@elie-laloum/outpost 3.0.0 → 4.0.0

package/dist/providers/firecracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/providers/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAKlC,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,IAAI,SAAS;gBACX,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,mGAAmG,CACpG,CAAC;YACJ,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC;YACtD,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG;gBACd,OAAO;gBACP,IAAI;gBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE;aAC7C,CAAC;YACF,IAAI,SAAoC,CAAC;YACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC,KAAK,CACR,IAAI,YAAY,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAC5D,CAAC;gBACF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACtC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACnB,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,QAAQ,GACZ,IAAI,CAAC,GAAG,EAAE;oBACV,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAC;gBACjE,OAAO,IAAI,EAAE,CAAC;oBACZ,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;oBACjC,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACpB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,2CAA2C,CAC5C,CAAC;oBACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;wBAClC,GAAG,cAAc,CACf,OAAO,EACP,kBAAkB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,uIAAuI,KAAK,CAAC,IAAI,CAAC,EAAE,CAC1L;wBACD,UAAU,EAAE,IAAI,CAAC,GAAG,CAClB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAC7D;wBACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACtD,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACjB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;wBACjC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,CAAC,CAAC,CAAC;oBACH,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACpB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,2CAA2C,CAC5C,CAAC;oBACJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM;oBAC/B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;wBACxB,MAAM,IAAI,YAAY,CACpB,SAAS,EACT,0DAA0D,EAC1D,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAC1B,CAAC;oBACJ,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,4CAA4C,CAC7C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,CACZ,SAA8C,EAC9C,MAAoB,EACR,EAAE;gBACd,IAAI,MAAM;oBACR,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAC9D,CAAC;gBACJ,MAAM,OAAO,GAAG,SAAS,CACvB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAC9D,CAAC;gBACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpB,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7B,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;YACF,OAAO;gBACL,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;gBACnE,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAC5C,KAAK,CACH,CAAC,MAAM,EAAE,EAAE,CACT,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAC3D,OAAO,CAAC,MAAM,CACf;gBACH,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAC9C,KAAK,CACH,CAAC,MAAM,EAAE,EAAE,CACT,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,EAC7D,OAAO,CAAC,MAAM,CACf;gBACH,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { executeProcess, quote } from \"../infrastructure/process.ts\";\nimport { firecrackerCommand, firecrackerSsh } from \"./firecracker-command.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\nimport { firecrackerFiles } from \"./firecracker-files.ts\";\nimport {\n  firecrackerMachine,\n  validateFirecracker,\n} from \"./firecracker-machine.ts\";\nimport type { FirecrackerOptions } from \"./firecracker.types.ts\";\n\nexport type { FirecrackerOptions } from \"./firecracker.types.ts\";\n\nexport function firecracker(options: FirecrackerOptions): SandboxProvider {\n  validateFirecracker(options);\n  let allocated = false;\n  return {\n    name: \"firecracker\",\n    placement: \"remote\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      if (allocated)\n        throw new OutpostError(\n          \"provider\",\n          \"This Firecracker provider already owns its TAP; create separate configurations for concurrent VMs\",\n        );\n      allocated = true;\n      let machine;\n      try {\n        machine = await firecrackerMachine(options, context.signal);\n      } catch (cause) {\n        allocated = false;\n        throw cause;\n      }\n      const root = options.root ?? firecrackerDefaults.root;\n      let closed = false;\n      const active = new Set<Promise<unknown>>();\n      const stop = new AbortController();\n      const runtime = {\n        options,\n        root,\n        variables: context.variables,\n        executor: executeProcess,\n        isClosed: () => closed || machine.isClosed(),\n      };\n      let releasing: Promise<void> | undefined;\n      const release = () =>\n        (releasing ??= (async () => {\n          closed = true;\n          stop.abort(\n            new OutpostError(\"aborted\", \"Firecracker sandbox disposed\"),\n          );\n          await Promise.allSettled([...active]);\n          await machine.release();\n          allocated = false;\n        })().catch((cause) => {\n          releasing = undefined;\n          throw cause;\n        }));\n      try {\n        const deadline =\n          Date.now() +\n          (options.bootDeadlineMs ?? firecrackerDefaults.bootDeadlineMs);\n        while (true) {\n          context.signal?.throwIfAborted();\n          if (machine.isClosed())\n            throw new OutpostError(\n              \"provider\",\n              \"Firecracker exited before guest readiness\",\n            );\n          const result = await executeProcess({\n            ...firecrackerSsh(\n              options,\n              `test \"$HOME\" = ${quote(options.home)} && node -e 'if(Number(process.versions.node.split(\".\")[0])<24)process.exit(1)' && command -v git setsid tar >/dev/null && mkdir -p ${quote(root)}`,\n            ),\n            deadlineMs: Math.max(\n              1,\n              Math.min(firecrackerDefaults.probeMs, deadline - Date.now()),\n            ),\n            ...(context.signal ? { signal: context.signal } : {}),\n          }).catch((cause) => {\n            context.signal?.throwIfAborted();\n            return { status: 1, stdout: \"\", stderr: String(cause) };\n          });\n          if (machine.isClosed())\n            throw new OutpostError(\n              \"provider\",\n              \"Firecracker exited during guest readiness\",\n            );\n          if (result.status === 0) break;\n          if (Date.now() >= deadline)\n            throw new OutpostError(\n              \"timeout\",\n              \"Firecracker guest SSH/prerequisites did not become ready\",\n              { stderr: result.stderr },\n            );\n          await delay(100, undefined, { signal: context.signal });\n        }\n      } catch (cause) {\n        try {\n          await release();\n        } catch (cleanup) {\n          throw new AggregateError(\n            [cause, cleanup],\n            \"Firecracker acquisition and cleanup failed\",\n          );\n        }\n        throw cause;\n      }\n      const invoke = firecrackerCommand(runtime);\n      const files = firecrackerFiles(runtime);\n      const track = <T>(\n        operation: (signal: AbortSignal) => Promise<T>,\n        signal?: AbortSignal,\n      ): Promise<T> => {\n        if (closed)\n          return Promise.reject(\n            new OutpostError(\"provider\", \"Firecracker sandbox is closed\"),\n          );\n        const pending = operation(\n          signal ? AbortSignal.any([signal, stop.signal]) : stop.signal,\n        );\n        active.add(pending);\n        void pending.then(\n          () => active.delete(pending),\n          () => active.delete(pending),\n        );\n        return pending;\n      };\n      return {\n        root,\n        home: options.home,\n        invoke: (command) =>\n          track((signal) => invoke({ ...command, signal }), command.signal),\n        upload: (source, destination, options = {}) =>\n          track(\n            (signal) =>\n              files.upload(source, destination, { ...options, signal }),\n            options.signal,\n          ),\n        download: (source, destination, options = {}) =>\n          track(\n            (signal) =>\n              files.download(source, destination, { ...options, signal }),\n            options.signal,\n          ),\n        release,\n      };\n    },\n  };\n}\n"]}

