@elie-laloum/outpost 2.0.0 → 4.0.0

package/dist/providers/firecracker-machine.js

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { access, chmod, copyFile, mkdir, mkdtemp, rm, writeFile, } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { invariant, OutpostError, positive } from "../domain/errors.js";
+import { registerCleanup } from "../infrastructure/shutdown.js";
+import { firecrackerDefaults } from "./firecracker.constants.js";
+export function validateFirecracker(options) {
+    invariant(!("egress" in options) || options.egress === undefined, "Firecracker cannot enforce Outpost egress policies; configure host networking explicitly");
+    for (const path of [
+        options.binary,
+        options.kernel,
+        options.rootfs,
+        options.home,
+        options.root ?? firecrackerDefaults.root,
+        options.ssh.identity,
+        options.ssh.knownHosts,
+    ])
+        invariant(isAbsolute(path) && !path.includes("\0"), "Firecracker paths must be absolute");
+    invariant(/^[a-zA-Z0-9_.-]{1,15}$/.test(options.tap), "Invalid TAP interface");
+    invariant(/^([a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2}$/.test(options.guestMac), "Invalid guest MAC address");
+    invariant(/^[a-zA-Z0-9_.:-]+$/.test(options.ssh.host) &&
+        !options.ssh.host.startsWith("-"), "Invalid SSH host");
+    invariant(/^[a-zA-Z0-9_-]+$/.test(options.ssh.user), "Invalid SSH user");
+    for (const value of [
+        options.cpus ?? firecrackerDefaults.cpus,
+        options.memoryMb ?? firecrackerDefaults.memoryMb,
+        options.ssh.port ?? 22,
+    ])
+        invariant(Number.isSafeInteger(value) && value > 0, "Firecracker resource limits and SSH port must be positive integers");
+    positive(options.bootDeadlineMs ?? firecrackerDefaults.bootDeadlineMs, "bootDeadlineMs");
+}
+export async function firecrackerMachine(options, signal) {
+    invariant(process.platform === "linux", "Firecracker requires Linux and KVM");
+    signal?.throwIfAborted();
+    await access("/dev/kvm", constants.R_OK | constants.W_OK);
+    await Promise.all([
+        access(options.binary, constants.X_OK),
+        access(options.kernel, constants.R_OK),
+        access(options.rootfs, constants.R_OK),
+        access(options.ssh.identity, constants.R_OK),
+        access(options.ssh.knownHosts, constants.R_OK),
+    ]);
+    const lock = join(tmpdir(), `outpost-firecracker-tap-${options.tap}.lock`);
+    await mkdir(lock, { mode: 0o700 });
+    const endpoint = createHash("sha256")
+        .update(`${options.ssh.host}:${options.ssh.port ?? 22}`)
+        .digest("hex");
+    const transportLock = join(tmpdir(), `outpost-firecracker-ssh-${endpoint}.lock`);
+    try {
+        await mkdir(transportLock, { mode: 0o700 });
+    }
+    catch (cause) {
+        return failedAllocation([lock], cause);
+    }
+    let directory;
+    try {
+        directory = await mkdtemp(join(tmpdir(), "outpost-firecracker-"));
+    }
+    catch (cause) {
+        return failedAllocation([lock, transportLock], cause);
+    }
+    try {
+        await copyFile(options.rootfs, join(directory, "rootfs.ext4"), constants.COPYFILE_FICLONE);
+        await chmod(join(directory, "rootfs.ext4"), 0o600);
+        signal?.throwIfAborted();
+        await writeFile(join(directory, "config.json"), JSON.stringify({
+            "boot-source": {
+                kernel_image_path: options.kernel,
+                boot_args: options.bootArgs,
+            },
+            drives: [
+                {
+                    drive_id: "rootfs",
+                    path_on_host: join(directory, "rootfs.ext4"),
+                    is_root_device: true,
+                    is_read_only: false,
+                },
+            ],
+            "machine-config": {
+                vcpu_count: options.cpus ?? firecrackerDefaults.cpus,
+                mem_size_mib: options.memoryMb ?? firecrackerDefaults.memoryMb,
+            },
+            "network-interfaces": [
+                {
+                    iface_id: "net1",
+                    guest_mac: options.guestMac,
+                    host_dev_name: options.tap,
+                },
+            ],
+        }), { mode: 0o600 });
+    }
+    catch (cause) {
+        return failedAllocation([directory, lock, transportLock], cause);
+    }
+    const child = spawn(options.binary, [
+        "--api-sock",
+        join(directory, "api.sock"),
+        "--config-file",
+        join(directory, "config.json"),
+    ], { stdio: "ignore" });
+    let exited = false;
+    const exit = new Promise((resolve) => {
+        child.once("error", () => {
+            exited = true;
+            resolve();
+        });
+        child.once("exit", () => {
+            exited = true;
+            resolve();
+        });
+    });
+    let releasing;
+    let closed = false;
+    let unregister = () => { };
+    const release = () => (releasing ??= (async () => {
+        closed = true;
+        if (!exited)
+            child.kill("SIGTERM");
+        await Promise.race([exit, delay(200, undefined, { ref: false })]);
+        if (!exited)
+            child.kill("SIGKILL");
+        await Promise.race([
+            exit,
+            delay(firecrackerDefaults.cleanupMs, undefined, { ref: false }),
+        ]);
+        if (!exited)
+            throw new OutpostError("provider", `VM termination uncertain; private disk retained at ${directory}`);
+        await rm(directory, { recursive: true, force: true });
+        await rm(lock, { recursive: true, force: true });
+        await rm(transportLock, { recursive: true, force: true });
+        unregister();
+    })().catch((cause) => {
+        releasing = undefined;
+        throw cause;
+    }));
+    unregister = registerCleanup(release, () => {
+        if (!exited)
+            child.kill("SIGKILL");
+    });
+    return { directory, isClosed: () => closed || exited, release };
+}
+async function failedAllocation(paths, cause) {
+    const results = await Promise.allSettled(paths.map((path) => rm(path, { recursive: true, force: true })));
+    const failures = results
+        .filter((result) => result.status === "rejected")
+        .map((result) => result.reason);
+    if (failures.length)
+        throw new AggregateError([cause, ...failures], "Firecracker allocation and cleanup failed; inspect retained temporary resources");
+    throw cause;
+}
+//# sourceMappingURL=firecracker-machine.js.map

