@agentcomms/events-daemon 0.23.0 → 0.25.0

package/dist/worker-boundary-probe-CFN6EsyK.mjs

@@ -0,0 +1,850 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, mkdtemp, realpath, rm } from "node:fs/promises";
+import { Server, Socket, connect, createServer } from "node:net";
+import { join, sep } from "node:path";
+import { spawn } from "node:child_process";
+import { Socket as Socket$1, createSocket } from "node:dgram";
+//#region src/network/error-sink.ts
+/**
+* Keeps an owned network resource from turning a later transport error into an uncaught exception.
+* Operation-specific listeners still translate errors into their own result while they are active.
+*/
+function installErrorSink(resource) {
+	resource.on("error", () => void 0);
+	return resource;
+}
+//#endregion
+//#region src/runtime/laya/templates.ts
+/**
+* Laya's two immutable prompt templates (E2-2, D11). The reviewed manifest lists which of them a release offers; their
+* content lives here, in the daemon's worker source, so a semantic change is a new id and a new manifest entry, never
+* an edit. Each has a stable SHA-256 over its canonical content, which the D11 gate subject binds.
+*
+* This module is loaded inside the isolated worker as well as by the daemon: it imports Node built-ins only.
+*/
+const LAYA_NOUL_TEMPLATE_ID = "laya-noul-v1";
+const LAYA_CHOICE2_TEMPLATE_ID = "laya-choice2-v1";
+/**
+* `laya-noul-v1` asks one `noul` question; the runtime renders a `noul` question's two options itself, as
+* `false: no, the statement does not hold` and `true: yes, the statement holds`, and its answer is P(true).
+* `laya-choice2-v1` asks the same question as a two-option `choice` with neutral keys, the model card's workaround for
+* issue #156, and its value is the probability of the affirmative key.
+*/
+const TEMPLATES = Object.freeze({
+	[LAYA_CHOICE2_TEMPLATE_ID]: Object.freeze({
+		id: LAYA_CHOICE2_TEMPLATE_ID,
+		type: "choice",
+		options: Object.freeze([Object.freeze({
+			label: "a",
+			text: "yes, the statement holds"
+		}), Object.freeze({
+			label: "b",
+			text: "no, the statement does not hold"
+		})]),
+		affirmative: "a"
+	}),
+	[LAYA_NOUL_TEMPLATE_ID]: Object.freeze({
+		id: LAYA_NOUL_TEMPLATE_ID,
+		type: "noul",
+		options: Object.freeze([Object.freeze({
+			label: "false",
+			text: "no, the statement does not hold"
+		}), Object.freeze({
+			label: "true",
+			text: "yes, the statement holds"
+		})]),
+		affirmative: "true"
+	})
+});
+/** Every template id this worker source implements, in raw UTF-8 byte order (the manifest's order). */
+const LAYA_TEMPLATE_IDS = Object.freeze(Object.keys(TEMPLATES).sort((left, right) => Buffer.compare(Buffer.from(left, "utf8"), Buffer.from(right, "utf8"))));
+/**
+* The templates this release runs: those that ask a `noul` question. The worker refuses any other as
+* `template-blocked` before the runtime is asked, so `laya-choice2-v1` stays out until a Laya source record states where
+* a choice's probability comes from (E2 Task 8); B3 control v3 refuses a judge naming it when it is created.
+*/
+const LAYA_RUNNABLE_TEMPLATE_IDS = Object.freeze(LAYA_TEMPLATE_IDS.filter((id) => TEMPLATES[id].type === "noul"));
+function isLayaTemplateId(value) {
+	return typeof value === "string" && Object.hasOwn(TEMPLATES, value);
+}
+function layaTemplate(id) {
+	const template = TEMPLATES[id];
+	if (template === void 0) throw new Error("the Laya prompt template is not one this worker implements");
+	return template;
+}
+/** The runtime replaces every literal `[MASK]` with a space before it encodes (npm-receptron-laya-0.1.2-render). */
+function unmasked(text) {
+	return text.replaceAll("[MASK]", " ");
+}
+/**
+* The complete, uncut text segments the runtime encodes for one request, as it lays them out: the head
+* `<type> question: <instructions>`, each option as `" " + "<label>: <text>"`, then the state as given. The worker
+* counts these with the bundle's own tokenizer before it runs anything, so the runtime never gets to cut one.
