@namzu/sandbox 14.0.0 → 16.0.0

package/dist/backends/kubernetes/sandbox.js

@@ -11,20 +11,36 @@
  *
  * Implemented: `exec` (through the shared {@link RemoteExecutionController},
  * so an `AbortSignal` terminates the guest process rather than abandoning
- * the wait), `writeFile`, `readFile`, `listFiles`, `openTerminal`,
- * `openTcpConnection`, `destroy`.
+ * the wait), `writeFile`, `readFile`, `listFiles`, `walkFiles`,
+ * `openTerminal`, `openTcpConnection`, `destroy`.
+ *
+ * Conditionally present, on the same contract read the other way:
+ *
+ *  - `setNetworkPolicy` — present on a TASK handle exactly when the backend
+ *    was configured with `egress.perSandbox`, which is what gives this host
+ *    an object to write (one `CiliumNetworkPolicy` per sandbox, owned by the
+ *    claim), an admission fence bounding what it may write, and the RBAC to
+ *    write it. Without that configuration there is still no per-running-pod
+ *    knob to turn, so the method is ABSENT rather than present and throwing —
+ *    the same rule, applied to a capability that now sometimes exists.
+ *    Presence follows configuration alone, never a probe of the cluster. See
+ *    `per-sandbox-policy.ts`.
+ *
+ *    A WORKSPACE handle never carries it: `KubernetesWorkspace`'s create path
+ *    builds its handle through `buildKubernetesSandbox` without this option,
+ *    because it composes no per-sandbox pod label and tracks no owner uid for
+ *    one. That is a property of the PATH and not of the configuration, so it
+ *    is not answered by omission: `createKubernetesWorkspace` refuses a
+ *    config carrying `egress.perSandbox` outright
+ *    (`KubernetesWorkspacePerSandboxEgressConfigError`, before any request)
+ *    rather than letting the option declare a capability the path never
+ *    serves — see `workspace.ts`.
  *
  * Absent on purpose, because the SDK's contract says a backend that cannot
  * honour an optional method must omit it rather than accept and ignore:
  *
- *  - `setNetworkPolicy` — egress here is a `NetworkPolicy` attached to the
- *    pool's `SandboxTemplate`. There is no per-running-pod knob to turn, and
- *    a policy accepted and not applied is worse than one never offered: the
- *    caller stops looking.
  *  - `spawnDetached` — the guest agent has no op that starts a process and
  *    returns it running. A host asking for background jobs must be told no.
- *  - `walkFiles` — not in this batch. A host that requires bounded search
- *    refuses an absent method, which is the honest answer today.
  *
  * ## Terminals are owned
  *
@@ -42,6 +58,7 @@
  * {@link KubernetesSandboxGoneError} (the cluster deleted it — the lease
  * renewal found the object already gone).
  */
+import { walkFilesViaExec } from '@namzu/sdk';
 import { OperationDeadline } from '../readiness.js';
 import { RemoteCancellationUnknownError, } from '../remote-execution-controller.js';
 import { KubernetesLeaseRenewal } from './lease.js';
@@ -99,6 +116,9 @@ export function buildKubernetesSandbox(options) {
     // line carrying an id is also a `kubectl get sandbox` argument.
     const id = options.name;
     const transport = options.transport;
+    // Captured as a const so the conditional member below narrows: the method
+    // is on the handle if and only if this is defined, decided once, here.
+    const setNetworkPolicy = options.setNetworkPolicy;
     let lifecycle = 'active';
     let activeExecutions = 0;
     let teardownPromise;
@@ -186,6 +206,28 @@ export function buildKubernetesSandbox(options) {
         }));
         return retirementPromise;
     };
+    /**
+     * What an unconfirmed cancellation does to THIS sandbox: retire it, or
+     * whatever the owner's hook decided instead — see
+     * {@link KubernetesSandboxBaseOptions.onUnconfirmedCancellation}.
