@claxedo/sandbox-manager 0.7.0 → 0.10.0

package/dist/drivers/box.mjs

@@ -1,499 +0,0 @@
-// src/runtime-env.ts
-function workspaceRuntimeTargetEnv(input) {
-  return {
-    WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
-    ...input.hostId ? { WORKSPACE_RUNTIME_HOST_ID: input.hostId } : {},
-    WORKSPACE_RUNTIME_DIRECTORY: input.directory,
-    WORKSPACE_RUNTIME_PORT: String(input.port),
-    ...input.host ? { WORKSPACE_RUNTIME_HOST: input.host } : {}
-  };
-}
-function workspaceRuntimeSourceEnv(input) {
-  if (!input.source || input.source.kind === "empty") return { WORKSPACE_RUNTIME_SOURCE_KIND: "empty" };
-  return {
-    WORKSPACE_RUNTIME_SOURCE_KIND: "git",
-    WORKSPACE_RUNTIME_GIT_REPO_URL: input.source.repoUrl,
-    ...input.source.branch ? { WORKSPACE_RUNTIME_GIT_BRANCH: input.source.branch } : {}
-  };
-}
-
-// src/command.ts
-function shell(input) {
-  return `'${input.replace(/'/g, `'"'"'`)}'`;
-}
-
-// src/constants.ts
-var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
-
-// src/image.ts
-import { Image, DaytonaNotFoundError } from "@daytona/sdk";
-
-// src/runtime-version.ts
-var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-function workspaceRuntimeVersion() {
-  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
-}
-
-// src/image-name.ts
-var SNAPSHOT_SCHEMA_VERSION = 8;
-var DEFAULT_SANDBOX_IMAGE_REPOSITORY = "ghcr.io/kyashrathore/claxedo-sandbox";
-function snapshotVersion(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function sandboxImageRepository(env = process.env) {
-  const repository = env.CLAXEDO_SANDBOX_IMAGE_REPOSITORY?.trim();
-  return repository ? repository : DEFAULT_SANDBOX_IMAGE_REPOSITORY;
-}
-function buildIdSuffix(buildId, env) {
-  const id = (buildId ?? env.CLAXEDO_SANDBOX_BUILD_ID)?.trim();
-  return id ? `-${snapshotVersion(id)}` : "";
-}
-function defaultSandboxImage(version = workspaceRuntimeVersion(), buildId, env = process.env) {
-  return `${sandboxImageRepository(env)}:workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
-}
-function defaultSnapshotName(version = workspaceRuntimeVersion(), buildId, env = process.env) {
-  return `claxedo-workspace-runtime-${snapshotVersion(version)}${buildIdSuffix(buildId, env)}-v${SNAPSHOT_SCHEMA_VERSION}`;
-}
-
-// src/image.ts
-var SANDBOX_IMAGE_REPOSITORY = sandboxImageRepository();
-var SANDBOX_IMAGE = process.env.CLAXEDO_SANDBOX_IMAGE || defaultSandboxImage();
-var SNAPSHOT_NAME = process.env.CLAXEDO_SNAPSHOT_NAME || defaultSnapshotName();
-
-// src/hosted-network-policy.ts
-var SANDBOX_MODEL_PROVIDER_HOSTS = [
-  "api.anthropic.com",
-  "api.openai.com",
-  "generativelanguage.googleapis.com",
-  "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
-  "models.dev",
-  "opencode.ai"
-];
-var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
-  "registry.npmjs.org",
-  "nodejs.org",
-  "pypi.org",
-  "files.pythonhosted.org",
-  "crates.io",
-  "static.crates.io",
-  "index.crates.io",
-  "proxy.golang.org",
-  "sum.golang.org"
-];
-var SANDBOX_BASELINE_EGRESS_HOSTS = [
-  ...SANDBOX_MODEL_PROVIDER_HOSTS,
-  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
-];
-
-// src/driver-catalog.ts
-var sandboxDriverCatalog = {
-  exe: {
-    id: "exe",
-    label: "exe.dev",
-    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "not-supported",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "none",
-        clone: true,
-        captureSource: "not-applicable",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  },
-  daytona: {
-    id: "daytona",
-    label: "Daytona",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
-    metadata: {
-      driverRunsIn: ["worker", "node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // Daytona is the only driver that can filter egress by NAME as well as
-      // by address: `domainAllowList` (names) alongside `networkAllowList`
-      // (CIDRs), with `networkBlockAll` as the deny-all floor.