+*/
+function layaLayout(id, input) {
+	const template = layaTemplate(id);
+	return {
+		head: `${template.type} question: ${unmasked(input.instructions)}`,
+		options: template.options.map((option) => ` ${unmasked(`${option.label}: ${option.text}`)}`),
+		state: unmasked(input.state)
+	};
+}
+//#endregion
+//#region src/runtime/laya/worker-protocol.ts
+const WORKER_FRAME_MAX_BYTES = 65536;
+const FRAME_PREFIX_BYTES = 4;
+var LayaWorkerProtocolError = class extends Error {
+	code;
+	constructor(code) {
+		super(code);
+		this.name = "LayaWorkerProtocolError";
+		this.code = code;
+	}
+};
+function frameObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new LayaWorkerProtocolError("FRAME_SHAPE");
+	return value;
+}
+function jsonFrame(value) {
+	let encoded;
+	try {
+		encoded = JSON.stringify(frameObject(value));
+	} catch {
+		throw new LayaWorkerProtocolError("FRAME_JSON");
+	}
+	if (encoded === void 0) throw new LayaWorkerProtocolError("FRAME_JSON");
+	const payload = Buffer.from(encoded, "utf8");
+	if (payload.length === 0 || payload.length > 65536) throw new LayaWorkerProtocolError("FRAME_SIZE");
+	return payload;
+}
+/** Encodes one exact big-endian length-prefixed JSON object. */
+function encodeWorkerFrame(value) {
+	const payload = jsonFrame(value);
+	const frame = Buffer.allocUnsafe(FRAME_PREFIX_BYTES + payload.length);
+	frame.writeUInt32BE(payload.length, 0);
+	payload.copy(frame, FRAME_PREFIX_BYTES);
+	return frame;
+}
+/** Incrementally parses pipes without allocating for an attacker-controlled advertised frame size. */
+var WorkerFrameParser = class {
+	#buffer = Buffer.alloc(0);
+	push(chunk) {
+		if (chunk.length === 0) return [];
+		this.#buffer = Buffer.concat([this.#buffer, Buffer.from(chunk)]);
+		const frames = [];
+		while (this.#buffer.length >= FRAME_PREFIX_BYTES) {
+			const length = this.#buffer.readUInt32BE(0);
+			if (length === 0 || length > 65536) throw new LayaWorkerProtocolError("FRAME_SIZE");
+			const end = FRAME_PREFIX_BYTES + length;
+			if (this.#buffer.length < end) break;
+			const payload = this.#buffer.subarray(FRAME_PREFIX_BYTES, end);
+			this.#buffer = this.#buffer.subarray(end);
+			let parsed;
+			try {
+				parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payload));
+			} catch {
+				throw new LayaWorkerProtocolError("FRAME_JSON");
+			}
+			frames.push(frameObject(parsed));
+		}
+		return frames;
+	}
+	finish() {
+		if (this.#buffer.length !== 0) throw new LayaWorkerProtocolError("FRAME_TRUNCATED");
+	}
+};
+function createWorkerRequestId() {
+	return randomUUID();
+}
+function createWorkerProbeId() {
+	return randomUUID();
+}
+/** Writes one complete bounded frame and honours pipe backpressure. */
+async function writeWorkerFrame(destination, frame) {
+	if (destination.write(encodeWorkerFrame(frame))) return;
+	await new Promise((resolve, reject) => {
+		const drained = () => {
+			destination.off("error", failed);
+			resolve();
+		};
+		const failed = (error) => {
+			destination.off("drain", drained);
+			reject(error);
+		};
+		destination.once("drain", drained);
+		destination.once("error", failed);
+	});
+}
+//#endregion
+//#region src/runtime/laya/worker-boundary-probe.ts
+const LAYA_SANDBOX_EXECUTABLE = "/usr/bin/sandbox-exec";
+const LAYA_SANDBOX_PROFILE = "(version 1) (allow default) (deny network*)";
+/** The profile parameter naming the one directory the worker may write in: its own, resolved as the kernel sees it. */
+const LAYA_WORKER_DIRECTORY_PARAMETER = "LAYA_WORKER_DIRECTORY";
+/**
+* What the worker runs under. The binding still names `LAYA_SANDBOX_PROFILE`, the reviewed profile's identity that the
+* worker checks and Task 7's frozen vectors pin; the launch adds the confinement to it, and the launch test pins both.
