@paperclipai/plugin-kubernetes 0.1.0 → 2026.620.0-canary.3

package/dist/tenant-orchestrator.js

@@ -0,0 +1,263 @@
+import { buildNetworkPolicyManifests } from "./network-policy.js";
+import { buildCiliumNetworkPolicyManifest } from "./cilium-network-policy.js";
+const SERVICE_ACCOUNT_NAME = "paperclip-tenant-sa";
+const ROLE_NAME = "paperclip-tenant-role";
+const ROLE_BINDING_NAME = "paperclip-tenant-rb";
+const RESOURCE_QUOTA_NAME = "paperclip-quota";
+const LIMIT_RANGE_NAME = "paperclip-limits";
+/**
+ * Lazy, first-write-wins tenant provisioning. Each helper checks if the named
+ * resource exists and creates it only on 404; if it already exists, it is
+ * left as-is — config-driven values (quota limits, RBAC permissions, network
+ * policies, egress allow-list) are FROZEN at first provisioning time.
+ *
+ * V1 limitation: changing KubernetesProviderConfig after a tenant namespace
+ * is provisioned does NOT update the in-cluster resources. To apply config
+ * changes, an operator must delete the per-tenant resources manually (or
+ * the namespace itself). A future iteration should add strategic-merge
+ * reconciliation here.
+ *
+ * Particular gotcha: switching egressMode "standard" → "cilium" leaves the
+ * old paperclip-egress-allow NetworkPolicy in place alongside the new
+ * CiliumNetworkPolicy. Both apply; the effective egress is the intersection.
+ */
+export async function ensureTenant(clients, input) {
+    await ensureNamespace(clients, input);
+    await ensureServiceAccount(clients, input);
+    await ensureRole(clients, input);
+    await ensureRoleBinding(clients, input);
+    await ensureResourceQuota(clients, input);
+    await ensureLimitRange(clients, input);
+    await ensureNetworkPolicies(clients, input);
+}
+async function ensureNamespace(clients, input) {
+    try {
+        await clients.core.readNamespace({ name: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespace({
+        body: {
+            apiVersion: "v1",
+            kind: "Namespace",
+            metadata: {
+                name: input.namespace,
+                labels: {
+                    "paperclip.io/company-id": input.companyId,
+                    "paperclip.io/managed-by": "paperclip-k8s-plugin",
+                    "pod-security.kubernetes.io/enforce": "restricted",
+                    "pod-security.kubernetes.io/audit": "restricted",
+                    "pod-security.kubernetes.io/warn": "restricted",
+                },
+            },
+        },
+    }));
+}
+async function ensureServiceAccount(clients, input) {
+    try {
+        await clients.core.readNamespacedServiceAccount({ name: SERVICE_ACCOUNT_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespacedServiceAccount({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "ServiceAccount",
+            metadata: {
+                name: SERVICE_ACCOUNT_NAME,
+                namespace: input.namespace,
+                annotations: input.serviceAccountAnnotations,
+                labels: { "paperclip.io/managed-by": "paperclip-k8s-plugin" },
+            },
+        },
+    }));
+}
+async function ensureRole(clients, input) {
+    try {
+        await clients.rbac.readNamespacedRole({ name: ROLE_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.rbac.createNamespacedRole({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "Role",
+            metadata: { name: ROLE_NAME, namespace: input.namespace },
+            rules: [
+                { apiGroups: [""], resources: ["pods/log"], verbs: ["get"] },
+            ],
+        },
+    }));
+}
+async function ensureRoleBinding(clients, input) {
+    try {
+        await clients.rbac.readNamespacedRoleBinding({ name: ROLE_BINDING_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.rbac.createNamespacedRoleBinding({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "RoleBinding",
+            metadata: { name: ROLE_BINDING_NAME, namespace: input.namespace },
+            roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: ROLE_NAME },
+            subjects: [{ kind: "ServiceAccount", name: SERVICE_ACCOUNT_NAME, namespace: input.namespace }],
+        },
+    }));
+}
+async function ensureResourceQuota(clients, input) {
