, RoomContext, RoomController, RoomDefinition, SocketContext, SocketDefinition, VoidSocket, VoidSocketCloseEvent, WebSocketBaseContext, WebSocketConnection, connect, defineRoom, defineWebSocket };

package/dist/sandbox-container-4fdqLnyb.mjs

@@ -0,0 +1,279 @@
+import { DurableObject, RpcTarget } from "cloudflare:workers";
+import { Files } from "@cloudflare/sandbox";
+//#region src/runtime/sandbox-container.ts
+const OPTIONS = /* @__PURE__ */ new Set([
+	"inactivityTimeoutMs",
+	"enableInternet",
+	"labels"
+]);
+const FILE_OPERATIONS = /* @__PURE__ */ new Set([
+	"readFile",
+	"writeFile",
+	"stat",
+	"lstat",
+	"readDirectory",
+	"mkdir",
+	"rename",
+	"remove"
+]);
+const DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS = 6e5;
+function validateSandboxOptions(options) {
+	if (!options || typeof options !== "object" || Array.isArray(options)) throw new TypeError("Sandbox options must be an object.");
+	for (const key of Object.keys(options)) if (!OPTIONS.has(key)) throw new TypeError(`Unsupported Sandbox option: ${key}`);
+	if (options.inactivityTimeoutMs !== void 0 && (!Number.isInteger(options.inactivityTimeoutMs) || options.inactivityTimeoutMs < 1 || options.inactivityTimeoutMs > 216e5)) throw new TypeError("Sandbox inactivityTimeoutMs must be an integer between 1 and 21600000.");
+	if (options.enableInternet !== void 0 && typeof options.enableInternet !== "boolean") throw new TypeError("Sandbox enableInternet must be a boolean.");
+	if (options.labels !== void 0 && (!options.labels || typeof options.labels !== "object" || Array.isArray(options.labels) || Object.values(options.labels).some((value) => typeof value !== "string"))) throw new TypeError("Sandbox labels must be strings.");
+}
+var ProcessCapability = class extends RpcTarget {
+	#process;
+	#exited = false;
+	#waitForExit;
+	constructor(process, waitForExit) {
+		super();
+		this.#process = process;
+		this.#waitForExit = waitForExit;
+		process.exitCode.then(() => {
+			this.#exited = true;
+		}, () => {
+			this.#exited = true;
+		});
+	}
+	async invoke(operation, args) {
+		if (!Array.isArray(args)) throw new TypeError("Sandbox arguments must be an array.");
+		if (operation === "exitCode") return this.#waitForExit();
+		if (operation === "kill") {
+			if (this.#exited) return;
+			return this.#process.kill(args[0]);
+		}
+		if (operation === "resize") return this.#process.resize(args[0], args[1]);
+		throw new TypeError(`Unsupported Sandbox process operation: ${operation}`);
+	}
+};
+/** Decode cancellation without trying to serialize an AbortSignal over Workers RPC. */
+function operationOptions(value) {
+	const { abort, ...options } = value ?? {};
+	if (abort === void 0) return {
+		options,
+		finish() {}
+	};
+	if (!(abort instanceof ReadableStream)) throw new TypeError("Invalid Sandbox cancellation stream.");
+	const controller = new AbortController();
+	const reader = abort.getReader();
+	let finished = false;
+	reader.read().then(() => {
+		if (!finished) controller.abort();
+	}, () => {
+		if (!finished) controller.abort();
+	});
+	return {
+		options: {
+			...options,
+			signal: controller.signal
+		},
+		finish() {
+			finished = true;
+			reader.cancel().catch(() => {});
+		}
+	};
+}
+/** Shared native execution, used by local Workers and the trusted platform controller. */
+var SandboxContainer = class extends DurableObject {
+	instanceType = "lite";
+	#setup;
+	#options = {};
+	#ready;
+	starting = false;
+	#epoch = 0;
+	constructor(ctx, env) {
+		super(ctx, env);
+		this.#ready = ctx.blockConcurrencyWhile(async () => {
+			this.#options = await ctx.storage.get("__voidSandboxOptions") ?? {};
+			if (this.container.running) await this.container.setInactivityTimeout(this.inactivityTimeoutMs);
+		});
+	}
+	get container() {
+		if (!this.ctx.container) throw new Error("Sandbox container binding is missing.");
+		return this.ctx.container;
+	}
+	async configure(options) {
+		validateSandboxOptions(options);
+		await this.#ready;
+		this.#options = { ...options };
+		await this.ctx.storage.put("__voidSandboxOptions", this.#options);
+		if (this.container.running) await this.container.setInactivityTimeout(this.inactivityTimeoutMs);
+	}
+	get inactivityTimeoutMs() {
+		return this.#options.inactivityTimeoutMs ?? 6e5;
+	}
+	async beforeStart() {}
+	async afterStart() {}
+	async beforeUse() {}
+	async stopped() {}