package/dist/providers/firecracker-machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker-machine.js","sourceRoot":"","sources":["../../src/providers/firecracker-machine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,KAAK,EACL,OAAO,EACP,EAAE,EACF,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAMjE,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,SAAS,CACP,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EACtD,0FAA0F,CAC3F,CAAC;IACF,KAAK,MAAM,IAAI,IAAI;QACjB,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;QACxC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,UAAU;KACvB;QACC,SAAS,CACP,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxC,oCAAoC,CACrC,CAAC;IACJ,SAAS,CACP,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAC1C,uBAAuB,CACxB,CAAC;IACF,SAAS,CACP,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC7D,2BAA2B,CAC5B,CAAC;IACF,SAAS,CACP,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACzC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACnC,kBAAkB,CACnB,CAAC;IACF,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI;QAClB,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;QACxC,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;QAChD,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;KACvB;QACC,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EACxC,oEAAoE,CACrE,CAAC;IACJ,QAAQ,CACN,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,EAC5D,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAC3B,MAAoB;IAEpB,SAAS,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3E,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EAAE,EACR,2BAA2B,QAAQ,OAAO,CAC3C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,CACZ,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,IAAI,CAAC,SAAS,CAAC;YACb,aAAa,EAAE;gBACb,iBAAiB,EAAE,OAAO,CAAC,MAAM;gBACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;aAC5B;YACD,MAAM,EAAE;gBACN;oBACE,QAAQ,EAAE,QAAQ;oBAClB,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;oBAC5C,cAAc,EAAE,IAAI;oBACpB,YAAY,EAAE,KAAK;iBACpB;aACF;YACD,gBAAgB,EAAE;gBAChB,UAAU,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;gBACpD,YAAY,EAAE,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;aAC/D;YACD,oBAAoB,EAAE;gBACpB;oBACE,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAC3B,aAAa,EAAE,OAAO,CAAC,GAAG;iBAC3B;aACF;SACF,CAAC,EACF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,MAAM,EACd;QACE,YAAY;QACZ,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAC3B,eAAe;QACf,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;KAC/B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,SAAoC,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;QACzB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,sDAAsD,SAAS,EAAE,CAClE,CAAC;QACJ,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,SAAS,GAAG,SAAS,CAAC;QACtB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC,CAAC;IACN,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE;QACzC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAwB,EACxB,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;SAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM;QACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,EACpB,iFAAiF,CAClF,CAAC;IACJ,MAAM,KAAK,CAAC;AACd,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { spawn } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport {\n  access,\n  chmod,\n  copyFile,\n  mkdir,\n  mkdtemp,\n  rm,\n  writeFile,\n} from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { isAbsolute, join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { invariant, OutpostError, positive } from \"../domain/errors.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\nimport type {\n  FirecrackerMachine,\n  FirecrackerOptions,\n} from \"./firecracker.types.ts\";\n\nexport function validateFirecracker(options: FirecrackerOptions): void {\n  invariant(\n    !(\"egress\" in options) || options.egress === undefined,\n    \"Firecracker cannot enforce Outpost egress policies; configure host networking explicitly\",\n  );\n  for (const path of [\n    options.binary,\n    options.kernel,\n    options.rootfs,\n    options.home,\n    options.root ?? firecrackerDefaults.root,\n    options.ssh.identity,\n    options.ssh.knownHosts,\n  ])\n    invariant(\n      isAbsolute(path) && !path.includes(\"\\0\"),\n      \"Firecracker paths must be absolute\",\n    );\n  invariant(\n    /^[a-zA-Z0-9_.-]{1,15}$/.test(options.tap),\n    \"Invalid TAP interface\",\n  );\n  invariant(\n    /^([a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2}$/.test(options.guestMac),\n    \"Invalid guest MAC address\",\n  );\n  invariant(\n    /^[a-zA-Z0-9_.:-]+$/.test(options.ssh.host) &&\n      !options.ssh.host.startsWith(\"-\"),\n    \"Invalid SSH host\",\n  );\n  invariant(/^[a-zA-Z0-9_-]+$/.test(options.ssh.user), \"Invalid SSH user\");\n  for (const value of [\n    options.cpus ?? firecrackerDefaults.cpus,\n    options.memoryMb ?? firecrackerDefaults.memoryMb,\n    options.ssh.port ?? 22,\n  ])\n    invariant(\n      Number.isSafeInteger(value) && value > 0,\n      \"Firecracker resource limits and SSH port must be positive integers\",\n    );\n  positive(\n    options.bootDeadlineMs ?? firecrackerDefaults.bootDeadlineMs,\n    \"bootDeadlineMs\",\n  );\n}\n\nexport async function firecrackerMachine(\n  options: FirecrackerOptions,\n  signal?: AbortSignal,\n): Promise<FirecrackerMachine> {\n  invariant(process.platform === \"linux\", \"Firecracker requires Linux and KVM\");\n  signal?.throwIfAborted();\n  await access(\"/dev/kvm\", constants.R_OK | constants.W_OK);\n  await Promise.all([\n    access(options.binary, constants.X_OK),\n    access(options.kernel, constants.R_OK),\n    access(options.rootfs, constants.R_OK),\n    access(options.ssh.identity, constants.R_OK),\n    access(options.ssh.knownHosts, constants.R_OK),\n  ]);\n  const lock = join(tmpdir(), `outpost-firecracker-tap-${options.tap}.lock`);\n  await mkdir(lock, { mode: 0o700 });\n  const endpoint = createHash(\"sha256\")\n    .update(`${options.ssh.host}:${options.ssh.port ?? 22}`)\n    .digest(\"hex\");\n  const transportLock = join(\n    tmpdir(),\n    `outpost-firecracker-ssh-${endpoint}.lock`,\n  );\n  try {\n    await mkdir(transportLock, { mode: 0o700 });\n  } catch (cause) {\n    return failedAllocation([lock], cause);\n  }\n  let directory: string;\n  try {\n    directory = await mkdtemp(join(tmpdir(), \"outpost-firecracker-\"));\n  } catch (cause) {\n    return failedAllocation([lock, transportLock], cause);\n  }\n  try {\n    await copyFile(\n      options.rootfs,\n      join(directory, \"rootfs.ext4\"),\n      constants.COPYFILE_FICLONE,\n    );\n    await chmod(join(directory, \"rootfs.ext4\"), 0o600);\n    signal?.throwIfAborted();\n    await writeFile(\n      join(directory, \"config.json\"),\n      JSON.stringify({\n        \"boot-source\": {\n          kernel_image_path: options.kernel,\n          boot_args: options.bootArgs,\n        },\n        drives: [\n          {\n            drive_id: \"rootfs\",\n            path_on_host: join(directory, \"rootfs.ext4\"),\n            is_root_device: true,\n            is_read_only: false,\n          },\n        ],\n        \"machine-config\": {\n          vcpu_count: options.cpus ?? firecrackerDefaults.cpus,\n          mem_size_mib: options.memoryMb ?? firecrackerDefaults.memoryMb,\n        },\n        \"network-interfaces\": [\n          {\n            iface_id: \"net1\",\n            guest_mac: options.guestMac,\n            host_dev_name: options.tap,\n          },\n        ],\n      }),\n      { mode: 0o600 },\n    );\n  } catch (cause) {\n    return failedAllocation([directory, lock, transportLock], cause);\n  }\n  const child = spawn(\n    options.binary,\n    [\n      \"--api-sock\",\n      join(directory, \"api.sock\"),\n      \"--config-file\",\n      join(directory, \"config.json\"),\n    ],\n    { stdio: \"ignore\" },\n  );\n  let exited = false;\n  const exit = new Promise<void>((resolve) => {\n    child.once(\"error\", () => {\n      exited = true;\n      resolve();\n    });\n    child.once(\"exit\", () => {\n      exited = true;\n      resolve();\n    });\n  });\n  let releasing: Promise<void> | undefined;\n  let closed = false;\n  let unregister = () => {};\n  const release = () =>\n    (releasing ??= (async () => {\n      closed = true;\n      if (!exited) child.kill(\"SIGTERM\");\n      await Promise.race([exit, delay(200, undefined, { ref: false })]);\n      if (!exited) child.kill(\"SIGKILL\");\n      await Promise.race([\n        exit,\n        delay(firecrackerDefaults.cleanupMs, undefined, { ref: false }),\n      ]);\n      if (!exited)\n        throw new OutpostError(\n          \"provider\",\n          `VM termination uncertain; private disk retained at ${directory}`,\n        );\n      await rm(directory, { recursive: true, force: true });\n      await rm(lock, { recursive: true, force: true });\n      await rm(transportLock, { recursive: true, force: true });\n      unregister();\n    })().catch((cause) => {\n      releasing = undefined;\n      throw cause;\n    }));\n  unregister = registerCleanup(release, () => {\n    if (!exited) child.kill(\"SIGKILL\");\n  });\n  return { directory, isClosed: () => closed || exited, release };\n}\n\nasync function failedAllocation(\n  paths: readonly string[],\n  cause: unknown,\n): Promise<never> {\n  const results = await Promise.allSettled(\n    paths.map((path) => rm(path, { recursive: true, force: true })),\n  );\n  const failures = results\n    .filter((result) => result.status === \"rejected\")\n    .map((result) => result.reason);\n  if (failures.length)\n    throw new AggregateError(\n      [cause, ...failures],\n      \"Firecracker allocation and cleanup failed; inspect retained temporary resources\",\n    );\n  throw cause;\n}\n"]}

