@multiplayer-app/sandbox 6.0.0-sandbox-docker-image.0 → 7.0.0

package/dist/prepare-images.d.ts

@@ -0,0 +1,14 @@
+import type { WorkerConfig } from './config';
+export declare function artifactImageLocation(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Materialize remotely published images before engine detection.
+ *
+ * S3_BUCKET_ARTIFACTS is the artifact bucket name. The worker derives the
+ * environment/version and runner prefix; pullImages appends
+ * <arch>/<stack>/<file>.
+ * Registry-backed Docker images are pulled whenever the configured prefix is
+ * a qualified repository (contains a slash), while local development prefixes
+ * continue to require locally built images.
+ */
+export declare function prepareWorkerImages(config: WorkerConfig, env?: NodeJS.ProcessEnv): Promise<void>;
+//# sourceMappingURL=prepare-images.d.ts.map

package/dist/prepare-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-images.d.ts","sourceRoot":"","sources":["../src/prepare-images.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAM5C,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAU9F;AAyBD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/services/serial-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serial-relay.d.ts","sourceRoot":"","sources":["../../src/services/serial-relay.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,oEAAoE;AACpE,qBAAa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,YAAY,CAAmD;gBAGpD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM;IAGjC,OAAO,IAAI,IAAI;IAmBf,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,WAAW;IAMnB,OAAO,IAAI,IAAI;CAMhB"}
+{"version":3,"file":"serial-relay.d.ts","sourceRoot":"","sources":["../../src/services/serial-relay.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,oEAAoE;AACpE,qBAAa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,YAAY,CAAmD;gBAGpD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM;IAGjC,OAAO,IAAI,IAAI;IAmBf,OAAO,CAAC,UAAU;IAkBlB,OAAO,CAAC,WAAW;IAUnB,OAAO,IAAI,IAAI;CAQhB"}

package/dist/services/vnc-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vnc-relay.d.ts","sourceRoot":"","sources":["../../src/services/vnc-relay.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAe9C,sFAAsF;AACtF,qBAAa,QAAQ;IAOjB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,IAAI,CAAsD;IAClE,OAAO,CAAC,QAAQ,CAA8C;IAC9D,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,UAAU,CAAiD;gBAGhD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;IAGjC,KAAK,IAAI,IAAI;IAwDb,OAAO,IAAI,IAAI;CAQhB"}
+{"version":3,"file":"vnc-relay.d.ts","sourceRoot":"","sources":["../../src/services/vnc-relay.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAqB9C,sFAAsF;AACtF,qBAAa,QAAQ;IAOjB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,IAAI,CAAsD;IAClE,OAAO,CAAC,QAAQ,CAA8C;IAC9D,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,UAAU,CAAiD;gBAGhD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;IAGjC,KAAK,IAAI,IAAI;IA2Eb,OAAO,IAAI,IAAI;CAUhB"}

package/dist/socket-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"socket-client.d.ts","sourceRoot":"","sources":["../src/socket-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAM,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAYlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE5C,OAAO,KAAK,EAAE,mBAAmB,EAAU,MAAM,YAAY,CAAA;AAkF7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAuD5F"}
+{"version":3,"file":"socket-client.d.ts","sourceRoot":"","sources":["../src/socket-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAM,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAYlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE5C,OAAO,KAAK,EAAE,mBAAmB,EAAU,MAAM,YAAY,CAAA;AAsH7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CA6F5F"}

package/dist/vendor/builder-types/access.d.ts

@@ -17,7 +17,7 @@ export interface GatewayAccessUpdateRequest {
  * check resolve the *same* session by ID, so a mismatched prefix means each service reads a
  * different Redis key and the shared session silently stops working. The shared session
  * relies on the cookie reaching both services' hosts, which requires them to live under a
- * common registrable parent domain (AUTH_COOKIE_DOMAIN) — e.g. app.<domain> and
+ * common registrable parent domain (COOKIE_DOMAIN) — e.g. app.<domain> and
  * <id>.vm.<domain> sharing Domain=.<domain>. Browsers do NOT share cookies across
  * *.localhost, so local dev uses *.lvh.me (public DNS → 127.0.0.1) instead.
  */

