@usine/cloudflare 0.0.0-stage → 0.1.0

package/dist/sandbox/ports.d.ts

@@ -0,0 +1,99 @@
+import { CloudflareInstanceType } from "@usine/core/worker";
+import { Context, type DateTime, type Duration, Effect, type Option, Schema } from "effect";
+import { SandboxCredentials, SandboxName, SandboxSummary } from "../api/api.ts";
+import type { Interception } from "./outbound.ts";
+/** A command started in the container, with the streams the start requested. */
+export interface ContainerProcess {
+    readonly stdin: WritableStream<Uint8Array> | null;
+    readonly stdout: ReadableStream<Uint8Array> | null;
+    readonly stderr: ReadableStream<Uint8Array> | null;
+    readonly exitCode: Promise<number>;
+}
+export declare const ContainerOperation: Schema.Literals<readonly ["start", "exec", "read", "destroy", "keep-alive", "intercept"]>;
+export type ContainerOperation = typeof ContainerOperation.Type;
+declare const ContainerFailure_base: Schema.Class<ContainerFailure, Schema.TaggedStruct<"ContainerFailure", {
+    readonly operation: Schema.Literals<readonly ["start", "exec", "read", "destroy", "keep-alive", "intercept"]>;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A Container API call failed. `message` comes from the runtime and contains no credential. */
+export declare class ContainerFailure extends ContainerFailure_base {
+}
+declare const SandboxContainer_base: Context.ServiceClass<SandboxContainer, "@usine/cloudflare/SandboxContainer", {
+    readonly running: Effect.Effect<boolean>;
+    /** The Worker's `containers[].images`, by name. */
+    readonly images: Effect.Effect<Readonly<Record<string, string>>>;
+    /** Starts the container from `image`, an entry of `images`, without internet access. */
+    readonly start: (image: string, instanceType: CloudflareInstanceType) => Effect.Effect<void, ContainerFailure>;
+    /** Runs `command` as the image's user in its home directory, with `HOME` set and piped output. */
+    readonly exec: (command: ReadonlyArray<string>, stdin: "pipe" | "closed") => Effect.Effect<ContainerProcess, ContainerFailure>;
+    /** Returns the content of `path`, or `None` if it doesn't exist. */
+    readonly read: (path: string) => Effect.Effect<Option.Option<Uint8Array>, ContainerFailure>;
+    /** Returns the content of `path` after its first `offset` bytes, or `None` if it doesn't exist. */
+    readonly readFrom: (path: string, offset: number) => Effect.Effect<Option.Option<Uint8Array>, ContainerFailure>;
+    /** Returns the size of `path` in bytes, or `None` if it doesn't exist. */
+    readonly size: (path: string) => Effect.Effect<Option.Option<number>, ContainerFailure>;
+    readonly destroy: Effect.Effect<void, ContainerFailure>;
+    /** Sets the time without a request after which the platform stops the container. */
+    readonly keepAlive: (inactivity: Duration.Duration) => Effect.Effect<void, ContainerFailure>;
+    /** Sends the container's requests for the interception's host to its outbound handler. */
+    readonly intercept: (interception: Interception) => Effect.Effect<void, ContainerFailure>;
+}>;
+/** The Durable Object Container API calls a sandbox makes (`ctx.container` in the Worker). */
+export declare class SandboxContainer extends SandboxContainer_base {
+}
+declare const StoredSandbox_base: Schema.Class<StoredSandbox, Schema.Struct<{
+    readonly name: Schema.brand<Schema.String, "SandboxName">;
+    readonly owner: Schema.brand<Schema.String, "SandboxOwner">;
+    readonly attempt: Schema.brand<Schema.NonEmptyString, "AttemptId">;
+    readonly image: Schema.brand<Schema.String, "CloudflareImageName">;
+    readonly instanceType: Schema.Literals<readonly ["lite", "basic", "standard-1", "standard-2", "standard-3", "standard-4"]>;
+    readonly createdAt: Schema.DateTimeUtc;
+    /**
+     * The keepalive alarm keeps the container running until this time. Each create, credential
+     * renewal, and command extends it.
