@namzu/sandbox 1.1.0

package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js

@@ -0,0 +1,201 @@
+/**
+ * Control-plane mTLS dial for the Firecracker backend (additive
+ * `config.controlPlaneMtls`).
+ *
+ * A loopback `https.createServer` with `requestCert + rejectUnauthorized`
+ * (pinned to the test CA) stands in for the orchestrator over the public hop.
+ * It serves the real `POST /sandboxes` + `:delete` routes; the create response
+ * points the agent handle at a unix-socket loopback running the REAL
+ * `agent/agent.cjs`, so the FULL create flow (control-plane POST over mTLS →
+ * vsock readiness fence → exec) runs end to end.
+ *
+ * Proves:
+ *  - with `controlPlaneMtls` injected, the create POST succeeds over mTLS and
+ *    the sandbox round-trips an exec.
+ *  - WITHOUT the client cert (no `controlPlaneMtls`, so the backend uses plain
+ *    `fetch` against the https listener), create is rejected at the TLS layer.
+ */
+import { mkdtempSync, rmSync } from 'node:fs';
+import { createServer as createHttpsServer, request as httpsRequest, } from 'node:https';
+import { createRequire } from 'node:module';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { buildFirecrackerBackend } from '../index.js';
+import { CA_CRT, CLIENT_CRT, CLIENT_KEY, ROGUE_CLIENT_CRT, ROGUE_CLIENT_KEY, SERVER_CRT, SERVER_KEY, } from './fixtures/mtls-pki.js';
+const require_ = createRequire(import.meta.url);
+let workDir;
+let sockPath;
+let agentServer;
+let orchestrator;
+let agent;
+beforeEach(() => {
+    workDir = mkdtempSync(join(tmpdir(), 'fc-cp-mtls-'));
+    sockPath = join(workDir, 'agent.sock');
+    process.env.NAMZU_SANDBOX_WORKSPACE = workDir;
+    delete require_.cache[require_.resolve('../../../../agent/agent.cjs')];
+    agent = require_('../../../../agent/agent.cjs');
+});
+afterEach(async () => {
+    if (orchestrator) {
+        await new Promise((r) => orchestrator?.close(() => r()));
+        orchestrator = undefined;
+    }
+    if (agentServer) {
+        await new Promise((r) => agentServer?.close(() => r()));
+        agentServer = undefined;
+    }
+    rmSync(workDir, { recursive: true, force: true });
+});
+function startAgent() {
+    return new Promise((resolve, reject) => {
+        const s = createServer(agent.handleConnection);
+        s.on('error', reject);
+        s.listen(sockPath, () => resolve(s));
+    });
+}
+/**
+ * A loopback mTLS orchestrator. Requires + verifies a client cert chaining to
+ * the test CA, then serves the control-plane routes: `POST /sandboxes` returns
+ * a unix agent handle, `:delete` returns 204. Records calls so the test can
+ * assert the create round-trip.
+ */
+function startMtlsOrchestrator(handlePath) {
+    const calls = [];
+    return new Promise((resolve, reject) => {
+        const server = createHttpsServer({
+            cert: SERVER_CRT,
+            key: SERVER_KEY,
+            ca: CA_CRT,
+            requestCert: true,
+            rejectUnauthorized: true,
+            minVersion: 'TLSv1.3',
+        }, (req, res) => {
+            const method = req.method ?? 'GET';
+            const url = req.url ?? '/';
+            calls.push({ method, url });
+            // Drain the body, then respond per route.
+            req.on('data', () => { });
+            req.on('end', () => {
+                if (method === 'POST' && url.endsWith('/sandboxes')) {
+                    res.statusCode = 200;
+                    res.setHeader('content-type', 'application/json');
+                    res.end(JSON.stringify({
+                        sandboxId: 'sbx_cp_mtls',
+                        agent: { kind: 'unix', path: handlePath },
+                        rootDir: workDir,
+                    }));
+                    return;
+                }
+                if (method === 'DELETE' && url.includes(':delete')) {
+                    res.statusCode = 204;
+                    res.end();
+                    return;
+                }
+                res.statusCode = 500;
+                res.end('unexpected');
+            });
+        });
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (addr === null || typeof addr === 'string') {
+                reject(new Error('orchestrator: no TCP port'));
+                return;
+            }
+            resolve({ server, port: addr.port, calls });
+        });
+    });
+}
+describe('buildFirecrackerBackend (control-plane mTLS dial)', () => {
+    it('create POST succeeds over mTLS and round-trips an exec', async () => {
+        agentServer = await startAgent();
+        const orch = await startMtlsOrchestrator(sockPath);
+        orchestrator = orch.server;
+        const backend = buildFirecrackerBackend({
+            // An https:// endpoint over the (loopback stand-in for the) public hop.
