alasio 8.0.0 → 9.0.0

package/dist/src/gateway/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/gateway/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,kIAAkI;AAClI,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAChE,MAAM,CAAC,MAAM,mCAAmC,GAAG,4BAA4B,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;AAC9E,8GAA8G;AAC9G,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAExE,uJAAuJ;AACvJ,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAC1D,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AAEpE,oIAAoI;AACpI,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAChE,gJAAgJ;AAChJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAE9D,uKAAuK;AACvK,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAc,EAAW,EAAE,CACvD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5K,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,IAAI,YAAY,MAAM,EAAE,CAAC;AAEpG,yJAAyJ;AACzJ,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,SAAiB,EAAE,IAAY;IAC3E,MAAM,WAAW,GAAG,CAAC,SAAsB,EAAe,EAAE,CAAC,CAAC;QAC5D,GAAG,SAAS;QACZ,GAAG,CAAC,SAAS,CAAC,YAAY;YACxB,CAAC,CAAC;gBACA,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;oBACjD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;wBAAE,OAAO,KAAK,CAAC;oBAC/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC;oBAChD,OAAO,GAAG,CAAC;gBACb,CAAC,CAAC;aACH;YACD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,2IAA2I;QAC3I,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,WAAW,IAAI,SAAS,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrN,CAAC;AACJ,CAAC;AAED,0HAA0H;AAC1H,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEpC,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C,+DAA+D;AAC/D,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAE1C,qGAAqG;AACrG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,YAAoB,EAAU,EAAE,CAAC,GAAG,iBAAiB,GAAG,OAAO,IAAI,YAAY,EAAE,CAAC;AAE7H,8GAA8G;AAC9G,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrI,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAE,YAAoB,EAAU,EAAE,CACjG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;AAErF,sIAAsI;AACtI,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,MAAc,EAAU,EAAE,CAAC,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;AACrH,MAAM,CAAC,MAAM,UAAU,GAAG,mCAAmC,CAAC;AAE9D,8IAA8I;AAC9I,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,GAAG,cAAc,CAAC;AAC/E,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,QAAQ,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;AAChE,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,8HAA8H;AAC9H,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,OAAO,GAAG,eAAe,EAAU,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9H;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,GAAW,EAAE,QAAgB;IAC1E,OAAO;QACL,GAAG,IAAI;QACP,6BAA6B,EAAE,mBAAmB;QAClD,aAAa,EAAE,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5C,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACvC,GAAG,SAAS;YACZ,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,CAAC;YAC7F,YAAY,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACpI,CACF;QACD,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;KACtI,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,gBAAgB,EAAE,MAAM,CAAC,MAAM;IAC/B,uJAAuJ;IACvJ,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,gBAAgB,EAAE,MAAM,CAAC,MAAM;QAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;KACnH,CAAC,CAAC;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;KAC9E,CAAC;CACH,CAAC,CAAC;AAGH,0JAA0J;AAC1J,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC,MAAM;IAC1B,mBAAmB,EAAE,MAAM,CAAC,MAAM;IAClC,2IAA2I;IAC3I,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7E,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC1C,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAClE,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrG,2IAA2I;IAC3I,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;CACtJ,CAAC,CAAC"}

package/dist/src/harness/names.js

@@ -0,0 +1,49 @@
+/**
+ * Harness identifiers shared by persistence, operator controls, and runtime selection.
+ *
+ * A harness is the agent runtime alasio drives for a Telegram conversation. Each
+ * conversation has at most one active harness at a time; the other harness keeps
+ * its own parked session pointer so switching never mounts a foreign session.
+ *
+ * A conversation starts with no harness mounted. Until the operator chooses one
+ * through /service, alasio only ever answers with the service picker. The
+ * `null` harness is therefore a real state, not a fallback, and callers must
+ * not coerce it to a default.
+ */
+export const CODEX_HARNESS = "codex";
+export const CLAUDE_HARNESS = "claude";
+export const HARNESS_NAMES = Object.freeze([CODEX_HARNESS, CLAUDE_HARNESS]);
+const DISPLAY_NAMES = Object.freeze({
+    [CODEX_HARNESS]: "Codex",
+    [CLAUDE_HARNESS]: "Claude",
+});
+export function isHarnessName(candidate) {
+    const names = HARNESS_NAMES;
+    return typeof candidate === "string" && names.includes(candidate);
+}
+export function normalizeHarnessName(candidate, fallback = CODEX_HARNESS) {
+    if (typeof candidate !== "string") {
+        return fallback;
+    }
+    const lowered = candidate.trim().toLowerCase();
+    if (lowered === "claude" || lowered === "claude-code" || lowered === "claude_code" || lowered === "claudecode" || lowered === "claude code") {
+        return CLAUDE_HARNESS;
+    }
+    if (lowered === "codex") {
+        return CODEX_HARNESS;
+    }
+    return fallback;
+}
+export function harnessDisplayName(harness) {
+    return (harness && DISPLAY_NAMES[harness]) ?? DISPLAY_NAMES[CODEX_HARNESS];
+}
+/**
+ * Harness pre-mounted on newly created conversations.
+ *
+ * Neutral by default: returns null unless ALASIO_DEFAULT_HARNESS opts into a
+ * harness, in which case new conversations skip the picker.
+ */
+export function getDefaultHarness(env = process.env) {
+    return normalizeHarnessName(env["ALASIO_DEFAULT_HARNESS"], null);
+}
+//# sourceMappingURL=names.js.map