+     */
+    readonly leaseUntil: Schema.DateTimeUtc;
+    /**
+     * Whether usine holds the sandbox for a checkout that it keeps. The keepalive alarm then keeps
+     * the container running past `leaseUntil`, until usine destroys the sandbox.
+     */
+    readonly held: Schema.withDecodingDefaultKey<Schema.Boolean, never>;
+    /** Kept so the outbound handlers can be registered again after the Durable Object restarts. */
+    readonly credentials: typeof SandboxCredentials;
+}>, {}>;
+/** A sandbox as its Durable Object stores it. */
+export declare class StoredSandbox extends StoredSandbox_base {
+    summary(running: boolean, draining: boolean): SandboxSummary;
+}
+declare const SandboxStorage_base: Context.ServiceClass<SandboxStorage, "@usine/cloudflare/SandboxStorage", {
+    readonly load: Effect.Effect<Option.Option<StoredSandbox>>;
+    /**
+     * Passes the stored sandbox, or `None`, to `change`, saves the sandbox that `change` returns
+     * with its result, and returns the result. Saves nothing when that sandbox is `None`. No other
+     * request runs between the read and the write.
+     */
+    readonly modify: <A>(change: (stored: Option.Option<StoredSandbox>) => readonly [A, Option.Option<StoredSandbox>]) => Effect.Effect<A>;
+    /** Deletes the stored sandbox and its alarm. */
+    readonly clear: Effect.Effect<void>;
+    /** Replaces the sandbox's alarm. */
+    readonly alarmAt: (at: DateTime.Utc) => Effect.Effect<void>;
+}>;
+/** The Durable Object storage of one sandbox. */
+export declare class SandboxStorage extends SandboxStorage_base {
+}
+declare const SandboxDirectory_base: Context.ServiceClass<SandboxDirectory, "@usine/cloudflare/SandboxDirectory", {
+    readonly record: (sandbox: SandboxSummary) => Effect.Effect<void>;
+    readonly forget: (name: SandboxName) => Effect.Effect<void>;
+}>;
+/** The registry that lists the sandboxes of each usine Worker. */
+export declare class SandboxDirectory extends SandboxDirectory_base {
+}
+declare const SandboxSettings_base: Context.ServiceClass<SandboxSettings, "@usine/cloudflare/SandboxSettings", {
+    /** The hosts the sandboxes reach over HTTPS without a credential, from `ALLOWED_HOSTS`. */
+    readonly allowedHosts: ReadonlyArray<string>;
+}>;
+/** The Worker's settings that every sandbox reads. */
+export declare class SandboxSettings extends SandboxSettings_base {
+}
+export {};
+//# sourceMappingURL=ports.d.ts.map

package/dist/sandbox/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../src/sandbox/ports.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAgB,cAAc,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,kBAAkB,2FAO7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;;;;;AAEhE,gGAAgG;AAChG,qBAAa,gBAAiB,SAAQ,qBAGpC;CAAG;;sBAMiB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACxC,mDAAmD;qBAClC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,wFAAwF;oBACxE,CACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,sBAAsB,KACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAC1C,kGAAkG;mBACnF,CACb,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAC9B,KAAK,EAAE,MAAM,GAAG,QAAQ,KACrB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IACtD,oEAAoE;mBACrD,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC3F,mGAAmG;uBAChF,CACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC/D,0EAA0E;mBAC3D,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;sBACrE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC;IACvD,oFAAoF;wBAChE,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAC5F,0FAA0F;wBACtE,CAAC,YAAY,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC;;AA9B7F,8FAA8F;AAC9F,qBAAa,gBAAiB,SAAQ,qBA+BG;CAAG;;;;;;;;IAU1C;;;OAGG;;IAEH;;;OAGG;;IAEH,+FAA+F;;;AAlBjG,iDAAiD;AACjD,qBAAa,aAAc,SAAQ,kBAmBjC;IACA,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,cAAc,CAY3D;CACF;;mBAMkB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1D;;;;OAIG;qBACc,CAAC,CAAC,EACjB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KACzF,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrB,gDAAgD;oBAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IACnC,oCAAoC;sBAClB,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AAhB/D,iDAAiD;AACjD,qBAAa,cAAe,SAAQ,mBAiBG;CAAG;;qBAMrB,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;qBAChD,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AAL/D,kEAAkE;AAClE,qBAAa,gBAAiB,SAAQ,qBAMG;CAAG;;IAMxC,2FAA2F;2BACpE,aAAa,CAAC,MAAM,CAAC;;AALhD,sDAAsD;AACtD,qBAAa,eAAgB,SAAQ,oBAMG;CAAG"}

package/dist/sandbox/ports.js

@@ -0,0 +1,66 @@
+import { AttemptId } from "@usine/core/attempt";
+import { CloudflareImageName, CloudflareInstanceType } from "@usine/core/worker";
+import { Context, Effect, Schema } from "effect";
+import { SandboxCredentials, SandboxName, SandboxOwner, SandboxSummary } from "../api/api.js";
+export const ContainerOperation = Schema.Literals([
+    "start",
+    "exec",
+    "read",
+    "destroy",
+    "keep-alive",
+    "intercept",
+]);
+/** A Container API call failed. `message` comes from the runtime and contains no credential. */
+export class ContainerFailure extends Schema.TaggedError()("ContainerFailure", {
+    operation: ContainerOperation,
+    message: Schema.String,
+}) {
+}
+/** The Durable Object Container API calls a sandbox makes (`ctx.container` in the Worker). */
+export class SandboxContainer extends Context.Service()("@usine/cloudflare/SandboxContainer") {
+}
+/** A sandbox as its Durable Object stores it. */
+export class StoredSandbox extends Schema.Class("@usine/cloudflare/StoredSandbox")({
+    name: SandboxName,
+    owner: SandboxOwner,
+    attempt: AttemptId,
+    image: CloudflareImageName,
+    instanceType: CloudflareInstanceType,
+    createdAt: Schema.DateTimeUtc,
+    /**
+     * The keepalive alarm keeps the container running until this time. Each create, credential
+     * renewal, and command extends it.
+     */
+    leaseUntil: Schema.DateTimeUtc,
+    /**
+     * Whether usine holds the sandbox for a checkout that it keeps. The keepalive alarm then keeps
+     * the container running past `leaseUntil`, until usine destroys the sandbox.
+     */
+    held: Schema.Boolean.pipe(Schema.withDecodingDefaultKey(Effect.succeed(false))),
+    /** Kept so the outbound handlers can be registered again after the Durable Object restarts. */
+    credentials: SandboxCredentials,
+}) {
+    summary(running, draining) {
+        return new SandboxSummary({
+            name: this.name,
+            owner: this.owner,
+            attempt: this.attempt,
+            image: this.image,
+            instanceType: this.instanceType,
+            createdAt: this.createdAt,
+            running,
+            held: this.held,
+            draining,
+        });
+    }
+}
+/** The Durable Object storage of one sandbox. */
+export class SandboxStorage extends Context.Service()("@usine/cloudflare/SandboxStorage") {
+}
+/** The registry that lists the sandboxes of each usine Worker. */
+export class SandboxDirectory extends Context.Service()("@usine/cloudflare/SandboxDirectory") {
+}
+/** The Worker's settings that every sandbox reads. */
+export class SandboxSettings extends Context.Service()("@usine/cloudflare/SandboxSettings") {
+}
+//# sourceMappingURL=ports.js.map