+     */
+    const observeUnconfirmedCancellation = async (error) => {
+        const decide = options.onUnconfirmedCancellation;
+        if (decide === undefined)
+            return await retire();
+        try {
+            return await decide(error);
+        }
+        catch (hookError) {
+            // The caller is already receiving `error`; a hook that threw must
+            // not replace it, and must not be reported as a teardown that was
+            // attempted either.
+            return {
+                accepted: false,
+                error: hookError instanceof Error ? hookError : new Error(String(hookError)),
+            };
+        }
+    };
     const runExecution = async (operation, run) => {
         assertAdmissible(operation);
         activeExecutions += 1;
@@ -194,7 +236,7 @@ export function buildKubernetesSandbox(options) {
         }
         catch (error) {
             if (error instanceof RemoteCancellationUnknownError) {
-                error.retirement = await retire();
+                error.retirement = await observeUnconfirmedCancellation(error);
             }
             throw error;
         }
@@ -221,20 +263,59 @@ export function buildKubernetesSandbox(options) {
          * Every `tcp` request dials a fresh connection, so its envelope is
          * also that connection's first, not-yet-authenticated frame and is
          * bounded by the guest's pre-auth frame ceiling (8 MiB by default).
-         * The transport checks that BEFORE dialing and throws
-         * `AgentPreauthFrameTooLargeError` naming the limit; it is passed
-         * through unwrapped so a caller can catch that class and chunk,
-         * rather than having to pattern-match a message.
+         * A body above it is no longer a refusal: the transport splits it
+         * into parts that each fit, writes them to a temporary sibling of
+         * the target and finishes with an atomic rename, so this method
+         * takes a body of any size the transport's `maxWriteFileBytes`
+         * admits (1 GiB by default). The named refusals that remain are
+         * passed through unwrapped so a caller can catch them BY CLASS:
+         * `AgentWriteFileTooLargeError` for a body above that bound, and
+         * `AgentPreauthFrameTooLargeError` for an oversized body against a
+         * guest too old to advertise the part protocol.
          */
         async writeFile(path, content) {
             assertAdmissible('writeFile');
             const buf = Buffer.isBuffer(content) ? content : Buffer.from(content, 'utf8');
             await transport.writeFile(path, buf);
         },
-        async readFile(path) {
+        /**
+         * A whole-file read is served by the guest's streamed op when the
+         * guest advertises it, so neither side holds the file's base64 form
+         * or its JSON envelope in one piece and a file of any size this
+         * workspace's disk holds can be read. `offset`/`length` ask for one
+         * slice instead; a guest too old to honour them is refused with
+         * `AgentReadFileStreamUnsupportedError` rather than answering with
+         * the whole file.
+         */
+        async readFile(path, readOptions) {
             assertAdmissible('readFile');
-            return await transport.readFile(path);
+            return await transport.readFile(path, readOptions);
         },
+        /**
+         * Chunks, in order, with nothing whole at either end — what a host
+         * draining a large output file before `destroy()` needs. The
+         * admissibility check runs at the call, not per chunk: a workspace
+         * suspended mid-stream takes its pod's connection with it, which is
+         * what ends the iteration.
+         */
+        readFileStream(path, readOptions) {
+            assertAdmissible('readFileStream');
+            return transport.readFileStream(path, readOptions);
+        },
+        // Present only when the backend was configured for per-sandbox egress
+        // — see {@link KubernetesSandboxBaseOptions.setNetworkPolicy}. The
+        // admissibility gate is this file's, not the writer's, so a destroyed
+        // or cluster-removed sandbox refuses BY NAME here, exactly as every
+        // other method does, rather than failing at the API server one round
+        // trip later.
