@claxedo/sandbox-manager 0.6.0 → 0.9.0

package/package.json

@@ -1,6 +1,4 @@
 {
-  "name": "@claxedo/sandbox-manager",
-  "version": "0.6.0",
   "type": "module",
   "description": "Sandbox lifecycle manager with epoch-based leases and pluggable drivers for Daytona, Modal, Vercel Sandbox, Cloudflare, Box, and Docker",
   "license": "MIT",
@@ -24,137 +22,151 @@
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
+      "development": "./src/index.ts",
+      "bun": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "bun": "./dist/index.mjs",
-      "development": "./dist/index.mjs",
       "import": "./dist/index.mjs",
       "default": "./dist/index.mjs"
     },
     "./command": {
+      "development": "./src/command.ts",
+      "bun": "./src/command.ts",
       "types": "./dist/command.d.ts",
-      "bun": "./dist/command.mjs",
-      "development": "./dist/command.mjs",
       "import": "./dist/command.mjs",
       "default": "./dist/command.mjs"
     },
     "./constants": {
+      "development": "./src/constants.ts",
+      "bun": "./src/constants.ts",
       "types": "./dist/constants.d.ts",
-      "bun": "./dist/constants.mjs",
-      "development": "./dist/constants.mjs",
       "import": "./dist/constants.mjs",
       "default": "./dist/constants.mjs"
     },
+    "./checkpoint-manager": {
+      "development": "./src/checkpoint-manager.ts",
+      "bun": "./src/checkpoint-manager.ts",
+      "types": "./dist/checkpoint-manager.d.ts",
+      "import": "./dist/checkpoint-manager.mjs",
+      "default": "./dist/checkpoint-manager.mjs"
+    },
     "./defaults": {
+      "development": "./src/defaults.ts",
+      "bun": "./src/defaults.ts",
       "types": "./dist/defaults.d.ts",
-      "bun": "./dist/defaults.mjs",
-      "development": "./dist/defaults.mjs",
       "import": "./dist/defaults.mjs",
       "default": "./dist/defaults.mjs"
     },
     "./driver-catalog": {
+      "development": "./src/driver-catalog.ts",
+      "bun": "./src/driver-catalog.ts",
       "types": "./dist/driver-catalog.d.ts",
-      "bun": "./dist/driver-catalog.mjs",
-      "development": "./dist/driver-catalog.mjs",
       "import": "./dist/driver-catalog.mjs",
       "default": "./dist/driver-catalog.mjs"
     },
     "./drivers/box": {
+      "development": "./src/drivers/box.ts",
+      "bun": "./src/drivers/box.ts",
       "types": "./dist/drivers/box.d.ts",
-      "bun": "./dist/drivers/box.mjs",
-      "development": "./dist/drivers/box.mjs",
       "import": "./dist/drivers/box.mjs",
       "default": "./dist/drivers/box.mjs"
     },
+    "./drivers/exe": {
+      "development": "./src/drivers/exe.ts",
+      "bun": "./src/drivers/exe.ts",
+      "types": "./dist/drivers/exe.d.ts",
+      "import": "./dist/drivers/exe.mjs",
+      "default": "./dist/drivers/exe.mjs"
+    },
     "./drivers/cloudflare": {
+      "development": "./src/drivers/cloudflare.ts",
+      "bun": "./src/drivers/cloudflare.ts",
       "types": "./dist/drivers/cloudflare.d.ts",
-      "bun": "./dist/drivers/cloudflare.mjs",
-      "development": "./dist/drivers/cloudflare.mjs",
       "import": "./dist/drivers/cloudflare.mjs",
       "default": "./dist/drivers/cloudflare.mjs"
     },
     "./drivers/daytona": {
+      "development": "./src/drivers/daytona.ts",
+      "bun": "./src/drivers/daytona.ts",
       "types": "./dist/drivers/daytona.d.ts",
-      "bun": "./dist/drivers/daytona.mjs",
-      "development": "./dist/drivers/daytona.mjs",
       "import": "./dist/drivers/daytona.mjs",
       "default": "./dist/drivers/daytona.mjs"
     },
     "./drivers/docker": {
+      "development": "./src/drivers/docker.ts",
+      "bun": "./src/drivers/docker.ts",
       "types": "./dist/drivers/docker.d.ts",
-      "bun": "./dist/drivers/docker.mjs",
-      "development": "./dist/drivers/docker.mjs",
       "import": "./dist/drivers/docker.mjs",
       "default": "./dist/drivers/docker.mjs"
     },
     "./drivers/fetch-bridge": {
+      "development": "./src/drivers/fetch-bridge.ts",
+      "bun": "./src/drivers/fetch-bridge.ts",
       "types": "./dist/drivers/fetch-bridge.d.ts",
-      "bun": "./dist/drivers/fetch-bridge.mjs",
-      "development": "./dist/drivers/fetch-bridge.mjs",