package/dist/sandbox/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../src/sandbox/ports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAgC,MAAM,EAAe,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAW9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC;IAChD,OAAO;IACP,MAAM;IACN,MAAM;IACN,SAAS;IACT,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAGH,gGAAgG;AAChG,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAAC,kBAAkB,EAAE;IAC/F,SAAS,EAAE,kBAAkB;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,8FAA8F;AAC9F,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EA+BlD,CAAC,oCAAoC,CAAC;CAAG;AAE5C,iDAAiD;AACjD,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,iCAAiC,CAAC,CAAC;IAChG,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,YAAY;IACnB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,mBAAmB;IAC1B,YAAY,EAAE,sBAAsB;IACpC,SAAS,EAAE,MAAM,CAAC,WAAW;IAC7B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,WAAW;IAC9B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,+FAA+F;IAC/F,WAAW,EAAE,kBAAkB;CAChC,CAAC;IACA,OAAO,CAAC,OAAgB,EAAE,QAAiB;QACzC,OAAO,IAAI,cAAc,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF;AAED,iDAAiD;AACjD,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAiBhD,CAAC,kCAAkC,CAAC;CAAG;AAE1C,kEAAkE;AAClE,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAMlD,CAAC,oCAAoC,CAAC;CAAG;AAE5C,sDAAsD;AACtD,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAMjD,CAAC,mCAAmC,CAAC;CAAG"}

package/dist/sandbox/process.d.ts

@@ -0,0 +1,55 @@
+import { Option } from "effect";
+import { ProcessId } from "../api/api.ts";
+/**
+ * Returns the Container API options of a command the Worker runs. The platform passes a command
+ * only the image's `PATH`, not its `ENV HOME`, so the options set `HOME` and start the command in
+ * the sandbox home.
+ */
+export declare const commandOptions: (stdin: "pipe" | "closed") => ContainerExecOptions;
+/** The files a command leaves in its process directory. */
+export declare const processFiles: (process: ProcessId) => {
+    /** The command's process ID, which is also its process group and session. */
+    readonly pid: `${string}/pid`;
+    /** The exit code, written once the command exits. */
+    readonly exit: `${string}/exit`;
+    readonly stdout: `${string}/stdout`;
+    readonly stderr: `${string}/stderr`;
+};
+/**
+ * A POSIX shell script that runs the command line `$2` with process files in the directory `$1`,
+ * and passes its stdin, stdout, stderr, and exit code through. Run it with `sh -c`.
+ *
+ * The command runs in its own session and writes its process ID to `pid`. The command and every
+ * process that it starts get `USINE_PROCESS`, the directory, in their environment, so that
+ * `STOP_SCRIPT` finds them even after the command exits or they leave its session. `tee -p` copies
+ * its output to `stdout` and `stderr` and keeps copying if the stream that started it closes, so a
+ * later request can attach. The exit code goes to `exit` when the command ends.
+ */
+export declare const PROCESS_SCRIPT: string;
+/** Returns the container command that runs `command` through `PROCESS_SCRIPT`. */
+export declare const processCommand: (process: ProcessId, command: string) => ReadonlyArray<string>;
+/**
+ * A bash script that stops what the commands in the processes directory `$1` started: every
+ * process in the session of each command, and in the session of each process whose
+ * `USINE_PROCESS` is in `$1`, so it includes what a command left running after it exited. It sends
+ * TERM to each process group in those sessions, waits up to five seconds, then sends KILL until no
+ * process is left. It prints the number of sessions it signaled, and fails if a process still runs
+ * five seconds after the first KILL.
+ *
+ * A command that exited has released its process ID. If another process has that ID now, the
+ * command's session has ended, and the script skips the session that has the ID now.