+        ...(setNetworkPolicy !== undefined
+            ? {
+                setNetworkPolicy: async (policy) => {
+                    assertAdmissible('setNetworkPolicy');
+                    await setNetworkPolicy(policy);
+                },
+            }
+            : {}),
         async openTerminal(terminalOptions) {
             assertAdmissible('openTerminal');
             const terminal = await transport.openTerminal(terminalOptions);
@@ -270,6 +351,59 @@ export function buildKubernetesSandbox(options) {
                 return entries;
             });
         },
+        /**
+         * Bounded, lazy file discovery — the method the SDK's `glob` and
+         * `grep` builtins refuse a sandbox for not having.
+         *
+         * Built on {@link walkFilesViaExec}, the same host-side enumerator the
+         * Firecracker and docker backends use, over this transport's `exec`:
+         * the guest needs no new agent op, because the walk IS an execution —
+         * `node -e` running the SDK's own walk program and streaming one JSONL
+         * record per match. The guest image is `node:22-bookworm-slim` (see
+         * `k8s/Dockerfile`) and the agent is itself node, so node on the
+         * guest's PATH is a precondition of the agent existing rather than a
+         * new requirement this method introduces.
+         *
+         * Ownership is the same as `exec`'s, and deliberately NOT
+         * `runExecution`'s: that helper wraps one awaited call, and a walk is a
+         * sequence of them. `activeExecutions` is therefore held for the whole
+         * walk rather than per entry — `status` reads `busy` from the first
+         * `next()` to the last, never flapping between yields — and an
+         * unconfirmed cancellation retires this handle exactly as a failed
+         * `exec` cancel does, on the same error class and through the same
+         * `retire()`.
+         *
+         * Cancellation: `options.signal` and the consumer's own
+         * `iterator.return()` both abort the underlying `exec`, which sends
+         * the guest a `cancel-execution` and kills the walk's process group —
+         * so breaking out of the loop after five entries leaves nothing
+         * running in the pod.
+         */
+        async *walkFiles(rootPath, walkOptions) {
+            assertAdmissible('walkFiles');
+            activeExecutions += 1;
+            try {
+                yield* walkFilesViaExec(async (command, argv, execOpts) => await transport.exec(command, argv, execOpts), rootPath, walkOptions);
+            }
+            catch (error) {
+                // The same rule `runExecution` applies, inlined because a
+                // generator cannot be wrapped by it: a command whose
+                // cancellation the guest could not confirm may still be running
+                // in that pod, so the pod stops being reusable.
+                //
+                // TWO SITES, ONE RULE. This block and `runExecution`'s must
+                // change together — #480, which owns the unconfirmed-cancel
+                // rule for this backend, is the next change to both, and a
+                // change that lands in one of them is a bug in the other.
+                if (error instanceof RemoteCancellationUnknownError) {
+                    error.retirement = await retire();
+                }
+                throw error;
+            }
+            finally {
+                activeExecutions = Math.max(0, activeExecutions - 1);
+            }
+        },
         async destroy(destroyOptions) {
             if (retirementPromise) {
                 const observation = await retirementPromise;

