@directive-run/sandbox 0.1.0

package/LICENSE

@@ -0,0 +1,26 @@
+MIT License
+
+Copyright (c) 2026 Sizls ∞ Jason Comes
+
+This project is dual-licensed under MIT OR Apache-2.0. You may choose
+either license. See LICENSE-APACHE for the Apache License, Version 2.0.
+
+---
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,5 @@
+"use strict";var D=Object.create;var x=Object.defineProperty;var j=Object.getOwnPropertyDescriptor;var L=Object.getOwnPropertyNames;var W=Object.getPrototypeOf,B=Object.prototype.hasOwnProperty;var C=(e,r)=>{for(var o in r)x(e,o,{get:r[o],enumerable:!0})},I=(e,r,o,t)=>{if(r&&typeof r=="object"||typeof r=="function")for(let n of L(r))!B.call(e,n)&&n!==o&&x(e,n,{get:()=>r[n],enumerable:!(t=j(r,n))||t.enumerable});return e};var V=(e,r,o)=>(o=e!=null?D(W(e)):{},I(r||!e||!e.__esModule?x(o,"default",{value:e,enumerable:!0}):o,e)),q=e=>I(x({},"__esModule",{value:!0}),e);var se={};C(se,{SandboxError:()=>d,runInSandbox:()=>oe});module.exports=q(se);var P=require("esbuild"),S="src/main.ts",g="directive-sandbox-vfs",p=class extends Error{constructor(o,t){super(o);this.cause=t;this.name="BundleError"}};function K(e){let r=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,o=e.match(r);if(!o)return e;let t=o[1],s=`
+(globalThis).__directiveSandbox_system__ = ${o[2]};
+`;return e.replace(t,t+s)}async function E(e){if(!e.find(t=>t.path===S))throw new p(`payload must include "${S}" \u2014 that's the entry point the runner targets`);let o=new Map;for(let t of e)o.set(t.path,t.source);try{let n=(await(0,P.build)({entryPoints:[`${g}:${S}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/core","@directive-run/ai","@directive-run/query"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(u){u.onResolve({filter:/.*/},i=>{if(i.kind==="entry-point")return{path:i.path.replace(`${g}:`,""),namespace:g};if(i.namespace!==g)return null;if(i.path.startsWith("@directive-run/"))return{external:!0,path:i.path};if(i.path.startsWith("./")||i.path.startsWith("../")){let a=i.importer.replace(/\/[^/]+$/,""),c=i.path.replace(/^\.\//,"").replace(/\.js$/,""),b=[`${a}/${c}.ts`,`${a}/${c}.js`,`${a}/${c}`,`${c}.ts`,`${c}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of b)if(o.has(m))return{path:m,namespace:g};throw new p(`cannot resolve "${i.path}" from "${i.importer}" \u2014 tried ${b.join(", ")}`)}throw new p(`unexpected import "${i.path}" from "${i.importer}" \u2014 only relative or @directive-run/* allowed`)}),u.onLoad({filter:/.*/,namespace:g},i=>{let a=o.get(i.path);if(a===void 0)throw new p(`virtual file missing: ${i.path}`);if(i.path===S){let c=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {","  (globalThis).__directiveSandbox_system__ = system;","}"].join(`
+`);return{contents:a+c,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!n)throw new p("esbuild produced no output");let s=K(n);return{source:s,bytes:Buffer.byteLength(s,"utf8")}}catch(t){throw t instanceof p?t:new p(`bundle failed: ${t.message??String(t)}`,t)}}var w=require("fs"),y=require("path"),$=require("url"),T=require("worker_threads"),Y={},U=100,G=1e4,k=5e3;async function N(){let{createRequire:e}=await import("module");return e(Y.url).resolve("@directive-run/sandbox/worker")}var h=class extends Error{constructor(o,t){super(o);this.code=t;this.name="WorkerExecError"}};function H(e){let r=e??k;return Number.isFinite(r)?Math.min(G,Math.max(U,Math.floor(r))):k}async function X(){let e=await N();return(0,y.dirname)((0,y.dirname)(e))}async function z(e){let r=await X(),o=(0,w.mkdtempSync)((0,y.join)(r,".sandbox-tmp-")),t=(0,y.join)(o,"bundle.mjs");return(0,w.writeFileSync)(t,e,"utf8"),{bundlePath:t,cleanup:()=>{try{(0,w.rmSync)(o,{recursive:!0,force:!0})}catch{}}}}async function _(e){let r=H(e.timeoutMs),o=await N(),{bundlePath:t,cleanup:n}=await z(e.bundledSource),s=new T.Worker(o,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),u=null,i=!1,a=Date.now();try{return await new Promise((b,m)=>{let v=!1;s.once("message",f=>{v=!0,f.ok?b(f.result):m(new h(f.error,"worker-error"))}),s.once("error",f=>{v=!0,m(new h(f.message,"worker-error"))}),s.once("exit",f=>{!v&&f!