npm - @elie-laloum/outpost - Versions diffs - 5.0.0 → 7.0.0 - Mend

@elie-laloum/outpost 5.0.0 → 7.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (647) hide show

package/dist/providers/antigravity-install.types.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+export interface AntigravityRelease {
+    readonly url: string;
+    readonly sha512: string;
+}

package/dist/providers/antigravity-install.types.js ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=antigravity-install.types.js.map

package/dist/providers/antigravity-install.types.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"antigravity-install.types.js","sourceRoot":"","sources":["../../src/providers/antigravity-install.types.ts"],"names":[],"mappings":"","sourcesContent":["export interface AntigravityRelease {\n readonly url: string;\n readonly sha512: string;\n}\n"]}

package/dist/providers/container-recovery.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+import type { TransferOptions } from "../domain/sandbox.types.ts";
+import type { Executor } from "../infrastructure/process.types.ts";
+import type { ContainerEngine } from "./container.types.ts";
+export declare function recoverContainer(engine: ContainerEngine, executor: Executor, resourceId: string, options?: TransferOptions): Promise<void>;

package/dist/providers/container-recovery.js ADDED Viewed

@@ -0,0 +1,28 @@
+import { invariant } from "../domain/errors.js";
+import { requireSuccess } from "../infrastructure/process.js";
+import { containerDefaults } from "./container.constants.js";
+export async function recoverContainer(engine, executor, resourceId, options = {}) {
+    invariant(/^outpost-[a-f0-9-]{36}$/.test(resourceId), "Invalid recoverable container identity");
+    const limits = {
+        deadlineMs: options.deadlineMs ?? containerDefaults.cleanupMs,
+        ...(options.signal ? { signal: options.signal } : {}),
+    };
+    const result = await requireSuccess({
+        executable: engine,
+        arguments: [
+            "container",
+            "ls",
+            "--all",
+            "--filter",
+            `name=^${resourceId}$`,
+            "--format",
+            "{{.Names}}",
+        ],
+        ...limits,
+    }, executor);
+    if (!result.stdout.trim())
+        return;
+    invariant(result.stdout.trim() === resourceId, "Recoverable container identity mismatch");
+    await requireSuccess({ executable: engine, arguments: ["rm", "--force", resourceId], ...limits }, executor);
+}
+//# sourceMappingURL=container-recovery.js.map

package/dist/providers/container-recovery.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"container-recovery.js","sourceRoot":"","sources":["../../src/providers/container-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAuB,EACvB,QAAkB,EAClB,UAAkB,EAClB,UAA2B,EAAE;IAE7B,SAAS,CACP,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,EAC1C,wCAAwC,CACzC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,SAAS;QAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC;QACE,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE;YACT,WAAW;YACX,IAAI;YACJ,OAAO;YACP,UAAU;YACV,SAAS,UAAU,GAAG;YACtB,UAAU;YACV,YAAY;SACb;QACD,GAAG,MAAM;KACV,EACD,QAAQ,CACT,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO;IAClC,SAAS,CACP,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,UAAU,EACnC,yCAAyC,CAC1C,CAAC;IACF,MAAM,cAAc,CAClB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,EAC3E,QAAQ,CACT,CAAC;AACJ,CAAC","sourcesContent":["import { invariant } from \"../domain/errors.ts\";\nimport type { TransferOptions } from \"../domain/sandbox.types.ts\";\nimport { requireSuccess } from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { containerDefaults } from \"./container.constants.ts\";\nimport type { ContainerEngine } from \"./container.types.ts\";\n\nexport async function recoverContainer(\n engine: ContainerEngine,\n executor: Executor,\n resourceId: string,\n options: TransferOptions = {},\n): Promise<void> {\n invariant(\n /^outpost-[a-f0-9-]{36}$/.test(resourceId),\n \"Invalid recoverable container identity\",\n );\n const limits = {\n deadlineMs: options.deadlineMs ?? containerDefaults.cleanupMs,\n ...(options.signal ? { signal: options.signal } : {}),\n };\n const result = await requireSuccess(\n {\n executable: engine,\n arguments: [\n \"container\",\n \"ls\",\n \"--all\",\n \"--filter\",\n `name=^${resourceId}$`,\n \"--format\",\n \"{{.Names}}\",\n ],\n ...limits,\n },\n executor,\n );\n if (!result.stdout.trim()) return;\n invariant(\n result.stdout.trim() === resourceId,\n \"Recoverable container identity mismatch\",\n );\n await requireSuccess(\n { executable: engine, arguments: [\"rm\", \"--force\", resourceId], ...limits },\n executor,\n );\n}\n"]}

package/dist/providers/container.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { recoverContainer } from "./container-recovery.js";
 import { execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { basename } from "node:path";
@@ -37,6 +38,11 @@ export function containerProvider(engine, options = {}, executor = executeProces
         name: engine,
         placement: config.repositoryMode === "isolated" ? "remote" : "mounted",
         variables: { ...config.variables },
+        ...(config.repositoryMode !== "isolated"
+            ? {
+                recover: (resourceId, recoveryOptions) => recoverContainer(engine, executor, resourceId, recoveryOptions),
+            }
+            : {}),
         async acquire(context) {
             context.signal?.throwIfAborted();
             const name = `outpost-${randomUUID()}`;
@@ -97,6 +103,8 @@ export function containerProvider(engine, options = {}, executor = executeProces
                         `${cacheDefaults.label}=true`,
                         cache.volume,
                     ], context.signal ? { signal: context.signal } : {});
+                await context.registerRecovery?.(name);
+                context.signal?.throwIfAborted();
                 await call(args, {
                     ...(context.signal ? { signal: context.signal } : {}),
                 });

