@elie-laloum/outpost 5.0.0 → 7.0.0

package/dist/providers/firecracker-jailer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker-jailer.js","sourceRoot":"","sources":["../../src/providers/firecracker-jailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACL,MAAM,EACN,KAAK,EACL,KAAK,EACL,QAAQ,EACR,KAAK,EACL,KAAK,EACL,QAAQ,EACR,EAAE,EACF,KAAK,EACL,MAAM,EACN,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,OAAO,EACP,UAAU,EACV,IAAI,EACJ,SAAS,EACT,QAAQ,GACT,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAK9D,OAAO,EAAE,uBAAuB,IAAI,MAAM,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACjE,SAAS,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAClB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EACjC,iDAAiD,CAClD,CAAC;IACJ,SAAS,CACP,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC;QAC/C,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EACnD,qEAAqE,CACtE,CAAC;IACF,KAAK,MAAM,KAAK,IAAI;QAClB,MAAM,CAAC,GAAG;QACV,MAAM,CAAC,GAAG;QACV,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,SAAS;KACjB;QACC,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EACxC,iEAAiE,CAClE,CAAC;IACJ,SAAS,CACP,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,iBAAiB,EAC7C,6EAA6E,CAC9E,CAAC;IACF,SAAS,CACP,MAAM,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EACvE,oEAAoE,CACrE,CAAC;IACF,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAC7D,kCAAkC,CACnC,CAAC;IACF,SAAS,CACP,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,eAAe;QAClC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,eAAe,EACtC,iDAAiD,CAClD,CAAC;IACF,SAAS,CACP,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,EAC3C,qDAAqD,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,SAAS,CACP,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAC5C,+CAA+C,CAChD,CAAC;IACF,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,SAAS,CACP,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EACxE,iFAAiF,OAAO,EAAE,CAC3F,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO;QAC/B,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA2B,EAC3B,SAAiB,EACjB,MAAoB;IAEpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,SAAS,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IACtD,SAAS,CACP,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,EACxB,kFAAkF,CACnF,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf;QACE,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,MAAM;QACb,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,cAAc;KACrC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CACzB,CAAC;IACF,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,SAAS,CACP,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,EAC9D,oCAAoC,CACrC,CAAC;IACF,MAAM,WAAW,GAAG,CAClB,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAAE,MAAM,CAAC,CACtE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,SAAS,CACP,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACrE,wEAAwE,CACzE,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;YACrE,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,gEAAgE,IAAI,EAAE,CACvE,CAAC;YACJ,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CACH,KAAK,YAAY,KAAK;gBACtB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB;gBACC,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,CACZ,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAChC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CACvD,CAAC;QACF,SAAS,CACP,MAAM,KAAK,IAAI;YACb,OAAO,MAAM,KAAK,QAAQ;YAC1B,aAAa,IAAI,MAAM;YACvB,QAAQ,IAAI,MAAM,EACpB,wCAAwC,CACzC,CAAC;QACF,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,MAAM;YACT,aAAa,EAAE;gBACb,iBAAiB,EAAE,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ;aAC5B;YACD,MAAM,EAAE;gBACN;oBACE,QAAQ,EAAE,QAAQ;oBAClB,YAAY,EAAE,cAAc;oBAC5B,cAAc,EAAE,IAAI;oBACpB,YAAY,EAAE,KAAK;iBACpB;aACF;SACF,CAAC,EACF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,cAAc,CAAC,EACvB,kDAAkD,IAAI,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE;YACT,MAAM;YACN,EAAE;YACF,aAAa;YACb,OAAO,CAAC,MAAM;YACd,OAAO;YACP,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAClB,OAAO;YACP,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAClB,mBAAmB;YACnB,MAAM,CAAC,SAAS;YAChB,kBAAkB;YAClB,GAAG;YACH,iBAAiB;YACjB,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YAC1C,UAAU;YACV,WAAW,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE;YACpD,UAAU;YACV,cAAc,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE;YACvD,UAAU;YACV,mBAAmB;YACnB,UAAU;YACV,YAAY,MAAM,CAAC,SAAS,EAAE;YAC9B,IAAI;YACJ,YAAY;YACZ,WAAW;YACX,eAAe;YACf,cAAc;SACf;QACD,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CACH,KAAK,YAAY,KAAK;oBACtB,MAAM,IAAI,KAAK;oBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB;oBACC,MAAM,KAAK,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO;KACR,CAAC;AACJ,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { constants } from \"node:fs\";\nimport {\n  access,\n  chmod,\n  chown,\n  copyFile,\n  lstat,\n  mkdir,\n  readFile,\n  rm,\n  rmdir,\n  statfs,\n  writeFile,\n} from \"node:fs/promises\";\nimport {\n  basename,\n  dirname,\n  isAbsolute,\n  join,\n  normalize,\n  relative,\n} from \"node:path\";\nimport { invariant, OutpostError } from \"../domain/errors.ts\";\nimport type {\n  FirecrackerOptions,\n  FirecrackerLaunch,\n} from \"./firecracker.types.ts\";\nimport { firecrackerJailerLimits as limits } from \"./firecracker-jailer.constants.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\n\nexport function validateJailer(options: FirecrackerOptions): void {\n  const jailer = options.jailer;\n  if (!jailer) return;\n  for (const path of [jailer.binary, jailer.directory, jailer.cgroup])\n    invariant(\n      path.startsWith(\"/\") &&\n        !path.includes(\"\\0\") &&\n        !path.split(\"/\").includes(\"..\"),\n      \"Jailer paths must be absolute without traversal\",\n    );\n  invariant(\n    jailer.cgroup.startsWith(`${limits.cgroupRoot}/`) &&\n      relative(limits.cgroupRoot, jailer.cgroup) !== \"\",\n    \"Jailer requires a dedicated cgroup v2 parent beneath /sys/fs/cgroup\",\n  );\n  for (const value of [\n    jailer.uid,\n    jailer.gid,\n    jailer.cpuQuotaUs,\n    jailer.memoryMaxMb,\n    jailer.processes,\n  ])\n    invariant(\n      Number.isSafeInteger(value) && value > 0,\n      \"Jailer identities and resource limits must be positive integers\",\n    );\n  invariant(\n    jailer.cpuQuotaUs >= limits.minimumCpuQuotaUs,\n    \"Jailer CPU quota must be at least 1000 microseconds per 100000 microseconds\",\n  );\n  invariant(\n    jailer.memoryMaxMb > (options.memoryMb ?? firecrackerDefaults.memoryMb),\n    \"Jailer memory limit must exceed guest memory to allow VMM overhead\",\n  );\n  invariant(\n    Number.isSafeInteger(jailer.memoryMaxMb * limits.bytesPerMiB),\n    \"Jailer memory limit is too large\",\n  );\n  invariant(\n    jailer.uid <= limits.maximumIdentity &&\n      jailer.gid <= limits.maximumIdentity,\n    \"Jailer identities must fit Linux UID/GID limits\",\n  );\n  invariant(\n    jailer.processes >= limits.minimumProcesses,\n    \"Jailer process limit must allow at least 16 threads\",\n  );\n}\n\nexport async function trustedJailerPath(path: string): Promise<void> {\n  invariant(\n    isAbsolute(path) && normalize(path) === path,\n    \"Jailer paths must be canonical absolute paths\",\n  );\n  let current = path;\n  while (true) {\n    const entry = await lstat(current);\n    invariant(\n      !entry.isSymbolicLink() && entry.uid === 0 && (entry.mode & 0o022) === 0,\n      `Jailer path must be root-owned, without symlinks or group/world write access: ${current}`,\n    );\n    const parent = dirname(current);\n    if (parent === current) return;\n    current = parent;\n  }\n}\n\nexport async function prepareJailer(\n  options: FirecrackerOptions,\n  directory: string,\n  signal?: AbortSignal,\n): Promise<FirecrackerLaunch> {\n  const jailer = options.jailer;\n  invariant(jailer, \"Jailer configuration is required\");\n  invariant(\n    process.getuid?.() === 0,\n    \"Jailer allocation requires a trusted root supervisor; Outpost never invokes sudo\",\n  );\n  await Promise.all(\n    [\n      jailer.binary,\n      jailer.directory,\n      jailer.cgroup,\n      options.binary,\n      options.kernel,\n      options.rootfs,\n      options.ssh.identity,\n      options.ssh.knownHosts,\n      options.ssh.binary ?? \"/usr/bin/ssh\",\n    ].map(trustedJailerPath),\n  );\n  await access(jailer.binary, constants.X_OK);\n  invariant(\n    (await statfs(jailer.cgroup)).type === limits.cgroupFilesystem,\n    \"Jailer parent must be on cgroup v2\",\n  );\n  const controllers = (\n    await readFile(join(jailer.cgroup, \"cgroup.subtree_control\"), \"utf8\")\n  ).split(/\\s+/);\n  invariant(\n    [\"cpu\", \"memory\", \"pids\"].every((name) => controllers.includes(name)),\n    \"Enable cpu, memory and pids controllers in the dedicated jailer parent\",\n  );\n  const parent = join(jailer.directory, basename(options.binary));\n  await mkdir(parent, { recursive: true, mode: 0o700 });\n  await trustedJailerPath(parent);\n  const id = randomUUID();\n  const jail = join(parent, id);\n  const root = join(jail, \"root\");\n  const cgroup = join(jailer.cgroup, id);\n  await mkdir(jail, { mode: 0o700 });\n  const cleanup = async () => {\n    try {\n      const events = await readFile(join(cgroup, \"cgroup.events\"), \"utf8\");\n      if (/^populated 1$/m.test(events))\n        throw new OutpostError(\n          \"provider\",\n          `Jailer cgroup is still populated; recovery files retained at ${jail}`,\n        );\n      await rmdir(cgroup);\n    } catch (cause) {\n      if (!(\n        cause instanceof Error &&\n        \"code\" in cause &&\n        cause.code === \"ENOENT\"\n      ))\n        throw cause;\n    }\n    await rm(jail, { recursive: true, force: true });\n  };\n  try {\n    await mkdir(root, { mode: 0o700 });\n    await copyFile(options.kernel, join(root, \"kernel\"));\n    await copyFile(\n      join(directory, \"rootfs.ext4\"),\n      join(root, \"rootfs.ext4\"),\n      constants.COPYFILE_FICLONE,\n    );\n    const config: unknown = JSON.parse(\n      await readFile(join(directory, \"config.json\"), \"utf8\"),\n    );\n    invariant(\n      config !== null &&\n        typeof config === \"object\" &&\n        \"boot-source\" in config &&\n        \"drives\" in config,\n      \"Invalid Firecracker boot configuration\",\n    );\n    await writeFile(\n      join(root, \"config.json\"),\n      JSON.stringify({\n        ...config,\n        \"boot-source\": {\n          kernel_image_path: \"/kernel\",\n          boot_args: options.bootArgs,\n        },\n        drives: [\n          {\n            drive_id: \"rootfs\",\n            path_on_host: \"/rootfs.ext4\",\n            is_root_device: true,\n            is_read_only: false,\n          },\n        ],\n      }),\n      { mode: 0o400 },\n    );\n    for (const name of [\"kernel\", \"rootfs.ext4\", \"config.json\"]) {\n      await chown(join(root, name), jailer.uid, jailer.gid);\n      await chmod(join(root, name), name === \"rootfs.ext4\" ? 0o600 : 0o400);\n    }\n    signal?.throwIfAborted();\n  } catch (cause) {\n    try {\n      await cleanup();\n    } catch (cleanupFailure) {\n      throw new AggregateError(\n        [cause, cleanupFailure],\n        `Jailer preparation and cleanup failed; inspect ${jail}`,\n      );\n    }\n    throw cause;\n  }\n  return {\n    binary: jailer.binary,\n    arguments: [\n      \"--id\",\n      id,\n      \"--exec-file\",\n      options.binary,\n      \"--uid\",\n      String(jailer.uid),\n      \"--gid\",\n      String(jailer.gid),\n      \"--chroot-base-dir\",\n      jailer.directory,\n      \"--cgroup-version\",\n      \"2\",\n      \"--parent-cgroup\",\n      relative(limits.cgroupRoot, jailer.cgroup),\n      \"--cgroup\",\n      `cpu.max=${jailer.cpuQuotaUs} ${limits.cpuPeriodUs}`,\n      \"--cgroup\",\n      `memory.max=${jailer.memoryMaxMb * limits.bytesPerMiB}`,\n      \"--cgroup\",\n      \"memory.swap.max=0\",\n      \"--cgroup\",\n      `pids.max=${jailer.processes}`,\n      \"--\",\n      \"--api-sock\",\n      \"/api.sock\",\n      \"--config-file\",\n      \"/config.json\",\n    ],\n    async stop() {\n      try {\n        await writeFile(join(cgroup, \"cgroup.kill\"), \"1\");\n      } catch (cause) {\n        if (!(\n          cause instanceof Error &&\n          \"code\" in cause &&\n          cause.code === \"ENOENT\"\n        ))\n          throw cause;\n      }\n    },\n    cleanup,\n  };\n}\n"]}

