hyperbrane 0.1.1 → 0.2.0

package/dist/dimension/paths.d.ts

@@ -1,9 +1,10 @@
+import type { DimensionLayout } from "./api.ts";
+export declare function containerName(dimensionName: string): string;
 export declare const WORKSPACE_PATH = "/workspace";
-/** Where the dimension's run directory (see Storage.ensureRunDirectory) is mounted. */
 export declare const RUN_PATH = "/run/hyperbrane";
-/** Where the dimension's state directory (see Storage.ensureStateDirectory) is mounted. */
 export declare const STATE_PATH = "/var/lib/hyperbrane";
-/** On the host, under hyperbrane's data directory: a dimension's run directory, mounted at RUN_PATH. */
+export declare const CA_BUNDLE_PATH = "/etc/ssl/certs/ca-certificates.crt";
+export declare const TRANSPORT_SOCKET = ".transport.sock";
 export declare function dimensionRunDirectory(dataDirectory: string, dimensionName: string): string;
-/** On the host, under hyperbrane's data directory: a dimension's state directory, mounted at STATE_PATH. */
 export declare function dimensionStateDirectory(dataDirectory: string, dimensionName: string): string;
+export declare const dimensionLayout: DimensionLayout;

package/dist/dimension/paths.js

@@ -1,15 +1,24 @@
-// Where things are inside every dimension, and on the host. Its own module so code running in a
-// dimension (the agent worker) can use them without the docker client service.ts brings along.
+export function containerName(dimensionName) {
+    return `hyb-${dimensionName}`;
+}
 export const WORKSPACE_PATH = "/workspace";
-/** Where the dimension's run directory (see Storage.ensureRunDirectory) is mounted. */
 export const RUN_PATH = "/run/hyperbrane";
-/** Where the dimension's state directory (see Storage.ensureStateDirectory) is mounted. */
 export const STATE_PATH = "/var/lib/hyperbrane";
-/** On the host, under hyperbrane's data directory: a dimension's run directory, mounted at RUN_PATH. */
+export const CA_BUNDLE_PATH = "/etc/ssl/certs/ca-certificates.crt";
+export const TRANSPORT_SOCKET = ".transport.sock";
 export function dimensionRunDirectory(dataDirectory, dimensionName) {
     return `${dataDirectory}/dimension-run/${dimensionName}`;
 }
-/** On the host, under hyperbrane's data directory: a dimension's state directory, mounted at STATE_PATH. */
 export function dimensionStateDirectory(dataDirectory, dimensionName) {
     return `${dataDirectory}/dimension-state/${dimensionName}`;
 }
+export const dimensionLayout = {
+    containerName,
+    workspacePath: () => WORKSPACE_PATH,
+    runPath: () => RUN_PATH,
+    statePath: () => STATE_PATH,
+    caBundlePath: () => CA_BUNDLE_PATH,
+    runDirectory: dimensionRunDirectory,
+    stateDirectory: dimensionStateDirectory,
+    transportSocketPath: (dataDirectory, dimensionName) => `${dimensionRunDirectory(dataDirectory, dimensionName)}/${TRANSPORT_SOCKET}`,
+};

package/dist/dimension/service.d.ts

@@ -1,23 +1,10 @@
-import { type DockerClient } from "../lib/docker.ts";
-import { type Sandbox } from "../sandbox/api.ts";
-import { type Dimension, type DimensionInfo, type DimensionLimits } from "./api.ts";
-import type { DimensionImage } from "./image.ts";
-import type { Storage } from "./storage.ts";
-import { RUN_PATH, STATE_PATH, WORKSPACE_PATH } from "./paths.ts";
-export { RUN_PATH, STATE_PATH, WORKSPACE_PATH };
+import type { Sandbox } from "../sandbox/api.ts";
+import { type DimensionClient } from "./api.ts";
+import { RUN_PATH, STATE_PATH, WORKSPACE_PATH, containerName } from "./paths.ts";
+export { RUN_PATH, STATE_PATH, WORKSPACE_PATH, containerName };
 /** @sealed */
-export interface DimensionService {
-    getDimensions(): Promise<DimensionInfo[]>;
-    /** The dimensions' names, from the records alone: none of getDimensions' container status and usage. */
-    getDimensionNames(): Promise<string[]>;
-    createDimension(dimension: Dimension): Promise<void>;
-    destroyDimension(dimensionName: string): Promise<void>;
-    restartDimension(dimensionName: string): Promise<void>;
-    updateDimension(dimensionName: string, limits: DimensionLimits): Promise<Dimension>;
+export interface DimensionService extends DimensionClient {
 }
-export declare function containerName(dimensionName: string): string;
-/**
- * `host` is the machine the docker daemon runs on, rooted at "/" so dimension directories
- * (bind-mount sources) resolve the same way docker resolves them.
- */
-export declare function createDimensionService(storage: Storage, docker: DockerClient, image: DimensionImage, host: Sandbox): DimensionService;
+export declare function createDimensionService(host: Sandbox, { dataDirectory }?: {
+    dataDirectory?: string;
+}): DimensionService;

