@paperclipai/plugin-kubernetes 0.1.0 → 2026.620.0-canary.4

package/dist/sandbox-cr-orchestrator.js

@@ -0,0 +1,248 @@
+/**
+ * SandboxOrchestrator implementation backed by the kubernetes-sigs/agent-sandbox
+ * Sandbox CRD (agents.x-k8s.io/v1alpha1).
+ *
+ * The Sandbox CR creates a long-lived pod that paperclip-server can exec into
+ * for multi-command adapter-install workflows — the key architectural win over
+ * the batch/v1 Job backend.
+ *
+ * Key semantic differences from jobOrchestrator:
+ * - claim() creates a Sandbox CR via CustomObjectsApi instead of a batch Job
+ * - getStatus() maps Sandbox phase (Pending|Ready|Terminating|Failed) to SandboxStatus
+ * - findPod() reads status.podName from the Sandbox CR (falls back to label query)
+ * - waitForCompletion() means "wait until pod is Ready to exec" NOT "wait until
+ *   workload finishes". The Sandbox pod runs sleep infinity; execution completion
+ *   is tracked by the individual execInPod() calls.
+ * - release() deletes the Sandbox CR with Foreground propagation (controller
+ *   tears down the underlying pod).
+ *
+ * NOTE: streamLogs() is provided for interface conformance but is limited —
+ * the sleep-infinity pod has no meaningful stdout. Callers in execute mode
+ * should use execInPod() and capture its stdout/stderr directly.
+ */
+const SANDBOX_GROUP = "agents.x-k8s.io";
+const SANDBOX_VERSION = "v1alpha1";
+const SANDBOX_PLURAL = "sandboxes";
+export class SandboxCrTimeoutError extends Error {
+    constructor(namespace, name, timeoutMs) {
+        super(`Sandbox ${namespace}/${name} did not reach Ready phase within ${timeoutMs}ms`);
+        this.name = "SandboxCrTimeoutError";
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Map a Sandbox CR status.phase value to our SandboxStatus shape.
+ * Sandbox phases: Pending | Ready | Terminating | Failed
+ */
+function mapSandboxPhase(cr) {
+    const status = cr.status ?? {};
+    const phase = status.phase ?? "Pending";
+    switch (phase) {
+        case "Ready":
+            return {
+                phase: "Running", // SandboxStatus.phase uses Job semantics; "Running" = active pod
+                complete: false,
+                active: 1,
+                succeeded: 0,
+                failed: 0,
+            };
+        case "Terminating":
+            return {
+                phase: "Running",
+                complete: false,
+                active: 0,
+                succeeded: 0,
+                failed: 0,
+                reason: "Terminating",
+            };
+        case "Failed": {
+            const conditions = status.conditions ?? [];
+            const failedCond = conditions.find((c) => c.type === "Failed");
+            return {
+                phase: "Failed",
+                complete: false,
+                active: 0,
+                succeeded: 0,
+                failed: 1,
+                reason: failedCond?.reason,
+                message: failedCond?.message,
+            };
+        }
+        default:
+            // "Pending" or unknown
+            return {
+                phase: "Pending",
+                complete: false,
+                active: 0,
+                succeeded: 0,
+                failed: 0,
+            };
+    }
+}
+export async function createSandboxCr(clients, namespace, manifest) {
+    const result = await clients.custom.createNamespacedCustomObject({
+        group: SANDBOX_GROUP,
+        version: SANDBOX_VERSION,
+        namespace,
+        plural: SANDBOX_PLURAL,
+        body: manifest,
+    });
+    const uid = result.metadata?.uid;
+    if (!uid)
+        throw new Error("Sandbox CR created without a UID");
+    return { uid };
+}
+export async function getSandboxCrStatus(clients, namespace, name) {
+    const result = await clients.custom.getNamespacedCustomObject({
+        group: SANDBOX_GROUP,
+        version: SANDBOX_VERSION,
+        namespace,
+        plural: SANDBOX_PLURAL,
+        name,
+    });
+    return mapSandboxPhase(result);
+}
+/**
+ * Returns the pod name backing a Sandbox CR.
+ * Primary: read status.podName from the CR (set by the controller once ready).
+ * Fallback: list pods in the namespace filtered by the paperclip.io/managed-by
+ * label and the sandbox name label set on the pod template.
+ */
+export async function findPodForSandbox(clients, namespace, name) {
+    // Primary: read status.podName from the Sandbox CR
+    const cr = await clients.custom.getNamespacedCustomObject({
+        group: SANDBOX_GROUP,
+        version: SANDBOX_VERSION,
+        namespace,
+        plural: SANDBOX_PLURAL,
+        name,
+    });
+    const status = cr.status ?? {};
+    const podName = status.podName;
+    if (podName && podName.trim().length > 0) {
+        return podName;
+    }
+    // Secondary: the agent-sandbox controller (v0.4.x) names the backing pod
+    // EXACTLY after the Sandbox CR and labels it only with
+    // agents.x-k8s.io/sandbox-name-hash (a hash, not the full name), so the
+    // full-name label selector below matches nothing on that controller. An
+    // exact-name GET is collision-free (unlike name-prefix matching, which
+    // could hit a concurrent sandbox sharing a prefix) and resolves the pod on
+    // every controller version that keeps pod name == sandbox name.
