@namzu/sandbox 2.0.2 → 3.0.0

package/dist/backends/firecracker/__tests__/egress-policy.test.js

@@ -1,67 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { resolveEgressAllowlist } from '../index.js';
-/**
- * Omitting the allowlist means "no allowlist to apply", which the
- * orchestrator reads as unrestricted. That makes omission the encoding for
- * `allow-all` and only for `allow-all`.
- *
- * `resolver` used to be omitted too — so two opposite intentions shared one
- * encoding, the tenant-scoped allowlist the variant exists for was silently
- * absent, and the callback that would have produced it was never called
- * anywhere in the repo. Whichever way the orchestrator reads an omitted
- * field, one of the two variants was always mis-enforced, and the one that
- * failed OPEN was the one whose entire purpose is restriction.
- */
-const opts = (egress) => ({
-    workingDirectory: '/w',
-    ...(egress ? { egress } : {}),
-});
-describe('each policy gets its own encoding', () => {
-    it('allow-all omits the field', async () => {
-        expect(await resolveEgressAllowlist(opts({ kind: 'allow-all' }))).toBeUndefined();
-    });
-    it('deny-all sends an explicitly empty list, not an absent one', async () => {
-        expect(await resolveEgressAllowlist(opts({ kind: 'deny-all' }))).toEqual([]);
-    });
-    it('static forwards the hosts as given', async () => {
-        expect(await resolveEgressAllowlist(opts({ kind: 'static', allowedHosts: ['a.example'] }))).toEqual(['a.example']);
-    });
-    it('resolver calls the callback and forwards what it returned', async () => {
-        const resolve = vi.fn(async () => ['tenant-a.example', 'tenant-b.example']);
-        expect(await resolveEgressAllowlist(opts({ kind: 'resolver', resolve }))).toEqual([
-            'tenant-a.example',
-            'tenant-b.example',
-        ]);
-        // The callback IS the feature. It was declared and never invoked.
-        expect(resolve).toHaveBeenCalledOnce();
-    });
-    it('never encodes resolver the same way as allow-all', async () => {
-        const restrictive = await resolveEgressAllowlist(opts({ kind: 'resolver', resolve: async () => ['only-this.example'] }));
-        const unrestricted = await resolveEgressAllowlist(opts({ kind: 'allow-all' }));
-        expect(restrictive).not.toEqual(unrestricted);
-    });
-    it('sends an empty resolver result as a real deny-all', async () => {
-        // An empty allowlist is a decision, not an absence. Collapsing it
-        // back to omission would turn "this tenant may reach nothing" into
-        // "this tenant may reach everything".
-        expect(await resolveEgressAllowlist(opts({ kind: 'resolver', resolve: async () => [] }))).toEqual([]);
-    });
-    it('omits the field when the host set no policy at all', async () => {
-        expect(await resolveEgressAllowlist(opts())).toBeUndefined();
-    });
-});
-describe('an unknown policy', () => {
-    it('refuses rather than defaulting to unrestricted', async () => {
-        await expect(resolveEgressAllowlist(opts({ kind: 'something-new' }))).rejects.toThrow(/Refusing rather than defaulting to unrestricted/);
-    });
-    it('propagates a failing resolver instead of falling back to open', async () => {
-        // A resolver that cannot answer must not become "allow everything".
-        await expect(resolveEgressAllowlist(opts({
-            kind: 'resolver',
-            resolve: async () => {
-                throw new Error('directory unreachable');
-            },
-        }))).rejects.toThrow('directory unreachable');
-    });
-});
-//# sourceMappingURL=egress-policy.test.js.map

package/dist/backends/firecracker/__tests__/egress-policy.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"egress-policy.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/egress-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAEpD;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,CAAC,MAAwC,EAAyB,EAAE,CAAC,CAAC;IAClF,gBAAgB,EAAE,IAAI;IACtB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,CACL,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CACnF,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAA;QAC3E,MAAM,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACjF,kBAAkB;YAClB,kBAAkB;SAClB,CAAC,CAAA;QACF,kEAAkE;QAClE,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC/C,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CACtE,CAAA;QACD,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,sCAAsC;QACtC,MAAM,CACL,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CACjF,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,CAAC,MAAM,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAC7D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7F,iDAAiD,CACjD,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC9E,oEAAoE;QACpE,MAAM,MAAM,CACX,sBAAsB,CACrB,IAAI,CAAC;YACJ,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,KAAK,IAAI,EAAE;gBACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YACzC,CAAC;SACD,CAAC,CACF,CACD,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/fixtures/ipc-path.d.ts