package/dist/dimension/service.js

@@ -1,242 +1,78 @@
-import { isAbsolute, posix } from "node:path";
-import { DockerError } from "../lib/docker.js";
-import { SandboxNotFoundError } from "../sandbox/api.js";
-import { sleep } from "../lib/sleep.js";
-import { HYPERBRANE_VERSION } from "../lib/version.js";
-import { DimensionConflictError, DimensionInvalidError, DimensionNotFoundError, } from "./api.js";
-import { RUN_PATH, STATE_PATH, WORKSPACE_PATH } from "./paths.js";
-export { RUN_PATH, STATE_PATH, WORKSPACE_PATH };
-// Docker's container-name alphabet; also keeps names safe to use as storage file names.
-const NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,62}$/;
-export function containerName(dimensionName) {
-    return `hyb-${dimensionName}`;
-}
-/**
- * `host` is the machine the docker daemon runs on, rooted at "/" so dimension directories
- * (bind-mount sources) resolve the same way docker resolves them.
- */
-export function createDimensionService(storage, docker, image, host) {
-    async function getDimensions() {
-        return Promise.all((await storage.getDimensions()).map(describeDimension));
-    }
-    async function describeDimension({ state, ...dimension }) {
-        if (state === "creating")
-            return withoutUsage(dimension, "creating");
-        const container = await docker.inspectContainer(containerName(dimension.name));
-        if (!container)
-            return withoutUsage(dimension, "missing");
-        const containerState = container.State;
-        if (!containerState?.Running || !containerState.StartedAt) {
-            return withoutUsage(dimension, containerState?.Status ?? "exited");
-        }
-        try {
-            const stats = await docker.containerStats(containerName(dimension.name));
-            return {
-                ...dimension,
-                status: "running",
-                uptimeSeconds: Math.max(0, Math.floor((Date.now() - Date.parse(containerState.StartedAt)) / 1000)),
-                memoryUsage: stats.memoryUsage,
-                cpuUsage: stats.cpuUsage,
-            };
-        }
-        catch (error) {
-            if (error instanceof DockerError && error.status === 404)
-                return withoutUsage(dimension, "missing");
-            throw error;
-        }
-    }
-    // Keeps no state between calls: every step re-reads storage or docker and uses operations that are
-    // atomic across processes, so a create that crashed halfway, or runs twice at once, converges.
-    // A relative directory ("work", "~/work") is the host user's: resolved against their home, and
-    // recorded resolved. A missing one is made.
-    async function createDimension(requested) {
-        assertValidName(requested.name);
-        const dimension = { ...requested, directory: await resolveDirectory(requested.directory) };
-        const owner = await directoryOwner(dimension.directory);
-        const existing = await docker.inspectContainer(containerName(dimension.name));
-        if (existing)
-            assertOwnedContainer(existing, dimension.name);
-        const record = await storage.insertDimension({ ...dimension, state: "creating" });
-        assertSameSpec(record, dimension);
-        const imageTag = await image.ensure();
-        const runDirectory = await storage.ensureRunDirectory(dimension.name);
-        const stateDirectory = await storage.ensureStateDirectory(dimension.name);
-        await ensureContainer(dimension, owner, imageTag, runDirectory, stateDirectory);
-        await docker.startContainer(containerName(dimension.name));
-        await ensureUser(dimension, owner);
-        if (record.state !== "ready")
-            await storage.saveDimension({ ...dimension, state: "ready" });
-    }
-    async function ensureContainer(dimension, owner, imageTag, runDirectory, stateDirectory) {
-        const name = containerName(dimension.name);
-        const existing = await docker.inspectContainer(name);
-        if (existing)
-            return assertOwnedContainer(existing, dimension.name);
-        try {
-            await docker.createContainer(name, {
-                Image: imageTag,
-                Cmd: ["sleep", "infinity"],