package/dist/vendor/builder-types/deployment.d.ts

@@ -0,0 +1,58 @@
+import type { GatewayAccessConfig } from './access';
+import type { VmCreateRequest, VmRecord, VmRunMode, VmState } from './vm';
+/**
+ * A published app: a stable identity (`slug`) that owns a persistent gateway domain
+ * (`<slug>.apps.<domain>`) across redeploys. Everything else is exactly what a plain
+ * VmRecord already tracks (stack, resources, env, state, ...) — a deployment is just a
+ * VM instance with a slug and a place in that slug's history.
+ */
+export interface DeploymentRecord extends VmRecord {
+    /**
+     * Stable, user-chosen identity shared by every instance created for the same app — this
+     * (not vmId) is what the gateway resolves to a domain and what redeploys keep. Exactly one
+     * record per slug has `active: true` at a time; older ones are kept as read-only history.
+     */
+    slug: string;
+    /** True for the instance currently owning `slug`'s domain/routing; false once superseded by a redeploy. */
+    active: boolean;
+}
+export interface DeploymentCreateRequest extends VmCreateRequest {
+    /** Stable identity for this app — DNS-label-safe, becomes `<slug>.apps.<domain>`. Immutable across redeploys. */
+    slug: string;
+}
+/** Keyed by slug (not vmId) — the gateway only ever needs "the active instance for this slug." */
+export declare const DEPLOYMENT_REDIS_KEY_PREFIX = "deployment:";
+/**
+ * Idle-liveness marker: the gateway SETEX's `<prefix><slug>` on every proxied request to a
+ * running 'service' deployment (TTL = DEPLOYMENT_IDLE_TIMEOUT_SECONDS); deployment-reaper.service.ts
+ * stops the instance once the key expires. Never touched for 'job' deployments — see
+ * deployment.service.ts's class doc comment.
+ */
+export declare const DEPLOYMENT_ACTIVE_KEY_PREFIX = "deployment:active:";
+export interface DeploymentRegistryEntry {
+    vmId: string;
+    workerId: string;
+    state: VmState;
+    /**
+     * Lets the gateway tell 'job' and 'service' deployments apart without a Mongo round trip:
+     * a 'job' always runs fresh (CGI-style) and never proxies a live request, while a 'service'
+     * only cold-starts on a state miss and otherwise gets the ordinary PROXY_HTTP treatment.
+     * See routes/proxy/proxy.ts.
+     */
+    runMode: VmRunMode;
+    access?: GatewayAccessConfig;
+}
+/**
+ * The gateway's own view of the HTTP request that triggered a cold start — only meaningful
+ * for `runMode: 'job'` deployments, where every hit runs the entrypoint fresh (CGI-style)
+ * and the request is what the script gets to react to. Ignored for 'service' deployments,
+ * which get the ordinary PROXY_HTTP treatment once running.
+ */
+export interface DeploymentInvocationRequest {
+    method: string;
+    path: string;
+    headers: Record<string, string>;
+    /** Raw body, base64-encoded (may be binary) — empty/absent for bodyless requests. */
+    body?: string;
+}
+//# sourceMappingURL=deployment.d.ts.map

package/dist/vendor/builder-types/deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../src/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,gBAAiB,SAAQ,QAAQ;IAChD;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,2GAA2G;IAC3G,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,iHAAiH;IACjH,IAAI,EAAE,MAAM,CAAA;CACb;AAED,kGAAkG;AAClG,eAAO,MAAM,2BAA2B,gBAAgB,CAAA;AAExD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAA;AAEhE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,OAAO,EAAE,SAAS,CAAA;IAClB,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAA;CACd"}