package/dist/providers/firecracker-machine.js

@@ -7,8 +7,10 @@ import { isAbsolute, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { invariant, OutpostError, positive } from "../domain/errors.js";
 import { registerCleanup } from "../infrastructure/shutdown.js";
+import { prepareJailer, validateJailer } from "./firecracker-jailer.js";
 import { firecrackerDefaults } from "./firecracker.constants.js";
 export function validateFirecracker(options) {
+    validateJailer(options);
     invariant(!("egress" in options) || options.egress === undefined, "Firecracker cannot enforce Outpost egress policies; configure host networking explicitly");
     for (const path of [
         options.binary,
@@ -96,12 +98,26 @@ export async function firecrackerMachine(options, signal) {
     catch (cause) {
         return failedAllocation([directory, lock, transportLock], cause);
     }
-    const child = spawn(options.binary, [
-        "--api-sock",
-        join(directory, "api.sock"),
-        "--config-file",
-        join(directory, "config.json"),
-    ], { stdio: "ignore" });
+    let launch;
+    try {
+        launch = options.jailer
+            ? await prepareJailer(options, directory, signal)
+            : {
+                binary: options.binary,
+                arguments: [
+                    "--api-sock",
+                    join(directory, "api.sock"),
+                    "--config-file",
+                    join(directory, "config.json"),
+                ],
+                async stop() { },
+                async cleanup() { },
+            };
+    }
+    catch (cause) {
+        return failedAllocation([directory, lock, transportLock], cause);
+    }
+    const child = spawn(launch.binary, launch.arguments, { stdio: "ignore" });
     let exited = false;
     const exit = new Promise((resolve) => {
         child.once("error", () => {
@@ -121,14 +137,20 @@ export async function firecrackerMachine(options, signal) {
         if (!exited)
             child.kill("SIGTERM");
         await Promise.race([exit, delay(200, undefined, { ref: false })]);
-        if (!exited)
-            child.kill("SIGKILL");
+        try {
+            await launch.stop();
+        }
+        finally {
+            if (!exited)
+                child.kill("SIGKILL");
+        }
         await Promise.race([
             exit,
             delay(firecrackerDefaults.cleanupMs, undefined, { ref: false }),
         ]);
         if (!exited)
             throw new OutpostError("provider", `VM termination uncertain; private disk retained at ${directory}`);
+        await launch.cleanup();
         await rm(directory, { recursive: true, force: true });
         await rm(lock, { recursive: true, force: true });
         await rm(transportLock, { recursive: true, force: true });