package/dist/providers/firecracker.constants.d.ts

@@ -0,0 +1,10 @@
+export declare const firecrackerDefaults: {
+    readonly root: "/workspace";
+    readonly cpus: 2;
+    readonly memoryMb: 2048;
+    readonly bootDeadlineMs: 60000;
+    readonly commandMs: 600000;
+    readonly probeMs: 2000;
+    readonly cleanupMs: 5000;
+    readonly manifestBytes: number;
+};

package/dist/providers/firecracker.constants.js

@@ -0,0 +1,11 @@
+export const firecrackerDefaults = {
+    root: "/workspace",
+    cpus: 2,
+    memoryMb: 2048,
+    bootDeadlineMs: 60_000,
+    commandMs: 600_000,
+    probeMs: 2000,
+    cleanupMs: 5000,
+    manifestBytes: 16 * 1024 * 1024,
+};
+//# sourceMappingURL=firecracker.constants.js.map

package/dist/providers/firecracker.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.constants.js","sourceRoot":"","sources":["../../src/providers/firecracker.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,IAAI;IACd,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;CACvB,CAAC","sourcesContent":["export const firecrackerDefaults = {\n  root: \"/workspace\",\n  cpus: 2,\n  memoryMb: 2048,\n  bootDeadlineMs: 60_000,\n  commandMs: 600_000,\n  probeMs: 2000,\n  cleanupMs: 5000,\n  manifestBytes: 16 * 1024 * 1024,\n} as const;\n"]}

package/dist/providers/firecracker.d.ts

@@ -0,0 +1,4 @@
+import type { SandboxProvider } from "../domain/sandbox.types.ts";
+import type { FirecrackerOptions } from "./firecracker.types.ts";
+export type { FirecrackerOptions } from "./firecracker.types.ts";
+export declare function firecracker(options: FirecrackerOptions): SandboxProvider;