+*/
+const LAYA_WORKER_SANDBOX_PROFILE = `${LAYA_SANDBOX_PROFILE} ${`(deny process-fork) (deny appleevent-send) (deny mach-lookup) (deny file-write*) (allow file-write* (subpath (param "${LAYA_WORKER_DIRECTORY_PARAMETER}")) (literal "/dev/null"))`}`;
+const BOUNDARY_PROBE_TIMEOUT_MS = 5e3;
+const BOUNDARY_SETTLE_MS = 150;
+const PROBE_SOCKET_RELEASE_MS = 1e3;
+const UNSPAWNED_RELEASE_MS = 1e3;
+const DENIED_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES"]);
+/** macOS keeps 104 bytes for a socket path, its terminating NUL included (B1-G's control socket has the same bound). */
+const UNIX_SOCKET_PATH_LIMIT_BYTES = 103;
+/** The daemon resolves its reviewed worker from its own shipped package, never from a caller-supplied path. */
+const LAYA_WORKER_ENTRY = join(import.meta.dirname, import.meta.dirname.endsWith(`${sep}dist`) ? "laya-worker.mjs" : "worker-main.ts");
+/** The child receives no inherited credential, proxy, Node option or descriptor beyond these three pipes. */
+const LAYA_WORKER_ENV = Object.freeze({
+	PATH: "/usr/bin:/bin",
+	TZ: "UTC"
+});
+/** The worker's five attempts, in the order it makes and reports them: four connections, then a process start. */
+const PROBE_ATTEMPTS = [
+	"tcp",
+	"fetch",
+	"udp",
+	"uds",
+	"spawn"
+];
+function listen(server, address, host) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => {
+			server.off("listening", onListening);
+			reject(error);
+		};
+		const onListening = () => {
+			server.off("error", onError);
+			resolve();
+		};
+		server.once("error", onError);
+		server.once("listening", onListening);
+		if (host === void 0) server.listen(address);
+		else if (typeof address === "number") server.listen({
+			port: address,
+			host
+		});
+		else reject(/* @__PURE__ */ new Error("boundary listener address"));
+	});
+}
+function closeServer(server) {
+	return new Promise((resolve, reject) => server.close((error) => {
+		if (error === void 0 || error.code === "ERR_SERVER_NOT_RUNNING") resolve();
+		else reject(error);
+	}));
+}
+function closeUdp(socket) {
+	return new Promise((resolve) => {
+		try {
+			socket.close(() => resolve());
+		} catch {
+			resolve();
+		}
+	});
+}
+function bindUdp(socket) {
+	return new Promise((resolve, reject) => {
+		socket.once("error", reject);
+		socket.bind({
+			address: "127.0.0.1",
+			port: 0
+		}, () => {
+			socket.off("error", reject);
+			resolve();
+		});
+	});
+}
+async function startBoundaryListeners(dataDirectory) {
+	await mkdir(dataDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(dataDirectory, 448);
+	const udsDirectory = await mkdtemp(join(dataDirectory, "laya-boundary-"));
+	await chmod(udsDirectory, 448);
+	const udsPath = join(udsDirectory, "boundary.sock");
+	if (Buffer.byteLength(udsPath) > UNIX_SOCKET_PATH_LIMIT_BYTES) {
+		await rm(udsDirectory, {
+			recursive: true,
+			force: true
+		});
+		throw new Error("the Laya boundary socket path is too long");
+	}
+	let tcpConnections = 0;
+	let udpDatagrams = 0;
+	let udsConnections = 0;
+	const tcpSockets = /* @__PURE__ */ new Set();
+	const udsSockets = /* @__PURE__ */ new Set();
+	let reportFailure = () => void 0;
+	const failure = new Promise((resolve) => {
+		reportFailure = resolve;
+	});
+	const guardError = (resource) => {
+		installErrorSink(resource);
+		resource.on("error", reportFailure);
+		return resource;
+	};
+	const track = (sockets, socket) => {
+		guardError(socket);
+		sockets.add(socket);
+		socket.once("close", () => sockets.delete(socket));
+		socket.destroy();
+	};
+	const tcp = guardError(createServer((socket) => {
+		tcpConnections += 1;
+		track(tcpSockets, socket);
+	}));
+	const udp = guardError(createSocket("udp4"));
+	udp.on("message", () => {
+		udpDatagrams += 1;
+	});