package/dist/src/harness/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/harness/names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,cAAc,CAAU,CAAC,CAAC;AAKrF,MAAM,aAAa,GAA0C,MAAM,CAAC,MAAM,CAAC;IACzE,CAAC,aAAa,CAAC,EAAE,OAAO;IACxB,CAAC,cAAc,CAAC,EAAE,QAAQ;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,MAAM,KAAK,GAAsB,aAAa,CAAC;IAC/C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC;AAID,MAAM,UAAU,oBAAoB,CAAC,SAAkB,EAAE,QAAQ,GAAuB,aAAa;IACnG,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC5I,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACpE,OAAO,oBAAoB,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC"}

package/dist/src/kube/sandbox-shape.js

@@ -1,42 +1,14 @@
 /**
- * What alasio adds to a workspace's Sandbox over the template its installation gives it
- * (../kube/config.ts): bayma's token, mounted from a Secret of the Sandbox's, and passed
- * as a file; the labels that name the Sandbox and say what it is; and, of a session's,
- * its internet's gate and DNS (../sandbox/index.ts), and of a folder's bayma, its state
- * directory (../mcp/bayma.ts). In one place, with no dependency, so the admission policy
- * that holds alasio to its templates (cli/src/manifests/admission.ts) knows it as they do.
+ * What alasio's pods of bayma carry, beyond their templates, that more than one of its
+ * parts knows: the gateway that binds them (../gateway/), the node agents that snapshot and
+ * restore them (../node-agent/), and the admission policies that hold them to what alasio
+ * up renders (cli/src/manifests/admission.ts). In one place, with no dependency, so the
+ * command line takes it as it is.
  */
-/** The container in every Sandbox's pod that runs bayma. */
+/** The container of a session's or a folder instance's pod that runs bayma. */
 export const BAYMA_CONTAINER = "bayma";
-/** Where a Sandbox's token Secret is mounted in its bayma container, its key, and its volume. */
-export const TOKEN_DIR = "/run/alasio/bayma";
-export const TOKEN_KEY = "token";
-export const TOKEN_VOLUME = "alasio-bayma-token";
-/** The token volume's files' mode: readable by the pod's group, which is how a non-root bayma reads it. */
-export const TOKEN_MODE = 0o440;
-/** The file bayma reads its token from, which a restored Sandbox's new token replaces. */
-export const TOKEN_FILE = `${TOKEN_DIR}/${TOKEN_KEY}`;
-/** The arguments bayma is given after its template's: where its token is. */
-export const TOKEN_FILE_ARGS = ["--token-file", TOKEN_FILE];
-/** The arguments a session's bayma is given after those when it exports telemetry: the token it exports with, read from the same file for each export. */
-export const TELEMETRY_TOKEN_FILE_ARGS = ["--telemetry-token-file", TOKEN_FILE];
-/** The name of a Sandbox's token Secret. */
-export function tokenSecretName(name) {
-    return `${name}-bayma-token`;
-}
-/** The label every object alasio makes carries, and the one that names its Sandbox. */
-export const MANAGED_BY = { "app.kubernetes.io/managed-by": "alasio" };
-export const SANDBOX_LABEL = "alasio.dev/sandbox";
-/** What a Sandbox's pod is to alasio: a session's, or a folder's bayma's. */
-export const WORKLOAD_LABEL = "alasio.dev/workload";
 /** A session's internet, `none` or `full`, which its NetworkPolicies follow. */
 export const NET_MODE_LABEL = "alasio.dev/net-mode";
-/** The harness a folder's bayma serves, as a path segment. */
-export const HARNESS_LABEL = "alasio.dev/harness";
-/** The resolvers a session with internet uses unless its template names others. */
-export const DEFAULT_FULL_MODE_NAMESERVERS = ["1.1.1.1", "8.8.8.8"];
-/** The argument a folder's bayma is given its state directory by, under its template's state root. */
-export const STATE_DIR_ARG = "--state-dir";
 /**
  * The argument a session's bayma is given how long it holds a stop by, for alasio to
  * snapshot it first (bayma's mcp-http help): a bayma run without it holds none.
@@ -50,7 +22,7 @@ export function sanitizePathToken(value) {
 }
 /**
  * What a session's pod template carries of its whole-sandbox snapshots
- * (../sandbox/snapshots.ts): the hash of the template it was made from, which its
+ * (../gateway/snapshots.ts): the hash of the template it was made from, which its