package/dist/providers/firecracker.js

@@ -0,0 +1,103 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { OutpostError } from "../domain/errors.js";
+import { executeProcess, quote } from "../infrastructure/process.js";
+import { firecrackerCommand, firecrackerSsh } from "./firecracker-command.js";
+import { firecrackerDefaults } from "./firecracker.constants.js";
+import { firecrackerFiles } from "./firecracker-files.js";
+import { firecrackerMachine, validateFirecracker, } from "./firecracker-machine.js";
+export function firecracker(options) {
+    validateFirecracker(options);
+    let allocated = false;
+    return {
+        name: "firecracker",
+        placement: "remote",
+        variables: { ...options.variables },
+        async acquire(context) {
+            if (allocated)
+                throw new OutpostError("provider", "This Firecracker provider already owns its TAP; create separate configurations for concurrent VMs");
+            allocated = true;
+            let machine;
+            try {
+                machine = await firecrackerMachine(options, context.signal);
+            }
+            catch (cause) {
+                allocated = false;
+                throw cause;
+            }
+            const root = options.root ?? firecrackerDefaults.root;
+            let closed = false;
+            const active = new Set();
+            const stop = new AbortController();
+            const runtime = {
+                options,
+                root,
+                variables: context.variables,
+                executor: executeProcess,
+                isClosed: () => closed || machine.isClosed(),
+            };
+            let releasing;
+            const release = () => (releasing ??= (async () => {
+                closed = true;
+                stop.abort(new OutpostError("aborted", "Firecracker sandbox disposed"));
+                await Promise.allSettled([...active]);
+                await machine.release();
+                allocated = false;
+            })().catch((cause) => {
+                releasing = undefined;
+                throw cause;
+            }));
+            try {
+                const deadline = Date.now() +
+                    (options.bootDeadlineMs ?? firecrackerDefaults.bootDeadlineMs);
+                while (true) {
+                    context.signal?.throwIfAborted();
+                    if (machine.isClosed())
+                        throw new OutpostError("provider", "Firecracker exited before guest readiness");
+                    const result = await executeProcess({
+                        ...firecrackerSsh(options, `test "$HOME" = ${quote(options.home)} && node -e 'if(Number(process.versions.node.split(".")[0])<24)process.exit(1)' && command -v git setsid tar >/dev/null && mkdir -p ${quote(root)}`),
+                        deadlineMs: Math.max(1, Math.min(firecrackerDefaults.probeMs, deadline - Date.now())),
+                        ...(context.signal ? { signal: context.signal } : {}),
+                    }).catch((cause) => {
+                        context.signal?.throwIfAborted();
+                        return { status: 1, stdout: "", stderr: String(cause) };
+                    });
+                    if (machine.isClosed())
+                        throw new OutpostError("provider", "Firecracker exited during guest readiness");
+                    if (result.status === 0)
+                        break;
+                    if (Date.now() >= deadline)
+                        throw new OutpostError("timeout", "Firecracker guest SSH/prerequisites did not become ready", { stderr: result.stderr });
+                    await delay(100, undefined, { signal: context.signal });
+                }
+            }
+            catch (cause) {
+                try {
+                    await release();
+                }
+                catch (cleanup) {
+                    throw new AggregateError([cause, cleanup], "Firecracker acquisition and cleanup failed");
+                }
+                throw cause;
+            }
+            const invoke = firecrackerCommand(runtime);
+            const files = firecrackerFiles(runtime);
+            const track = (operation, signal) => {
+                if (closed)
+                    return Promise.reject(new OutpostError("provider", "Firecracker sandbox is closed"));
+                const pending = operation(signal ? AbortSignal.any([signal, stop.signal]) : stop.signal);
+                active.add(pending);
+                void pending.then(() => active.delete(pending), () => active.delete(pending));
+                return pending;
+            };
+            return {
+                root,
+                home: options.home,
+                invoke: (command) => track((signal) => invoke({ ...command, signal }), command.signal),
+                upload: (source, destination, options = {}) => track((signal) => files.upload(source, destination, { ...options, signal }), options.signal),
+                download: (source, destination, options = {}) => track((signal) => files.download(source, destination, { ...options, signal }), options.signal),
+                release,
+            };
+        },
+    };
+}
+//# sourceMappingURL=firecracker.js.map