+	const uds = guardError(createServer((socket) => {
+		udsConnections += 1;
+		track(udsSockets, socket);
+	}));
+	let closing;
+	const close = () => {
+		closing ??= (async () => {
+			for (const socket of [...tcpSockets, ...udsSockets]) socket.destroy();
+			await Promise.allSettled([
+				closeServer(tcp),
+				closeServer(uds),
+				closeUdp(udp)
+			]);
+			await rm(udsPath, { force: true });
+			await rm(udsDirectory, {
+				recursive: true,
+				force: true
+			});
+		})();
+		return closing;
+	};
+	try {
+		await listen(tcp, 0, "127.0.0.1");
+		await bindUdp(udp);
+		await listen(uds, udsPath);
+		const tcpAddress = tcp.address();
+		const udpAddress = udp.address();
+		if (tcpAddress === null || typeof tcpAddress === "string" || typeof udpAddress === "string") throw new Error("boundary listener");
+		return {
+			tcpPort: tcpAddress.port,
+			udpPort: udpAddress.port,
+			udsPath,
+			get observed() {
+				return {
+					tcpConnections,
+					udpDatagrams,
+					udsConnections
+				};
+			},
+			failure,
+			close
+		};
+	} catch (error) {
+		await close();
+		throw error;
+	}
+}
+function workerArguments(entry, workerDirectory) {
+	const sandbox = [
+		"-D",
+		`${LAYA_WORKER_DIRECTORY_PARAMETER}=${workerDirectory}`,
+		"-p",
+		LAYA_WORKER_SANDBOX_PROFILE
+	];
+	return entry.endsWith(".ts") ? [
+		...sandbox,
+		process.execPath,
+		"--experimental-strip-types",
+		entry
+	] : [
+		...sandbox,
+		process.execPath,
+		entry
+	];
+}
+/** The working directory is the owner-only (0700) data directory the proof's listeners were made in. */
+function workerSpawnOptions(workingDirectory) {
+	return {
+		cwd: workingDirectory,
+		env: LAYA_WORKER_ENV,
+		shell: false,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	};
+}
+function bindingFrom(value) {
+	if (typeof value.nonce !== "string" || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || typeof value.profile !== "string" || typeof value.entry !== "string" || typeof value.pipeGeneration !== "string") return null;
+	return {
+		nonce: value.nonce,
+		pid: value.pid,
+		profile: value.profile,
+		entry: value.entry,
+		pipeGeneration: value.pipeGeneration
+	};
+}
+function sameBinding(expected, candidate) {
+	return expected.nonce === candidate.nonce && expected.pid === candidate.pid && expected.profile === candidate.profile && expected.entry === candidate.entry && expected.pipeGeneration === candidate.pipeGeneration;
+}
+function isProbeOutcome(value) {
+	return value === "denied" || value === "escaped" || value === "failed";
+}
+function isProbeAttempt(value) {
+	return PROBE_ATTEMPTS.includes(value);
+}
+function probeReport(frame) {
+	const report = {};
+	for (const attempt of PROBE_ATTEMPTS) {
+		const outcome = frame[attempt];
+		if (!isProbeOutcome(outcome)) return null;
+		report[attempt] = outcome;
+	}
+	return report;
+}
+function probeResult(frame, binding) {
+	if (frame.type !== "probe-result") return null;
+	const candidate = bindingFrom(frame);
+	if (candidate === null || !sameBinding(binding, candidate)) return null;
+	const report = probeReport(frame);
+	return report === null ? null : {
+		type: "probe-result",
+		...candidate,
+		...report
+	};
+}
+function probeAttempt(frame, binding) {
+	if (frame.type !== "probe-attempt") return null;
+	const candidate = bindingFrom(frame);
+	if (candidate === null || !sameBinding(binding, candidate)) return null;
+	if (!isProbeAttempt(frame.attempt) || !isProbeOutcome(frame.outcome)) return null;
+	return {
+		attempt: frame.attempt,
+		outcome: frame.outcome
+	};
+}
+/**
+* Child stderr can carry untrusted runtime or model text, so the daemon retains none of it. It keeps reading and
+* discarding: a paused pipe would fill and stall a child that writes to stderr, which would look like a hung worker.