-      egressControl: "hosts-and-cidrs",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  modal: {
-    id: "modal",
-    label: "Modal",
-    credentialFields: [
-      { key: "token_id", label: "Token ID", secret: true },
-      { key: "token_secret", label: "Token Secret", secret: true }
-    ],
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "replacement-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      // Modal can cut the network entirely (`blockNetwork`) but cannot express
-      // an allowlist, and its driver throws on a host policy. A blackout is
-      // not containment for a workspace that has to clone and reach a model.
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  vercel: {
-    id: "vercel",
-    label: "Vercel",
-    credentialFields: [
-      { key: "access_token", label: "Access Token", secret: true },
-      { key: "team_id", label: "Team ID" },
-      { key: "project_id", label: "Project ID" }
-    ],
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "replacement-host",
-      targetAccess: "relay",
-      secretBrokering: "native",
-      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
-      // never CIDRs.
-      egressControl: "hosts",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "filesystem",
-        clone: false,
-        captureSource: "stopped",
-        retention: "explicit",
-        restoreMount: "new-resource"
-      }
-    }
-  },
-  cloudflare: {
-    id: "cloudflare",
-    label: "Cloudflare",
-    credentialFields: [
-      { key: "api_token", label: "API Token", secret: true },
-      { key: "worker_url", label: "Worker URL" }
-    ],
-    metadata: {
-      driverRunsIn: ["worker"],
-      hostStopBehavior: "not-supported",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "proxy",
-      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
-      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
-      // to route brokered-credential requests through, not a boundary. The
-      // driver therefore drops `net` entirely — which is exactly why this
-      // must be declared, so the manager refuses instead of provisioning a
-      // sandbox the caller believes is contained.
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "directories",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "copy-on-write"
-      }
-    }
-  },
-  box: {
-    id: "box",
-    label: "Box",
-    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "same-sandbox",
-        capture: "none",
-        clone: false,
-        captureSource: "not-applicable",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  },
-  docker: {
-    id: "docker",
-    label: "Docker",
-    credentialFields: [{ key: "image", label: "Image" }],
-    metadata: {
-      driverRunsIn: ["local"],
-      hostStopBehavior: "terminates-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "loopback",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: {
-        resume: "replacement-restore",
-        capture: "same-resource",
-        clone: false,
-        captureSource: "preserved",
-        retention: "provider-managed",
-        restoreMount: "same-resource"
-      }
-    }
-  }
-};
-
-// src/drivers/box.ts
-var DEFAULT_BASE_URL = "https://ascii.dev/api/box/v1";
-var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
-var DEFAULT_WORKSPACE_DIR = "/workspace";
-var DEFAULT_CONTAINER_NAME = "claxedo-runtime";
-var DEFAULT_PROVISION_TIMEOUT_MS = 12e4;
-var DEFAULT_PROVISION_INTERVAL_MS = 2e3;
-var DEFAULT_HEALTH_TIMEOUT_MS = 6e4;
-var DEFAULT_HEALTH_INTERVAL_MS = 1e3;
-var DEFAULT_OPERATION_TIMEOUT_MS = 12e4;
-var READY_STATES = /* @__PURE__ */ new Set(["ready", "idle", "running"]);
-var PENDING_STATES = /* @__PURE__ */ new Set(["init", "provisioning", "provisioned", "cloning"]);
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function clean(input) {
-  const txt = input?.trim();
-  return txt ? txt : void 0;
-}
-function transientDriverError(err) {
-  const shaped = err;
-  if (typeof shaped.status === "number" && shaped.status >= 500) return true;
-  const text = `${shaped.code ?? ""} ${shaped.name ?? ""} ${shaped.message ?? ""}`.toLowerCase();
-  return text.includes("timeout") || text.includes("unavailable") || text.includes("econnreset") || text.includes("network");
-}
-var BoxApiError = class extends Error {
-  status;
-  constructor(message, status) {
-    super(message);
-    this.name = "BoxApiError";
-    this.status = status;
-  }
-};
-function createBoxSandboxDriver(options) {
-  const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-  const image = options.image ?? SANDBOX_IMAGE;
-  const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
-  const workspaceDir = options.workspaceDir ?? DEFAULT_WORKSPACE_DIR;
-  const containerName = options.containerName ?? DEFAULT_CONTAINER_NAME;