package/dist/providers/container.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/providers/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,KAAK,EACL,cAAc,GACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAK7D,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,OAAO,WACL,QAAQ,CAAC,UAAU,CAAC;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,WACtC,EAAE,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,UAA4B,EAAE,EAC9B,WAAqB,cAAc,EACnC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KAC9D,CAAC;IACF,SAAS,CACP,MAAM,CAAC,cAAc,KAAK,SAAS;QACjC,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,cAAc,KAAK,UAAU,EACtC,4CAA4C,CAC7C,CAAC;IACF,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,SAAS,CACP,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAC/C,uBAAuB,CACxB,CAAC;IACJ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;YACnC,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC,eAAe,EACtD,8BAA8B,CAC/B,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACtE,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE;QAClC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI;gBAC1B,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;gBAChD,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;aACjD,CAAC;YACF,SAAS,CACP,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxB,IAAI,CAAC,GAAG,IAAI,CAAC;gBACb,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,EACf,wBAAwB,CACzB,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,QAA0B,EAAE,EAAE,EAAE,CACrE,cAAc,CACZ;gBACE,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,iBAAiB,CAAC,UAAU;gBACxC,GAAG,KAAK;aACT,EACD,QAAQ,CACT,CAAC;YACJ,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,IAAI,GACN,MAAM,CAAC,cAAc,KAAK,UAAU;gBAClC,CAAC,CAAC,iBAAiB,CAAC,YAAY;gBAChC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAC5B,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CACzD,OAAO,EACP,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,IAAI,CACL,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,CAAC,MAAM,IAAI,EAAE,EACnB,OAAO,CAAC,UAAU,EAClB,KAAK,EACL,IAAI,CACL,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,MAAM;gBACxB,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,IAAI;gBACJ,KAAK;gBACL,OAAO;gBACP,WAAW;aACZ,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,KAAK,EAChB,SAAoC,CAAC;YACvC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAkB,EAAE;gBAClC,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;qBACxC,IAAI,CAAC,GAAG,EAAE;oBACT,UAAU,EAAE,CAAC;gBACf,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,SAAS,GAAG,SAAS,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;gBACL,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,MAAM;oBACxB,MAAM,IAAI,CACR;wBACE,QAAQ;wBACR,QAAQ;wBACR,GAAG,kBAAkB,CAAC,MAAM,CAAC;wBAC7B,SAAS;wBACT,GAAG,aAAa,CAAC,KAAK,OAAO;wBAC7B,KAAK,CAAC,MAAM;qBACb,EACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACJ,MAAM,IAAI,CAAC,IAAI,EAAE;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC,CAAC;gBACH,MAAM,IAAI,CACR,CAAC,OAAO,EAAE,IAAI,CAAC,EACf,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,IAAI,CACR;wBACE,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,OAAO;wBACP,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;wBACzB,KAAK,CAAC,MAAM;qBACb,EACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;oBACF,MAAM,IAAI,CACR,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAC5C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,MAAM,IAAI,WAAW;oBAC9B,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,YAAY,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;qBAC9E,CAAC,CAAC;gBACL,IAAI,WAAW,CAAC,IAAI;oBAClB,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,OAAO;wBACP,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;wBACzB,IAAI;qBACL,CAAC,CAAC;gBACL,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU;oBACtC,MAAM,IAAI,CACR;wBACE,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,YAAY,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe;qBAChI,EACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACJ,MAAM,IAAI,CAAC;oBACT,MAAM;oBACN,IAAI;oBACJ,IAAI;oBACJ,IAAI;oBACJ,qHAAqH;iBACtH,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE;gBACzC,IAAI,CAAC,MAAM;oBACT,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;wBAC5C,OAAO,EAAE,iBAAiB,CAAC,SAAS;wBACpC,KAAK,EAAE,QAAQ;wBACf,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,gBAAgB,CAAC;oBACvB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,IAAI;oBACJ,GAAG;oBACH,IAAI;oBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,cAAc,CAAC;oBAChB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,IAAI;oBACJ,GAAG;oBACH,IAAI;oBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { basename } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { containerNetworks } from \"./container-network.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport {\n executeProcess,\n quote,\n requireSuccess,\n} from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cacheMounts, validateCaches } from \"./container-cache.ts\";\nimport {\n cacheCreateOptions,\n cacheDefaults,\n} from \"./container-cache.constants.ts\";\nimport { containerCommand } from \"./container-command.ts\";\nimport { containerFiles } from \"./container-files.ts\";\nimport { containerMounts } from \"./container-mounts.ts\";\nimport { containerPlan } from \"./container-plan.ts\";\nimport { containerPreflight } from \"./container-preflight.ts\";\nimport { containerDefaults } from \"./container.constants.ts\";\nimport type { ContainerEngine, ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.types.ts\";\n\nexport function imageName(repository: string): string {\n return `outpost:${\n basename(repository)\n .toLowerCase()\n .replace(/[^a-z0-9_.-]/g, \"-\") \|\| \"workspace\"\n }`;\n}\n\nexport function containerProvider(\n engine: ContainerEngine,\n options: ContainerOptions = {},\n executor: Executor = executeProcess,\n platform: NodeJS.Platform = process.platform,\n): SandboxProvider {\n const config = {\n ...options,\n networks: containerNetworks(options),\n caches: (options.caches ?? []).map((cache) => ({ ...cache })),\n };\n invariant(\n config.repositoryMode === undefined \|\|\n config.repositoryMode === \"mounted\" \|\|\n config.repositoryMode === \"isolated\",\n \"repositoryMode must be mounted or isolated\",\n );\n validateCaches(config);\n if (config.cpus !== undefined)\n invariant(\n Number.isFinite(config.cpus) && config.cpus > 0,\n \"cpus must be positive\",\n );\n if (config.memoryMb !== undefined)\n invariant(\n Number.isSafeInteger(config.memoryMb) &&\n config.memoryMb >= containerDefaults.minimumMemoryMb,\n \"memoryMb must be at least 64\",\n );\n return {\n name: engine,\n placement: config.repositoryMode === \"isolated\" ? \"remote\" : \"mounted\",\n variables: { ...config.variables },\n async acquire(context) {\n context.signal?.throwIfAborted();\n const name = `outpost-${randomUUID()}`;\n const image = config.image ?? imageName(context.repository);\n const user = config.user ?? {\n uid: process.getuid?.() ?? containerDefaults.uid,\n gid: process.getgid?.() ?? containerDefaults.gid,\n };\n invariant(\n Number.isInteger(user.uid) &&\n user.uid >= 0 &&\n Number.isInteger(user.gid) &&\n user.gid >= 0,\n \"Invalid container user\",\n );\n const call = (args: readonly string[], extra: Partial<Command> = {}) =>\n requireSuccess(\n {\n executable: engine,\n arguments: args,\n deadlineMs: containerDefaults.deadlineMs,\n ...extra,\n },\n executor,\n );\n await containerPreflight(engine, platform, call, config, image, user);\n const root =\n config.repositoryMode === \"isolated\"\n ? containerDefaults.isolatedRoot\n : containerDefaults.root,\n home = containerDefaults.home;\n const { env, volumes, fileParents } = await containerMounts(\n context,\n config,\n platform,\n root,\n home,\n );\n const caches = await cacheMounts(\n config.caches ?? [],\n context.repository,\n image,\n user,\n );\n for (const cache of caches)\n volumes.push(\"--volume\", `${cache.volume}:${cache.target}:nocopy`);\n const args = containerPlan({\n config,\n engine,\n user,\n root,\n name,\n image,\n volumes,\n fileParents,\n });\n let closed = false,\n releasing: Promise<void> \| undefined;\n let unregister = () => {};\n const release = (): Promise<void> => {\n closed = true;\n releasing ??= call([\"rm\", \"--force\", name])\n .then(() => {\n unregister();\n })\n .catch((error) => {\n releasing = undefined;\n throw error;\n });\n return releasing;\n };\n try {\n for (const cache of caches)\n await call(\n [\n \"volume\",\n \"create\",\n ...cacheCreateOptions[engine],\n \"--label\",\n `${cacheDefaults.label}=true`,\n cache.volume,\n ],\n context.signal ? { signal: context.signal } : {},\n );\n await call(args, {\n ...(context.signal ? { signal: context.signal } : {}),\n });\n await call(\n [\"start\", name],\n context.signal ? { signal: context.signal } : {},\n );\n for (const cache of caches) {\n await call(\n [\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"chown\",\n `${user.uid}:${user.gid}`,\n cache.target,\n ],\n context.signal ? { signal: context.signal } : {},\n );\n await call(\n [\"exec\", name, \"chmod\", \"700\", cache.target],\n context.signal ? { signal: context.signal } : {},\n );\n }\n for (const parent of fileParents)\n await call([\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"sh\",\n \"-c\",\n `mkdir -p ${quote(parent)} && chown ${user.uid}:${user.gid} ${quote(parent)}`,\n ]);\n if (fileParents.size)\n await call([\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"chown\",\n `${user.uid}:${user.gid}`,\n home,\n ]);\n if (config.repositoryMode === \"isolated\")\n await call(\n [\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"sh\",\n \"-c\",\n `mkdir -p ${quote(root)} && chmod 700 ${quote(root)} /tmp/outpost && chown ${user.uid}:${user.gid} ${quote(root)} /tmp/outpost`,\n ],\n context.signal ? { signal: context.signal } : {},\n );\n await call([\n \"exec\",\n name,\n \"sh\",\n \"-c\",\n \"command -v setsid >/dev/null && command -v kill >/dev/null && command -v tar >/dev/null && command -v cp >/dev/null\",\n ]);\n } catch (cause) {\n try {\n await release();\n } catch (cleanup) {\n throw new AggregateError(\n [cause, cleanup],\n \"Sandbox provisioning and cleanup failed\",\n );\n }\n throw cause;\n }\n unregister = registerCleanup(release, () => {\n if (!closed)\n execFileSync(engine, [\"rm\", \"--force\", name], {\n timeout: containerDefaults.cleanupMs,\n stdio: \"ignore\",\n windowsHide: true,\n });\n });\n return {\n root,\n home,\n invoke: containerCommand({\n engine,\n config,\n executor,\n root,\n name,\n env,\n call,\n isClosed: () => closed,\n }),\n ...containerFiles({\n engine,\n config,\n executor,\n root,\n name,\n env,\n call,\n isClosed: () => closed,\n }),\n release,\n };\n },\n };\n}\n"]}
