@agentsh/secure-sandbox 0.1.0

package/dist/index.js

@@ -0,0 +1,774 @@
+import {
+  adapters_exports
+} from "./chunk-L4KFLVNU.js";
+import "./chunk-UYEAO27E.js";
+import "./chunk-LMN3KM53.js";
+import "./chunk-45FKFVMC.js";
+import "./chunk-2P37YGN7.js";
+import "./chunk-OANLKSOD.js";
+import "./chunk-JY5ERJTX.js";
+import {
+  AgentSHError,
+  IncompatibleProviderVersionError,
+  IntegrityError,
+  MissingPeerDependencyError,
+  PolicyValidationError,
+  ProvisioningError,
+  RuntimeError,
+  agentDefault,
+  policies_exports,
+  serializePolicy,
+  systemPolicyYaml,
+  validatePolicy
+} from "./chunk-NWHVZ3DG.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/core/integrity.ts
+var PINNED_VERSION = "0.15.0";
+var CHECKSUMS = {
+  "0.15.0": {
+    linux_amd64: "89f7ebbfd75ffd961245ec62b2602fd0cc387740502ac858dbc39c367c5699c5",
+    linux_arm64: "3fabbd749f9e98fb9f96ddfc94c389a6868cda7ed3668daa8440c39ceec85f3b"
+  },
+  "0.14.0": {
+    linux_amd64: "2ab8ba0d6637fe1a5badf840c3db197161a6f9865d721ed216029d229b1b9bbc",
+    linux_arm64: "929d18dd9fe36e9b2fa830d7ae64b4fb481853e743ade8674fcfcdc73470ed53"
+  }
+};
+function getChecksum(version, arch, override) {
+  if (override) {
+    return override;
+  }
+  const versionChecksums = CHECKSUMS[version];
+  if (versionChecksums && versionChecksums[arch]) {
+    return versionChecksums[arch];
+  }
+  throw new IntegrityError({
+    expected: "",
+    actual: "",
+    message: `No pinned checksum for agentsh v${version}. Provide \`agentshChecksum\` explicitly or use \`skipIntegrityCheck: true\`.`
+  });
+}
+function buildVerifyCommand(filePath) {
+  return [
+    `sha256sum "${filePath}" | awk '{print $1}'`,
+    `shasum -a 256 "${filePath}" | awk '{print $1}'`,
+    `openssl dgst -sha256 "${filePath}" | awk '{print $NF}'`
+  ];
+}
+function binaryUrl(version, arch, overrideUrl) {
+  if (overrideUrl) {
+    return overrideUrl;
+  }
+  return `https://github.com/canyonroad/agentsh/releases/download/v${version}/agentsh_${version}_${arch}.tar.gz`;
+}
+
+// src/core/config.ts
+import yaml from "js-yaml";
+var defaultThreatFeeds = {
+  action: "deny",
+  feeds: [
+    {
+      name: "urlhaus",
+      url: "https://urlhaus.abuse.ch/downloads/hostfile/",
+      format: "hostfile",
+      refreshInterval: "6h"
+    },
+    {
+      name: "phishing",
+      url: "https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-domains-ACTIVE.txt",
+      format: "domain-list",
+      refreshInterval: "12h"
+    }
+  ],
+  allowlist: [
+    "github.com",
+    "*.github.com",
+    "registry.npmjs.org",
+    "registry.yarnpkg.com",
+    "pypi.org",
+    "files.pythonhosted.org",
+    "crates.io",
+    "static.crates.io",
+    "index.crates.io",
+    "proxy.golang.org",
+    "sum.golang.org"
+  ]
+};
+function generateServerConfig(opts) {
+  const config = {
+    server: {
+      http: {
+        addr: "127.0.0.1:18080"
+      }
+    },
+    auth: {
+      type: "none"
+    },
+    policies: {
+      system_dir: "/etc/agentsh/system",
+      dir: "/etc/agentsh",
+      default: "policy"
+    },
+    workspace: opts.workspace,
+    sandbox: {
+      enabled: true,
+      allow_degraded: true
+    }
+  };
+  if (opts.watchtower) config.watchtower = opts.watchtower;
+  if (opts.enforceRedirects) config.enforce_redirects = true;
+  if (opts.realPaths) config.real_paths = true;
+  const feeds = opts.threatFeeds === false ? void 0 : opts.threatFeeds ?? defaultThreatFeeds;
+  if (feeds) {
+    config.threat_feeds = {
+      enabled: true,
+      action: feeds.action ?? "deny",
+      feeds: feeds.feeds.map((f) => ({
+        name: f.name,
+        url: f.url,
+        format: f.format,
