void 0.21.9 → 0.23.0

package/dist/runtime/sandbox-container.d.mts

@@ -0,0 +1,3 @@
+/// <reference types="@cloudflare/workers-types" />
+import { a as SandboxInstance, c as SandboxProcessWire, i as SandboxExecOptions, l as validateSandboxOptions, n as SandboxCapability, o as SandboxNativeContainer, r as SandboxContainer, s as SandboxOptions, t as DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS } from "../sandbox-container-Bo0eiFKz.mjs";
+export { DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS, SandboxCapability, SandboxContainer, SandboxExecOptions, SandboxInstance, SandboxNativeContainer, SandboxOptions, SandboxProcessWire, validateSandboxOptions };

package/dist/runtime/sandbox-container.mjs

@@ -0,0 +1,2 @@
+import { n as SandboxContainer, r as validateSandboxOptions, t as DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS } from "../sandbox-container-C6ItmVuN.mjs";
+export { DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS, SandboxContainer, validateSandboxOptions };

package/dist/runtime/sandbox.d.mts

@@ -1,33 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
-import { Sandbox, SandboxOptions } from "@cloudflare/sandbox";
-//#region src/runtime/sandbox.d.ts
-export declare const DEFAULT_SANDBOX_ID = "default";
-export declare const DEFAULT_SANDBOX_BINDING = "SANDBOX";
-export declare const SANDBOX_SERVICE_BINDING = "__VOID_SANDBOX";
-export type VoidSandboxOptions = SandboxOptions & {
-  binding?: string;
-};
-export declare class SandboxLimitError extends Error {
-  override readonly name = "SandboxLimitError";
-  readonly reason: "concurrency" | "runtime_budget";
-  constructor(reason: "concurrency" | "runtime_budget", message?: string);
-}
-export declare class SandboxUnavailableError extends Error {
-  override readonly name = "SandboxUnavailableError";
-  constructor(message?: string);
-}
-export declare function __setSandboxBindingName(bindingName: string): void;
-/**
- * Retained for generated native/local Worker entries. Managed deployments host
- * the platform-owned Sandbox class in a separate Worker and never use this DO.
- */
-export declare class VoidPlatformSandbox<Env = unknown> extends Sandbox<Env> {
-  override onStart(): Promise<void>;
-}
-/** Resolve an isolated Sandbox on the current deployment. Starts on first use. */
-export declare function getSandbox<T extends Sandbox = Sandbox>(id?: string, options?: VoidSandboxOptions): Promise<T>;
-export declare const sandbox: {
-  get: typeof getSandbox;
-};
-//#endregion
-export { Sandbox, type SandboxOptions };
+import { i as SandboxExecOptions, s as SandboxOptions } from "../sandbox-container-Bo0eiFKz.mjs";
+import { a as SandboxFiles, c as SandboxUnavailableError, d as __setSandboxBindingName, f as getSandbox, i as SandboxClient, l as VoidPlatformSandbox, n as DEFAULT_SANDBOX_ID, o as SandboxLimitError, p as sandbox, r as SANDBOX_SERVICE_BINDING, s as SandboxProcess, t as DEFAULT_SANDBOX_BINDING, u as VoidSandboxOptions } from "../sandbox-XZAqzFlG.mjs";
+export * from "@cloudflare/sandbox";
+export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, SANDBOX_SERVICE_BINDING, SandboxClient, type SandboxExecOptions, SandboxFiles, SandboxLimitError, type SandboxOptions, SandboxProcess, SandboxUnavailableError, VoidPlatformSandbox, VoidSandboxOptions, __setSandboxBindingName, getSandbox, sandbox };

