gigadrive 2.8.1 → 2.10.0

package/dist/index.mjs

@@ -9,7 +9,7 @@ import { Effect as Effect29, Layer, LogLevel, Logger } from "effect";
 // package.json
 var package_default = {
   name: "gigadrive",
-  version: "2.8.1",
+  version: "2.10.0",
   repository: {
     type: "git",
     url: "https://github.com/Gigadrive/sdk.git",
@@ -3062,7 +3062,8 @@ var describeMicroVm = (vm, now = Date.now()) => {
     `Image:       ${vm.image.name}`,
     `Size:        ${vm.vcpus} vCPU, ${formatMemory(vm.memoryMb)} memory, ${formatMemory(vm.diskMb)} disk`,
     `Region:      ${vm.region}`,
-    `Network:     ${vm.network.egress === "deny" ? "outbound traffic blocked" : "internet access"}`,
+    `Network:     ${vm.network.egress === "deny" ? "outbound traffic blocked" : vm.network.allow && vm.network.allow.length > 0 ? `only ${vm.network.allow.join(", ")} (and DNS)` : "internet access"}`,
+    `Previews:    ${vm.network.previews === "private" ? "private (preview token required)" : "public"}`,
     `Application: ${vm.applicationId}`,
     `Created:     ${vm.createdAt}`
   ];
@@ -3329,6 +3330,20 @@ var createInput = (flags) => Effect22.gen(function* () {
     onNone: () => Effect22.succeed(void 0),
     onSome: (text) => parseLifetime("--timeout", text)
   });
+  if (flags.denyEgress && flags.allowEgress.length > 0) {
+    return yield* new InvalidMicroVmOptionsError({
+      message: "--allow-egress cannot be combined with --deny-egress."
+    });
+  }
+  if (flags.allowEgress.length > 32) {
+    return yield* new InvalidMicroVmOptionsError({ message: "--allow-egress takes at most 32 networks." });
+  }
+  const badNetwork = flags.allowEgress.find((network) => !/^\d{1,3}(\.\d{1,3}){3}\/\d{1,2}$/.test(network.trim()));
+  if (badNetwork !== void 0) {
+    return yield* new InvalidMicroVmOptionsError({
+      message: `--allow-egress must be an IPv4 network such as 140.82.112.0/20 (got ${badNetwork}).`
+    });
+  }
   const badPort = flags.ports.find((port) => !Number.isInteger(port) || port < 1 || port > 65535);
   if (badPort !== void 0) {
     return yield* new InvalidMicroVmOptionsError({ message: `--port must be between 1 and 65535 (got ${badPort}).` });
@@ -3347,7 +3362,13 @@ var createInput = (flags) => Effect22.gen(function* () {
     ...flags.ports.length > 0 ? { ports: [...flags.ports] } : {},
     ...env ? { env } : {},
     ...metadata ? { metadata } : {},
-    ...flags.denyEgress ? { network: { egress: "deny" } } : {},
+    ...flags.denyEgress || flags.privatePreviews || flags.allowEgress.length > 0 ? {
+      network: {
+        egress: flags.denyEgress ? "deny" : "allow",
+        ...flags.privatePreviews ? { previews: "private" } : {},
+        ...flags.allowEgress.length > 0 ? { allow: [...flags.allowEgress] } : {}
+      }
+    } : {},
     ...Option14.match(flags.region, { onNone: () => ({}), onSome: (region) => ({ region }) })
   };
   return input;
@@ -3362,6 +3383,13 @@ var createMicroVm = (flags) => Effect22.gen(function* () {
     return vm;
   }
   for (const line of describeMicroVm(vm)) yield* Console12.log(line);
+  if (vm.previewToken) {
+    yield* Console12.log(`
+Preview token: ${vm.previewToken}`);
+    yield* Console12.log(
+      "Shown only now. Send it in the x-gigadrive-preview-token header, or open a preview URL once with ?gd_preview_token=<token>."
+    );
+  }
   yield* Console12.log(`
 Run a command: gigadrive microvms exec ${vm.id} -- <command>`);
   yield* Console12.log(`Open a shell:  gigadrive microvms shell ${vm.id}`);
@@ -3391,7 +3419,7 @@ var createCommand = Command12.make(
     ),
     ports: Options7.integer("port").pipe(
       Options7.withAlias("p"),
-      Options7.withDescription("Port to expose on a public preview URL (repeatable, up to 8)"),
+      Options7.withDescription("Port to expose on a preview URL (repeatable, up to 8)"),
       Options7.repeated
     ),
     env: envOption,
@@ -3401,6 +3429,15 @@ var createCommand = Command12.make(
       Options7.repeated
     ),
     denyEgress: Options7.boolean("deny-egress").pipe(Options7.withDescription("Block all outbound network traffic")),
+    privatePreviews: Options7.boolean("private-previews").pipe(
+      Options7.withDescription("Answer preview URLs only to requests that carry the preview token printed at create")
+    ),
+    allowEgress: Options7.text("allow-egress").pipe(
+      Options7.withDescription(
+        "Only reach this public IPv4 network, such as 140.82.112.0/20, besides DNS (repeatable, up to 32)"
+      ),
+      Options7.repeated
+    ),
     region: Options7.text("region").pipe(Options7.withDescription("Region to place the microVM in"), Options7.optional),
     json: jsonOption2
   },