package/dist/providers/firecracker-machine.js.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker-machine.js","sourceRoot":"","sources":["../../src/providers/firecracker-machine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,KAAK,EACL,OAAO,EACP,EAAE,EACF,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAMjE,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,SAAS,CACP,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EACtD,0FAA0F,CAC3F,CAAC;IACF,KAAK,MAAM,IAAI,IAAI;QACjB,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;QACxC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,UAAU;KACvB;QACC,SAAS,CACP,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxC,oCAAoC,CACrC,CAAC;IACJ,SAAS,CACP,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAC1C,uBAAuB,CACxB,CAAC;IACF,SAAS,CACP,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC7D,2BAA2B,CAC5B,CAAC;IACF,SAAS,CACP,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACzC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACnC,kBAAkB,CACnB,CAAC;IACF,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI;QAClB,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;QACxC,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;QAChD,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;KACvB;QACC,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EACxC,oEAAoE,CACrE,CAAC;IACJ,QAAQ,CACN,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,EAC5D,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAC3B,MAAoB;IAEpB,SAAS,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3E,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EAAE,EACR,2BAA2B,QAAQ,OAAO,CAC3C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,CACZ,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,IAAI,CAAC,SAAS,CAAC;YACb,aAAa,EAAE;gBACb,iBAAiB,EAAE,OAAO,CAAC,MAAM;gBACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;aAC5B;YACD,MAAM,EAAE;gBACN;oBACE,QAAQ,EAAE,QAAQ;oBAClB,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;oBAC5C,cAAc,EAAE,IAAI;oBACpB,YAAY,EAAE,KAAK;iBACpB;aACF;YACD,gBAAgB,EAAE;gBAChB,UAAU,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;gBACpD,YAAY,EAAE,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;aAC/D;YACD,oBAAoB,EAAE;gBACpB;oBACE,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAC3B,aAAa,EAAE,OAAO,CAAC,GAAG;iBAC3B;aACF;SACF,CAAC,EACF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,MAAM,EACd;QACE,YAAY;QACZ,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAC3B,eAAe;QACf,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;KAC/B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,SAAoC,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;QACzB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,sDAAsD,SAAS,EAAE,CAClE,CAAC;QACJ,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,SAAS,GAAG,SAAS,CAAC;QACtB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC,CAAC;IACN,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE;QACzC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAwB,EACxB,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;SAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM;QACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,EACpB,iFAAiF,CAClF,CAAC;IACJ,MAAM,KAAK,CAAC;AACd,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { spawn } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport {\n  access,\n  chmod,\n  copyFile,\n  mkdir,\n  mkdtemp,\n  rm,\n  writeFile,\n} from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { isAbsolute, join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { invariant, OutpostError, positive } from \"../domain/errors.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\nimport type {\n  FirecrackerMachine,\n  FirecrackerOptions,\n} from \"./firecracker.types.ts\";\n\nexport function validateFirecracker(options: FirecrackerOptions): void {\n  invariant(\n    !(\"egress\" in options) || options.egress === undefined,\n    \"Firecracker cannot enforce Outpost egress policies; configure host networking explicitly\",\n  );\n  for (const path of [\n    options.binary,\n    options.kernel,\n    options.rootfs,\n    options.home,\n    options.root ?? firecrackerDefaults.root,\n    options.ssh.identity,\n    options.ssh.knownHosts,\n  ])\n    invariant(\n      isAbsolute(path) && !path.includes(\"\\0\"),\n      \"Firecracker paths must be absolute\",\n    );\n  invariant(\n    /^[a-zA-Z0-9_.-]{1,15}$/.test(options.tap),\n    \"Invalid TAP interface\",\n  );\n  invariant(\n    /^([a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2}$/.test(options.guestMac),\n    \"Invalid guest MAC address\",\n  );\n  invariant(\n    /^[a-zA-Z0-9_.:-]+$/.test(options.ssh.host) &&\n      !options.ssh.host.startsWith(\"-\"),\n    \"Invalid SSH host\",\n  );\n  invariant(/^[a-zA-Z0-9_-]+$/.test(options.ssh.user), \"Invalid SSH user\");\n  for (const value of [\n    options.cpus ?? firecrackerDefaults.cpus,\n    options.memoryMb ?? firecrackerDefaults.memoryMb,\n    options.ssh.port ?? 22,\n  ])\n    invariant(\n      Number.isSafeInteger(value) && value > 0,\n      \"Firecracker resource limits and SSH port must be positive integers\",\n    );\n  positive(\n    options.bootDeadlineMs ?? firecrackerDefaults.bootDeadlineMs,\n    \"bootDeadlineMs\",\n  );\n}\n\nexport async function firecrackerMachine(\n  options: FirecrackerOptions,\n  signal?: AbortSignal,\n): Promise<FirecrackerMachine> {\n  invariant(process.platform === \"linux\", \"Firecracker requires Linux and KVM\");\n  signal?.throwIfAborted();\n  await access(\"/dev/kvm\", constants.R_OK | constants.W_OK);\n  await Promise.all([\n    access(options.binary, constants.X_OK),\n    access(options.kernel, constants.R_OK),\n    access(options.rootfs, constants.R_OK),\n    access(options.ssh.identity, constants.R_OK),\n    access(options.ssh.knownHosts, constants.R_OK),\n  ]);\n  const lock = join(tmpdir(), `outpost-firecracker-tap-${options.tap}.lock`);\n  await mkdir(lock, { mode: 0o700 });\n  const endpoint = createHash(\"sha256\")\n    .update(`${options.ssh.host}:${options.ssh.port ?? 22}`)\n    .digest(\"hex\");\n  const transportLock = join(\n    tmpdir(),\n    `outpost-firecracker-ssh-${endpoint}.lock`,\n  );\n  try {\n    await mkdir(transportLock, { mode: 0o700 });\n  } catch (cause) {\n    return failedAllocation([lock], cause);\n  }\n  let directory: string;\n  try {\n    directory = await mkdtemp(join(tmpdir(), \"outpost-firecracker-\"));\n  } catch (cause) {\n    return failedAllocation([lock, transportLock], cause);\n  }\n  try {\n    await copyFile(\n      options.rootfs,\n      join(directory, \"rootfs.ext4\"),\n      constants.COPYFILE_FICLONE,\n    );\n    await chmod(join(directory, \"rootfs.ext4\"), 0o600);\n    signal?.throwIfAborted();\n    await writeFile(\n      join(directory, \"config.json\"),\n      JSON.stringify({\n        \"boot-source\": {\n          kernel_image_path: options.kernel,\n          boot_args: options.bootArgs,\n        },\n        drives: [\n          {\n            drive_id: \"rootfs\",\n            path_on_host: join(directory, \"rootfs.ext4\"),\n            is_root_device: true,\n            is_read_only: false,\n          },\n        ],\n        \"machine-config\": {\n          vcpu_count: options.cpus ?? firecrackerDefaults.cpus,\n          mem_size_mib: options.memoryMb ?? firecrackerDefaults.memoryMb,\n        },\n        \"network-interfaces\": [\n          {\n            iface_id: \"net1\",\n            guest_mac: options.guestMac,\n            host_dev_name: options.tap,\n          },\n        ],\n      }),\n      { mode: 0o600 },\n    );\n  } catch (cause) {\n    return failedAllocation([directory, lock, transportLock], cause);\n  }\n  const child = spawn(\n    options.binary,\n    [\n      \"--api-sock\",\n      join(directory, \"api.sock\"),\n      \"--config-file\",\n      join(directory, \"config.json\"),\n    ],\n    { stdio: \"ignore\" },\n  );\n  let exited = false;\n  const exit = new Promise<void>((resolve) => {\n    child.once(\"error\", () => {\n      exited = true;\n      resolve();\n    });\n    child.once(\"exit\", () => {\n      exited = true;\n      resolve();\n    });\n  });\n  let releasing: Promise<void> | undefined;\n  let closed = false;\n  let unregister = () => {};\n  const release = () =>\n    (releasing ??= (async () => {\n      closed = true;\n      if (!exited) child.kill(\"SIGTERM\");\n      await Promise.race([exit, delay(200, undefined, { ref: false })]);\n      if (!exited) child.kill(\"SIGKILL\");\n      await Promise.race([\n        exit,\n        delay(firecrackerDefaults.cleanupMs, undefined, { ref: false }),\n      ]);\n      if (!exited)\n        throw new OutpostError(\n          \"provider\",\n          `VM termination uncertain; private disk retained at ${directory}`,\n        );\n      await rm(directory, { recursive: true, force: true });\n      await rm(lock, { recursive: true, force: true });\n      await rm(transportLock, { recursive: true, force: true });\n      unregister();\n    })().catch((cause) => {\n      releasing = undefined;\n      throw cause;\n    }));\n  unregister = registerCleanup(release, () => {\n    if (!exited) child.kill(\"SIGKILL\");\n  });\n  return { directory, isClosed: () => closed || exited, release };\n}\n\nasync function failedAllocation(\n  paths: readonly string[],\n  cause: unknown,\n): Promise<never> {\n  const results = await Promise.allSettled(\n    paths.map((path) => rm(path, { recursive: true, force: true })),\n  );\n  const failures = results\n    .filter((result) => result.status === \"rejected\")\n    .map((result) => result.reason);\n  if (failures.length)\n    throw new AggregateError(\n      [cause, ...failures],\n      \"Firecracker allocation and cleanup failed; inspect retained temporary resources\",\n    );\n  throw cause;\n}\n"]}
