alasio 8.0.0 → 10.0.0

package/dist/src/kube/client.js

@@ -0,0 +1,212 @@
+/**
+ * alasio's one door to the Kubernetes API (decision 001 of the Kubernetes design): a
+ * narrow client over @kubernetes/client-node, so the modules that drive workloads take
+ * this small service and their tests a fake of it.
+ *
+ * In a pod it authenticates as the pod's ServiceAccount; elsewhere (tests, a developer's
+ * machine) as the current context of `KUBECONFIG` or ~/.kube/config.
+ */
+import { request } from "node:http";
+import { createInterface } from "node:readline";
+import { PassThrough } from "node:stream";
+import { finished } from "node:stream/promises";
+import { isDeepStrictEqual } from "node:util";
+import { CoreV1Api, Exec, KubeConfig, KubernetesObjectApi, PatchStrategy, setHeaderOptions } from "@kubernetes/client-node";
+import { Cause, Context, Effect, Layer, Predicate, Queue, Result, Schema, Stream } from "effect";
+/** The annotation of the bookmark that ends a watch's initial events. */
+export const INITIAL_EVENTS_END = "k8s.io/initial-events-end";
+/** The API refused a call, or could not be reached: the status it answered with, when it answered. */
+export class KubeApiError extends Schema.TaggedError()("KubeApiError", {
+    /** The API's HTTP status (404 for absent, 409 for a conflict), when it answered. */
+    status: Schema.optional(Schema.Number),
+    cause: Schema.Defect(),
+}) {
+    /** What a call failed with, read for the status the API answered with (the client's ApiException carries it as `code`). */
+    static of(cause) {
+        return new KubeApiError({ status: Predicate.hasProperty(cause, "code") && Predicate.isNumber(cause.code) ? cause.code : undefined, cause });
+    }
+    get message() {
+        return this.cause instanceof Error ? this.cause.message : String(this.cause);
+    }
+}
+/** A command `exec` ran in a container came to no exit code: its output overflowed, or the exec itself failed. */
+export class KubeExecError extends Schema.TaggedError()("KubeExecError", {
+    message: Schema.String,
+}) {
+}
+/** Whether `error` is the API's answer `status`. */
+export const hasStatus = (status) => (error) => error.status === status;
+/** Whether `value` is a JSON object, which a merge patch merges key by key. */
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * The JSON merge patch (RFC 7386) that makes `from` into `to`: objects patched key by key,
+ * with null for each key `to` has no value for, and anything else, arrays included,
+ * given whole. A merge patch cannot set a null, so a null in `to` is a key it lacks.
+ */
+export function mergePatch(from, to) {
+    if (!isJsonObject(from) || !isJsonObject(to))
+        return to;
+    const patch = {};
+    for (const [key, value] of Object.entries(from)) {
+        if (value !== undefined && to[key] === undefined)
+            patch[key] = null;
+    }
+    for (const [key, value] of Object.entries(to)) {
+        if (value === undefined || isDeepStrictEqual(from[key], value))
+            continue;
+        patch[key] = mergePatch(from[key], value);
+    }
+    return patch;
+}
+const DEFAULT_EXEC_MAX_BYTES = 16 * 1024 * 1024;
+/**
+ * How long a watch hears nothing before its connection is taken for lost and the watch
+ * fails: one and a half times the minute between the bookmarks the API server sends a watch
+ * that asks for them, however quiet what it watches.
+ */
+export const WATCH_SILENCE_MS = 90_000;
+/** The kubeconfig alasio runs with: its ServiceAccount in a pod, the default elsewhere. */
+function loadKubeConfig() {
+    const kubeConfig = new KubeConfig();
+    kubeConfig.loadFromDefault();
+    return kubeConfig;
+}
+const ref = (apiVersion, kind, namespace, name) => ({ apiVersion, kind, metadata: { namespace, name } });
+/**
+ * What a merge patch of the object sends: `patch`, addressed to the object, whose name
+ * and namespace sit in its metadata beside what `patch` changes there.
+ */
+export function patchBody(apiVersion, kind, namespace, name, patch) {
+    const target = ref(apiVersion, kind, namespace, name);
+    const metadata = Predicate.hasProperty(patch, "metadata") && isJsonObject(patch.metadata) ? patch.metadata : {};
+    return { ...patch, ...target, metadata: { ...metadata, ...target.metadata } };
+}
+/** A call to the API, its rejection a KubeApiError. */
+const call = (request) => Effect.tryPromise({ try: request, catch: KubeApiError.of });
+/**
+ * The Kubernetes API, as alasio calls it. Objects are addressed by `apiVersion`, `kind`,
+ * namespace and name, so one set of calls serves every kind alike.
+ */
+export class KubeClient extends Context.Service()("alasio/kube/KubeClient") {
+    /** The API alasio's kubeconfig (loadKubeConfig) reaches. */
+    static layer = Layer.sync(KubeClient, () => makeKubeClient(loadKubeConfig()));
+}
+/** The client over `kubeConfig`, its watches failing after `watchSilenceMs` of silence. */
+export function makeKubeClient(kubeConfig, { watchSilenceMs = WATCH_SILENCE_MS } = {}) {
+    const objects = KubernetesObjectApi.makeApiClient(kubeConfig);
+    const core = kubeConfig.makeApiClient(CoreV1Api);
+    const executor = new Exec(kubeConfig);
+    const exec = Effect.fnUntraced(function* (namespace, pod, container, command, { maxBytes = DEFAULT_EXEC_MAX_BYTES } = {}) {
+        const stdout = new PassThrough();
+        const stderr = new PassThrough();
+        const out = [];
+        const err = [];
+        let size = 0;
+        let socket = null;
+        let overflowed = false;
+        stdout.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes) {
+                overflowed = true;
+                socket?.close();
+                return;
+            }
+            out.push(chunk);
+        });
+        stderr.on("data", (chunk) => err.push(chunk));
+        // Held in an object: the status callback sets it where control flow cannot see.
+        const reported = { status: null };
+        // The status arrives on its own channel before the socket closes; the output is
+        // whole once the socket has closed and both streams have drained.
+        yield* Effect.callback((resume) => {
+            executor