package/dist/runtime/sandbox.mjs

@@ -1,16 +1,20 @@
 import { a as getRawRuntimeEnv } from "../env-raw-Cx8ElDdj.mjs";
 import { a as requireRuntimeBinding } from "../env-D5liuQYR.mjs";
-import { Sandbox, getSandbox as getSandbox$1 } from "@cloudflare/sandbox";
+import { i as limitOperation, t as UsageLimit } from "../limits-Cjuk2VPm.mjs";
+import { n as SandboxContainer, r as validateSandboxOptions } from "../sandbox-container-C6ItmVuN.mjs";
+export * from "@cloudflare/sandbox";
 //#region src/runtime/sandbox.ts
 const DEFAULT_SANDBOX_ID = "default";
 const DEFAULT_SANDBOX_BINDING = "SANDBOX";
 const SANDBOX_SERVICE_BINDING = "__VOID_SANDBOX";
-var SandboxLimitError = class extends Error {
+var SandboxLimitError = class extends UsageLimit {
 	name = "SandboxLimitError";
-	reason;
 	constructor(reason, message) {
-		super(message ?? `Sandbox limit reached: ${reason}`);
-		this.reason = reason;
+		super({
+			resource: "sandbox",
+			reason,
+			message: message ?? `Sandbox limit reached: ${reason}`
+		});
 	}
 };
 var SandboxUnavailableError = class extends Error {
@@ -29,96 +33,168 @@ function rethrowSandboxError(error) {
 	if (message.includes("VOID_SANDBOX_unavailable")) throw new SandboxUnavailableError();
 	throw error;
 }
-function managedClient(capability) {
-	const call = async (target, operation, args) => {
+function encodeOptions(value) {
+	if (!value || typeof value !== "object") return {
+		options: value,
+		finish() {}
+	};
+	const { signal, ...options } = value;
+	if (!signal) return {
+		options,
+		finish() {}
+	};
+	signal.throwIfAborted();
+	let closed = false;
+	let remove;
+	let finish;
+	const abort = new ReadableStream({
+		start(controller) {
+			const listener = () => finish();
+			remove = () => signal.removeEventListener("abort", listener);
+			finish = () => {
+				remove();
+				if (!closed) {
+					closed = true;
+					controller.close();
+				}
+			};
+			signal.addEventListener("abort", listener, { once: true });
+		},
+		cancel() {
+			closed = true;
+			remove();
+		}
+	});
+	return {
+		options: {
+			...options,
+			abort
+		},
+		finish
+	};
+}
+function client(capability) {
+	const call = async (operation, args) => {
 		try {
-			return decodeManagedResult(await target.invoke(operation, prepareManagedArgs(operation, args)));
+			return await capability.invoke(operation, args);
 		} catch (error) {
 			rethrowSandboxError(error);
 		}
 	};
-	return new Proxy(Object.create(null), { get(_target, property) {
-		if (typeof property !== "string" || property === "then") return;
-		if (property === "tunnels") return new Proxy(Object.create(null), { get(_tunnels, method) {
-			if (typeof method !== "string" || method === "then") return;
-			return (...args) => call(capability, "tunnels", [method, ...args]);
-		} });
-		return (...args) => call(capability, property, args);
+	const callWithOptions = async (operation, args, index) => {
+		const encoded = encodeOptions(args[index]);
+		args[index] = encoded.options;
+		try {
+			return await call(operation, args);
+		} catch (error) {
+			encoded.finish();
+			throw error;
+		}
+	};
+	const files = new Proxy(Object.create(null), { get(_target, method) {
+		if (typeof method !== "string" || method === "then") return;
+		return (...args) => {
+			const index = method === "writeFile" || method === "rename" ? 3 : 2;
+			return limitOperation(() => callWithOptions("files", [method, ...args], index));
+		};
 	} });
-	function decodeManagedResult(value) {
-		if (Array.isArray(value)) return value.map(decodeManagedResult);
-		if (!value || typeof value !== "object") return value;
-		const record = value;
-		if (record.__voidSandboxType === "process") {
-			const { capability: processCapability, __voidSandboxType: _type, ...snapshot } = value;
-			return Object.assign(snapshot, {
-				kill: (...args) => call(processCapability, "kill", args),
-				getStatus: (...args) => call(processCapability, "getStatus", args),
-				getLogs: (...args) => call(processCapability, "getLogs", args),
-				waitForLog: (...args) => call(processCapability, "waitForLog", args),
-				waitForPort: (...args) => call(processCapability, "waitForPort", args),
-				waitForExit: (...args) => call(processCapability, "waitForExit", args)
+	const execute = async (argv, options) => {
+		const wire = await callWithOptions("exec", [argv, options], 1);
+		let exitCode;
+		let output;
+		const process = {
+			pid: wire.pid,
+			isPty: wire.isPty,
+			stdin: wire.stdin,
+			stdout: wire.stdout,
+			stderr: wire.stderr,
+			get exitCode() {
+				return exitCode ??= limitOperation(async () => {
+					try {
+						return await wire.capability.invoke("exitCode", []);
+					} catch (error) {
+						rethrowSandboxError(error);
+					}
+				});
+			},
+			output() {
+				return output ??= limitOperation(async () => {
+					try {
+						return await Promise.all([
+							wire.stdout ? new Response(wire.stdout).arrayBuffer() : /* @__PURE__ */ new ArrayBuffer(0),
+							wire.stderr ? new Response(wire.stderr).arrayBuffer() : /* @__PURE__ */ new ArrayBuffer(0),