+            orchestratorEndpoint: `https://127.0.0.1:${orch.port}/`,
+            getToken: async () => 'tok',
+            readyTimeoutMs: 5_000,
+            readyPollIntervalMs: 50,
+            // CONTROL-plane client material — injected by the consumer, never
+            // shipped by the orchestrator. Drives the node:https mTLS dial.
+            controlPlaneMtls: {
+                ca: CA_CRT,
+                cert: CLIENT_CRT,
+                key: CLIENT_KEY,
+                servername: 'sandbox.fc.internal',
+            },
+        });
+        const sandbox = await backend.create({ workingDirectory: workDir });
+        expect(sandbox.id).toBe('sbx_cp_mtls');
+        expect(sandbox.status).toBe('ready');
+        // The control-plane POST reached the mTLS orchestrator.
+        expect(orch.calls.some((c) => c.method === 'POST' && c.url.endsWith('/sandboxes'))).toBe(true);
+        // Exec over the vsock tunnel (the data plane), proving the whole flow.
+        const r = await sandbox.exec('/bin/sh', ['-c', 'echo hello-cp-mtls']);
+        expect(r.stdout).toContain('hello-cp-mtls');
+        // destroy DELETE also rides the mTLS control plane.
+        await sandbox.destroy();
+        expect(orch.calls.some((c) => c.method === 'DELETE' && c.url.includes(':delete'))).toBe(true);
+    });
+    it('the backend without controlPlaneMtls cannot reach the mTLS orchestrator (plain fetch fails the handshake)', async () => {
+        agentServer = await startAgent();
+        const orch = await startMtlsOrchestrator(sockPath);
+        orchestrator = orch.server;
+        // No `controlPlaneMtls` → the backend uses plain `fetch`, which neither
+        // presents a client cert nor trusts the test CA, so the TLS handshake
+        // fails and create rejects BEFORE any route runs.
+        const backend = buildFirecrackerBackend({
+            orchestratorEndpoint: `https://127.0.0.1:${orch.port}/`,
+            getToken: async () => 'tok',
+            readyTimeoutMs: 2_000,
+            readyPollIntervalMs: 50,
+        });
+        await expect(backend.create({ workingDirectory: workDir })).rejects.toThrow(/failed to create microVM sandbox/);
+        expect(orch.calls.some((c) => c.method === 'POST' && c.url.endsWith('/sandboxes'))).toBe(false);
+    });
+    it("the orchestrator's requestCert rejects a client presenting NO cert (server-side proof)", async () => {
+        // Isolate the SERVER's requestCert+rejectUnauthorized from any client-side
+        // CA distrust: dial directly with node:https TRUSTING the server CA but
+        // presenting NO client cert. The handshake must be rejected by the server.
+        const orch = await startMtlsOrchestrator(sockPath);
+        orchestrator = orch.server;
+        const err = await new Promise((resolve) => {
+            const req = httpsRequest({
+                host: '127.0.0.1',
+                port: orch.port,
+                method: 'POST',
+                path: '/sandboxes',
+                ca: CA_CRT,
+                servername: 'sandbox.fc.internal',
+            }, () => resolve(undefined));
+            req.on('error', (e) => resolve(e));
+            req.end();
+        });
+        expect(err).toBeInstanceOf(Error);
+        expect(orch.calls.some((c) => c.method === 'POST')).toBe(false);
+    });
+    it("the orchestrator's requestCert rejects a client cert from a DIFFERENT CA", async () => {
+        const orch = await startMtlsOrchestrator(sockPath);
+        orchestrator = orch.server;
+        const err = await new Promise((resolve) => {
+            const req = httpsRequest({
+                host: '127.0.0.1',
+                port: orch.port,
+                method: 'POST',
+                path: '/sandboxes',
+                ca: CA_CRT,
+                cert: ROGUE_CLIENT_CRT,
+                key: ROGUE_CLIENT_KEY,
+                servername: 'sandbox.fc.internal',
+            }, () => resolve(undefined));
+            req.on('error', (e) => resolve(e));
+            req.end();
+        });
+        expect(err).toBeInstanceOf(Error);
+        expect(orch.calls.some((c) => c.method === 'POST')).toBe(false);
+    });
+});
+//# sourceMappingURL=control-plane-mtls.test.js.map