package/dist/providers/firecracker.types.d.ts

@@ -0,0 +1,36 @@
+import type { Variables } from "../domain/command.types.ts";
+import type { Executor } from "../infrastructure/process.types.ts";
+export interface FirecrackerOptions {
+    readonly binary: string;
+    readonly kernel: string;
+    readonly rootfs: string;
+    readonly tap: string;
+    readonly guestMac: string;
+    readonly bootArgs: string;
+    readonly ssh: {
+        readonly host: string;
+        readonly user: string;
+        readonly identity: string;
+        readonly knownHosts: string;
+        readonly port?: number;
+        readonly binary?: string;
+    };
+    readonly root?: string;
+    readonly home: string;
+    readonly cpus?: number;
+    readonly memoryMb?: number;
+    readonly bootDeadlineMs?: number;
+    readonly variables?: Variables;
+}
+export interface FirecrackerRuntime {
+    readonly options: FirecrackerOptions;
+    readonly root: string;
+    readonly variables: Variables;
+    readonly isClosed: () => boolean;
+    readonly executor: Executor;
+}
+export interface FirecrackerMachine {
+    readonly directory: string;
+    readonly isClosed: () => boolean;
+    release(): Promise<void>;
+}

package/dist/providers/firecracker.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=firecracker.types.js.map

package/dist/providers/firecracker.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.types.js","sourceRoot":"","sources":["../../src/providers/firecracker.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Variables } from \"../domain/command.types.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\n\nexport interface FirecrackerOptions {\n  readonly binary: string;\n  readonly kernel: string;\n  readonly rootfs: string;\n  readonly tap: string;\n  readonly guestMac: string;\n  readonly bootArgs: string;\n  readonly ssh: {\n    readonly host: string;\n    readonly user: string;\n    readonly identity: string;\n    readonly knownHosts: string;\n    readonly port?: number;\n    readonly binary?: string;\n  };\n  readonly root?: string;\n  readonly home: string;\n  readonly cpus?: number;\n  readonly memoryMb?: number;\n  readonly bootDeadlineMs?: number;\n  readonly variables?: Variables;\n}\n\nexport interface FirecrackerRuntime {\n  readonly options: FirecrackerOptions;\n  readonly root: string;\n  readonly variables: Variables;\n  readonly isClosed: () => boolean;\n  readonly executor: Executor;\n}\n\nexport interface FirecrackerMachine {\n  readonly directory: string;\n  readonly isClosed: () => boolean;\n  release(): Promise<void>;\n}\n"]}

package/dist/providers/local.js

@@ -1,9 +1,10 @@
 import { cp, mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
-import { OutpostError } from "../domain/errors.js";
+import { invariant, OutpostError } from "../domain/errors.js";
 import { executeProcess } from "../infrastructure/process.js";
 export function local(options = {}) {
+    invariant(!("egress" in options) || options.egress === undefined, "Local execution cannot enforce egress policies");
     return {
         name: "local",
         placement: "host",