+                .exec(namespace, pod, container, [...command], stdout, stderr, null, false, (status) => { reported.status = status; })
+                .then((opened) => {
+                socket = opened;
+                opened.on("close", () => resume(Effect.void));
+                opened.on("error", (error) => resume(Effect.fail(KubeApiError.of(error))));
+            }, (error) => resume(Effect.fail(KubeApiError.of(error))));
+            return Effect.sync(() => socket?.close());
+        });
+        for (const stream of [stdout, stderr]) {
+            if (!stream.writableEnded)
+                stream.end();
+        }
+        // Both were ended just above, so both finish.
+        yield* Effect.promise(() => Promise.all([finished(stdout), finished(stderr)]));
+        if (overflowed) {
+            return yield* new KubeExecError({ message: `the output of ${JSON.stringify(command[0])} in ${namespace}/${pod} is over ${maxBytes} bytes` });
+        }
+        if (!reported.status)
+            return yield* new KubeExecError({ message: `exec in ${namespace}/${pod} ended without a status` });
+        return {
+            exitCode: yield* Effect.fromResult(exitCodeOf(reported.status)),
+            stdout: Buffer.concat(out),
+            stderr: Buffer.concat(err).toString("utf8"),
+        };
+    });
+    // Asked over node:http, as client-node's ProtoClient asks, not through its Watch: its request timeout, 30 s and not to be
+    // set, ends every watch of something quiet between two of the API server's bookmarks, so each would be listed anew twice a minute.
+    const watch = (apiVersion, plural, namespace, labelSelector, from) => Stream.callback((queue) => Effect.acquireRelease(Effect.tryPromise({
+        try: async () => {
+            const url = new URL(`${kubeConfig.getCurrentCluster()?.server ?? ""}/${apiVersion.includes("/") ? "apis" : "api"}/${apiVersion}/namespaces/${namespace}/${plural}`);
+            const since = from === undefined ? { sendInitialEvents: "true", resourceVersionMatch: "NotOlderThan" } : { resourceVersion: from };
+            for (const [name, value] of Object.entries({ watch: "true", labelSelector, allowWatchBookmarks: "true", ...since })) {
+                url.searchParams.set(name, value);
+            }
+            const options = {};
+            await kubeConfig.applyToHTTPSOptions(options);
+            const fail = (error) => void Queue.failCauseUnsafe(queue, Cause.fail(KubeApiError.of(error)));
+            const asked = request(url, options, (response) => {
+                response.on("error", fail);
+                if (response.statusCode !== 200) {
+                    response.resume();
+                    return fail(Object.assign(new Error(`watching ${url.pathname} was answered ${response.statusCode} ${response.statusMessage}`), { code: response.statusCode }));
+                }
+                const lines = createInterface({ input: response, crlfDelay: Infinity });
+                // What ends the response, the watch ended or its connection lost, ends the lines, which say so as their own error.
+                lines.on("error", fail);
+                lines.on("line", (line) => {
+                    try {
+                        const { type, object } = JSON.parse(line);
+                        // The API server's own end of a watch it cannot go on with, as a Status: 410 where what it watched from is too old.
+                        if (type === "ERROR")
+                            fail(Object.assign(new Error(object.message ?? `watching ${url.pathname} failed`), { code: object.code }));
+                        else
+                            Queue.offerUnsafe(queue, { type, object });
+                    }
+                    catch (error) {
+                        fail(error);
+                    }
+                });
+                response.on("end", () => void Queue.endUnsafe(queue));
+            });
+            asked.setTimeout(watchSilenceMs, () => asked.destroy(new Error(`the watch of ${url.pathname} heard nothing for ${watchSilenceMs} ms`)));
+            asked.on("error", fail);
+            asked.end();
+            return asked;
+        },
+        catch: KubeApiError.of,
+    }), (asked) => Effect.sync(() => asked.destroy())));
+    return KubeClient.of({
+        read: (apiVersion, kind, namespace, name) => call(() => objects.read(ref(apiVersion, kind, namespace, name))).pipe(Effect.catchIf(hasStatus(404), () => Effect.succeed(null))),
+        list: (apiVersion, kind, namespace, labelSelector) => call(() => objects.list(apiVersion, kind, namespace, undefined, undefined, undefined, undefined, labelSelector)).pipe(Effect.map(({ items }) => items)),
+        create: (object) => call(() => objects.create(object)),
+        replace: (object) => call(() => objects.replace(object)),
+        patch: (apiVersion, kind, namespace, name, patch) => call(() => objects.patch(patchBody(apiVersion, kind, namespace, name, patch), undefined, undefined, "alasio", undefined, PatchStrategy.MergePatch)),
+        watch,
+        patchPodStatus: (namespace, name, patch) => call(() => core.patchNamespacedPodStatus({ namespace, name, body: patch, fieldManager: "alasio" }, setHeaderOptions("Content-Type", PatchStrategy.StrategicMergePatch))).pipe(Effect.asVoid),
+        remove: (apiVersion, kind, namespace, name, resourceVersion) => call(() => objects.delete(ref(apiVersion, kind, namespace, name), undefined, undefined, undefined, undefined, "Background", resourceVersion === undefined ? undefined : { preconditions: { resourceVersion } })).pipe(Effect.asVoid, Effect.catchIf(hasStatus(404), () => Effect.void)),
+        exec,
+    });
+}
+/** The exit code a `pods/exec` status reports: 0 on success, the process's own otherwise. */
+export function exitCodeOf(status) {
+    if (status.status === "Success")
+        return Result.succeed(0);
+    const cause = status.details?.causes?.find((entry) => entry.reason === "ExitCode");
+    if (cause)
+        return Result.succeed(Number(cause.message));
+    return Result.fail(new KubeExecError({ message: `exec failed: ${status.message ?? status.reason ?? "unknown error"}` }));
+}
+//# sourceMappingURL=client.js.map

