@crewhaus/sandbox-image-java 0.1.3 → 0.1.5

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+import { type SandboxImageEntry } from "@crewhaus/sandbox-image-registry";
+/**
+ * Catalog R8 `sandbox-image-java` — Section 36 polyglot Java sandbox image.
+ *
+ * Java 11+ supports running .java source files directly via `java <File>.java`,
+ * so snippet mode skips the explicit javac step. Default entrypoint is
+ * `["java"]`; tool-code-execution callers extend with the source file path.
+ *
+ * Cold-start budget: ≤2s for the compiled-language warm pool. The JVM's
+ * `java -version` boot is ~250ms on warm hosts and stays well under
+ * budget; full compile+run round-trips can take longer (1-3s) and
+ * should be invoked with a per-call timeoutMs override.
+ *
+ * Layer R8.
+ */
+export declare const JAVA_IMAGE_ID = "java";
+export declare const JAVA_IMAGE_REF = "eclipse-temurin:21-alpine";
+export declare const JAVA_DEFAULT_ENTRYPOINT: ReadonlyArray<string>;
+export declare const JAVA_HEALTHCHECK_ARGV: ReadonlyArray<string>;
+/** Cold-start budget for the warm pool (ms). T7 layer asserts this. */
+export declare const JAVA_COLD_START_BUDGET_MS = 2000;
+export declare function registerJavaSandboxImage(): SandboxImageEntry;

package/{src/index.ts → dist/index.js}

@@ -1,5 +1,4 @@
-import { type SandboxImageEntry, registerSandboxImage } from "@crewhaus/sandbox-image-registry";
-
+import { registerSandboxImage } from "@crewhaus/sandbox-image-registry";
 /**
  * Catalog R8 `sandbox-image-java` — Section 36 polyglot Java sandbox image.
  *
@@ -14,26 +13,22 @@ import { type SandboxImageEntry, registerSandboxImage } from "@crewhaus/sandbox-
  *
  * Layer R8.
  */
-
 export const JAVA_IMAGE_ID = "java";
 export const JAVA_IMAGE_REF = "eclipse-temurin:21-alpine";
-export const JAVA_DEFAULT_ENTRYPOINT: ReadonlyArray<string> = ["java"];
-export const JAVA_HEALTHCHECK_ARGV: ReadonlyArray<string> = ["java", "-version"];
-
+export const JAVA_DEFAULT_ENTRYPOINT = ["java"];
+export const JAVA_HEALTHCHECK_ARGV = ["java", "-version"];
 /** Cold-start budget for the warm pool (ms). T7 layer asserts this. */
 export const JAVA_COLD_START_BUDGET_MS = 2_000;
-
-export function registerJavaSandboxImage(): SandboxImageEntry {
-  return registerSandboxImage({
-    id: JAVA_IMAGE_ID,
-    image: JAVA_IMAGE_REF,
-    defaultEntrypoint: JAVA_DEFAULT_ENTRYPOINT,
-    healthcheck: {
-      command: JAVA_HEALTHCHECK_ARGV,
-      expectedExitCode: 0,
-      timeoutMs: JAVA_COLD_START_BUDGET_MS,
-    },
-    description:
-      "JDK 21 (Eclipse Temurin alpine) — snippet mode via `java <File>.java` (Java 11+); compiled-class mode for mounted projects.",
-  });
+export function registerJavaSandboxImage() {
+    return registerSandboxImage({
+        id: JAVA_IMAGE_ID,
+        image: JAVA_IMAGE_REF,
+        defaultEntrypoint: JAVA_DEFAULT_ENTRYPOINT,
+        healthcheck: {
+            command: JAVA_HEALTHCHECK_ARGV,
+            expectedExitCode: 0,
+            timeoutMs: JAVA_COLD_START_BUDGET_MS,
+        },
+        description: "JDK 21 (Eclipse Temurin alpine) — snippet mode via `java <File>.java` (Java 11+); compiled-class mode for mounted projects.",
+    });
 }