package/dist/providers/local.js.map

@@ -1 +1 @@
-{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,MAAM,UAAU,KAAK,CAAC,UAAwB,EAAE;IAC9C,OAAO;QACL,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,EAChB,MAAc,EACd,WAAmB,EACnB,UAA2B,EAAE,EAC7B,EAAE;gBACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjC,IAAI,QAAQ;oBACV,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC;oBAAE,OAAO;gBACrD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE;oBAC5B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,GAAG,EAAE;wBACX,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;wBACjC,OAAO,IAAI,CAAC;oBACd,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC;YACF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,SAAS;gBACvB,IAAI,EAAE,OAAO,EAAE;gBACf,MAAM,CAAC,OAAgB;oBACrB,IAAI,QAAQ;wBACV,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CACxD,CAAC;oBACJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;wBAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;wBAChD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;oBAChB,MAAM,OAAO,GAAG,cAAc,CAAC;wBAC7B,GAAG,OAAO;wBACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;wBACjD,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;wBACzD,MAAM;qBACP,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpB,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7B,CAAC;oBACF,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,KAAK,CAAC,OAAO;oBACX,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;oBAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { cp, mkdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { dirname, resolve } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type {\n  SandboxProvider,\n  TransferOptions,\n} from \"../domain/sandbox.types.ts\";\nimport { executeProcess } from \"../infrastructure/process.ts\";\nimport type { LocalOptions } from \"./local.types.ts\";\n\nexport function local(options: LocalOptions = {}): SandboxProvider {\n  return {\n    name: \"local\",\n    placement: \"host\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const stop = new AbortController();\n      const active = new Set<Promise<unknown>>();\n      let disposed = false;\n      const copy = async (\n        source: string,\n        destination: string,\n        options: TransferOptions = {},\n      ) => {\n        options.signal?.throwIfAborted();\n        if (disposed)\n          throw new OutpostError(\"provider\", \"Local sandbox is closed\");\n        if (resolve(source) === resolve(destination)) return;\n        await mkdir(dirname(destination), { recursive: true });\n        await cp(source, destination, {\n          recursive: true,\n          force: true,\n          filter: () => {\n            options.signal?.throwIfAborted();\n            return true;\n          },\n        });\n      };\n      return {\n        root: context.directory,\n        home: homedir(),\n        invoke(command: Command) {\n          if (disposed)\n            return Promise.reject(\n              new OutpostError(\"provider\", \"Local sandbox is closed\"),\n            );\n          const signal = command.signal\n            ? AbortSignal.any([command.signal, stop.signal])\n            : stop.signal;\n          const pending = executeProcess({\n            ...command,\n            directory: command.directory ?? context.directory,\n            variables: { ...context.variables, ...command.variables },\n            signal,\n          });\n          active.add(pending);\n          void pending.then(\n            () => active.delete(pending),\n            () => active.delete(pending),\n          );\n          return pending;\n        },\n        upload: copy,\n        download: copy,\n        async release() {\n          if (disposed) return;\n          disposed = true;\n          stop.abort(new OutpostError(\"aborted\", \"Sandbox disposed\"));\n          await Promise.allSettled(active);\n        },\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAK9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,MAAM,UAAU,KAAK,CAAC,UAAwB,EAAE;IAC9C,SAAS,CACP,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EACtD,gDAAgD,CACjD,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,EAChB,MAAc,EACd,WAAmB,EACnB,UAA2B,EAAE,EAC7B,EAAE;gBACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjC,IAAI,QAAQ;oBACV,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC;oBAAE,OAAO;gBACrD,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE;oBAC5B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,GAAG,EAAE;wBACX,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;wBACjC,OAAO,IAAI,CAAC;oBACd,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC;YACF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,SAAS;gBACvB,IAAI,EAAE,OAAO,EAAE;gBACf,MAAM,CAAC,OAAgB;oBACrB,IAAI,QAAQ;wBACV,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CACxD,CAAC;oBACJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;wBAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;wBAChD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;oBAChB,MAAM,OAAO,GAAG,cAAc,CAAC;wBAC7B,GAAG,OAAO;wBACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;wBACjD,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;wBACzD,MAAM;qBACP,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpB,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7B,CAAC;oBACF,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,KAAK,CAAC,OAAO;oBACX,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;oBAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { cp, mkdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { dirname, resolve } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { invariant, OutpostError } from \"../domain/errors.ts\";\nimport type {\n  SandboxProvider,\n  TransferOptions,\n} from \"../domain/sandbox.types.ts\";\nimport { executeProcess } from \"../infrastructure/process.ts\";\nimport type { LocalOptions } from \"./local.types.ts\";\n\nexport function local(options: LocalOptions = {}): SandboxProvider {\n  invariant(\n    !(\"egress\" in options) || options.egress === undefined,\n    \"Local execution cannot enforce egress policies\",\n  );\n  return {\n    name: \"local\",\n    placement: \"host\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const stop = new AbortController();\n      const active = new Set<Promise<unknown>>();\n      let disposed = false;\n      const copy = async (\n        source: string,\n        destination: string,\n        options: TransferOptions = {},\n      ) => {\n        options.signal?.throwIfAborted();\n        if (disposed)\n          throw new OutpostError(\"provider\", \"Local sandbox is closed\");\n        if (resolve(source) === resolve(destination)) return;\n        await mkdir(dirname(destination), { recursive: true });\n        await cp(source, destination, {\n          recursive: true,\n          force: true,\n          filter: () => {\n            options.signal?.throwIfAborted();\n            return true;\n          },\n        });\n      };\n      return {\n        root: context.directory,\n        home: homedir(),\n        invoke(command: Command) {\n          if (disposed)\n            return Promise.reject(\n              new OutpostError(\"provider\", \"Local sandbox is closed\"),\n            );\n          const signal = command.signal\n            ? AbortSignal.any([command.signal, stop.signal])\n            : stop.signal;\n          const pending = executeProcess({\n            ...command,\n            directory: command.directory ?? context.directory,\n            variables: { ...context.variables, ...command.variables },\n            signal,\n          });\n          active.add(pending);\n          void pending.then(\n            () => active.delete(pending),\n            () => active.delete(pending),\n          );\n          return pending;\n        },\n        upload: copy,\n        download: copy,\n        async release() {\n          if (disposed) return;\n          disposed = true;\n          stop.abort(new OutpostError(\"aborted\", \"Sandbox disposed\"));\n          await Promise.allSettled(active);\n        },\n      };\n    },\n  };\n}\n"]}

package/dist/providers/podman.d.ts

@@ -2,3 +2,4 @@ import type { ContainerOptions } from "./container.types.ts";
 export type { ContainerOptions } from "./container.ts";
 export declare const podman: (options?: ContainerOptions) => import("../index.ts").SandboxProvider;
 export type { DependencyCache } from "./container-cache.types.ts";
+export type { EgressPolicy } from "../domain/egress.types.ts";

package/dist/providers/podman.js.map

@@ -1 +1 @@
-{"version":3,"file":"podman.js","sourceRoot":"","sources":["../../src/providers/podman.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKnD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAA4B,EAAE,EAAE,EAAE,CACvD,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC","sourcesContent":["import { containerProvider } from \"./container.ts\";\nimport type { ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.ts\";\n\nexport const podman = (options: ContainerOptions = {}) =>\n  containerProvider(\"podman\", options);\n\nexport type { DependencyCache } from \"./container-cache.types.ts\";\n"]}
+{"version":3,"file":"podman.js","sourceRoot":"","sources":["../../src/providers/podman.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKnD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAA4B,EAAE,EAAE,EAAE,CACvD,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC","sourcesContent":["import { containerProvider } from \"./container.ts\";\nimport type { ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.ts\";\n\nexport const podman = (options: ContainerOptions = {}) =>\n  containerProvider(\"podman\", options);\n\nexport type { DependencyCache } from \"./container-cache.types.ts\";\n\nexport type { EgressPolicy } from \"../domain/egress.types.ts\";\n"]}

package/dist/providers/terminal-bridge.d.ts

@@ -0,0 +1,14 @@
+import type { PtyHandle } from "@daytona/sdk";
+import type { Command } from "../domain/command.types.ts";
+export declare function terminalBridge(command: Command, retain: number): {
+    failure: Promise<never>;
+    size: () => {
+        cols: number;
+        rows: number;
+    };
+    output(data: Uint8Array): void;
+    connect(pty: PtyHandle): void;
+    flush(): Promise<void>;
+    text: () => string;
+    close(): void;
+};