-  const ttlSeconds = options.ttlSeconds === void 0 ? null : options.ttlSeconds;
-  const provisionTimeoutMs = options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS;
-  const provisionIntervalMs = options.provisionIntervalMs ?? DEFAULT_PROVISION_INTERVAL_MS;
-  const healthTimeoutMs = options.healthTimeoutMs ?? DEFAULT_HEALTH_TIMEOUT_MS;
-  const healthIntervalMs = options.healthIntervalMs ?? DEFAULT_HEALTH_INTERVAL_MS;
-  const operationTimeoutMs = options.operationTimeoutMs ?? DEFAULT_OPERATION_TIMEOUT_MS;
-  const fetchImpl = options.fetchImpl ?? fetch;
-  async function api(path, init) {
-    let res;
-    try {
-      res = await fetchImpl(`${baseUrl}${path}`, {
-        method: init?.method ?? "GET",
-        headers: {
-          Authorization: `Bearer ${options.apiKey}`,
-          ...init?.body !== void 0 ? { "Content-Type": "application/json" } : {}
-        },
-        ...init?.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-        signal: AbortSignal.timeout(operationTimeoutMs)
-      });
-    } catch (err) {
-      throw new BoxApiError(err instanceof Error ? err.message : String(err));
-    }
-    const text = await res.text();
-    const body = text ? JSON.parse(text) : {};
-    if (!res.ok || body.ok === false) {
-      const detail = clean(body.error) ?? clean(body.message) ?? res.statusText;
-      throw new BoxApiError(`Box API ${init?.method ?? "GET"} ${path} failed: ${detail}`, res.status);
-    }
-    return body;
-  }
-  function runtimePort(input) {
-    return input.workspaceRuntimePort ?? options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
-  }
-  function workspaceDirectory(input) {
-    return input.workspaceRoot ?? workspaceDir;
-  }
-  function resolveImage(input) {
-    if (input.bootSource?.kind === "image") return input.bootSource.image;
-    return input.snapshot ?? image;
-  }
-  function bootEnv(input, hostId) {
-    const env = {
-      ...workspaceRuntimeTargetEnv({
-        workspaceId: input.workspaceId,
-        hostId,
-        directory: workspaceDirectory(input),
-        port: runtimePort(input),
-        host: "0.0.0.0"
-      }),
-      ...workspaceRuntimeSourceEnv({ source: input.source }),
-      ...input.env
-    };
-    if (options.runner) env.WORKSPACE_RUNTIME_RUNNER = options.runner;
-    return env;
-  }
-  async function exec(boxId, command) {
-    const body = await api(`/boxes/${boxId}/commands`, {
-      method: "POST",
-      body: { command }
-    });
-    const result = body.result ?? body;
-    return {
-      stdout: typeof result.stdout === "string" ? result.stdout : "",
-      stderr: typeof result.stderr === "string" ? result.stderr : "",
-      exitCode: typeof result.exitCode === "number" ? result.exitCode : 0
-    };
-  }
-  async function execOrThrow(boxId, command, label) {
-    const result = await exec(boxId, command);
-    if ((result.exitCode ?? 0) !== 0) {
-      throw new BoxApiError(`Box ${boxId} ${label} failed (exit ${result.exitCode}): ${clean(result.stderr) ?? clean(result.stdout) ?? ""}`);
-    }
-    return result;
-  }
-  async function waitUntilReady(boxId) {
-    const until = Date.now() + provisionTimeoutMs;
-    for (; ; ) {
-      const { box } = await api(`/boxes/${boxId}`);
-      if (READY_STATES.has(box.state)) return true;
-      if (!PENDING_STATES.has(box.state)) {
-        throw new BoxApiError(`Box ${boxId} entered non-ready state: ${box.state}`);
-      }
-      if (Date.now() >= until) return false;
-      await sleep(provisionIntervalMs);
-    }
-  }
-  function dockerRunScript(input, env) {
-    const port = runtimePort(input);
-    const directory = workspaceDirectory(input);
-    const bootScript = [`mkdir -p ${shell(directory)}`, `cd ${shell(directory)}`, `exec ${runtimeCommand}`].join(" && ");
-    const envArgs = Object.entries(env).map(([key, value]) => `--env ${shell(`${key}=${value}`)}`).join(" ");
-    const login = options.registryAuth ? `echo ${shell(options.registryAuth.password)} | docker login ${shell(options.registryAuth.server)} --username ${shell(options.registryAuth.username)} --password-stdin && ` : "";
-    return `${login}docker rm -f ${containerName} >/dev/null 2>&1 || true; docker run -d --name ${containerName} -p ${port}:${port} ${envArgs} --entrypoint sh ${shell(resolveImage(input))} -lc ${shell(bootScript)}`;
-  }
-  async function waitForHealth(boxId, input) {
-    const port = runtimePort(input);
-    const until = Date.now() + healthTimeoutMs;
-    let last = "workspace runtime not ready";
-    while (Date.now() < until) {
-      const probe = await exec(
-        boxId,
-        `curl -sf -o /dev/null -w '%{http_code}' http://127.0.0.1:${port}/global/health || true`
-      );
-      const code = clean(probe.stdout);
-      if (code === "200") return;