==0&&f!==null&&m(new h(`worker exited with code ${f} before responding`,"worker-error"))}),u=setTimeout(()=>{i=!0,s.terminate(),m(new h(`wall-clock budget of ${r}ms elapsed`,"timeout"))},r);let O={bundlePath:(0,$.pathToFileURL)(t).href,timeoutMs:r};s.postMessage(O)})}catch(c){if(c instanceof h&&c.code==="timeout")return{logs:[],facts:{},errors:[c.message],durationMs:Date.now()-a,timedOut:!0};throw c}finally{u&&clearTimeout(u),await s.terminate().catch(()=>{}),n()}}var d=class extends Error{constructor(o,t){super(o);this.code=t;this.name="SandboxError"}};var l=require("ts-morph"),J=[/^@directive-run\/(core|ai|query)(\/.+)?$/,/^\.\/.+\.js$/,/^\.\.\/.+\.js$/],Q=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),Z=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function ee(e,r,o){let t=r.getSourceFileOrThrow(e);for(let n of t.getImportDeclarations()){let s=n.getModuleSpecifierValue();if(!J.some(i=>i.test(s))){let{line:i,column:a}=t.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:i,column:a,message:`import "${s}" is not allowed in the sandbox. Allowed: @directive-run/{core,ai,query} or relative "./X.js" paths.`})}}}function te(e,r,o){let t=r.getSourceFileOrThrow(e);t.forEachDescendant(n=>{if(n.getKind()===l.SyntaxKind.ImportKeyword){let s=n.getParent();if(s&&s.getKind()===l.SyntaxKind.CallExpression){let{line:u,column:i}=t.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:u,column:i,message:"dynamic import() is not allowed in the sandbox"})}}if(n.getKind()===l.SyntaxKind.NewExpression){let s=n.getText();if(/^new\s+Function\s*\(/.test(s)){let{line:u,column:i}=t.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:u,column:i,message:"new Function(...) is not allowed in the sandbox"})}}})}function re(e,r,o){let t=r.getSourceFileOrThrow(e),n=new Set;for(let s of t.getImportDeclarations()){for(let a of s.getNamedImports())n.add(a.getName());let u=s.getDefaultImport();u&&n.add(u.getText());let i=s.getNamespaceImport();i&&n.add(i.getText())}for(let s of t.getVariableDeclarations())n.add(s.getName());for(let s of t.getFunctions()){let u=s.getName();u&&n.add(u)}for(let s of t.getClasses()){let u=s.getName();u&&n.add(u)}t.forEachDescendant(s=>{if(s.getKind()!==l.SyntaxKind.Identifier)return;let u=s.getText();if(n.has(u)||Q.has(u))return;let i=s.getParent();if(i){let a=i.getKind();if(a===l.SyntaxKind.PropertyAssignment&&i.getNameNode?.()===s||a===l.SyntaxKind.PropertyAccessExpression&&i.getNameNode?.()===s||a===l.SyntaxKind.MethodDeclaration||a===l.SyntaxKind.ImportSpecifier||a===l.SyntaxKind.ExportSpecifier||a===l.SyntaxKind.NamespaceImport||a===l.SyntaxKind.ImportClause||a===l.SyntaxKind.Parameter||a===l.SyntaxKind.TypeReference||a===l.SyntaxKind.TypeQuery)return}if(Z.has(u)){let{line:a,column:c}=t.getLineAndColumnAtPos(s.getStart());o.push({path:e,line:a,column:c,message:`identifier "${u}" is denied in the sandbox (FS/network/eval surface)`})}})}function F(e){let r=[],o=new l.Project({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let t of e)o.createSourceFile(t.path,t.source,{overwrite:!0});for(let t of e)ee(t.path,o,r),te(t.path,o,r),re(t.path,o,r);return r}var A=2e5,R=10,M="src/main.ts";function ne(e){if(e.files&&e.source)throw new d("pass either `source` or `files`, not both","input-invalid");if(!e.files&&!e.source)throw new d("must pass either `source` or `files`","input-invalid");let r=e.files?e.files:[{path:M,source:e.source??""}];if(r.length===0)throw new d("files array is empty","input-invalid");if(r.length>R)throw new d(`payload exceeds ${R} files`,"input-invalid");let o=0;for(let t of r){if(typeof t.path!