+							process.exitCode.match({
+								ok: (code) => code,
+								limited: (limit) => {
+									throw limit;
+								}
+							})
+						]).then(([stdout, stderr, exitCode]) => ({
+							stdout,
+							stderr,
+							exitCode
+						}));
+					} catch (error) {
+						rethrowSandboxError(error);
+					}
+				});
+			},
+			kill: async (signal) => {
+				await wire.capability.invoke("kill", [signal]);
+			},
+			resize: async (cols, rows) => {
+				await wire.capability.invoke("resize", [cols, rows]);
+			}
+		};
+		return process;
+	};
+	return {
+		files,
+		exec: (argv, options) => limitOperation(() => execute(argv, options)),
+		run: (argv, options) => limitOperation(async () => {
+			return (await execute(argv, options)).output().match({
+				ok: (result) => result,
+				limited: (limit) => {
+					throw limit;
+				}
 			});
+		}),
+		fetch: (port, request) => limitOperation(async () => await call("fetch", [port, request])),
+		running: async () => await call("running", []),
+		destroy: async () => {
+			await call("destroy", []);
 		}
-		if (record.__voidSandboxType === "session") {
-			const session = value;
-			return new Proxy({ id: session.id }, { get(target, property) {
-				if (property === "id") return target.id;
-				if (typeof property !== "string" || property === "then") return;
-				return (...args) => call(session.capability, property, args);
-			} });
-		}
-		return value;
-	}
-	function prepareManagedArgs(operation, args) {
-		if (operation !== "startProcess") return args;
-		const [command, options, ...rest] = args;
-		if (!options || typeof options !== "object" || Array.isArray(options)) return args;
-		const onStart = options.onStart;
-		if (typeof onStart !== "function") return args;
-		return [
-			command,
-			{
-				...options,
-				onStart: (process) => onStart(decodeManagedResult(process))
-			},
-			...rest
-		];
-	}
+	};
 }
-/**
-* Retained for generated native/local Worker entries. Managed deployments host
-* the platform-owned Sandbox class in a separate Worker and never use this DO.
-*/
-var VoidPlatformSandbox = class extends Sandbox {
-	async onStart() {
+/** Generated local/native DO. Managed execution uses the trusted controller. */
+var VoidPlatformSandbox = class extends SandboxContainer {
+	async beforeStart() {
 		const env = this.env;
 		if (env.__PROJECT_ID !== void 0 || env.__VOID_PROXY !== void 0) throw new SandboxUnavailableError("Managed Sandboxes require the platform Sandbox controller. Redeploy this application.");
-		await super.onStart();
 	}
 };
-/** Resolve an isolated Sandbox on the current deployment. Starts on first use. */
-async function getSandbox(id = DEFAULT_SANDBOX_ID, options) {
-	const { binding = sandboxBindingName, ...sandboxOptions } = options ?? {};
-	const runtimeEnv = getRawRuntimeEnv();
-	const service = runtimeEnv[SANDBOX_SERVICE_BINDING];
+/** Resolve a container by name. Starts on the first command, file or port operation. */
+async function getSandbox(id = DEFAULT_SANDBOX_ID, options = {}) {
+	const { binding = sandboxBindingName, normalizeId = true, ...sandboxOptions } = options;
+	if (typeof normalizeId !== "boolean") throw new TypeError("Sandbox normalizeId must be a boolean.");
+	validateSandboxOptions(sandboxOptions);
+	if (typeof id !== "string" || id.length === 0 || id.length > 63) throw new TypeError("Sandbox id must contain between 1 and 63 characters.");
+	if (normalizeId) id = id.toLowerCase();
+	const env = getRawRuntimeEnv();
+	const service = env[SANDBOX_SERVICE_BINDING];
 	if (service) {
 		if (binding !== sandboxBindingName) throw new SandboxUnavailableError(`Managed Sandbox binding ${binding} is unavailable.`);
 		try {
-			return managedClient(await service.getSandbox(id, {
-				normalizeId: true,
-				...sandboxOptions
-			}));
+			return client(await service.getSandbox(id, sandboxOptions));
 		} catch (error) {
 			rethrowSandboxError(error);
 		}
 	}
-	if (runtimeEnv.__PROJECT_ID !== void 0 || runtimeEnv.__VOID_PROXY !== void 0) throw new SandboxUnavailableError("This deployment has no managed Sandbox controller. Redeploy this application.");
-	return getSandbox$1(requireRuntimeBinding(binding), id, {
-		normalizeId: true,
-		...sandboxOptions
-	});
+	if (env.__PROJECT_ID !== void 0 || env.__VOID_PROXY !== void 0) throw new SandboxUnavailableError("This deployment has no managed Sandbox controller. Redeploy this application.");
+	const stub = requireRuntimeBinding(binding).getByName(id);
+	await stub.configure(sandboxOptions);
+	return client(stub);
 }
 const sandbox = { get: getSandbox };
 //#endregion
-export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, SANDBOX_SERVICE_BINDING, Sandbox, SandboxLimitError, SandboxUnavailableError, VoidPlatformSandbox, __setSandboxBindingName, getSandbox, sandbox };
+export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, SANDBOX_SERVICE_BINDING, SandboxLimitError, SandboxUnavailableError, VoidPlatformSandbox, __setSandboxBindingName, getSandbox, sandbox };