+    try {
+        await clients.core.readNamespacedResourceQuota({ name: RESOURCE_QUOTA_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespacedResourceQuota({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "ResourceQuota",
+            metadata: { name: RESOURCE_QUOTA_NAME, namespace: input.namespace },
+            spec: {
+                hard: {
+                    pods: input.resourceQuota.pods,
+                    "requests.cpu": input.resourceQuota.requestsCpu,
+                    "requests.memory": input.resourceQuota.requestsMemory,
+                    "limits.cpu": input.resourceQuota.limitsCpu,
+                    "limits.memory": input.resourceQuota.limitsMemory,
+                },
+            },
+        },
+    }));
+}
+async function ensureLimitRange(clients, input) {
+    try {
+        await clients.core.readNamespacedLimitRange({ name: LIMIT_RANGE_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespacedLimitRange({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "LimitRange",
+            metadata: { name: LIMIT_RANGE_NAME, namespace: input.namespace },
+            spec: {
+                limits: [
+                    {
+                        type: "Container",
+                        max: { cpu: "4", memory: "8Gi" },
+                        min: { cpu: "100m", memory: "128Mi" },
+                        // The k8s client-node type names this `_default` but the actual
+                        // Kubernetes API field is `default`. We produce a JSON-shape
+                        // manifest so the cast is safe.
+                        default: { cpu: "1", memory: "2Gi" },
+                        defaultRequest: { cpu: "250m", memory: "512Mi" },
+                    },
+                ],
+            },
+        },
+    }));
+}
+async function ensureNetworkPolicies(clients, input) {
+    const [denyAll, egressStd] = buildNetworkPolicyManifests({
+        namespace: input.namespace,
+        paperclipServerNamespace: input.paperclipServerNamespace,
+        egressAllowCidrs: input.egressAllowCidrs,
+        egressAllowFqdns: input.egressAllowFqdns,
+    });
+    await ensureNetworkPolicy(clients, input.namespace, denyAll);
+    if (input.egressMode === "cilium") {
+        const cnp = buildCiliumNetworkPolicyManifest({
+            namespace: input.namespace,
+            paperclipServerNamespace: input.paperclipServerNamespace,
+            egressAllowFqdns: input.egressAllowFqdns,
+            egressAllowCidrs: input.egressAllowCidrs,
+        });
+        await ensureCiliumNetworkPolicy(clients, input.namespace, cnp);
+    }
+    else {
+        await ensureNetworkPolicy(clients, input.namespace, egressStd);
+    }
+}
+async function ensureNetworkPolicy(clients, namespace, manifest) {
+    const name = manifest.metadata.name;
+    try {
+        await clients.networking.readNamespacedNetworkPolicy({ name, namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.networking.createNamespacedNetworkPolicy({ namespace, body: manifest }));
+}
+async function ensureCiliumNetworkPolicy(clients, namespace, manifest) {
+    const name = manifest.metadata.name;
+    try {
+        await clients.custom.getNamespacedCustomObject({
+            group: "cilium.io",
+            version: "v2",
+            namespace,
+            plural: "ciliumnetworkpolicies",
+            name,
+        });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.custom.createNamespacedCustomObject({
+        group: "cilium.io",
+        version: "v2",
+        namespace,
+        plural: "ciliumnetworkpolicies",
+        body: manifest,
+    }));
+}
+function isNotFound(err) {
+    if (typeof err !== "object" || err === null)
+        return false;
+    const e = err;
+    return e.code === 404 || e.statusCode === 404;
+}
+function isAlreadyExists(err) {
+    if (typeof err !== "object" || err === null)
+        return false;
+    const e = err;
+    return e.code === 409 || e.statusCode === 409;
+}
+// Two concurrent lease acquisitions for a brand-new tenant can both observe
+// the 404 read and race the create; a 409 AlreadyExists from the loser means
+// the desired state already exists, which is exactly what ensure* wants.