       "import": "./dist/drivers/fetch-bridge.mjs",
       "default": "./dist/drivers/fetch-bridge.mjs"
     },
     "./drivers/modal": {
+      "development": "./src/drivers/modal.ts",
+      "bun": "./src/drivers/modal.ts",
       "types": "./dist/drivers/modal.d.ts",
-      "bun": "./dist/drivers/modal.mjs",
-      "development": "./dist/drivers/modal.mjs",
       "import": "./dist/drivers/modal.mjs",
       "default": "./dist/drivers/modal.mjs"
     },
     "./drivers/vercel": {
+      "development": "./src/drivers/vercel.ts",
+      "bun": "./src/drivers/vercel.ts",
       "types": "./dist/drivers/vercel.d.ts",
-      "bun": "./dist/drivers/vercel.mjs",
-      "development": "./dist/drivers/vercel.mjs",
       "import": "./dist/drivers/vercel.mjs",
       "default": "./dist/drivers/vercel.mjs"
     },
     "./image": {
+      "development": "./src/image.ts",
+      "bun": "./src/image.ts",
       "types": "./dist/image.d.ts",
-      "bun": "./dist/image.mjs",
-      "development": "./dist/image.mjs",
       "import": "./dist/image.mjs",
       "default": "./dist/image.mjs"
     },
+    "./image-name": {
+      "development": "./src/image-name.ts",
+      "bun": "./src/image-name.ts",
+      "types": "./dist/image-name.d.ts",
+      "import": "./dist/image-name.mjs",
+      "default": "./dist/image-name.mjs"
+    },
     "./lease-policy": {
+      "development": "./src/lease-policy.ts",
+      "bun": "./src/lease-policy.ts",
       "types": "./dist/lease-policy.d.ts",
-      "bun": "./dist/lease-policy.mjs",
-      "development": "./dist/lease-policy.mjs",
       "import": "./dist/lease-policy.mjs",
       "default": "./dist/lease-policy.mjs"
     },
     "./lease-types": {
+      "development": "./src/lease-types.ts",
+      "bun": "./src/lease-types.ts",
       "types": "./dist/lease-types.d.ts",
-      "bun": "./dist/lease-types.mjs",
-      "development": "./dist/lease-types.mjs",
       "import": "./dist/lease-types.mjs",
       "default": "./dist/lease-types.mjs"
     },
     "./runtime-env": {
+      "development": "./src/runtime-env.ts",
+      "bun": "./src/runtime-env.ts",
       "types": "./dist/runtime-env.d.ts",
-      "bun": "./dist/runtime-env.mjs",
-      "development": "./dist/runtime-env.mjs",
       "import": "./dist/runtime-env.mjs",
       "default": "./dist/runtime-env.mjs"
     },
     "./service-url-exposure": {
+      "development": "./src/service-url-exposure.ts",
+      "bun": "./src/service-url-exposure.ts",
       "types": "./dist/service-url-exposure.d.ts",
-      "bun": "./dist/service-url-exposure.mjs",
-      "development": "./dist/service-url-exposure.mjs",
       "import": "./dist/service-url-exposure.mjs",
       "default": "./dist/service-url-exposure.mjs"
     },
     "./stores/memory": {
+      "development": "./src/stores/memory.ts",
+      "bun": "./src/stores/memory.ts",
       "types": "./dist/stores/memory.d.ts",
-      "bun": "./dist/stores/memory.mjs",
-      "development": "./dist/stores/memory.mjs",
       "import": "./dist/stores/memory.mjs",
       "default": "./dist/stores/memory.mjs"
-    },
-    "./drivers/cloudflare-egress": {
-      "types": "./dist/drivers/cloudflare-egress.d.ts",
-      "bun": "./dist/drivers/cloudflare-egress.mjs",
-      "development": "./dist/drivers/cloudflare-egress.mjs",
-      "import": "./dist/drivers/cloudflare-egress.mjs",
-      "default": "./dist/drivers/cloudflare-egress.mjs"
     }
   },
   "files": [
@@ -165,16 +177,20 @@
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "@daytona/sdk": "0.192.0",
-    "@vercel/sandbox": "1.10.2",
-    "modal": "0.7.5"
-  },
+  "name": "@claxedo/sandbox-manager",
+  "version": "0.9.0",
   "scripts": {
     "build": "tsx scripts/build.ts",
     "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "test": "bun test src"
+    "test": "mkdir -p .artifacts/unit && node ../../scripts/test-deadline.mjs bun test src --reporter=junit --reporter-outfile=.artifacts/unit/junit.xml"
+  },
+  "dependencies": {
+    "@claxedo/helpers": "0.1.0",
+    "@claxedo/sandbox-contract": "0.8.0",
+    "@daytona/sdk": "0.211.2",
+    "@vercel/sandbox": "3.3.0",
+    "modal": "0.10.1"
   },
   "devDependencies": {
     "@tsconfig/node-lts": "22.0.4",

