feat(sdk): expose the sandbox binding to TypeScript

crates/alien-bindings-node/Cargo.toml

@@ -27,6 +27,7 @@ platform-sdk = ["alien-bindings/platform-sdk"]
 # so the gRPC feature is never pulled in transitively; platform features are
 # forwarded explicitly above.
 alien-bindings = { workspace = true }
+alien-core = { workspace = true }
 alien-error = { workspace = true }
 futures = { workspace = true }
 napi = { workspace = true }

crates/alien-bindings-node/src/lib.rs

@@ -13,6 +13,7 @@ mod error;
 mod kv;
 mod postgres;
 mod queue;
+mod sandbox;
 #[cfg(feature = "platform-sdk")]
 mod remote_storage;
 mod storage;
@@ -29,6 +30,7 @@ pub use container::ContainerHandle;
 pub use kv::KvHandle;
 pub use postgres::{PostgresConnectionJs, PostgresHandle};
 pub use queue::QueueHandle;
+pub use sandbox::{CommandFrameJs, CommandStreamHandle, SandboxHandle, SandboxSessionJs};
 #[cfg(feature = "platform-sdk")]
 pub use remote_storage::RemoteStorageHandle;
 pub use storage::StorageHandle;
@@ -92,6 +94,14 @@ impl BindingsHandle {
         Ok(VaultHandle::new(vault))
     }
 
+    /// Resolve the sandbox binding named `name`.
+    #[napi]
+    pub async fn sandbox(&self, name: String) -> napi::Result<SandboxHandle> {
+        let inner = self.inner.clone();
+        let sandbox = inner.sandbox(&name).await.map_err(map_alien_error)?;
+        Ok(SandboxHandle::new(sandbox))
+    }
+
     /// Resolve the linked-container binding named `name`.
     #[napi]
     pub async fn container(&self, name: String) -> napi::Result<ContainerHandle> {