+async function createIgnoringAlreadyExists(create) {
+    try {
+        await create;
+    }
+    catch (err) {
+        if (!isAlreadyExists(err))
+            throw err;
+    }
+}
+//# sourceMappingURL=tenant-orchestrator.js.map

package/dist/tenant-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-orchestrator.js","sourceRoot":"","sources":["../src/tenant-orchestrator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAmB9E,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AACnD,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAoB,EAAE,KAAwB;IAC/E,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAoB,EAAE,KAAwB;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;QACzB,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,SAAS;gBACrB,MAAM,EAAE;oBACN,yBAAyB,EAAE,KAAK,CAAC,SAAS;oBAC1C,yBAAyB,EAAE,sBAAsB;oBACjD,oCAAoC,EAAE,YAAY;oBAClD,kCAAkC,EAAE,YAAY;oBAChD,iCAAiC,EAAE,YAAY;iBAChD;aACF;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAoB,EAAE,KAAwB;IAChF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5G,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE;gBACR,IAAI,EAAE,oBAAoB;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,yBAAyB;gBAC5C,MAAM,EAAE,EAAE,yBAAyB,EAAE,sBAAsB,EAAE;aAC9D;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,KAAwB;IACtE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,8BAA8B;YAC1C,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YACzD,KAAK,EAAE;gBACL,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;aAC7D;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAoB,EAAE,KAAwB;IAC7E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACtG,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,8BAA8B;YAC1C,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YACjE,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjF,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC/F;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAoB,EAAE,KAAwB;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YACnE,IAAI,EAAE;gBACJ,IAAI,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI;oBAC9B,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;oBAC/C,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc;oBACrD,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,SAAS;oBAC3C,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY;iBAClD;aACF;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAoB,EAAE,KAAwB;IAC5E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpG,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAChE,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,WAAW;wBACjB,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;wBAChC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;wBACrC,gEAAgE;wBAChE,6DAA6D;wBAC7D,gCAAgC;wBAChC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;wBACpC,cAAc,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;qBACjD;iBACF;aACF;SACO;KACX,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAoB,EAAE,KAAwB;IACjF,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,2BAA2B,CAAC;QACvD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,gCAAgC,CAAC;YAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;QACH,MAAM,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAoB,EACpB,SAAiB,EACjB,QAAiC;IAEjC,MAAM,IAAI,GAAI,QAAQ,CAAC,QAA6B,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,OAAoB,EACpB,SAAiB,EACjB,QAAiC;IAEjC,MAAM,IAAI,GAAI,QAAQ,CAAC,QAA6B,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC7C,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,IAAI;YACb,SAAS;YACT,MAAM,EAAE,uBAAuB;YAC/B,IAAI;SACL,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC;QACxC,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,IAAI;QACb,SAAS;QACT,MAAM,EAAE,uBAAuB;QAC/B,IAAI,EAAE,QAAQ;KACf,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA6C,CAAC;IACxD,OAAO,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA6C,CAAC;IACxD,OAAO,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,KAAK,UAAU,2BAA2B,CAAC,MAAwB;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,264 @@
+import { z } from "zod";
+export declare const kubernetesProviderConfigSchema: z.ZodEffects<z.ZodObject<{
+    inCluster: z.ZodDefault<z.ZodBoolean>;
+    kubeconfig: z.ZodOptional<z.ZodString>;
+    namespacePrefix: z.ZodDefault<z.ZodString>;
+    companySlug: z.ZodOptional<z.ZodString>;
+    imageRegistry: z.ZodOptional<z.ZodString>;
+    imageAllowList: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    imagePullSecrets: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    egressAllowFqdns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    egressAllowCidrs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    egressMode: z.ZodDefault<z.ZodEnum<["cilium", "standard"]>>;
+    defaultResources: z.ZodOptional<z.ZodObject<{
+        requests: z.ZodOptional<z.ZodObject<{
+            cpu: z.ZodOptional<z.ZodString>;
+            memory: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            cpu: z.ZodOptional<z.ZodString>;
+            memory: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    }, {
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    }>>;
+    runtimeClassName: z.ZodOptional<z.ZodString>;
+    serviceAccountAnnotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    jobTtlSecondsAfterFinished: z.ZodDefault<z.ZodNumber>;
+    podActivityDeadlineSec: z.ZodDefault<z.ZodNumber>;
+    /**
+     * The adapter type that Jobs in this environment will run.