1	+ {"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/providers/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,KAAK,EACL,cAAc,GACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAK7D,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,OAAO,WACL,QAAQ,CAAC,UAAU,CAAC;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,WACtC,EAAE,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,UAA4B,EAAE,EAC9B,WAAqB,cAAc,EACnC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KAC9D,CAAC;IACF,SAAS,CACP,MAAM,CAAC,cAAc,KAAK,SAAS;QACjC,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,cAAc,KAAK,UAAU,EACtC,4CAA4C,CAC7C,CAAC;IACF,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,SAAS,CACP,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAC/C,uBAAuB,CACxB,CAAC;IACJ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;YACnC,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC,eAAe,EACtD,8BAA8B,CAC/B,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACtE,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE;QAClC,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU;YACtC,CAAC,CAAC;gBACE,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,CACvC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC;aAClE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI;gBAC1B,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;gBAChD,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;aACjD,CAAC;YACF,SAAS,CACP,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxB,IAAI,CAAC,GAAG,IAAI,CAAC;gBACb,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,EACf,wBAAwB,CACzB,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,QAA0B,EAAE,EAAE,EAAE,CACrE,cAAc,CACZ;gBACE,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,iBAAiB,CAAC,UAAU;gBACxC,GAAG,KAAK;aACT,EACD,QAAQ,CACT,CAAC;YACJ,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,IAAI,GACN,MAAM,CAAC,cAAc,KAAK,UAAU;gBAClC,CAAC,CAAC,iBAAiB,CAAC,YAAY;gBAChC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAC5B,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CACzD,OAAO,EACP,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,IAAI,CACL,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,CAAC,MAAM,IAAI,EAAE,EACnB,OAAO,CAAC,UAAU,EAClB,KAAK,EACL,IAAI,CACL,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,MAAM;gBACxB,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,IAAI;gBACJ,KAAK;gBACL,OAAO;gBACP,WAAW;aACZ,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,KAAK,EAChB,SAAoC,CAAC;YACvC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAkB,EAAE;gBAClC,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;qBACxC,IAAI,CAAC,GAAG,EAAE;oBACT,UAAU,EAAE,CAAC;gBACf,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,SAAS,GAAG,SAAS,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;gBACL,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,MAAM;oBACxB,MAAM,IAAI,CACR;wBACE,QAAQ;wBACR,QAAQ;wBACR,GAAG,kBAAkB,CAAC,MAAM,CAAC;wBAC7B,SAAS;wBACT,GAAG,aAAa,CAAC,KAAK,OAAO;wBAC7B,KAAK,CAAC,MAAM;qBACb,EACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACJ,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC;gBACvC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,IAAI,EAAE;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC,CAAC;gBACH,MAAM,IAAI,CACR,CAAC,OAAO,EAAE,IAAI,CAAC,EACf,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,IAAI,CACR;wBACE,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,OAAO;wBACP,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;wBACzB,KAAK,CAAC,MAAM;qBACb,EACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;oBACF,MAAM,IAAI,CACR,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAC5C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,MAAM,IAAI,WAAW;oBAC9B,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,YAAY,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;qBAC9E,CAAC,CAAC;gBACL,IAAI,WAAW,CAAC,IAAI;oBAClB,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,OAAO;wBACP,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;wBACzB,IAAI;qBACL,CAAC,CAAC;gBACL,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU;oBACtC,MAAM,IAAI,CACR;wBACE,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,YAAY,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe;qBAChI,EACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACJ,MAAM,IAAI,CAAC;oBACT,MAAM;oBACN,IAAI;oBACJ,IAAI;oBACJ,IAAI;oBACJ,qHAAqH;iBACtH,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE;gBACzC,IAAI,CAAC,MAAM;oBACT,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;wBAC5C,OAAO,EAAE,iBAAiB,CAAC,SAAS;wBACpC,KAAK,EAAE,QAAQ;wBACf,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,gBAAgB,CAAC;oBACvB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,IAAI;oBACJ,GAAG;oBACH,IAAI;oBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,cAAc,CAAC;oBAChB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,IAAI;oBACJ,GAAG;oBACH,IAAI;oBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { recoverContainer } from \"./container-recovery.ts\";\nimport { execFileSync } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { basename } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { containerNetworks } from \"./container-network.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport {\n executeProcess,\n quote,\n requireSuccess,\n} from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cacheMounts, validateCaches } from \"./container-cache.ts\";\nimport {\n cacheCreateOptions,\n cacheDefaults,\n} from \"./container-cache.constants.ts\";\nimport { containerCommand } from \"./container-command.ts\";\nimport { containerFiles } from \"./container-files.ts\";\nimport { containerMounts } from \"./container-mounts.ts\";\nimport { containerPlan } from \"./container-plan.ts\";\nimport { containerPreflight } from \"./container-preflight.ts\";\nimport { containerDefaults } from \"./container.constants.ts\";\nimport type { ContainerEngine, ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.types.ts\";\n\nexport function imageName(repository: string): string {\n return `outpost:${\n basename(repository)\n .toLowerCase()\n .replace(/[^a-z0-9_.-]/g, \"-\") \|\| \"workspace\"\n }`;\n}\n\nexport function containerProvider(\n engine: ContainerEngine,\n options: ContainerOptions = {},\n executor: Executor = executeProcess,\n platform: NodeJS.Platform = process.platform,\n): SandboxProvider {\n const config = {\n ...options,\n networks: containerNetworks(options),\n caches: (options.caches ?? []).map((cache) => ({ ...cache })),\n };\n invariant(\n config.repositoryMode === undefined \|\|\n config.repositoryMode === \"mounted\" \|\|\n config.repositoryMode === \"isolated\",\n \"repositoryMode must be mounted or isolated\",\n );\n validateCaches(config);\n if (config.cpus !== undefined)\n invariant(\n Number.isFinite(config.cpus) && config.cpus > 0,\n \"cpus must be positive\",\n );\n if (config.memoryMb !== undefined)\n invariant(\n Number.isSafeInteger(config.memoryMb) &&\n config.memoryMb >= containerDefaults.minimumMemoryMb,\n \"memoryMb must be at least 64\",\n );\n return {\n name: engine,\n placement: config.repositoryMode === \"isolated\" ? \"remote\" : \"mounted\",\n variables: { ...config.variables },\n ...(config.repositoryMode !== \"isolated\"\n ? {\n recover: (resourceId, recoveryOptions) =>\n recoverContainer(engine, executor, resourceId, recoveryOptions),\n }\n : {}),\n async acquire(context) {\n context.signal?.throwIfAborted();\n const name = `outpost-${randomUUID()}`;\n const image = config.image ?? imageName(context.repository);\n const user = config.user ?? {\n uid: process.getuid?.() ?? containerDefaults.uid,\n gid: process.getgid?.() ?? containerDefaults.gid,\n };\n invariant(\n Number.isInteger(user.uid) &&\n user.uid >= 0 &&\n Number.isInteger(user.gid) &&\n user.gid >= 0,\n \"Invalid container user\",\n );\n const call = (args: readonly string[], extra: Partial<Command> = {}) =>\n requireSuccess(\n {\n executable: engine,\n arguments: args,\n deadlineMs: containerDefaults.deadlineMs,\n ...extra,\n },\n executor,\n );\n await containerPreflight(engine, platform, call, config, image, user);\n const root =\n config.repositoryMode === \"isolated\"\n ? containerDefaults.isolatedRoot\n : containerDefaults.root,\n home = containerDefaults.home;\n const { env, volumes, fileParents } = await containerMounts(\n context,\n config,\n platform,\n root,\n home,\n );\n const caches = await cacheMounts(\n config.caches ?? [],\n context.repository,\n image,\n user,\n );\n for (const cache of caches)\n volumes.push(\"--volume\", `${cache.volume}:${cache.target}:nocopy`);\n const args = containerPlan({\n config,\n engine,\n user,\n root,\n name,\n image,\n volumes,\n fileParents,\n });\n let closed = false,\n releasing: Promise<void> \| undefined;\n let unregister = () => {};\n const release = (): Promise<void> => {\n closed = true;\n releasing ??= call([\"rm\", \"--force\", name])\n .then(() => {\n unregister();\n })\n .catch((error) => {\n releasing = undefined;\n throw error;\n });\n return releasing;\n };\n try {\n for (const cache of caches)\n await call(\n [\n \"volume\",\n \"create\",\n ...cacheCreateOptions[engine],\n \"--label\",\n `${cacheDefaults.label}=true`,\n cache.volume,\n ],\n context.signal ? { signal: context.signal } : {},\n );\n await context.registerRecovery?.(name);\n context.signal?.throwIfAborted();\n await call(args, {\n ...(context.signal ? { signal: context.signal } : {}),\n });\n await call(\n [\"start\", name],\n context.signal ? { signal: context.signal } : {},\n );\n for (const cache of caches) {\n await call(\n [\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"chown\",\n `${user.uid}:${user.gid}`,\n cache.target,\n ],\n context.signal ? { signal: context.signal } : {},\n );\n await call(\n [\"exec\", name, \"chmod\", \"700\", cache.target],\n context.signal ? { signal: context.signal } : {},\n );\n }\n for (const parent of fileParents)\n await call([\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"sh\",\n \"-c\",\n `mkdir -p ${quote(parent)} && chown ${user.uid}:${user.gid} ${quote(parent)}`,\n ]);\n if (fileParents.size)\n await call([\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"chown\",\n `${user.uid}:${user.gid}`,\n home,\n ]);\n if (config.repositoryMode === \"isolated\")\n await call(\n [\n \"exec\",\n \"--user\",\n \"0:0\",\n name,\n \"sh\",\n \"-c\",\n `mkdir -p ${quote(root)} && chmod 700 ${quote(root)} /tmp/outpost && chown ${user.uid}:${user.gid} ${quote(root)} /tmp/outpost`,\n ],\n context.signal ? { signal: context.signal } : {},\n );\n await call([\n \"exec\",\n name,\n \"sh\",\n \"-c\",\n \"command -v setsid >/dev/null && command -v kill >/dev/null && command -v tar >/dev/null && command -v cp >/dev/null\",\n ]);\n } catch (cause) {\n try {\n await release();\n } catch (cleanup) {\n throw new AggregateError(\n [cause, cleanup],\n \"Sandbox provisioning and cleanup failed\",\n );\n }\n throw cause;\n }\n unregister = registerCleanup(release, () => {\n if (!closed)\n execFileSync(engine, [\"rm\", \"--force\", name], {\n timeout: containerDefaults.cleanupMs,\n stdio: \"ignore\",\n windowsHide: true,\n });\n });\n return {\n root,\n home,\n invoke: containerCommand({\n engine,\n config,\n executor,\n root,\n name,\n env,\n call,\n isClosed: () => closed,\n }),\n ...containerFiles({\n engine,\n config,\n executor,\n root,\n name,\n env,\n call,\n isClosed: () => closed,\n }),\n release,\n };\n },\n };\n}\n"]}