-      last = `health probe returned ${code ?? "no response"}`;
-      await sleep(healthIntervalMs);
-    }
-    throw new BoxApiError(`Box ${boxId} runtime did not become healthy: ${last}`);
-  }
-  async function boot(boxId, input, hostId) {
-    const env = {
-      ...bootEnv(input, hostId),
-      ...await options.env?.(input, { id: hostId })
-    };
-    const port = runtimePort(input);
-    await execOrThrow(boxId, dockerRunScript(input, env), "docker run");
-    await execOrThrow(boxId, `host ${port}`, "host publish");
-    await waitForHealth(boxId, input);
-    const urlResult = await execOrThrow(boxId, `host url ${port}`, "host url");
-    const url = clean(urlResult.stdout?.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop());
-    if (!url) throw new BoxApiError(`Box ${boxId} did not return a public URL for port ${port}`);
-    return {
-      workspaceId: input.workspaceId,
-      sandboxId: boxId,
-      url,
-      hostId,
-      driverResourceId: boxId,
-      driver: { id: "box", resourceId: boxId },
-      labels: input.labels
-    };
-  }
-  function assertNetwork(input) {
-    if (input.net && input.net.mode !== "allow-all") {
-      throw new BoxApiError("Box SandboxDriver cannot enforce host-based network policy");
-    }
-  }
-  async function ensureHost(input) {
-    assertNetwork(input);
-    const hostId = input.hostId ?? `box-${input.workspaceId}`;
-    const created = await api("/boxes", {
-      method: "POST",
-      body: { ttlSeconds }
-    }).catch((err) => {
-      if (transientDriverError(err)) return void 0;
-      throw err;
-    });
-    if (!created) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-    const boxId = created.box.id;
-    const ready = await waitUntilReady(boxId);
-    if (!ready) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-    return boot(boxId, input, hostId);
-  }
-  async function resumeHost(input) {
-    const boxId = input.lease.sandboxId;
-    if (!boxId) return ensureHost(input.ensure);
-    assertNetwork(input.ensure);
-    const hostId = input.ensure.hostId ?? input.lease.hostId ?? `box-${input.ensure.workspaceId}`;
-    try {
-      await api(`/boxes/${boxId}/resume`, { method: "POST" });
-      const ready = await waitUntilReady(boxId);
-      if (!ready) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-      return await boot(boxId, input.ensure, hostId);
-    } catch (err) {
-      if (transientDriverError(err)) return { provisioning: true, retryAfterMs: provisionIntervalMs };
-      return ensureHost(input.ensure);
-    }
-  }
-  async function stop(target) {
-    await api(`/boxes/${target.sandboxId}/stop`, { method: "POST" });
-  }
-  async function destroy(target) {
-    await api(`/boxes/${target.sandboxId}`, { method: "DELETE" });
-  }
-  return {
-    id: "box",
-    metadata: {
-      driverRunsIn: ["node"],
-      hostStopBehavior: "suspends-host",
-      hostResumeBehavior: "same-host",
-      targetAccess: "relay",
-      secretBrokering: "none",
-      egressControl: "none",
-      persistence: sandboxDriverCatalog.box.metadata.persistence
-    },
-    ensureHost,
-    resumeHost,
-    async touch() {
-    },
-    suspend: stop,
-    stop,
-    destroy
-  };
-}
-export {
-  createBoxSandboxDriver
-};

package/dist/drivers/cloudflare-egress.d.ts

@@ -1,40 +0,0 @@
-export type EgressTokenClaims = {
-    /** Sandbox the token is bound to. */
-    sub: string;
-    /** Hosts the sandbox may reach through the broker. */
-    hosts: string[];
-    /** Expiry (epoch seconds). */
-    exp: number;
-};
-/** Mint a short-lived HS256 token binding a sandbox to its brokered hosts. Carries NO secret values. */
-export declare function mintEgressToken(input: {
-    sandboxId: string;
-    hosts: string[];
-    signingSecret: string;
-    ttlSeconds?: number;
-    now?: () => number;
-}): Promise<string>;
-/** Verify a token and return its claims, or null if invalid/expired. */
-export declare function verifyEgressToken(token: string, signingSecret: string, now?: () => number): Promise<EgressTokenClaims | null>;
-/** How the sandbox names its egress target: header carries the absolute upstream URL. */
-export declare const EGRESS_TARGET_HEADER = "x-claxedo-egress-target";
-/** Resolves the brokered credential for a (sandbox, host) pair — Worker-side only, never the sandbox. */
-export type EgressSecretResolver = (sandboxId: string, host: string) => Promise<{
-    header: string;
-    value: string;
-} | undefined> | {
-    header: string;
-    value: string;
-} | undefined;
-/**
- * Handle one egress-proxy request from a sandbox: validate the JWT, confirm
- * the target host is allowed, inject the brokered credential as its header,
- * and forward. The credential is read from `resolveSecret` (Worker store) and
- * never round-trips through the sandbox.