+    try {
+        const pod = (await clients.core.readNamespacedPod({ namespace, name }));
+        if (pod?.metadata?.name) {
+            return pod.metadata.name;
+        }
+    }
+    catch (err) {
+        const code = err.code ??
+            err.statusCode;
+        if (code !== 404)
+            throw err;
+    }
+    // Fallback: list pods by a full-name sandbox label, for controller versions
+    // that label pods with the sandbox name. A broader managed-by selector plus
+    // name-prefix narrowing could match a concurrent sandbox whose generated
+    // name shares a prefix, and exec would target the wrong lease's pod.
+    const result = await clients.core.listNamespacedPod({
+        namespace,
+        labelSelector: `agents.x-k8s.io/sandbox-name=${name}`,
+    });
+    const items = (result.items) ?? [];
+    // The label selector already scopes to exactly this sandbox's pod(s); keep a
+    // defensive re-check on the label value only (no name-prefix matching).
+    const matching = items.filter((p) => (p.metadata?.labels ?? {})["agents.x-k8s.io/sandbox-name"] === name);
+    const running = matching.find((p) => p.status?.phase === "Running");
+    return (running ?? matching[0])?.metadata?.name ?? null;
+}
+export async function streamSandboxLogs(clients, namespace, podName, onChunk) {
+    // V1 limitation: readNamespacedPodLog returns combined stdout. The
+    // sleep-infinity pod will have minimal output; this is provided for interface
+    // conformance. For actual command output, use execInPod() directly.
+    const result = await clients.core.readNamespacedPodLog({
+        namespace,
+        name: podName,
+    });
+    const text = result ?? "";
+    if (text.length > 0)
+        await onChunk("stdout", text);
+}
+export async function deleteSandboxCr(clients, namespace, name) {
+    await clients.custom.deleteNamespacedCustomObject({
+        group: SANDBOX_GROUP,
+        version: SANDBOX_VERSION,
+        namespace,
+        plural: SANDBOX_PLURAL,
+        name,
+        propagationPolicy: "Foreground",
+    });
+}
+/**
+ * Wait until the Sandbox CR's pod reaches Ready phase (i.e., the pod is up and
+ * exec-able). This is NOT waiting for a workload to finish — the Sandbox pod
+ * runs sleep infinity indefinitely. Execution completion is tracked by the
+ * individual execInPod() calls.
+ *
+ * Throws SandboxCrTimeoutError if Ready is not reached within timeoutMs.
+ * Throws if the Sandbox transitions to Failed.
+ */
+export async function waitForSandboxReady(clients, namespace, name, opts = {
+    timeoutMs: 120_000,
+    pollMs: 2000,
+}) {
+    const deadline = Date.now() + opts.timeoutMs;
+    const pollMs = opts.pollMs ?? 2000;
+    while (Date.now() < deadline) {
+        const cr = await clients.custom.getNamespacedCustomObject({
+            group: SANDBOX_GROUP,
+            version: SANDBOX_VERSION,
+            namespace,
+            plural: SANDBOX_PLURAL,
+            name,
+        });
+        const status = cr.status ?? {};
+        // agent-sandbox v1alpha1 uses status.conditions[type=Ready,status=True],
+        // not status.phase. Fall back to phase for forward-compat.
+        const conditions = Array.isArray(status.conditions) ? status.conditions : [];
+        const readyCondition = conditions.find((c) => c.type === "Ready");
+        const failedCondition = conditions.find((c) => c.type === "Failed" || (c.type === "Ready" && c.status === "False" && typeof c.reason === "string" && /failed/i.test(c.reason)));
+        const phase = status.phase ?? "";
+        if (readyCondition?.status === "True" || phase === "Ready") {
+            return mapSandboxPhase(cr);
+        }
+        if (failedCondition?.status === "True" || phase === "Failed") {
+            const mapped = mapSandboxPhase(cr);
+            throw new Error(`Sandbox ${namespace}/${name} failed: ${mapped.reason ?? failedCondition?.reason ?? "unknown reason"} — ${mapped.message ?? failedCondition?.message ?? ""}`);
+        }
+        if (phase === "Terminating") {
+            // A Sandbox being torn down will never transition to Ready. Polling
+            // until the deadline would burn the full timeoutMs (potentially
+            // 30+ minutes) before throwing a generic timeout. Fail fast instead
+            // so the caller can surface a clear "the lease is being released"
+            // error and decide whether to retry against a fresh Sandbox.
+            throw new Error(`Sandbox ${namespace}/${name} is Terminating — cannot wait for Ready`);
+        }
+        // Pending — keep polling
+        await sleep(pollMs);
+    }
+    throw new SandboxCrTimeoutError(namespace, name, opts.timeoutMs);
+}
+/**
+ * Sandbox CR-backed conformance to SandboxOrchestrator.
+ *
+ * waitForCompletion semantics change: for this backend, "completion" means
+ * "pod is up and Ready to exec into" — NOT "workload finished". The actual
+ * command execution and its completion is handled by execInPod().
+ */
+export const sandboxCrOrchestrator = {
+    claim: createSandboxCr,
+    getStatus: getSandboxCrStatus,
+    findPod: findPodForSandbox,
+    streamLogs: streamSandboxLogs,
+    release: deleteSandboxCr,
+    waitForCompletion: waitForSandboxReady,
+};
+//# sourceMappingURL=sandbox-cr-orchestrator.js.map