+{"version":3,"file":"firecracker-machine.js","sourceRoot":"","sources":["../../src/providers/firecracker-machine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,KAAK,EACL,OAAO,EACP,EAAE,EACF,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAOjE,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,SAAS,CACP,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EACtD,0FAA0F,CAC3F,CAAC;IACF,KAAK,MAAM,IAAI,IAAI;QACjB,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;QACxC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,UAAU;KACvB;QACC,SAAS,CACP,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxC,oCAAoC,CACrC,CAAC;IACJ,SAAS,CACP,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAC1C,uBAAuB,CACxB,CAAC;IACF,SAAS,CACP,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC7D,2BAA2B,CAC5B,CAAC;IACF,SAAS,CACP,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACzC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACnC,kBAAkB,CACnB,CAAC;IACF,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI;QAClB,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;QACxC,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;QAChD,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;KACvB;QACC,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EACxC,oEAAoE,CACrE,CAAC;IACJ,QAAQ,CACN,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,EAC5D,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAC3B,MAAoB;IAEpB,SAAS,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3E,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EAAE,EACR,2BAA2B,QAAQ,OAAO,CAC3C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,CACZ,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,IAAI,CAAC,SAAS,CAAC;YACb,aAAa,EAAE;gBACb,iBAAiB,EAAE,OAAO,CAAC,MAAM;gBACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;aAC5B;YACD,MAAM,EAAE;gBACN;oBACE,QAAQ,EAAE,QAAQ;oBAClB,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;oBAC5C,cAAc,EAAE,IAAI;oBACpB,YAAY,EAAE,KAAK;iBACpB;aACF;YACD,gBAAgB,EAAE;gBAChB,UAAU,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI;gBACpD,YAAY,EAAE,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;aAC/D;YACD,oBAAoB,EAAE;gBACpB;oBACE,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAC3B,aAAa,EAAE,OAAO,CAAC,GAAG;iBAC3B;aACF;SACF,CAAC,EACF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,MAAM;YACrB,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;YACjD,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE;oBACT,YAAY;oBACZ,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;oBAC3B,eAAe;oBACf,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;iBAC/B;gBACD,KAAK,CAAC,IAAI,KAAI,CAAC;gBACf,KAAK,CAAC,OAAO,KAAI,CAAC;aACnB,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,SAAoC,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;QACzB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,sDAAsD,SAAS,EAAE,CAClE,CAAC;QACJ,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,SAAS,GAAG,SAAS,CAAC;QACtB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC,CAAC;IACN,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE;QACzC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAwB,EACxB,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;SAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM;QACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,EACpB,iFAAiF,CAClF,CAAC;IACJ,MAAM,KAAK,CAAC;AACd,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { spawn } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport {\n  access,\n  chmod,\n  copyFile,\n  mkdir,\n  mkdtemp,\n  rm,\n  writeFile,\n} from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { isAbsolute, join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { invariant, OutpostError, positive } from \"../domain/errors.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { prepareJailer, validateJailer } from \"./firecracker-jailer.ts\";\nimport { firecrackerDefaults } from \"./firecracker.constants.ts\";\nimport type {\n  FirecrackerMachine,\n  FirecrackerLaunch,\n  FirecrackerOptions,\n} from \"./firecracker.types.ts\";\n\nexport function validateFirecracker(options: FirecrackerOptions): void {\n  validateJailer(options);\n  invariant(\n    !(\"egress\" in options) || options.egress === undefined,\n    \"Firecracker cannot enforce Outpost egress policies; configure host networking explicitly\",\n  );\n  for (const path of [\n    options.binary,\n    options.kernel,\n    options.rootfs,\n    options.home,\n    options.root ?? firecrackerDefaults.root,\n    options.ssh.identity,\n    options.ssh.knownHosts,\n  ])\n    invariant(\n      isAbsolute(path) && !path.includes(\"\\0\"),\n      \"Firecracker paths must be absolute\",\n    );\n  invariant(\n    /^[a-zA-Z0-9_.-]{1,15}$/.test(options.tap),\n    \"Invalid TAP interface\",\n  );\n  invariant(\n    /^([a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2}$/.test(options.guestMac),\n    \"Invalid guest MAC address\",\n  );\n  invariant(\n    /^[a-zA-Z0-9_.:-]+$/.test(options.ssh.host) &&\n      !options.ssh.host.startsWith(\"-\"),\n    \"Invalid SSH host\",\n  );\n  invariant(/^[a-zA-Z0-9_-]+$/.test(options.ssh.user), \"Invalid SSH user\");\n  for (const value of [\n    options.cpus ?? firecrackerDefaults.cpus,\n    options.memoryMb ?? firecrackerDefaults.memoryMb,\n    options.ssh.port ?? 22,\n  ])\n    invariant(\n      Number.isSafeInteger(value) && value > 0,\n      \"Firecracker resource limits and SSH port must be positive integers\",\n    );\n  positive(\n    options.bootDeadlineMs ?? firecrackerDefaults.bootDeadlineMs,\n    \"bootDeadlineMs\",\n  );\n}\n\nexport async function firecrackerMachine(\n  options: FirecrackerOptions,\n  signal?: AbortSignal,\n): Promise<FirecrackerMachine> {\n  invariant(process.platform === \"linux\", \"Firecracker requires Linux and KVM\");\n  signal?.throwIfAborted();\n  await access(\"/dev/kvm\", constants.R_OK | constants.W_OK);\n  await Promise.all([\n    access(options.binary, constants.X_OK),\n    access(options.kernel, constants.R_OK),\n    access(options.rootfs, constants.R_OK),\n    access(options.ssh.identity, constants.R_OK),\n    access(options.ssh.knownHosts, constants.R_OK),\n  ]);\n  const lock = join(tmpdir(), `outpost-firecracker-tap-${options.tap}.lock`);\n  await mkdir(lock, { mode: 0o700 });\n  const endpoint = createHash(\"sha256\")\n    .update(`${options.ssh.host}:${options.ssh.port ?? 22}`)\n    .digest(\"hex\");\n  const transportLock = join(\n    tmpdir(),\n    `outpost-firecracker-ssh-${endpoint}.lock`,\n  );\n  try {\n    await mkdir(transportLock, { mode: 0o700 });\n  } catch (cause) {\n    return failedAllocation([lock], cause);\n  }\n  let directory: string;\n  try {\n    directory = await mkdtemp(join(tmpdir(), \"outpost-firecracker-\"));\n  } catch (cause) {\n    return failedAllocation([lock, transportLock], cause);\n  }\n  try {\n    await copyFile(\n      options.rootfs,\n      join(directory, \"rootfs.ext4\"),\n      constants.COPYFILE_FICLONE,\n    );\n    await chmod(join(directory, \"rootfs.ext4\"), 0o600);\n    signal?.throwIfAborted();\n    await writeFile(\n      join(directory, \"config.json\"),\n      JSON.stringify({\n        \"boot-source\": {\n          kernel_image_path: options.kernel,\n          boot_args: options.bootArgs,\n        },\n        drives: [\n          {\n            drive_id: \"rootfs\",\n            path_on_host: join(directory, \"rootfs.ext4\"),\n            is_root_device: true,\n            is_read_only: false,\n          },\n        ],\n        \"machine-config\": {\n          vcpu_count: options.cpus ?? firecrackerDefaults.cpus,\n          mem_size_mib: options.memoryMb ?? firecrackerDefaults.memoryMb,\n        },\n        \"network-interfaces\": [\n          {\n            iface_id: \"net1\",\n            guest_mac: options.guestMac,\n            host_dev_name: options.tap,\n          },\n        ],\n      }),\n      { mode: 0o600 },\n    );\n  } catch (cause) {\n    return failedAllocation([directory, lock, transportLock], cause);\n  }\n  let launch: FirecrackerLaunch;\n  try {\n    launch = options.jailer\n      ? await prepareJailer(options, directory, signal)\n      : {\n          binary: options.binary,\n          arguments: [\n            \"--api-sock\",\n            join(directory, \"api.sock\"),\n            \"--config-file\",\n            join(directory, \"config.json\"),\n          ],\n          async stop() {},\n          async cleanup() {},\n        };\n  } catch (cause) {\n    return failedAllocation([directory, lock, transportLock], cause);\n  }\n  const child = spawn(launch.binary, launch.arguments, { stdio: \"ignore\" });\n  let exited = false;\n  const exit = new Promise<void>((resolve) => {\n    child.once(\"error\", () => {\n      exited = true;\n      resolve();\n    });\n    child.once(\"exit\", () => {\n      exited = true;\n      resolve();\n    });\n  });\n  let releasing: Promise<void> | undefined;\n  let closed = false;\n  let unregister = () => {};\n  const release = () =>\n    (releasing ??= (async () => {\n      closed = true;\n      if (!exited) child.kill(\"SIGTERM\");\n      await Promise.race([exit, delay(200, undefined, { ref: false })]);\n      try {\n        await launch.stop();\n      } finally {\n        if (!exited) child.kill(\"SIGKILL\");\n      }\n      await Promise.race([\n        exit,\n        delay(firecrackerDefaults.cleanupMs, undefined, { ref: false }),\n      ]);\n      if (!exited)\n        throw new OutpostError(\n          \"provider\",\n          `VM termination uncertain; private disk retained at ${directory}`,\n        );\n      await launch.cleanup();\n      await rm(directory, { recursive: true, force: true });\n      await rm(lock, { recursive: true, force: true });\n      await rm(transportLock, { recursive: true, force: true });\n      unregister();\n    })().catch((cause) => {\n      releasing = undefined;\n      throw cause;\n    }));\n  unregister = registerCleanup(release, () => {\n    if (!exited) child.kill(\"SIGKILL\");\n  });\n  return { directory, isClosed: () => closed || exited, release };\n}\n\nasync function failedAllocation(\n  paths: readonly string[],\n  cause: unknown,\n): Promise<never> {\n  const results = await Promise.allSettled(\n    paths.map((path) => rm(path, { recursive: true, force: true })),\n  );\n  const failures = results\n    .filter((result) => result.status === \"rejected\")\n    .map((result) => result.reason);\n  if (failures.length)\n    throw new AggregateError(\n      [cause, ...failures],\n      \"Firecracker allocation and cleanup failed; inspect retained temporary resources\",\n    );\n  throw cause;\n}\n"]}