package/dist/drivers/cloudflare-egress.d.ts

@@ -1,40 +0,0 @@
-export type EgressTokenClaims = {
-    /** Sandbox the token is bound to. */
-    sub: string;
-    /** Hosts the sandbox may reach through the broker. */
-    hosts: string[];
-    /** Expiry (epoch seconds). */
-    exp: number;
-};
-/** Mint a short-lived HS256 token binding a sandbox to its brokered hosts. Carries NO secret values. */
-export declare function mintEgressToken(input: {
-    sandboxId: string;
-    hosts: string[];
-    signingSecret: string;
-    ttlSeconds?: number;
-    now?: () => number;
-}): Promise<string>;
-/** Verify a token and return its claims, or null if invalid/expired. */
-export declare function verifyEgressToken(token: string, signingSecret: string, now?: () => number): Promise<EgressTokenClaims | null>;
-/** How the sandbox names its egress target: header carries the absolute upstream URL. */
-export declare const EGRESS_TARGET_HEADER = "x-claxedo-egress-target";
-/** Resolves the brokered credential for a (sandbox, host) pair — Worker-side only, never the sandbox. */
-export type EgressSecretResolver = (sandboxId: string, host: string) => Promise<{
-    header: string;
-    value: string;
-} | undefined> | {
-    header: string;
-    value: string;
-} | undefined;
-/**
- * Handle one egress-proxy request from a sandbox: validate the JWT, confirm
- * the target host is allowed, inject the brokered credential as its header,
- * and forward. The credential is read from `resolveSecret` (Worker store) and
- * never round-trips through the sandbox.
- */
-export declare function handleEgressRequest(request: Request, options: {
-    signingSecret: string;
-    resolveSecret: EgressSecretResolver;
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-}): Promise<Response>;

package/dist/drivers/cloudflare-egress.mjs

@@ -1,113 +0,0 @@
-// src/drivers/cloudflare-egress.ts
-function b64urlEncode(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function b64urlDecode(input) {
-  const padded = input.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - input.length % 4) % 4);
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-  return bytes;
-}
-function encodeJson(value) {
-  return b64urlEncode(new TextEncoder().encode(JSON.stringify(value)));
-}
-async function hmacKey(secret) {
-  return crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign", "verify"]
-  );
-}
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-async function mintEgressToken(input) {
-  const now = input.now ?? Date.now;
-  const header = encodeJson({ alg: "HS256", typ: "JWT" });
-  const payload = encodeJson({
-    sub: input.sandboxId,
-    hosts: input.hosts,
-    exp: Math.floor(now() / 1e3) + (input.ttlSeconds ?? 15 * 60)
-  });
-  const key = await hmacKey(input.signingSecret);
-  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${header}.${payload}`)));
-  return `${header}.${payload}.${b64urlEncode(sig)}`;
-}
-async function verifyEgressToken(token, signingSecret, now = Date.now) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  const [header, payload, sig] = parts;
-  const key = await hmacKey(signingSecret);
-  const expected = b64urlEncode(
-    new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${header}.${payload}`)))
-  );
-  if (!timingSafeEqual(sig, expected)) return null;
-  let claims;
-  try {
-    claims = JSON.parse(new TextDecoder().decode(b64urlDecode(payload)));
-  } catch {
-    return null;
-  }
-  if (typeof claims.sub !== "string" || !Array.isArray(claims.hosts) || typeof claims.exp !== "number") return null;
-  if (claims.exp <= Math.floor(now() / 1e3)) return null;
-  return claims;
-}
-var EGRESS_TARGET_HEADER = "x-claxedo-egress-target";
-async function handleEgressRequest(request, options) {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const auth = request.headers.get("authorization");
-  const token = auth?.toLowerCase().startsWith("bearer ") ? auth.slice(7) : void 0;
-  if (!token) return egressError(401, "missing egress token");
-  const claims = await verifyEgressToken(token, options.signingSecret, options.now);
-  if (!claims) return egressError(401, "invalid or expired egress token");
-  const targetRaw = request.headers.get(EGRESS_TARGET_HEADER);
-  if (!targetRaw) return egressError(400, "missing egress target");
-  let target;
-  try {
-    target = new URL(targetRaw);
-  } catch {
-    return egressError(400, "malformed egress target");
-  }
-  if (target.protocol !== "https:") return egressError(400, "egress target must be https");
-  if (!claims.hosts.includes(target.host)) return egressError(403, "host not permitted for this sandbox");
-  const secret = await options.resolveSecret(claims.sub, target.host);
-  if (!secret) return egressError(403, "no brokered credential for host");
-  const headers = new Headers(request.headers);
-  headers.delete("authorization");
-  headers.delete(EGRESS_TARGET_HEADER);
-  headers.set(secret.header, secret.value);
-  headers.set("host", target.host);
-  try {
-    const upstream = await fetchImpl(target.toString(), {
-      method: request.method,
-      headers,
-      body: request.method === "GET" || request.method === "HEAD" ? void 0 : request.body,
-      redirect: "manual"
-    });
-    const outHeaders = new Headers(upstream.headers);
-    outHeaders.delete(secret.header);
-    return new Response(upstream.body, { status: upstream.status, statusText: upstream.statusText, headers: outHeaders });
-  } catch {
-    return egressError(502, "upstream request failed");
-  }
-}
-function egressError(status, message) {
-  return new Response(JSON.stringify({ error: message }), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-export {
-  EGRESS_TARGET_HEADER,
-  handleEgressRequest,
-  mintEgressToken,
-  verifyEgressToken
-};