package/dist/sandbox-cr-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-cr-orchestrator.js","sourceRoot":"","sources":["../src/sandbox-cr-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,SAAiB,EAAE,IAAY,EAAE,SAAiB;QAC5D,KAAK,CACH,WAAW,SAAS,IAAI,IAAI,qCAAqC,SAAS,IAAI,CAC/E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,EAA2B;IAE3B,MAAM,MAAM,GAAI,EAAE,CAAC,MAAkC,IAAI,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAI,MAAM,CAAC,KAAgB,IAAI,SAAS,CAAC;IAEpD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO;gBACL,KAAK,EAAE,SAAS,EAAE,iEAAiE;gBACnF,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC;aACV,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,aAAa;aACtB,CAAC;QACJ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,UAAU,GAAI,MAAM,CAAC,UAAqE,IAAI,EAAE,CAAC;YACvG,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,UAAU,EAAE,MAAM;gBAC1B,OAAO,EAAE,UAAU,EAAE,OAAO;aAC7B,CAAC;QACJ,CAAC;QACD;YACE,uBAAuB;YACvB,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC;aACV,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAoB,EACpB,SAAiB,EACjB,QAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC;QAC/D,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,eAAe;QACxB,SAAS;QACT,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAI,MAA0C,CAAC,QAAQ,EAAE,GAAG,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC9D,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAoB,EACpB,SAAiB,EACjB,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC;QAC5D,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,eAAe;QACxB,SAAS;QACT,MAAM,EAAE,cAAc;QACtB,IAAI;KACL,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,MAAiC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAoB,EACpB,SAAiB,EACjB,IAAY;IAEZ,mDAAmD;IACnD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACxD,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,eAAe;QACxB,SAAS;QACT,MAAM,EAAE,cAAc;QACtB,IAAI;KACL,CAA4B,CAAC;IAE9B,MAAM,MAAM,GAAI,EAAE,CAAC,MAAkC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAA6B,CAAC;IACrD,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,yEAAyE;IACzE,uDAAuD;IACvD,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAErE,CAAC;QACF,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GACP,GAA8C,CAAC,IAAI;YACnD,GAA8C,CAAC,UAAU,CAAC;QAC7D,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,SAAS;QACT,aAAa,EAAE,gCAAgC,IAAI,EAAE;KACtD,CAAC,CAAC;IACH,MAAM,KAAK,GACT,CAEI,MAMD,CAAC,KAAK,CACR,IAAI,EAAE,CAAC;IAEV,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,8BAA8B,CAAC,KAAK,IAAI,CAC3E,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;IACpE,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,OAAqE;IAErE,mEAAmE;IACnE,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC;QACrD,SAAS;QACT,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,IAAI,GAAI,MAAiB,IAAI,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAoB,EACpB,SAAiB,EACjB,IAAY;IAEZ,MAAM,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC;QAChD,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,eAAe;QACxB,SAAS;QACT,MAAM,EAAE,cAAc;QACtB,IAAI;QACJ,iBAAiB,EAAE,YAAY;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,SAAiB,EACjB,IAAY,EACZ,OAA+C;IAC7C,SAAS,EAAE,OAAO;IAClB,MAAM,EAAE,IAAI;CACb;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAEnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC;YACxD,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,eAAe;YACxB,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,IAAI;SACL,CAA4B,CAAC;QAE9B,MAAM,MAAM,GAAI,EAAE,CAAC,MAAkC,IAAI,EAAE,CAAC;QAC5D,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChL,MAAM,KAAK,GAAI,MAAM,CAAC,KAAgB,IAAI,EAAE,CAAC;QAE7C,IAAI,cAAc,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,eAAe,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,IAAI,IAAI,YAAY,MAAM,CAAC,MAAM,IAAK,eAAe,EAAE,MAAiB,IAAI,gBAAgB,MAAM,MAAM,CAAC,OAAO,IAAK,eAAe,EAAE,OAAkB,IAAI,EAAE,EAAE,CACrL,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,oEAAoE;YACpE,gEAAgE;YAChE,oEAAoE;YACpE,kEAAkE;YAClE,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,IAAI,IAAI,yCAAyC,CACtE,CAAC;QACJ,CAAC;QACD,yBAAyB;QACzB,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB;IACxD,KAAK,EAAE,eAAe;IACtB,SAAS,EAAE,kBAAkB;IAC7B,OAAO,EAAE,iBAAiB;IAC1B,UAAU,EAAE,iBAAiB;IAC7B,OAAO,EAAE,eAAe;IACxB,iBAAiB,EAAE,mBAAmB;CACvC,CAAC"}