package/dist/providers/firecracker.types.d.ts

@@ -21,6 +21,16 @@ export interface FirecrackerOptions {
     readonly memoryMb?: number;
     readonly bootDeadlineMs?: number;
     readonly variables?: Variables;
+    readonly jailer?: {
+        readonly binary: string;
+        readonly directory: string;
+        readonly cgroup: string;
+        readonly uid: number;
+        readonly gid: number;
+        readonly cpuQuotaUs: number;
+        readonly memoryMaxMb: number;
+        readonly processes: number;
+    };
 }
 export interface FirecrackerRuntime {
     readonly options: FirecrackerOptions;
@@ -34,3 +44,9 @@ export interface FirecrackerMachine {
     readonly isClosed: () => boolean;
     release(): Promise<void>;
 }
+export interface FirecrackerLaunch {
+    readonly binary: string;
+    readonly arguments: readonly string[];
+    stop(): Promise<void>;
+    cleanup(): Promise<void>;
+}

package/dist/providers/firecracker.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.types.js","sourceRoot":"","sources":["../../src/providers/firecracker.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Variables } from \"../domain/command.types.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\n\nexport interface FirecrackerOptions {\n  readonly binary: string;\n  readonly kernel: string;\n  readonly rootfs: string;\n  readonly tap: string;\n  readonly guestMac: string;\n  readonly bootArgs: string;\n  readonly ssh: {\n    readonly host: string;\n    readonly user: string;\n    readonly identity: string;\n    readonly knownHosts: string;\n    readonly port?: number;\n    readonly binary?: string;\n  };\n  readonly root?: string;\n  readonly home: string;\n  readonly cpus?: number;\n  readonly memoryMb?: number;\n  readonly bootDeadlineMs?: number;\n  readonly variables?: Variables;\n}\n\nexport interface FirecrackerRuntime {\n  readonly options: FirecrackerOptions;\n  readonly root: string;\n  readonly variables: Variables;\n  readonly isClosed: () => boolean;\n  readonly executor: Executor;\n}\n\nexport interface FirecrackerMachine {\n  readonly directory: string;\n  readonly isClosed: () => boolean;\n  release(): Promise<void>;\n}\n"]}
+{"version":3,"file":"firecracker.types.js","sourceRoot":"","sources":["../../src/providers/firecracker.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Variables } from \"../domain/command.types.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\n\nexport interface FirecrackerOptions {\n  readonly binary: string;\n  readonly kernel: string;\n  readonly rootfs: string;\n  readonly tap: string;\n  readonly guestMac: string;\n  readonly bootArgs: string;\n  readonly ssh: {\n    readonly host: string;\n    readonly user: string;\n    readonly identity: string;\n    readonly knownHosts: string;\n    readonly port?: number;\n    readonly binary?: string;\n  };\n  readonly root?: string;\n  readonly home: string;\n  readonly cpus?: number;\n  readonly memoryMb?: number;\n  readonly bootDeadlineMs?: number;\n  readonly variables?: Variables;\n  readonly jailer?: {\n    readonly binary: string;\n    readonly directory: string;\n    readonly cgroup: string;\n    readonly uid: number;\n    readonly gid: number;\n    readonly cpuQuotaUs: number;\n    readonly memoryMaxMb: number;\n    readonly processes: number;\n  };\n}\n\nexport interface FirecrackerRuntime {\n  readonly options: FirecrackerOptions;\n  readonly root: string;\n  readonly variables: Variables;\n  readonly isClosed: () => boolean;\n  readonly executor: Executor;\n}\n\nexport interface FirecrackerMachine {\n  readonly directory: string;\n  readonly isClosed: () => boolean;\n  release(): Promise<void>;\n}\n\nexport interface FirecrackerLaunch {\n  readonly binary: string;\n  readonly arguments: readonly string[];\n  stop(): Promise<void>;\n  cleanup(): Promise<void>;\n}\n"]}

package/dist/providers/vercel-network.js

@@ -3,7 +3,7 @@ import { invariant } from "../domain/errors.js";
 export function vercelNetworkPolicy(options) {
     const policy = validateEgress(options.egress);
     if (!policy)
-        return options.create?.networkPolicy;
+        return structuredClone(options.create?.networkPolicy);
     invariant(options.create?.networkPolicy === undefined, "Use egress or create.networkPolicy, not both");
     if (policy.mode === "deny-all")
         return "deny-all";

package/dist/providers/vercel-network.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-network.js","sourceRoot":"","sources":["../../src/providers/vercel-network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,MAAM,UAAU,mBAAmB,CACjC,OAAsB;IAEtB,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC;IAClD,SAAS,CACP,OAAO,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS,EAC3C,8CAA8C,CAC/C,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE;YACP,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;SACpC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { validateEgress } from \"../domain/egress.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport function vercelNetworkPolicy(\n  options: VercelOptions,\n): NonNullable<VercelOptions[\"create\"]>[\"networkPolicy\"] {\n  const policy = validateEgress(options.egress);\n  if (!policy) return options.create?.networkPolicy;\n  invariant(\n    options.create?.networkPolicy === undefined,\n    \"Use egress or create.networkPolicy, not both\",\n  );\n  if (policy.mode === \"deny-all\") return \"deny-all\";\n  return {\n    allow: [...(policy.domains ?? [])],\n    subnets: {\n      allow: [...(policy.allowCidrs ?? [])],\n      deny: [...(policy.denyCidrs ?? [])],\n    },\n  };\n}\n"]}
+{"version":3,"file":"vercel-network.js","sourceRoot":"","sources":["../../src/providers/vercel-network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,MAAM,UAAU,mBAAmB,CACjC,OAAsB;IAEtB,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACnE,SAAS,CACP,OAAO,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS,EAC3C,8CAA8C,CAC/C,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE;YACP,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;SACpC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { validateEgress } from \"../domain/egress.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport function vercelNetworkPolicy(\n  options: VercelOptions,\n): NonNullable<VercelOptions[\"create\"]>[\"networkPolicy\"] {\n  const policy = validateEgress(options.egress);\n  if (!policy) return structuredClone(options.create?.networkPolicy);\n  invariant(\n    options.create?.networkPolicy === undefined,\n    \"Use egress or create.networkPolicy, not both\",\n  );\n  if (policy.mode === \"deny-all\") return \"deny-all\";\n  return {\n    allow: [...(policy.domains ?? [])],\n    subnets: {\n      allow: [...(policy.allowCidrs ?? [])],\n      deny: [...(policy.denyCidrs ?? [])],\n    },\n  };\n}\n"]}