+*/
+function discardStderr(child) {
+	child.stderr.on("data", () => void 0);
+}
+/** A worker that exits early turns the daemon's next write into EPIPE; that must fail the proof, never the daemon. */
+function sinkWorkerPipes(child) {
+	installErrorSink(child);
+	installErrorSink(child.stdin);
+	installErrorSink(child.stdout);
+	installErrorSink(child.stderr);
+}
+function waitForProbe(child, binding, timeoutMs, signal) {
+	return new Promise((resolve) => {
+		const parser = new WorkerFrameParser();
+		const attempts = /* @__PURE__ */ new Set();
+		const expectedAttempts = PROBE_ATTEMPTS;
+		let done = false;
+		let reported;
+		let settled;
+		const finish = (result) => {
+			if (done) return;
+			done = true;
+			clearTimeout(timeout);
+			if (settled !== void 0) clearTimeout(settled);
+			child.stdout.off("data", onData);
+			child.stdout.pause();
+			child.off("error", onEnd);
+			child.off("exit", onEnd);
+			child.off("close", onEnd);
+			signal?.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		const onData = (chunk) => {
+			try {
+				for (const frame of parser.push(chunk)) {
+					if (reported !== void 0) {
+						finish(null);
+						return;
+					}
+					if (frame.type === "probe-attempt") {
+						const attempt = probeAttempt(frame, binding);
+						if (attempt === null || attempt.outcome !== "denied" || attempt.attempt !== expectedAttempts[attempts.size] || attempts.has(attempt.attempt)) {
+							finish(null);
+							return;
+						}
+						attempts.add(attempt.attempt);
+						continue;
+					}
+					const result = probeResult(frame, binding);
+					if (result === null || attempts.size !== expectedAttempts.length) {
+						finish(null);
+						return;
+					}
+					reported = result;
+					settled = setTimeout(() => finish(reported ?? null), BOUNDARY_SETTLE_MS);
+				}
+			} catch {
+				finish(null);
+			}
+		};
+		const onEnd = () => finish(null);
+		const onAbort = () => finish(null);
+		const timeout = setTimeout(() => finish(null), timeoutMs);
+		child.stdout.on("data", onData);
+		child.once("error", onEnd);
+		child.once("exit", onEnd);
+		child.once("close", onEnd);
+		signal?.addEventListener("abort", onAbort, { once: true });
+		if (signal?.aborted) onAbort();
+	});
+}
+function waitForExit(child, boundMs) {
+	if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve();
+	return new Promise((resolve) => {
+		const timer = boundMs === void 0 ? void 0 : setTimeout(() => settled(), boundMs);
+		const settled = () => {
+			if (timer !== void 0) clearTimeout(timer);
+			child.off("exit", settled);
+			child.off("close", settled);
+			child.off("error", settled);
+			resolve();
+		};
+		child.once("exit", settled);
+		child.once("close", settled);
+		child.once("error", settled);
+	});
+}
+async function killWorker(child) {
+	if (child.pid === void 0) {
+		await waitForExit(child, UNSPAWNED_RELEASE_MS);
+		return;
+	}
+	if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+	await waitForExit(child);
+}
+/** A child report alone is never sufficient: the daemon's own listeners must observe no connection or datagram. */
+function boundaryProbePassed(result, observed) {
+	return result.tcp === "denied" && result.fetch === "denied" && result.udp === "denied" && result.uds === "denied" && result.spawn === "denied" && observed.tcpConnections === 0 && observed.udpDatagrams === 0 && observed.udsConnections === 0;
+}
+function isAbortSignal(value) {
+	return typeof value === "object" && value !== null && typeof value.aborted === "boolean" && typeof value.addEventListener === "function" && typeof value.removeEventListener === "function";
+}
+function productionBoundaryOptions(input) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return null;
+	const candidate = input;
+	const keys = Object.keys(candidate).toSorted();
+	if (keys.length < 1 || keys.length > 2 || keys[0] !== "dataDirectory" || keys[1] !== void 0 && keys[1] !== "signal") return null;