package/dist/sandbox-orchestrator.d.ts

@@ -0,0 +1,39 @@
+import type { KubeClients } from "./kube-client.js";
+export interface SandboxStatus {
+    phase: "Pending" | "Running" | "Succeeded" | "Failed";
+    complete: boolean;
+    active: number;
+    succeeded: number;
+    failed: number;
+    reason?: string;
+    message?: string;
+}
+/**
+ * Abstract interface over a sandbox runtime backend. The current implementation
+ * is Job-backed (job-orchestrator.ts). Future backends slot in by exporting an
+ * object conforming to this shape — e.g. a Kata-FC warm-pool backend that
+ * additionally implements the optional pause/resume slots, or a CRD-backed
+ * backend on kubernetes-sigs/agent-sandbox once it reaches Beta.
+ */
+export interface SandboxOrchestrator {
+    /** Provision the sandbox. Returns the runtime's stable UID. */
+    claim(clients: KubeClients, namespace: string, manifest: Record<string, unknown>): Promise<{
+        uid: string;
+    }>;
+    /** Read current lifecycle phase. */
+    getStatus(clients: KubeClients, namespace: string, name: string): Promise<SandboxStatus>;
+    /** Locate the pod backing this sandbox (or null if none exists yet). */
+    findPod(clients: KubeClients, namespace: string, name: string): Promise<string | null>;
+    /** Read logs from the sandbox's pod. V1: post-completion read. */
+    streamLogs(clients: KubeClients, namespace: string, podName: string, onChunk: (stream: "stdout" | "stderr", text: string) => Promise<void>): Promise<void>;
+    /** Tear down the sandbox. Implementations MUST cascade-delete child resources. */
+    release(clients: KubeClients, namespace: string, name: string): Promise<void>;
+    /** Block until phase is Succeeded or Failed, or throw on timeout. */
+    waitForCompletion(clients: KubeClients, namespace: string, name: string, opts: {
+        timeoutMs: number;
+        pollMs?: number;
+    }): Promise<SandboxStatus>;
+    pause?(clients: KubeClients, namespace: string, name: string): Promise<void>;
+    resume?(clients: KubeClients, namespace: string, name: string): Promise<void>;
+}
+//# sourceMappingURL=sandbox-orchestrator.d.ts.map

package/dist/sandbox-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-orchestrator.d.ts","sourceRoot":"","sources":["../src/sandbox-orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,KAAK,CACH,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE5B,oCAAoC;IACpC,SAAS,CACP,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B,wEAAwE;IACxE,OAAO,CACL,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1B,kEAAkE;IAClE,UAAU,CACR,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,kFAAkF;IAClF,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E,qEAAqE;IACrE,iBAAiB,CACf,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,aAAa,CAAC,CAAC;IAO1B,KAAK,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E"}

package/dist/sandbox-orchestrator.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandbox-orchestrator.js.map

package/dist/sandbox-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-orchestrator.js","sourceRoot":"","sources":["../src/sandbox-orchestrator.ts"],"names":[],"mappings":""}