package/dist/providers/terminal-bridge.js

@@ -0,0 +1,100 @@
+import { StringDecoder } from "node:string_decoder";
+import { ReadStream } from "node:tty";
+export function terminalBridge(command, retain) {
+    const input = command.terminal?.input ?? process.stdin;
+    const output = command.terminal?.output ?? process.stdout;
+    const decoder = new StringDecoder("utf8");
+    const wasPaused = input.isPaused();
+    const raw = input instanceof ReadStream ? input.isRaw : false;
+    let captured = "";
+    let active = true;
+    let pending = Promise.resolve();
+    let sending = Promise.resolve();
+    let handle;
+    let reject = () => { };
+    const failure = new Promise((_resolve, fail) => {
+        reject = fail;
+    });
+    void failure.catch(() => undefined);
+    const size = () => ({
+        cols: "columns" in output && typeof output.columns === "number"
+            ? output.columns
+            : 80,
+        rows: "rows" in output && typeof output.rows === "number" ? output.rows : 24,
+    });
+    const capture = (text) => {
+        captured = retain > 0 ? (captured + text).slice(-retain) : "";
+        try {
+            command.observe?.("stdout", text);
+        }
+        catch { }
+    };
+    const send = (data) => {
+        input.pause();
+        sending = sending.then(async () => {
+            if (active)
+                await handle?.sendInput(data);
+        });
+        void sending.then(() => {
+            if (active)
+                input.resume();
+        }, reject);
+    };
+    const end = () => send(new Uint8Array([4]));
+    const resize = () => {
+        const { cols, rows } = size();
+        void handle?.resize(cols, rows).catch(reject);
+    };
+    const error = (cause) => reject(cause);
+    output.on("error", error);
+    return {
+        failure,
+        size,
+        output(data) {
+            if (!active)
+                return;
+            const bytes = Buffer.from(data);
+            capture(decoder.write(bytes));
+            pending = pending.then(() => new Promise((resolve, rejectWrite) => {
+                if (!active) {
+                    resolve();
+                    return;
+                }
+                output.write(bytes, (cause) => cause ? rejectWrite(cause) : resolve());
+            }));
+            void pending.catch(reject);
+        },
+        connect(pty) {
+            handle = pty;
+            if (input instanceof ReadStream)
+                input.setRawMode(true);
+            input.on("data", send);
+            input.on("end", end);
+            input.on("error", error);
+            output.on("resize", resize);
+            if (input.readableEnded)
+                end();
+            input.resume();
+        },
+        async flush() {
+            await Promise.race([pending, failure]);
+            capture(decoder.end());
+        },
+        text: () => captured,
+        close() {
+            active = false;
+            input.removeListener("data", send);
+            input.removeListener("end", end);
+            input.removeListener("error", error);
+            output.removeListener("resize", resize);
+            output.removeListener("error", error);
+            if (wasPaused || input.listenerCount("data") === 0)
+                input.pause();
+            if (!wasPaused && input.listenerCount("data") > 0)
+                input.resume();
+            if (input instanceof ReadStream)
+                input.setRawMode(raw);
+        },
+    };
+}
+//# sourceMappingURL=terminal-bridge.js.map

package/dist/providers/terminal-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-bridge.js","sourceRoot":"","sources":["../../src/providers/terminal-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAItC,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,IAAI,MAA6B,CAAC;IAClC,IAAI,MAAM,GAA6B,GAAG,EAAE,GAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;QAClB,IAAI,EACF,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YACvD,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,EAAE;QACR,IAAI,EACF,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;QAC/B,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAyB,EAAE,EAAE;QACzC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAChC,IAAI,MAAM;gBAAE,MAAM,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,MAAM;gBAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO;QACL,OAAO;QACP,IAAI;QACJ,MAAM,CAAC,IAAgB;YACrB,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,OAAO,GAAG,OAAO,CAAC,IAAI,CACpB,GAAG,EAAE,CACH,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE;gBACzC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CACvC,CAAC;YACJ,CAAC,CAAC,CACL,CAAC;YACF,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAc;YACpB,MAAM,GAAG,GAAG,CAAC;YACb,IAAI,KAAK,YAAY,UAAU;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,aAAa;gBAAE,GAAG,EAAE,CAAC;YAC/B,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ;QACpB,KAAK;YACH,MAAM,GAAG,KAAK,CAAC;YACf,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAClE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAClE,IAAI,KAAK,YAAY,UAAU;gBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { StringDecoder } from \"node:string_decoder\";\nimport { ReadStream } from \"node:tty\";\nimport type { PtyHandle } from \"@daytona/sdk\";\nimport type { Command } from \"../domain/command.types.ts\";\n\nexport function terminalBridge(command: Command, retain: number) {\n  const input = command.terminal?.input ?? process.stdin;\n  const output = command.terminal?.output ?? process.stdout;\n  const decoder = new StringDecoder(\"utf8\");\n  const wasPaused = input.isPaused();\n  const raw = input instanceof ReadStream ? input.isRaw : false;\n  let captured = \"\";\n  let active = true;\n  let pending = Promise.resolve();\n  let sending = Promise.resolve();\n  let handle: PtyHandle | undefined;\n  let reject: (cause: unknown) => void = () => {};\n  const failure = new Promise<never>((_resolve, fail) => {\n    reject = fail;\n  });\n  void failure.catch(() => undefined);\n  const size = () => ({\n    cols:\n      \"columns\" in output && typeof output.columns === \"number\"\n        ? output.columns\n        : 80,\n    rows:\n      \"rows\" in output && typeof output.rows === \"number\" ? output.rows : 24,\n  });\n  const capture = (text: string) => {\n    captured = retain > 0 ? (captured + text).slice(-retain) : \"\";\n    try {\n      command.observe?.(\"stdout\", text);\n    } catch {}\n  };\n  const send = (data: string | Uint8Array) => {\n    input.pause();\n    sending = sending.then(async () => {\n      if (active) await handle?.sendInput(data);\n    });\n    void sending.then(() => {\n      if (active) input.resume();\n    }, reject);\n  };\n  const end = () => send(new Uint8Array([4]));\n  const resize = () => {\n    const { cols, rows } = size();\n    void handle?.resize(cols, rows).catch(reject);\n  };\n  const error = (cause: Error) => reject(cause);\n  output.on(\"error\", error);\n  return {\n    failure,\n    size,\n    output(data: Uint8Array) {\n      if (!active) return;\n      const bytes = Buffer.from(data);\n      capture(decoder.write(bytes));\n      pending = pending.then(\n        () =>\n          new Promise<void>((resolve, rejectWrite) => {\n            if (!active) {\n              resolve();\n              return;\n            }\n            output.write(bytes, (cause) =>\n              cause ? rejectWrite(cause) : resolve(),\n            );\n          }),\n      );\n      void pending.catch(reject);\n    },\n    connect(pty: PtyHandle) {\n      handle = pty;\n      if (input instanceof ReadStream) input.setRawMode(true);\n      input.on(\"data\", send);\n      input.on(\"end\", end);\n      input.on(\"error\", error);\n      output.on(\"resize\", resize);\n      if (input.readableEnded) end();\n      input.resume();\n    },\n    async flush() {\n      await Promise.race([pending, failure]);\n      capture(decoder.end());\n    },\n    text: () => captured,\n    close() {\n      active = false;\n      input.removeListener(\"data\", send);\n      input.removeListener(\"end\", end);\n      input.removeListener(\"error\", error);\n      output.removeListener(\"resize\", resize);\n      output.removeListener(\"error\", error);\n      if (wasPaused || input.listenerCount(\"data\") === 0) input.pause();\n      if (!wasPaused && input.listenerCount(\"data\") > 0) input.resume();\n      if (input instanceof ReadStream) input.setRawMode(raw);\n    },\n  };\n}\n"]}