package/dist/providers/vercel.js

@@ -8,6 +8,7 @@ import { vercelDirectory } from "./vercel-directory.js";
 import { vercelFiles } from "./vercel-files.js";
 export function vercelSandboxProvider(options = {}, connect = async (config) => (await import("@vercel/sandbox")).Sandbox.create(config)) {
     const networkPolicy = vercelNetworkPolicy(options);
+    const create = { ...options.create };
     return {
         name: "vercel",
         placement: "remote",
@@ -15,9 +16,11 @@ export function vercelSandboxProvider(options = {}, connect = async (config) =>
         async acquire(context) {
             context.signal?.throwIfAborted();
             const sandbox = await connect({
-                ...options.create,
-                ...(networkPolicy === undefined ? {} : { networkPolicy }),
-                env: { ...options.create?.env, ...context.variables },
+                ...create,
+                ...(networkPolicy === undefined
+                    ? {}
+                    : { networkPolicy: structuredClone(networkPolicy) }),
+                env: { ...create.env, ...context.variables },
             });
             const root = options.root ?? cloudRoots.vercel;
             let closed = false;

package/dist/providers/vercel.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/providers/vercel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKhD,MAAM,UAAU,qBAAqB,CACnC,UAAyB,EAAE,EAC3B,UAAiE,KAAK,EACpE,MAAM,EACN,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IAE7D,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,GAAG,OAAO,CAAC,MAAM;gBACjB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC;YAC/C,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,SAAoC,CAAC;YACzC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,OAAO;iBACnB,IAAI,EAAE;iBACN,IAAI,CAAC,GAAG,EAAE;gBACT,MAAM,GAAG,IAAI,CAAC;gBACd,UAAU,EAAE,CAAC;YACf,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACR,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACrC,IAAI,GAAG,CACL,MAAM,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAChE,CAAC,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,kDAAkD,CACnD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG;gBACZ,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,aAAa,CAAC;oBACpB,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,OAAO;oBACP,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,WAAW,CAAC,OAAO,CAAC;gBACvB,OAAO;aACR,CAAC;YACF,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Sandbox } from \"@vercel/sandbox\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { fileBatches } from \"./file-batches.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cloudRoots } from \"./cloud.constants.ts\";\nimport { vercelCommand } from \"./vercel-command.ts\";\nimport { vercelNetworkPolicy } from \"./vercel-network.ts\";\nimport { vercelDirectory } from \"./vercel-directory.ts\";\nimport { vercelFiles } from \"./vercel-files.ts\";\nimport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport function vercelSandboxProvider(\n  options: VercelOptions = {},\n  connect: (config: VercelOptions[\"create\"]) => Promise<Sandbox> = async (\n    config,\n  ) => (await import(\"@vercel/sandbox\")).Sandbox.create(config),\n): SandboxProvider {\n  const networkPolicy = vercelNetworkPolicy(options);\n  return {\n    name: \"vercel\",\n    placement: \"remote\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const sandbox = await connect({\n        ...options.create,\n        ...(networkPolicy === undefined ? {} : { networkPolicy }),\n        env: { ...options.create?.env, ...context.variables },\n      });\n      const root = options.root ?? cloudRoots.vercel;\n      let closed = false;\n      let releasing: Promise<void> | undefined;\n      let unregister = () => {};\n      const release = () =>\n        (releasing ??= sandbox\n          .stop()\n          .then(() => {\n            closed = true;\n            unregister();\n          })\n          .catch((error) => {\n            releasing = undefined;\n            throw error;\n          }));\n      unregister = registerCleanup(release);\n      let home: string;\n      try {\n        await vercelDirectory(sandbox, root);\n        home = (\n          await (await sandbox.runCommand(\"printenv\", [\"HOME\"])).stdout()\n        ).trim();\n        if (!home.startsWith(\"/\"))\n          throw new OutpostError(\n            \"provider\",\n            \"Cloud sandbox returned an invalid home directory\",\n          );\n      } catch (cause) {\n        await release();\n        throw cause;\n      }\n      const lease = {\n        root,\n        home,\n        invoke: vercelCommand({\n          sandbox,\n          root,\n          options,\n          context,\n          isClosed: () => closed,\n        }),\n        ...vercelFiles(sandbox),\n        release,\n      };\n      return { ...lease, fileTransfers: fileBatches(lease) };\n    },\n  };\n}\n\nexport type { EgressPolicy } from \"../domain/egress.types.ts\";\n"]}
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/providers/vercel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKhD,MAAM,UAAU,qBAAqB,CACnC,UAAyB,EAAE,EAC3B,UAAiE,KAAK,EACpE,MAAM,EACN,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IAE7D,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAyC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,GAAG,MAAM;gBACT,GAAG,CAAC,aAAa,KAAK,SAAS;oBAC7B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtD,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;aAC7C,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC;YAC/C,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,SAAoC,CAAC;YACzC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,SAAS,KAAK,OAAO;iBACnB,IAAI,EAAE;iBACN,IAAI,CAAC,GAAG,EAAE;gBACT,MAAM,GAAG,IAAI,CAAC;gBACd,UAAU,EAAE,CAAC;YACf,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC,CAAC;YACR,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACrC,IAAI,GAAG,CACL,MAAM,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAChE,CAAC,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBACvB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,kDAAkD,CACnD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG;gBACZ,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,aAAa,CAAC;oBACpB,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,OAAO;oBACP,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,WAAW,CAAC,OAAO,CAAC;gBACvB,OAAO;aACR,CAAC;YACF,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Sandbox } from \"@vercel/sandbox\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport { fileBatches } from \"./file-batches.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { cloudRoots } from \"./cloud.constants.ts\";\nimport { vercelCommand } from \"./vercel-command.ts\";\nimport { vercelNetworkPolicy } from \"./vercel-network.ts\";\nimport { vercelDirectory } from \"./vercel-directory.ts\";\nimport { vercelFiles } from \"./vercel-files.ts\";\nimport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport type { VercelOptions } from \"./vercel.types.ts\";\n\nexport function vercelSandboxProvider(\n  options: VercelOptions = {},\n  connect: (config: VercelOptions[\"create\"]) => Promise<Sandbox> = async (\n    config,\n  ) => (await import(\"@vercel/sandbox\")).Sandbox.create(config),\n): SandboxProvider {\n  const networkPolicy = vercelNetworkPolicy(options);\n  const create: NonNullable<VercelOptions[\"create\"]> = { ...options.create };\n  return {\n    name: \"vercel\",\n    placement: \"remote\",\n    variables: { ...options.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const sandbox = await connect({\n        ...create,\n        ...(networkPolicy === undefined\n          ? {}\n          : { networkPolicy: structuredClone(networkPolicy) }),\n        env: { ...create.env, ...context.variables },\n      });\n      const root = options.root ?? cloudRoots.vercel;\n      let closed = false;\n      let releasing: Promise<void> | undefined;\n      let unregister = () => {};\n      const release = () =>\n        (releasing ??= sandbox\n          .stop()\n          .then(() => {\n            closed = true;\n            unregister();\n          })\n          .catch((error) => {\n            releasing = undefined;\n            throw error;\n          }));\n      unregister = registerCleanup(release);\n      let home: string;\n      try {\n        await vercelDirectory(sandbox, root);\n        home = (\n          await (await sandbox.runCommand(\"printenv\", [\"HOME\"])).stdout()\n        ).trim();\n        if (!home.startsWith(\"/\"))\n          throw new OutpostError(\n            \"provider\",\n            \"Cloud sandbox returned an invalid home directory\",\n          );\n      } catch (cause) {\n        await release();\n        throw cause;\n      }\n      const lease = {\n        root,\n        home,\n        invoke: vercelCommand({\n          sandbox,\n          root,\n          options,\n          context,\n          isClosed: () => closed,\n        }),\n        ...vercelFiles(sandbox),\n        release,\n      };\n      return { ...lease, fileTransfers: fileBatches(lease) };\n    },\n  };\n}\n\nexport type { EgressPolicy } from \"../domain/egress.types.ts\";\n"]}