+        refresh_interval: f.refreshInterval ?? "6h"
+      })),
+      ...feeds.allowlist?.length ? { allowlist: feeds.allowlist } : {}
+    };
+  }
+  return yaml.dump(config, { lineWidth: -1 });
+}
+
+// src/core/traceparent.ts
+async function getTraceparent() {
+  try {
+    const { trace } = await import("./esm-7TZRRYDK.js");
+    const span = trace.getActiveSpan();
+    const ctx = span?.spanContext();
+    if (!ctx?.traceId || ctx.traceId === "00000000000000000000000000000000") {
+      return void 0;
+    }
+    const flags = (ctx.traceFlags ?? 0).toString(16).padStart(2, "0");
+    return `00-${ctx.traceId}-${ctx.spanId}-${flags}`;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/core/provision.ts
+var SECURITY_MODE_RANK = {
+  full: 4,
+  landlock: 3,
+  "landlock-only": 2,
+  minimal: 1
+};
+function isWeakerThan(detected, required) {
+  return SECURITY_MODE_RANK[detected] < SECURITY_MODE_RANK[required];
+}
+function mapArch(uname) {
+  const trimmed = uname.trim();
+  if (trimmed === "x86_64") return "linux_amd64";
+  if (trimmed === "aarch64") return "linux_arm64";
+  throw new ProvisioningError({
+    phase: "install",
+    command: "uname -m",
+    stderr: `Unsupported architecture: ${trimmed}`
+  });
+}
+var AGENTSH_PATHS = ["/usr/local/bin/agentsh", "/usr/bin/agentsh"];
+async function binaryExists(adapter) {
+  for (const path of AGENTSH_PATHS) {
+    const found = adapter.fileExists ? await adapter.fileExists(path) : (await adapter.exec("test", ["-f", path])).exitCode === 0;
+    if (found) return true;
+  }
+  return false;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function provision(adapter, config = {}) {
+  const {
+    policy: rawPolicy,
+    workspace = "/workspace",
+    watchtower,
+    installStrategy = "download",
+    agentshVersion = PINNED_VERSION,
+    agentshArch: archOverride,
+    agentshBinaryUrl,
+    agentshChecksum,
+    skipIntegrityCheck = false,
+    minimumSecurityMode,
+    realPaths: realPathsOverride,
+    enforceRedirects = false,
+    traceParent,
+    policyName = "policy",
+    threatFeeds
+  } = config;
+  const policy = rawPolicy ? validatePolicy(rawPolicy) : agentDefault();
+  let securityMode = "full";
+  if (installStrategy === "running") {
+    securityMode = await detectSecurityMode(adapter);
+    if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {
+      throw new ProvisioningError({
+        phase: "install",
+        command: "agentsh detect --output json",
+        stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`
+      });
+    }
+    await healthCheck(adapter);
+    const envResult = await adapter.exec("sh", ["-c", "echo $AGENTSH_SESSION_ID"]);
+    const sessionId2 = envResult.stdout.trim();
+    if (!sessionId2) {
+      throw new ProvisioningError({
+        phase: "session",
+        command: "echo $AGENTSH_SESSION_ID",
+        stderr: "AGENTSH_SESSION_ID not set \u2014 running strategy requires a pre-created session"
+      });
+    }
+    return { sessionId: sessionId2, securityMode, passthrough: true };
+  }
+  const exists = await binaryExists(adapter);
+  if (installStrategy === "preinstalled") {
+    if (!exists) {
+      throw new ProvisioningError({
+        phase: "install",
+        command: AGENTSH_PATHS.map((p) => `test -f ${p}`).join(" || "),
+        stderr: "Binary not found but installStrategy is preinstalled"
+      });
+    }
+  } else if (installStrategy === "download" || installStrategy === "upload") {
+    if (!exists) {
+      const arch = archOverride ?? await detectArch(adapter);
+      if (installStrategy === "download") {
+        await downloadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);