package/dist/providers/vercel-directory.d.ts

@@ -0,0 +1,2 @@
+import type { VercelRuntime } from "./vercel.types.ts";
+export declare function vercelDirectory(sandbox: VercelRuntime["sandbox"], path: string): Promise<void>;

package/dist/providers/vercel-directory.js

@@ -0,0 +1,7 @@
+import { OutpostError } from "../domain/errors.js";
+export async function vercelDirectory(sandbox, path) {
+    const result = await sandbox.runCommand("mkdir", ["-p", "--", path]);
+    if (result.exitCode !== 0)
+        throw new OutpostError("provider", `Could not create remote directory ${path}: ${await result.stderr()}`);
+}
+//# sourceMappingURL=vercel-directory.js.map

package/dist/providers/vercel-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-directory.js","sourceRoot":"","sources":["../../src/providers/vercel-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAiC,EACjC,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,qCAAqC,IAAI,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,CACtE,CAAC;AACN,CAAC","sourcesContent":["import { OutpostError } from \"../domain/errors.ts\";\nimport type { VercelRuntime } from \"./vercel.types.ts\";\n\nexport async function vercelDirectory(\n  sandbox: VercelRuntime[\"sandbox\"],\n  path: string,\n): Promise<void> {\n  const result = await sandbox.runCommand(\"mkdir\", [\"-p\", \"--\", path]);\n  if (result.exitCode !== 0)\n    throw new OutpostError(\n      \"provider\",\n      `Could not create remote directory ${path}: ${await result.stderr()}`,\n    );\n}\n"]}

package/dist/providers/vercel-files.js

@@ -3,12 +3,13 @@ import { OutpostError } from "../domain/errors.js";
 import { transfer } from "../infrastructure/transfer.js";
 import { manifestScript } from "./cloud-files.constants.js";
 import { downloadTree, uploadTree } from "./cloud-files.js";
+import { vercelDirectory } from "./vercel-directory.js";
 export function vercelFiles(sandbox) {
     return {
         async upload(source, destination, options = {}) {
             return transfer(options, async (signal) => {
                 await uploadTree(source, destination, (path, content) => sandbox.writeFiles([{ path, content }]), async (target, path) => {
-                    await sandbox.mkDir(posix.dirname(path));
+                    await vercelDirectory(sandbox, posix.dirname(path));
                     const result = await sandbox.runCommand("ln", [
                         "-s",
                         "--",
@@ -19,7 +20,7 @@ export function vercelFiles(sandbox) {
                         throw new OutpostError("provider", "Symlink upload failed");
                 }, async (path, directory, mode) => {
                     if (directory)
-                        await sandbox.mkDir(path);
+                        await vercelDirectory(sandbox, path);
                     const result = await sandbox.runCommand("chmod", [
                         mode.toString(8),
                         path,