-                Hostname: name,
-                User: `${owner.uid}:${owner.gid}`,
-                WorkingDir: WORKSPACE_PATH,
-                Labels: {
-                    hyperbrane: "true",
-                    "hyperbrane.version": HYPERBRANE_VERSION,
-                    "hyperbrane.dimension": dimension.name,
-                },
-                HostConfig: {
-                    Binds: [`${dimension.directory}:${WORKSPACE_PATH}`, `${runDirectory}:${RUN_PATH}`, `${stateDirectory}:${STATE_PATH}`],
-                    // dmesg: docker drops CAP_SYSLOG, and its seccomp profile refuses the syslog call without it.
-                    // The log is the host's kernel log, shared by every dimension.
-                    CapAdd: ["SYSLOG"],
-                    ...containerResources(dimension),
-                    NetworkMode: "none",
-                    // Without a network docker doesn't map the hostname, and sudo warns on every call.
-                    ExtraHosts: [`${name}:127.0.1.1`],
-                    Init: true,
-                    RestartPolicy: { Name: "unless-stopped" },
-                },
-            });
-        }
-        catch (error) {
-            // Lost a race with another creator: fine as long as the winner is ours.
-            if (!(error instanceof DockerError && error.status === 409))
-                throw error;
-            assertOwnedContainer(await awaitContainer(name, error), dimension.name);
-        }
-    }
-    // Docker reserves the name before the winner's container becomes inspectable, so give it a moment.
-    async function awaitContainer(name, conflict) {
-        for (let attempt = 0; attempt < 50; attempt++) {
-            const container = await docker.inspectContainer(name);
-            if (container)
-                return container;
-            await sleep(100);
-        }
-        throw conflict;
+import { DimensionInvalidError, isDimensionName } from "./api.js";
+import { createDimensionScript, destroyDimensionScript, dimensionUsageScript, listDimensionsScript, restartDimensionScript, startTransportScript, updateDimensionScript, } from "./control.js";
+import { createDimensionImage } from "./image.js";
+import { RUN_PATH, STATE_PATH, WORKSPACE_PATH, containerName, dimensionLayout } from "./paths.js";
+import { transportFiles } from "./transportClient.js";
+import { createDockerClient } from "../lib/docker.js";
+import { createPortalClient } from "../portal-gateway/portalClient.js";
+export { RUN_PATH, STATE_PATH, WORKSPACE_PATH, containerName };
+export function createDimensionService(host, { dataDirectory } = {}) {
+    const options = { dataDirectory };
+    const image = createDimensionImage(createDockerClient(host));
+    const portals = createPortalClient(host, { dataDirectory });
+    async function listDimensions() {
+        return (await listDimensionsScript(host, options)).map(({ record: { state: _state, ...dimension }, status, startedAt }) => ({
+            ...dimension,
+            status,
+            uptimeSeconds: startedAt ? Math.max(0, Math.floor((Date.now() - Date.parse(startedAt)) / 1000)) : null,
+        }));
     }
-    async function ensureUser(dimension, owner) {
-        const result = await docker.exec(containerName(dimension.name), {
-            cmd: ["hyb-ensure-user"],
-            user: "root",
-            env: { HYB_UID: String(owner.uid), HYB_GID: String(owner.gid) },
-        });
-        if (result.exitCode !== 0) {
-            throw new Error(`user setup in ${containerName(dimension.name)} failed: ${result.stderr.trim()}`);
-        }
+    async function createDimension(dimension) {
+        assertValidName(dimension.name);
+        if (!dimension.directory?.trim())
+            throw new DimensionInvalidError("directory is required");
+        if (/[\x00-\x1f]/.test(dimension.directory))
+            throw new DimensionInvalidError("directory has a control character");
+        assertLimits({ memoryLimit: dimension.memoryLimit, cpuLimit: dimension.cpuLimit });
+        const record = (await createDimensionScript(host, dimension, options)) || (await image.ensure(), await createDimensionScript(host, dimension, options));