package/dist/providers/firecracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/providers/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAKlC,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,IAAI,SAAS;gBACX,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,mGAAmG,CACpG,CAAC;YACJ,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC;YACtD,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG;gBACd,OAAO;gBACP,IAAI;gBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE;aAC7C,CAAC;YACF,IAAI,SAAoC,CAAC;YACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC,KAAK,CACR,IAAI,YAAY,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAC5D,CAAC;gBACF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACtC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACnB,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,QAAQ,GACZ,IAAI,CAAC,GAAG,EAAE;oBACV,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAC;gBACjE,OAAO,IAAI,EAAE,CAAC;oBACZ,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;oBACjC,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACpB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,2CAA2C,CAC5C,CAAC;oBACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;wBAClC,GAAG,cAAc,CACf,OAAO,EACP,kBAAkB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,uIAAuI,KAAK,CAAC,IAAI,CAAC,EAAE,CAC1L;wBACD,UAAU,EAAE,IAAI,CAAC,GAAG,CAClB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAC7D;wBACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACtD,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACjB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;wBACjC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,CAAC,CAAC,CAAC;oBACH,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACpB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,2CAA2C,CAC5C,CAAC;oBACJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM;oBAC/B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;wBACxB,MAAM,IAAI,YAAY,CACpB,SAAS,EACT,0DAA0D,EAC1D,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAC1B,CAAC;oBACJ,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,4CAA4C,CAC7C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,CACZ,SAA8C,EAC9C,MAAoB,EACR,EAAE;gBACd,IAAI,MAAM;oBACR,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAC9D,CAAC;gBACJ,MAAM,OAAO,GAAG,SAAS,CACvB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAC9D,CAAC;gBACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpB,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7B,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;YACF,OAAO;gBACL,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;gBACnE,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAC5C,KAAK,CACH,CAAC,MAAM,EAAE,EAAE,CACT,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAC3D,OAAO,CAAC,MAAM,CACf;gBACH,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAC9C,KAAK,CACH,CAAC,MAAM,EAAE,EAAE,CACT,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAC7D,OAAO,CAAC,MAAM,CACf;gBACH,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { executeProcess, quote } from \"../infrastructure/process.ts\";\nimport { firecrackerCommand, firecrackerSsh } from \"./firecracker-command.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\nimport { firecrackerFiles } from \"./firecracker-files.ts\";\nimport {\n  firecrackerMachine,\n  validateFirecracker,\n} from \"./firecracker-machine.ts\";\nimport type { FirecrackerOptions } from \"./firecracker.types.ts\";\n\nexport type { FirecrackerOptions } from \"./firecracker.types.ts\";\n\nexport function firecracker(options: FirecrackerOptions): SandboxProvider {\n  validateFirecracker(options);\n  let allocated = false;\n  return {\n    name: \"firecracker\",\n    placement: \"remote\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      if (allocated)\n        throw new OutpostError(\n          \"provider\",\n          \"This Firecracker provider already owns its TAP; create separate configurations for concurrent VMs\",\n        );\n      allocated = true;\n      let machine;\n      try {\n        machine = await firecrackerMachine(options, context.signal);\n      } catch (cause) {\n        allocated = false;\n        throw cause;\n      }\n      const root = options.root ?? firecrackerDefaults.root;\n      let closed = false;\n      const active = new Set<Promise<unknown>>();\n      const stop = new AbortController();\n      const runtime = {\n        options,\n        root,\n        variables: context.variables,\n        executor: executeProcess,\n        isClosed: () => closed || machine.isClosed(),\n      };\n      let releasing: Promise<void> | undefined;\n      const release = () =>\n        (releasing ??= (async () => {\n          closed = true;\n          stop.abort(\n            new OutpostError(\"aborted\", \"Firecracker sandbox disposed\"),\n          );\n          await Promise.allSettled([...active]);\n          await machine.release();\n          allocated = false;\n        })().catch((cause) => {\n          releasing = undefined;\n          throw cause;\n        }));\n      try {\n        const deadline =\n          Date.now() +\n          (options.bootDeadlineMs ?? firecrackerDefaults.bootDeadlineMs);\n        while (true) {\n          context.signal?.throwIfAborted();\n          if (machine.isClosed())\n            throw new OutpostError(\n              \"provider\",\n              \"Firecracker exited before guest readiness\",\n            );\n          const result = await executeProcess({\n            ...firecrackerSsh(\n              options,\n              `test \"$HOME\" = ${quote(options.home)} && node -e 'if(Number(process.versions.node.split(\".\")[0])<24)process.exit(1)' && command -v git setsid tar >/dev/null && mkdir -p ${quote(root)}`,\n            ),\n            deadlineMs: Math.max(\n              1,\n              Math.min(firecrackerDefaults.probeMs, deadline - Date.now()),\n            ),\n            ...(context.signal ? { signal: context.signal } : {}),\n          }).catch((cause) => {\n            context.signal?.throwIfAborted();\n            return { status: 1, stdout: \"\", stderr: String(cause) };\n          });\n          if (machine.isClosed())\n            throw new OutpostError(\n              \"provider\",\n              \"Firecracker exited during guest readiness\",\n            );\n          if (result.status === 0) break;\n          if (Date.now() >= deadline)\n            throw new OutpostError(\n              \"timeout\",\n              \"Firecracker guest SSH/prerequisites did not become ready\",\n              { stderr: result.stderr },\n            );\n          await delay(100, undefined, { signal: context.signal });\n        }\n      } catch (cause) {\n        try {\n          await release();\n        } catch (cleanup) {\n          throw new AggregateError(\n            [cause, cleanup],\n            \"Firecracker acquisition and cleanup failed\",\n          );\n        }\n        throw cause;\n      }\n      const invoke = firecrackerCommand(runtime);\n      const files = firecrackerFiles(runtime);\n      const track = <T>(\n        operation: (signal: AbortSignal) => Promise<T>,\n        signal?: AbortSignal,\n      ): Promise<T> => {\n        if (closed)\n          return Promise.reject(\n            new OutpostError(\"provider\", \"Firecracker sandbox is closed\"),\n          );\n        const pending = operation(\n          signal ? AbortSignal.any([signal, stop.signal]) : stop.signal,\n        );\n        active.add(pending);\n        void pending.then(\n          () => active.delete(pending),\n          () => active.delete(pending),\n        );\n        return pending;\n      };\n      return {\n        root,\n        home: options.home,\n        invoke: (command) =>\n          track((signal) => invoke({ ...command, signal }), command.signal),\n        upload: (source, destination, options = {}) =>\n          track(\n            (signal) =>\n              files.upload(source, destination, { ...options, signal }),\n            options.signal,\n          ),\n        download: (source, destination, options = {}) =>\n          track(\n            (signal) =>\n              files.download(source, destination, { ...options, signal }),\n            options.signal,\n          ),\n        release,\n      };\n    },\n  };\n}\n"]}

package/dist/providers/firecracker.types.d.ts

@@ -0,0 +1,36 @@
+import type { Variables } from "../domain/command.types.ts";
+import type { Executor } from "../infrastructure/process.types.ts";
+export interface FirecrackerOptions {
+    readonly binary: string;
+    readonly kernel: string;
+    readonly rootfs: string;
+    readonly tap: string;
+    readonly guestMac: string;
+    readonly bootArgs: string;
+    readonly ssh: {
+        readonly host: string;
+        readonly user: string;
+        readonly identity: string;
+        readonly knownHosts: string;
+        readonly port?: number;
+        readonly binary?: string;
+    };
+    readonly root?: string;
+    readonly home: string;
+    readonly cpus?: number;
+    readonly memoryMb?: number;
+    readonly bootDeadlineMs?: number;
+    readonly variables?: Variables;
+}
+export interface FirecrackerRuntime {
+    readonly options: FirecrackerOptions;
+    readonly root: string;
+    readonly variables: Variables;
+    readonly isClosed: () => boolean;
+    readonly executor: Executor;
+}
+export interface FirecrackerMachine {
+    readonly directory: string;
+    readonly isClosed: () => boolean;
+    release(): Promise<void>;
+}

package/dist/providers/firecracker.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=firecracker.types.js.map

package/dist/providers/firecracker.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.types.js","sourceRoot":"","sources":["../../src/providers/firecracker.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Variables } from \"../domain/command.types.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\n\nexport interface FirecrackerOptions {\n  readonly binary: string;\n  readonly kernel: string;\n  readonly rootfs: string;\n  readonly tap: string;\n  readonly guestMac: string;\n  readonly bootArgs: string;\n  readonly ssh: {\n    readonly host: string;\n    readonly user: string;\n    readonly identity: string;\n    readonly knownHosts: string;\n    readonly port?: number;\n    readonly binary?: string;\n  };\n  readonly root?: string;\n  readonly home: string;\n  readonly cpus?: number;\n  readonly memoryMb?: number;\n  readonly bootDeadlineMs?: number;\n  readonly variables?: Variables;\n}\n\nexport interface FirecrackerRuntime {\n  readonly options: FirecrackerOptions;\n  readonly root: string;\n  readonly variables: Variables;\n  readonly isClosed: () => boolean;\n  readonly executor: Executor;\n}\n\nexport interface FirecrackerMachine {\n  readonly directory: string;\n  readonly isClosed: () => boolean;\n  release(): Promise<void>;\n}\n"]}

package/dist/providers/local.js

@@ -1,9 +1,10 @@
 import { cp, mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
-import { OutpostError } from "../domain/errors.js";
+import { invariant, OutpostError } from "../domain/errors.js";
 import { executeProcess } from "../infrastructure/process.js";
 export function local(options = {}) {
+    invariant(!("egress" in options) || options.egress === undefined, "Local execution cannot enforce egress policies");
     return {
         name: "local",
         placement: "host",