+      } else {
+        await uploadBinary(adapter, agentshVersion, arch, agentshBinaryUrl);
+      }
+      if (!skipIntegrityCheck) {
+        await verifyChecksum(
+          adapter,
+          agentshVersion,
+          arch,
+          agentshChecksum,
+          "/tmp/agentsh.tar.gz"
+        );
+      }
+      const binaries = [
+        { src: "/tmp/agentsh", dest: "/usr/local/bin/agentsh" },
+        { src: "/tmp/agentsh-shell-shim", dest: "/usr/bin/agentsh-shell-shim" },
+        { src: "/tmp/agentsh-unixwrap", dest: "/usr/local/bin/agentsh-unixwrap" }
+      ];
+      for (const { src, dest } of binaries) {
+        const installResult = await adapter.exec(
+          "install",
+          ["-m", "0755", src, dest],
+          { sudo: true }
+        );
+        if (installResult.exitCode !== 0) {
+          throw new ProvisioningError({
+            phase: "install",
+            command: `install -m 0755 ${src} ${dest}`,
+            stderr: installResult.stderr
+          });
+        }
+      }
+    }
+  }
+  securityMode = await detectSecurityMode(adapter);
+  if (minimumSecurityMode && isWeakerThan(securityMode, minimumSecurityMode)) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "agentsh detect --json",
+      stderr: `Detected security mode '${securityMode}' is weaker than required '${minimumSecurityMode}'`
+    });
+  }
+  const hasFuse = securityMode === "full" || securityMode === "landlock";
+  const realPaths = realPathsOverride ?? hasFuse;
+  const shimResult = await adapter.exec(
+    "agentsh",
+    [
+      "shim",
+      "install-shell",
+      "--root",
+      "/",
+      "--shim",
+      "/usr/bin/agentsh-shell-shim",
+      "--bash",
+      "--i-understand-this-modifies-the-host"
+    ],
+    { sudo: true }
+  );
+  if (shimResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "agentsh shim install-shell",
+      stderr: shimResult.stderr
+    });
+  }
+  const mkdirResult = await adapter.exec(
+    "mkdir",
+    ["-p", "/etc/agentsh/system"],
+    { sudo: true }
+  );
+  if (mkdirResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "policy",
+      command: "mkdir -p /etc/agentsh/system",
+      stderr: mkdirResult.stderr
+    });
+  }
+  await adapter.exec("chmod", ["-R", "777", "/etc/agentsh/"], { sudo: true });
+  await adapter.writeFile(
+    "/etc/agentsh/system/policy.yml",
+    systemPolicyYaml(),
+    { sudo: true }
+  );
+  await adapter.writeFile(
+    "/etc/agentsh/policy.yml",
+    serializePolicy(policy),
+    { sudo: true }
+  );
+  const serverConfig = generateServerConfig({
+    workspace,
+    watchtower,
+    enforceRedirects,
+    realPaths,
+    threatFeeds
+  });
+  await adapter.writeFile("/etc/agentsh/config.yml", serverConfig, {
+    sudo: true
+  });
+  const chmodDirResult = await adapter.exec(
+    "find",
+    ["/etc/agentsh", "-type", "d", "-exec", "chmod", "555", "{}", "+"],
+    { sudo: true }
+  );
+  if (chmodDirResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "policy",
+      command: "find /etc/agentsh -type d -exec chmod 555 {} +",
+      stderr: chmodDirResult.stderr
+    });
+  }
+  const chmodFileResult = await adapter.exec(
+    "find",
+    ["/etc/agentsh", "-type", "f", "-exec", "chmod", "444", "{}", "+"],
+    { sudo: true }
+  );
+  if (chmodFileResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "policy",
+      command: "find /etc/agentsh -type f -exec chmod 444 {} +",
+      stderr: chmodFileResult.stderr
+    });
+  }
+  const chownResult = await adapter.exec(
+    "chown",
+    ["-R", "root:root", "/etc/agentsh/"],
+    { sudo: true }
+  );
+  if (chownResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "policy",