package/dist/runtime/sse.mjs

@@ -1,2 +1,2 @@
-import { a as getLastEventId, i as formatSseText, n as eventStream, r as formatSse, t as SseStreamClosedError } from "../sse-BaC1jXko.mjs";
+import { a as getLastEventId, i as formatSseText, n as eventStream, r as formatSse, t as SseStreamClosedError } from "../sse-CQNaDFFV.mjs";
 export { SseStreamClosedError, eventStream, formatSse, formatSseText, getLastEventId };

package/dist/runtime/validator.d.mts

@@ -1,2 +1,2 @@
-import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-BXJTXd02.mjs";
+import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-CZ4nAylQ.mjs";
 export { HandlerInput, ValidatorSlots, runValidation };

package/dist/runtime/ws-server.d.mts

@@ -1,8 +1,10 @@
 import { n as AuthState } from "../auth-DkcFflXV.mjs";
 import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-BVkjZ3vM.mjs";
-import { t as AnyWebSocketDefinition } from "../ws-BwcqizuH.mjs";
+import { f as WebSocketInstanceKey, t as AnyWebSocketDefinition } from "../ws-CL1w7GXU.mjs";
 //#region src/runtime/ws-server.d.ts
 export type WebSocketRouteMeta = {
+  name?: string;
+  key?: WebSocketInstanceKey;
   pattern: string;
   params: Array<string>;
   className: string;
@@ -17,7 +19,7 @@ export type WebSocketDurableObjectClass = {
   new (state: DurableObjectState, env: Record<string, unknown>): WebSocketDurableObjectInstance;
 };
 type ResolveVoidAuthState = (request: Request, env: VoidAuthEnv, runtime: VoidAuthRuntimeOptions) => Promise<AuthState | null>;
-export declare function buildWebSocketInstanceId(route: Pick<WebSocketRouteMeta, "params">, params: Record<string, string>): string;
+export declare function buildWebSocketInstanceId(route: Pick<WebSocketRouteMeta, "params" | "key">, params: Record<string, string>): string;
 export declare function createWebSocketDurableObject(definition: AnyWebSocketDefinition, route: WebSocketRouteMeta, authRuntime?: VoidAuthRuntimeOptions, resolveAuthState?: ResolveVoidAuthState): WebSocketDurableObjectClass;
 /** Keep a removed WebSocket Durable Object class deployable without deleting its storage. */
 export declare function createWebSocketTombstoneDurableObject(className: string): WebSocketDurableObjectClass;

