# Tasks — enterprise-sandbox

1. Scaffold package skeleton (`package.json`, `vite.config.ts`,
   `vitest.config.ts`, `tsconfig.lib.json`, `README.md`, `src/index.ts`).
2. Author `types/sandbox.types.ts` with `SandboxConfig`, `SandboxResult`,
   `SandboxOptions`, `SandboxModule`, `ExecutionContext`, `AuditLogEntry`,
   `AuditStatistics`, `Clock`, `ProcessSpawner`, `CommandResult`,
   `DEFAULT_CONFIG`.
3. Author `error-codes/error-codes.ts` — `SANDBOX_CODES` via `defineCodes` +
   `SandboxError` class. Sibling docs + tests.
4. Author `schemas/schemas.ts` — Zod schemas for config, options, module.
   Sibling docs + tests.
5. Author `telemetry/telemetry.ts` — OTel counters + histogram + record fns.
   Sibling docs + tests.
6. Author `audit-logger/audit-logger.ts` — SHA-256 hash, filter, statistics,
   `onAuditLog`. Sibling docs + tests.
7. Author `resource-limiter/resource-limiter.ts` — sliding-window limiter with
   injectable `Clock`, output truncation. Sibling docs + tests.
8. Author `module-resolver/module-resolver.ts` — denylist + allowlist + builtin
   resolver. Sibling docs + tests.
9. Author `code-transformer/code-transformer.ts` — eleven built-in rules,
   custom-rule slot, `wouldBlock`. Sibling docs + tests.
10. Author `vm-engine/vm-engine.ts` — real `node:vm` sandbox with frozen
    intrinsics, captured console, heap stats. Sibling docs + tests.
11. Author `worker-engine/worker-engine.ts` — real `node:worker_threads`
    sandbox, postMessage IPC, timeout via `worker.terminate()`. Sibling docs
    + tests.
12. Author `spawn-engine/spawn-engine.ts` + `runner.ts` — real
    `node:child_process` runner with sanitised env, JSON IPC, timeout race.
    Sibling docs + tests.
13. Author `isolate-engine/isolate-engine.ts` — structural `isolated-vm`
    contract with `IsolateFactory` seam. Sibling docs + tests.
14. Author `pool/pool.ts` — pre-warmed pool with injectable `Clock`,
    cleanup, recycle-on-N. Sibling docs + tests.
15. Author `result-streamer/result-streamer.ts` — subscribe / push / flush /
    complete / destroy. Sibling docs + tests.
16. Author `sandbox/sandbox.ts` — `createSandbox` facade composing every
    feature, engine selection, audit-log integration. Sibling docs + tests.
17. Wire `src/index.ts` barrel + every subpath export in `package.json`.
18. Run pre-publish gate: `bunx turbo lint typecheck test build --filter=@suaveplan/sandbox`
    + `bunx turbo test:coverage --filter=@suaveplan/sandbox` — all green at
    100/100/100/100.
19. Refresh `MANIFEST.md` via `bun scripts/folder-reorg/generate-manifest.ts`.
20. Flip `@suaveplan/sandbox` row in `STATUS.md` from `–` to `✅`.
21. Fold `specs/sandbox/spec.md` into `openspec/specs/sandbox/spec.md`.
22. Archive `openspec/changes/enterprise-sandbox/` to
    `openspec/archive/2026-05-25-enterprise-sandbox/`.