- */
-export declare function handleEgressRequest(request: Request, options: {
-    signingSecret: string;
-    resolveSecret: EgressSecretResolver;
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-}): Promise<Response>;

package/dist/drivers/cloudflare-egress.mjs

@@ -1,113 +0,0 @@
-// src/drivers/cloudflare-egress.ts
-function b64urlEncode(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function b64urlDecode(input) {
-  const padded = input.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - input.length % 4) % 4);
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-  return bytes;
-}
-function encodeJson(value) {
-  return b64urlEncode(new TextEncoder().encode(JSON.stringify(value)));
-}
-async function hmacKey(secret) {
-  return crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign", "verify"]
-  );
-}
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-async function mintEgressToken(input) {
-  const now = input.now ?? Date.now;
-  const header = encodeJson({ alg: "HS256", typ: "JWT" });
-  const payload = encodeJson({
-    sub: input.sandboxId,
-    hosts: input.hosts,
-    exp: Math.floor(now() / 1e3) + (input.ttlSeconds ?? 15 * 60)
-  });
-  const key = await hmacKey(input.signingSecret);
-  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${header}.${payload}`)));
-  return `${header}.${payload}.${b64urlEncode(sig)}`;
-}
-async function verifyEgressToken(token, signingSecret, now = Date.now) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  const [header, payload, sig] = parts;
-  const key = await hmacKey(signingSecret);
-  const expected = b64urlEncode(
-    new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${header}.${payload}`)))
-  );
-  if (!timingSafeEqual(sig, expected)) return null;
-  let claims;
-  try {
-    claims = JSON.parse(new TextDecoder().decode(b64urlDecode(payload)));
-  } catch {
-    return null;
-  }
-  if (typeof claims.sub !== "string" || !Array.isArray(claims.hosts) || typeof claims.exp !== "number") return null;
-  if (claims.exp <= Math.floor(now() / 1e3)) return null;
-  return claims;
-}
-var EGRESS_TARGET_HEADER = "x-claxedo-egress-target";
-async function handleEgressRequest(request, options) {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const auth = request.headers.get("authorization");
-  const token = auth?.toLowerCase().startsWith("bearer ") ? auth.slice(7) : void 0;
-  if (!token) return egressError(401, "missing egress token");
-  const claims = await verifyEgressToken(token, options.signingSecret, options.now);
-  if (!claims) return egressError(401, "invalid or expired egress token");
-  const targetRaw = request.headers.get(EGRESS_TARGET_HEADER);
-  if (!targetRaw) return egressError(400, "missing egress target");
-  let target;
-  try {
-    target = new URL(targetRaw);
-  } catch {
-    return egressError(400, "malformed egress target");
-  }
-  if (target.protocol !== "https:") return egressError(400, "egress target must be https");
-  if (!claims.hosts.includes(target.host)) return egressError(403, "host not permitted for this sandbox");
-  const secret = await options.resolveSecret(claims.sub, target.host);
-  if (!secret) return egressError(403, "no brokered credential for host");
-  const headers = new Headers(request.headers);
-  headers.delete("authorization");
-  headers.delete(EGRESS_TARGET_HEADER);
-  headers.set(secret.header, secret.value);
-  headers.set("host", target.host);
-  try {
-    const upstream = await fetchImpl(target.toString(), {
-      method: request.method,
-      headers,
-      body: request.method === "GET" || request.method === "HEAD" ? void 0 : request.body,
-      redirect: "manual"
-    });
-    const outHeaders = new Headers(upstream.headers);
-    outHeaders.delete(secret.header);
-    return new Response(upstream.body, { status: upstream.status, statusText: upstream.statusText, headers: outHeaders });
-  } catch {
-    return egressError(502, "upstream request failed");
-  }
-}
-function egressError(status, message) {
-  return new Response(JSON.stringify({ error: message }), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-export {
-  EGRESS_TARGET_HEADER,
-  handleEgressRequest,
-  mintEgressToken,
-  verifyEgressToken
-};