+	if (typeof candidate.dataDirectory !== "string" || candidate.dataDirectory.length === 0) return null;
+	if (candidate.signal !== void 0 && !isAbortSignal(candidate.signal)) return null;
+	return {
+		dataDirectory: candidate.dataDirectory,
+		signal: candidate.signal
+	};
+}
+async function disposeFailedBoundary(child, listeners) {
+	await Promise.allSettled([...child === void 0 ? [] : [killWorker(child)], ...listeners === void 0 ? [] : [listeners.close()]]);
+}
+/** Starts one child, proves its own OS boundary before load, and never falls back to an unconfined process. */
+async function createLayaWorkerBoundaryInternal(options) {
+	if ((options.platform ?? process.platform) !== "darwin") return {
+		ok: false,
+		code: "LAYA_PLATFORM_UNAVAILABLE",
+		loadSent: false
+	};
+	if (options.signal?.aborted) return {
+		ok: false,
+		code: "boundary-failed",
+		loadSent: false
+	};
+	let listeners;
+	let child;
+	try {
+		listeners = await (options.startListeners ?? startBoundaryListeners)(options.dataDirectory);
+		if (options.signal?.aborted) {
+			await disposeFailedBoundary(void 0, listeners);
+			listeners = void 0;
+			return {
+				ok: false,
+				code: "boundary-failed",
+				loadSent: false
+			};
+		}
+		const workerDirectory = await realpath(options.dataDirectory);
+		child = (options.spawn ?? ((command, args, spawnOptions) => spawn(command, args, spawnOptions)))(LAYA_SANDBOX_EXECUTABLE, workerArguments(options.workerEntry, workerDirectory), workerSpawnOptions(options.dataDirectory));
+		const started = child;
+		installErrorSink(started);
+		if (started.pid === void 0) {
+			await disposeFailedBoundary(started, listeners);
+			listeners = void 0;
+			return {
+				ok: false,
+				code: "boundary-failed",
+				loadSent: false
+			};
+		}
+		sinkWorkerPipes(started);
+		discardStderr(started);
+		if (options.signal?.aborted) {
+			await disposeFailedBoundary(started, listeners);
+			listeners = void 0;
+			return {
+				ok: false,
+				code: "boundary-failed",
+				loadSent: false
+			};
+		}
+		const binding = {
+			nonce: createWorkerProbeId(),
+			pid: started.pid,
+			profile: LAYA_SANDBOX_PROFILE,
+			entry: options.workerEntry,
+			pipeGeneration: createWorkerRequestId()
+		};
+		await writeWorkerFrame(started.stdin, {
+			type: "probe",
+			...binding,
+			tcpPort: listeners.tcpPort,
+			udpPort: listeners.udpPort,
+			udsPath: listeners.udsPath
+		});
+		const result = await Promise.race([waitForProbe(started, binding, options.timeoutMs ?? BOUNDARY_PROBE_TIMEOUT_MS, options.signal), listeners.failure.then(() => null)]);
+		const proof = listeners;
+		listeners = void 0;
+		await proof.close();
+		if (result === null || !boundaryProbePassed(result, proof.observed)) {
+			await disposeFailedBoundary(started, void 0);
+			return {
+				ok: false,
+				code: "boundary-failed",
+				loadSent: false
+			};
+		}
+		return {
+			ok: true,
+			child: started,
+			binding,
+			async sendLoad(payload) {
+				assertWorkerLoadBinding(binding, {
+					type: "load",
+					...binding,
+					payload
+				});
+				await writeWorkerFrame(started.stdin, {
+					type: "load",
+					...binding,
+					payload
+				});
+			},
+			async close() {
+				await killWorker(started);
+			}
+		};
+	} catch {
+		await disposeFailedBoundary(child, listeners);
+		listeners = void 0;
+		return {
+			ok: false,
+			code: "boundary-failed",
+			loadSent: false
+		};
+	} finally {
+		if (listeners !== void 0) await disposeFailedBoundary(void 0, listeners);
+	}
+}
+/** Production surface: only the daemon's shipped worker entry can reach the sandbox launcher. */
+async function createLayaWorkerBoundary(options) {
+	const accepted = productionBoundaryOptions(options);
+	if (accepted === null) return {
+		ok: false,
+		code: "boundary-failed",
+		loadSent: false
+	};
+	return createLayaWorkerBoundaryInternal({
+		...accepted,
+		workerEntry: LAYA_WORKER_ENTRY
+	});
+}