package/dist/providers/local.js.map

@@ -1 +1 @@
-{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,MAAM,UAAU,KAAK,CAAC,UAAwB,EAAE;IAC9C,OAAO;QACL,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,EAChB,MAAc,EACd,WAAmB,EACnB,UAA2B,EAAE,EAC7B,EAAE;gBACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjC,IAAI,QAAQ;oBACV,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC;oBAAE,OAAO;gBACrD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE;oBAC5B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,GAAG,EAAE;wBACX,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;wBACjC,OAAO,IAAI,CAAC;oBACd,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC;YACF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,SAAS;gBACvB,IAAI,EAAE,OAAO,EAAE;gBACf,MAAM,CAAC,OAAgB;oBACrB,IAAI,QAAQ;wBACV,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CACxD,CAAC;oBACJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;wBAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;wBAChD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;oBAChB,MAAM,OAAO,GAAG,cAAc,CAAC;wBAC7B,GAAG,OAAO;wBACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;wBACjD,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;wBACzD,MAAM;qBACP,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpB,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7B,CAAC;oBACF,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,KAAK,CAAC,OAAO;oBACX,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;oBAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { cp, mkdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { dirname, resolve } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type {\n  SandboxProvider,\n  TransferOptions,\n} from \"../domain/sandbox.types.ts\";\nimport { executeProcess } from \"../infrastructure/process.ts\";\nimport type { LocalOptions } from \"./local.types.ts\";\n\nexport function local(options: LocalOptions = {}): SandboxProvider {\n  return {\n    name: \"local\",\n    placement: \"host\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const stop = new AbortController();\n      const active = new Set<Promise<unknown>>();\n      let disposed = false;\n      const copy = async (\n        source: string,\n        destination: string,\n        options: TransferOptions = {},\n      ) => {\n        options.signal?.throwIfAborted();\n        if (disposed)\n          throw new OutpostError(\"provider\", \"Local sandbox is closed\");\n        if (resolve(source) === resolve(destination)) return;\n        await mkdir(dirname(destination), { recursive: true });\n        await cp(source, destination, {\n          recursive: true,\n          force: true,\n          filter: () => {\n            options.signal?.throwIfAborted();\n            return true;\n          },\n        });\n      };\n      return {\n        root: context.directory,\n        home: homedir(),\n        invoke(command: Command) {\n          if (disposed)\n            return Promise.reject(\n              new OutpostError(\"provider\", \"Local sandbox is closed\"),\n            );\n          const signal = command.signal\n            ? AbortSignal.any([command.signal, stop.signal])\n            : stop.signal;\n          const pending = executeProcess({\n            ...command,\n            directory: command.directory ?? context.directory,\n            variables: { ...context.variables, ...command.variables },\n            signal,\n          });\n          active.add(pending);\n          void pending.then(\n            () => active.delete(pending),\n            () => active.delete(pending),\n          );\n          return pending;\n        },\n        upload: copy,\n        download: copy,\n        async release() {\n          if (disposed) return;\n          disposed = true;\n          stop.abort(new OutpostError(\"aborted\", \"Sandbox disposed\"));\n          await Promise.allSettled(active);\n        },\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAK9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,MAAM,UAAU,KAAK,CAAC,UAAwB,EAAE;IAC9C,SAAS,CACP,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EACtD,gDAAgD,CACjD,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,EAChB,MAAc,EACd,WAAmB,EACnB,UAA2B,EAAE,EAC7B,EAAE;gBACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjC,IAAI,QAAQ;oBACV,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC;oBAAE,OAAO;gBACrD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE;oBAC5B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,GAAG,EAAE;wBACX,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;wBACjC,OAAO,IAAI,CAAC;oBACd,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC;YACF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,SAAS;gBACvB,IAAI,EAAE,OAAO,EAAE;gBACf,MAAM,CAAC,OAAgB;oBACrB,IAAI,QAAQ;wBACV,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CACxD,CAAC;oBACJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;wBAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;wBAChD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;oBAChB,MAAM,OAAO,GAAG,cAAc,CAAC;wBAC7B,GAAG,OAAO;wBACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;wBACjD,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;wBACzD,MAAM;qBACP,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpB,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7B,CAAC;oBACF,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,KAAK,CAAC,OAAO;oBACX,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;oBAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { cp, mkdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { dirname, resolve } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { invariant, OutpostError } from \"../domain/errors.ts\";\nimport type {\n  SandboxProvider,\n  TransferOptions,\n} from \"../domain/sandbox.types.ts\";\nimport { executeProcess } from \"../infrastructure/process.ts\";\nimport type { LocalOptions } from \"./local.types.ts\";\n\nexport function local(options: LocalOptions = {}): SandboxProvider {\n  invariant(\n    !(\"egress\" in options) || options.egress === undefined,\n    \"Local execution cannot enforce egress policies\",\n  );\n  return {\n    name: \"local\",\n    placement: \"host\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const stop = new AbortController();\n      const active = new Set<Promise<unknown>>();\n      let disposed = false;\n      const copy = async (\n        source: string,\n        destination: string,\n        options: TransferOptions = {},\n      ) => {\n        options.signal?.throwIfAborted();\n        if (disposed)\n          throw new OutpostError(\"provider\", \"Local sandbox is closed\");\n        if (resolve(source) === resolve(destination)) return;\n        await mkdir(dirname(destination), { recursive: true });\n        await cp(source, destination, {\n          recursive: true,\n          force: true,\n          filter: () => {\n            options.signal?.throwIfAborted();\n            return true;\n          },\n        });\n      };\n      return {\n        root: context.directory,\n        home: homedir(),\n        invoke(command: Command) {\n          if (disposed)\n            return Promise.reject(\n              new OutpostError(\"provider\", \"Local sandbox is closed\"),\n            );\n          const signal = command.signal\n            ? AbortSignal.any([command.signal, stop.signal])\n            : stop.signal;\n          const pending = executeProcess({\n            ...command,\n            directory: command.directory ?? context.directory,\n            variables: { ...context.variables, ...command.variables },\n            signal,\n          });\n          active.add(pending);\n          void pending.then(\n            () => active.delete(pending),\n            () => active.delete(pending),\n          );\n          return pending;\n        },\n        upload: copy,\n        download: copy,\n        async release() {\n          if (disposed) return;\n          disposed = true;\n          stop.abort(new OutpostError(\"aborted\", \"Sandbox disposed\"));\n          await Promise.allSettled(active);\n        },\n      };\n    },\n  };\n}\n"]}