package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-mtls.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/control-plane-mtls.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAEN,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAA4B,YAAY,EAAE,MAAM,UAAU,CAAA;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EACN,MAAM,EACN,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,GACV,MAAM,wBAAwB,CAAA;AAE/B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAM/C,IAAI,OAAe,CAAA;AACnB,IAAI,QAAgB,CAAA;AACpB,IAAI,WAA+B,CAAA;AACnC,IAAI,YAAqC,CAAA;AACzC,IAAI,KAAkB,CAAA;AAEtB,UAAU,CAAC,GAAG,EAAE;IACf,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IACpD,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IACtC,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAA;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACtE,KAAK,GAAG,QAAQ,CAAC,6BAA6B,CAAgB,CAAA;AAC/D,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,KAAK,IAAI,EAAE;IACpB,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,YAAY,GAAG,SAAS,CAAA;IACzB,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,WAAW,GAAG,SAAS,CAAA;IACxB,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF,SAAS,UAAU;IAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC9C,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAKhD,MAAM,KAAK,GAA2C,EAAE,CAAA;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,iBAAiB,CAC/B;YACC,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,UAAU;YACf,EAAE,EAAE,MAAM;YACV,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,IAAI;YACxB,UAAU,EAAE,SAAS;SACrB,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;YAClC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3B,0CAA0C;YAC1C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBAClB,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;oBACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;oBACjD,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC;wBACd,SAAS,EAAE,aAAa;wBACxB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;wBACzC,OAAO,EAAE,OAAO;qBAChB,CAAC,CACF,CAAA;oBACD,OAAM;gBACP,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;oBACpB,GAAG,CAAC,GAAG,EAAE,CAAA;oBACT,OAAM;gBACP,CAAC;gBACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACtB,CAAC,CAAC,CAAA;QACH,CAAC,CACD,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAA;gBAC9C,OAAM;YACP,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACvE,WAAW,GAAG,MAAM,UAAU,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAE1B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,wEAAwE;YACxE,oBAAoB,EAAE,qBAAqB,IAAI,CAAC,IAAI,GAAG;YACvD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;YACvB,kEAAkE;YAClE,gEAAgE;YAChE,gBAAgB,EAAE;gBACjB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,UAAU;gBACf,UAAU,EAAE,qBAAqB;aACjC;SACD,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEpC,wDAAwD;QACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE9F,uEAAuE;QACvE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAA;QACrE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QAE3C,oDAAoD;QACpD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2GAA2G,EAAE,KAAK,IAAI,EAAE;QAC1H,WAAW,GAAG,MAAM,UAAU,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAE1B,wEAAwE;QACxE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,qBAAqB,IAAI,CAAC,IAAI,GAAG;YACvD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;SACvB,CAAC,CAAA;QAEF,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1E,kCAAkC,CAClC,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACvG,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YAC5D,MAAM,GAAG,GAAG,YAAY,CACvB;gBACC,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,MAAM;gBACV,UAAU,EAAE,qBAAqB;aACjC,EACD,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CACxB,CAAA;YACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;YACzC,GAAG,CAAC,GAAG,EAAE,CAAA;QACV,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YAC5D,MAAM,GAAG,GAAG,YAAY,CACvB;gBACC,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,gBAAgB;gBACrB,UAAU,EAAE,qBAAqB;aACjC,EACD,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CACxB,CAAA;YACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;YACzC,GAAG,CAAC,GAAG,EAAE,CAAA;QACV,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared Ring-0 mTLS test PKI + a loopback relay stand-in.
+ *
+ * A throwaway P-256 test PKI (CA + server leaf + client leaf + an unrelated
+ * rogue client) baked in as PEM constants — no openssl/forge at test time, so
+ * the package stays dependency-light. Minted offline:
+ *   openssl ec/x509 self-signed CA + leaves
+ *   (server SAN = DNS:sandbox.fc.internal, IP:127.0.0.1), far-future expiry.
+ * `ROGUE_*` chains to a DIFFERENT CA to prove `rejectUnauthorized` blocks it.
+ *
+ * Used by both transport.test.ts (the raw `kind:'mtls'` dialer arm) and
+ * backend.test.ts (the cert-INJECTION seam through `buildFirecrackerBackend`),
+ * so the PKI + relay harness lives in one place instead of per-test copies.