package/dist/runtime/ws-server.mjs

@@ -48,7 +48,14 @@ function getRouteMatch(request, route) {
 	return match.matched ? match.params : null;
 }
 function buildWebSocketInstanceId(route, params) {
+	if (route.key) {
+		const key = route.key({ params });
+		if (typeof key !== "string") throw new Error("ws: key must return a string synchronously.");
+		return key;
+	}
 	if (route.params.length === 0) return "default";
+	const entries = route.params.map((name) => [name, params[name] ?? ""]);
+	if (entries.length > 1 && entries.some(([, value]) => value.includes("&"))) return `v2:${JSON.stringify(entries)}`;
 	return route.params.map((name) => `${name}=${params[name] ?? ""}`).join("&");
 }
 async function validateSchema(schema, value) {
@@ -92,6 +99,16 @@ function getStoredConnection(webSocket) {
 		authState: null
 	};
 }
+function completeWebSocketClose(webSocket, code, reason) {
+	if (webSocket.readyState === 3) return;
+	if ([
+		1004,
+		1005,
+		1006,
+		1015
+	].includes(code)) webSocket.close();
+	else webSocket.close(code, reason);
+}
 function setStoredConnection(webSocket, data) {
 	webSocket.serializeAttachment?.(data);
 }
@@ -164,6 +181,11 @@ function assertDefinition(definition) {
 }
 function createWebSocketDurableObject(definition, route, authRuntime, resolveAuthState) {
 	assertDefinition(definition);
+	if (definition.name !== route.name) throw new Error("ws: name must be statically discoverable in the route definition. Run void info to inspect this route.");
+	const instanceRoute = {
+		...route,
+		key: definition.key
+	};
 	class VoidWebSocketDurableObject {
 		state;
 		env;
@@ -176,7 +198,7 @@ function createWebSocketDurableObject(definition, route, authRuntime, resolveAut
 		}
 		async handleFetch(request) {
 			const params = getRouteMatch(request, route) ?? {};
-			const roomId = buildWebSocketInstanceId(route, params);
+			const roomId = buildWebSocketInstanceId(instanceRoute, params);
 			const authState = authRuntime && resolveAuthState ? await resolveAuthState(request, this.env, authRuntime) : null;
 			const user = authState?.user ?? null;
 			if (request.headers.get("upgrade")?.toLowerCase() === "websocket") {
@@ -261,6 +283,7 @@ function createWebSocketDurableObject(definition, route, authRuntime, resolveAut
 			return withRuntimeEnv(this.env, () => this.handleWebSocketClose(webSocket, code, reason, wasClean));
 		}
 		async handleWebSocketClose(webSocket, code, reason, wasClean) {
+			completeWebSocketClose(webSocket, code, reason);
 			const stored = getStoredConnection(webSocket);
 			const request = new Request(`https://void.local${route.pattern}`);
 			if (definition.__kind === "room") {
@@ -297,7 +320,9 @@ function createWebSocketTombstoneDurableObject(className) {
 		async webSocketMessage(webSocket) {
 			webSocket.close(1012, "WebSocket route removed");
 		}
-		async webSocketClose() {}
+		async webSocketClose(webSocket, code, reason) {
+			completeWebSocketClose(webSocket, code, reason);
+		}
 	};
 }
 function getStub(env, route, params) {

package/dist/runtime/ws.d.mts

@@ -1,2 +1,2 @@
-import { a as RoomDefinition, c as VoidSocket, d as WebSocketConnection, f as connect, i as RoomController, l as VoidSocketCloseEvent, m as defineWebSocket, n as ConnectCommonOptions, o as SocketContext, p as defineRoom, r as RoomContext, s as SocketDefinition, t as AnyWebSocketDefinition, u as WebSocketBaseContext } from "../ws-BwcqizuH.mjs";
-export { AnyWebSocketDefinition, ConnectCommonOptions, RoomContext, RoomController, RoomDefinition, SocketContext, SocketDefinition, VoidSocket, VoidSocketCloseEvent, WebSocketBaseContext, WebSocketConnection, connect, defineRoom, defineWebSocket };
+import { a as RoomDefinition, c as VoidSocket, d as WebSocketConnection, f as WebSocketInstanceKey, h as defineWebSocket, i as RoomController, l as VoidSocketCloseEvent, m as defineRoom, n as ConnectCommonOptions, o as SocketContext, p as connect, r as RoomContext, s as SocketDefinition, t as AnyWebSocketDefinition, u as WebSocketBaseContext } from "../ws-CL1w7GXU.mjs";
+export { AnyWebSocketDefinition, ConnectCommonOptions, RoomContext, RoomController, RoomDefinition, SocketContext, SocketDefinition, VoidSocket, VoidSocketCloseEvent, WebSocketBaseContext, WebSocketConnection, WebSocketInstanceKey, connect, defineRoom, defineWebSocket };