="string"||t.path.length===0)throw new d("every file must have a non-empty path","input-invalid");if(typeof t.source!="string"||t.source.length===0)throw new d(`file "${t.path}" has empty source`,"input-invalid");o+=Buffer.byteLength(t.source,"utf8")}if(o>A)throw new d(`total payload is ${o} bytes (max ${A})`,"input-invalid");if(!r.some(t=>t.path===M))throw new d(`payload must include "${M}" \u2014 the runner entry point`,"input-invalid");return r}async function oe(e){let r;try{r=ne(e)}catch(n){if(n instanceof d)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let o=F(r);if(o.length>0)return{logs:[],facts:{},errors:o.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let t;try{t=await E(r)}catch(n){if(n instanceof p)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await _({bundledSource:t.source,timeoutMs:e.timeoutMs})}catch(n){if(n instanceof h)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}0&&(module.exports={SandboxError,runInSandbox});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/bundler.ts","../src/host.ts","../src/types.ts","../src/validator.ts"],"sourcesContent":["/**\n * Public API for `@directive-run/sandbox`.\n *\n * Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n *\n * Consumers:\n *\n * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n *   result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n *   for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n  PlaygroundFile,\n  RunInSandboxInput,\n  SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n  SandboxError,\n  type PlaygroundFile,\n  type RunInSandboxInput,\n  type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n  if (input.files && input.source) {\n    throw new SandboxError(\n      \"pass either `source` or `files`, not both\",\n      \"input-invalid\",\n    );\n  }\n  if (!input.files && !input.source) {\n    throw new SandboxError(\n      \"must pass either `source` or `files`\",\n      \"input-invalid\",\n    );\n  }\n  const files: PlaygroundFile[] = input.files\n    ? input.files\n    : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n  if (files.length === 0) {\n    throw new SandboxError(\"files array is empty\", \"input-invalid\");\n  }\n  if (files.length > MAX_FILES) {\n    throw new SandboxError(\n      `payload exceeds ${MAX_FILES} files`,\n      \"input-invalid\",\n    );\n  }\n  let totalBytes = 0;\n  for (const file of files) {\n    if (typeof file.path !== \"string\" || file.path.length === 0) {\n      throw new SandboxError(\n        \"every file must have a non-empty path\",\n        \"input-invalid\",\n      );\n    }\n    if (typeof file.source !== \"string\" || file.source.length === 0) {\n      throw new SandboxError(\n        `file \"${file.path}\" has empty source`,\n        \"input-invalid\",\n      );\n    }\n    totalBytes += Buffer.byteLength(file.source, \"utf8\");\n  }\n  if (totalBytes > MAX_PAYLOAD_BYTES) {\n    throw new SandboxError(\n      `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n      \"input-invalid\",\n    );\n  }\n  // Ensure src/main.ts is present — that's the runner / entry point.\n  if (!files.some((f) => f.path === MAIN_PATH)) {\n    throw new SandboxError(\n      `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n      \"input-invalid\",\n    );\n  }\n  return files;\n}\n\nexport async function runInSandbox(\n  input: RunInSandboxInput,\n): Promise<SandboxResult> {\n  let files: PlaygroundFile[];\n  try {\n    files = normalizeInput(input);\n  } catch (err) {\n    if (err instanceof SandboxError) {\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: 0,\n        timedOut: false,\n      };\n    }\n    throw err;\n  }\n\n  const validationErrors = validateSandboxInput(files);\n  if (validationErrors.length > 0) {\n    return {\n      logs: [],\n      