+ */
+import { type Server as TlsServer } from 'node:tls';
+export declare const CA_CRT = "-----BEGIN CERTIFICATE-----\nMIIBjjCCATWgAwIBAgIUGXUtG14KQr4spNGW7rpfjZGoBIIwCgYIKoZIzj0EAwIw\nHDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP\nMjEyNjA1MjMwODMyNTJaMBwxGjAYBgNVBAMMEXZhbmRhbC1mYy10ZXN0LWNhMFkw\nEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5l+vjhjm/PX02D55n56EwelgvM1jrqQM\nZ+ezzvMmrZEBGWInvBND3z3kc6nv7snu6fHT2HHOyhwUNoLqmrIg/qNTMFEwHQYD\nVR0OBBYEFP0M8/KZY1ovxyGDci5iuoYXcmZgMB8GA1UdIwQYMBaAFP0M8/KZY1ov\nxyGDci5iuoYXcmZgMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIg\nC0xtFDASnwsOYT0GiZwzYWTOBfgmjDWK7ANXQQFNTh4CICVLQwq5eLy3424drEHk\n5Ol/FNKVZcGRjE96rB0mRUOp\n-----END CERTIFICATE-----\n";
+export declare const SERVER_CRT = "-----BEGIN CERTIFICATE-----\nMIIBsDCCAVWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1MwCgYIKoZIzj0EAwIw\nHDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP\nMjEyNjA1MjMwODMyNTJaMBIxEDAOBgNVBAMMB2ZjLWhvc3QwWTATBgcqhkjOPQIB\nBggqhkjOPQMBBwNCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMBfmonVb7dUhM0ZWpo\nePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6o30wezAkBgNVHREEHTAbghNz\nYW5kYm94LmZjLmludGVybmFshwR/AAABMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0G\nA1UdDgQWBBRXHU1vlX7WvqzcbaNxRxV4f3gfDDAfBgNVHSMEGDAWgBT9DPPymWNa\nL8chg3IuYrqGF3JmYDAKBggqhkjOPQQDAgNJADBGAiEAlqzKqgBf5hxJqd26QwcY\nn3cvEKi4f2BSLe1Rfzr5oSoCIQD0izUOJXLNvmac9cMgV0HvkftBerDKFOcGeGTN\ng3Eunw==\n-----END CERTIFICATE-----\n";
+export declare const SERVER_KEY = "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg/ROnYXIkMKnipbLt\nJnFEwXAifgeOv9TGLcK2RojE7jmhRANCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMB\nfmonVb7dUhM0ZWpoePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6\n-----END PRIVATE KEY-----\n";
+export declare const CLIENT_CRT = "-----BEGIN CERTIFICATE-----\nMIIBjjCCATWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1QwCgYIKoZIzj0EAwIw\nHDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP\nMjEyNjA1MjMwODMyNTJaMBgxFjAUBgNVBAMMDWNhLXZhbmRhbC1hcHAwWTATBgcq\nhkjOPQIBBggqhkjOPQMBBwNCAASlCMCwjtrQUicWcWsO29R5S7fzjMbbxXvDh8/K\nw57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXko1cwVTATBgNVHSUE\nDDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQU2cxDCNrlVkk4ODs6ZPrkC6GzHjkwHwYD\nVR0jBBgwFoAU/Qzz8pljWi/HIYNyLmK6hhdyZmAwCgYIKoZIzj0EAwIDRwAwRAIg\nRghqArNm3bXnWnRi+jkEEJa8mRb2z0Wj4G7SIhtMurUCIBQSllVtICgZB9hvcM0D\nd24fcW4nlfvaZJMJ6dRC1Wle\n-----END CERTIFICATE-----\n";
+export declare const CLIENT_KEY = "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgaamj/ycrEuPqpiC2\nIhAYx/M5iN4t4P+B17V4GO54Nb2hRANCAASlCMCwjtrQUicWcWsO29R5S7fzjMbb\nxXvDh8/Kw57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXk\n-----END PRIVATE KEY-----\n";
+export declare const ROGUE_CLIENT_CRT = "-----BEGIN CERTIFICATE-----\nMIIBhjCCASugAwIBAgIUbAYOlW4PQGyXjjRsjCPy62EHUmIwCgYIKoZIzj0EAwIw\nEzERMA8GA1UEAwwIcm9ndWUtY2EwIBcNMjYwNjE2MDgzMjUyWhgPMjEyNjA1MjMw\nODMyNTJaMBcxFTATBgNVBAMMDHJvZ3VlLWNsaWVudDBZMBMGByqGSM49AgEGCCqG\nSM49AwEHA0IABOPSzdzQTQz3M5CDHLVPguvHd10ncaDV9t4zKUy/PCE+U7GTJwN2\nTtypGnmYEahbcl45j94hwu495P5VbR5ohb6jVzBVMBMGA1UdJQQMMAoGCCsGAQUF\nBwMCMB0GA1UdDgQWBBTf0woauniche3/ps77+Kd0dsbbSDAfBgNVHSMEGDAWgBSX\nYu0IJlPxi79Gyi5hR1IfS/sqyzAKBggqhkjOPQQDAgNJADBGAiEAxD4N4XWtaHPJ\nyaCOzQP0e5RRyNst3QrhH0NSMyPw89wCIQC+bezLX97TuV1sId53Bo1l9j1TSOMa\nEZotN/Wsq6L+qw==\n-----END CERTIFICATE-----\n";
+export declare const ROGUE_CLIENT_KEY = "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgR6fGq27O9eT/hi0Q\nc+L5+lSm5fbDEghVJCo6k7HrG62hRANCAATj0s3c0E0M9zOQgxy1T4Lrx3ddJ3Gg\n1fbeMylMvzwhPlOxkycDdk7cqRp5mBGoW3JeOY/eIcLuPeT+VW0eaIW+\n-----END PRIVATE KEY-----\n";
+export interface RelayHandle {
+    readonly server: TlsServer;
+    readonly port: number;
+    /** sandboxId from the first connection's `SANDBOX <id>` preamble. */
+    preamble(): Promise<string>;
+}
+/**
+ * A loopback stand-in for the per-FC-host mTLS relay.