+ */
+export declare const STOP_SCRIPT: string;
+/** Returns the container command that runs `STOP_SCRIPT`. */
+export declare const stopCommand: ReadonlyArray<string>;
+/** Returns the container command that prints the bytes of `file` from `offset`. */
+export declare const readFromCommand: (file: string, offset: number) => ReadonlyArray<string>;
+/** Returns the number that `STOP_SCRIPT` printed, or `None` for any other output. */
+export declare const stoppedCount: (output: string) => Option.Option<number>;
+/** Returns the process ID in a `pid` file, or `None` if it's empty or malformed. */
+export declare const pidOf: (content: string) => Option.Option<number>;
+/** Returns the exit code in an `exit` file, or `None` if it's malformed. */
+export declare const exitCodeOf: (content: string) => Option.Option<number>;
+/** Returns a new random process ID. */
+export declare const newProcessId: () => ProcessId;
+//# sourceMappingURL=process.d.ts.map

package/dist/sandbox/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/sandbox/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAW,MAAM,GAAG,QAAQ,KAAG,oBAQzD,CAAC;AAKF,2DAA2D;AAC3D,eAAO,MAAM,YAAY,YAAa,SAAS;IAG3C,6EAA6E;aAC7E,GAAG;IACH,qDAAqD;aACrD,IAAI;aACJ,MAAM;aACN,MAAM;CAET,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,QAenB,CAAC;AAET,kFAAkF;AAClF,eAAO,MAAM,cAAc,YAAa,SAAS,WAAW,MAAM,KAAG,aAAa,CAAC,MAAM,CAOxF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,QA8DhB,CAAC;AAET,6DAA6D;AAC7D,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,MAAM,CAM7C,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,eAAe,SAAU,MAAM,UAAU,MAAM,KAAG,aAAa,CAAC,MAAM,CAMlF,CAAC;AAMF,qFAAqF;AACrF,eAAO,MAAM,YAAY,WAAY,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAA+B,CAAC;AAMlG,oFAAoF;AACpF,eAAO,MAAM,KAAK,YAAa,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAA8B,CAAC;AAM3F,4EAA4E;AAC5E,eAAO,MAAM,UAAU,YAAa,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CACjC,CAAC;AAIjC,uCAAuC;AACvC,eAAO,MAAM,YAAY,QAAO,SAG/B,CAAC"}

package/dist/sandbox/process.js

@@ -0,0 +1,172 @@
+import { Option, Schema } from "effect";
+import { ProcessId } from "../api/api.js";
+import { PROCESSES_DIRECTORY, SANDBOX_HOME } from "../api/harness.js";
+/**
+ * Returns the Container API options of a command the Worker runs. The platform passes a command
+ * only the image's `PATH`, not its `ENV HOME`, so the options set `HOME` and start the command in
+ * the sandbox home.
+ */
+export const commandOptions = (stdin) => {
+    const options = {
+        cwd: SANDBOX_HOME,
+        env: { HOME: SANDBOX_HOME },
+        stdout: "pipe",
+        stderr: "pipe",
+    };
+    return stdin === "pipe" ? { ...options, stdin: "pipe" } : options;
+};
+/** Returns the directory with the process files of `process`. */
+const processDirectory = (process) => `${PROCESSES_DIRECTORY}/${process}`;
+/** The files a command leaves in its process directory. */
+export const processFiles = (process) => {
+    const directory = processDirectory(process);
+    return {
+        /** The command's process ID, which is also its process group and session. */
+        pid: `${directory}/pid`,
+        /** The exit code, written once the command exits. */
+        exit: `${directory}/exit`,
+        stdout: `${directory}/stdout`,
+        stderr: `${directory}/stderr`,
+    };
+};
+/**
+ * A POSIX shell script that runs the command line `$2` with process files in the directory `$1`,
+ * and passes its stdin, stdout, stderr, and exit code through. Run it with `sh -c`.
+ *
+ * The command runs in its own session and writes its process ID to `pid`. The command and every
+ * process that it starts get `USINE_PROCESS`, the directory, in their environment, so that
+ * `STOP_SCRIPT` finds them even after the command exits or they leave its session. `tee -p` copies
+ * its output to `stdout` and `stderr` and keeps copying if the stream that started it closes, so a
+ * later request can attach. The exit code goes to `exit` when the command ends.