+      command: "chown -R root:root /etc/agentsh/",
+      stderr: chownResult.stderr
+    });
+  }
+  await adapter.exec("mkdir", ["-p", workspace], { sudo: true });
+  const serverResult = await adapter.exec(
+    "agentsh",
+    ["server", "--config", "/etc/agentsh/config.yml"],
+    { detached: true, sudo: true }
+  );
+  if (serverResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "startup",
+      command: "agentsh server --config /etc/agentsh/config.yml",
+      stderr: serverResult.stderr
+    });
+  }
+  await healthCheck(adapter);
+  const sessionResult = await adapter.exec("agentsh", [
+    "session",
+    "create",
+    "--workspace",
+    workspace,
+    "--policy",
+    "policy"
+  ]);
+  if (sessionResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "session",
+      command: "agentsh session create",
+      stderr: sessionResult.stderr
+    });
+  }
+  let sessionId;
+  try {
+    const sessionData = JSON.parse(sessionResult.stdout);
+    sessionId = sessionData.session_id;
+  } catch {
+    const match = sessionResult.stdout.match(/Session\s+(session-[^\s]+)/);
+    if (match) {
+      sessionId = match[1];
+    } else {
+      throw new ProvisioningError({
+        phase: "session",
+        command: "agentsh session create",
+        stderr: `Failed to parse session output: ${sessionResult.stdout}`
+      });
+    }
+  }
+  const effectiveTraceParent = traceParent ?? await getTraceparent();
+  if (effectiveTraceParent) {
+    await adapter.exec("curl", [
+      "-X",
+      "PUT",
+      `http://127.0.0.1:18080/sessions/${sessionId}/trace-context`,
+      "-H",
+      "Content-Type: application/json",
+      "-d",
+      JSON.stringify({ traceparent: effectiveTraceParent })
+    ]);
+  }
+  return { sessionId, securityMode };
+}
+async function detectArch(adapter) {
+  const result = await adapter.exec("uname", ["-m"]);
+  if (result.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "uname -m",
+      stderr: result.stderr
+    });
+  }
+  return mapArch(result.stdout);
+}
+async function downloadBinary(adapter, version, arch, overrideUrl) {
+  const url = binaryUrl(version, arch, overrideUrl);
+  const curlResult = await adapter.exec("curl", [
+    "-fsSL",
+    url,
+    "-o",
+    "/tmp/agentsh.tar.gz"
+  ]);
+  if (curlResult.exitCode !== 0) {
+    let wgetResult;
+    try {
+      wgetResult = await adapter.exec("wget", [
+        "-q",
+        url,
+        "-O",
+        "/tmp/agentsh.tar.gz"
+      ]);
+    } catch {
+      throw new ProvisioningError({
+        phase: "install",
+        command: `curl -fsSL ${url} -o /tmp/agentsh.tar.gz`,
+        stderr: curlResult.stderr || "Download failed (curl failed, wget not available)"
+      });
+    }
+    if (wgetResult.exitCode !== 0) {
+      throw new ProvisioningError({
+        phase: "install",
+        command: `wget -q ${url} -O /tmp/agentsh.tar.gz`,
+        stderr: wgetResult.stderr
+      });
+    }
+  }
+  const tarResult = await adapter.exec("tar", [
+    "xz",
+    "-C",
+    "/tmp/",
+    "-f",
+    "/tmp/agentsh.tar.gz"
+  ]);
+  if (tarResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "tar xz -C /tmp/ -f /tmp/agentsh.tar.gz",
+      stderr: tarResult.stderr
+    });
+  }
+}
+async function uploadBinary(adapter, version, arch, overrideUrl) {
+  const url = binaryUrl(version, arch, overrideUrl);
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: `fetch ${url}`,
+      stderr: `HTTP ${response.status}: ${response.statusText}`
+    });
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  await adapter.writeFile("/tmp/agentsh.tar.gz", buffer);
+  const tarResult = await adapter.exec("tar", [