package/dist/vendor/builder-types/events.d.ts

@@ -1,7 +1,9 @@
-import type { VmAction } from './vm';
+import type { VmAction, VmRunResult } from './vm';
 /** Events exchanged on the worker socket (sandbox side listens, worker side emits — and vice versa). */
 export declare const WorkerEvent: {
     readonly HEARTBEAT: "worker:heartbeat";
+    readonly VM_RUN_EXITED: "vm:run-exited";
+    readonly ASSIGNED_ID: "worker:assigned-id";
     readonly REATTACH: "worker:reattach";
     readonly VM_CREATE: "vm:create";
     readonly VM_PAUSE: "vm:pause";
@@ -77,4 +79,7 @@ export interface TerminalInputPayload {
     vmId: string;
     data: string;
 }
+export interface VmRunExitedPayload extends VmRunResult {
+    vmId: string;
+}
 //# sourceMappingURL=events.d.ts.map

package/dist/vendor/builder-types/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,wGAAwG;AACxG,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;CAkCd,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAE5E,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAKrD,CAAA;AAID,sFAAsF;AACtF,eAAO,MAAM,YAAY;;;;;;;;CAaf,CAAA;AAIV,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;IACT,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,KAAK,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;IACT,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;IACT,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,MAAM,CAAA;AAIjD,wGAAwG;AACxG,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;CA0Cd,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAE5E,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAKrD,CAAA;AAID,sFAAsF;AACtF,eAAO,MAAM,YAAY;;;;;;;;CAaf,CAAA;AAIV,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;IACT,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,KAAK,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;IACT,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;IACT,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,IAAI,EAAE,MAAM,CAAA;CACb"}

package/dist/vendor/builder-types/index.d.ts

@@ -5,6 +5,7 @@ export type HealthStatus = {
 };
 export * from './worker';
 export * from './vm';
+export * from './deployment';
 export * from './access';
 export * from './events';
 export * from './release';

package/dist/vendor/builder-types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,cAAc,UAAU,CAAA;AACxB,cAAc,MAAM,CAAA;AACpB,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,cAAc,UAAU,CAAA;AACxB,cAAc,MAAM,CAAA;AACpB,cAAc,cAAc,CAAA;AAC5B,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA"}

package/dist/vendor/builder-types/release.d.ts

@@ -7,13 +7,14 @@ import type { GatewayAccessConfig } from './access';
  */
 export interface ReleaseRecord {
     releaseId: string;
+    tenantId: string;
     name: string;
     stack: VmStack;
     /** Object key of the artifact zip inside the releases bucket. */
     artifactKey: string;
     /**
      * True once the artifact has been extracted into individual objects under
-     * releaseSitePrefix(releaseId) — only meaningful for stack "static", where the
+     * releasePrefix(tenantId, releaseId) — only meaningful for stack "static", where the
      * gateway serves those objects directly, with no VM involved.
      */
     published: boolean;
@@ -23,6 +24,8 @@ export interface ReleaseRecord {
     createdAt: string;
     updatedAt: string;
 }
+/** S3 object key for a release archive. S3 keys intentionally do not start with "/". */
+export declare function releaseArtifactKey(tenantId: string, releaseId: string): string;
 export interface ReleaseCreateRequest {
     name: string;
     stack: VmStack;
@@ -37,11 +40,12 @@ export interface ReleaseCreateResponse {
     /** Presigned PUT URL to upload the artifact zip; present when artifactKey was not supplied. */
     uploadUrl?: string;
 }
-/** S3 key prefix (no trailing slash) under which a static release's extracted files live. */
-export declare function releaseSitePrefix(releaseId: string): string;
+/** S3 key prefix (no trailing slash) shared by a release archive and its extracted files. */
+export declare function releasePrefix(tenantId: string, releaseId: string): string;
 export declare const RELEASE_REDIS_KEY_PREFIX = "release:";
 /** Mirrored into Redis on publish so the gateway can serve static releases without touching Mongo. */
 export interface ReleaseRegistryEntry {
+    tenantId: string;
     stack: VmStack;
     published: boolean;
     access?: GatewayAccessConfig;