+ */
+export const PROCESS_SCRIPT = String.raw `
+d=$1
+mkdir -p "$d" && mkfifo "$d/stdout.pipe" "$d/stderr.pipe" || exit 125
+exec 3<&0
+tee -p -a "$d/stdout" < "$d/stdout.pipe" &
+tee -p -a "$d/stderr" < "$d/stderr.pipe" >&2 &
+USINE_PROCESS=$d setsid -w sh -c 'printf %s "$$" > "$0" && exec sh -c "$1"' "$d/pid" "$2" <&3 > "$d/stdout.pipe" 2> "$d/stderr.pipe" &
+command=$!
+exec 3<&-
+wait "$command"
+code=$?
+wait
+printf %s "$code" > "$d/exit.next" && mv "$d/exit.next" "$d/exit"
+rm -f "$d/stdout.pipe" "$d/stderr.pipe"
+exit "$code"
+`.trim();
+/** Returns the container command that runs `command` through `PROCESS_SCRIPT`. */
+export const processCommand = (process, command) => [
+    "sh",
+    "-c",
+    PROCESS_SCRIPT,
+    "usine-process",
+    processDirectory(process),
+    command,
+];
+/**
+ * A bash script that stops what the commands in the processes directory `$1` started: every
+ * process in the session of each command, and in the session of each process whose
+ * `USINE_PROCESS` is in `$1`, so it includes what a command left running after it exited. It sends
+ * TERM to each process group in those sessions, waits up to five seconds, then sends KILL until no
+ * process is left. It prints the number of sessions it signaled, and fails if a process still runs
+ * five seconds after the first KILL.
+ *
+ * A command that exited has released its process ID. If another process has that ID now, the
+ * command's session has ended, and the script skips the session that has the ID now.
+ */
+export const STOP_SCRIPT = `
+root=$1
+declare -A groups=() sessions=()
+read -r line < "/proc/$$/stat"
+fields=(\${line##*") "})
+own=\${fields[3]}
+scan() {
+  local process line fields entry
+  groups=()
+  for process in /proc/[0-9]*; do
+    read -r line 2>/dev/null < "$process/stat" || continue
+    fields=(\${line##*") "})
+    case \${fields[0]} in Z|X) continue ;; esac
+    groups[\${fields[3]}]+=" \${fields[2]}"
+    [ "\${fields[3]}" = "$own" ] && continue
+    while IFS= read -r -d '' entry; do
+      case $entry in "USINE_PROCESS=$root"/*) sessions[\${fields[3]}]=1; break ;; esac
+    done 2>/dev/null < "$process/environ"
+  done
+}
+signal() {
+  local session group
+  local -A sent=()
+  for session in "\${!sessions[@]}"; do
+    for group in \${groups[$session]-}; do
+      [ -n "\${sent[$group]-}" ] || kill "-$1" -- "-$group" 2>/dev/null
+      sent[$group]=1
+    done
+  done
+}
+running() {
+  local session
+  for session in "\${!sessions[@]}"; do
+    [ -n "\${groups[$session]-}" ] && echo "$session"
+  done
+}
+scan
+for pidfile in "$root"/*/pid; do
+  [ -f "$pidfile" ] || continue
+  read -r pid < "$pidfile"
+  case "$pid" in ''|*[!0-9]*) continue ;; esac
+  [ -f "\${pidfile%/pid}/exit" ] && [ -e "/proc/$pid" ] && continue
+  [ "$pid" != "$own" ] && [ -n "\${groups[$pid]-}" ] && sessions[$pid]=1
+done
+signal TERM
+for _ in {1..20}; do
+  [ -z "$(running)" ] && break
+  sleep 0.25
+  scan
+done
+for _ in {1..20}; do
+  [ -z "$(running)" ] && break
+  signal KILL
+  sleep 0.25
+  scan
+done
+left=$(running)
+if [ -n "$left" ]; then
+  echo "Processes still run after KILL in sessions" $left >&2
+  exit 1
+fi
+echo "\${#sessions[@]}"
+`.trim();
+/** Returns the container command that runs `STOP_SCRIPT`. */
+export const stopCommand = [
+    "bash",
+    "-c",
+    STOP_SCRIPT,
+    "usine-stop",
+    PROCESSES_DIRECTORY,
+];