package/dist/providers/daytona-network.constants.d.ts ADDED Viewed

@@ -0,0 +1,5 @@
+export declare const daytonaNetworkFields: readonly ["networkBlockAll", "networkAllowList", "domainAllowList", "outboundProxyUrl"];
+export declare const daytonaNetworkLimits: {
+    readonly domains: 100;
+    readonly cidrs: 10;
+};

package/dist/providers/daytona-network.constants.js ADDED Viewed

@@ -0,0 +1,8 @@
+export const daytonaNetworkFields = [
+    "networkBlockAll",
+    "networkAllowList",
+    "domainAllowList",
+    "outboundProxyUrl",
+];
+export const daytonaNetworkLimits = { domains: 100, cidrs: 10 };
+//# sourceMappingURL=daytona-network.constants.js.map

package/dist/providers/daytona-network.constants.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"daytona-network.constants.js","sourceRoot":"","sources":["../../src/providers/daytona-network.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAW,CAAC","sourcesContent":["export const daytonaNetworkFields = [\n \"networkBlockAll\",\n \"networkAllowList\",\n \"domainAllowList\",\n \"outboundProxyUrl\",\n] as const;\n\nexport const daytonaNetworkLimits = { domains: 100, cidrs: 10 } as const;\n"]}

package/dist/providers/daytona-network.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+import type { Sandbox } from "@daytona/sdk";
+import type { DaytonaOptions } from "./daytona.types.ts";
+export declare function daytonaNetworkPolicy(options: DaytonaOptions): Parameters<Sandbox["updateNetworkSettings"]>[0] | undefined;
+export declare function confirmDaytonaNetworkPolicy(sandbox: Pick<Sandbox, "updateNetworkSettings">, policy: Parameters<Sandbox["updateNetworkSettings"]>[0]): Promise<void>;

package/dist/providers/daytona-network.js ADDED Viewed

@@ -0,0 +1,33 @@
+import { isIP } from "node:net";
+import { validateEgress } from "../domain/egress.js";
+import { invariant, OutpostError } from "../domain/errors.js";
+import { daytonaNetworkFields, daytonaNetworkLimits, } from "./daytona-network.constants.js";
+export function daytonaNetworkPolicy(options) {
+    const policy = validateEgress(options.egress);
+    if (!policy)
+        return undefined;
+    invariant(daytonaNetworkFields.every((field) => options.create?.[field] === undefined), "Use egress or Daytona create network settings, not both");
+    if (policy.mode === "deny-all")
+        return { networkBlockAll: true };
+    const domains = policy.domains ?? [];
+    const cidrs = policy.allowCidrs ?? [];
+    invariant(!policy.denyCidrs?.length, "Daytona cannot enforce egress denyCidrs");
+    invariant(!domains.length || !cidrs.length, "Daytona cannot combine egress domains and allowCidrs");
+    invariant(cidrs.every((entry) => isIP(entry.split("/")[0]) === 4), "Daytona egress allowCidrs supports IPv4 only");
+    invariant(cidrs.length <= daytonaNetworkLimits.cidrs &&
+        domains.length <= daytonaNetworkLimits.domains, "Daytona egress supports at most 10 CIDRs or 100 domains");
+    const names = new Set(domains.map((name) => name.toLowerCase()));
+    invariant(domains.every((name) => !name.startsWith("*.") || names.has(name.slice(2).toLowerCase())), "Daytona wildcard domains also allow the apex; list the apex domain explicitly");
+    if (domains.length)
+        return { domainAllowList: domains.join(",") };
+    return { networkAllowList: cidrs.join(",") };
+}
+export async function confirmDaytonaNetworkPolicy(sandbox, policy) {
+    try {
+        await sandbox.updateNetworkSettings({ ...policy });
+    }
+    catch (cause) {
+        throw new OutpostError("provider", "Daytona could not confirm egress enforcement; sandbox-level network controls require Tier 3/4 and WRITE_SANDBOXES permission", { stage: "egress-confirmation" }, cause);
+    }
+}
+//# sourceMappingURL=daytona-network.js.map

package/dist/providers/daytona-network.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"daytona-network.js","sourceRoot":"","sources":["../../src/providers/daytona-network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AAGxC,MAAM,UAAU,oBAAoB,CAClC,OAAuB;IAEvB,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,SAAS,CACP,oBAAoB,CAAC,KAAK,CACxB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,CACjD,EACD,yDAAyD,CAC1D,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,SAAS,CACP,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EACzB,yCAAyC,CAC1C,CAAC;IACF,SAAS,CACP,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAChC,sDAAsD,CACvD,CAAC;IACF,SAAS,CACP,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,EACxD,8CAA8C,CAC/C,CAAC;IACF,SAAS,CACP,KAAK,CAAC,MAAM,IAAI,oBAAoB,CAAC,KAAK;QACxC,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAChD,yDAAyD,CAC1D,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjE,SAAS,CACP,OAAO,CAAC,KAAK,CACX,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACnE,EACD,+EAA+E,CAChF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA+C,EAC/C,MAAuD;IAEvD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,qBAAqB,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,8HAA8H,EAC9H,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { isIP } from \"node:net\";\nimport type { Sandbox } from \"@daytona/sdk\";\nimport { validateEgress } from \"../domain/egress.ts\";\nimport { invariant, OutpostError } from \"../domain/errors.ts\";\nimport {\n daytonaNetworkFields,\n daytonaNetworkLimits,\n} from \"./daytona-network.constants.ts\";\nimport type { DaytonaOptions } from \"./daytona.types.ts\";\n\nexport function daytonaNetworkPolicy(\n options: DaytonaOptions,\n): Parameters<Sandbox[\"updateNetworkSettings\"]>[0] | undefined {\n const policy = validateEgress(options.egress);\n if (!policy) return undefined;\n invariant(\n daytonaNetworkFields.every(\n (field) => options.create?.[field] === undefined,\n ),\n \"Use egress or Daytona create network settings, not both\",\n );\n if (policy.mode === \"deny-all\") return { networkBlockAll: true };\n const domains = policy.domains ?? [];\n const cidrs = policy.allowCidrs ?? [];\n invariant(\n !policy.denyCidrs?.length,\n \"Daytona cannot enforce egress denyCidrs\",\n );\n invariant(\n !domains.length || !cidrs.length,\n \"Daytona cannot combine egress domains and allowCidrs\",\n );\n invariant(\n cidrs.every((entry) => isIP(entry.split(\"/\")[0]!) === 4),\n \"Daytona egress allowCidrs supports IPv4 only\",\n );\n invariant(\n cidrs.length <= daytonaNetworkLimits.cidrs &&\n domains.length <= daytonaNetworkLimits.domains,\n \"Daytona egress supports at most 10 CIDRs or 100 domains\",\n );\n const names = new Set(domains.map((name) => name.toLowerCase()));\n invariant(\n domains.every(\n (name) =>\n !name.startsWith(\"*.\") || names.has(name.slice(2).toLowerCase()),\n ),\n \"Daytona wildcard domains also allow the apex; list the apex domain explicitly\",\n );\n if (domains.length) return { domainAllowList: domains.join(\",\") };\n return { networkAllowList: cidrs.join(\",\") };\n}\n\nexport async function confirmDaytonaNetworkPolicy(\n sandbox: Pick<Sandbox, \"updateNetworkSettings\">,\n policy: Parameters<Sandbox[\"updateNetworkSettings\"]>[0],\n): Promise<void> {\n try {\n await sandbox.updateNetworkSettings({ ...policy });\n } catch (cause) {\n throw new OutpostError(\n \"provider\",\n \"Daytona could not confirm egress enforcement; sandbox-level network controls require Tier 3/4 and WRITE_SANDBOXES permission\",\n { stage: \"egress-confirmation\" },\n cause,\n );\n }\n}\n"]}

package/dist/providers/daytona.d.ts CHANGED Viewed

@@ -3,3 +3,4 @@ import type { SandboxProvider } from "../domain/sandbox.types.ts";
 import type { DaytonaOptions } from "./daytona.types.ts";
 export type { DaytonaOptions } from "./daytona.types.ts";
 export declare function daytonaSandboxProvider(options?: DaytonaOptions, connect?: (config?: DaytonaConfig) => Promise<Pick<Daytona, "create" | "delete">>): SandboxProvider;
+export type { EgressPolicy } from "../domain/egress.types.ts";

package/dist/providers/daytona.js CHANGED Viewed

@@ -1,12 +1,13 @@
-import { invariant } from "../domain/errors.js";
 import { posix } from "node:path";
 import { fileBatches } from "./file-batches.js";
 import { registerCleanup } from "../infrastructure/shutdown.js";
 import { cloudRoots } from "./cloud.constants.js";
+import { daytonaNetworkPolicy, confirmDaytonaNetworkPolicy, } from "./daytona-network.js";
 import { daytonaCommand } from "./daytona-command.js";
 import { daytonaFiles } from "./daytona-files.js";
 export function daytonaSandboxProvider(options = {}, connect = async (config) => new (await import("@daytona/sdk")).Daytona(config)) {
-    invariant(!("egress" in options) || options.egress === undefined, "Daytona does not support Outpost egress policies; configure provider-native networking explicitly");
+    const networkPolicy = daytonaNetworkPolicy(options);
+    const create = { ...options.create, ...networkPolicy };
     return {
         name: "daytona",
         placement: "remote",
@@ -14,7 +15,7 @@ export function daytonaSandboxProvider(options = {}, connect = async (config) =>
         async acquire(context) {
             context.signal?.throwIfAborted();
             const client = await connect(options.connection);
-            const sandbox = await client.create(options.create ?? {});
+            const sandbox = await client.create({ ...create });
             let closed = false, releasing;
             let unregister = () => { };
             const release = () => (releasing ??= client
@@ -31,6 +32,11 @@ export function daytonaSandboxProvider(options = {}, connect = async (config) =>
             let home;
             let root;
             try {
+                context.signal?.throwIfAborted();
+                if (networkPolicy) {
+                    await confirmDaytonaNetworkPolicy(sandbox, networkPolicy);
+                    context.signal?.throwIfAborted();
+                }
                 home = (await sandbox.getUserHomeDir()) ?? cloudRoots.daytonaHome;
                 root = options.root ?? posix.join(home, "outpost");
                 await sandbox.fs.createFolder(root, "755");