package/package.json

@@ -1,20 +1,23 @@
 {
   "name": "@crewhaus/sandbox-image-java",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "JDK 21 polyglot sandbox image: registry registration + multi-stage Dockerfile + T2/T7/T8 contract tests (Section 36)",
-  "main": "src/index.ts",
-  "types": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.1.3",
-    "@crewhaus/sandbox": "0.1.3",
-    "@crewhaus/sandbox-image-registry": "0.1.3"
+    "@crewhaus/errors": "0.1.5",
+    "@crewhaus/sandbox": "0.1.5",
+    "@crewhaus/sandbox-image-registry": "0.1.5"
   },
   "license": "Apache-2.0",
   "author": {
@@ -34,5 +37,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["src", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -1,157 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { createSandbox } from "@crewhaus/sandbox";
-import {
-  ImageRegistrationError,
-  _resetSandboxImageRegistry,
-  hasSandboxImage,
-  listAllowedImageRefs,
-  lookupSandboxImage,
-  registerSandboxImage,
-} from "@crewhaus/sandbox-image-registry";
-import {
-  JAVA_COLD_START_BUDGET_MS,
-  JAVA_DEFAULT_ENTRYPOINT,
-  JAVA_HEALTHCHECK_ARGV,
-  JAVA_IMAGE_ID,
-  JAVA_IMAGE_REF,
-  registerJavaSandboxImage,
-} from "./index";
-
-describe("registerJavaSandboxImage (T1 + T2)", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("constants match the kickoff prompt's spec", () => {
-    expect(JAVA_IMAGE_ID).toBe("java");
-    expect(JAVA_IMAGE_REF).toBe("eclipse-temurin:21-alpine");
-    expect(JAVA_DEFAULT_ENTRYPOINT).toEqual(["java"]);
-    expect(JAVA_HEALTHCHECK_ARGV).toEqual(["java", "-version"]);
-  });
-
-  test("registerJavaSandboxImage() registers an image with the right shape", () => {
-    const entry = registerJavaSandboxImage();
-    expect(entry.id).toBe("java");
-    expect(entry.image).toBe("eclipse-temurin:21-alpine");
-    expect(entry.defaultEntrypoint).toEqual(["java"]);
-    expect(entry.healthcheck.command).toEqual(["java", "-version"]);
-    expect(entry.healthcheck.expectedExitCode).toBe(0);
-    expect(entry.healthcheck.timeoutMs).toBe(JAVA_COLD_START_BUDGET_MS);
-    expect(entry.description).toMatch(/JDK 21/);
-  });
-
-  test("lookupSandboxImage('java') returns the registered entry", () => {
-    registerJavaSandboxImage();
-    expect(hasSandboxImage("java")).toBe(true);
-    expect(lookupSandboxImage("java").image).toBe("eclipse-temurin:21-alpine");
-  });
-
-  test("listAllowedImageRefs includes eclipse-temurin:21-alpine", () => {
-    registerJavaSandboxImage();
-    const refs = listAllowedImageRefs();
-    expect(refs).toContain("eclipse-temurin:21-alpine");
-    expect(refs).toContain("python:3.13-slim");
-  });
-});
-
-describe("Java-shape T2 contract — round-trip via noop sandbox", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("noop sandbox accepts eclipse-temurin:21-alpine when registered", async () => {
-    registerJavaSandboxImage();
-    const sandbox = createSandbox({
-      backend: "noop",
-      allowedImages: listAllowedImageRefs(),
-    });
-    const result = await sandbox.exec({
-      image: JAVA_IMAGE_REF,
-      argv: ["printf", "hello-from-java"],
-    });
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout).toBe("hello-from-java");
-    await sandbox.close();
-  });
-
-  test("noop sandbox refuses eclipse-temurin:21-alpine when NOT registered", async () => {
-    const trioRefs = ["python:3.13-slim", "node:22-alpine", "alpine:3.19"];
-    const sandbox = createSandbox({ backend: "noop", allowedImages: trioRefs });
-    await expect(sandbox.exec({ image: JAVA_IMAGE_REF, argv: ["printf", "x"] })).rejects.toThrow(
-      /not on the allowlist/,
-    );
-    await sandbox.close();
-  });
-});
-
-describe("Java-shape T7 — cold-start budget", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("healthcheck timeoutMs is within the compiled-language budget (≤2s)", () => {
-    const entry = registerJavaSandboxImage();
-    expect(entry.healthcheck.timeoutMs).toBeLessThanOrEqual(2_000);
-    expect(entry.healthcheck.timeoutMs).toBeGreaterThan(0);
-  });
-});
-
-describe("Java-shape T8 — escape-attempt suite (reuses §18 corpus shape)", () => {
-  beforeEach(() => _resetSandboxImageRegistry());
-  afterEach(() => _resetSandboxImageRegistry());
-
-  test("Java image registration is idempotent-then-rejected", () => {
-    registerJavaSandboxImage();
-    expect(() => registerJavaSandboxImage()).toThrow(/already registered/);
-  });
-
-  test("Java entry's image string passes registry validation", () => {
-    expect(JAVA_IMAGE_REF.startsWith("-")).toBe(false);
-    expect(/\s/.test(JAVA_IMAGE_REF)).toBe(false);
-    expect(JAVA_IMAGE_REF.includes("\n")).toBe(false);
-  });
-
-  test("Java defaultEntrypoint contains no shell-meta", () => {
-    for (const arg of JAVA_DEFAULT_ENTRYPOINT) {
-      expect(/[;&|<>$`(){}]/.test(arg)).toBe(false);
-      expect(arg.includes("\n")).toBe(false);
-    }
-  });
-
-  test("Java healthcheck argv contains no shell-meta", () => {
-    for (const arg of JAVA_HEALTHCHECK_ARGV) {
-      expect(/[;&|<>$`(){}]/.test(arg)).toBe(false);
-      expect(arg.includes("\n")).toBe(false);
-    }
-  });
-
-  test("CLI-flag-injection registration via Java id is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "java",
-        image: "--privileged",
-        defaultEntrypoint: ["java"],
-        healthcheck: { command: ["java", "-version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(ImageRegistrationError);
-  });
-
-  test("whitespace-tampered Java image is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "java",
-        image: "eclipse-temurin:21-alpine --privileged",
-        defaultEntrypoint: ["java"],
-        healthcheck: { command: ["java", "-version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(/whitespace/);
-  });
-
-  test("shell-meta-tagged Java image is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "java",
-        image: "eclipse-temurin:$(id)",
-        defaultEntrypoint: ["java"],
-        healthcheck: { command: ["java", "-version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(/valid registry/);
-  });
-});