package/dist/vendor/builder-types/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAEnD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,aAAa,CAAA;IACtB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,eAAO,MAAM,wBAAwB,aAAa,CAAA;AAElD,sGAAsG;AACtG,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAA;IACd,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAEnD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,aAAa,CAAA;IACtB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,eAAO,MAAM,wBAAwB,aAAa,CAAA;AAElD,sGAAsG;AACtG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B"}

package/dist/vendor/builder-types/vm.d.ts

@@ -3,7 +3,14 @@ export declare const VM_STACKS: readonly ["generic", "node", "python", "static"]
 export type VmStack = (typeof VM_STACKS)[number];
 export declare const VM_ENGINES: readonly ["mock", "qemu", "firecracker", "docker", "docker-sandbox", "remote", "lambda-microvm", "fargate"];
 export type VmEngine = (typeof VM_ENGINES)[number];
-export type VmState = 'creating' | 'running' | 'pausing' | 'paused' | 'resuming' | 'stopping' | 'stopped' | 'restoring' | 'destroying' | 'error';
+/** 'service': a persistent process the gateway proxies to. 'job': runs its entrypoint once and exits. */
+export declare const VM_RUN_MODES: readonly ["service", "job"];
+export type VmRunMode = (typeof VM_RUN_MODES)[number];
+export type VmState = 'creating' | 'running' | 'pausing' | 'paused' | 'resuming' | 'stopping' | 'stopped' | 'restoring' | 'destroying' | 'error'
+/** Job VM whose entrypoint exited with code 0. See VmRecord.result. */
+ | 'completed'
+/** User-initiated teardown that keeps the record around (e.g. as deployment history) instead of deleting it. */
+ | 'destroyed';
 export declare const VM_ACTIONS: readonly ["pause", "resume", "stop", "restore"];
 export type VmAction = (typeof VM_ACTIONS)[number];
 export interface VmResources {
@@ -24,6 +31,12 @@ export interface VmRecord {
     access?: GatewayAccessConfig;
     resources: VmResources;
     state: VmState;
+    /** 'service' (default) for a persistent proxied process, 'job' for a run-once script. */
+    runMode: VmRunMode;
+    /** Custom environment variables for the guest entrypoint. */
+    env?: Record<string, string>;
+    /** Set once a 'job' VM's entrypoint exits (state becomes 'completed' or 'error'). */
+    result?: VmRunResult;
     /**
      * Opaque, engine-specific data an executor needs to reattach to this VM after a worker
      * restart (e.g. a QEMU QMP socket path, a Fargate task ARN). Sandbox stores it as-is and
@@ -41,6 +54,10 @@ export interface VmCreateRequest {
     engine?: VmEngine;
     /** Release to deploy into the VM: the guest pulls the artifact (presigned URL), unzips, and starts it. */
     releaseId?: string;
+    /** 'service' (default) keeps the entrypoint running and proxied; 'job' runs it once and exits. */
+    runMode?: VmRunMode;
+    /** Custom environment variables for the guest entrypoint. */
+    env?: Record<string, string>;
     resources?: Partial<VmResources>;
 }
 export interface VmExecRequest {
@@ -61,6 +78,16 @@ export interface VmExecResult {
     /** True when the command was killed by the timeout. */
     timedOut: boolean;
 }
+/** Outcome of a 'job' VM's entrypoint running to completion. */
+export interface VmRunResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    /** True when stdout/stderr were cut at the executor's output cap. */
+    truncated: boolean;
+    durationMs: number;
+    finishedAt: string;
+}
 export interface VmFileWrite {
     /** Path relative to the VM workspace root (no leading slash, no traversal). */
     path: string;