package/dist/src/kube/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../../src/kube/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,OAAO,EAAuB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAyB,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAiB,MAAM,yBAAyB,CAAC;AAClK,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAyBjG,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAE9D,sGAAsG;AACtG,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE;IACnF,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;CACvB,CAAC;IACA,2HAA2H;IAC3H,MAAM,CAAC,EAAE,CAAC,KAAc;QACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9I,CAAC;IAED,IAAa,OAAO;QAClB,OAAO,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;CACF;AAED,kHAAkH;AAClH,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,eAAe,EAAE;IACtF,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,oDAAoD;AACpD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;AAEvG,+EAA+E;AAC/E,MAAM,YAAY,GAAG,CAAC,KAAc,EAA8C,EAAE,CAClF,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,EAAW;IACnD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS;QACzE,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,2FAA2F;AAC3F,SAAS,cAAc;IACrB,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IACpC,UAAU,CAAC,eAAe,EAAE,CAAC;IAC7B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,UAAkB,EAAE,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAEzI;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAE,KAAa;IACxG,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAChH,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,uDAAuD;AACvD,MAAM,IAAI,GAAG,CAAI,OAAyB,EAAkC,EAAE,CAC5E,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;AAE9D;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,OAAO,CAAC,OAAO,EAyC3C,CAAC,wBAAwB,CAAC;IAC5B,4DAA4D;IAC5D,MAAM,CAAU,KAAK,GAA4B,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;CACjH;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,UAAsB,EAAE,EAAE,cAAc,GAAG,gBAAgB,EAAE,GAAyC,EAAE;IACrI,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACtC,SAAiB,EACjB,GAAW,EACX,SAAiB,EACjB,OAA0B,EAC1B,EAAE,QAAQ,GAAG,sBAAsB,EAAE,GAAgB,EAAE;QAEvD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,GAAsB,IAAI,CAAC;QACrC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM,EAAE,KAAK,EAAE,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,gFAAgF;QAChF,MAAM,QAAQ,GAAgC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC/D,gFAAgF;QAChF,kEAAkE;QAClE,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAqB,CAAC,MAAM,EAAE,EAAE;YACpD,QAAQ;iBACL,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrH,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,MAAM,GAAG,MAAM,CAAC;gBAChB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,aAAa;gBAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC1C,CAAC;QACD,8CAA8C;QAC9C,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,SAAS,IAAI,GAAG,YAAY,QAAQ,QAAQ,EAAE,CAAC,CAAC;QAC/I,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,WAAW,SAAS,IAAI,GAAG,yBAAyB,EAAE,CAAC,CAAC;QACzH,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0HAA0H;IAC1H,mIAAmI;IACnI,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAE,MAAc,EAAE,SAAiB,EAAE,aAAqB,EAAE,IAAa,EAA2C,EAAE,CACrJ,MAAM,CAAC,QAAQ,CAA2B,CAAC,KAAK,EAAE,EAAE,CAClD,MAAM,CAAC,cAAc,CACnB,MAAM,CAAC,UAAU,CAAC;QAChB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,iBAAiB,EAAE,EAAE,MAAM,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,UAAU,eAAe,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;YACpK,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACnI,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;gBACpH,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,OAAO,GAAmB,EAAE,CAAC;YACnC,MAAM,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC/C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC3B,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAChC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAClB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,QAAQ,iBAAiB,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACjK,CAAC;gBACD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACxE,mHAAmH;gBACnH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBACxB,IAAI,CAAC;wBACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkG,CAAC;wBAC3I,oHAAoH;wBACpH,IAAI,IAAI,KAAK,OAAO;4BAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,YAAY,GAAG,CAAC,QAAQ,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;;4BAC5H,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,KAAK,CAAC,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,QAAQ,sBAAsB,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;YACxI,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,EAAE,YAAY,CAAC,EAAE;KACvB,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAC9C,CACF,CAAC;IAEJ,OAAO,UAAU,CAAC,EAAE,CAAC;QACnB,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAC1C,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC3D;QACH,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CACnD,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACzJ,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,IAAI,CAAC,GAAG,EAAE,CACR,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CACxI;QACH,KAAK;QACL,cAAc,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACzC,IAAI,CAAC,GAAG,EAAE,CACR,IAAI,CAAC,wBAAwB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,gBAAgB,CAAC,cAAc,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAC7J,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAC7D,IAAI,CAAC,GAAG,EAAE,CACR,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,eAAe,EAAE,EAAE,CAAC,CACrM,CAAC,IAAI,CACJ,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAClD;QACH,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,MAAgB;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IACnF,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3H,CAAC"}