package/dist/providers/versions.constants.d.ts

@@ -1,5 +1,7 @@
 export declare const agentVersions: Readonly<{
-    gemini: "0.61.0";
     codex: "0.156.1";
     claude: "2.1.280";
+    copilot: "1.0.88";
+    kimi: "2.1.1";
+    antigravity: "1.2.12";
 }>;

package/dist/providers/versions.constants.js

@@ -1,6 +1,8 @@
 export const agentVersions = Object.freeze({
-    gemini: "0.61.0",
     codex: "0.156.1",
     claude: "2.1.280",
+    copilot: "1.0.88",
+    kimi: "2.1.1",
+    antigravity: "1.2.12",
 });
 //# sourceMappingURL=versions.constants.js.map

package/dist/providers/versions.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"versions.constants.js","sourceRoot":"","sources":["../../src/providers/versions.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC","sourcesContent":["export const agentVersions = Object.freeze({\n  gemini: \"0.61.0\",\n  codex: \"0.156.1\",\n  claude: \"2.1.280\",\n});\n"]}
+{"version":3,"file":"versions.constants.js","sourceRoot":"","sources":["../../src/providers/versions.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,QAAQ;IACjB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,QAAQ;CACtB,CAAC,CAAC","sourcesContent":["export const agentVersions = Object.freeze({\n  codex: \"0.156.1\",\n  claude: \"2.1.280\",\n  copilot: \"1.0.88\",\n  kimi: \"2.1.1\",\n  antigravity: \"1.2.12\",\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elie-laloum/outpost",
-  "version": "5.0.0",
+  "version": "7.0.0",
   "description": "Programmable sandboxes, coding agents and typed workflows.",
   "type": "module",
   "license": "MIT",
@@ -74,8 +74,8 @@
     "test:package": "node scripts/package-smoke.mjs",
     "test:container": "node --test test/container.test.ts",
     "architecture": "node scripts/check-architecture.mjs",
-    "docs:sync": "npm run build && node docs/scripts/sync-preparations.mjs && node docs/scripts/sync-reference.mjs",
-    "docs:check": "node docs/scripts/sync-preparations.mjs --check && node docs/scripts/sync-reference.mjs --check && npm run check --prefix docs",
+    "docs:sync": "npm run build && node docs/scripts/sync-reference.mjs",
+    "docs:check": "node docs/scripts/sync-reference.mjs --check && npm run check --prefix docs",
     "docs:dev": "npm run dev --prefix docs",
     "docs:build": "npm run build --prefix docs",
     "docs:test": "npm run test:build --prefix docs && node docs/scripts/check-examples.mjs && node --test docs/scripts/release-channel.test.mjs",

package/dist/adapters/agents/gemini-adapter.d.ts

@@ -1,3 +0,0 @@
-import type { CliHarness } from "../../domain/agent.types.ts";
-import type { GeminiSettings } from "./gemini.types.ts";
-export declare function geminiHarness(settings?: GeminiSettings): CliHarness;

package/dist/adapters/agents/gemini-adapter.js

@@ -1,34 +0,0 @@
-import { authenticationCommand } from "./authentication.js";
-import { geminiEvents } from "./gemini-events.js";
-import { geminiRequest } from "./gemini-request.js";
-import { geminiModelSupport } from "./model-support.constants.js";
-import { harnessSettings, supportModel } from "./model-support.js";
-function bindGemini(settings) {
-    supportModel(geminiModelSupport, settings.model);
-    return Object.freeze({
-        name: "gemini",
-        authenticate: authenticationCommand("gemini", settings.authentication),
-        bootstrap: "gemini",
-        resumable: false,
-        capture: false,
-        requiresFinishedEvent: true,
-        variables: Object.freeze({ ...settings.variables }),
-        request: (input) => geminiRequest(settings, input),
-        events: geminiEvents,
-    });
-}
-export function geminiHarness(settings = {}) {
-    harnessSettings(settings);
-    const configured = Object.freeze({
-        ...settings,
-        variables: Object.freeze({ ...settings.variables }),
-    });
-    return Object.freeze({
-        kind: "cli",
-        bind: (model) => bindGemini({
-            ...configured,
-            ...(model === undefined ? {} : { model }),
-        }),
-    });
-}
-//# sourceMappingURL=gemini-adapter.js.map

package/dist/adapters/agents/gemini-adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gemini-adapter.js","sourceRoot":"","sources":["../../../src/adapters/agents/gemini-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGnE,SAAS,UAAU,CAAC,QAA+B;IACjD,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC;QACtE,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClD,MAAM,EAAE,YAAY;KACE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAA2B,EAAE;IACzD,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,GAAG,QAAQ;QACX,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,CAAC,KAAkB,EAAE,EAAE,CAC3B,UAAU,CAAC;YACT,GAAG,UAAU;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { AgentModel } from \"../../domain/model.types.ts\";\nimport { authenticationCommand } from \"./authentication.ts\";\nimport type { AgentAdapter, CliHarness } from \"../../domain/agent.types.ts\";\nimport { geminiEvents } from \"./gemini-events.ts\";\nimport { geminiRequest } from \"./gemini-request.ts\";\nimport type { GeminiSettings } from \"./gemini.types.ts\";\nimport { geminiModelSupport } from \"./model-support.constants.ts\";\nimport { harnessSettings, supportModel } from \"./model-support.ts\";\nimport type { Bound } from \"./settings.types.ts\";\n\nfunction bindGemini(settings: Bound<GeminiSettings>): AgentAdapter {\n  supportModel(geminiModelSupport, settings.model);\n  return Object.freeze({\n    name: \"gemini\",\n    authenticate: authenticationCommand(\"gemini\", settings.authentication),\n    bootstrap: \"gemini\",\n    resumable: false,\n    capture: false,\n    requiresFinishedEvent: true,\n    variables: Object.freeze({ ...settings.variables }),\n    request: (input) => geminiRequest(settings, input),\n    events: geminiEvents,\n  } satisfies AgentAdapter);\n}\n\nexport function geminiHarness(settings: GeminiSettings = {}): CliHarness {\n  harnessSettings(settings);\n  const configured = Object.freeze({\n    ...settings,\n    variables: Object.freeze({ ...settings.variables }),\n  });\n  return Object.freeze({\n    kind: \"cli\",\n    bind: (model?: AgentModel) =>\n      bindGemini({\n        ...configured,\n        ...(model === undefined ? {} : { model }),\n      }),\n  });\n}\n"]}

package/dist/adapters/agents/gemini-diagnostics.d.ts

@@ -1,2 +0,0 @@
-import type { AgentCliDiagnostic } from "./cli-diagnostics.types.ts";
-export declare function geminiDiagnostics(): readonly AgentCliDiagnostic[];

package/dist/adapters/agents/gemini-diagnostics.js

@@ -1,15 +0,0 @@
-import { geminiRequest } from "./gemini-request.js";
-export function geminiDiagnostics() {
-    const command = geminiRequest({}, {});
-    const args = command.arguments ?? [];
-    return [
-        {
-            mode: "start",
-            usage: "gemini",
-            options: args.filter((argument) => argument.startsWith("--")),
-            // Gemini omits supplied options from its help output.
-            command: { ...command, arguments: ["--help"] },
-        },
-    ];
-}
-//# sourceMappingURL=gemini-diagnostics.js.map

package/dist/adapters/agents/gemini-diagnostics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gemini-diagnostics.js","sourceRoot":"","sources":["../../../src/adapters/agents/gemini-diagnostics.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACrC,OAAO;QACL;YACE,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC7D,sDAAsD;YACtD,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE;SAC/C;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentCliDiagnostic } from \"./cli-diagnostics.types.ts\";\nimport { geminiRequest } from \"./gemini-request.ts\";\n\nexport function geminiDiagnostics(): readonly AgentCliDiagnostic[] {\n  const command = geminiRequest({}, {});\n  const args = command.arguments ?? [];\n  return [\n    {\n      mode: \"start\",\n      usage: \"gemini\",\n      options: args.filter((argument) => argument.startsWith(\"--\")),\n      // Gemini omits supplied options from its help output.\n      command: { ...command, arguments: [\"--help\"] },\n    },\n  ];\n}\n"]}