+ *
+ * Terminates mTLS (requestCert + rejectUnauthorized + CA pin), reads the
+ * `SANDBOX <id>\n` routing preamble line, then bridges the rest of the TLS
+ * stream verbatim to a FRESH `net.connect` to `agentSockPath` (the
+ * unix-socket-backed real agent) — exactly the dumb byte-pump the production
+ * relay is. It does NOT speak framing itself and does NOT send an ack line.
+ */
+export declare function startMtlsRelay(agentSockPath: string, listenPort?: number): Promise<RelayHandle>;
+//# sourceMappingURL=mtls-pki.d.ts.map

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls-pki.d.ts","sourceRoot":"","sources":["../../../../../src/backends/firecracker/__tests__/fixtures/mtls-pki.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAkB,KAAK,MAAM,IAAI,SAAS,EAAmC,MAAM,UAAU,CAAA;AAEpG,eAAO,MAAM,MAAM,umBAWlB,CAAA;AAED,eAAO,MAAM,UAAU,ypBAYtB,CAAA;AAED,eAAO,MAAM,UAAU,2PAKtB,CAAA;AAED,eAAO,MAAM,UAAU,umBAWtB,CAAA;AAED,eAAO,MAAM,UAAU,2PAKtB,CAAA;AAED,eAAO,MAAM,gBAAgB,+lBAW5B,CAAA;AAED,eAAO,MAAM,gBAAgB,2PAK5B,CAAA;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,SAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAyD1F"}

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js

@@ -0,0 +1,149 @@
+/**
+ * Shared Ring-0 mTLS test PKI + a loopback relay stand-in.
+ *
+ * A throwaway P-256 test PKI (CA + server leaf + client leaf + an unrelated
+ * rogue client) baked in as PEM constants — no openssl/forge at test time, so
+ * the package stays dependency-light. Minted offline:
+ *   openssl ec/x509 self-signed CA + leaves
+ *   (server SAN = DNS:sandbox.fc.internal, IP:127.0.0.1), far-future expiry.
+ * `ROGUE_*` chains to a DIFFERENT CA to prove `rejectUnauthorized` blocks it.
+ *
+ * Used by both transport.test.ts (the raw `kind:'mtls'` dialer arm) and
+ * backend.test.ts (the cert-INJECTION seam through `buildFirecrackerBackend`),
+ * so the PKI + relay harness lives in one place instead of per-test copies.
+ */
+import { connect as netConnect } from 'node:net';
+import { createServer as createTlsServer } from 'node:tls';
+export const CA_CRT = `-----BEGIN CERTIFICATE-----
+MIIBjjCCATWgAwIBAgIUGXUtG14KQr4spNGW7rpfjZGoBIIwCgYIKoZIzj0EAwIw
+HDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP
+MjEyNjA1MjMwODMyNTJaMBwxGjAYBgNVBAMMEXZhbmRhbC1mYy10ZXN0LWNhMFkw
+EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5l+vjhjm/PX02D55n56EwelgvM1jrqQM
+Z+ezzvMmrZEBGWInvBND3z3kc6nv7snu6fHT2HHOyhwUNoLqmrIg/qNTMFEwHQYD
+VR0OBBYEFP0M8/KZY1ovxyGDci5iuoYXcmZgMB8GA1UdIwQYMBaAFP0M8/KZY1ov
+xyGDci5iuoYXcmZgMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIg
+C0xtFDASnwsOYT0GiZwzYWTOBfgmjDWK7ANXQQFNTh4CICVLQwq5eLy3424drEHk
+5Ol/FNKVZcGRjE96rB0mRUOp
+-----END CERTIFICATE-----
+`;
+export const SERVER_CRT = `-----BEGIN CERTIFICATE-----
+MIIBsDCCAVWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1MwCgYIKoZIzj0EAwIw
+HDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP
+MjEyNjA1MjMwODMyNTJaMBIxEDAOBgNVBAMMB2ZjLWhvc3QwWTATBgcqhkjOPQIB
+BggqhkjOPQMBBwNCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMBfmonVb7dUhM0ZWpo
+ePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6o30wezAkBgNVHREEHTAbghNz
+YW5kYm94LmZjLmludGVybmFshwR/AAABMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0G
+A1UdDgQWBBRXHU1vlX7WvqzcbaNxRxV4f3gfDDAfBgNVHSMEGDAWgBT9DPPymWNa
+L8chg3IuYrqGF3JmYDAKBggqhkjOPQQDAgNJADBGAiEAlqzKqgBf5hxJqd26QwcY
+n3cvEKi4f2BSLe1Rfzr5oSoCIQD0izUOJXLNvmac9cMgV0HvkftBerDKFOcGeGTN
+g3Eunw==
+-----END CERTIFICATE-----
+`;
+export const SERVER_KEY = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg/ROnYXIkMKnipbLt
+JnFEwXAifgeOv9TGLcK2RojE7jmhRANCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMB
+fmonVb7dUhM0ZWpoePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6
+-----END PRIVATE KEY-----
+`;
+export const CLIENT_CRT = `-----BEGIN CERTIFICATE-----
+MIIBjjCCATWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1QwCgYIKoZIzj0EAwIw
+HDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP
+MjEyNjA1MjMwODMyNTJaMBgxFjAUBgNVBAMMDWNhLXZhbmRhbC1hcHAwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAASlCMCwjtrQUicWcWsO29R5S7fzjMbbxXvDh8/K
+w57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXko1cwVTATBgNVHSUE
+DDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQU2cxDCNrlVkk4ODs6ZPrkC6GzHjkwHwYD
+VR0jBBgwFoAU/Qzz8pljWi/HIYNyLmK6hhdyZmAwCgYIKoZIzj0EAwIDRwAwRAIg
+RghqArNm3bXnWnRi+jkEEJa8mRb2z0Wj4G7SIhtMurUCIBQSllVtICgZB9hvcM0D
+d24fcW4nlfvaZJMJ6dRC1Wle
+-----END CERTIFICATE-----
+`;
+export const CLIENT_KEY = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgaamj/ycrEuPqpiC2
+IhAYx/M5iN4t4P+B17V4GO54Nb2hRANCAASlCMCwjtrQUicWcWsO29R5S7fzjMbb
+xXvDh8/Kw57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXk
+-----END PRIVATE KEY-----
+`;
+export const ROGUE_CLIENT_CRT = `-----BEGIN CERTIFICATE-----
+MIIBhjCCASugAwIBAgIUbAYOlW4PQGyXjjRsjCPy62EHUmIwCgYIKoZIzj0EAwIw
+EzERMA8GA1UEAwwIcm9ndWUtY2EwIBcNMjYwNjE2MDgzMjUyWhgPMjEyNjA1MjMw
+ODMyNTJaMBcxFTATBgNVBAMMDHJvZ3VlLWNsaWVudDBZMBMGByqGSM49AgEGCCqG
+SM49AwEHA0IABOPSzdzQTQz3M5CDHLVPguvHd10ncaDV9t4zKUy/PCE+U7GTJwN2
+TtypGnmYEahbcl45j94hwu495P5VbR5ohb6jVzBVMBMGA1UdJQQMMAoGCCsGAQUF
+BwMCMB0GA1UdDgQWBBTf0woauniche3/ps77+Kd0dsbbSDAfBgNVHSMEGDAWgBSX
+Yu0IJlPxi79Gyi5hR1IfS/sqyzAKBggqhkjOPQQDAgNJADBGAiEAxD4N4XWtaHPJ
+yaCOzQP0e5RRyNst3QrhH0NSMyPw89wCIQC+bezLX97TuV1sId53Bo1l9j1TSOMa
+EZotN/Wsq6L+qw==
+-----END CERTIFICATE-----
+`;
+export const ROGUE_CLIENT_KEY = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgR6fGq27O9eT/hi0Q
+c+L5+lSm5fbDEghVJCo6k7HrG62hRANCAATj0s3c0E0M9zOQgxy1T4Lrx3ddJ3Gg
+1fbeMylMvzwhPlOxkycDdk7cqRp5mBGoW3JeOY/eIcLuPeT+VW0eaIW+
+-----END PRIVATE KEY-----
+`;
+/**
+ * A loopback stand-in for the per-FC-host mTLS relay.
+ *
+ * Terminates mTLS (requestCert + rejectUnauthorized + CA pin), reads the
+ * `SANDBOX <id>\n` routing preamble line, then bridges the rest of the TLS
+ * stream verbatim to a FRESH `net.connect` to `agentSockPath` (the
+ * unix-socket-backed real agent) — exactly the dumb byte-pump the production
+ * relay is. It does NOT speak framing itself and does NOT send an ack line.