package/dist/src/kube/sandbox-shape.js

@@ -1,42 +1,14 @@
 /**
- * What alasio adds to a workspace's Sandbox over the template its installation gives it
- * (../kube/config.ts): bayma's token, mounted from a Secret of the Sandbox's, and passed
- * as a file; the labels that name the Sandbox and say what it is; and, of a session's,
- * its internet's gate and DNS (../sandbox/index.ts), and of a folder's bayma, its state
- * directory (../mcp/bayma.ts). In one place, with no dependency, so the admission policy
- * that holds alasio to its templates (cli/src/manifests/admission.ts) knows it as they do.
+ * What alasio's pods of bayma carry, beyond their templates, that more than one of its
+ * parts knows: the gateway that binds them (../gateway/), the node agents that snapshot and
+ * restore them (../node-agent/), and the admission policies that hold them to what alasio
+ * up renders (cli/src/manifests/admission.ts). In one place, with no dependency, so the
+ * command line takes it as it is.
  */
-/** The container in every Sandbox's pod that runs bayma. */
+/** The container of a session's or a folder instance's pod that runs bayma. */
 export const BAYMA_CONTAINER = "bayma";
-/** Where a Sandbox's token Secret is mounted in its bayma container, its key, and its volume. */
-export const TOKEN_DIR = "/run/alasio/bayma";
-export const TOKEN_KEY = "token";
-export const TOKEN_VOLUME = "alasio-bayma-token";
-/** The token volume's files' mode: readable by the pod's group, which is how a non-root bayma reads it. */
-export const TOKEN_MODE = 0o440;
-/** The file bayma reads its token from, which a restored Sandbox's new token replaces. */
-export const TOKEN_FILE = `${TOKEN_DIR}/${TOKEN_KEY}`;
-/** The arguments bayma is given after its template's: where its token is. */
-export const TOKEN_FILE_ARGS = ["--token-file", TOKEN_FILE];
-/** The arguments a session's bayma is given after those when it exports telemetry: the token it exports with, read from the same file for each export. */
-export const TELEMETRY_TOKEN_FILE_ARGS = ["--telemetry-token-file", TOKEN_FILE];
-/** The name of a Sandbox's token Secret. */
-export function tokenSecretName(name) {
-    return `${name}-bayma-token`;
-}
-/** The label every object alasio makes carries, and the one that names its Sandbox. */
-export const MANAGED_BY = { "app.kubernetes.io/managed-by": "alasio" };
-export const SANDBOX_LABEL = "alasio.dev/sandbox";
-/** What a Sandbox's pod is to alasio: a session's, or a folder's bayma's. */
-export const WORKLOAD_LABEL = "alasio.dev/workload";
 /** A session's internet, `none` or `full`, which its NetworkPolicies follow. */
 export const NET_MODE_LABEL = "alasio.dev/net-mode";
-/** The harness a folder's bayma serves, as a path segment. */
-export const HARNESS_LABEL = "alasio.dev/harness";
-/** The resolvers a session with internet uses unless its template names others. */
-export const DEFAULT_FULL_MODE_NAMESERVERS = ["1.1.1.1", "8.8.8.8"];
-/** The argument a folder's bayma is given its state directory by, under its template's state root. */
-export const STATE_DIR_ARG = "--state-dir";
 /**
  * The argument a session's bayma is given how long it holds a stop by, for alasio to
  * snapshot it first (bayma's mcp-http help): a bayma run without it holds none.
@@ -44,13 +16,19 @@ export const STATE_DIR_ARG = "--state-dir";
 export const STOP_WAIT_ARG = "--stop-wait-ms";
 /** How long a session's bayma takes to stop once it holds its stop no more: it persists its sessions. */
 export const BAYMA_STOP_SECONDS = 30;
+/**
+ * The variable bayma's hook, run as its sandbox is restored, takes why its host stopped the
+ * sandbox from, as the end of a sentence, to tell each live session's next exec (bayma's
+ * sandbox-hook help).
+ */
+export const SANDBOX_STOP_REASON_VARIABLE = "BAYMA_SANDBOX_STOP_REASON";
 /** A path segment from `value`: never empty, nor starting with a dot. */
 export function sanitizePathToken(value) {
     return String(value).replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^[-.]+|-+$/g, "") || "default";
 }
 /**
  * What a session's pod template carries of its whole-sandbox snapshots
- * (../sandbox/snapshots.ts): the hash of the template it was made from, which its
+ * (../gateway/snapshots.ts): the hash of the template it was made from, which its