+     * Each Kubernetes environment is bound to one adapter; create multiple
+     * environments for different adapters.
+     * Defaults to `"claude_local"`.
+     */
+    adapterType: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string | undefined>;
+    /**
+     * Optional declarative adapter registry. When present it is authoritative
+     * for runtime image / envKeys / allowFqdns / probe / defaultEnv resolution
+     * (replace semantics). Absent = built-in defaults.
+     */
+    adapters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        adapterType: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        runtimeImage: z.ZodOptional<z.ZodString>;
+        envKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowFqdns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        probeCommand: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        defaultEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        adapterType: string;
+        enabled: boolean;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }, {
+        adapterType: string;
+        enabled?: boolean | undefined;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }>, "many">>;
+    /**
+     * The sandbox backend to use.
+     *
+     * - `"sandbox-cr"` (default, alpha) — uses the kubernetes-sigs/agent-sandbox
+     *   Sandbox CRD (agents.x-k8s.io/v1alpha1). Creates a long-lived pod that
+     *   paperclip-server can exec into for multi-command adapter-install workflows.
+     *   Requires the agent-sandbox controller to be installed in the cluster.
+     *
+     * - `"job"` — uses batch/v1 Job (stable fallback). One-shot entrypoint; does
+     *   NOT support multi-command exec. Use this for clusters without agent-sandbox
+     *   installed, or when you need stable (non-alpha) k8s APIs.
+     */
+    backend: z.ZodDefault<z.ZodEnum<["sandbox-cr", "job"]>>;
+}, "strip", z.ZodTypeAny, {
+    adapterType: string;
+    inCluster: boolean;
+    namespacePrefix: string;
+    imageAllowList: string[];
+    imagePullSecrets: string[];
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+    egressMode: "standard" | "cilium";
+    serviceAccountAnnotations: Record<string, string>;
+    jobTtlSecondsAfterFinished: number;
+    podActivityDeadlineSec: number;
+    backend: "job" | "sandbox-cr";
+    kubeconfig?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    defaultResources?: {
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled: boolean;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+}, {
+    adapterType?: string | undefined;
+    inCluster?: boolean | undefined;
+    kubeconfig?: string | undefined;
+    namespacePrefix?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    imageAllowList?: string[] | undefined;
+    imagePullSecrets?: string[] | undefined;
+    egressAllowFqdns?: string[] | undefined;
+    egressAllowCidrs?: string[] | undefined;
+    egressMode?: "standard" | "cilium" | undefined;
+    defaultResources?: {
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    serviceAccountAnnotations?: Record<string, string> | undefined;
+    jobTtlSecondsAfterFinished?: number | undefined;
+    podActivityDeadlineSec?: number | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled?: boolean | undefined;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+    backend?: "job" | "sandbox-cr" | undefined;
+}>, {
+    adapterType: string;
+    inCluster: boolean;
+    namespacePrefix: string;
+    imageAllowList: string[];
+    imagePullSecrets: string[];
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+    egressMode: "standard" | "cilium";
+    serviceAccountAnnotations: Record<string, string>;
+    jobTtlSecondsAfterFinished: number;
+    podActivityDeadlineSec: number;
+    backend: "job" | "sandbox-cr";
+    kubeconfig?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    defaultResources?: {
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled: boolean;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+}, {