package/dist/providers/daytona.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"daytona.js","sourceRoot":"","sources":["../../src/providers/daytona.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,~~SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,~~KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKlD,MAAM,UAAU,sBAAsB,CACpC,UAA0B,EAAE,EAC5B,UAEmD,KAAK,EAAE,MAAM,EAAE,EAAE,CAClE,IAAI,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpD,~~SAAS~~,~~CACP~~,CAAC,CAAC,~~QAAQ~~,~~IAAI~~,~~OAAO~~,~~CAAC~~,~~IAAI~~,OAAO,CAAC,MAAM,~~KAAK~~,~~SAAS~~,~~EACtD~~,~~mGAAmG~~,~~CACpG,~~CAAC;~~IACF~~,OAAO;QACL,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,~~OAAO~~,~~CAAC~~,MAAM,~~IAAI,~~EAAE,CAAC,CAAC;~~YAC1D~~,IAAI,MAAM,GAAG,KAAK,EAChB,SAAoC,CAAC;YACvC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,MAAM;iBAClB,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,GAAG,EAAE;gBACT,MAAM,GAAG,IAAI,CAAC;gBACd,UAAU,EAAE,CAAC;YACf,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACR,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAY,CAAC;YACjB,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC;gBAClE,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACnD,MAAM,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,gCAAgC,CACjC,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG;gBACZ,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,cAAc,CAAC;oBACrB,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,OAAO;oBACP,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,YAAY,CAAC,OAAO,CAAC;gBACxB,OAAO;aACR,CAAC;YACF,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Daytona, DaytonaConfig } from \"@daytona/sdk\";\nimport { ~~invariant } from \"../domain/errors.ts\";\nimport {~~ posix } from \"node:path\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { fileBatches } from \"./file-batches.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cloudRoots } from \"./cloud.constants.ts\";\nimport { daytonaCommand } from \"./daytona-command.ts\";\nimport { daytonaFiles } from \"./daytona-files.ts\";\nimport type { DaytonaOptions } from \"./daytona.types.ts\";\n\nexport type { DaytonaOptions } from \"./daytona.types.ts\";\n\nexport function daytonaSandboxProvider(\n options: DaytonaOptions = {},\n connect: (\n config?: DaytonaConfig,\n ) => Promise<Pick<Daytona, \"create\" \| \"delete\">> = async (config) =>\n new (await import(\"@daytona/sdk\")).Daytona(config),\n): SandboxProvider {\n ~~invariant(\n !(\"egress\"~~ in options) ~~\|\| options.egress === undefined,\~~n ~~\"Daytona~~ ~~does~~ ~~not~~ ~~support~~ ~~Outpost~~ ~~egress~~ ~~policies; configure provider-native networking explicitly\",\n )~~;\n return {\n name: \"daytona\",\n placement: \"remote\",\n variables: { ...options.variables },\n async acquire(context) {\n context.signal?.throwIfAborted();\n const client = await connect(options.connection);\n const sandbox = await client.create(~~options.~~create ~~?? {~~});\n let closed = false,\n releasing: Promise<void> \| undefined;\n let unregister = () => {};\n const release = () =>\n (releasing ??= client\n .delete(sandbox)\n .then(() => {\n closed = true;\n unregister();\n })\n .catch((error) => {\n releasing = undefined;\n throw error;\n }));\n unregister = registerCleanup(release);\n let home: string;\n let root: string;\n try {\n home = (await sandbox.getUserHomeDir()) ?? cloudRoots.daytonaHome;\n root = options.root ?? posix.join(home, \"outpost\");\n await sandbox.fs.createFolder(root, \"755\");\n } catch (cause) {\n try {\n await release();\n } catch (cleanup) {\n throw new AggregateError(\n [cause, cleanup],\n \"Cloud setup and cleanup failed\",\n );\n }\n throw cause;\n }\n const lease = {\n root,\n home,\n invoke: daytonaCommand({\n sandbox,\n root,\n options,\n context,\n isClosed: () => closed,\n }),\n ...daytonaFiles(sandbox),\n release,\n };\n return { ...lease, fileTransfers: fileBatches(lease) };\n },\n };\n}\n"]}
1	+ {"version":3,"file":"daytona.js","sourceRoot":"","sources":["../../src/providers/daytona.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKlD,MAAM,UAAU,sBAAsB,CACpC,UAA0B,EAAE,EAC5B,UAEmD,KAAK,EAAE,MAAM,EAAE,EAAE,CAClE,IAAI,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpD,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;IACvD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,GAAG,KAAK,EAChB,SAAoC,CAAC;YACvC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,MAAM;iBAClB,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,GAAG,EAAE;gBACT,MAAM,GAAG,IAAI,CAAC;gBACd,UAAU,EAAE,CAAC;YACf,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACR,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAY,CAAC;YACjB,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjC,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,2BAA2B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBAC1D,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBACnC,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC;gBAClE,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACnD,MAAM,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,gCAAgC,CACjC,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG;gBACZ,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,cAAc,CAAC;oBACrB,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,OAAO;oBACP,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,YAAY,CAAC,OAAO,CAAC;gBACxB,OAAO;aACR,CAAC;YACF,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Daytona, DaytonaConfig } from \"@daytona/sdk\";\nimport { posix } from \"node:path\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { fileBatches } from \"./file-batches.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cloudRoots } from \"./cloud.constants.ts\";\nimport {\n daytonaNetworkPolicy,\n confirmDaytonaNetworkPolicy,\n} from \"./daytona-network.ts\";\nimport { daytonaCommand } from \"./daytona-command.ts\";\nimport { daytonaFiles } from \"./daytona-files.ts\";\nimport type { DaytonaOptions } from \"./daytona.types.ts\";\n\nexport type { DaytonaOptions } from \"./daytona.types.ts\";\n\nexport function daytonaSandboxProvider(\n options: DaytonaOptions = {},\n connect: (\n config?: DaytonaConfig,\n ) => Promise<Pick<Daytona, \"create\" \| \"delete\">> = async (config) =>\n new (await import(\"@daytona/sdk\")).Daytona(config),\n): SandboxProvider {\n const networkPolicy = daytonaNetworkPolicy(options);\n const create = { ...options.create, ...networkPolicy };\n return {\n name: \"daytona\",\n placement: \"remote\",\n variables: { ...options.variables },\n async acquire(context) {\n context.signal?.throwIfAborted();\n const client = await connect(options.connection);\n const sandbox = await client.create({ ...create });\n let closed = false,\n releasing: Promise<void> \| undefined;\n let unregister = () => {};\n const release = () =>\n (releasing ??= client\n .delete(sandbox)\n .then(() => {\n closed = true;\n unregister();\n })\n .catch((error) => {\n releasing = undefined;\n throw error;\n }));\n unregister = registerCleanup(release);\n let home: string;\n let root: string;\n try {\n context.signal?.throwIfAborted();\n if (networkPolicy) {\n await confirmDaytonaNetworkPolicy(sandbox, networkPolicy);\n context.signal?.throwIfAborted();\n }\n home = (await sandbox.getUserHomeDir()) ?? cloudRoots.daytonaHome;\n root = options.root ?? posix.join(home, \"outpost\");\n await sandbox.fs.createFolder(root, \"755\");\n } catch (cause) {\n try {\n await release();\n } catch (cleanup) {\n throw new AggregateError(\n [cause, cleanup],\n \"Cloud setup and cleanup failed\",\n );\n }\n throw cause;\n }\n const lease = {\n root,\n home,\n invoke: daytonaCommand({\n sandbox,\n root,\n options,\n context,\n isClosed: () => closed,\n }),\n ...daytonaFiles(sandbox),\n release,\n };\n return { ...lease, fileTransfers: fileBatches(lease) };\n },\n };\n}\n\nexport type { EgressPolicy } from \"../domain/egress.types.ts\";\n"]}

package/dist/providers/daytona.types.d.ts CHANGED Viewed

@@ -1,7 +1,9 @@
+import type { EgressPolicy } from "../domain/egress.types.ts";
 import type { CreateSandboxFromImageParams, CreateSandboxFromSnapshotParams, DaytonaConfig, Sandbox as DaytonaSandbox } from "@daytona/sdk";
 import type { Variables } from "../domain/command.types.ts";
 import type { SandboxContext } from "../domain/sandbox.types.ts";
 export interface DaytonaOptions {
+    readonly egress?: EgressPolicy;
     readonly connection?: DaytonaConfig;
     readonly create?: CreateSandboxFromImageParams | CreateSandboxFromSnapshotParams;
     readonly variables?: Variables;