package/dist/secret-manager.d.ts

@@ -0,0 +1,14 @@
+import type { KubeClients } from "./kube-client.js";
+export interface CreatePerRunSecretInput {
+    namespace: string;
+    secretName: string;
+    runId: string;
+    ownerKind: string;
+    ownerApiVersion: string;
+    ownerName: string;
+    ownerUid: string;
+    bootstrapToken: string;
+    adapterEnv: Record<string, string>;
+}
+export declare function createPerRunSecret(clients: KubeClients, input: CreatePerRunSecretInput): Promise<void>;
+//# sourceMappingURL=secret-manager.d.ts.map

package/dist/secret-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-manager.d.ts","sourceRoot":"","sources":["../src/secret-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC5G"}

package/dist/secret-manager.js

@@ -0,0 +1,39 @@
+export async function createPerRunSecret(clients, input) {
+    if (!input.ownerUid) {
+        throw new Error("createPerRunSecret requires a non-empty ownerUid");
+    }
+    if ("BOOTSTRAP_TOKEN" in input.adapterEnv) {
+        throw new Error("adapterEnv must not contain BOOTSTRAP_TOKEN (reserved key)");
+    }
+    await clients.core.createNamespacedSecret({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "Secret",
+            type: "Opaque",
+            metadata: {
+                name: input.secretName,
+                namespace: input.namespace,
+                labels: {
+                    "paperclip.io/run-id": input.runId,
+                    "paperclip.io/managed-by": "paperclip-k8s-plugin",
+                },
+                ownerReferences: [
+                    {
+                        apiVersion: input.ownerApiVersion,
+                        kind: input.ownerKind,
+                        name: input.ownerName,
+                        uid: input.ownerUid,
+                        controller: true,
+                        blockOwnerDeletion: true,
+                    },
+                ],
+            },
+            stringData: {
+                BOOTSTRAP_TOKEN: input.bootstrapToken,
+                ...input.adapterEnv,
+            },
+        },
+    });
+}
+//# sourceMappingURL=secret-manager.js.map

package/dist/secret-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-manager.js","sourceRoot":"","sources":["../src/secret-manager.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB,EAAE,KAA8B;IAC3F,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE;oBACN,qBAAqB,EAAE,KAAK,CAAC,KAAK;oBAClC,yBAAyB,EAAE,sBAAsB;iBAClD;gBACD,eAAe,EAAE;oBACf;wBACE,UAAU,EAAE,KAAK,CAAC,eAAe;wBACjC,IAAI,EAAE,KAAK,CAAC,SAAS;wBACrB,IAAI,EAAE,KAAK,CAAC,SAAS;wBACrB,GAAG,EAAE,KAAK,CAAC,QAAQ;wBACnB,UAAU,EAAE,IAAI;wBAChB,kBAAkB,EAAE,IAAI;qBACzB;iBACF;aACF;YACD,UAAU,EAAE;gBACV,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,GAAG,KAAK,CAAC,UAAU;aACpB;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/tenant-orchestrator.d.ts

@@ -0,0 +1,35 @@
+import type { KubeClients } from "./kube-client.js";
+export interface EnsureTenantInput {
+    namespace: string;
+    companyId: string;
+    paperclipServerNamespace: string;
+    serviceAccountAnnotations: Record<string, string>;
+    egressMode: "standard" | "cilium";
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+    resourceQuota: {
+        pods: string;
+        requestsCpu: string;
+        requestsMemory: string;
+        limitsCpu: string;
+        limitsMemory: string;
+    };
+}
+/**
+ * Lazy, first-write-wins tenant provisioning. Each helper checks if the named
+ * resource exists and creates it only on 404; if it already exists, it is
+ * left as-is — config-driven values (quota limits, RBAC permissions, network
+ * policies, egress allow-list) are FROZEN at first provisioning time.
+ *
+ * V1 limitation: changing KubernetesProviderConfig after a tenant namespace
+ * is provisioned does NOT update the in-cluster resources. To apply config
+ * changes, an operator must delete the per-tenant resources manually (or
+ * the namespace itself). A future iteration should add strategic-merge
+ * reconciliation here.
+ *
+ * Particular gotcha: switching egressMode "standard" → "cilium" leaves the
+ * old paperclip-egress-allow NetworkPolicy in place alongside the new
+ * CiliumNetworkPolicy. Both apply; the effective egress is the intersection.
+ */
+export declare function ensureTenant(clients: KubeClients, input: EnsureTenantInput): Promise<void>;
+//# sourceMappingURL=tenant-orchestrator.d.ts.map

package/dist/tenant-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-orchestrator.d.ts","sourceRoot":"","sources":["../src/tenant-orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,UAAU,EAAE,UAAU,GAAG,QAAQ,CAAC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG"}