@@ -1,21 +0,0 @@
-/**
- * A local IPC address Node can actually `listen()` on, for the current OS.
- *
- * These suites bind a loopback agent over a Unix domain socket in a temp
- * directory. Windows supports `AF_UNIX` at the OS level, but Node's `net`
- * server does not bind filesystem sockets there — it wants a **named
- * pipe**, so every one of these tests failed with
- * `listen EACCES: permission denied …\agent.sock` and the whole
- * `@namzu/sandbox` suite has been red for Windows contributors.
- *
- * The transport under test is address-agnostic: it is handed a path and
- * connects to it. So the fix belongs in the fixture, not the driver.
- */
-export declare function localIpcPath(workDir: string, name?: string): string;
-/**
- * True when the socket address lives on disk and can be cleaned up with
- * the temp directory. Named pipes disappear with the process that owns
- * them, so there is nothing to unlink.
- */
-export declare const IPC_IS_FILESYSTEM_PATH: boolean;
-//# sourceMappingURL=ipc-path.d.ts.map

package/dist/backends/firecracker/__tests__/fixtures/ipc-path.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ipc-path.d.ts","sourceRoot":"","sources":["../../../../../src/backends/firecracker/__tests__/fixtures/ipc-path.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAU,GAAG,MAAM,CAOpE;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,SAA+B,CAAA"}

package/dist/backends/firecracker/__tests__/fixtures/ipc-path.js

@@ -1,30 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { join } from 'node:path';
-/**
- * A local IPC address Node can actually `listen()` on, for the current OS.
- *
- * These suites bind a loopback agent over a Unix domain socket in a temp
- * directory. Windows supports `AF_UNIX` at the OS level, but Node's `net`
- * server does not bind filesystem sockets there — it wants a **named
- * pipe**, so every one of these tests failed with
- * `listen EACCES: permission denied …\agent.sock` and the whole
- * `@namzu/sandbox` suite has been red for Windows contributors.
- *
- * The transport under test is address-agnostic: it is handed a path and
- * connects to it. So the fix belongs in the fixture, not the driver.
- */
-export function localIpcPath(workDir, name = 'agent') {
-    if (process.platform === 'win32') {
-        // Named pipes are not filesystem entries, so the temp dir cannot
-        // namespace them — a uuid keeps concurrent test files apart.
-        return `\\\\.\\pipe\\namzu-${name}-${randomUUID()}`;
-    }
-    return join(workDir, `${name}.sock`);
-}
-/**
- * True when the socket address lives on disk and can be cleaned up with
- * the temp directory. Named pipes disappear with the process that owns
- * them, so there is nothing to unlink.
- */
-export const IPC_IS_FILESYSTEM_PATH = process.platform !== 'win32';
-//# sourceMappingURL=ipc-path.js.map

package/dist/backends/firecracker/__tests__/fixtures/ipc-path.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ipc-path.js","sourceRoot":"","sources":["../../../../../src/backends/firecracker/__tests__/fixtures/ipc-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,OAAO;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,iEAAiE;QACjE,6DAA6D;QAC7D,OAAO,sBAAsB,IAAI,IAAI,UAAU,EAAE,EAAE,CAAA;IACpD,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA"}