  * snapshots record; the CPU features its sandbox is held to; and, of a pod restored from
  * a snapshot, the image it is restored from, on its node under the snapshot cache, left
  * paused until its node's agent resumes it, which its readiness gate waits for.
@@ -64,18 +36,6 @@ export const RESTORE_ANNOTATION = "dev.gvisor.internal.restore.host-image-path";
 export const RESTORE_PAUSED_ANNOTATION = "dev.gvisor.internal.restore.paused";
 /** The condition of a restored pod's readiness gate, which alasio sets once its sandbox is resumed. */
 export const RESUMED_CONDITION = "alasio.dev/resumed";
-/**
- * The annotation of a suspended Sandbox naming the snapshot its pod was saved into, which
- * alone it may be restored from: set as it is suspended, removed as it is next resumed,
- * from that snapshot or not, so a snapshot outlives no resume of its Sandbox's.
- */
-export const SNAPSHOT_ANNOTATION = "alasio.dev/snapshot";
-/**
- * The annotation naming the gVisor release that took the snapshot SNAPSHOT_ANNOTATION
- * names, beside it, the only one that restores it: `alasio up` keeps every release one
- * names (cli/src/kept-releases.ts).
- */
-export const SNAPSHOT_RELEASE_ANNOTATION = "alasio.dev/snapshot-release";
 /** Where a node agent keeps the snapshots it prepares, as `<environment>/<workspace>/<snapshot>` (../node-agent/cache.ts). */
 export const SNAPSHOT_CACHE_DIR = "/var/lib/alasio/snapshots";
 /**
@@ -83,26 +43,6 @@ export const SNAPSHOT_CACHE_DIR = "/var/lib/alasio/snapshots";
  * workspace's ids sort as its snapshots were taken, then 32 random bits.
  */
 export const SNAPSHOT_ID = "[0-9]{8}T[0-9]{9}Z-[0-9a-f]{8}";
-/** A DNS label: an environment's name (its sessions' namespace) and a workspace's (its Sandbox's), as the snapshot cache's directories are named. */
+/** A DNS label: an environment's name (its sessions' namespace) and a workspace's, as the snapshot cache's directories are named. */
 export const NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/u;
-/** The init container that holds a session's pod until its egress is confined: its name, and its resources. */
-export const EGRESS_GATE = { name: "egress-gate", resources: { requests: { cpu: "10m", memory: "32Mi" }, limits: { memory: "64Mi" } } };
-/**
- * The egress gate's program: exits once three connections in a row to the API server
- * fail, and fails the pod if they still succeed after two minutes. Runs on the agent
- * image's Node.
- */
-export const EGRESS_GATE_SCRIPT = [
-    "const net = require('node:net');",
-    "const host = process.env.KUBERNETES_SERVICE_HOST, port = Number(process.env.KUBERNETES_SERVICE_PORT);",
-    "const deadline = Date.now() + 120000; let refused = 0;",
-    "(function probe() {",
-    "  const socket = net.connect({ host, port, timeout: 1000 });",
-    "  const next = (blocked) => { socket.destroy(); refused = blocked ? refused + 1 : 0;",
-    "    if (refused >= 3) process.exit(0);",
-    "    if (Date.now() > deadline) { console.error('egress is not confined: is NetworkPolicy enforced in this cluster?'); process.exit(1); }",
-    "    setTimeout(probe, 250); };",
-    "  socket.once('connect', () => next(false)); socket.once('timeout', () => next(true)); socket.once('error', () => next(true));",
-    "})();",
-].join("\n");
 //# sourceMappingURL=sandbox-shape.js.map

package/dist/src/kube/sandbox-shape.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAChC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAC/E,0JAA0J;AAC1J,MAAM,CAAC,MAAM,yBAAyB,GAAsB,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;AAEnG,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,cAAc,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,8BAA8B,EAAE,QAAQ,EAAW,CAAC;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEvF,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qJAAqJ;AACrJ,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAE5D,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,uGAAuG;IACvG,wDAAwD;IACxD,qBAAqB;IACrB,8DAA8D;IAC9D,sFAAsF;IACtF,wCAAwC;IACxC,0IAA0I;IAC1I,gCAAgC;IAChC,gIAAgI;IAChI,OAAO;CACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qIAAqI;AACrI,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC"}