package/dist/runtime/ws.mjs

@@ -1,16 +1,23 @@
+import { t as isResourceName } from "../resource-name-C7LVpcRm.mjs";
+import { t as interpolateRouteParams } from "../route-url-CG7U-cRN.mjs";
 //#region src/runtime/ws.ts
 function defineRoom(definition) {
+	assertResourceName(definition.name);
 	return {
 		...definition,
 		__kind: "room"
 	};
 }
 function defineWebSocket(definition) {
+	assertResourceName(definition.name);
 	return {
 		...definition,
 		__kind: "socket"
 	};
 }
+function assertResourceName(name) {
+	if (name !== void 0 && !isResourceName(name)) throw new Error("ws: name must contain a word starting with a letter.");
+}
 var VoidSocket = class {
 	url;
 	options;
@@ -89,14 +96,9 @@ function resolveBaseUrl(baseURL) {
 	if (!location) throw new Error("ws: connect() requires a browser-like runtime or an explicit \"baseURL\".");
 	return new URL(location.href);
 }
-function interpolateParams(path, params) {
-	let resolved = path;
-	if (params) for (const [key, value] of Object.entries(params)) resolved = resolved.replace(`:${key}`, encodeURIComponent(value));
-	return resolved;
-}
 function connect(path, options = {}) {
 	const base = resolveBaseUrl(options.baseURL);
-	const resolvedPath = interpolateParams(path, options.params);
+	const resolvedPath = interpolateRouteParams(path, options.params);
 	const url = new URL(resolvedPath, base);
 	url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
 	return new VoidSocket(url.toString(), options);

package/dist/sandbox-XZAqzFlG.d.mts

@@ -0,0 +1,52 @@
+import { n as LimitOperation, r as UsageLimit } from "./limits-Bq5LG8Id.mjs";
+import { i as SandboxExecOptions, r as SandboxContainer, s as SandboxOptions } from "./sandbox-container-Bo0eiFKz.mjs";
+import { Files } from "@cloudflare/sandbox";
+//#region src/runtime/sandbox.d.ts
+declare const DEFAULT_SANDBOX_ID = "default";
+declare const DEFAULT_SANDBOX_BINDING = "SANDBOX";
+declare const SANDBOX_SERVICE_BINDING = "__VOID_SANDBOX";
+type VoidSandboxOptions = SandboxOptions & {
+  binding?: string;
+  normalizeId?: boolean;
+};
+type SandboxProcess = {
+  pid: number;
+  isPty: boolean;
+  stdin: WritableStream | null;
+  stdout: ReadableStream | null;
+  stderr: ReadableStream | null;
+  readonly exitCode: LimitOperation<number>;
+  output(): LimitOperation<ExecOutput>;
+  kill(signal?: number): Promise<void>;
+  resize(cols: number, rows: number): Promise<void>;
+};
+type SandboxFiles = { [K in keyof Files]: Files[K] extends ((...args: infer A) => Promise<infer R>) ? (...args: A) => LimitOperation<R> : never; };
+type SandboxClient = {
+  exec(argv: Array<string>, options?: SandboxExecOptions): LimitOperation<SandboxProcess>;
+  run(argv: Array<string>, options?: SandboxExecOptions): LimitOperation<ExecOutput>;
+  files: SandboxFiles;
+  fetch(port: number, request: Request): LimitOperation<Response>;
+  running(): Promise<boolean>;
+  destroy(): Promise<void>;
+};
+declare class SandboxLimitError extends UsageLimit {
+  override readonly name = "SandboxLimitError";
+  readonly reason: "concurrency" | "runtime_budget";
+  constructor(reason: "concurrency" | "runtime_budget", message?: string);
+}
+declare class SandboxUnavailableError extends Error {
+  override readonly name = "SandboxUnavailableError";
+  constructor(message?: string);
+}
+declare function __setSandboxBindingName(bindingName: string): void;
+/** Generated local/native DO. Managed execution uses the trusted controller. */
+declare class VoidPlatformSandbox<Env = unknown> extends SandboxContainer<Env> {
+  protected override beforeStart(): Promise<void>;
+}
+/** Resolve a container by name. Starts on the first command, file or port operation. */
+declare function getSandbox(id?: string, options?: VoidSandboxOptions): Promise<SandboxClient>;
+declare const sandbox: {
+  get: typeof getSandbox;
+};
+//#endregion
+export { SandboxFiles as a, SandboxUnavailableError as c, __setSandboxBindingName as d, getSandbox as f, SandboxClient as i, VoidPlatformSandbox as l, DEFAULT_SANDBOX_ID as n, SandboxLimitError as o, sandbox as p, SANDBOX_SERVICE_BINDING as r, SandboxProcess as s, DEFAULT_SANDBOX_BINDING as t, VoidSandboxOptions as u };