+        if (!record)
+            throw new Error(`the dimension image is missing after it was built`);
+        await startTransportScript(host, dimension.name, options, { restart: false });
+        const { state: _state, ...created } = record;
+        return created;
     }
-    // Container first: if this crashes before the record is removed, the dimension still shows up
-    // (as "missing") and the destroy can be retried. Its run and state directories go with the record,
-    // emptied from inside first: what a dimension running as root left there (an agent worker's socket
-    // and log) the host user couldn't remove.
     async function destroyDimension(dimensionName) {
         assertValidName(dimensionName);
-        const name = containerName(dimensionName);
-        const existing = await docker.inspectContainer(name);
-        if (existing) {
-            assertOwnedContainer(existing, dimensionName);
-            if (!existing.State?.Running)
-                await docker.startContainer(name).catch(() => { });
-            // Best effort: if it fails, removing them from the host below says why.
-            await docker
-                .exec(name, { cmd: ["sh", "-c", 'find "$R" "$S" -mindepth 1 -delete'], user: "root", env: { R: RUN_PATH, S: STATE_PATH } })
-                .catch(() => { });
-            await docker.removeContainer(name);
-        }
-        await storage.removeRunDirectory(dimensionName);
-        await storage.removeStateDirectory(dimensionName);
-        await storage.removeDimension(dimensionName);
+        await destroyDimensionScript(host, dimensionName, options);
     }
-    // Same container, so the user and anything installed outside the workspace survive; the workspace
-    // is a bind mount either way.
     async function restartDimension(dimensionName) {
         assertValidName(dimensionName);
-        if (!(await storage.getDimensions()).some((dimension) => dimension.name === dimensionName)) {
-            throw new DimensionNotFoundError(`dimension ${dimensionName} does not exist`);
-        }
-        const existing = await docker.inspectContainer(containerName(dimensionName));
-        if (!existing)
-            throw new DimensionNotFoundError(`dimension ${dimensionName} has no container; create it again`);
-        assertOwnedContainer(existing, dimensionName);
-        await docker.restartContainer(containerName(dimensionName));
+        await restartDimensionScript(host, dimensionName, options);
+        await portals.restorePortals({ dimensionName });
+        await startTransportScript(host, dimensionName, options, { restart: true });
     }
-    // Container first: a limit docker refuses leaves the record as it was.
+    async function transportSocket(dimensionName) {
+        assertValidName(dimensionName);
+        const data = dataDirectory ?? `${await host.homeDirectory()}/.local/share/hyperbrane`;
+        return dimensionLayout.transportSocketPath(data, dimensionName);
+    }
+    const files = transportFiles(async (dimensionName) => host.connect(await transportSocket(dimensionName)));
     async function updateDimension(dimensionName, limits) {
         assertValidName(dimensionName);
-        for (const [name, value] of Object.entries(limits)) {
-            if (value !== undefined && !(typeof value === "number" && value > 0))
-                throw new DimensionInvalidError(`${name} must be positive`);
-        }
-        const record = (await storage.getDimensions()).find((dimension) => dimension.name === dimensionName);
-        if (!record)
-            throw new DimensionNotFoundError(`dimension ${dimensionName} does not exist`);
-        const existing = await docker.inspectContainer(containerName(dimensionName));
-        if (!existing)
-            throw new DimensionNotFoundError(`dimension ${dimensionName} has no container; create it again`);
-        assertOwnedContainer(existing, dimensionName);
-        const { state, ...current } = record;
-        const updated = {
-            ...current,
-            memoryLimit: limits.memoryLimit ?? record.memoryLimit,
-            cpuLimit: limits.cpuLimit ?? record.cpuLimit,
