@alienplatform/core 3.3.17 → 3.3.19

package/dist/index.js

@@ -4927,6 +4927,22 @@ const EventChangeSchema = z$2.union([
 	})
 ]).describe("Represents a change to an event");
 //#endregion
+//#region src/generated/zod/gcp-agent-platform-sandbox-heartbeat-data-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP: the Agent Platform template sessions are cut from, and the engine it hangs under.\n\nNo session count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says.
+*/
+const GcpAgentPlatformSandboxHeartbeatDataSchema = z$2.object({
+	"engine": z$2.string().describe("Reasoning engine the template hangs under, without which the template id names nothing."),
+	get "status"() {
+		return SandboxHeartbeatStatusSchema;
+	},
+	"templateId": z$2.string().describe("The template sessions are currently cut from.")
+}).describe("GCP: the Agent Platform template sessions are cut from, and the engine it hangs under.\n\nNo session count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says.");
+//#endregion
 //#region src/generated/zod/gcp-artifact-registry-import-data-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -5260,10 +5276,6 @@ const GcpRemoteStackManagementImportDataSchema = z$2.object({
 	"serviceAccountEmail": z$2.string().describe("Service account email the manager impersonates."),
 	"serviceAccountUniqueId": z$2.string().describe("Stable unique id Google assigns to the service account.")
 }).describe("GCP RemoteStackManagement ImportData — cross-project service account\nthe manager impersonates.");
-z$2.object({
-	"allowEgress": z$2.boolean().describe("Whether sessions may reach the network. Taken from the declaration rather than left to the\napplication: the launcher decides egress per sandbox at create time."),
-	"launcherPath": z$2.string().describe("Path to the sandbox CLI Cloud Run injects when the container sets `sandboxLauncher`.")
-}).describe("GCP Sandbox ImportData.\n\nA Cloud Run sandbox has no durable parent: it is a nested gVisor sandbox started by a launcher\nbinary Cloud Run injects into the container, so there is no group, image or endpoint for setup\nto hand over. What the runtime needs is the launcher's path, and it is carried here rather than\nhardcoded in the provider so a change to where Cloud Run mounts it is a data change.");
 //#endregion
 //#region src/generated/zod/gcp-secret-manager-vault-heartbeat-data-schema.ts
 /**
@@ -6621,6 +6633,7 @@ const ResourceEntrySchema = z$2.object({
 const SandboxHeartbeatDataSchema = z$2.union([
 	z$2.lazy(() => AwsMicrovmSandboxHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["awsMicrovm"]) })).describe("AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."),
 	z$2.lazy(() => AzureSandboxGroupHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["azureSandboxGroup"]) })).describe("Azure: the sandbox group's ARM state. The data plane has no list operation, so a session count\nis not available here."),
+	z$2.lazy(() => GcpAgentPlatformSandboxHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["gcpAgentPlatform"]) })).describe("GCP: the Agent Platform template sessions are cut from, and the engine it hangs under.\n\nNo session count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."),
 	z$2.lazy(() => KubernetesSandboxHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["kubernetesPods"]) })).describe("Kubernetes: pods carrying the sandbox label, in the deployment's namespace."),
 	z$2.lazy(() => LocalSandboxHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["local"]) })).describe("Local: containers Docker still holds for this sandbox.")
 ]).describe("Content-free telemetry about a sandbox's sessions.\n\nNever anything from inside a session. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it.");
@@ -6857,12 +6870,13 @@ z$2.object({
 	"domainEgressRules": z$2.boolean().describe("Egress can be restricted to a hostname allowlist"),
 	"egressDeny": z$2.boolean().describe("Whether a declared `deny` is actually enforced, rather than accepted and dropped"),
 	"enforcedLimits": z$2.boolean().describe("The platform enforces the declared cpu, memory and disk ceilings"),
-	"files": z$2.boolean().describe("Files can be moved in and out of a session\n\nEvery backend but Azure, whose binding implements no transfer."),
+	"files": z$2.boolean().describe("Files can be moved in and out of a session"),
 	"preview": z$2.boolean().describe("An authenticated, port-scoped capability to reach a service inside the sandbox"),
 	"processLimit": z$2.boolean().describe("The platform can cap how many processes a session runs"),
 	"reconnect": z$2.boolean().describe("A later call can reach a session created by an earlier one"),
 	"sessionLifetime": z$2.boolean().describe("The platform terminates a session at a declared wall-clock deadline"),
 	"snapshot": z$2.boolean().describe("A session's full state can be captured and used to create another"),
+	"supervisorIsolation": z$2.boolean().describe("The process supervising a command is a different identity from the command.\n\nFalse where a command runs as the agent's own user: it can then read the supervisor's\nenvironment and signal it. Separate from `supervisorPidNamespace`, which is about\nvisibility rather than identity — a backend can have one without the other."),
 	"supervisorPidNamespace": z$2.boolean().describe("A command runs in its own PID namespace and cannot see or signal the agent's processes.\n\nOnly where an agent runs as root. Creating the namespace needs `CAP_SYS_ADMIN`, and the\nKubernetes sandbox pod drops every capability — which is also what denies `ptrace` by\nconstruction, so granting it there would remove a lock to add one."),
 	"suspendResume": z$2.boolean().describe("Session state can be suspended and resumed")
 }).describe("What a platform's sandbox backend can actually do.\n\nPublished so portable code can branch before calling rather than discovering a gap through\nan error. Every field here corresponds to a capability that at least one platform lacks;\ncreate, exec and terminate are the guaranteed floor and are therefore not listed.");
@@ -6877,7 +6891,8 @@ z$2.enum([
 	"enforcedLimits",
 	"processLimit",
 	"sessionLifetime",
-	"supervisorPidNamespace"
+	"supervisorPidNamespace",
+	"supervisorIsolation"
 ]).describe("Names a single sandbox capability, so an unsupported call can report which one it needed.");
 //#endregion
 //#region src/generated/zod/sandbox-code-schema.ts
@@ -6889,7 +6904,7 @@ z$2.enum([
 * @description Specifies where the sandbox\'s root filesystem comes from.