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts

@@ -1,39 +0,0 @@
-/**
- * Shared Ring-0 mTLS test PKI + a loopback relay stand-in.
- *
- * A throwaway P-256 test PKI (CA + server leaf + client leaf + an unrelated
- * rogue client) baked in as PEM constants — no openssl/forge at test time, so
- * the package stays dependency-light. Minted offline:
- *   openssl ec/x509 self-signed CA + leaves
- *   (server SAN = DNS:sandbox.fc.internal, IP:127.0.0.1), far-future expiry.
- * `ROGUE_*` chains to a DIFFERENT CA to prove `rejectUnauthorized` blocks it.
- *
- * Used by both transport.test.ts (the raw `kind:'mtls'` dialer arm) and
- * backend.test.ts (the cert-INJECTION seam through `buildFirecrackerBackend`),
- * so the PKI + relay harness lives in one place instead of per-test copies.
- */
-import { type Server as TlsServer } from 'node:tls';
-export declare const CA_CRT = "-----BEGIN CERTIFICATE-----\nMIIBjjCCATWgAwIBAgIUGXUtG14KQr4spNGW7rpfjZGoBIIwCgYIKoZIzj0EAwIw\nHDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP\nMjEyNjA1MjMwODMyNTJaMBwxGjAYBgNVBAMMEXZhbmRhbC1mYy10ZXN0LWNhMFkw\nEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5l+vjhjm/PX02D55n56EwelgvM1jrqQM\nZ+ezzvMmrZEBGWInvBND3z3kc6nv7snu6fHT2HHOyhwUNoLqmrIg/qNTMFEwHQYD\nVR0OBBYEFP0M8/KZY1ovxyGDci5iuoYXcmZgMB8GA1UdIwQYMBaAFP0M8/KZY1ov\nxyGDci5iuoYXcmZgMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIg\nC0xtFDASnwsOYT0GiZwzYWTOBfgmjDWK7ANXQQFNTh4CICVLQwq5eLy3424drEHk\n5Ol/FNKVZcGRjE96rB0mRUOp\n-----END CERTIFICATE-----\n";
-export declare const SERVER_CRT = "-----BEGIN CERTIFICATE-----\nMIIBsDCCAVWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1MwCgYIKoZIzj0EAwIw\nHDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP\nMjEyNjA1MjMwODMyNTJaMBIxEDAOBgNVBAMMB2ZjLWhvc3QwWTATBgcqhkjOPQIB\nBggqhkjOPQMBBwNCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMBfmonVb7dUhM0ZWpo\nePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6o30wezAkBgNVHREEHTAbghNz\nYW5kYm94LmZjLmludGVybmFshwR/AAABMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0G\nA1UdDgQWBBRXHU1vlX7WvqzcbaNxRxV4f3gfDDAfBgNVHSMEGDAWgBT9DPPymWNa\nL8chg3IuYrqGF3JmYDAKBggqhkjOPQQDAgNJADBGAiEAlqzKqgBf5hxJqd26QwcY\nn3cvEKi4f2BSLe1Rfzr5oSoCIQD0izUOJXLNvmac9cMgV0HvkftBerDKFOcGeGTN\ng3Eunw==\n-----END CERTIFICATE-----\n";
-export declare const SERVER_KEY = "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg/ROnYXIkMKnipbLt\nJnFEwXAifgeOv9TGLcK2RojE7jmhRANCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMB\nfmonVb7dUhM0ZWpoePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6\n-----END PRIVATE KEY-----\n";