package/dist/providers/vercel-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-files.js","sourceRoot":"","sources":["../../src/providers/vercel-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5D,MAAM,UAAU,WAAW,CACzB,OAAiC;IAEjC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YAC5C,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,UAAU,CACd,MAAM,EACN,WAAW,EACX,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAC1D,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;oBACrB,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;oBACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE;wBAC5C,IAAI;wBACJ,IAAI;wBACJ,MAAM;wBACN,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;wBACvB,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;gBAChE,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;oBAC9B,IAAI,SAAS;wBAAE,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE;wBAC/C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAChB,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;wBACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,uCAAuC,CACxC,CAAC;gBACN,CAAC,EACD,MAAM,CACP,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YAC9C,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE;oBAC/C,IAAI;oBACJ,cAAc;oBACd,MAAM;iBACP,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;oBACxB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,uCAAuC,CACxC,CAAC;gBACJ,MAAM,YAAY,CAChB,MAAM,EACN,WAAW,EACX,MAAM,OAAO,CAAC,MAAM,EAAE,EACtB,KAAK,EAAE,IAAI,EAAE,EAAE;oBACb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChD,IAAI,CAAC,MAAM;wBACT,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,2BAA2B,IAAI,EAAE,CAClC,CAAC;oBACJ,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM;wBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACnE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC,EACD,MAAM,CACP,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { posix } from \"node:path\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport { transfer } from \"../infrastructure/transfer.ts\";\nimport { manifestScript } from \"./cloud-files.constants.ts\";\nimport { downloadTree, uploadTree } from \"./cloud-files.ts\";\nimport type { VercelRuntime } from \"./vercel.types.ts\";\n\nexport function vercelFiles(\n  sandbox: VercelRuntime[\"sandbox\"],\n): Pick<SandboxLease, \"upload\" | \"download\"> {\n  return {\n    async upload(source, destination, options = {}) {\n      return transfer(options, async (signal) => {\n        await uploadTree(\n          source,\n          destination,\n          (path, content) => sandbox.writeFiles([{ path, content }]),\n          async (target, path) => {\n            await sandbox.mkDir(posix.dirname(path));\n            const result = await sandbox.runCommand(\"ln\", [\n              \"-s\",\n              \"--\",\n              target,\n              path,\n            ]);\n            if (result.exitCode !== 0)\n              throw new OutpostError(\"provider\", \"Symlink upload failed\");\n          },\n          async (path, directory, mode) => {\n            if (directory) await sandbox.mkDir(path);\n            const result = await sandbox.runCommand(\"chmod\", [\n              mode.toString(8),\n              path,\n            ]);\n            if (result.exitCode !== 0)\n              throw new OutpostError(\n                \"provider\",\n                \"Transfer permissions could not be set\",\n              );\n          },\n          signal,\n        );\n      });\n    },\n    async download(source, destination, options = {}) {\n      return transfer(options, async (signal) => {\n        const listing = await sandbox.runCommand(\"node\", [\n          \"-e\",\n          manifestScript,\n          source,\n        ]);\n        if (listing.exitCode !== 0)\n          throw new OutpostError(\n            \"provider\",\n            \"Remote transfer source is unavailable\",\n          );\n        await downloadTree(\n          source,\n          destination,\n          await listing.stdout(),\n          async (path) => {\n            const stream = await sandbox.readFile({ path });\n            if (!stream)\n              throw new OutpostError(\n                \"provider\",\n                `Remote file is missing: ${path}`,\n              );\n            const chunks: Buffer[] = [];\n            for await (const chunk of stream)\n              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n            return Buffer.concat(chunks);\n          },\n          signal,\n        );\n      });\n    },\n  };\n}\n"]}
+{"version":3,"file":"vercel-files.js","sourceRoot":"","sources":["../../src/providers/vercel-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,UAAU,WAAW,CACzB,OAAiC;IAEjC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YAC5C,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,UAAU,CACd,MAAM,EACN,WAAW,EACX,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAC1D,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;oBACrB,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;oBACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE;wBAC5C,IAAI;wBACJ,IAAI;wBACJ,MAAM;wBACN,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;wBACvB,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;gBAChE,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;oBAC9B,IAAI,SAAS;wBAAE,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE;wBAC/C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAChB,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;wBACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,uCAAuC,CACxC,CAAC;gBACN,CAAC,EACD,MAAM,CACP,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YAC9C,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE;oBAC/C,IAAI;oBACJ,cAAc;oBACd,MAAM;iBACP,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;oBACxB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,uCAAuC,CACxC,CAAC;gBACJ,MAAM,YAAY,CAChB,MAAM,EACN,WAAW,EACX,MAAM,OAAO,CAAC,MAAM,EAAE,EACtB,KAAK,EAAE,IAAI,EAAE,EAAE;oBACb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChD,IAAI,CAAC,MAAM;wBACT,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,2BAA2B,IAAI,EAAE,CAClC,CAAC;oBACJ,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM;wBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACnE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC,EACD,MAAM,CACP,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { posix } from \"node:path\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport { transfer } from \"../infrastructure/transfer.ts\";\nimport { manifestScript } from \"./cloud-files.constants.ts\";\nimport { downloadTree, uploadTree } from \"./cloud-files.ts\";\nimport { vercelDirectory } from \"./vercel-directory.ts\";\nimport type { VercelRuntime } from \"./vercel.types.ts\";\n\nexport function vercelFiles(\n  sandbox: VercelRuntime[\"sandbox\"],\n): Pick<SandboxLease, \"upload\" | \"download\"> {\n  return {\n    async upload(source, destination, options = {}) {\n      return transfer(options, async (signal) => {\n        await uploadTree(\n          source,\n          destination,\n          (path, content) => sandbox.writeFiles([{ path, content }]),\n          async (target, path) => {\n            await vercelDirectory(sandbox, posix.dirname(path));\n            const result = await sandbox.runCommand(\"ln\", [\n              \"-s\",\n              \"--\",\n              target,\n              path,\n            ]);\n            if (result.exitCode !== 0)\n              throw new OutpostError(\"provider\", \"Symlink upload failed\");\n          },\n          async (path, directory, mode) => {\n            if (directory) await vercelDirectory(sandbox, path);\n            const result = await sandbox.runCommand(\"chmod\", [\n              mode.toString(8),\n              path,\n            ]);\n            if (result.exitCode !== 0)\n              throw new OutpostError(\n                \"provider\",\n                \"Transfer permissions could not be set\",\n              );\n          },\n          signal,\n        );\n      });\n    },\n    async download(source, destination, options = {}) {\n      return transfer(options, async (signal) => {\n        const listing = await sandbox.runCommand(\"node\", [\n          \"-e\",\n          manifestScript,\n          source,\n        ]);\n        if (listing.exitCode !== 0)\n          throw new OutpostError(\n            \"provider\",\n            \"Remote transfer source is unavailable\",\n          );\n        await downloadTree(\n          source,\n          destination,\n          await listing.stdout(),\n          async (path) => {\n            const stream = await sandbox.readFile({ path });\n            if (!stream)\n              throw new OutpostError(\n                \"provider\",\n                `Remote file is missing: ${path}`,\n              );\n            const chunks: Buffer[] = [];\n            for await (const chunk of stream)\n              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n            return Buffer.concat(chunks);\n          },\n          signal,\n        );\n      });\n    },\n  };\n}\n"]}

package/dist/providers/vercel-network.d.ts

@@ -0,0 +1,2 @@
+import type { VercelOptions } from "./vercel.types.ts";
+export declare function vercelNetworkPolicy(options: VercelOptions): NonNullable<VercelOptions["create"]>["networkPolicy"];

package/dist/providers/vercel-network.js

@@ -0,0 +1,18 @@
+import { validateEgress } from "../domain/egress.js";
+import { invariant } from "../domain/errors.js";
+export function vercelNetworkPolicy(options) {
+    const policy = validateEgress(options.egress);
+    if (!policy)
+        return options.create?.networkPolicy;
+    invariant(options.create?.networkPolicy === undefined, "Use egress or create.networkPolicy, not both");
+    if (policy.mode === "deny-all")
+        return "deny-all";
+    return {
+        allow: [...(policy.domains ?? [])],
+        subnets: {
+            allow: [...(policy.allowCidrs ?? [])],
+            deny: [...(policy.denyCidrs ?? [])],
+        },
+    };
+}
+//# sourceMappingURL=vercel-network.js.map