+/** Returns the container command that prints the bytes of `file` from `offset`. */
+export const readFromCommand = (file, offset) => [
+    "tail",
+    "-c",
+    `+${String(offset + 1)}`,
+    "--",
+    file,
+];
+const decodeCount = Schema.decodeUnknownOption(Schema.NumberFromString.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0)));
+/** Returns the number that `STOP_SCRIPT` printed, or `None` for any other output. */
+export const stoppedCount = (output) => decodeCount(output.trim());
+const decodePid = Schema.decodeUnknownOption(Schema.NumberFromString.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(1)));
+/** Returns the process ID in a `pid` file, or `None` if it's empty or malformed. */
+export const pidOf = (content) => decodePid(content.trim());
+const decodeExitCode = Schema.decodeUnknownOption(Schema.NumberFromString.check(Schema.isInt(), Schema.isBetween({ minimum: 0, maximum: 255 })));
+/** Returns the exit code in an `exit` file, or `None` if it's malformed. */
+export const exitCodeOf = (content) => decodeExitCode(content.trim());
+const ProcessIdBytes = 16;
+/** Returns a new random process ID. */
+export const newProcessId = () => {
+    const bytes = crypto.getRandomValues(new Uint8Array(ProcessIdBytes));
+    return ProcessId.make([...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join(""));
+};
+//# sourceMappingURL=process.js.map

package/dist/sandbox/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/sandbox/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAwB,EAAwB,EAAE;IAC/E,MAAM,OAAO,GAAyB;QACpC,GAAG,EAAE,YAAY;QACjB,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;KACf,CAAC;IACF,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACpE,CAAC,CAAC;AAEF,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,CAAC,OAAkB,EAAU,EAAE,CAAC,GAAG,mBAAmB,IAAI,OAAO,EAAE,CAAC;AAE7F,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAkB,EAAE,EAAE;IACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,6EAA6E;QAC7E,GAAG,EAAE,GAAG,SAAS,MAAM;QACvB,qDAAqD;QACrD,IAAI,EAAE,GAAG,SAAS,OAAO;QACzB,MAAM,EAAE,GAAG,SAAS,SAAS;QAC7B,MAAM,EAAE,GAAG,SAAS,SAAS;KACrB,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;CAevC,CAAC,IAAI,EAAE,CAAC;AAET,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAkB,EAAE,OAAe,EAAyB,EAAE,CAAC;IAC5F,IAAI;IACJ,IAAI;IACJ,cAAc;IACd,eAAe;IACf,gBAAgB,CAAC,OAAO,CAAC;IACzB,OAAO;CACR,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8D1B,CAAC,IAAI,EAAE,CAAC;AAET,6DAA6D;AAC7D,MAAM,CAAC,MAAM,WAAW,GAA0B;IAChD,MAAM;IACN,IAAI;IACJ,WAAW;IACX,YAAY;IACZ,mBAAmB;CACpB,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,MAAc,EAAyB,EAAE,CAAC;IACtF,MAAM;IACN,IAAI;IACJ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;IACxB,IAAI;IACJ,IAAI;CACL,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAC5C,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAChF,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAyB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAElG,MAAM,SAAS,GAAG,MAAM,CAAC,mBAAmB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAChF,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAyB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3F,MAAM,cAAc,GAAG,MAAM,CAAC,mBAAmB,CAC/C,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAC9F,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAyB,EAAE,CACnE,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAEjC,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,uCAAuC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAc,EAAE;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC"}