-export declare const CLIENT_CRT = "-----BEGIN CERTIFICATE-----\nMIIBjjCCATWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1QwCgYIKoZIzj0EAwIw\nHDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP\nMjEyNjA1MjMwODMyNTJaMBgxFjAUBgNVBAMMDWNhLXZhbmRhbC1hcHAwWTATBgcq\nhkjOPQIBBggqhkjOPQMBBwNCAASlCMCwjtrQUicWcWsO29R5S7fzjMbbxXvDh8/K\nw57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXko1cwVTATBgNVHSUE\nDDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQU2cxDCNrlVkk4ODs6ZPrkC6GzHjkwHwYD\nVR0jBBgwFoAU/Qzz8pljWi/HIYNyLmK6hhdyZmAwCgYIKoZIzj0EAwIDRwAwRAIg\nRghqArNm3bXnWnRi+jkEEJa8mRb2z0Wj4G7SIhtMurUCIBQSllVtICgZB9hvcM0D\nd24fcW4nlfvaZJMJ6dRC1Wle\n-----END CERTIFICATE-----\n";
-export declare const CLIENT_KEY = "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgaamj/ycrEuPqpiC2\nIhAYx/M5iN4t4P+B17V4GO54Nb2hRANCAASlCMCwjtrQUicWcWsO29R5S7fzjMbb\nxXvDh8/Kw57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXk\n-----END PRIVATE KEY-----\n";
-export declare const ROGUE_CLIENT_CRT = "-----BEGIN CERTIFICATE-----\nMIIBhjCCASugAwIBAgIUbAYOlW4PQGyXjjRsjCPy62EHUmIwCgYIKoZIzj0EAwIw\nEzERMA8GA1UEAwwIcm9ndWUtY2EwIBcNMjYwNjE2MDgzMjUyWhgPMjEyNjA1MjMw\nODMyNTJaMBcxFTATBgNVBAMMDHJvZ3VlLWNsaWVudDBZMBMGByqGSM49AgEGCCqG\nSM49AwEHA0IABOPSzdzQTQz3M5CDHLVPguvHd10ncaDV9t4zKUy/PCE+U7GTJwN2\nTtypGnmYEahbcl45j94hwu495P5VbR5ohb6jVzBVMBMGA1UdJQQMMAoGCCsGAQUF\nBwMCMB0GA1UdDgQWBBTf0woauniche3/ps77+Kd0dsbbSDAfBgNVHSMEGDAWgBSX\nYu0IJlPxi79Gyi5hR1IfS/sqyzAKBggqhkjOPQQDAgNJADBGAiEAxD4N4XWtaHPJ\nyaCOzQP0e5RRyNst3QrhH0NSMyPw89wCIQC+bezLX97TuV1sId53Bo1l9j1TSOMa\nEZotN/Wsq6L+qw==\n-----END CERTIFICATE-----\n";
-export declare const ROGUE_CLIENT_KEY = "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgR6fGq27O9eT/hi0Q\nc+L5+lSm5fbDEghVJCo6k7HrG62hRANCAATj0s3c0E0M9zOQgxy1T4Lrx3ddJ3Gg\n1fbeMylMvzwhPlOxkycDdk7cqRp5mBGoW3JeOY/eIcLuPeT+VW0eaIW+\n-----END PRIVATE KEY-----\n";
-export interface RelayHandle {
-    readonly server: TlsServer;
-    readonly port: number;
-    /** sandboxId from the first connection's `SANDBOX <id>` preamble. */
-    preamble(): Promise<string>;
-}
-/**
- * A loopback stand-in for the per-FC-host mTLS relay.
- *
- * Terminates mTLS (requestCert + rejectUnauthorized + CA pin), reads the
- * `SANDBOX <id>\n` routing preamble line, then bridges the rest of the TLS
- * stream verbatim to a FRESH `net.connect` to `agentSockPath` (the
- * unix-socket-backed real agent) — exactly the dumb byte-pump the production
- * relay is. It does NOT speak framing itself and does NOT send an ack line.
- */
-export declare function startMtlsRelay(agentSockPath: string, listenPort?: number): Promise<RelayHandle>;
-//# sourceMappingURL=mtls-pki.d.ts.map