+/** The worker's second frame may only use the exact child that completed the probe. */
+function assertWorkerLoadBinding(binding, frame) {
+	const candidate = bindingFrom(frame);
+	if (frame.type !== "load" || candidate === null || !sameBinding(binding, candidate)) throw new Error("worker load binding");
+}
+/** True only for the operating system's refusal, found on the error, its cause or an aggregate's members. */
+function deniedBySystem(error, depth = 0) {
+	if (depth > 4 || error === null || typeof error !== "object") return false;
+	const { code, cause, errors } = error;
+	if (typeof code === "string" && DENIED_CODES.has(code)) return true;
+	if (deniedBySystem(cause, depth + 1)) return true;
+	return Array.isArray(errors) && errors.some((member) => deniedBySystem(member, depth + 1));
+}
+function settled(run) {
+	return new Promise((resolve) => resolve(run())).then(() => "escaped", (error) => deniedBySystem(error) ? "denied" : "failed");
+}
+/** Runs one attempt with a bound; on expiry its own socket is released before the attempt fails. */
+function bounded(run) {
+	return new Promise((resolve, reject) => {
+		let done = false;
+		let release;
+		const timer = setTimeout(() => {
+			if (done) return;
+			done = true;
+			(release?.() ?? Promise.resolve()).finally(() => reject(/* @__PURE__ */ new Error("boundary probe timeout")));
+		}, BOUNDARY_PROBE_TIMEOUT_MS);
+		release = run(() => {
+			if (done) return;
+			done = true;
+			clearTimeout(timer);
+			resolve();
+		}, (error) => {
+			if (done) return;
+			done = true;
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+function closedSocket(socket) {
+	if (socket.closed) return Promise.resolve();
+	return new Promise((resolve) => {
+		socket.once("close", () => resolve());
+		socket.destroy();
+	});
+}
+function closedDatagram(socket) {
+	return new Promise((resolve) => {
+		try {
+			socket.close(() => resolve());
+		} catch {
+			resolve();
+		}
+	});
+}
+/** The attempt settles only after its socket has closed, so no probe handle outlives the report. */
+function connectProbe(options) {
+	return bounded((resolve, reject) => {
+		const socket = "path" in options ? connect(options.path) : connect(options.port, "127.0.0.1");
+		socket.on("error", () => void 0);
+		const release = () => closedSocket(socket);
+		socket.once("connect", () => void release().then(resolve));
+		socket.once("error", (error) => void release().then(() => reject(error)));
+		return release;
+	});
+}
+function fetchProbe(port) {
+	return bounded((resolve, reject) => {
+		const controller = new AbortController();
+		globalThis.fetch(`http://127.0.0.1:${port}/laya-boundary-probe`, { signal: controller.signal }).then(async (response) => {
+			await response.body?.cancel().catch(() => void 0);
+			resolve();
+		}, (error) => reject(error instanceof Error ? error : /* @__PURE__ */ new Error("probe request")));
+		return async () => controller.abort();
+	});
+}
+function udpProbe(port) {
+	return bounded((resolve, reject) => {
+		const socket = createSocket("udp4");
+		socket.on("error", () => void 0);
+		const release = () => closedDatagram(socket);
+		socket.once("error", (error) => void release().then(() => reject(error)));
+		socket.send(Buffer.from([0]), port, "127.0.0.1", (error) => {
+			release().then(() => error ? reject(error) : resolve());
+		});
+		return release;
+	});
+}
+/** The fifth attempt's program, which exits at once if the profile ever let it start. */
+const LAYA_PROBE_SPAWN_COMMAND = "/usr/bin/true";
+const PROBE_SPAWN_OPTIONS = Object.freeze({
+	cwd: "/",
+	env: {},
+	shell: false,
+	stdio: "ignore"
+});
+/**
+* The fifth attempt: start another process. Under the profile `process-fork` refuses it and Node's spawn fails with
+* EPERM; unconfined it starts, which is an escape. It settles only after a process it started has exited, so none
+* outlives the report. No daemon listener can see a process start, so this attempt rests on the system's refusal.