  * snapshots record; the CPU features its sandbox is held to; and, of a pod restored from
  * a snapshot, the image it is restored from, on its node under the snapshot cache, left
  * paused until its node's agent resumes it, which its readiness gate waits for.
@@ -64,18 +42,6 @@ export const RESTORE_ANNOTATION = "dev.gvisor.internal.restore.host-image-path";
 export const RESTORE_PAUSED_ANNOTATION = "dev.gvisor.internal.restore.paused";
 /** The condition of a restored pod's readiness gate, which alasio sets once its sandbox is resumed. */
 export const RESUMED_CONDITION = "alasio.dev/resumed";
-/**
- * The annotation of a suspended Sandbox naming the snapshot its pod was saved into, which
- * alone it may be restored from: set as it is suspended, removed as it is next resumed,
- * from that snapshot or not, so a snapshot outlives no resume of its Sandbox's.
- */
-export const SNAPSHOT_ANNOTATION = "alasio.dev/snapshot";
-/**
- * The annotation naming the gVisor release that took the snapshot SNAPSHOT_ANNOTATION
- * names, beside it, the only one that restores it: `alasio up` keeps every release one
- * names (cli/src/kept-releases.ts).
- */
-export const SNAPSHOT_RELEASE_ANNOTATION = "alasio.dev/snapshot-release";
 /** Where a node agent keeps the snapshots it prepares, as `<environment>/<workspace>/<snapshot>` (../node-agent/cache.ts). */
 export const SNAPSHOT_CACHE_DIR = "/var/lib/alasio/snapshots";
 /**
@@ -83,26 +49,6 @@ export const SNAPSHOT_CACHE_DIR = "/var/lib/alasio/snapshots";
  * workspace's ids sort as its snapshots were taken, then 32 random bits.
  */
 export const SNAPSHOT_ID = "[0-9]{8}T[0-9]{9}Z-[0-9a-f]{8}";
-/** A DNS label: an environment's name (its sessions' namespace) and a workspace's (its Sandbox's), as the snapshot cache's directories are named. */
+/** A DNS label: an environment's name (its sessions' namespace) and a workspace's, as the snapshot cache's directories are named. */
 export const NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/u;
-/** The init container that holds a session's pod until its egress is confined: its name, and its resources. */
-export const EGRESS_GATE = { name: "egress-gate", resources: { requests: { cpu: "10m", memory: "32Mi" }, limits: { memory: "64Mi" } } };
-/**
- * The egress gate's program: exits once three connections in a row to the API server
- * fail, and fails the pod if they still succeed after two minutes. Runs on the agent
- * image's Node.
- */
-export const EGRESS_GATE_SCRIPT = [
-    "const net = require('node:net');",
-    "const host = process.env.KUBERNETES_SERVICE_HOST, port = Number(process.env.KUBERNETES_SERVICE_PORT);",
-    "const deadline = Date.now() + 120000; let refused = 0;",
-    "(function probe() {",
-    "  const socket = net.connect({ host, port, timeout: 1000 });",
-    "  const next = (blocked) => { socket.destroy(); refused = blocked ? refused + 1 : 0;",
-    "    if (refused >= 3) process.exit(0);",
-    "    if (Date.now() > deadline) { console.error('egress is not confined: is NetworkPolicy enforced in this cluster?'); process.exit(1); }",
-    "    setTimeout(probe, 250); };",
-    "  socket.once('connect', () => next(false)); socket.once('timeout', () => next(true)); socket.once('error', () => next(true));",
-    "})();",
-].join("\n");
 //# sourceMappingURL=sandbox-shape.js.map

package/dist/src/kube/sandbox-shape.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAChC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAC/E,0JAA0J;AAC1J,MAAM,CAAC,MAAM,yBAAyB,GAAsB,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;AAEnG,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,cAAc,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,8BAA8B,EAAE,QAAQ,EAAW,CAAC;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEvF,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qJAAqJ;AACrJ,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAE5D,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,uGAAuG;IACvG,wDAAwD;IACxD,qBAAqB;IACrB,8DAA8D;IAC9D,sFAAsF;IACtF,wCAAwC;IACxC,0IAA0I;IAC1I,gCAAgC;IAChC,gIAAgI;IAChI,OAAO;CACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAExE,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qIAAqI;AACrI,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC"}