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mtls-pki.d.ts","sourceRoot":"","sources":["../../../../../src/backends/firecracker/__tests__/fixtures/mtls-pki.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAkB,KAAK,MAAM,IAAI,SAAS,EAAmC,MAAM,UAAU,CAAA;AAEpG,eAAO,MAAM,MAAM,umBAWlB,CAAA;AAED,eAAO,MAAM,UAAU,ypBAYtB,CAAA;AAED,eAAO,MAAM,UAAU,2PAKtB,CAAA;AAED,eAAO,MAAM,UAAU,umBAWtB,CAAA;AAED,eAAO,MAAM,UAAU,2PAKtB,CAAA;AAED,eAAO,MAAM,gBAAgB,+lBAW5B,CAAA;AAED,eAAO,MAAM,gBAAgB,2PAK5B,CAAA;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,SAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAyD1F"}

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js

@@ -1,149 +0,0 @@
-/**
- * Shared Ring-0 mTLS test PKI + a loopback relay stand-in.
- *
- * A throwaway P-256 test PKI (CA + server leaf + client leaf + an unrelated
- * rogue client) baked in as PEM constants — no openssl/forge at test time, so
- * the package stays dependency-light. Minted offline:
- *   openssl ec/x509 self-signed CA + leaves
- *   (server SAN = DNS:sandbox.fc.internal, IP:127.0.0.1), far-future expiry.
- * `ROGUE_*` chains to a DIFFERENT CA to prove `rejectUnauthorized` blocks it.
- *
- * Used by both transport.test.ts (the raw `kind:'mtls'` dialer arm) and
- * backend.test.ts (the cert-INJECTION seam through `buildFirecrackerBackend`),
- * so the PKI + relay harness lives in one place instead of per-test copies.
- */
-import { connect as netConnect } from 'node:net';
-import { createServer as createTlsServer } from 'node:tls';
-export const CA_CRT = `-----BEGIN CERTIFICATE-----
-MIIBjjCCATWgAwIBAgIUGXUtG14KQr4spNGW7rpfjZGoBIIwCgYIKoZIzj0EAwIw
-HDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP
-MjEyNjA1MjMwODMyNTJaMBwxGjAYBgNVBAMMEXZhbmRhbC1mYy10ZXN0LWNhMFkw
-EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5l+vjhjm/PX02D55n56EwelgvM1jrqQM
-Z+ezzvMmrZEBGWInvBND3z3kc6nv7snu6fHT2HHOyhwUNoLqmrIg/qNTMFEwHQYD
-VR0OBBYEFP0M8/KZY1ovxyGDci5iuoYXcmZgMB8GA1UdIwQYMBaAFP0M8/KZY1ov
-xyGDci5iuoYXcmZgMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIg
-C0xtFDASnwsOYT0GiZwzYWTOBfgmjDWK7ANXQQFNTh4CICVLQwq5eLy3424drEHk
-5Ol/FNKVZcGRjE96rB0mRUOp
------END CERTIFICATE-----
-`;
-export const SERVER_CRT = `-----BEGIN CERTIFICATE-----
-MIIBsDCCAVWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1MwCgYIKoZIzj0EAwIw
-HDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP
-MjEyNjA1MjMwODMyNTJaMBIxEDAOBgNVBAMMB2ZjLWhvc3QwWTATBgcqhkjOPQIB
-BggqhkjOPQMBBwNCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMBfmonVb7dUhM0ZWpo
-ePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6o30wezAkBgNVHREEHTAbghNz
-YW5kYm94LmZjLmludGVybmFshwR/AAABMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0G
-A1UdDgQWBBRXHU1vlX7WvqzcbaNxRxV4f3gfDDAfBgNVHSMEGDAWgBT9DPPymWNa
-L8chg3IuYrqGF3JmYDAKBggqhkjOPQQDAgNJADBGAiEAlqzKqgBf5hxJqd26QwcY
-n3cvEKi4f2BSLe1Rfzr5oSoCIQD0izUOJXLNvmac9cMgV0HvkftBerDKFOcGeGTN
-g3Eunw==
------END CERTIFICATE-----
-`;
-export const SERVER_KEY = `-----BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg/ROnYXIkMKnipbLt
-JnFEwXAifgeOv9TGLcK2RojE7jmhRANCAAQodCSHY8Sz5Lh/4K6+SzekkrRCeKMB
-fmonVb7dUhM0ZWpoePCcRrMcJp5aNxLxEgkl2EMMMMwE3LlLSOX5LZz6
------END PRIVATE KEY-----
-`;
-export const CLIENT_CRT = `-----BEGIN CERTIFICATE-----
-MIIBjjCCATWgAwIBAgIUYkXroqlz9blXW8llis6e2OxOc1QwCgYIKoZIzj0EAwIw
-HDEaMBgGA1UEAwwRdmFuZGFsLWZjLXRlc3QtY2EwIBcNMjYwNjE2MDgzMjUyWhgP
-MjEyNjA1MjMwODMyNTJaMBgxFjAUBgNVBAMMDWNhLXZhbmRhbC1hcHAwWTATBgcq
-hkjOPQIBBggqhkjOPQMBBwNCAASlCMCwjtrQUicWcWsO29R5S7fzjMbbxXvDh8/K
-w57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXko1cwVTATBgNVHSUE
-DDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQU2cxDCNrlVkk4ODs6ZPrkC6GzHjkwHwYD
-VR0jBBgwFoAU/Qzz8pljWi/HIYNyLmK6hhdyZmAwCgYIKoZIzj0EAwIDRwAwRAIg
-RghqArNm3bXnWnRi+jkEEJa8mRb2z0Wj4G7SIhtMurUCIBQSllVtICgZB9hvcM0D
-d24fcW4nlfvaZJMJ6dRC1Wle
------END CERTIFICATE-----
-`;