+    "xz",
+    "-C",
+    "/tmp/",
+    "-f",
+    "/tmp/agentsh.tar.gz"
+  ]);
+  if (tarResult.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "tar xz -C /tmp/ -f /tmp/agentsh.tar.gz",
+      stderr: tarResult.stderr
+    });
+  }
+}
+async function verifyChecksum(adapter, version, arch, checksumOverride, filePath) {
+  const expected = getChecksum(version, arch, checksumOverride);
+  const commands = buildVerifyCommand(filePath);
+  let actual;
+  for (const cmd of commands) {
+    const result = await adapter.exec("sh", ["-c", cmd]);
+    if (result.exitCode === 0 && result.stdout.trim()) {
+      actual = result.stdout.trim();
+      break;
+    }
+  }
+  if (actual === void 0) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "sha256sum / shasum / openssl",
+      stderr: "No checksum tool available in sandbox"
+    });
+  }
+  if (actual !== expected) {
+    throw new IntegrityError({
+      expected,
+      actual,
+      message: `Checksum mismatch: expected ${expected}, got ${actual}`
+    });
+  }
+}
+async function detectSecurityMode(adapter) {
+  const result = await adapter.exec("agentsh", ["detect", "--output", "json"]);
+  if (result.exitCode !== 0) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "agentsh detect --output json",
+      stderr: result.stderr
+    });
+  }
+  const jsonOutput = result.stderr || result.stdout;
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonOutput);
+  } catch {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "agentsh detect --output json",
+      stderr: `Failed to parse detect JSON: ${jsonOutput.slice(0, 200)}`
+    });
+  }
+  const mode = parsed.security_mode;
+  const validModes = ["full", "landlock", "landlock-only", "minimal"];
+  if (!validModes.includes(mode)) {
+    throw new ProvisioningError({
+      phase: "install",
+      command: "agentsh detect --output json",
+      stderr: `Unknown security mode: '${mode}'`
+    });
+  }
+  return mode;
+}
+async function healthCheck(adapter) {
+  const maxRetries = 10;
+  const delayMs = 500;
+  for (let i = 0; i < maxRetries; i++) {
+    const result = await adapter.exec("curl", [
+      "-sf",
+      "http://127.0.0.1:18080/health"
+    ]);
+    if (result.exitCode === 0) {
+      return;
+    }
+    if (i < maxRetries - 1) {
+      await sleep(delayMs);
+    }
+  }
+  throw new ProvisioningError({
+    phase: "startup",
+    command: "curl http://127.0.0.1:18080/health",
+    stderr: "Health check failed after 10 attempts"
+  });
+}
+
+// src/core/runtime.ts
+async function traceEnv() {
+  const tp = await getTraceparent();
+  return tp ? { TRACEPARENT: tp } : void 0;
+}
+function parseExecJson(raw) {
+  try {
+    const json = JSON.parse(raw.stdout);
+    const result = json.result ?? {};
+    return {
+      exitCode: result.exit_code ?? raw.exitCode,
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? result.error?.message ?? ""
+    };
+  } catch {
+    return raw;
+  }
+}
+function createSecuredSandbox(adapter, sessionId, securityMode, options) {
+  if (options?.passthrough) {
+    return createPassthroughSandbox(adapter, sessionId, securityMode);
+  }
+  return createAgentshSandbox(adapter, sessionId, securityMode);
+}
+function createPassthroughSandbox(adapter, sessionId, securityMode) {
+  return {
+    sessionId,
+    securityMode,
+    async exec(command, opts) {
+      const result = await adapter.exec("bash", ["-c", command], {
+        cwd: opts?.cwd
+      });
+      return result;
+    },
+    async writeFile(path, content) {
+      const b64 = Buffer.from(content, "utf-8").toString("base64");
+      const result = await adapter.exec("sh", [
+        "-c",