package/dist/providers/vercel-network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-network.js","sourceRoot":"","sources":["../../src/providers/vercel-network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,MAAM,UAAU,mBAAmB,CACjC,OAAsB;IAEtB,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC;IAClD,SAAS,CACP,OAAO,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS,EAC3C,8CAA8C,CAC/C,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE;YACP,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;SACpC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { validateEgress } from \"../domain/egress.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport function vercelNetworkPolicy(\n  options: VercelOptions,\n): NonNullable<VercelOptions[\"create\"]>[\"networkPolicy\"] {\n  const policy = validateEgress(options.egress);\n  if (!policy) return options.create?.networkPolicy;\n  invariant(\n    options.create?.networkPolicy === undefined,\n    \"Use egress or create.networkPolicy, not both\",\n  );\n  if (policy.mode === \"deny-all\") return \"deny-all\";\n  return {\n    allow: [...(policy.domains ?? [])],\n    subnets: {\n      allow: [...(policy.allowCidrs ?? [])],\n      deny: [...(policy.denyCidrs ?? [])],\n    },\n  };\n}\n"]}

package/dist/providers/vercel.d.ts

@@ -3,3 +3,4 @@ import type { SandboxProvider } from "../domain/sandbox.types.ts";
 import type { VercelOptions } from "./vercel.types.ts";
 export type { VercelOptions } from "./vercel.types.ts";
 export declare function vercel(options?: VercelOptions, connect?: (config: VercelOptions["create"]) => Promise<Sandbox>): SandboxProvider;
+export type { EgressPolicy } from "../domain/egress.types.ts";

package/dist/providers/vercel.js

@@ -3,8 +3,11 @@ import { fileBatches } from "./file-batches.js";
 import { registerCleanup } from "../infrastructure/shutdown.js";
 import { cloudRoots } from "./cloud.constants.js";
 import { vercelCommand } from "./vercel-command.js";
+import { vercelNetworkPolicy } from "./vercel-network.js";
+import { vercelDirectory } from "./vercel-directory.js";
 import { vercelFiles } from "./vercel-files.js";
 export function vercel(options = {}, connect = async (config) => (await import("@vercel/sandbox")).Sandbox.create(config)) {
+    const networkPolicy = vercelNetworkPolicy(options);
     return {
         name: "vercel",
         placement: "remote",
@@ -13,6 +16,7 @@ export function vercel(options = {}, connect = async (config) => (await import("
             context.signal?.throwIfAborted();
             const sandbox = await connect({
                 ...options.create,
+                ...(networkPolicy === undefined ? {} : { networkPolicy }),
                 env: { ...options.create?.env, ...context.variables },
             });
             const root = options.root ?? cloudRoots.vercel;
@@ -32,7 +36,7 @@ export function vercel(options = {}, connect = async (config) => (await import("
             unregister = registerCleanup(release);
             let home;
             try {
-                await sandbox.mkDir(root);
+                await vercelDirectory(sandbox, root);
                 home = (await (await sandbox.runCommand("printenv", ["HOME"])).stdout()).trim();
                 if (!home.startsWith("/"))
                     throw new OutpostError("provider", "Cloud sandbox returned an invalid home directory");

package/dist/providers/vercel.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/providers/vercel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKhD,MAAM,UAAU,MAAM,CACpB,UAAyB,EAAE,EAC3B,UAAiE,KAAK,EACpE,MAAM,EACN,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IAE7D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,GAAG,OAAO,CAAC,MAAM;gBACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC;YAC/C,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,SAAoC,CAAC;YACzC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,OAAO;iBACnB,IAAI,EAAE;iBACN,IAAI,CAAC,GAAG,EAAE;gBACT,MAAM,GAAG,IAAI,CAAC;gBACd,UAAU,EAAE,CAAC;YACf,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACR,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1B,IAAI,GAAG,CACL,MAAM,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAChE,CAAC,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,kDAAkD,CACnD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG;gBACZ,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,aAAa,CAAC;oBACpB,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,OAAO;oBACP,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,WAAW,CAAC,OAAO,CAAC;gBACvB,OAAO;aACR,CAAC;YACF,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Sandbox } from \"@vercel/sandbox\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { fileBatches } from \"./file-batches.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cloudRoots } from \"./cloud.constants.ts\";\nimport { vercelCommand } from \"./vercel-command.ts\";\nimport { vercelFiles } from \"./vercel-files.ts\";\nimport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport function vercel(\n  options: VercelOptions = {},\n  connect: (config: VercelOptions[\"create\"]) => Promise<Sandbox> = async (\n    config,\n  ) => (await import(\"@vercel/sandbox\")).Sandbox.create(config),\n): SandboxProvider {\n  return {\n    name: \"vercel\",\n    placement: \"remote\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const sandbox = await connect({\n        ...options.create,\n        env: { ...options.create?.env, ...context.variables },\n      });\n      const root = options.root ?? cloudRoots.vercel;\n      let closed = false;\n      let releasing: Promise<void> | undefined;\n      let unregister = () => {};\n      const release = () =>\n        (releasing ??= sandbox\n          .stop()\n          .then(() => {\n            closed = true;\n            unregister();\n          })\n          .catch((error) => {\n            releasing = undefined;\n            throw error;\n          }));\n      unregister = registerCleanup(release);\n      let home: string;\n      try {\n        await sandbox.mkDir(root);\n        home = (\n          await (await sandbox.runCommand(\"printenv\", [\"HOME\"])).stdout()\n        ).trim();\n        if (!home.startsWith(\"/\"))\n          throw new OutpostError(\n            \"provider\",\n            \"Cloud sandbox returned an invalid home directory\",\n          );\n      } catch (cause) {\n        await release();\n        throw cause;\n      }\n      const lease = {\n        root,\n        home,\n        invoke: vercelCommand({\n          sandbox,\n          root,\n          options,\n          context,\n          isClosed: () => closed,\n        }),\n        ...vercelFiles(sandbox),\n        release,\n      };\n      return { ...lease, fileTransfers: fileBatches(lease) };\n    },\n  };\n}\n"]}
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/providers/vercel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKhD,MAAM,UAAU,MAAM,CACpB,UAAyB,EAAE,EAC3B,UAAiE,KAAK,EACpE,MAAM,EACN,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IAE7D,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,GAAG,OAAO,CAAC,MAAM;gBACjB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC;YAC/C,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,SAAoC,CAAC;YACzC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,OAAO;iBACnB,IAAI,EAAE;iBACN,IAAI,CAAC,GAAG,EAAE;gBACT,MAAM,GAAG,IAAI,CAAC;gBACd,UAAU,EAAE,CAAC;YACf,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACR,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACrC,IAAI,GAAG,CACL,MAAM,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAChE,CAAC,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,kDAAkD,CACnD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG;gBACZ,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,aAAa,CAAC;oBACpB,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,OAAO;oBACP,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,WAAW,CAAC,OAAO,CAAC;gBACvB,OAAO;aACR,CAAC;YACF,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Sandbox } from \"@vercel/sandbox\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { fileBatches } from \"./file-batches.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cloudRoots } from \"./cloud.constants.ts\";\nimport { vercelCommand } from \"./vercel-command.ts\";\nimport { vercelNetworkPolicy } from \"./vercel-network.ts\";\nimport { vercelDirectory } from \"./vercel-directory.ts\";\nimport { vercelFiles } from \"./vercel-files.ts\";\nimport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport function vercel(\n  options: VercelOptions = {},\n  connect: (config: VercelOptions[\"create\"]) => Promise<Sandbox> = async (\n    config,\n  ) => (await import(\"@vercel/sandbox\")).Sandbox.create(config),\n): SandboxProvider {\n  const networkPolicy = vercelNetworkPolicy(options);\n  return {\n    name: \"vercel\",\n    placement: \"remote\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const sandbox = await connect({\n        ...options.create,\n        ...(networkPolicy === undefined ? {} : { networkPolicy }),\n        env: { ...options.create?.env, ...context.variables },\n      });\n      const root = options.root ?? cloudRoots.vercel;\n      let closed = false;\n      let releasing: Promise<void> | undefined;\n      let unregister = () => {};\n      const release = () =>\n        (releasing ??= sandbox\n          .stop()\n          .then(() => {\n            closed = true;\n            unregister();\n          })\n          .catch((error) => {\n            releasing = undefined;\n            throw error;\n          }));\n      unregister = registerCleanup(release);\n      let home: string;\n      try {\n        await vercelDirectory(sandbox, root);\n        home = (\n          await (await sandbox.runCommand(\"printenv\", [\"HOME\"])).stdout()\n        ).trim();\n        if (!home.startsWith(\"/\"))\n          throw new OutpostError(\n            \"provider\",\n            \"Cloud sandbox returned an invalid home directory\",\n          );\n      } catch (cause) {\n        await release();\n        throw cause;\n      }\n      const lease = {\n        root,\n        home,\n        invoke: vercelCommand({\n          sandbox,\n          root,\n          options,\n          context,\n          isClosed: () => closed,\n        }),\n        ...vercelFiles(sandbox),\n        release,\n      };\n      return { ...lease, fileTransfers: fileBatches(lease) };\n    },\n  };\n}\n\nexport type { EgressPolicy } from \"../domain/egress.types.ts\";\n"]}