-export const CLIENT_KEY = `-----BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgaamj/ycrEuPqpiC2
-IhAYx/M5iN4t4P+B17V4GO54Nb2hRANCAASlCMCwjtrQUicWcWsO29R5S7fzjMbb
-xXvDh8/Kw57x/PN/uQwLHWCz1Tsyk0FnbrwGP+nPtwrUPIxrLN//euXk
------END PRIVATE KEY-----
-`;
-export const ROGUE_CLIENT_CRT = `-----BEGIN CERTIFICATE-----
-MIIBhjCCASugAwIBAgIUbAYOlW4PQGyXjjRsjCPy62EHUmIwCgYIKoZIzj0EAwIw
-EzERMA8GA1UEAwwIcm9ndWUtY2EwIBcNMjYwNjE2MDgzMjUyWhgPMjEyNjA1MjMw
-ODMyNTJaMBcxFTATBgNVBAMMDHJvZ3VlLWNsaWVudDBZMBMGByqGSM49AgEGCCqG
-SM49AwEHA0IABOPSzdzQTQz3M5CDHLVPguvHd10ncaDV9t4zKUy/PCE+U7GTJwN2
-TtypGnmYEahbcl45j94hwu495P5VbR5ohb6jVzBVMBMGA1UdJQQMMAoGCCsGAQUF
-BwMCMB0GA1UdDgQWBBTf0woauniche3/ps77+Kd0dsbbSDAfBgNVHSMEGDAWgBSX
-Yu0IJlPxi79Gyi5hR1IfS/sqyzAKBggqhkjOPQQDAgNJADBGAiEAxD4N4XWtaHPJ
-yaCOzQP0e5RRyNst3QrhH0NSMyPw89wCIQC+bezLX97TuV1sId53Bo1l9j1TSOMa
-EZotN/Wsq6L+qw==
------END CERTIFICATE-----
-`;
-export const ROGUE_CLIENT_KEY = `-----BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgR6fGq27O9eT/hi0Q
-c+L5+lSm5fbDEghVJCo6k7HrG62hRANCAATj0s3c0E0M9zOQgxy1T4Lrx3ddJ3Gg
-1fbeMylMvzwhPlOxkycDdk7cqRp5mBGoW3JeOY/eIcLuPeT+VW0eaIW+
------END PRIVATE KEY-----
-`;
-/**
- * A loopback stand-in for the per-FC-host mTLS relay.
- *
- * Terminates mTLS (requestCert + rejectUnauthorized + CA pin), reads the
- * `SANDBOX <id>\n` routing preamble line, then bridges the rest of the TLS
- * stream verbatim to a FRESH `net.connect` to `agentSockPath` (the
- * unix-socket-backed real agent) — exactly the dumb byte-pump the production
- * relay is. It does NOT speak framing itself and does NOT send an ack line.
- */
-export function startMtlsRelay(agentSockPath, listenPort = 0) {
-    let resolvePreamble;
-    const preamble = new Promise((r) => {
-        resolvePreamble = r;
-    });
-    return new Promise((resolve, reject) => {
-        const server = createTlsServer({
-            requestCert: true,
-            rejectUnauthorized: true,
-            ca: CA_CRT,
-            cert: SERVER_CRT,
-            key: SERVER_KEY,
-            minVersion: 'TLSv1.3',
-        }, (tlsSock) => {
-            let pre = Buffer.alloc(0);
-            const onPreambleData = (chunk) => {
-                pre = Buffer.concat([pre, chunk]);
-                const nl = pre.indexOf(0x0a);
-                if (nl < 0)
-                    return;
-                tlsSock.removeListener('data', onPreambleData);
-                tlsSock.pause();
-                const line = pre.subarray(0, nl).toString('utf8');
-                const rest = pre.subarray(nl + 1);
-                if (rest.length > 0)
-                    tlsSock.unshift(rest);
-                const m = /^SANDBOX (.+)$/.exec(line);
-                const id = m?.[1];
-                if (id === undefined) {
-                    tlsSock.destroy();
-                    return;
-                }
-                resolvePreamble(id);
-                // 1 inbound mTLS conn -> 1 FRESH local agent connect (the
-                // resume-survival invariant the relay must preserve).
-                const upstream = netConnect({ path: agentSockPath });
-                upstream.on('error', () => tlsSock.destroy());
-                tlsSock.on('error', () => upstream.destroy());
-                upstream.once('connect', () => {
-                    tlsSock.pipe(upstream);
-                    upstream.pipe(tlsSock);
-                });
-            };
-            tlsSock.on('data', onPreambleData);
-        });
-        server.on('error', reject);
-        server.listen(listenPort, '127.0.0.1', () => {
-            const addr = server.address();
-            if (addr === null || typeof addr === 'string') {
-                reject(new Error('relay: no TCP port'));
-                return;
-            }
-            resolve({ server, port: addr.port, preamble: () => preamble });
-        });
-    });
-}
-//# sourceMappingURL=mtls-pki.js.map