package/dist/src/node-agent/names.js

@@ -14,6 +14,27 @@ export const NODE_AGENT_PORT = 8484;
  * alone reaches it, as a node reaches the pods it runs.
  */
 export const STORE_PROXY_PORT = 8485;
+/**
+ * Where a node agent keeps, on its node's /run, a tmpfs, what outlives it until the node
+ * restarts: the Unix domain socket it serves the snapshots bucket on to its node's restores
+ * too, which a restore's checkpoint gofer dials by its path, whatever pod the agent runs in
+ * (STORE_SOCKET), and those restores' tokens, read back as it starts again
+ * (STORE_TOKENS_FILE), each only root's. Of the pods alasio makes, the agent alone mounts the
+ * node's /run (cli/src/manifests/node-agent.ts), and the sessions' pods are held to their
+ * templates, which mount none of it (cli/src/manifests/admission.ts sandboxPodPolicy). The
+ * host profile's mounts, which the operator gives alasio and the folder's bayma, could reach
+ * it, but both run as the operator's user (1000 unless the profile says), whom the socket's
+ * and the file's mode, 0600 and root's, keep out.
+ */
+export const NODE_AGENT_RUN_DIR = "/run/alasio/node-agent";
+/** The variable that moves NODE_AGENT_RUN_DIR, as a test of the agent's own process does. */
+export const NODE_AGENT_RUN_DIR_VARIABLE = "ALASIO_NODE_AGENT_RUN_DIR";
+/** The socket a node agent serves the snapshots bucket on, on its node, in `runDir` (NODE_AGENT_RUN_DIR). */
+export const storeSocket = (runDir) => `${runDir}/store.sock`;
+/** The file a node agent keeps its restores' tokens in, on its node, in `runDir` (NODE_AGENT_RUN_DIR). */
+export const storeTokensFile = (runDir) => `${runDir}/tokens.json`;
+/** The URL a restore's gofer names the store by through STORE_SOCKET, which it signs: no host's, as the socket alone is dialled. */
+export const STORE_SOCKET_ENDPOINT = "http://alasio-node-agent";
 /** The variable that gives a node agent its pod's address, which it serves the bucket to its node on. */
 export const POD_IP_VARIABLE = "POD_IP";
 /**
@@ -36,6 +57,13 @@ export const gvisorDirectory = (release) => `${GVISOR_RELEASES}/${release}`;
  * where `since` names none.
  */
 export function restoresFromBucket(release, since) {
+    return releaseAtOrPast(release, since);
+}
+/**
+ * Whether gVisor's `release` is the fork's `since` or one past it, by its base's date and
+ * patch, then its own number; never where either names no release of the fork's.
+ */
+function releaseAtOrPast(release, since) {
     const parts = (named) => {
         const matched = /^(\d{8})\.(\d+)-eaucoin\.(\d+)$/u.exec(named);
         return matched ? matched.slice(1).map(Number) : null;
@@ -46,6 +74,19 @@ export function restoresFromBucket(release, since) {
     const differs = of.findIndex((part, index) => part !== first[index]);
     return differs === -1 || (of[differs] ?? 0) > (first[differs] ?? 0);
 }
+/**
+ * The gofer a restore of a snapshot taken under gVisor's `release` asks for: through a socket,
+ * reading again pages a read of failed, of one at or past `since`, the first release that
+ * restores so, as cluster/node/pins.json says it (gvisor.restoresThroughSocketSince); none,
+ * the agent's own way, over TCP, of one before it, and of every release where `since` names none.
+ */
+export const goferOf = (release, since) => (releaseAtOrPast(release, since) ? { transport: "socket", pagesRetry: true } : null);
+/**
+ * The name of a restore's pod, as the gateway makes it (../gateway/names.ts restorePodName): its
+ * pool's, `-restore-`, then seven of base 36's digits; the one name whose directory the node
+ * agent makes for it, before the pod is made.
+ */
+export const RESTORE_POD = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?-restore-[0-9a-z]{7}$/u;
 /** The variable that gives the node agent the first gVisor release that restores straight from the bucket (restoresFromBucket). */
 export const RESTORES_FROM_BUCKET_SINCE_VARIABLE = "ALASIO_GVISOR_RESTORES_FROM_BUCKET_SINCE";
 /** Where k3s's containerd reads its template, and runsc its options. */
@@ -61,6 +102,13 @@ export const gvisorHandler = (release) => `runsc-${gvisorLabel(release)}`;
 export const gvisorRuntimeClass = (release) => `gvisor-${gvisorLabel(release)}`;
 /** The version runsc of gVisor's `release` reports, and saves its images with: its release's tag. */
 export const runscVersion = (release) => `release-${release}`;
+/**
+ * Where a node has workspace storage mounted, held by a pod of its own, each workspace's
+ * files at `<environment>/<workspace>/files`.
+ */
+export const WORKSPACES_ROOT = "/var/lib/alasio/workspaces";
+/** Where a node keeps the directory of each pod of a sandbox pool, `<namespace>/<pod>`, which the pod mounts by `subPathExpr` of its namespace and its name. */
+export const ATTACH_ROOT = "/var/lib/alasio/attach";
 /** The root the gVisor shims run runsc with for Kubernetes' containers, under the node's /run. */
 export const RUNSC_ROOT = "/run/containerd/runsc/k8s.io";
 /** The node's snapshot cache, where its sandboxes are restored from, as the admission policy holds a restore to. */
@@ -93,8 +141,10 @@ export const UNSYNCED_DOWNLOAD_BYTES = SNAPSHOT_PARTS_AT_ONCE * SNAPSHOT_SYNC_BY
 export const NODE_AGENT_OWN_BYTES = 160 * 1024 ** 2;
 /** The least memory limit a node agent runs under: its own, and a download's budget beside it. */
 export const NODE_AGENT_MEMORY_FLOOR = NODE_AGENT_OWN_BYTES + UNSYNCED_DOWNLOAD_BYTES;
-/** The variable holding the token alasio presents to a node agent. */
+/** The variable holding the token the sandbox gateway presents to a node agent. */
 export const NODE_AGENT_TOKEN_VARIABLE = "ALASIO_NODE_AGENT_TOKEN";
+/** The variable holding workspace storage's metadata engine's address, its password in it, which the agent sets workspaces' quotas on alone. */
+export const META_URL_VARIABLE = "META_URL";
 /** The variable holding the most bytes the node's snapshot cache keeps. */
 export const SNAPSHOT_CACHE_BYTES_VARIABLE = "ALASIO_SNAPSHOT_CACHE_BYTES";
 /**
@@ -106,7 +156,7 @@ export const OPERATION_LIMIT_SECONDS = 15 * 60;
 /**
  * How long a restore from the bucket may take from its prepare to its resume, which its token
  * lasts unless resumed before (./store-proxy.ts): the longest it takes, alasio waiting 3
- * minutes for its pod to run (POD_RUNNING_TIMEOUT in src/sandbox/snapshots.ts), then for the
+ * minutes for its pod to run (POD_RUNNING_TIMEOUT_MS in src/gateway/snapshots.ts), then for the
  * agent's resume, and a margin.
  */
 export const RESTORE_PREPARED_FOR_SECONDS = 5 * 60;