package/dist/providers/daytona.types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"daytona.types.js","sourceRoot":"","sources":["../../src/providers/daytona.types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n CreateSandboxFromImageParams,\n CreateSandboxFromSnapshotParams,\n DaytonaConfig,\n Sandbox as DaytonaSandbox,\n} from \"@daytona/sdk\";\nimport type { Variables } from \"../domain/command.types.ts\";\nimport type { SandboxContext } from \"../domain/sandbox.types.ts\";\n\nexport interface DaytonaOptions {\n readonly connection?: DaytonaConfig;\n readonly create?:\n CreateSandboxFromImageParams \| CreateSandboxFromSnapshotParams;\n readonly variables?: Variables;\n readonly root?: string;\n readonly retain?: number;\n}\n\nexport interface DaytonaRuntime {\n readonly sandbox: DaytonaSandbox;\n readonly root: string;\n readonly options: DaytonaOptions;\n readonly context: SandboxContext;\n readonly isClosed: () => boolean;\n}\n"]}
1	+ {"version":3,"file":"daytona.types.js","sourceRoot":"","sources":["../../src/providers/daytona.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { EgressPolicy } from \"../domain/egress.types.ts\";\nimport type {\n CreateSandboxFromImageParams,\n CreateSandboxFromSnapshotParams,\n DaytonaConfig,\n Sandbox as DaytonaSandbox,\n} from \"@daytona/sdk\";\nimport type { Variables } from \"../domain/command.types.ts\";\nimport type { SandboxContext } from \"../domain/sandbox.types.ts\";\n\nexport interface DaytonaOptions {\n readonly egress?: EgressPolicy;\n readonly connection?: DaytonaConfig;\n readonly create?:\n CreateSandboxFromImageParams \| CreateSandboxFromSnapshotParams;\n readonly variables?: Variables;\n readonly root?: string;\n readonly retain?: number;\n}\n\nexport interface DaytonaRuntime {\n readonly sandbox: DaytonaSandbox;\n readonly root: string;\n readonly options: DaytonaOptions;\n readonly context: SandboxContext;\n readonly isClosed: () => boolean;\n}\n"]}

package/dist/providers/firecracker-command.js CHANGED Viewed

@@ -5,7 +5,7 @@ import { firecrackerDefaults } from "./firecracker.constants.js";
 export function firecrackerSsh(options, script) {
     const ssh = options.ssh;
     return {
-        executable: ssh.binary ?? "ssh",
+        executable: ssh.binary ?? (options.jailer ? "/usr/bin/ssh" : "ssh"),
         arguments: [
             "-F",
             "/dev/null",