package/dist/backends/kubernetes/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EACN,8BAA8B,GAE9B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAGnD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC,wEAAwE;AACxE,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAI/C;IACA;IAJQ,IAAI,GAAG,iCAAiC,CAAA;IAE1D,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,wBAAwB,SAAS,+IAA+I,CACjN,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAI1C;IACA;IAJQ,IAAI,GAAG,4BAA4B,CAAA;IAErD,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,qCAAqC,SAAS,8OAA8O,CAC7T,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAgDD,SAAS,iBAAiB;IACzB,wEAAwE;IACxE,qEAAqE;IACrE,wCAAwC;IACxC,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAiB,CAAA;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAGnC,IAAI,SAAS,GAAc,QAAQ,CAAA;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,eAA0C,CAAA;IAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAC5B,IAAI,iBAAoE,CAAA;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAE5C,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,wEAAwE;IACxE,mEAAmE;IACnE,2EAA2E;IAC3E,uEAAuE;IACvE,wBAAwB;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACd,uBAAuB,OAAO,CAAC,IAAI,8CAA8C,MAAM,CAAC,UAAU,CAAC,oUAAoU,CACva,CAAA;IACF,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,KAAK,GACV,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAC9C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,sBAAsB,CAAC;YAC3B,UAAU;YACV,KAAK;YACL,MAAM,EAAE,GAAG,EAAE;gBACZ,+DAA+D;gBAC/D,iEAAiE;gBACjE,8CAA8C;gBAC9C,IAAI,SAAS,KAAK,QAAQ;oBAAE,SAAS,GAAG,MAAM,CAAA;YAC/C,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAA;IACL,KAAK,EAAE,KAAK,EAAE,CAAA;IAEd,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACpD,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAM;QAClC,IAAI,SAAS,KAAK,MAAM;YAAE,MAAM,IAAI,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACvF,MAAM,IAAI,+BAA+B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,MAAoB,EAAiB,EAAE;QACxD,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,KAAK,EAAE,IAAI,EAAE,CAAA;QACb,IAAI,gBAAgB;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9C,IAAI,eAAe;YAAE,OAAO,eAAe,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,GAAG,EAAE;YACJ,gBAAgB,GAAG,IAAI,CAAA;YACvB,SAAS,GAAG,WAAW,CAAA;QACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,8DAA8D;YAC9D,2DAA2D;YAC3D,iBAAiB;YACjB,IAAI,eAAe,KAAK,MAAM;gBAAE,eAAe,GAAG,SAAS,CAAA;YAC3D,MAAM,KAAK,CAAA;QACZ,CAAC,CACD,CAAA;QACD,eAAe,GAAG,MAAM,CAAA;QACxB,OAAO,MAAM,CAAA;IACd,CAAC,CAAA;IAED;;;;;OAKG;IACH,MAAM,MAAM,GAAG,GAA0C,EAAE;QAC1D,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,iBAAiB,KAAK,IAAI,iBAAiB,CAC1C,qBAAqB,EACrB,sBAAsB,OAAO,CAAC,IAAI,aAAa,CAC/C;aACC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC7C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;YAC3B,QAAQ,EAAE,KAAc;YACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAChE,CAAC,CAAC,CAAA;QACJ,OAAO,iBAAiB,CAAA;IACzB,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAK,SAAiB,EAAE,GAAqB,EAAc,EAAE;QACtF,gBAAgB,CAAC,SAAS,CAAC,CAAA;QAC3B,gBAAgB,IAAI,CAAC,CAAA;QACrB,IAAI,CAAC;YACJ,OAAO,MAAM,GAAG,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;gBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,KAAK,CAAA;QACZ,CAAC;gBAAS,CAAC;YACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;QACrD,CAAC;IACF,CAAC,CAAA;IAED,OAAO;QACN,EAAE;QACF,IAAI,MAAM;YACT,mEAAmE;YACnE,+DAA+D;YAC/D,0CAA0C;YAC1C,IAAI,SAAS,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAA;YAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/C,CAAC;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,iBAAiB,EAAE;QAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;YAEzB,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzF,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;YACrD,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC7E,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAY;YAC1B,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5B,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,eAAoC;YACtD,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;YAC9D,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvB,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC9D,OAAO,QAAQ,CAAA;QAChB,CAAC;QAED,KAAK,CAAC,iBAAiB,CACtB,cAAwC;YAExC,gBAAgB,CAAC,mBAAmB,CAAC,CAAA;YACrC,OAAO,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC/B,OAAO,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACjD,kEAAkE;gBAClE