package/dist/src/node-agent/names.js.map

@@ -1 +1 @@
-{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/node-agent/names.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAG,0CAA0C,CAAC;AAE9F,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAEtE,0IAA0I;AAC1I,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1F,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAEhG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;AAE9E,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAEzD,oHAAoH;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAQrD,uIAAuI;AACvI,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAElD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAEtF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,CAAC;AAEnD,+IAA+I;AAC/I,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,gCAAgC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,4BAA4B,GAAG,qBAAqB,CAAC,WAAW,CAAC,GAAG,uBAAuB,CAAC;AACrG,CAAC"}
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/node-agent/names.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAC3D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AACvE,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,aAAa,CAAC;AAC9E,0GAA0G;AAC1G,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,cAAc,CAAC;AACnF,oIAAoI;AACpI,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,KAAa,EAAgB,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9J;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAElF,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAG,0CAA0C,CAAC;AAE9F,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAEtE,0IAA0I;AAC1I,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1F,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAEhG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAE5D,gKAAgK;AAChK,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAEzD,oHAAoH;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAQrD,uIAAuI;AACvI,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAElD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAEtF,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,gJAAgJ;AAChJ,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,CAAC;AAEnD,+IAA+I;AAC/I,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,gCAAgC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,4BAA4B,GAAG,qBAAqB,CAAC,WAAW,CAAC,GAAG,uBAAuB,CAAC;AACrG,CAAC"}

package/dist/src/sandbox/names.js

@@ -1,33 +1,18 @@
 /**
  * Naming for session filesystems. A workspace is one of two kinds (see
  * ../workspace/kind.ts): a folder, or a session filesystem identified by a volume id.
- * A volume id is what alasio generates and stores, and its session's Sandbox, Service and
- * volume claim are named for it.
- */
-import { Schema } from "effect";
-/**
- * The longest a volume id is: a DNS label's 63 characters, less a claim template's name
- * of up to CLAIM_TEMPLATE_MAX and the hyphen after it, so its volume claims' names,
- * `<template>-<id>` (../kube/sandboxes.ts claimName), are DNS labels too, as alasio's
- * admission policy of its clones holds them to (cli/src/manifests/admission.ts).
+ * A volume id is what alasio generates and stores, and its session's workspace, which the
+ * sandbox gateway holds, is named for it (sessionKey).
  */
+/** The longest a volume id is: a DNS label's 63 characters, with room to spare, as the ids alasio has stored are. */
 export const VOLUME_ID_MAX = 58;
-/** The longest a claim template's name is, of which a volume id's claims are named. */
-export const CLAIM_TEMPLATE_MAX = 63 - 1 - VOLUME_ID_MAX;
 /**
  * A volume id is a DNS label of 3–58 characters from `[a-z0-9-]` that starts and ends
- * with a letter or digit, as the names of the Sandbox, its Service and its pod must be,
- * and short enough for its claims' (VOLUME_ID_MAX). alasio generates ids that already
+ * with a letter or digit, as the names of what is made of it must be, a workspace's
+ * directory among them, of VOLUME_ID_MAX at most. alasio generates ids that already
  * satisfy this, and this guards against any that would not.
  */
 const VOLUME_ID_PATTERN = new RegExp(`^[a-z0-9][a-z0-9-]{1,${VOLUME_ID_MAX - 2}}[a-z0-9]$`, "u");
-/** A volume id, as what comes from outside alasio is decoded. */
-const VolumeId = Schema.String.check(Schema.isPattern(VOLUME_ID_PATTERN));
-/**
- * A session's token, `<volumeId>.<random>` (../kube/sandboxes.ts newToken), decoded into
- * the session it names and the rest.
- */
-export const SessionToken = Schema.TemplateLiteralParser([VolumeId, ".", Schema.NonEmptyString]);
 export function isValidVolumeId(volumeId) {
     return typeof volumeId === "string" && VOLUME_ID_PATTERN.test(volumeId);
 }
@@ -41,4 +26,11 @@ export function assertValidVolumeId(volumeId) {
 export function newVolumeId(random = () => crypto.randomUUID()) {
     return `fs-${random().replace(/-/g, "").slice(0, 12)}`;
 }
+/** The key a session filesystem's workspace is bound by in the sandbox service: `sessionfs:<volumeId>`. */
+export const sessionKey = (volumeId) => `sessionfs:${volumeId}`;
+/** The volume id of the session filesystem `key` binds, where it binds one; else null. */
+export function volumeIdOfKey(key) {
+    const volumeId = key.startsWith("sessionfs:") ? key.slice("sessionfs:".length) : "";
+    return isValidVolumeId(volumeId) ? volumeId : null;
+}
 //# sourceMappingURL=names.js.map