package/dist/sandbox-container-Bo0eiFKz.d.mts

@@ -0,0 +1,73 @@
+import { DurableObject } from "cloudflare:workers";
+//#region src/runtime/sandbox-container.d.ts
+type SandboxInstance = "lite" | "standard-1" | "standard-2" | "standard-3" | "standard-4";
+type SandboxOptions = {
+  inactivityTimeoutMs?: number;
+  enableInternet?: boolean;
+  labels?: Record<string, string>;
+};
+type SandboxExecOptions = ContainerExecOptions & {
+  signal?: AbortSignal;
+  pty?: boolean | {
+    cols?: number;
+    rows?: number;
+  };
+};
+type SandboxCapability = {
+  invoke(operation: string, args: Array<unknown>): Promise<unknown>;
+};
+type SandboxProcessWire = {
+  capability: SandboxCapability;
+  pid: number;
+  isPty: boolean;
+  stdin: WritableStream | null;
+  stdout: ReadableStream | null;
+  stderr: ReadableStream | null;
+};
+type SandboxNativeContainer = Omit<Container, "start" | "exec"> & {
+  readonly images: Record<string, string>;
+  start(options: {
+    image: string;
+    instance: SandboxInstance;
+    enableInternet: boolean;
+    labels?: Record<string, string>;
+    entrypoint?: Array<string>;
+  }): void;
+  exec(argv: Array<string>, options?: SandboxExecOptions): Promise<ExecProcess & {
+    isPty?: boolean;
+    resize(cols: number, rows: number): void;
+  }>;
+};
+declare const DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS: number;
+declare function validateSandboxOptions(options: SandboxOptions): void;
+/** Shared native execution, used by local Workers and the trusted platform controller. */
+declare class SandboxContainer<Env = unknown> extends DurableObject<Env> {
+  #private;
+  protected instanceType: SandboxInstance;
+  protected starting: boolean;
+  constructor(ctx: DurableObjectState, env: Env);
+  protected get container(): SandboxNativeContainer;
+  configure(options: SandboxOptions): Promise<void>;
+  protected get inactivityTimeoutMs(): number;
+  protected beforeStart(): Promise<void>;
+  protected afterStart(): Promise<void>;
+  protected beforeUse(): Promise<void>;
+  protected stopped(): Promise<void>;
+  protected processContext(_exitCode: Promise<number>): unknown;
+  protected waitForProcessExit(exitCode: Promise<number>, _context?: unknown): Promise<number>;
+  /** Native abort listeners must be detached as soon as a process exits. */
+  protected execProcess(argv: Array<string>, options?: SandboxExecOptions): Promise<ExecProcess & {
+    isPty?: boolean;
+    resize(cols: number, rows: number): void;
+  }>;
+  protected initializationOutput(argv: Array<string>, options: SandboxExecOptions, timeoutMs: number): Promise<ExecOutput>;
+  protected initialize(): Promise<void>;
+  protected get entrypoint(): Array<string> | undefined;
+  protected get image(): string;
+  protected ensureRunning(): Promise<void>;
+  private setup;
+  destroy(): Promise<void>;
+  invoke(operation: string, args: Array<unknown>): Promise<unknown>;
+}
+//#endregion
+export { SandboxInstance as a, SandboxProcessWire as c, SandboxExecOptions as i, validateSandboxOptions as l, SandboxCapability as n, SandboxNativeContainer as o, SandboxContainer as r, SandboxOptions as s, DEFAULT_SANDBOX_INACTIVITY_TIMEOUT_MS as t };