+	async waitForProcessExit(exitCode) {
+		return exitCode;
+	}
+	/** Native abort listeners must be detached as soon as a process exits. */
+	async execProcess(argv, options = {}) {
+		const { signal, ...nativeOptions } = options;
+		if (!signal) return this.container.exec(argv, nativeOptions);
+		const controller = new AbortController();
+		const abort = () => controller.abort();
+		if (signal.aborted) abort();
+		else signal.addEventListener("abort", abort, { once: true });
+		const finish = () => signal.removeEventListener("abort", abort);
+		try {
+			const process = await this.container.exec(argv, {
+				...nativeOptions,
+				signal: controller.signal
+			});
+			process.exitCode.then(finish, finish);
+			return process;
+		} catch (error) {
+			finish();
+			throw error;
+		}
+	}
+	async initializationOutput(argv, options, timeoutMs) {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		const finish = () => clearTimeout(timer);
+		try {
+			const process = await this.execProcess(argv, {
+				...options,
+				signal: controller.signal
+			});
+			process.exitCode.then(finish, finish);
+			return await process.output();
+		} finally {
+			finish();
+		}
+	}
+	async initialize() {
+		if ((await this.initializationOutput([
+			"sh",
+			"-c",
+			"mkdir -p /workspace"
+		], {}, 6e4)).exitCode !== 0) throw new Error("Sandbox workspace initialization failed.");
+	}
+	get entrypoint() {}
+	get image() {
+		return this.container.images.default;
+	}
+	async ensureRunning() {
+		if (!this.#setup || !this.container.running && !this.starting) {
+			this.starting = true;
+			this.#setup = this.setup(this.#epoch).catch((error) => {
+				this.#setup = void 0;
+				throw error;
+			}).finally(() => {
+				this.starting = false;
+			});
+		}
+		await this.#setup;
+		await this.beforeUse();
+	}
+	async setup(epoch) {
+		await this.#ready;
+		try {
+			await this.beforeStart();
+			if (epoch !== this.#epoch) throw new Error("Sandbox startup was cancelled.");
+			if (!this.container.running) this.container.start({
+				image: this.image,
+				instance: this.instanceType,
+				enableInternet: this.#options.enableInternet ?? false,
+				labels: this.#options.labels,
+				...this.entrypoint ? { entrypoint: this.entrypoint } : {}
+			});
+			await this.initialize();
+			if (epoch !== this.#epoch) throw new Error("Sandbox startup was cancelled.");
+			await this.container.setInactivityTimeout(this.inactivityTimeoutMs);
+			await this.afterStart();
+		} catch (error) {
+			await this.destroy().catch(() => {});
+			throw error;
+		}
+	}
+	async destroy() {
+		this.#epoch++;
+		if (this.container.running) await this.container.destroy();
+		if (this.container.running) throw new Error("VOID_SANDBOX_unavailable");
+		if (!this.starting) this.#setup = void 0;
+		await this.stopped();
+	}
+	async invoke(operation, args) {
+		if (!Array.isArray(args)) throw new TypeError("Sandbox arguments must be an array.");
+		if (operation === "destroy") return this.destroy();
+		if (operation === "running") return this.container.running;
+		if (operation === "files") {
+			const [method, ...parameters] = args;
+			if (!FILE_OPERATIONS.has(method)) throw new TypeError(`Unsupported Sandbox file operation: ${String(method)}`);
+			await this.ensureRunning();
+			const index = method === "writeFile" || method === "rename" ? 2 : 1;
+			const { options, finish } = operationOptions(parameters[index]);
+			parameters[index] = options;
+			try {
+				const files = new Files({ exec: (argv, options) => this.execProcess(argv, options) });
+				const result = await files[method].apply(files, parameters);
+				if (result instanceof Response && result.body) {
+					const reader = result.body.getReader();
+					return new Response(new ReadableStream({
+						async pull(controller) {
+							try {
+								const chunk = await reader.read();
+								if (chunk.done) {
+									finish();
+									controller.close();
+								} else controller.enqueue(chunk.value);
+							} catch (error) {
+								finish();
+								controller.error(error);
+							}
+						},
+						async cancel(reason) {
+							finish();
+							await reader.cancel(reason);
+						}
+					}), result);
+				}
+				finish();
+				return result;
+			} catch (error) {
+				finish();
+				throw error;
+			}
+		}
+		if (operation === "exec") {
+			const [argv, value] = args;