-        };
-        await docker.updateContainer(containerName(dimensionName), containerResources(updated));
-        await storage.saveDimension({ ...updated, state });
+        assertLimits(limits);
+        const { state: _state, ...updated } = await updateDimensionScript(host, dimensionName, limits, options);
         return updated;
     }
-    async function resolveDirectory(directory) {
-        if (!directory.trim())
-            throw new DimensionInvalidError("directory is required");
-        if (isAbsolute(directory))
-            return directory;
-        const relative = directory === "~" ? "." : directory.replace(/^~\//, "");
-        return posix.join(await host.homeDirectory(), relative);
-    }
-    async function directoryOwner(directory) {
-        if (!isAbsolute(directory))
-            throw new DimensionInvalidError(`directory must be absolute: ${directory}`);
-        // A missing one is made, by the host user: theirs, so the dimension runs as them.
-        const info = await host.stat(directory).catch(async (error) => {
-            if (!(error instanceof SandboxNotFoundError))
-                throw error;
-            await host.createDirectory(directory).catch((cause) => {
-                throw new DimensionInvalidError(`directory ${directory} doesn't exist and can't be made: ${cause.message}`);
-            });
-            return host.stat(directory);
-        });
-        if (info.type !== "directory")
-            throw new DimensionInvalidError(`not a directory: ${directory}`);
-        return { uid: info.uid, gid: info.gid };
-    }
-    async function getDimensionNames() {
-        return (await storage.getDimensions()).map((dimension) => dimension.name);
+    return {
+        listDimensions,
+        getDimensionUsage: () => dimensionUsageScript(host, options),
+        readFile: files.readFile,
+        writeFile: files.writeFile,
+        statFile: files.statFile,
+        createDimension: (dimension) => createDimension(dimension),
+        destroyDimension: (dimensionName) => destroyDimension(dimensionName),
+        restartDimension: (dimensionName) => restartDimension(dimensionName),
+        updateDimension: (dimensionName, limits) => updateDimension(dimensionName, limits),
+    };
+}
+function assertLimits(limits) {
+    for (const [name, value] of Object.entries(limits)) {
+        if (value !== undefined && !(typeof value === "number" && value > 0))
+            throw new DimensionInvalidError(`${name} must be positive`);
     }
-    return { getDimensions, getDimensionNames, createDimension, destroyDimension, restartDimension, updateDimension };
 }
 function assertValidName(dimensionName) {
-    if (!NAME_PATTERN.test(dimensionName)) {
+    if (!isDimensionName(dimensionName)) {
         throw new DimensionInvalidError(`invalid dimension name "${dimensionName}": use letters, digits, "_", "." or "-", starting with a letter or digit`);
     }
 }
-function assertSameSpec(existing, requested) {
-    const differs = existing.directory !== requested.directory ||
-        existing.memoryLimit !== requested.memoryLimit ||
-        existing.cpuLimit !== requested.cpuLimit ||
-        [...(existing.portals ?? [])].sort().join("\0") !== [...(requested.portals ?? [])].sort().join("\0");
-    if (differs) {
-        throw new DimensionConflictError(`dimension ${requested.name} already exists with a different spec`);
-    }
-}
-function assertOwnedContainer(container, dimensionName) {
-    if (container.Config?.Labels?.["hyperbrane.dimension"] !== dimensionName) {
-        throw new DimensionConflictError(`container ${containerName(dimensionName)} exists but is not managed by hyperbrane`);
-    }
-}
-// Swap stays at twice the memory, which is what docker gives a container created with only a
-// memory limit; setting both keeps an update valid whichever way the limit moves.
-function containerResources({ memoryLimit, cpuLimit }) {
-    return { Memory: memoryLimit, MemorySwap: memoryLimit * 2, NanoCpus: Math.round(cpuLimit * 1e9) };
-}
-function withoutUsage(dimension, status) {
-    return { ...dimension, status, uptimeSeconds: null, memoryUsage: null, cpuUsage: null };
-}