+ */
+export function startMtlsRelay(agentSockPath, listenPort = 0) {
+    let resolvePreamble;
+    const preamble = new Promise((r) => {
+        resolvePreamble = r;
+    });
+    return new Promise((resolve, reject) => {
+        const server = createTlsServer({
+            requestCert: true,
+            rejectUnauthorized: true,
+            ca: CA_CRT,
+            cert: SERVER_CRT,
+            key: SERVER_KEY,
+            minVersion: 'TLSv1.3',
+        }, (tlsSock) => {
+            let pre = Buffer.alloc(0);
+            const onPreambleData = (chunk) => {
+                pre = Buffer.concat([pre, chunk]);
+                const nl = pre.indexOf(0x0a);
+                if (nl < 0)
+                    return;
+                tlsSock.removeListener('data', onPreambleData);
+                tlsSock.pause();
+                const line = pre.subarray(0, nl).toString('utf8');
+                const rest = pre.subarray(nl + 1);
+                if (rest.length > 0)
+                    tlsSock.unshift(rest);
+                const m = /^SANDBOX (.+)$/.exec(line);
+                const id = m?.[1];
+                if (id === undefined) {
+                    tlsSock.destroy();
+                    return;
+                }
+                resolvePreamble(id);
+                // 1 inbound mTLS conn -> 1 FRESH local agent connect (the
+                // resume-survival invariant the relay must preserve).
+                const upstream = netConnect({ path: agentSockPath });
+                upstream.on('error', () => tlsSock.destroy());
+                tlsSock.on('error', () => upstream.destroy());
+                upstream.once('connect', () => {
+                    tlsSock.pipe(upstream);
+                    upstream.pipe(tlsSock);
+                });
+            };
+            tlsSock.on('data', onPreambleData);
+        });
+        server.on('error', reject);
+        server.listen(listenPort, '127.0.0.1', () => {
+            const addr = server.address();
+            if (addr === null || typeof addr === 'string') {
+                reject(new Error('relay: no TCP port'));
+                return;
+            }
+            resolve({ server, port: addr.port, preamble: () => preamble });
+        });
+    });
+}
+//# sourceMappingURL=mtls-pki.js.map

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls-pki.js","sourceRoot":"","sources":["../../../../../src/backends/firecracker/__tests__/fixtures/mtls-pki.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,EAA4C,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAA;AAEpG,MAAM,CAAC,MAAM,MAAM,GAAG;;;;;;;;;;;CAWrB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;CAYzB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;CAKzB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;CAWzB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;CAKzB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;CAW/B,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;CAK/B,CAAA;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB,EAAE,UAAU,GAAG,CAAC;IACnE,IAAI,eAAqC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,EAAE;QAC1C,eAAe,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,eAAe,CAC7B;YACC,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,IAAI;YACxB,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,UAAU;YACf,UAAU,EAAE,SAAS;SACrB,EACD,CAAC,OAAkB,EAAE,EAAE;YACtB,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACzB,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE;gBACxC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;gBACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC5B,IAAI,EAAE,GAAG,CAAC;oBAAE,OAAM;gBAClB,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;gBAC9C,OAAO,CAAC,KAAK,EAAE,CAAA;gBACf,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACjD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;gBACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC1C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACjB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;oBACtB,OAAO,CAAC,OAAO,EAAE,CAAA;oBACjB,OAAM;gBACP,CAAC;gBACD,eAAe,CAAC,EAAE,CAAC,CAAA;gBACnB,0DAA0D;gBAC1D,sDAAsD;gBACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;gBACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC7C,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC7C,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;oBAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;oBACtB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACvB,CAAC,CAAC,CAAA;YACH,CAAC,CAAA;YACD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;QACnC,CAAC,CACD,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAA;gBACvC,OAAM;YACP,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/backends/firecracker/__tests__/protocol.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Unit-pins the shared NDJSON codec the vsock + HTTP transports both
+ * speak, and the `pickBackend` routing for `microvm:self-hosted`.
+ */
+export {};
+//# sourceMappingURL=protocol.test.d.ts.map

package/dist/backends/firecracker/__tests__/protocol.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/protocol.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/backends/firecracker/__tests__/protocol.test.js

@@ -0,0 +1,77 @@
+/**
+ * Unit-pins the shared NDJSON codec the vsock + HTTP transports both
+ * speak, and the `pickBackend` routing for `microvm:self-hosted`.