package/dist/src/sandbox/names.js.map

@@ -1 +1 @@
-{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/sandbox/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,wBAAwB,aAAa,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAEjG,iEAAiE;AACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAEjG,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,aAAa,kEAAkE,CAAC,CAAC;IACrK,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,MAAM,GAAiB,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;IAC1E,OAAO,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/sandbox/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qHAAqH;AACrH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,wBAAwB,aAAa,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAEjG,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,aAAa,kEAAkE,CAAC,CAAC;IACrK,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,MAAM,GAAiB,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;IAC1E,OAAO,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,aAAa,QAAQ,EAAE,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC"}

package/dist/src/sandbox/otlp-resource.js

@@ -0,0 +1,173 @@
+const RESOURCE_LISTS = {
+    traces: ["resourceSpans", "scopeSpans"],
+    metrics: ["resourceMetrics", "scopeMetrics"],
+    logs: ["resourceLogs", "scopeLogs"],
+};
+/** Thrown for a request that does not parse as one, which is then not exported. */
+export class MalformedRequest extends Error {
+    name = "MalformedRequest";
+}
+function isStamped(key, stamp) {
+    return Object.hasOwn(stamp, key) || key.startsWith("alasio.");
+}
+// --- Binary protobuf ----------------------------------------------------------
+// The levels the resource is at, by field number, the same for all three signals:
+//   Export{Trace,Metrics,Logs}ServiceRequest  1: repeated Resource{Spans,Metrics,Logs}
+//   Resource{Spans,Metrics,Logs}               1: Resource
+//   Resource                                   1: repeated KeyValue attributes
+//   KeyValue                                   1: string key, 2: AnyValue value
+//   AnyValue                                   1: string string_value
+const VARINT = 0;
+const FIXED64 = 1;
+const LEN = 2;
+const FIXED32 = 5;
+function readVarint(buf, at) {
+    let value = 0;
+    for (let shift = 0; shift < 64; shift += 7) {
+        const byte = buf[at++];
+        if (byte === undefined)
+            throw new MalformedRequest("truncated varint");
+        value += (byte & 0x7f) * 2 ** shift;
+        if ((byte & 0x80) === 0)
+            return [value, at];
+    }
+    throw new MalformedRequest("overlong varint");
+}
+/** Each field of a message: its number, wire type, whole encoding, and value. */
+function* fields(buf) {
+    let at = 0;
+    while (at < buf.length) {
+        const start = at;
+        let tag;
+        [tag, at] = readVarint(buf, at);
+        const field = Math.floor(tag / 8);
+        const wire = tag % 8;
+        if (field === 0)
+            throw new MalformedRequest("field number 0");
+        let valueStart = at;
+        if (wire === VARINT)
+            [, at] = readVarint(buf, at);
+        else if (wire === FIXED64)
+            at += 8;
+        else if (wire === FIXED32)
+            at += 4;
+        else if (wire === LEN) {
+            let length;
+            [length, valueStart] = readVarint(buf, at);
+            at = valueStart + length;
+        }
+        else
+            throw new MalformedRequest(`wire type ${wire}`);
+        if (at > buf.length)
+            throw new MalformedRequest("truncated field");
+        yield { field, wire, whole: buf.subarray(start, at), value: buf.subarray(valueStart, at) };
+    }
+}
+/** A message field's value, which must be length-delimited. */
+function message({ field, wire, value }) {
+    if (wire !== LEN)
+        throw new MalformedRequest(`field ${field} has wire type ${wire}`);
+    return value;
+}
+function varint(value) {
+    const bytes = [];
+    for (; value >= 0x80; value = Math.floor(value / 128))
+        bytes.push((value % 128) | 0x80);