package/dist/dimension/transport-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dimension/transport-worker.js

@@ -0,0 +1,151 @@
+import { constants } from "node:fs";
+import { chown, mkdir, open, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import { basename, dirname, join, resolve } from "node:path";
+import { UnpackrStream } from "msgpackr";
+import { TRANSPORT_CHUNK, TRANSPORT_MSGPACK, transportPackr } from "./transportProtocol.js";
+class TransportFailure extends Error {
+    name;
+    constructor(name, message) {
+        super(message);
+        this.name = name;
+    }
+}
+function required(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`${name} is not set`);
+    return value;
+}
+async function existingAncestor(path) {
+    for (let current = path;; current = dirname(current)) {
+        try {
+            return await realpath(current);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT" || current === "/")
+                throw error;
+        }
+    }
+}
+function assertInside(real, path) {
+    if (real !== workspace && !real.startsWith(`${workspace}/`))
+        throw new TransportFailure("DimensionInvalidError", `"${path}" is outside the workspace`);
+}
+async function workspacePath(path) {
+    const full = resolve(workspace, path.replace(/^\/+/, ""));
+    assertInside(await existingAncestor(full), path);
+    return full;
+}
+function checkUpload(upload) {
+    if (!/^[A-Za-z0-9-]{1,64}$/.test(upload))
+        throw new TransportFailure("DimensionInvalidError", "the upload id must be 1-64 letters, digits or dashes");
+}
+async function stagingPath(path, upload) {
+    checkUpload(upload);
+    const target = await workspacePath(path);
+    return join(dirname(target), `.${basename(target)}.${upload}.upload`);
+}
+function notFound(path) {
+    return (error) => {
+        if (error.code === "ENOENT")
+            throw new TransportFailure("DimensionNotFoundError", `no file "${path}" in the workspace`);
+        throw error;
+    };
+}
+async function handle(request, send) {
+    switch (request.op) {
+        case "stat": {
+            const info = await stat(await workspacePath(request.path)).catch(notFound(request.path));
+            const type = info.isFile() ? "file" : info.isDirectory() ? "directory" : "other";
+            return send({ id: request.id, info: { type, size: info.size } });
+        }
+        case "read": {
+            const file = await open(await workspacePath(request.path), "r").catch(notFound(request.path));
+            try {
+                const offset = request.offset ?? 0;
+                const end = request.length === undefined ? (await file.stat()).size : offset + request.length;
+                for (let position = offset; position < end;) {
+                    const buffer = new Uint8Array(Math.min(TRANSPORT_CHUNK, end - position));
+                    const { bytesRead } = await file.read(buffer, 0, buffer.length, position);
+                    if (bytesRead === 0)
+                        break;
+                    await send({ id: request.id, data: buffer.subarray(0, bytesRead) });
+                    position += bytesRead;
+                }
+            }
+            finally {
+                await file.close();
+            }
+            return send({ id: request.id, done: true });
+        }
+        case "staged": {
+            const staged = await stat(await stagingPath(request.path, request.upload)).catch(() => null);
+            return send({ id: request.id, size: staged?.size ?? 0 });
+        }
+        case "write": {
+            const staging = await stagingPath(request.path, request.upload);
+            await mkdir(dirname(staging), { recursive: true });
+            assertInside(await realpath(dirname(staging)), request.path);
+            const file = await open(staging, constants.O_CREAT | constants.O_WRONLY, 0o666);
+            try {
+                await file.write(request.data, 0, request.data.length, request.offset);
+            }
+            finally {
+                await file.close();
+            }
+            return send({ id: request.id });
+        }
+        case "commit": {
+            const staging = await stagingPath(request.path, request.upload);
+            const staged = await stat(staging).catch(notFound(request.path));
+            if (staged.size < request.size)
+                throw new TransportFailure("DimensionInvalidError", `the upload of "${request.path}" has ${staged.size} of ${request.size} bytes`);
+            const file = await open(staging, "r+");
+            try {
+                await file.truncate(request.size);
+            }
+            finally {
+                await file.close();
+            }
+            await rename(staging, await workspacePath(request.path));
+            return send({ id: request.id });
+        }
+    }
+}
+function serve(socket) {
+    const send = (reply) => new Promise((done) => {
+        if (socket.destroyed || socket.write(transportPackr.pack(reply)))
+            return done();
+        socket.once("drain", done);
+        socket.once("close", done);
+    });
+    const decoder = new UnpackrStream(TRANSPORT_MSGPACK);
+    decoder.on("data", (request) => {
+        handle(request, send).catch((error) => {
+            const { name, message } = error instanceof Error ? error : new Error(String(error));
+            return send({ id: request.id, error: { name, message } });
+        });
+    });
+    decoder.on("error", () => socket.destroy());
+    socket.on("error", () => socket.destroy());
+    socket.pipe(decoder);
+}
+const workspace = await realpath(required("HYB_WORKSPACE"));
+const socketPath = required("HYB_TRANSPORT_SOCKET");
+const build = required("HYB_TRANSPORT_BUILD");
+const owner = process.env.HYB_SOCKET_OWNER;
+await rm(socketPath, { force: true });
+const server = createServer(serve);
+await new Promise((done) => server.listen(socketPath, done));
+if (owner) {
+    const [uid, gid] = owner.split(":").map(Number);
+    await chown(socketPath, uid, gid);
+}
+for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.once(signal, () => {
+        server.close();
+        process.exit(0);
+    });
+}
+await writeFile(required("HYB_TRANSPORT_READY"), `${process.pid} ${build}\n`);

package/dist/dimension/transportBundle.d.ts

@@ -0,0 +1,2 @@
+export declare const dimensionTransportEntry: () => string;
+export declare const dimensionTransportBundle: () => Promise<import("../lib/scriptBundle.ts").ScriptBundle>;

package/dist/dimension/transportBundle.generated.d.ts

@@ -0,0 +1 @@
+export declare const DIMENSION_TRANSPORT_SOURCE: string;