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;gBAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAuB,EAAE,CAAA;gBACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,OAAO;wBAAE,SAAQ;oBACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;oBACjC,IAAI,GAAG,GAAG,CAAC;wBAAE,SAAQ;oBACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;oBACtC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvC,CAAC;gBACD,OAAO,OAAO,CAAA;YACf,CAAC,CAAC,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,cAAsC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;gBAC3C,IAAI,WAAW,CAAC,QAAQ;oBAAE,OAAM;gBAChC,iBAAiB,GAAG,SAAS,CAAA;YAC9B,CAAC;YACD,oEAAoE;YACpE,4DAA4D;YAC5D,kEAAkE;YAClE,SAAS,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3D,KAAK,EAAE,IAAI,EAAE,CAAA;YACb,MAAM,eAAe,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;YACtC,KAAK,MAAM,QAAQ,IAAI,eAAe;gBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAChE,MAAM,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;YAC5E,SAAS,CAAC,KAAK,EAAE,CAAA;YACjB,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,cAAc;YACd,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAmBH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EACN,8BAA8B,GAE9B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAGnD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC,wEAAwE;AACxE,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAI/C;IACA;IAJQ,IAAI,GAAG,iCAAiC,CAAA;IAE1D,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,wBAAwB,SAAS,+IAA+I,CACjN,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAI1C;IACA;IAJQ,IAAI,GAAG,4BAA4B,CAAA;IAErD,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,qCAAqC,SAAS,8OAA8O,CAC7T,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAoGD,SAAS,iBAAiB;IACzB,wEAAwE;IACxE,qEAAqE;IACrE,wCAAwC;IACxC,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAiB,CAAA;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAA;IAGjD,IAAI,SAAS,GAAc,QAAQ,CAAA;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,eAA0C,CAAA;IAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAC5B,IAAI,iBAAoE,CAAA;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAE5C,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,wEAAwE;IACxE,mEAAmE;IACnE,2EAA2E;IAC3E,uEAAuE;IACvE,wBAAwB;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACd,uBAAuB,OAAO,CAAC,IAAI,8CAA8C,MAAM,CAAC,UAAU,CAAC,oUAAoU,CACva,CAAA;IACF,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,KAAK,GACV,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAC9C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,sBAAsB,CAAC;YAC3B,UAAU;YACV,KAAK;YACL,MAAM,EAAE,GAAG,EAAE;gBACZ,+DAA+D;gBAC/D,iEAAiE;gBACjE,8CAA8C;gBAC9C,IAAI,SAAS,KAAK,QAAQ;oBAAE,SAAS,GAAG,MAAM,CAAA;YAC/C,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAA;IACL,KAAK,EAAE,KAAK,EAAE,CAAA;IAEd,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACpD,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAM;QAClC,IAAI,SAAS,KAAK,MAAM;YAAE,MAAM,IAAI,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACvF,MAAM,IAAI,+BAA+B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,MAAoB,EAAiB,EAAE;QACxD,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,KAAK,EAAE,IAAI,EAAE,CAAA;QACb,IAAI,gBAAgB;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9C,IAAI,eAAe;YAAE,OAAO,eAAe,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,GAAG,EAAE;YACJ,gBAAgB,GAAG,IAAI,CAAA;YACvB,SAAS,GAAG,WAAW,CAAA;QACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,8DAA8D;YAC9D,2DAA2D;YAC3D,iBAAiB;YACjB,IAAI,eAAe,KAAK,MAAM;gBAAE,eAAe,GAAG,SAAS,CAAA;YAC3D,MAAM,KAAK,CAAA;QACZ,CAAC,CACD,CAAA;QACD,eAAe,GAAG,MAAM,CAAA;QACxB,OAAO,MAAM,CAAA;IACd,CAAC,CAAA;IAED;;;;;OAKG;IACH,MAAM,MAAM,GAAG,GAA0C,EAAE;QAC1D,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,iBAAiB,KAAK,IAAI,iBAAiB,CAC1C,qBAAqB,EACrB,sBAAsB,OAAO,CAAC,IAAI,aAAa,CAC/C;aACC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC7C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;YAC3B,QAAQ,EAAE,KAAc;YACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAChE,CAAC,CAAC,CAAA;QACJ,OAAO,iBAAiB,CAAA;IACzB,CAAC,CAAA;IAED;;;;OAIG;IACH,MAAM,8BAA8B,GAAG,KAAK,EAC3C,KAAqC,EACG,EAAE;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAA;QAChD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,MAAM,EAAE,CAAA;QAC/C,IAAI,CAAC;YACJ,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,SAAkB,EAAE,CAAC;YAC7B,kEAAkE;YAClE,kEAAkE;YAClE,oBAAoB;YACpB,OAAO;gBACN,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;aAC5E,CAAA;QACF,CAAC;IACF,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAK,SAAiB,EAAE,GAAqB,EAAc,EAAE;QACtF,gBAAgB,CAAC,SAAS,CAAC,CAAA;QAC3B,gBAAgB,IAAI,CAAC,CAAA;QACrB,IAAI,CAAC;YACJ,OAAO,MAAM,GAAG,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;gBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,KAAK,CAAA;QACZ,CAAC;gBAAS,CAAC;YACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;QACrD,CAAC;IACF,CAAC,CAAA;IAED,OAAO;QACN,EAAE;QACF,IAAI,MAAM;YACT,mEAAmE;YACnE,+DAA+D;YAC/D,0CAA0C;YAC1C,IAAI,SAAS,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAA;YAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/C,CAAC;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,iBAAiB,EAAE;QAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;YAEzB,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzF,CAAC;QAED;;;;;;;;;;;;;WAaG;QACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;YACrD,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC7E,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,WAAoC;YAChE,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5B,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAED;;;;;;WAMG;QACH,cAAc,CAAC,IAAY,EAAE,WAAoC;YAChE,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;YAClC,OAAO,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,cAAc;QACd,GAAG,CAAC,gBAAgB,KAAK,SAAS;YACjC,CAAC,CAAC;gBACA,gBAAgB,EAAE,KAAK,EAAE,MAA4B,EAAiB,EAAE;oBACvE,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;oBACpC,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBAC/B,CAAC;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QAEN,KAAK,CAAC,YAAY,CAAC,eAAoC;YACtD,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;YAC9D,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvB,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC9D,OAAO,QAAQ,CAAA;QAChB,CAAC;QAED,KAAK,CAAC,iBAAiB,CACtB,cAAwC;YAExC,gBAAgB,CAAC,mBAAmB,CAAC,CAAA;YACrC,OAAO,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC/B,OAAO,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACjD,kEAAkE;gBAClE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;gBAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAuB,EAAE,CAAA;gBACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,OAAO;wBAAE,SAAQ;oBACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;oBACjC,IAAI,GAAG,GAAG,CAAC;wBAAE,SAAQ;oBACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;oBACtC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvC,CAAC;gBACD,OAAO,OAAO,CAAA;YACf,CAAC,CAAC,CAAA;QACH,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,WAAoC;YAEpC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC7B,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,KAAK,CAAC,CAAC,gBAAgB,CACtB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAChF,QAAQ,EACR,WAAW,CACX,CAAA;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,0DAA0D;gBAC1D,qDAAqD;gBACrD,gEAAgE;gBAChE,gDAAgD;gBAChD,EAAE;gBACF,4DAA4D;gBAC5D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,0DAA0D;gBAC1D,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,cAAsC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;gBAC3C,IAAI,WAAW,CAAC,QAAQ;oBAAE,OAAM;gBAChC,iBAAiB,GAAG,SAAS,CAAA;YAC9B,CAAC;YACD,oEAAoE;YACpE,4DAA4D;YAC5D,kEAAkE;YAClE,SAAS,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3D,KAAK,EAAE,IAAI,EAAE,CAAA;YACb,MAAM,eAAe,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;YACtC,KAAK,MAAM,QAAQ,IAAI,eAAe;gBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAChE,MAAM,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;YAC5E,SAAS,CAAC,KAAK,EAAE,CAAA;YACjB,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,cAAc;YACd,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;KACD,CAAA;AACF,CAAC"}