package/dist/src/kube/started-map.js

@@ -0,0 +1,12 @@
+/**
+ * Where alasio keeps the time of its last start (./started.ts), which `alasio status` reads
+ * while alasio runs no replica (cli/src/commands/status.ts), and whose ConfigMap alasio's
+ * manifests make, empty, alasio's Role letting it read and patch that one alone
+ * (cli/src/manifests/alasio.ts). In a module of its own, with no dependency, so the command
+ * line takes it as it is.
+ */
+/** The ConfigMap alasio keeps the time of its last start in, of its namespace. */
+export const STARTED_CONFIG_MAP = "alasio-started";
+/** Its key holding the time, as an ISO 8601 timestamp. */
+export const STARTED_KEY = "startedAt";
+//# sourceMappingURL=started-map.js.map

package/dist/src/kube/started-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"started-map.js","sourceRoot":"","sources":["../../../../src/kube/started-map.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC"}

package/dist/src/node-agent/names.js

@@ -14,6 +14,27 @@ export const NODE_AGENT_PORT = 8484;
  * alone reaches it, as a node reaches the pods it runs.
  */
 export const STORE_PROXY_PORT = 8485;
+/**
+ * Where a node agent keeps, on its node's /run, a tmpfs, what outlives it until the node
+ * restarts: the Unix domain socket it serves the snapshots bucket on to its node's restores
+ * too, which a restore's checkpoint gofer dials by its path, whatever pod the agent runs in
+ * (STORE_SOCKET), and those restores' tokens, read back as it starts again
+ * (STORE_TOKENS_FILE), each only root's. Of the pods alasio makes, the agent alone mounts the
+ * node's /run (cli/src/manifests/node-agent.ts), and the sessions' pods are held to their
+ * templates, which mount none of it (cli/src/manifests/admission.ts sandboxPodPolicy). The
+ * host profile's mounts, which the operator gives alasio and the folder's bayma, could reach
+ * it, but both run as the operator's user (1000 unless the profile says), whom the socket's
+ * and the file's mode, 0600 and root's, keep out.
+ */
+export const NODE_AGENT_RUN_DIR = "/run/alasio/node-agent";
+/** The variable that moves NODE_AGENT_RUN_DIR, as a test of the agent's own process does. */
+export const NODE_AGENT_RUN_DIR_VARIABLE = "ALASIO_NODE_AGENT_RUN_DIR";
+/** The socket a node agent serves the snapshots bucket on, on its node, in `runDir` (NODE_AGENT_RUN_DIR). */
+export const storeSocket = (runDir) => `${runDir}/store.sock`;
+/** The file a node agent keeps its restores' tokens in, on its node, in `runDir` (NODE_AGENT_RUN_DIR). */
+export const storeTokensFile = (runDir) => `${runDir}/tokens.json`;
+/** The URL a restore's gofer names the store by through STORE_SOCKET, which it signs: no host's, as the socket alone is dialled. */
+export const STORE_SOCKET_ENDPOINT = "http://alasio-node-agent";
 /** The variable that gives a node agent its pod's address, which it serves the bucket to its node on. */
 export const POD_IP_VARIABLE = "POD_IP";
 /**
@@ -36,6 +57,13 @@ export const gvisorDirectory = (release) => `${GVISOR_RELEASES}/${release}`;
  * where `since` names none.
  */
 export function restoresFromBucket(release, since) {
+    return releaseAtOrPast(release, since);
+}
+/**
+ * Whether gVisor's `release` is the fork's `since` or one past it, by its base's date and
+ * patch, then its own number; never where either names no release of the fork's.
+ */
+function releaseAtOrPast(release, since) {
     const parts = (named) => {
         const matched = /^(\d{8})\.(\d+)-eaucoin\.(\d+)$/u.exec(named);
         return matched ? matched.slice(1).map(Number) : null;
@@ -46,6 +74,19 @@ export function restoresFromBucket(release, since) {
     const differs = of.findIndex((part, index) => part !== first[index]);
     return differs === -1 || (of[differs] ?? 0) > (first[differs] ?? 0);
 }
+/**
+ * The gofer a restore of a snapshot taken under gVisor's `release` asks for: through a socket,
+ * reading again pages a read of failed, of one at or past `since`, the first release that
+ * restores so, as cluster/node/pins.json says it (gvisor.restoresThroughSocketSince); none,
+ * the agent's own way, over TCP, of one before it, and of every release where `since` names none.
+ */
+export const goferOf = (release, since) => (releaseAtOrPast(release, since) ? { transport: "socket", pagesRetry: true } : null);
+/**
+ * The name of a restore's pod, as the gateway makes it (../gateway/names.ts restorePodName): its