package/dist/providers/podman.d.ts

@@ -1,3 +1,5 @@
 import type { ContainerOptions } from "./container.types.ts";
 export type { ContainerOptions } from "./container.ts";
 export declare const podman: (options?: ContainerOptions) => import("../index.ts").SandboxProvider;
+export type { DependencyCache } from "./container-cache.types.ts";
+export type { EgressPolicy } from "../domain/egress.types.ts";

package/dist/providers/podman.js.map

@@ -1 +1 @@
-{"version":3,"file":"podman.js","sourceRoot":"","sources":["../../src/providers/podman.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKnD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAA4B,EAAE,EAAE,EAAE,CACvD,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC","sourcesContent":["import { containerProvider } from \"./container.ts\";\nimport type { ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.ts\";\n\nexport const podman = (options: ContainerOptions = {}) =>\n  containerProvider(\"podman\", options);\n"]}
+{"version":3,"file":"podman.js","sourceRoot":"","sources":["../../src/providers/podman.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKnD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAA4B,EAAE,EAAE,EAAE,CACvD,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC","sourcesContent":["import { containerProvider } from \"./container.ts\";\nimport type { ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.ts\";\n\nexport const podman = (options: ContainerOptions = {}) =>\n  containerProvider(\"podman\", options);\n\nexport type { DependencyCache } from \"./container-cache.types.ts\";\n\nexport type { EgressPolicy } from \"../domain/egress.types.ts\";\n"]}

package/dist/providers/terminal-bridge.d.ts

@@ -0,0 +1,14 @@
+import type { PtyHandle } from "@daytona/sdk";
+import type { Command } from "../domain/command.types.ts";
+export declare function terminalBridge(command: Command, retain: number): {
+    failure: Promise<never>;
+    size: () => {
+        cols: number;
+        rows: number;
+    };
+    output(data: Uint8Array): void;
+    connect(pty: PtyHandle): void;
+    flush(): Promise<void>;
+    text: () => string;
+    close(): void;
+};

package/dist/providers/terminal-bridge.js

@@ -0,0 +1,100 @@
+import { StringDecoder } from "node:string_decoder";
+import { ReadStream } from "node:tty";
+export function terminalBridge(command, retain) {
+    const input = command.terminal?.input ?? process.stdin;
+    const output = command.terminal?.output ?? process.stdout;
+    const decoder = new StringDecoder("utf8");
+    const wasPaused = input.isPaused();
+    const raw = input instanceof ReadStream ? input.isRaw : false;
+    let captured = "";
+    let active = true;
+    let pending = Promise.resolve();
+    let sending = Promise.resolve();
+    let handle;
+    let reject = () => { };
+    const failure = new Promise((_resolve, fail) => {
+        reject = fail;
+    });
+    void failure.catch(() => undefined);
+    const size = () => ({
+        cols: "columns" in output && typeof output.columns === "number"
+            ? output.columns
+            : 80,
+        rows: "rows" in output && typeof output.rows === "number" ? output.rows : 24,
+    });
+    const capture = (text) => {
+        captured = retain > 0 ? (captured + text).slice(-retain) : "";
+        try {
+            command.observe?.("stdout", text);
+        }
+        catch { }
+    };
+    const send = (data) => {
+        input.pause();
+        sending = sending.then(async () => {
+            if (active)
+                await handle?.sendInput(data);
+        });
+        void sending.then(() => {
+            if (active)
+                input.resume();
+        }, reject);
+    };
+    const end = () => send(new Uint8Array([4]));
+    const resize = () => {
+        const { cols, rows } = size();
+        void handle?.resize(cols, rows).catch(reject);
+    };
+    const error = (cause) => reject(cause);
+    output.on("error", error);
+    return {
+        failure,
+        size,
+        output(data) {
+            if (!active)
+                return;
+            const bytes = Buffer.from(data);
+            capture(decoder.write(bytes));
+            pending = pending.then(() => new Promise((resolve, rejectWrite) => {
+                if (!active) {
+                    resolve();
+                    return;
+                }
+                output.write(bytes, (cause) => cause ? rejectWrite(cause) : resolve());
+            }));
+            void pending.catch(reject);
+        },
+        connect(pty) {
+            handle = pty;
+            if (input instanceof ReadStream)
+                input.setRawMode(true);
+            input.on("data", send);
+            input.on("end", end);
+            input.on("error", error);
+            output.on("resize", resize);
+            if (input.readableEnded)
+                end();
+            input.resume();
+        },
+        async flush() {
+            await Promise.race([pending, failure]);
+            capture(decoder.end());
+        },
+        text: () => captured,
+        close() {
+            active = false;
+            input.removeListener("data", send);
+            input.removeListener("end", end);
+            input.removeListener("error", error);
+            output.removeListener("resize", resize);
+            output.removeListener("error", error);
+            if (wasPaused || input.listenerCount("data") === 0)
+                input.pause();
+            if (!wasPaused && input.listenerCount("data") > 0)
+                input.resume();
+            if (input instanceof ReadStream)
+                input.setRawMode(raw);
+        },
+    };
+}
+//# sourceMappingURL=terminal-bridge.js.map