 */
 const SandboxCodeSchema = z$2.union([z$2.object({
-	"image": z$2.string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`)"),
+	"image": z$2.string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`).\n\nTwo backends narrow it in opposite directions: AWS wants an `s3://` bundle, Azure a\nbare catalog name such as `ubuntu`. Each refuses the other's shape while planning."),
 	"type": z$2.enum(["image"])
 }), z$2.object({
 	"src": z$2.string().describe("The source directory to build from"),
@@ -6968,7 +6983,7 @@ const SandboxSchema = z$2.object({
 	get "limits"() {
 		return z$2.union([SandboxLimitsSchema, z$2.null()]).optional();
 	},
-	"previewPorts": z$2.optional(z$2.array(z$2.int().min(0)).describe("Ports eligible for a preview capability. A port not listed here can never be exposed,\nso an application cannot widen its own ingress at runtime.")),
+	"previewPorts": z$2.optional(z$2.array(z$2.int().min(0)).describe("Ports eligible for a preview capability. An application reaches its sandbox through the\nprovider, so it cannot widen its own ingress at runtime; a holder of a remote binding's\ncredentials is bounded by no port condition, which is why a remote sandbox declares none.")),
 	get "session"() {
 		return SandboxSessionPolicySchema.describe("How long a session may live and when it is suspended.");
 	}
@@ -7531,7 +7546,6 @@ const WorkerSchema = z$2.object({
 	get "readinessProbe"() {
 		return z$2.union([ReadinessProbeSchema, z$2.null()]).optional();
 	},
-	"sandboxLauncher": z$2.optional(z$2.boolean().describe("Whether this worker hosts sandbox sessions.\n\nSet by preflight, not by an application: on GCP a sandbox is a subprocess of the Cloud Run\ninstance running the app, and the instance can only launch one if its container declares\nit. Declaring it by hand would be a permission the workload does not need.")),
 	"timeoutSeconds": z$2.optional(z$2.int().min(1).max(3600).default(180).describe("Maximum execution time for the worker in seconds.\nConstraints: 1‑3600 seconds (platform-specific limits may apply)\nDefault: 180")),
 	get "triggers"() {
 		return z$2.array(WorkerTriggerSchema.describe("Defines what triggers a worker execution.")).describe("List of triggers that define what events automatically invoke this worker.\nIf empty, the worker is only invokable directly via HTTP calls or platform-specific invocation APIs.\nWhen configured, the worker will be automatically invoked when any of the specified trigger conditions are met.");
@@ -9572,8 +9586,11 @@ var Queue = class extends ResourceBuilder {
 *
 * Capabilities are not uniform. Call `capabilities()` on the binding and branch, or handle the
 * typed error — an unsupported capability never silently succeeds. Notably GCP cannot
-* reconnect to a session (its session id is scoped to one Cloud Run instance), the Azure
-* binding implements no file transfer, and no binding renders a hostname egress allowlist.
+* reconnect to a session (its session id is scoped to one Cloud Run instance), only Azure
+* restricts egress to a hostname allowlist, no platform can snapshot a session, and only AWS
+* and Local run a command under a different identity than the process supervising it. Elsewhere the
+* command shares the supervisor's user, so it can read the supervisor's environment and
+* signal it, and the container is the isolation boundary.
 *
 * Limits are enforced ceilings, not scheduling hints, and are validated when the stack is
 * planned. A platform that cannot enforce them rejects the sandbox rather than ignoring them.