package/dist/providers/firecracker-command.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"firecracker-command.js","sourceRoot":"","sources":["../../src/providers/firecracker-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,KAAK,EACL,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAMjE,MAAM,UAAU,cAAc,CAC5B,OAA2B,EAC3B,MAAc;IAEd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;~~QAC/B~~,SAAS,EAAE;YACT,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,IAAI;YACJ,eAAe;YACf,IAAI;YACJ,oBAAoB;YACpB,IAAI;YACJ,2BAA2B;YAC3B,IAAI;YACJ,sBAAsB,GAAG,CAAC,UAAU,EAAE;YACtC,IAAI;YACJ,gCAAgC;YAChC,IAAI;YACJ,kBAAkB;YAClB,IAAI;YACJ,uBAAuB;YACvB,IAAI;YACJ,uBAAuB;YACvB,IAAI;YACJ,GAAG,CAAC,QAAQ;YACZ,IAAI;YACJ,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI;YACJ,GAAG,CAAC,IAAI;YACR,IAAI;YACJ,GAAG,CAAC,IAAI;YACR,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA2B;IAE3B,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpB,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;QACtE,SAAS,CACP,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EACzC,iFAAiF,CAClF,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACjE,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACnC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CACrC,EACD,yBAAyB,CAC1B,CAAC;QACF,MAAM,EAAE,GAAG,wBAAwB,UAAU,EAAE,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,wBAAwB,KAAK,CAAC,EAAE,CAAC,eAAe,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,oBAAoB,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,OAAO,CACnL,SAAS,CACV;aACE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,GAAG,CACJ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;YAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,SAAS,CAAC;QACvE,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACnC,IAAI,YAA0C,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,YAAY,KAAK,cAAc,CAC7B;gBACE,GAAG,cAAc,CACf,OAAO,CAAC,OAAO,EACf,oBAAoB,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC,oBAAoB,KAAK,CAAC,+QAA+Q,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,CAC7X;gBACD,UAAU,EAAE,mBAAmB,CAAC,SAAS;aAC1C,EACD,cAAc,CACf,CAAC;YACF,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,KAAK,CACR,IAAI,YAAY,CAAC,SAAS,EAAE,oBAAoB,UAAU,KAAK,CAAC,CACjE,EACH,UAAU,CACX,CAAC;QACF,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,GAAG,UAAU,EACd,GAAG,OAAO,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;gBACpC,GAAG,UAAU;gBACb,GAAG,CAAC,OAAO,CAAC,OAAO;oBACjB,CAAC,CAAC;wBACE,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;4BACzB,IAAI,CAAC;gCACH,OAAO,CAAC,OAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;4BAClC,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BACpB,CAAC;wBACH,CAAC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM;gBACN,GAAG,cAAc,CACf,OAAO,CAAC,OAAO,EACf,uBAAuB,KAAK,CAAC,OAAO,CAAC,EAAE,CACxC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC;gBACT,MAAM,YAAY,CAAC;YACrB,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACrC,MAAM,cAAc,CAAC;oBACnB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC3D,UAAU,EAAE,mBAAmB,CAAC,SAAS;iBAC1C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { invariant, OutpostError, positive } from \"../domain/errors.ts\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport {\n executeProcess,\n quote,\n requireSuccess,\n} from \"../infrastructure/process.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\nimport type {\n FirecrackerOptions,\n FirecrackerRuntime,\n} from \"./firecracker.types.ts\";\n\nexport function firecrackerSsh(\n options: FirecrackerOptions,\n script: string,\n): Command {\n const ssh = options.ssh;\n return {\n executable: ssh.binary ?? \"ssh\",\n arguments: [\n \"-F\",\n \"/dev/null\",\n \"-T\",\n \"-o\",\n \"BatchMode=yes\",\n \"-o\",\n \"IdentitiesOnly=yes\",\n \"-o\",\n \"StrictHostKeyChecking=yes\",\n \"-o\",\n `UserKnownHostsFile=${ssh.knownHosts}`,\n \"-o\",\n \"GlobalKnownHostsFile=/dev/null\",\n \"-o\",\n \"ConnectTimeout=2\",\n \"-o\",\n \"ServerAliveInterval=2\",\n \"-o\",\n \"ServerAliveCountMax=2\",\n \"-i\",\n ssh.identity,\n \"-p\",\n String(ssh.port ?? 22),\n \"-l\",\n ssh.user,\n \"--\",\n ssh.host,\n script,\n ],\n };\n}\n\nexport function firecrackerCommand(\n runtime: FirecrackerRuntime,\n): SandboxLease[\"invoke\"] {\n return async (command) => {\n if (runtime.isClosed())\n throw new OutpostError(\"provider\", \"Firecracker sandbox is closed\");\n invariant(\n !command.interactive && !command.elevated,\n \"Firecracker research provider does not support interactive or elevated commands\",\n );\n command.signal?.throwIfAborted();\n const variables = { ...runtime.variables, ...command.variables };\n invariant(\n Object.keys(variables).every((key) =>\n /^[A-Za-z_][A-Za-z0-9_]*$/.test(key),\n ),\n \"Invalid environment key\",\n );\n const id = `/tmp/outpost-command-${randomUUID()}`;\n const wrapper = `umask 077; echo $$ > ${quote(id)}; test ! -e ${quote(id + \".cancel\")} \|\| exit 130; cd ${quote(command.directory ?? runtime.root)} \|\| exit; exec env ${Object.entries(\n variables,\n )\n .map(([key, value]) => quote(`${key}=${value}`))\n .join(\n \" \",\n )} ${[command.executable, ...(command.arguments ?? [])].map(quote).join(\" \")}`;\n const stop = new AbortController();\n const signal = command.signal\n ? AbortSignal.any([command.signal, stop.signal])\n : stop.signal;\n const deadlineMs = command.deadlineMs ?? firecrackerDefaults.commandMs;\n positive(deadlineMs, \"deadlineMs\");\n let cancellation: Promise<unknown> \| undefined;\n const cancel = () => {\n cancellation ??= requireSuccess(\n {\n ...firecrackerSsh(\n runtime.options,\n `umask 077; touch ${quote(id + \".cancel\")}; if [ -f ${quote(id)} ]; then node -e ${quote(\"const fs=require('node:fs');const pid=Number(fs.readFileSync(process.argv[1],'utf8'));if(!Number.isSafeInteger(pid)\|\|pid<2)process.exit(1);const kill=s=>{try{process.kill(-pid,s)}catch(e){if(e.code!=='ESRCH')throw e}};kill('SIGTERM');setTimeout(()=>kill('SIGKILL'),100)\")} ${quote(id)}; fi`,\n ),\n deadlineMs: firecrackerDefaults.cleanupMs,\n },\n executeProcess,\n );\n void cancellation.catch(() => undefined);\n };\n signal.addEventListener(\"abort\", cancel, { once: true });\n const timer = setTimeout(\n () =>\n stop.abort(\n new OutpostError(\"timeout\", `Command exceeded ${deadlineMs} ms`),\n ),\n deadlineMs,\n );\n let interrupted = false;\n try {\n const {\n directory: _directory,\n variables: _variables,\n ...invocation\n } = command;\n const result = await runtime.executor({\n ...invocation,\n ...(command.observe\n ? {\n observe: (channel, text) => {\n try {\n command.observe!(channel, text);\n } catch (cause) {\n stop.abort(cause);\n }\n },\n }\n : {}),\n signal,\n ...firecrackerSsh(\n runtime.options,\n `setsid --wait sh -c ${quote(wrapper)}`,\n ),\n });\n signal.throwIfAborted();\n return result;\n } catch (cause) {\n interrupted = true;\n try {\n cancel();\n await cancellation;\n } catch (cleanup) {\n throw new AggregateError(\n [cause, cleanup],\n \"Guest cancellation could not be confirmed; release the VM\",\n );\n }\n throw cause;\n } finally {\n clearTimeout(timer);\n signal.removeEventListener(\"abort\", cancel);\n if (!interrupted && !runtime.isClosed())\n await executeProcess({\n ...firecrackerSsh(runtime.options, `rm -f -- ${quote(id)}`),\n deadlineMs: firecrackerDefaults.cleanupMs,\n }).catch(() => undefined);\n }\n };\n}\n"]}
1	+ {"version":3,"file":"firecracker-command.js","sourceRoot":"","sources":["../../src/providers/firecracker-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,KAAK,EACL,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAMjE,MAAM,UAAU,cAAc,CAC5B,OAA2B,EAC3B,MAAc;IAEd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;QACnE,SAAS,EAAE;YACT,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,IAAI;YACJ,eAAe;YACf,IAAI;YACJ,oBAAoB;YACpB,IAAI;YACJ,2BAA2B;YAC3B,IAAI;YACJ,sBAAsB,GAAG,CAAC,UAAU,EAAE;YACtC,IAAI;YACJ,gCAAgC;YAChC,IAAI;YACJ,kBAAkB;YAClB,IAAI;YACJ,uBAAuB;YACvB,IAAI;YACJ,uBAAuB;YACvB,IAAI;YACJ,GAAG,CAAC,QAAQ;YACZ,IAAI;YACJ,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI;YACJ,GAAG,CAAC,IAAI;YACR,IAAI;YACJ,GAAG,CAAC,IAAI;YACR,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA2B;IAE3B,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpB,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;QACtE,SAAS,CACP,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EACzC,iFAAiF,CAClF,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACjE,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACnC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CACrC,EACD,yBAAyB,CAC1B,CAAC;QACF,MAAM,EAAE,GAAG,wBAAwB,UAAU,EAAE,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,wBAAwB,KAAK,CAAC,EAAE,CAAC,eAAe,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,oBAAoB,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,OAAO,CACnL,SAAS,CACV;aACE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,GAAG,CACJ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;YAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,SAAS,CAAC;QACvE,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACnC,IAAI,YAA0C,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,YAAY,KAAK,cAAc,CAC7B;gBACE,GAAG,cAAc,CACf,OAAO,CAAC,OAAO,EACf,oBAAoB,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC,oBAAoB,KAAK,CAAC,+QAA+Q,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,CAC7X;gBACD,UAAU,EAAE,mBAAmB,CAAC,SAAS;aAC1C,EACD,cAAc,CACf,CAAC;YACF,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,KAAK,CACR,IAAI,YAAY,CAAC,SAAS,EAAE,oBAAoB,UAAU,KAAK,CAAC,CACjE,EACH,UAAU,CACX,CAAC;QACF,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,GAAG,UAAU,EACd,GAAG,OAAO,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;gBACpC,GAAG,UAAU;gBACb,GAAG,CAAC,OAAO,CAAC,OAAO;oBACjB,CAAC,CAAC;wBACE,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;4BACzB,IAAI,CAAC;gCACH,OAAO,CAAC,OAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;4BAClC,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BACpB,CAAC;wBACH,CAAC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM;gBACN,GAAG,cAAc,CACf,OAAO,CAAC,OAAO,EACf,uBAAuB,KAAK,CAAC,OAAO,CAAC,EAAE,CACxC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC;gBACT,MAAM,YAAY,CAAC;YACrB,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACrC,MAAM,cAAc,CAAC;oBACnB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC3D,UAAU,EAAE,mBAAmB,CAAC,SAAS;iBAC1C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { invariant, OutpostError, positive } from \"../domain/errors.ts\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport {\n executeProcess,\n quote,\n requireSuccess,\n} from \"../infrastructure/process.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\nimport type {\n FirecrackerOptions,\n FirecrackerRuntime,\n} from \"./firecracker.types.ts\";\n\nexport function firecrackerSsh(\n options: FirecrackerOptions,\n script: string,\n): Command {\n const ssh = options.ssh;\n return {\n executable: ssh.binary ?? (options.jailer ? \"/usr/bin/ssh\" : \"ssh\"),\n arguments: [\n \"-F\",\n \"/dev/null\",\n \"-T\",\n \"-o\",\n \"BatchMode=yes\",\n \"-o\",\n \"IdentitiesOnly=yes\",\n \"-o\",\n \"StrictHostKeyChecking=yes\",\n \"-o\",\n `UserKnownHostsFile=${ssh.knownHosts}`,\n \"-o\",\n \"GlobalKnownHostsFile=/dev/null\",\n \"-o\",\n \"ConnectTimeout=2\",\n \"-o\",\n \"ServerAliveInterval=2\",\n \"-o\",\n \"ServerAliveCountMax=2\",\n \"-i\",\n ssh.identity,\n \"-p\",\n String(ssh.port ?? 22),\n \"-l\",\n ssh.user,\n \"--\",\n ssh.host,\n script,\n ],\n };\n}\n\nexport function firecrackerCommand(\n runtime: FirecrackerRuntime,\n): SandboxLease[\"invoke\"] {\n return async (command) => {\n if (runtime.isClosed())\n throw new OutpostError(\"provider\", \"Firecracker sandbox is closed\");\n invariant(\n !command.interactive && !command.elevated,\n \"Firecracker research provider does not support interactive or elevated commands\",\n );\n command.signal?.throwIfAborted();\n const variables = { ...runtime.variables, ...command.variables };\n invariant(\n Object.keys(variables).every((key) =>\n /^[A-Za-z_][A-Za-z0-9_]*$/.test(key),\n ),\n \"Invalid environment key\",\n );\n const id = `/tmp/outpost-command-${randomUUID()}`;\n const wrapper = `umask 077; echo $$ > ${quote(id)}; test ! -e ${quote(id + \".cancel\")} \|\| exit 130; cd ${quote(command.directory ?? runtime.root)} \|\| exit; exec env ${Object.entries(\n variables,\n )\n .map(([key, value]) => quote(`${key}=${value}`))\n .join(\n \" \",\n )} ${[command.executable, ...(command.arguments ?? [])].map(quote).join(\" \")}`;\n const stop = new AbortController();\n const signal = command.signal\n ? AbortSignal.any([command.signal, stop.signal])\n : stop.signal;\n const deadlineMs = command.deadlineMs ?? firecrackerDefaults.commandMs;\n positive(deadlineMs, \"deadlineMs\");\n let cancellation: Promise<unknown> \| undefined;\n const cancel = () => {\n cancellation ??= requireSuccess(\n {\n ...firecrackerSsh(\n runtime.options,\n `umask 077; touch ${quote(id + \".cancel\")}; if [ -f ${quote(id)} ]; then node -e ${quote(\"const fs=require('node:fs');const pid=Number(fs.readFileSync(process.argv[1],'utf8'));if(!Number.isSafeInteger(pid)\|\|pid<2)process.exit(1);const kill=s=>{try{process.kill(-pid,s)}catch(e){if(e.code!=='ESRCH')throw e}};kill('SIGTERM');setTimeout(()=>kill('SIGKILL'),100)\")} ${quote(id)}; fi`,\n ),\n deadlineMs: firecrackerDefaults.cleanupMs,\n },\n executeProcess,\n );\n void cancellation.catch(() => undefined);\n };\n signal.addEventListener(\"abort\", cancel, { once: true });\n const timer = setTimeout(\n () =>\n stop.abort(\n new OutpostError(\"timeout\", `Command exceeded ${deadlineMs} ms`),\n ),\n deadlineMs,\n );\n let interrupted = false;\n try {\n const {\n directory: _directory,\n variables: _variables,\n ...invocation\n } = command;\n const result = await runtime.executor({\n ...invocation,\n ...(command.observe\n ? {\n observe: (channel, text) => {\n try {\n command.observe!(channel, text);\n } catch (cause) {\n stop.abort(cause);\n }\n },\n }\n : {}),\n signal,\n ...firecrackerSsh(\n runtime.options,\n `setsid --wait sh -c ${quote(wrapper)}`,\n ),\n });\n signal.throwIfAborted();\n return result;\n } catch (cause) {\n interrupted = true;\n try {\n cancel();\n await cancellation;\n } catch (cleanup) {\n throw new AggregateError(\n [cause, cleanup],\n \"Guest cancellation could not be confirmed; release the VM\",\n );\n }\n throw cause;\n } finally {\n clearTimeout(timer);\n signal.removeEventListener(\"abort\", cancel);\n if (!interrupted && !runtime.isClosed())\n await executeProcess({\n ...firecrackerSsh(runtime.options, `rm -f -- ${quote(id)}`),\n deadlineMs: firecrackerDefaults.cleanupMs,\n }).catch(() => undefined);\n }\n };\n}\n"]}

package/dist/providers/firecracker-jailer.constants.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+export declare const firecrackerJailerLimits: {
+    readonly cgroupRoot: "/sys/fs/cgroup";
+    readonly cgroupFilesystem: 1667723888;
+    readonly cpuPeriodUs: 100000;
+    readonly minimumCpuQuotaUs: 1000;
+    readonly minimumProcesses: 16;
+    readonly maximumIdentity: 4294967294;
+    readonly bytesPerMiB: number;
+};