+ * pool's, `-restore-`, then seven of base 36's digits; the one name whose directory the node
+ * agent makes for it, before the pod is made.
+ */
+export const RESTORE_POD = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?-restore-[0-9a-z]{7}$/u;
 /** The variable that gives the node agent the first gVisor release that restores straight from the bucket (restoresFromBucket). */
 export const RESTORES_FROM_BUCKET_SINCE_VARIABLE = "ALASIO_GVISOR_RESTORES_FROM_BUCKET_SINCE";
 /** Where k3s's containerd reads its template, and runsc its options. */
@@ -61,6 +102,21 @@ export const gvisorHandler = (release) => `runsc-${gvisorLabel(release)}`;
 export const gvisorRuntimeClass = (release) => `gvisor-${gvisorLabel(release)}`;
 /** The version runsc of gVisor's `release` reports, and saves its images with: its release's tag. */
 export const runscVersion = (release) => `release-${release}`;
+/**
+ * The directory alasio's pods keep on a node, which nothing of k3s's removes: the workspaces'
+ * JuiceFS mount and its state and cache, its juicefs, and the pool pods' directories, which
+ * workspaces are attached into, mounts all (cli/src/manifests/sandbox-gateway.ts).
+ */
+export const NODE_DIRECTORY = "/var/lib/alasio";
+/**
+ * Where a node has workspace storage mounted, held by a pod of its own, each workspace's
+ * files at `<environment>/<workspace>/files`.
+ */
+export const WORKSPACES_ROOT = `${NODE_DIRECTORY}/workspaces`;
+/** Where a node keeps the directory of each pod of a sandbox pool, or of a harness pool, `<namespace>/<pod>`, which the pod mounts by `subPathExpr` of its namespace and its name. */
+export const ATTACH_ROOT = `${NODE_DIRECTORY}/attach`;
+/** The file of a harness pool's pod's binding in its directory, which its node's agent writes as the gateway binds it, and the pod serves once it is there (src/harness/program.ts). */
+export const BINDING_FILE = "binding.json";
 /** The root the gVisor shims run runsc with for Kubernetes' containers, under the node's /run. */
 export const RUNSC_ROOT = "/run/containerd/runsc/k8s.io";
 /** The node's snapshot cache, where its sandboxes are restored from, as the admission policy holds a restore to. */
@@ -93,8 +149,10 @@ export const UNSYNCED_DOWNLOAD_BYTES = SNAPSHOT_PARTS_AT_ONCE * SNAPSHOT_SYNC_BY
 export const NODE_AGENT_OWN_BYTES = 160 * 1024 ** 2;
 /** The least memory limit a node agent runs under: its own, and a download's budget beside it. */
 export const NODE_AGENT_MEMORY_FLOOR = NODE_AGENT_OWN_BYTES + UNSYNCED_DOWNLOAD_BYTES;
-/** The variable holding the token alasio presents to a node agent. */
+/** The variable holding the token the sandbox gateway presents to a node agent. */
 export const NODE_AGENT_TOKEN_VARIABLE = "ALASIO_NODE_AGENT_TOKEN";
+/** The variable holding workspace storage's metadata engine's address, its password in it, which the agent sets workspaces' quotas on alone. */
+export const META_URL_VARIABLE = "META_URL";
 /** The variable holding the most bytes the node's snapshot cache keeps. */
 export const SNAPSHOT_CACHE_BYTES_VARIABLE = "ALASIO_SNAPSHOT_CACHE_BYTES";
 /**
@@ -106,7 +164,7 @@ export const OPERATION_LIMIT_SECONDS = 15 * 60;
 /**
  * How long a restore from the bucket may take from its prepare to its resume, which its token
  * lasts unless resumed before (./store-proxy.ts): the longest it takes, alasio waiting 3
- * minutes for its pod to run (POD_RUNNING_TIMEOUT in src/sandbox/snapshots.ts), then for the
+ * minutes for its pod to run (POD_RUNNING_TIMEOUT_MS in src/gateway/snapshots.ts), then for the
  * agent's resume, and a margin.
  */
 export const RESTORE_PREPARED_FOR_SECONDS = 5 * 60;
@@ -114,9 +172,8 @@ export const RESTORE_PREPARED_FOR_SECONDS = 5 * 60;
 export const BACKGROUND_READ_SECONDS_VARIABLE = "ALASIO_BACKGROUND_READ_SECONDS";
 /**
  * The slowest a resumed restore is taken to read the rest of its sandbox through the node
- * agent, in the background: half of what gate 4 measured on a runner's bundled SeaweedFS,
- * 8.7 MB/s through the agent's proxy from the restore's start to its last read
- * (program/progress/live-lazy.md).
+ * agent, in the background: half of what was measured on a runner's bundled SeaweedFS,
+ * 8.7 MB/s through the agent's proxy from the restore's start to its last read.
  */
 export const BACKGROUND_READ_BYTES_PER_SECOND = 4 * 1024 ** 2;
 /**