+ */
+import { describe, expect, it } from 'vitest';
+import { SandboxBackendNotImplementedError, createSandboxProvider } from '../../../index.js';
+import { ExecResultAccumulator, parseExecLine } from '../protocol.js';
+describe('ExecResultAccumulator', () => {
+    it('accumulates stdout/stderr deltas and captures the terminal result', () => {
+        const acc = new ExecResultAccumulator(0);
+        expect(acc.push({ type: 'stdout_delta', data: 'a' })).toBe(false);
+        expect(acc.push({ type: 'stdout_delta', data: 'b' })).toBe(false);
+        expect(acc.push({ type: 'stderr_delta', data: 'E' })).toBe(false);
+        expect(acc.done).toBe(false);
+        expect(acc.push({ type: 'result', exitCode: 0, timedOut: false })).toBe(true);
+        expect(acc.done).toBe(true);
+        const r = acc.finish();
+        expect(r.stdout).toBe('ab');
+        expect(r.stderr).toBe('E');
+        expect(r.exitCode).toBe(0);
+        expect(r.timedOut).toBe(false);
+    });
+    it('throws on an error event (docker loop parity)', () => {
+        const acc = new ExecResultAccumulator(0);
+        expect(() => acc.push({ type: 'error', error: 'boom' })).toThrow('boom');
+    });
+});
+describe('parseExecLine', () => {
+    it('parses a valid NDJSON line', () => {
+        expect(parseExecLine('{"type":"stdout_delta","data":"x"}')).toEqual({
+            type: 'stdout_delta',
+            data: 'x',
+        });
+    });
+    it('returns undefined for blank or malformed lines (SyntaxError swallow)', () => {
+        expect(parseExecLine('')).toBeUndefined();
+        expect(parseExecLine('   ')).toBeUndefined();
+        expect(parseExecLine('{not json')).toBeUndefined();
+    });
+});
+describe('pickBackend — microvm:self-hosted', () => {
+    it('builds the firecracker backend when orchestratorEndpoint + getToken are present', () => {
+        const provider = createSandboxProvider({
+            backend: {
+                tier: 'microvm',
+                service: 'self-hosted',
+                firecrackerBinary: '/usr/bin/firecracker',
+                kernelImage: '/golden/vmlinux',
+                rootfsImage: '/golden/rootfs.ext4',
+                orchestratorEndpoint: 'https://orchestrator.test',
+                getToken: async () => 'tok',
+                template: 'golden-rev-1',
+            },
+        });
+        expect(provider.id).toContain('microvm');
+        expect(provider.id).toContain('firecracker');
+        expect(provider.name).toContain('microvm:self-hosted');
+    });
+    it('still throws for the legacy local-containerd self-hosted shape (no orchestrator)', () => {
+        expect(() => createSandboxProvider({
+            backend: {
+                tier: 'microvm',
+                service: 'self-hosted',
+                firecrackerBinary: '/usr/bin/firecracker',
+                kernelImage: '/k',
+                rootfsImage: '/r',
+            },
+        })).toThrow(SandboxBackendNotImplementedError);
+    });
+    it('still throws for microvm:e2b and microvm:fly-machines', () => {
+        expect(() => createSandboxProvider({ backend: { tier: 'microvm', service: 'e2b', apiKey: 'k' } })).toThrow(SandboxBackendNotImplementedError);
+        expect(() => createSandboxProvider({
+            backend: { tier: 'microvm', service: 'fly-machines', apiToken: 't', app: 'a', image: 'i' },
+        })).toThrow(SandboxBackendNotImplementedError);
+    });
+});
+//# sourceMappingURL=protocol.test.js.map

package/dist/backends/firecracker/__tests__/protocol.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/protocol.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,iCAAiC,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAErE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;QACtB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,aAAa,CAAC,oCAAoC,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,GAAG;SACT,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QACzC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5C,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QAC1F,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE;gBACR,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,aAAa;gBACtB,iBAAiB,EAAE,sBAAsB;gBACzC,WAAW,EAAE,iBAAiB;gBAC9B,WAAW,EAAE,qBAAqB;gBAClC,oBAAoB,EAAE,2BAA2B;gBACjD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;gBAC3B,QAAQ,EAAE,cAAc;aACxB;SACD,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACxC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC3F,MAAM,CAAC,GAAG,EAAE,CACX,qBAAqB,CAAC;YACrB,OAAO,EAAE;gBACR,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,aAAa;gBACtB,iBAAiB,EAAE,sBAAsB;gBACzC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;aACjB;SACD,CAAC,CACF,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,CACX,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CACpF,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,EAAE,CACX,qBAAqB,CAAC;YACrB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;SAC1F,CAAC,CACF,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/transport.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Loopback transport round-trip tests for the Firecracker vsock path.
+ *
+ * These prove the NEW transport (host dialer ↔ in-VM agent) over a
+ * **unix-socket stand-in** — the faithful local peer for AF_VSOCK,
+ * because the production vsock path also terminates on a host
+ * unix socket (see `transport.ts` docblock). The peer is the REAL
+ * `agent/agent.cjs` connection handler (its spawn/jail + NDJSON shapes
+ * verbatim), driven in-process over a temp unix socket; the client is
+ * the REAL {@link VsockAgentTransport}. So one test exercises:
+ *   - exec → streamed stdout/stderr/result NDJSON, accumulated;
+ *   - writeFile / readFile → base64 round-trip through the jail;
+ *   - a simulated resume (server torn down + re-listened) survived by
+ *     the dialer's connect-retry budget — the FC #4713 invariant.
+ *
+ * No docker, no Azure, no AF_VSOCK kernel support required: pure
+ * loopback, safe in CI.
+ */
+export {};
+//# sourceMappingURL=transport.test.d.ts.map

package/dist/backends/firecracker/__tests__/transport.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/transport.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}