+    bytes.push(value);
+    return Buffer.from(bytes);
+}
+function lengthDelimited(field, bytes) {
+    return Buffer.concat([varint(field * 8 + LEN), varint(bytes.length), bytes]);
+}
+/** A KeyValue's key, the last given as protobuf merges them, or "" for none. */
+function keyOf(keyValue) {
+    let key = "";
+    for (const field of fields(keyValue)) {
+        if (field.field === 1)
+            key = message(field).toString("utf8");
+    }
+    return key;
+}
+function stampedAttributesProtobuf(stamp) {
+    return Object.entries(stamp).map(([key, value]) => lengthDelimited(1, Buffer.concat([
+        lengthDelimited(1, Buffer.from(key, "utf8")),
+        lengthDelimited(2, lengthDelimited(1, Buffer.from(value, "utf8"))),
+    ])));
+}
+/**
+ * A Resource{Spans,Metrics,Logs} with one Resource: every Resource it held merged as
+ * protobuf merges repeated occurrences, less the stamped attributes, plus the stamp.
+ */
+function stampResourcePart(part, stamp) {
+    const resource = [];
+    const rest = [];
+    for (const field of fields(part)) {
+        if (field.field !== 1) {
+            rest.push(field.whole);
+            continue;
+        }
+        for (const resourceField of fields(message(field))) {
+            if (resourceField.field === 1 && isStamped(keyOf(message(resourceField)), stamp))
+                continue;
+            resource.push(resourceField.whole);
+        }
+    }
+    return Buffer.concat([lengthDelimited(1, Buffer.concat([...resource, ...stampedAttributesProtobuf(stamp)])), ...rest]);
+}
+function stampProtobuf(body, stamp) {
+    return Buffer.concat([...fields(body)].map((field) => field.field === 1 ? lengthDelimited(1, stampResourcePart(message(field), stamp)) : field.whole));
+}
+// --- JSON ---------------------------------------------------------------------
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function list(value, what) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new MalformedRequest(`${what} is not a list`);
+    return value;
+}
+function object(value, what) {
+    if (value === undefined)
+        return {};
+    if (!isObject(value))
+        throw new MalformedRequest(`${what} is not an object`);
+    return value;
+}
+/** The fields of `source` named by `names` that it has. */
+function only(source, names) {
+    return Object.fromEntries(names.filter((name) => source[name] !== undefined).map((name) => [name, source[name]]));
+}
+function stampJson(signal, body, stamp) {
+    let request;
+    try {
+        request = JSON.parse(body.toString("utf8"));
+    }
+    catch (error) {
+        throw new MalformedRequest(error instanceof Error ? error.message : String(error));
+    }
+    const [partsName, scopesName] = RESOURCE_LISTS[signal];
+    const parts = list(object(request, "the request")[partsName], partsName).map((value) => {
+        const part = object(value, partsName);
+        const resource = object(part["resource"], "resource");
+        const attributes = list(resource["attributes"], "resource.attributes")
+            .filter((attribute) => !(isObject(attribute) && typeof attribute["key"] === "string" && isStamped(attribute["key"], stamp)));
+        return {
+            resource: {
+                ...only(resource, ["droppedAttributesCount", "entityRefs"]),
+                attributes: [...attributes, ...Object.entries(stamp).map(([key, value]) => ({ key, value: { stringValue: value } }))],
+            },
+            ...only(part, [scopesName, "schemaUrl"]),
+        };
+    });
+    return Buffer.from(JSON.stringify({ [partsName]: parts }), "utf8");
+}
+/**
+ * `body`, an OTLP export request for `signal` in `encoding` ("protobuf" or "json"),
+ * with its resources stamped. Throws MalformedRequest for one that does not parse.
+ */
+export function stampResources(signal, encoding, body, stamp) {
+    if (!Object.hasOwn(RESOURCE_LISTS, signal))
+        throw new Error(`unknown signal ${signal}`);
+    return encoding === "json" ? stampJson(signal, body, stamp) : stampProtobuf(body, stamp);
+}
+//# sourceMappingURL=otlp-resource.js.map