package/dist/src/node-agent/names.js.map

@@ -1 +1 @@
-{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/node-agent/names.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAG,0CAA0C,CAAC;AAE9F,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAEtE,0IAA0I;AAC1I,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1F,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAEhG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;AAE9E,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAEzD,oHAAoH;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAQrD,uIAAuI;AACvI,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAElD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAEtF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,CAAC;AAEnD,+IAA+I;AAC/I,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,gCAAgC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,4BAA4B,GAAG,qBAAqB,CAAC,WAAW,CAAC,GAAG,uBAAuB,CAAC;AACrG,CAAC"}
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/node-agent/names.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAC3D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AACvE,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,aAAa,CAAC;AAC9E,0GAA0G;AAC1G,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,cAAc,CAAC;AACnF,oIAAoI;AACpI,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,KAAa,EAAgB,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9J;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAElF,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAG,0CAA0C,CAAC;AAE9F,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAEtE,0IAA0I;AAC1I,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1F,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAEhG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,cAAc,aAAa,CAAC;AAE9D,sLAAsL;AACtL,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,cAAc,SAAS,CAAC;AAEtD,wLAAwL;AACxL,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAEzD,oHAAoH;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAQrD,uIAAuI;AACvI,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAElD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAEtF,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,gJAAgJ;AAChJ,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,CAAC;AAEnD,+IAA+I;AAC/I,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,gCAAgC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,4BAA4B,GAAG,qBAAqB,CAAC,WAAW,CAAC,GAAG,uBAAuB,CAAC;AACrG,CAAC"}

package/dist/src/sandbox/names.js

@@ -1,33 +1,18 @@
 /**
  * Naming for session filesystems. A workspace is one of two kinds (see
  * ../workspace/kind.ts): a folder, or a session filesystem identified by a volume id.
- * A volume id is what alasio generates and stores, and its session's Sandbox, Service and
- * volume claim are named for it.
- */
-import { Schema } from "effect";
-/**
- * The longest a volume id is: a DNS label's 63 characters, less a claim template's name
- * of up to CLAIM_TEMPLATE_MAX and the hyphen after it, so its volume claims' names,
- * `<template>-<id>` (../kube/sandboxes.ts claimName), are DNS labels too, as alasio's
- * admission policy of its clones holds them to (cli/src/manifests/admission.ts).
+ * A volume id is what alasio generates and stores, and its session's workspace, which the
+ * sandbox gateway holds, is named for it (sessionKey).
  */
+/** The longest a volume id is: a DNS label's 63 characters, with room to spare, as the ids alasio has stored are. */
 export const VOLUME_ID_MAX = 58;
-/** The longest a claim template's name is, of which a volume id's claims are named. */
-export const CLAIM_TEMPLATE_MAX = 63 - 1 - VOLUME_ID_MAX;
 /**
  * A volume id is a DNS label of 3–58 characters from `[a-z0-9-]` that starts and ends
- * with a letter or digit, as the names of the Sandbox, its Service and its pod must be,
- * and short enough for its claims' (VOLUME_ID_MAX). alasio generates ids that already
+ * with a letter or digit, as the names of what is made of it must be, a workspace's
+ * directory among them, of VOLUME_ID_MAX at most. alasio generates ids that already
  * satisfy this, and this guards against any that would not.
  */
 const VOLUME_ID_PATTERN = new RegExp(`^[a-z0-9][a-z0-9-]{1,${VOLUME_ID_MAX - 2}}[a-z0-9]$`, "u");
-/** A volume id, as what comes from outside alasio is decoded. */
-const VolumeId = Schema.String.check(Schema.isPattern(VOLUME_ID_PATTERN));
-/**
- * A session's token, `<volumeId>.<random>` (../kube/sandboxes.ts newToken), decoded into
- * the session it names and the rest.
- */
-export const SessionToken = Schema.TemplateLiteralParser([VolumeId, ".", Schema.NonEmptyString]);
 export function isValidVolumeId(volumeId) {
     return typeof volumeId === "string" && VOLUME_ID_PATTERN.test(volumeId);
 }
@@ -41,4 +26,11 @@ export function assertValidVolumeId(volumeId) {
 export function newVolumeId(random = () => crypto.randomUUID()) {
     return `fs-${random().replace(/-/g, "").slice(0, 12)}`;
 }
+/** The key a session filesystem's workspace is bound by in the sandbox service: `sessionfs:<volumeId>`. */
+export const sessionKey = (volumeId) => `sessionfs:${volumeId}`;
+/** The volume id of the session filesystem `key` binds, where it binds one; else null. */
+export function volumeIdOfKey(key) {
+    const volumeId = key.startsWith("sessionfs:") ? key.slice("sessionfs:".length) : "";
+    return isValidVolumeId(volumeId) ? volumeId : null;
+}
 //# sourceMappingURL=names.js.map

package/dist/src/sandbox/names.js.map

@@ -1 +1 @@
-{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/sandbox/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,wBAAwB,aAAa,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAEjG,iEAAiE;AACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAEjG,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,aAAa,kEAAkE,CAAC,CAAC;IACrK,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,MAAM,GAAiB,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;IAC1E,OAAO,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/sandbox/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qHAAqH;AACrH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,wBAAwB,aAAa,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAEjG,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,aAAa,kEAAkE,CAAC,CAAC;IACrK,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,MAAM,GAAiB,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;IAC1E,OAAO,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,aAAa,QAAQ,EAAE,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC"}