package/dist/adapters/agents/gemini-events.d.ts

@@ -1,2 +0,0 @@
-import type { AgentEvent } from "../../domain/agent.types.ts";
-export declare function geminiEvents(line: string): AgentEvent[];

package/dist/adapters/agents/gemini-events.js

@@ -1,50 +0,0 @@
-import { decodeLine } from "./event-decoder.js";
-import { asRecord, numberOrZero } from "./protocol.js";
-function message(event) {
-    if (event.role !== "assistant" || typeof event.content !== "string")
-        return [];
-    return [{ kind: "text", text: event.content }];
-}
-function result(event) {
-    const events = [];
-    if (event.stats) {
-        const stats = asRecord(event.stats);
-        events.push({
-            kind: "usage",
-            tokens: {
-                input: numberOrZero(stats.input_tokens),
-                cached: numberOrZero(stats.cached),
-                output: numberOrZero(stats.output_tokens),
-            },
-        });
-    }
-    if (event.status === "success")
-        events.push({ kind: "finished" });
-    if (event.status === "error")
-        events.push({
-            kind: "failure",
-            message: String(asRecord(event.error).message ?? "Gemini failed"),
-        });
-    return events;
-}
-export function geminiEvents(line) {
-    return decodeLine(line, {
-        init: (event) => typeof event.session_id === "string"
-            ? [{ kind: "conversation", id: event.session_id }]
-            : [],
-        message,
-        tool_use: (event) => typeof event.tool_name === "string"
-            ? [{ kind: "tool", name: event.tool_name, input: event.parameters }]
-            : [],
-        error: (event) => typeof event.message === "string"
-            ? [
-                {
-                    kind: event.severity === "warning" ? "warning" : "failure",
-                    message: event.message,
-                },
-            ]
-            : [],
-        result,
-    });
-}
-//# sourceMappingURL=gemini-events.js.map

package/dist/adapters/agents/gemini-events.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gemini-events.js","sourceRoot":"","sources":["../../../src/adapters/agents/gemini-events.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGvD,SAAS,OAAO,CAAC,KAAqB;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjE,OAAO,EAAE,CAAC;IACZ,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CAAC,KAAqB;IACnC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,OAAO;YACb,MAAM,EAAE;gBACN,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACvC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC;gBAClC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,eAAe,CAAC;SAClE,CAAC,CAAC;IACL,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CACd,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;YAClC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YAClD,CAAC,CAAC,EAAE;QACR,OAAO;QACP,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACjC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACpE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YAC/B,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB;aACF;YACH,CAAC,CAAC,EAAE;QACR,MAAM;KACP,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { AgentEvent } from \"../../domain/agent.types.ts\";\nimport { decodeLine } from \"./event-decoder.ts\";\nimport { asRecord, numberOrZero } from \"./protocol.ts\";\nimport type { ProtocolRecord } from \"./protocol.types.ts\";\n\nfunction message(event: ProtocolRecord): AgentEvent[] {\n  if (event.role !== \"assistant\" || typeof event.content !== \"string\")\n    return [];\n  return [{ kind: \"text\", text: event.content }];\n}\n\nfunction result(event: ProtocolRecord): AgentEvent[] {\n  const events: AgentEvent[] = [];\n  if (event.stats) {\n    const stats = asRecord(event.stats);\n    events.push({\n      kind: \"usage\",\n      tokens: {\n        input: numberOrZero(stats.input_tokens),\n        cached: numberOrZero(stats.cached),\n        output: numberOrZero(stats.output_tokens),\n      },\n    });\n  }\n  if (event.status === \"success\") events.push({ kind: \"finished\" });\n  if (event.status === \"error\")\n    events.push({\n      kind: \"failure\",\n      message: String(asRecord(event.error).message ?? \"Gemini failed\"),\n    });\n  return events;\n}\n\nexport function geminiEvents(line: string): AgentEvent[] {\n  return decodeLine(line, {\n    init: (event) =>\n      typeof event.session_id === \"string\"\n        ? [{ kind: \"conversation\", id: event.session_id }]\n        : [],\n    message,\n    tool_use: (event) =>\n      typeof event.tool_name === \"string\"\n        ? [{ kind: \"tool\", name: event.tool_name, input: event.parameters }]\n        : [],\n    error: (event) =>\n      typeof event.message === \"string\"\n        ? [\n            {\n              kind: event.severity === \"warning\" ? \"warning\" : \"failure\",\n              message: event.message,\n            },\n          ]\n        : [],\n    result,\n  });\n}\n"]}

package/dist/adapters/agents/gemini-request.js

@@ -1,23 +0,0 @@
-import { invariant } from "../../domain/errors.js";
-export function geminiRequest(settings, input) {
-    invariant(!input.continuation, "Gemini does not support continuation or fork in Outpost");
-    const args = [];
-    if (settings.model)
-        args.push("--model", settings.model.name);
-    const approvalMode = settings.approvalMode ?? (input.interactive ? "default" : "yolo");
-    args.push("--approval-mode", approvalMode);
-    if (!input.interactive && approvalMode === "yolo")
-        args.push("--skip-trust");
-    if (!input.interactive)
-        args.push("--output-format", "stream-json");
-    if (input.interactive && input.text !== undefined)
-        args.push("--prompt-interactive", input.text);
-    return {
-        executable: "gemini",
-        arguments: args,
-        ...(input.interactive
-            ? { interactive: true }
-            : { stdin: input.text ?? "" }),
-    };
-}
-//# sourceMappingURL=gemini-request.js.map

package/dist/adapters/agents/gemini-request.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gemini-request.js","sourceRoot":"","sources":["../../../src/adapters/agents/gemini-request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAInD,MAAM,UAAU,aAAa,CAC3B,QAA+B,EAC/B,KAAiB;IAEjB,SAAS,CACP,CAAC,KAAK,CAAC,YAAY,EACnB,yDAAyD,CAC1D,CAAC;IACF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,YAAY,GAChB,QAAQ,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,YAAY,KAAK,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAC/C,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;YACvB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentInput } from \"../../domain/agent.types.ts\";\nimport type { Command } from \"../../domain/command.types.ts\";\nimport { invariant } from \"../../domain/errors.ts\";\nimport type { GeminiSettings } from \"./gemini.types.ts\";\nimport type { Bound } from \"./settings.types.ts\";\n\nexport function geminiRequest(\n  settings: Bound<GeminiSettings>,\n  input: AgentInput,\n): Command {\n  invariant(\n    !input.continuation,\n    \"Gemini does not support continuation or fork in Outpost\",\n  );\n  const args: string[] = [];\n  if (settings.model) args.push(\"--model\", settings.model.name);\n  const approvalMode =\n    settings.approvalMode ?? (input.interactive ? \"default\" : \"yolo\");\n  args.push(\"--approval-mode\", approvalMode);\n  if (!input.interactive && approvalMode === \"yolo\") args.push(\"--skip-trust\");\n  if (!input.interactive) args.push(\"--output-format\", \"stream-json\");\n  if (input.interactive && input.text !== undefined)\n    args.push(\"--prompt-interactive\", input.text);\n  return {\n    executable: \"gemini\",\n    arguments: args,\n    ...(input.interactive\n      ? { interactive: true }\n      : { stdin: input.text ?? \"\" }),\n  };\n}\n"]}

package/dist/adapters/agents/gemini.types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=gemini.types.js.map

package/dist/adapters/agents/gemini.types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gemini.types.js","sourceRoot":"","sources":["../../../src/adapters/agents/gemini.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AgentAuthentication } from \"../../domain/agent.types.ts\";\nimport type { Variables } from \"../../domain/command.types.ts\";\n\nexport interface GeminiSettings {\n  readonly authentication?: AgentAuthentication;\n  readonly variables?: Variables;\n  readonly approvalMode?: \"default\" | \"auto_edit\" | \"yolo\" | \"plan\";\n}\n"]}

package/dist/infrastructure/artifact-store.d.ts

@@ -1,3 +0,0 @@
-import type { ArtifactStore } from "../domain/artifact.types.ts";
-import type { FileArtifactStoreOptions } from "./artifact-store.types.ts";
-export declare function fileArtifactStore(options: FileArtifactStoreOptions): ArtifactStore;