package/dist/vendor/builder-types/vm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vm.d.ts","sourceRoot":"","sources":["../src/vm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAEnD,eAAO,MAAM,SAAS,kDAAmD,CAAA;AACzE,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhD,eAAO,MAAM,UAAU,6GAA8G,CAAA;AACrI,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAElD,MAAM,MAAM,OAAO,GACf,UAAU,GACV,SAAS,GACT,SAAS,GACT,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,GACT,WAAW,GACX,YAAY,GACZ,OAAO,CAAA;AAEX,eAAO,MAAM,UAAU,iDAAkD,CAAA;AACzE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAElD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,wFAAwF;IACxF,MAAM,CAAC,EAAE,QAAQ,CAAA;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,SAAS,EAAE,WAAW,CAAA;IACtB,KAAK,EAAE,OAAO,CAAA;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;IACd,oFAAoF;IACpF,MAAM,CAAC,EAAE,QAAQ,CAAA;IACjB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAA;IAClB,uDAAuD;IACvD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,aAAa;IAC5D,MAAM,CAAC,EAAE,CAAC,CAAA;CACX;AAED,eAAO,MAAM,mBAAmB,QAAQ,CAAA;AAExC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B"}
+{"version":3,"file":"vm.d.ts","sourceRoot":"","sources":["../src/vm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAEnD,eAAO,MAAM,SAAS,kDAAmD,CAAA;AACzE,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhD,eAAO,MAAM,UAAU,6GASb,CAAA;AACV,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAElD,yGAAyG;AACzG,eAAO,MAAM,YAAY,6BAA8B,CAAA;AACvD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAErD,MAAM,MAAM,OAAO,GACf,UAAU,GACV,SAAS,GACT,SAAS,GACT,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,GACT,WAAW,GACX,YAAY,GACZ,OAAO;AACT,uEAAuE;GACrE,WAAW;AACb,gHAAgH;GAC9G,WAAW,CAAA;AAEf,eAAO,MAAM,UAAU,iDAAkD,CAAA;AACzE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAElD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,wFAAwF;IACxF,MAAM,CAAC,EAAE,QAAQ,CAAA;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,SAAS,EAAE,WAAW,CAAA;IACtB,KAAK,EAAE,OAAO,CAAA;IACd,yFAAyF;IACzF,OAAO,EAAE,SAAS,CAAA;IAClB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;IACd,oFAAoF;IACpF,MAAM,CAAC,EAAE,QAAQ,CAAA;IACjB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kGAAkG;IAClG,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAA;IAClB,uDAAuD;IACvD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,aAAa;IAC5D,MAAM,CAAC,EAAE,CAAC,CAAA;CACX;AAED,eAAO,MAAM,mBAAmB,QAAQ,CAAA;AAExC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAC7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplayer-app/sandbox",
-  "version": "6.0.0-sandbox-docker-image.0",
+  "version": "7.0.0",
   "description": "Sandbox worker library and CLI (Docker, QEMU, Firecracker, AWS Lambda MicroVM, Fargate)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -35,18 +35,23 @@
   "devDependencies": {
     "@types/node": "^25.8.0",
     "esbuild": "^0.25.12",
+    "nodemon": "3.1.14",
     "typescript": "^6.0.3",
     "@multiplayer-app/builder-types": "0.0.1",
     "@multiplayer-app/logger": "0.0.1"
   },
   "scripts": {
     "build": "tsc --build --force && node scripts/bundle.mjs",
+    "dev": "nodemon --watch src --watch scripts/bundle.mjs --watch package.json --ext ts,mjs,json --exec \"pnpm run build && pnpm run worker:start\"",
     "clean": "rm -rf ./dist tsconfig.tsbuildinfo",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src/**/*.ts --config ../../eslint.config.js",
     "images:build": "bash scripts/build-base-images.sh",
+    "images:publish:local": "bash scripts/publish-base-images-local.sh",
+    "images:upload:local": "SKIP_BUILD=1 bash scripts/publish-base-images-local.sh",
     "docker:build": "docker build -f Dockerfile -t multiplayer-sandbox-worker:local ../..",
     "start": "node dist/cli.js",
+    "worker:start": "node dist/cli.js start",
     "test": "tsc --build --force && node --test 'dist/**/*.test.js'",
     "postversion": "git commit -m \"sandbox v$npm_package_version\" -- package.json && git tag \"sandbox-v$npm_package_version\" && git push && git push --tags"
   }