package/dist/providers/vercel.types.d.ts

@@ -1,7 +1,9 @@
+import type { EgressPolicy } from "../domain/egress.types.ts";
 import type { Sandbox, Sandbox as VercelSandbox } from "@vercel/sandbox";
 import type { Variables } from "../domain/command.types.ts";
 import type { SandboxContext } from "../domain/sandbox.types.ts";
 export interface VercelOptions {
+    readonly egress?: EgressPolicy;
     readonly create?: NonNullable<Parameters<typeof Sandbox.create>[0]>;
     readonly variables?: Variables;
     readonly root?: string;

package/dist/providers/vercel.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.types.js","sourceRoot":"","sources":["../../src/providers/vercel.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Sandbox, Sandbox as VercelSandbox } from \"@vercel/sandbox\";\nimport type { Variables } from \"../domain/command.types.ts\";\nimport type { SandboxContext } from \"../domain/sandbox.types.ts\";\n\nexport interface VercelOptions {\n  readonly create?: NonNullable<Parameters<typeof Sandbox.create>[0]>;\n  readonly variables?: Variables;\n  readonly root?: string;\n  readonly retain?: number;\n}\n\nexport interface VercelRuntime {\n  readonly sandbox: VercelSandbox;\n  readonly root: string;\n  readonly options: VercelOptions;\n  readonly context: SandboxContext;\n  readonly isClosed: () => boolean;\n}\n"]}
+{"version":3,"file":"vercel.types.js","sourceRoot":"","sources":["../../src/providers/vercel.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { EgressPolicy } from \"../domain/egress.types.ts\";\nimport type { Sandbox, Sandbox as VercelSandbox } from \"@vercel/sandbox\";\nimport type { Variables } from \"../domain/command.types.ts\";\nimport type { SandboxContext } from \"../domain/sandbox.types.ts\";\n\nexport interface VercelOptions {\n  readonly egress?: EgressPolicy;\n  readonly create?: NonNullable<Parameters<typeof Sandbox.create>[0]>;\n  readonly variables?: Variables;\n  readonly root?: string;\n  readonly retain?: number;\n}\n\nexport interface VercelRuntime {\n  readonly sandbox: VercelSandbox;\n  readonly root: string;\n  readonly options: VercelOptions;\n  readonly context: SandboxContext;\n  readonly isClosed: () => boolean;\n}\n"]}

package/dist/providers/versions.constants.d.ts

@@ -1,4 +1,5 @@
 export declare const agentVersions: Readonly<{
+    gemini: "0.61.0";
     codex: "0.156.1";
     claude: "2.1.280";
 }>;

package/dist/providers/versions.constants.js

@@ -1,4 +1,5 @@
 export const agentVersions = Object.freeze({
+    gemini: "0.61.0",
     codex: "0.156.1",
     claude: "2.1.280",
 });

package/dist/providers/versions.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"versions.constants.js","sourceRoot":"","sources":["../../src/providers/versions.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC","sourcesContent":["export const agentVersions = Object.freeze({\n  codex: \"0.156.1\",\n  claude: \"2.1.280\",\n});\n"]}
+{"version":3,"file":"versions.constants.js","sourceRoot":"","sources":["../../src/providers/versions.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC","sourcesContent":["export const agentVersions = Object.freeze({\n  gemini: \"0.61.0\",\n  codex: \"0.156.1\",\n  claude: \"2.1.280\",\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elie-laloum/outpost",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Programmable sandboxes, coding agents and typed workflows.",
   "type": "module",
   "license": "MIT",
@@ -39,6 +39,10 @@
     "./opentelemetry": {
       "types": "./dist/infrastructure/opentelemetry.d.ts",
       "import": "./dist/infrastructure/opentelemetry.js"
+    },
+    "./providers/firecracker": {
+      "types": "./dist/providers/firecracker.d.ts",
+      "import": "./dist/providers/firecracker.js"
     }
   },
   "files": [