package/dist/backends/firecracker/__tests__/fixtures/mtls-pki.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mtls-pki.js","sourceRoot":"","sources":["../../../../../src/backends/firecracker/__tests__/fixtures/mtls-pki.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,EAA4C,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAA;AAEpG,MAAM,CAAC,MAAM,MAAM,GAAG;;;;;;;;;;;CAWrB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;CAYzB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;CAKzB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;CAWzB,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;CAKzB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;CAW/B,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;CAK/B,CAAA;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB,EAAE,UAAU,GAAG,CAAC;IACnE,IAAI,eAAqC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,EAAE;QAC1C,eAAe,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,eAAe,CAC7B;YACC,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,IAAI;YACxB,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,UAAU;YACf,UAAU,EAAE,SAAS;SACrB,EACD,CAAC,OAAkB,EAAE,EAAE;YACtB,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACzB,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE;gBACxC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;gBACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC5B,IAAI,EAAE,GAAG,CAAC;oBAAE,OAAM;gBAClB,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;gBAC9C,OAAO,CAAC,KAAK,EAAE,CAAA;gBACf,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACjD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;gBACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC1C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACjB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;oBACtB,OAAO,CAAC,OAAO,EAAE,CAAA;oBACjB,OAAM;gBACP,CAAC;gBACD,eAAe,CAAC,EAAE,CAAC,CAAA;gBACnB,0DAA0D;gBAC1D,sDAAsD;gBACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;gBACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC7C,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC7C,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;oBAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;oBACtB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACvB,CAAC,CAAC,CAAA;YACH,CAAC,CAAA;YACD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;QACnC,CAAC,CACD,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAA;gBACvC,OAAM;YACP,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/backends/firecracker/__tests__/protocol.test.d.ts

@@ -1,6 +0,0 @@
-/**
- * Unit-pins the shared NDJSON codec the vsock + HTTP transports both
- * speak, and the `pickBackend` routing for `microvm:self-hosted`.
- */
-export {};
-//# sourceMappingURL=protocol.test.d.ts.map

package/dist/backends/firecracker/__tests__/protocol.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"protocol.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/protocol.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/backends/firecracker/__tests__/protocol.test.js