package/dist/providers/firecracker-jailer.constants.js ADDED Viewed

@@ -0,0 +1,10 @@
+export const firecrackerJailerLimits = {
+    cgroupRoot: "/sys/fs/cgroup",
+    cgroupFilesystem: 0x63677270,
+    cpuPeriodUs: 100_000,
+    minimumCpuQuotaUs: 1000,
+    minimumProcesses: 16,
+    maximumIdentity: 4_294_967_294,
+    bytesPerMiB: 1024 * 1024,
+};
+//# sourceMappingURL=firecracker-jailer.constants.js.map

package/dist/providers/firecracker-jailer.constants.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"firecracker-jailer.constants.js","sourceRoot":"","sources":["../../src/providers/firecracker-jailer.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,OAAO;IACpB,iBAAiB,EAAE,IAAI;IACvB,gBAAgB,EAAE,EAAE;IACpB,eAAe,EAAE,aAAa;IAC9B,WAAW,EAAE,IAAI,GAAG,IAAI;CAChB,CAAC","sourcesContent":["export const firecrackerJailerLimits = {\n cgroupRoot: \"/sys/fs/cgroup\",\n cgroupFilesystem: 0x63677270,\n cpuPeriodUs: 100_000,\n minimumCpuQuotaUs: 1000,\n minimumProcesses: 16,\n maximumIdentity: 4_294_967_294,\n bytesPerMiB: 1024 * 1024,\n} as const;\n"]}

package/dist/providers/firecracker-jailer.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+import type { FirecrackerOptions, FirecrackerLaunch } from "./firecracker.types.ts";
+export declare function validateJailer(options: FirecrackerOptions): void;
+export declare function trustedJailerPath(path: string): Promise<void>;
+export declare function prepareJailer(options: FirecrackerOptions, directory: string, signal?: AbortSignal): Promise<FirecrackerLaunch>;

package/dist/providers/firecracker-jailer.js ADDED Viewed

@@ -0,0 +1,171 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { access, chmod, chown, copyFile, lstat, mkdir, readFile, rm, rmdir, statfs, writeFile, } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, normalize, relative, } from "node:path";
+import { invariant, OutpostError } from "../domain/errors.js";
+import { firecrackerJailerLimits as limits } from "./firecracker-jailer.constants.js";
+import { firecrackerDefaults } from "./firecracker.constants.js";
+export function validateJailer(options) {
+    const jailer = options.jailer;
+    if (!jailer)
+        return;
+    for (const path of [jailer.binary, jailer.directory, jailer.cgroup])
+        invariant(path.startsWith("/") &&
+            !path.includes("\0") &&
+            !path.split("/").includes(".."), "Jailer paths must be absolute without traversal");
+    invariant(jailer.cgroup.startsWith(`${limits.cgroupRoot}/`) &&
+        relative(limits.cgroupRoot, jailer.cgroup) !== "", "Jailer requires a dedicated cgroup v2 parent beneath /sys/fs/cgroup");
+    for (const value of [
+        jailer.uid,
+        jailer.gid,
+        jailer.cpuQuotaUs,
+        jailer.memoryMaxMb,
+        jailer.processes,
+    ])
+        invariant(Number.isSafeInteger(value) && value > 0, "Jailer identities and resource limits must be positive integers");
+    invariant(jailer.cpuQuotaUs >= limits.minimumCpuQuotaUs, "Jailer CPU quota must be at least 1000 microseconds per 100000 microseconds");
+    invariant(jailer.memoryMaxMb > (options.memoryMb ?? firecrackerDefaults.memoryMb), "Jailer memory limit must exceed guest memory to allow VMM overhead");
+    invariant(Number.isSafeInteger(jailer.memoryMaxMb * limits.bytesPerMiB), "Jailer memory limit is too large");
+    invariant(jailer.uid <= limits.maximumIdentity &&
+        jailer.gid <= limits.maximumIdentity, "Jailer identities must fit Linux UID/GID limits");
+    invariant(jailer.processes >= limits.minimumProcesses, "Jailer process limit must allow at least 16 threads");
+}
+export async function trustedJailerPath(path) {
+    invariant(isAbsolute(path) && normalize(path) === path, "Jailer paths must be canonical absolute paths");
+    let current = path;
+    while (true) {
+        const entry = await lstat(current);
+        invariant(!entry.isSymbolicLink() && entry.uid === 0 && (entry.mode & 0o022) === 0, `Jailer path must be root-owned, without symlinks or group/world write access: ${current}`);
+        const parent = dirname(current);
+        if (parent === current)
+            return;
+        current = parent;
+    }
+}
+export async function prepareJailer(options, directory, signal) {
+    const jailer = options.jailer;
+    invariant(jailer, "Jailer configuration is required");
+    invariant(process.getuid?.() === 0, "Jailer allocation requires a trusted root supervisor; Outpost never invokes sudo");
+    await Promise.all([
+        jailer.binary,
+        jailer.directory,
+        jailer.cgroup,
+        options.binary,
+        options.kernel,
+        options.rootfs,
+        options.ssh.identity,
+        options.ssh.knownHosts,
+        options.ssh.binary ?? "/usr/bin/ssh",
+    ].map(trustedJailerPath));
+    await access(jailer.binary, constants.X_OK);
+    invariant((await statfs(jailer.cgroup)).type === limits.cgroupFilesystem, "Jailer parent must be on cgroup v2");
+    const controllers = (await readFile(join(jailer.cgroup, "cgroup.subtree_control"), "utf8")).split(/\s+/);
+    invariant(["cpu", "memory", "pids"].every((name) => controllers.includes(name)), "Enable cpu, memory and pids controllers in the dedicated jailer parent");
+    const parent = join(jailer.directory, basename(options.binary));
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    await trustedJailerPath(parent);
+    const id = randomUUID();
+    const jail = join(parent, id);
+    const root = join(jail, "root");
+    const cgroup = join(jailer.cgroup, id);
+    await mkdir(jail, { mode: 0o700 });
+    const cleanup = async () => {
+        try {
+            const events = await readFile(join(cgroup, "cgroup.events"), "utf8");
+            if (/^populated 1$/m.test(events))
+                throw new OutpostError("provider", `Jailer cgroup is still populated; recovery files retained at ${jail}`);
+            await rmdir(cgroup);
+        }
+        catch (cause) {
+            if (!(cause instanceof Error &&
+                "code" in cause &&
+                cause.code === "ENOENT"))
+                throw cause;
+        }
+        await rm(jail, { recursive: true, force: true });
+    };
+    try {
+        await mkdir(root, { mode: 0o700 });
+        await copyFile(options.kernel, join(root, "kernel"));
+        await copyFile(join(directory, "rootfs.ext4"), join(root, "rootfs.ext4"), constants.COPYFILE_FICLONE);
+        const config = JSON.parse(await readFile(join(directory, "config.json"), "utf8"));
+        invariant(config !== null &&
+            typeof config === "object" &&
+            "boot-source" in config &&
+            "drives" in config, "Invalid Firecracker boot configuration");
+        await writeFile(join(root, "config.json"), JSON.stringify({
+            ...config,
+            "boot-source": {
+                kernel_image_path: "/kernel",
+                boot_args: options.bootArgs,
+            },
+            drives: [
+                {
+                    drive_id: "rootfs",
+                    path_on_host: "/rootfs.ext4",
+                    is_root_device: true,
+                    is_read_only: false,
+                },
+            ],
+        }), { mode: 0o400 });
+        for (const name of ["kernel", "rootfs.ext4", "config.json"]) {
+            await chown(join(root, name), jailer.uid, jailer.gid);
+            await chmod(join(root, name), name === "rootfs.ext4" ? 0o600 : 0o400);
+        }
+        signal?.throwIfAborted();
+    }
+    catch (cause) {
+        try {
+            await cleanup();
+        }
+        catch (cleanupFailure) {
+            throw new AggregateError([cause, cleanupFailure], `Jailer preparation and cleanup failed; inspect ${jail}`);
+        }
+        throw cause;
+    }
+    return {
+        binary: jailer.binary,
+        arguments: [
+            "--id",
+            id,
+            "--exec-file",
+            options.binary,
+            "--uid",
+            String(jailer.uid),
+            "--gid",
+            String(jailer.gid),
+            "--chroot-base-dir",
+            jailer.directory,
+            "--cgroup-version",
+            "2",
+            "--parent-cgroup",
+            relative(limits.cgroupRoot, jailer.cgroup),
+            "--cgroup",
+            `cpu.max=${jailer.cpuQuotaUs} ${limits.cpuPeriodUs}`,
+            "--cgroup",
+            `memory.max=${jailer.memoryMaxMb * limits.bytesPerMiB}`,
+            "--cgroup",
+            "memory.swap.max=0",
+            "--cgroup",
+            `pids.max=${jailer.processes}`,
+            "--",
+            "--api-sock",
+            "/api.sock",
+            "--config-file",
+            "/config.json",
+        ],
+        async stop() {
+            try {
+                await writeFile(join(cgroup, "cgroup.kill"), "1");
+            }
+            catch (cause) {
+                if (!(cause instanceof Error &&
+                    "code" in cause &&
+                    cause.code === "ENOENT"))
+                    throw cause;
+            }
+        },
+        cleanup,
+    };
+}
+//# sourceMappingURL=firecracker-jailer.js.map