+    adapterType?: string | undefined;
+    inCluster?: boolean | undefined;
+    kubeconfig?: string | undefined;
+    namespacePrefix?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    imageAllowList?: string[] | undefined;
+    imagePullSecrets?: string[] | undefined;
+    egressAllowFqdns?: string[] | undefined;
+    egressAllowCidrs?: string[] | undefined;
+    egressMode?: "standard" | "cilium" | undefined;
+    defaultResources?: {
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    serviceAccountAnnotations?: Record<string, string> | undefined;
+    jobTtlSecondsAfterFinished?: number | undefined;
+    podActivityDeadlineSec?: number | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled?: boolean | undefined;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+    backend?: "job" | "sandbox-cr" | undefined;
+}>;
+export type KubernetesProviderConfig = z.infer<typeof kubernetesProviderConfigSchema>;
+export declare function parseKubernetesProviderConfig(input: unknown): KubernetesProviderConfig;
+export interface KubernetesLeaseMetadata {
+    namespace: string;
+    /** Name of the workload resource (Job name for job backend, Sandbox CR name for sandbox-cr backend). */
+    jobName: string;
+    podName: string | null;
+    secretName: string;
+    phase: "Pending" | "Running" | "Succeeded" | "Failed";
+    /** Which backend provisioned this lease. */
+    backend: "sandbox-cr" | "job";
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BvC;;;;;OAKG;;IAQH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;IAGH;;;;;;;;;;;OAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASJ,CAAC;AAEJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAEtF;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACtD,4CAA4C;IAC5C,OAAO,EAAE,YAAY,GAAG,KAAK,CAAC;CAC/B"}

package/dist/types.js

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { adapterRegistrySchema } from "./adapter-registry.js";
+import { KNOWN_ADAPTER_TYPES } from "./adapter-defaults.js";
+const cidrRegex = /^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$/;
+export const kubernetesProviderConfigSchema = z
+    .object({
+    inCluster: z.boolean().default(false),
+    kubeconfig: z.string().optional(),
+    namespacePrefix: z.string().regex(/^[a-z0-9-]{1,32}$/).default("paperclip-"),
+    companySlug: z.string().regex(/^[a-z0-9-]{1,32}$/).optional(),
+    imageRegistry: z.string().url().optional(),
+    imageAllowList: z.array(z.string()).default([]),
+    imagePullSecrets: z.array(z.string()).default([]),
+    egressAllowFqdns: z.array(z.string()).default([]),
+    egressAllowCidrs: z.array(z.string().regex(cidrRegex, "Invalid CIDR")).default([]),
+    egressMode: z.enum(["cilium", "standard"]).default("standard"),
+    defaultResources: z
+        .object({
+        requests: z.object({ cpu: z.string(), memory: z.string() }).partial().optional(),
+        limits: z.object({ cpu: z.string(), memory: z.string() }).partial().optional(),
+    })
+        .optional(),
+    runtimeClassName: z.string().optional(),
+    serviceAccountAnnotations: z.record(z.string()).default({}),
+    jobTtlSecondsAfterFinished: z.number().int().nonnegative().default(900),
+    podActivityDeadlineSec: z.number().int().positive().default(3600),
+    /**
+     * The adapter type that Jobs in this environment will run.
+     * Each Kubernetes environment is bound to one adapter; create multiple
+     * environments for different adapters.
+     * Defaults to `"claude_local"`.
+     */
+    adapterType: z
+        .string()
+        .default("claude_local")
+        .refine((v) => KNOWN_ADAPTER_TYPES.has(v), {
+        message: "adapterType must be one of the known adapter types",
+    }),
+    /**
+     * Optional declarative adapter registry. When present it is authoritative
+     * for runtime image / envKeys / allowFqdns / probe / defaultEnv resolution
+     * (replace semantics). Absent = built-in defaults.