@@ -1,67 +0,0 @@
-/**
- * Unit-pins the shared NDJSON codec the vsock + HTTP transports both
- * speak, and the `pickBackend` routing for `microvm:self-hosted`.
- */
-import { describe, expect, it } from 'vitest';
-import { SandboxBackendNotImplementedError, createSandboxProvider } from '../../../index.js';
-import { ExecResultAccumulator, parseExecLine } from '../protocol.js';
-describe('ExecResultAccumulator', () => {
-    it('accumulates stdout/stderr deltas and captures the terminal result', () => {
-        const acc = new ExecResultAccumulator(0);
-        expect(acc.push({ type: 'stdout_delta', data: 'a' })).toBe(false);
-        expect(acc.push({ type: 'stdout_delta', data: 'b' })).toBe(false);
-        expect(acc.push({ type: 'stderr_delta', data: 'E' })).toBe(false);
-        expect(acc.done).toBe(false);
-        expect(acc.push({ type: 'result', exitCode: 0, timedOut: false })).toBe(true);
-        expect(acc.done).toBe(true);
-        const r = acc.finish();
-        expect(r.stdout).toBe('ab');
-        expect(r.stderr).toBe('E');
-        expect(r.exitCode).toBe(0);
-        expect(r.timedOut).toBe(false);
-    });
-    it('throws on an error event (docker loop parity)', () => {
-        const acc = new ExecResultAccumulator(0);
-        expect(() => acc.push({ type: 'error', error: 'boom' })).toThrow('boom');
-    });
-});
-describe('parseExecLine', () => {
-    it('parses a valid NDJSON line', () => {
-        expect(parseExecLine('{"type":"stdout_delta","data":"x"}')).toEqual({
-            type: 'stdout_delta',
-            data: 'x',
-        });
-    });
-    it('returns undefined for blank or malformed lines (SyntaxError swallow)', () => {
-        expect(parseExecLine('')).toBeUndefined();
-        expect(parseExecLine('   ')).toBeUndefined();
-        expect(parseExecLine('{not json')).toBeUndefined();
-    });
-});
-describe('pickBackend — microvm:self-hosted', () => {
-    it('builds the firecracker backend when orchestratorEndpoint + getToken are present', () => {
-        const provider = createSandboxProvider({
-            backend: {
-                tier: 'microvm',
-                service: 'self-hosted',
-                orchestratorEndpoint: 'https://orchestrator.test',
-                getToken: async () => 'tok',
-                template: 'golden-rev-1',
-            },
-        });
-        expect(provider.id).toContain('microvm');
-        expect(provider.id).toContain('firecracker');
-        expect(provider.name).toContain('microvm:self-hosted');
-    });
-    it('refuses the shape that reaches no orchestrator', () => {
-        // The control-plane endpoint and its bearer are required now. They
-        // used to be optional beside three REQUIRED fields belonging to a
-        // local-daemon path that was never written, so the only working
-        // configuration had to supply three values nothing reads — and
-        // omitting these two type-checked its way to a runtime throw.
-        expect(() => createSandboxProvider({
-            backend: { tier: 'microvm', service: 'self-hosted' },
-        })).toThrow(SandboxBackendNotImplementedError);
-    });
-});
-//# sourceMappingURL=protocol.test.js.map

package/dist/backends/firecracker/__tests__/protocol.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"protocol.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/protocol.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,iCAAiC,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAErE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;QACtB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,aAAa,CAAC,oCAAoC,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,GAAG;SACT,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QACzC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5C,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QAC1F,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE;gBACR,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,aAAa;gBACtB,oBAAoB,EAAE,2BAA2B;gBACjD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;gBAC3B,QAAQ,EAAE,cAAc;aACxB;SACD,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACxC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,+DAA+D;QAC/D,8DAA8D;QAC9D,MAAM,CAAC,GAAG,EAAE,CACX,qBAAqB,CAAC;YACrB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE;SAC3C,CAAC,CACX,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/transport.test.d.ts

@@ -1,20 +0,0 @@
-/**
- * Loopback transport round-trip tests for the Firecracker vsock path.
- *
- * These prove the NEW transport (host dialer ↔ in-VM agent) over a
- * **unix-socket stand-in** — the faithful local peer for AF_VSOCK,
- * because the production vsock path also terminates on a host
- * unix socket (see `transport.ts` docblock). The peer is the REAL
- * `agent/agent.cjs` connection handler (its spawn/jail + NDJSON shapes
- * verbatim), driven in-process over a temp unix socket; the client is
- * the REAL {@link VsockAgentTransport}. So one test exercises:
- *   - exec → streamed stdout/stderr/result NDJSON, accumulated;
- *   - writeFile / readFile → base64 round-trip through the jail;
- *   - a simulated resume (server torn down + re-listened) survived by
- *     the dialer's connect-retry budget — the FC #4713 invariant.
- *
- * No docker, no Azure, no AF_VSOCK kernel support required: pure
- * loopback, safe in CI.
- */
-export {};
-//# sourceMappingURL=transport.test.d.ts.map

package/dist/backends/firecracker/__tests__/transport.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/transport.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}