+			if (!Array.isArray(argv) || argv.length === 0 || argv.some((arg) => typeof arg !== "string")) throw new TypeError("Sandbox exec requires an executable and arguments as an array of strings.");
+			const { options, finish } = operationOptions(value);
+			try {
+				await this.ensureRunning();
+				const process = await this.execProcess(argv, {
+					cwd: "/workspace",
+					...options
+				});
+				process.exitCode.then(finish, finish);
+				return {
+					capability: new ProcessCapability(process, () => this.waitForProcessExit(process.exitCode)),
+					pid: process.pid,
+					isPty: process.isPty ?? false,
+					stdin: process.stdin ?? null,
+					stdout: process.stdout ?? null,
+					stderr: process.stderr ?? null
+				};
+			} catch (error) {
+				finish();
+				throw error;
+			}
+		}
+		if (operation === "fetch") {
+			const [port, request] = args;
+			if (!Number.isInteger(port) || port < 1 || port > 65535) throw new TypeError("Invalid Sandbox TCP port.");
+			await this.ensureRunning();
+			return this.container.getTcpPort(port).fetch(request);
+		}
+		throw new TypeError(`Unsupported Sandbox operation: ${operation}`);
+	}
+};
+//#endregion
+export { SandboxContainer as n, validateSandboxOptions as r, DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS as t };

package/dist/sandbox-container-DdNEBfCc.d.mts

@@ -0,0 +1,72 @@
+import { DurableObject } from "cloudflare:workers";
+//#region src/runtime/sandbox-container.d.ts
+type SandboxInstance = "lite" | "standard-1" | "standard-2" | "standard-3" | "standard-4";
+type SandboxOptions = {
+  inactivityTimeoutMs?: number;
+  enableInternet?: boolean;
+  labels?: Record<string, string>;
+};
+type SandboxExecOptions = ContainerExecOptions & {
+  signal?: AbortSignal;
+  pty?: boolean | {
+    cols?: number;
+    rows?: number;
+  };
+};
+type SandboxCapability = {
+  invoke(operation: string, args: Array<unknown>): Promise<unknown>;
+};
+type SandboxProcessWire = {
+  capability: SandboxCapability;
+  pid: number;
+  isPty: boolean;
+  stdin: WritableStream | null;
+  stdout: ReadableStream | null;
+  stderr: ReadableStream | null;
+};
+type SandboxNativeContainer = Omit<Container, "start" | "exec"> & {
+  readonly images: Record<string, string>;
+  start(options: {
+    image: string;
+    instance: SandboxInstance;
+    enableInternet: boolean;
+    labels?: Record<string, string>;
+    entrypoint?: Array<string>;
+  }): void;
+  exec(argv: Array<string>, options?: SandboxExecOptions): Promise<ExecProcess & {
+    isPty?: boolean;
+    resize(cols: number, rows: number): void;
+  }>;
+};
+declare const DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS: number;
+declare function validateSandboxOptions(options: SandboxOptions): void;
+/** Shared native execution, used by local Workers and the trusted platform controller. */
+declare class SandboxContainer<Env = unknown> extends DurableObject<Env> {
+  #private;
+  protected instanceType: SandboxInstance;
+  protected starting: boolean;
+  constructor(ctx: DurableObjectState, env: Env);
+  protected get container(): SandboxNativeContainer;
+  configure(options: SandboxOptions): Promise<void>;
+  protected get inactivityTimeoutMs(): number;
+  protected beforeStart(): Promise<void>;
+  protected afterStart(): Promise<void>;
+  protected beforeUse(): Promise<void>;
+  protected stopped(): Promise<void>;
+  protected waitForProcessExit(exitCode: Promise<number>): Promise<number>;
+  /** Native abort listeners must be detached as soon as a process exits. */
+  protected execProcess(argv: Array<string>, options?: SandboxExecOptions): Promise<ExecProcess & {
+    isPty?: boolean;
+    resize(cols: number, rows: number): void;
+  }>;
+  protected initializationOutput(argv: Array<string>, options: SandboxExecOptions, timeoutMs: number): Promise<ExecOutput>;
+  protected initialize(): Promise<void>;
+  protected get entrypoint(): Array<string> | undefined;
+  protected get image(): string;
+  protected ensureRunning(): Promise<void>;
+  private setup;
+  destroy(): Promise<void>;
+  invoke(operation: string, args: Array<unknown>): Promise<unknown>;
+}
+//#endregion
+export { SandboxInstance as a, SandboxProcessWire as c, SandboxExecOptions as i, validateSandboxOptions as l, SandboxCapability as n, SandboxNativeContainer as o, SandboxContainer as r, SandboxOptions as s, DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS as t };