package/dist/src/sandbox/otlp-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otlp-resource.js","sourceRoot":"","sources":["../../../../src/sandbox/otlp-resource.ts"],"names":[],"mappings":"AAeA,MAAM,cAAc,GAAuE;IACzF,MAAM,EAAE,CAAC,eAAe,EAAE,YAAY,CAAC;IACvC,OAAO,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAC5C,IAAI,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC;CACpC,CAAC;AAEF,mFAAmF;AACnF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,GAAG,kBAAkB,CAAC;CACpC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,KAAoB;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,kFAAkF;AAClF,uFAAuF;AACvF,2DAA2D;AAC3D,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AAEtE,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,GAAG,GAAG,CAAC,CAAC;AACd,MAAM,OAAO,GAAG,CAAC,CAAC;AAWlB,SAAS,UAAU,CAAC,GAAW,EAAE,EAAU;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACvE,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAW;IAC1B,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,GAAW,CAAC;QAChB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,IAAI,KAAK,MAAM;YAAE,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;aAC7C,IAAI,IAAI,KAAK,OAAO;YAAE,EAAE,IAAI,CAAC,CAAC;aAC9B,IAAI,IAAI,KAAK,OAAO;YAAE,EAAE,IAAI,CAAC,CAAC;aAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,MAAc,CAAC;YACnB,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC;QAC3B,CAAC;;YAAM,MAAM,IAAI,gBAAgB,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,SAAS,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAS;IAC5C,IAAI,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,KAAK,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAChF,SAAS,KAAK,CAAC,QAAgB;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC;YAAE,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAoB;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAChD,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/B,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,eAAe,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;KACnE,CAAC,CAAC,CAAC,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAoB;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,aAAa,CAAC,KAAK,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAE,SAAS;YAC3F,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAoB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,iFAAiF;AAEjF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,SAAS,IAAI,CAAC,KAAc,EAAE,IAAY;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,SAAS,IAAI,CAAC,MAA+B,EAAE,KAAwB;IACrE,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,KAAoB;IACnE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;aACnE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/H,OAAO;YACL,QAAQ,EAAE;gBACR,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;gBAC3D,UAAU,EAAE,CAAC,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;aACtH;YACD,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,QAAsB,EAAE,IAAY,EAAE,KAAoB;IACvG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;IACxF,OAAO,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3F,CAAC"}

package/dist/src/sandbox/telemetry.js

@@ -0,0 +1,43 @@
+/**
+ * What bayma inside a session's sandbox exports its telemetry with, and what is stamped on
+ * it. A pool's pod's one way out without internet is the sandbox service's receiver
+ * (../receiver/receiver.ts), so its bayma exports there, with its binding's token, each signal
+ * the sandbox gateway exports, as the gateway tells the node agent attaching the workspace
+ * (../gateway/sessions.ts); the receiver stamps what arrives with what is known of the session
+ * and exports it where the stack's telemetry goes.
+ */
+import { parseKeyValueList, resolveTelemetry, sharedResourceAttributes, SIGNALS, telemetryEnabled } from "../telemetry/config.js";
+/**
+ * The standard variables bayma inside a sandbox exports with, but for the endpoint and the
+ * token it sends, which are the sandbox's own: each signal `env`, the gateway's, exports, in
+ * the protocol it exports it in, and no other. Empty where it exports nothing.
+ */
+export function sandboxBaymaTelemetryEnv(env = process.env) {
+    const telemetry = resolveTelemetry(env);
+    if (!telemetryEnabled(telemetry))
+        return {};
+    const settings = {};
+    for (const signal of SIGNALS) {
+        const upper = signal.toUpperCase();
+        const exporter = telemetry[signal];
+        settings[`OTEL_${upper}_EXPORTER`] = exporter ? "otlp" : "none";
+        if (exporter)
+            settings[`OTEL_EXPORTER_OTLP_${upper}_PROTOCOL`] = exporter.protocol;
+    }
+    return settings;
+}
+/** The resource attributes a session's telemetry is stamped with. */
+export function sandboxResource(volumeId, env = process.env) {
+    return { ...parseKeyValueList(sharedResourceAttributes(env)), "service.name": "bayma", "alasio.volume.id": volumeId };
+}
+/**
+ * What a folder conversation's instance's telemetry is stamped with: bayma's, of the
+ * conversation, as alasio's own of the conversation is, and the harness it is under.
+ */
+export const folderResource = (harness, conversation, env = process.env) => ({
+    ...parseKeyValueList(sharedResourceAttributes(env)),
+    "service.name": "bayma",
+    "alasio.conversation.id": conversation,
+    "alasio.harness": harness,
+});
+//# sourceMappingURL=telemetry.js.map

package/dist/src/sandbox/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../../../src/sandbox/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAGlI;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAG,GAAgC,OAAO,CAAC,GAAG;IACrF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,QAAQ,CAAC,QAAQ,KAAK,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,IAAI,QAAQ;YAAE,QAAQ,CAAC,sBAAsB,KAAK,WAAW,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACrF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,GAAG,GAAgC,OAAO,CAAC,GAAG;IAC9F,OAAO,EAAE,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;AACxH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,YAAoB,EAAE,GAAG,GAAgC,OAAO,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC;IACvI,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACnD,cAAc,EAAE,OAAO;IACvB,wBAAwB,EAAE,YAAY;IACtC,gBAAgB,EAAE,OAAO;CAC1B,CAAC,CAAC"}