package/dist/sandbox/sandbox.d.ts

@@ -0,0 +1,36 @@
+import { Duration, Effect, Layer } from "effect";
+import { ContainerUnavailable, SandboxNotFound } from "../api/api.ts";
+import { ContainerFailure, type ContainerProcess, SandboxContainer, SandboxDirectory, SandboxSettings, SandboxStorage, StoredSandbox } from "./ports.ts";
+/** How long the keepalive alarm keeps a container running after the last create, renewal, or command. */
+export declare const LEASE: Duration.Duration;
+/** Waits for `process` to exit and returns its output bytes, unchanged, and exit code. */
+export declare const collectBytes: (process: ContainerProcess) => Effect.Effect<{
+    stdout: Uint8Array<ArrayBufferLike>;
+    stderr: Uint8Array<ArrayBufferLike>;
+    exitCode: number;
+}, ContainerFailure, never>;
+/** Returns the stored sandbox if its container runs, or fails with `ContainerUnavailable`. */
+export declare const runningSandboxFor: (name: string & import("effect/Brand").Brand<"SandboxName">) => Effect.Effect<StoredSandbox, ContainerUnavailable | SandboxNotFound, SandboxContainer | SandboxStorage>;
+/**
+ * Extends the sandbox's lease from now and returns the stored sandbox, or fails with
+ * `SandboxNotFound` if it was destroyed.
+ */
+export declare const extendLease: (name: string & import("effect/Brand").Brand<"SandboxName">) => Effect.Effect<StoredSandbox, SandboxNotFound, SandboxStorage>;
+/**
+ * Keeps the container running while the sandbox's lease lasts or usine holds it, then lets the
+ * platform stop it after `INACTIVITY_TIMEOUT`. Runs from the Durable Object's alarm, and sets the
+ * next one.
+ */
+export declare const keepAlive: () => Effect.Effect<void, never, SandboxContainer | SandboxStorage>;
+/**
+ * Registers the outbound handlers and sets the inactivity timeout again after the Durable Object
+ * restarts while its container runs, since the platform resets both for each instance. Does
+ * nothing for a sandbox without a running container.
+ */
+export declare const restore: () => Effect.Effect<void, never, SandboxContainer | SandboxSettings | SandboxStorage>;
+/**
+ * The health and sandbox routes of `SandboxApi`, served by each sandbox's Durable Object. Requires
+ * `SandboxContainer`, `SandboxStorage`, `SandboxDirectory`, and `SandboxSettings`.
+ */
+export declare const sandboxRoutes: Layer.Layer<never, never, import("effect/http/HttpRouter").HttpRouter | import("effect/http/HttpRouter").Request<"Requires", SandboxDirectory> | import("effect/http/HttpRouter").Request<"Requires", SandboxSettings> | (import("effect/http/HttpRouter").Request<"Requires", SandboxContainer> | import("effect/http/HttpRouter").Request<"Requires", SandboxStorage>)>;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,QAAQ,EAAE,MAAM,EAAE,KAAK,EAA6B,MAAM,QAAQ,CAAC;AAGtF,OAAO,EACL,oBAAoB,EAgBpB,eAAe,EAGhB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AAGpB,yGAAyG;AACzG,eAAO,MAAM,KAAK,mBAAoB,CAAC;AAevC,0FAA0F;AAC1F,eAAO,MAAM,YAAY,YAAa,gBAAgB;;;;2BAQ+B,CAAC;AA+CtF,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,yKAS5B,CAAC;AAsDH;;;GAGG;AACH,eAAO,MAAM,WAAW,+HAMtB,CAAC;AAmOH;;;;GAIG;AACH,eAAO,MAAM,SAAS,qEAiCpB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,OAAO,uFA2BlB,CAAC;AAyBH;;;GAGG;AACH,eAAO,MAAM,aAAa,2WAGzB,CAAC"}