+*/
+function spawnProbe() {
+	return bounded((resolve, reject) => {
+		let child;
+		try {
+			child = spawn(LAYA_PROBE_SPAWN_COMMAND, [], PROBE_SPAWN_OPTIONS);
+		} catch (error) {
+			reject(error instanceof Error ? error : /* @__PURE__ */ new Error("probe spawn"));
+			return;
+		}
+		const ended = new Promise((settle) => child.once("close", () => settle()));
+		const release = () => {
+			if (child.pid !== void 0 && child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			return child.pid === void 0 ? Promise.resolve() : ended;
+		};
+		child.once("error", (error) => void release().then(() => reject(error)));
+		child.once("spawn", () => void ended.then(resolve));
+		return release;
+	});
+}
+/** This is the worker's first built-in-only act, before any runtime/model import. */
+async function runWorkerBoundaryProbe(input, observeAttempt) {
+	const attempts = [
+		["tcp", () => connectProbe({ port: input.tcpPort })],
+		["fetch", () => fetchProbe(input.tcpPort)],
+		["udp", () => udpProbe(input.udpPort)],
+		["uds", () => connectProbe({ path: input.udsPath })],
+		["spawn", () => spawnProbe()]
+	];
+	const outcomes = {};
+	for (const [attempt, run] of attempts) {
+		const outcome = await settled(run);
+		outcomes[attempt] = outcome;
+		await observeAttempt?.(attempt, outcome);
+	}
+	if (PROBE_ATTEMPTS.some((attempt) => outcomes[attempt] === void 0)) throw new Error("boundary probe");
+	return outcomes;
+}
+function sealedNetwork() {
+	throw new Error("Laya worker network is sealed");
+}
+function seal(target, name, value) {
+	Object.defineProperty(target, name, {
+		configurable: false,
+		enumerable: false,
+		writable: false,
+		value
+	});
+}
+/**
+* Defence in depth after the operating-system proof, never a substitute for it: `fetch` and `WebSocket`, every TCP or
+* pathname-socket connection and listener (which `http`, `https` and `tls` build on) and every datagram bind, connect
+* or send throw for the rest of the worker's life.
+*/
+function sealWorkerNetworkAfterProbe() {
+	seal(globalThis, "fetch", async () => sealedNetwork());
+	if ("WebSocket" in globalThis) seal(globalThis, "WebSocket", class SealedWebSocket {
+		constructor() {
+			sealedNetwork();
+		}
+	});
+	seal(Socket.prototype, "connect", sealedNetwork);
+	seal(Server.prototype, "listen", sealedNetwork);
+	seal(Socket$1.prototype, "bind", sealedNetwork);
+	seal(Socket$1.prototype, "connect", sealedNetwork);
+	seal(Socket$1.prototype, "send", sealedNetwork);
+}
+/** Node's names for an open TCP or UDP socket, a listener or a resolver request; stdio pipes are not among them. */
+const NETWORK_RESOURCE = /^(?:TCP|UDP|PipeServer|GetAddrInfo|GetNameInfo|Query|TLS)/;
+function networkResourcesRemain(resources) {
+	return resources.some((resource) => NETWORK_RESOURCE.test(resource));
+}
+/** The worker reports its proof only once no socket, listener or lookup it may have opened is still alive. */
+async function assertNoProbeSocketsRemain(resources = () => process.getActiveResourcesInfo()) {
+	const deadline = Date.now() + PROBE_SOCKET_RELEASE_MS;
+	while (networkResourcesRemain(resources())) {
+		if (Date.now() >= deadline) throw new Error("a Laya worker network resource outlived its probe");
+		await new Promise((resolve) => setTimeout(resolve, 10));
+	}
+}
+//#endregion
+export { layaTemplate as _, createLayaWorkerBoundary as a, WORKER_FRAME_MAX_BYTES as c, encodeWorkerFrame as d, writeWorkerFrame as f, layaLayout as g, isLayaTemplateId as h, assertWorkerLoadBinding as i, WorkerFrameParser as l, LAYA_RUNNABLE_TEMPLATE_IDS as m, LAYA_SANDBOX_PROFILE as n, runWorkerBoundaryProbe as o, LAYA_NOUL_TEMPLATE_ID as p, assertNoProbeSocketsRemain as r, sealWorkerNetworkAfterProbe as s, LAYA_SANDBOX_EXECUTABLE as t, createWorkerRequestId as u, installErrorSink as v };