+     */
+    adapters: adapterRegistrySchema.optional(),
+    /**
+     * The sandbox backend to use.
+     *
+     * - `"sandbox-cr"` (default, alpha) — uses the kubernetes-sigs/agent-sandbox
+     *   Sandbox CRD (agents.x-k8s.io/v1alpha1). Creates a long-lived pod that
+     *   paperclip-server can exec into for multi-command adapter-install workflows.
+     *   Requires the agent-sandbox controller to be installed in the cluster.
+     *
+     * - `"job"` — uses batch/v1 Job (stable fallback). One-shot entrypoint; does
+     *   NOT support multi-command exec. Use this for clusters without agent-sandbox
+     *   installed, or when you need stable (non-alpha) k8s APIs.
+     */
+    backend: z.enum(["sandbox-cr", "job"]).default("sandbox-cr"),
+})
+    .refine((cfg) => cfg.inCluster || cfg.kubeconfig, {
+    message: "kubernetes provider requires one of `inCluster` or `kubeconfig`",
+});
+export function parseKubernetesProviderConfig(input) {
+    return kubernetesProviderConfigSchema.parse(input);
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAE7D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9D,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/E,CAAC;SACD,QAAQ,EAAE;IAEb,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,yBAAyB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEjE;;;;;OAKG;IACH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,OAAO,CAAC,cAAc,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACzC,OAAO,EAAE,oDAAoD;KAC9D,CAAC;IAEJ;;;;OAIG;IACH,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE1C;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CAC7D,CAAC;KACD,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,EACxC;IACE,OAAO,EACL,iEAAiE;CACpE,CACF,CAAC;AAIJ,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC"}

package/dist/upload-interceptor.d.ts

@@ -0,0 +1,44 @@
+export interface InterceptStateFlush {
+    /** Final target path on the remote (decoded payload goes here). */
+    targetPath: string;
+    /** Decoded payload bytes. */
+    payload: Buffer;
+}
+export type InterceptDecision = 
+/** Pattern recognized; respond with success without running the command. */
+{
+    action: "ack";
+    reason: string;
+}
+/** Pattern recognized; flush via single exec. Caller does the exec. */
+ | {
+    action: "flush";
+    flush: InterceptStateFlush;
+}
+/** Pattern not recognized; pass through to the normal exec path. */
+ | {
+    action: "passthrough";
+    reason: string;
+};
+/**
+ * Stateful interceptor. Keyed by the base64 temp path (`<TARGET>.paperclip-upload.b64`).
+ * One instance per plugin worker is fine — concurrent uploads to different paths
+ * don't interfere.
+ */
+export declare class FastUploadInterceptor {
+    private buffers;
+    /**
+     * Inspect a single shell command (the literal argument to `sh -c <cmd>`).
+     * Returns the action the plugin should take.
+     */
+    decide(command: string): InterceptDecision;
+    /**
+     * Drop all buffered state. Called on releaseLease so a new lease doesn't
+     * inherit stale buffers (lease IDs are unique so target paths shouldn't
+     * collide, but cleanup is hygiene).
+     */
+    reset(): void;
+    /** Number of in-flight uploads being tracked. Mostly for tests / diagnostics. */
+    get pendingCount(): number;
+}
+//# sourceMappingURL=upload-interceptor.d.ts.map

package/dist/upload-interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-interceptor.d.ts","sourceRoot":"","sources":["../src/upload-interceptor.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,mBAAmB;IAClC,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB;AAC3B,4EAA4E;AAC1E;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACnC,uEAAuE;GACrE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE;AACjD,oEAAoE;GAClE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ9C;;;;GAIG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,OAAO,CAAkC;IAEjD;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB;IA+D1C;;;;OAIG;IACH,KAAK,IAAI,IAAI;IAIb,iFAAiF;IACjF,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF"}