js/sandbox/v0.1.7

## What's New

### ✨ Features
* Added platform-aware sandbox creation for the JavaScript SDK. `Sandbox.create()` now accepts a `platform` constraint so callers can request runtime OS/architecture explicitly, while existing image-based creation remains compatible by default. This is useful for deployments that schedule across mixed Docker/Kubernetes platforms. https://github.com/alibaba/OpenSandbox/pull/645
* Added richer storage and Windows sandbox creation options. The JS models now include PVC auto-provisioning fields such as `createIfNotExists`, `storageClass`, `storage`, and `accessModes`; this pairs with server-side auto-create support for Kubernetes PVCs and Docker named volumes. The SDK also accepts Windows-aware platform values for sandbox provisioning. https://github.com/alibaba/OpenSandbox/pull/661 https://github.com/alibaba/OpenSandbox/pull/749 https://github.com/alibaba/OpenSandbox/pull/785
* Added secure endpoint access support. `Sandbox.create()` accepts `secureAccess`, and endpoint responses preserve required access headers so SDK traffic can continue to reach secured Kubernetes gateway endpoints without callers manually wiring transport headers. https://github.com/alibaba/OpenSandbox/pull/745
* Added signed endpoint support for time-limited route access. JavaScript consumers can call `sandbox.getSignedEndpoint(port, expires)` to obtain an endpoint whose URL/headers carry the signed route token instead of relying on a long-lived static endpoint secret. https://github.com/alibaba/OpenSandbox/pull/787
* Added pause and resume lifecycle support. `Sandbox` and `SandboxManager` expose pause/resume methods, and `Sandbox.resume(...)` reconnects after resume so callers receive a fresh instance when the execd endpoint changes. https://github.com/alibaba/OpenSandbox/pull/668
* Added snapshot lifecycle support. The JS SDK can create, get, list, and delete snapshots through `SandboxManager`, and `Sandbox.create()` can restore from `snapshotId`; callers must provide exactly one startup source, either `image` or `snapshotId`. The API is runtime-neutral: Docker snapshot support landed with the SDK surface, and Kubernetes public snapshot support followed in the server/controller runtime. https://github.com/alibaba/OpenSandbox/pull/764 https://github.com/alibaba/OpenSandbox/pull/837 https://github.com/alibaba/OpenSandbox/pull/840
* Added metadata patch support. `Sandbox.patchMetadata(...)` and `SandboxManager.patchSandboxMetadata(...)` expose JSON merge-patch semantics for updating or deleting sandbox metadata without replacing the whole sandbox record. https://github.com/alibaba/OpenSandbox/pull/863

### 🐛 Bug Fixes
* Updated JavaScript package dependencies to address npm audit findings including high/moderate vulnerabilities in minimatch, rollup, flatted, vite, esbuild, postcss, picomatch, and brace-expansion. https://github.com/alibaba/OpenSandbox/pull/789
* Addressed CodeQL/static-analysis findings in the JavaScript SDK connection layer, including safer string handling and regression coverage in `connection.test.mjs`. https://github.com/alibaba/OpenSandbox/pull/795

### 📦 Misc
* JavaScript package publishing now packs the npm tarball before publish and emits GitHub artifact attestations, so consumers can verify the published SDK artifact provenance. https://github.com/alibaba/OpenSandbox/pull/827

## 👥 Contributors
Thanks to these contributors ❤️

@ninan-nn
@hittyt
@Pangjiping
@fengcone
@xfgong