package/dist/providers/terminal-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-bridge.js","sourceRoot":"","sources":["../../src/providers/terminal-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAItC,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,IAAI,MAA6B,CAAC;IAClC,IAAI,MAAM,GAA6B,GAAG,EAAE,GAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAClB,IAAI,EACF,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YACvD,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,EAAE;QACR,IAAI,EACF,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;QAC/B,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAyB,EAAE,EAAE;QACzC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAChC,IAAI,MAAM;gBAAE,MAAM,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,MAAM;gBAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO;QACL,OAAO;QACP,IAAI;QACJ,MAAM,CAAC,IAAgB;YACrB,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,OAAO,GAAG,OAAO,CAAC,IAAI,CACpB,GAAG,EAAE,CACH,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE;gBACzC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CACvC,CAAC;YACJ,CAAC,CAAC,CACL,CAAC;YACF,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAc;YACpB,MAAM,GAAG,GAAG,CAAC;YACb,IAAI,KAAK,YAAY,UAAU;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,aAAa;gBAAE,GAAG,EAAE,CAAC;YAC/B,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ;QACpB,KAAK;YACH,MAAM,GAAG,KAAK,CAAC;YACf,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAClE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAClE,IAAI,KAAK,YAAY,UAAU;gBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { StringDecoder } from \"node:string_decoder\";\nimport { ReadStream } from \"node:tty\";\nimport type { PtyHandle } from \"@daytona/sdk\";\nimport type { Command } from \"../domain/command.types.ts\";\n\nexport function terminalBridge(command: Command, retain: number) {\n  const input = command.terminal?.input ?? process.stdin;\n  const output = command.terminal?.output ?? process.stdout;\n  const decoder = new StringDecoder(\"utf8\");\n  const wasPaused = input.isPaused();\n  const raw = input instanceof ReadStream ? input.isRaw : false;\n  let captured = \"\";\n  let active = true;\n  let pending = Promise.resolve();\n  let sending = Promise.resolve();\n  let handle: PtyHandle | undefined;\n  let reject: (cause: unknown) => void = () => {};\n  const failure = new Promise<never>((_resolve, fail) => {\n    reject = fail;\n  });\n  void failure.catch(() => undefined);\n  const size = () => ({\n    cols:\n      \"columns\" in output && typeof output.columns === \"number\"\n        ? output.columns\n        : 80,\n    rows:\n      \"rows\" in output && typeof output.rows === \"number\" ? output.rows : 24,\n  });\n  const capture = (text: string) => {\n    captured = retain > 0 ? (captured + text).slice(-retain) : \"\";\n    try {\n      command.observe?.(\"stdout\", text);\n    } catch {}\n  };\n  const send = (data: string | Uint8Array) => {\n    input.pause();\n    sending = sending.then(async () => {\n      if (active) await handle?.sendInput(data);\n    });\n    void sending.then(() => {\n      if (active) input.resume();\n    }, reject);\n  };\n  const end = () => send(new Uint8Array([4]));\n  const resize = () => {\n    const { cols, rows } = size();\n    void handle?.resize(cols, rows).catch(reject);\n  };\n  const error = (cause: Error) => reject(cause);\n  output.on(\"error\", error);\n  return {\n    failure,\n    size,\n    output(data: Uint8Array) {\n      if (!active) return;\n      const bytes = Buffer.from(data);\n      capture(decoder.write(bytes));\n      pending = pending.then(\n        () =>\n          new Promise<void>((resolve, rejectWrite) => {\n            if (!active) {\n              resolve();\n              return;\n            }\n            output.write(bytes, (cause) =>\n              cause ? rejectWrite(cause) : resolve(),\n            );\n          }),\n      );\n      void pending.catch(reject);\n    },\n    connect(pty: PtyHandle) {\n      handle = pty;\n      if (input instanceof ReadStream) input.setRawMode(true);\n      input.on(\"data\", send);\n      input.on(\"end\", end);\n      input.on(\"error\", error);\n      output.on(\"resize\", resize);\n      if (input.readableEnded) end();\n      input.resume();\n    },\n    async flush() {\n      await Promise.race([pending, failure]);\n      capture(decoder.end());\n    },\n    text: () => captured,\n    close() {\n      active = false;\n      input.removeListener(\"data\", send);\n      input.removeListener(\"end\", end);\n      input.removeListener(\"error\", error);\n      output.removeListener(\"resize\", resize);\n      output.removeListener(\"error\", error);\n      if (wasPaused || input.listenerCount(\"data\") === 0) input.pause();\n      if (!wasPaused && input.listenerCount(\"data\") > 0) input.resume();\n      if (input instanceof ReadStream) input.setRawMode(raw);\n    },\n  };\n}\n"]}

package/dist/providers/vercel-directory.d.ts

@@ -0,0 +1,2 @@
+import type { VercelRuntime } from "./vercel.types.ts";
+export declare function vercelDirectory(sandbox: VercelRuntime["sandbox"], path: string): Promise<void>;

package/dist/providers/vercel-directory.js

@@ -0,0 +1,7 @@
+import { OutpostError } from "../domain/errors.js";
+export async function vercelDirectory(sandbox, path) {
+    const result = await sandbox.runCommand("mkdir", ["-p", "--", path]);
+    if (result.exitCode !== 0)
+        throw new OutpostError("provider", `Could not create remote directory ${path}: ${await result.stderr()}`);
+}
+//# sourceMappingURL=vercel-directory.js.map

package/dist/providers/vercel-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-directory.js","sourceRoot":"","sources":["../../src/providers/vercel-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAiC,EACjC,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,qCAAqC,IAAI,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,CACtE,CAAC;AACN,CAAC","sourcesContent":["import { OutpostError } from \"../domain/errors.ts\";\nimport type { VercelRuntime } from \"./vercel.types.ts\";\n\nexport async function vercelDirectory(\n  sandbox: VercelRuntime[\"sandbox\"],\n  path: string,\n): Promise<void> {\n  const result = await sandbox.runCommand(\"mkdir\", [\"-p\", \"--\", path]);\n  if (result.exitCode !== 0)\n    throw new OutpostError(\n      \"provider\",\n      `Could not create remote directory ${path}: ${await result.stderr()}`,\n    );\n}\n"]}

package/dist/providers/vercel-files.js

@@ -3,12 +3,13 @@ import { OutpostError } from "../domain/errors.js";
 import { transfer } from "../infrastructure/transfer.js";
 import { manifestScript } from "./cloud-files.constants.js";
 import { downloadTree, uploadTree } from "./cloud-files.js";
+import { vercelDirectory } from "./vercel-directory.js";
 export function vercelFiles(sandbox) {
     return {
         async upload(source, destination, options = {}) {
             return transfer(options, async (signal) => {
                 await uploadTree(source, destination, (path, content) => sandbox.writeFiles([{ path, content }]), async (target, path) => {
-                    await sandbox.mkDir(posix.dirname(path));
+                    await vercelDirectory(sandbox, posix.dirname(path));
                     const result = await sandbox.runCommand("ln", [
                         "-s",
                         "--",
@@ -19,7 +20,7 @@ export function vercelFiles(sandbox) {
                         throw new OutpostError("provider", "Symlink upload failed");
                 }, async (path, directory, mode) => {
                     if (directory)
-                        await sandbox.mkDir(path);
+                        await vercelDirectory(sandbox, path);
                     const result = await sandbox.runCommand("chmod", [
                         mode.toString(8),
                         path,