+        'printf "%s" "$1" | base64 -d > "$2"',
+        "_",
+        b64,
+        path
+      ]);
+      if (result.exitCode !== 0) {
+        return {
+          success: false,
+          path,
+          error: result.stderr || "writeFile failed"
+        };
+      }
+      return { success: true, path };
+    },
+    async readFile(path) {
+      const result = await adapter.exec("cat", [path]);
+      if (result.exitCode !== 0) {
+        return {
+          success: false,
+          path,
+          error: result.stderr || "readFile failed"
+        };
+      }
+      return { success: true, path, content: result.stdout };
+    },
+    async stop() {
+      await adapter.stop?.();
+    }
+  };
+}
+function createAgentshSandbox(adapter, sessionId, securityMode) {
+  return {
+    sessionId,
+    securityMode,
+    async exec(command, opts) {
+      const args = [
+        "exec",
+        "--output",
+        "json",
+        sessionId,
+        "--",
+        "bash",
+        "-c",
+        command
+      ];
+      const env = await traceEnv();
+      const execOpts = { cwd: opts?.cwd, env };
+      const result = await adapter.exec("agentsh", args, execOpts);
+      if (isTransportFailure(result)) {
+        throw new RuntimeError({
+          sessionId,
+          command,
+          stderr: result.stderr
+        });
+      }
+      return parseExecJson(result);
+    },
+    async writeFile(path, content) {
+      const b64 = Buffer.from(content, "utf-8").toString("base64");
+      const args = [
+        "exec",
+        sessionId,
+        "--",
+        "sh",
+        "-c",
+        'printf "%s" "$1" | base64 -d > "$2"',
+        "_",
+        b64,
+        path
+      ];
+      const env = await traceEnv();
+      const result = await adapter.exec("agentsh", args, { env });
+      if (isTransportFailure(result)) {
+        throw new RuntimeError({
+          sessionId,
+          command: `writeFile ${path}`,
+          stderr: result.stderr
+        });
+      }
+      if (result.exitCode !== 0) {
+        return {
+          success: false,
+          path,
+          error: result.stderr || "writeFile failed"
+        };
+      }
+      return { success: true, path };
+    },
+    async readFile(path) {
+      const args = ["exec", sessionId, "--", "cat", path];
+      const env = await traceEnv();
+      const result = await adapter.exec("agentsh", args, { env });
+      if (isTransportFailure(result)) {
+        throw new RuntimeError({
+          sessionId,
+          command: `readFile ${path}`,
+          stderr: result.stderr
+        });
+      }
+      if (result.exitCode !== 0) {
+        return {
+          success: false,
+          path,
+          error: result.stderr || "readFile failed"
+        };
+      }
+      return { success: true, path, content: result.stdout };
+    },
+    async stop() {
+      await adapter.stop?.();
+    }
+  };
+}
+function isTransportFailure(result) {
+  return result.exitCode === 127 && result.stderr.includes("agentsh");
+}
+
+// src/api.ts
+async function secureSandbox(adapter, config) {
+  const resolvedConfig = config ?? {};
+  const { sessionId, securityMode, passthrough } = await provision(adapter, {
+    workspace: "/workspace",
+    ...resolvedConfig
+  });
+  return createSecuredSandbox(adapter, sessionId, securityMode, { passthrough });
+}
+export {
+  AgentSHError,
+  IncompatibleProviderVersionError,
+  IntegrityError,
+  MissingPeerDependencyError,
+  PolicyValidationError,
+  ProvisioningError,
+  RuntimeError,
+  adapters_exports as adapters,
+  defaultThreatFeeds,
+  policies_exports as policies,
+  secureSandbox
+};
+//# sourceMappingURL=index.js.map