facts: {},\n      errors: validationErrors.map(\n        (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n      ),\n      durationMs: 0,\n      timedOut: false,\n    };\n  }\n\n  let bundled: { source: string; bytes: number };\n  try {\n    bundled = await bundleSandboxFiles(files);\n  } catch (err) {\n    if (err instanceof BundleError) {\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: 0,\n        timedOut: false,\n      };\n    }\n    throw err;\n  }\n\n  try {\n    const result = await execInWorker({\n      bundledSource: bundled.source,\n      timeoutMs: input.timeoutMs,\n    });\n    return result;\n  } catch (err) {\n    if (err instanceof WorkerExecError) {\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: 0,\n        timedOut: err.code === \"timeout\",\n      };\n    }\n    throw err;\n  }\n}\n","/**\n * esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n *\n * `@directive-run/*` packages are marked **external** — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n *\n * The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n */\n\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n  /** Single ESM string ready to evaluate inside the worker. */\n  source: string;\n  /** Total bytes of the bundled JS (informational). */\n  bytes: number;\n}\n\nexport class BundleError extends Error {\n  constructor(\n    message: string,\n    public readonly cause?: unknown,\n  ) {\n    super(message);\n    this.name = \"BundleError\";\n  }\n}\n\n/**\n * Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n *\n * esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n *\n *   var system = createSystem({ ... });\n *   var system2 = createSystem({ ... });   // when \"system\" collides\n *\n * The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n */\nfunction injectEarlyCapture(bundled: string): string {\n  const re = /(var\\s+(system\\d*)\\s*=\\s*createSystem\\s*\\([\\s\\S]*?\\)\\s*;)/;\n  const match = bundled.match(re);\n  if (!match) {\n    return bundled;\n  }\n  const decl = match[1]!;\n  const localName = match[2]!;\n  const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n  return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n  files: PlaygroundFile[],\n): Promise<BundleResult> {\n  const entry = files.find((f) => f.path === ENTRY_PATH);\n  if (!entry) {\n    throw new BundleError(\n      `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n    );\n  }\n\n  const fileMap = new Map<string, string>();\n  for (const file of files) {\n    fileMap.set(file.path, file.source);\n  }\n\n  try {\n    const result = await build({\n      entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n      bundle: true,\n      format: \"esm\",\n      target: \"node20\",\n      platform: \"node\",\n      write: false,\n      logLevel: \"silent\",\n      external: [\n        \"@directive-run/core\",\n        \"@directive-run/ai\",\n        \"@directive-run/query\",\n      ],\n      // Top-level await is required (the runner does `await system.settle()`)\n      // and node20 supports it natively.\n      supported: { \"top-level-await\": true },\n      plugins: [\n        {\n          name: \"directive-sandbox-vfs\",\n          setup(b) {\n            b.onResolve({ filter: /.*/ }, (args) => {\n              if (args.kind === \"entry-point\") {\n                const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n                return { path, namespace: VIRTUAL_NAMESPACE };\n              }\n              if (args.namespace !== VIRTUAL_NAMESPACE) {\n                return null;\n              }\n              if (args.path.startsWith(\"@directive-run/\")) {\n                // External — let esbuild's external list handle it.\n                return { external: true, path: args.path };\n              }\n              if (args.path.startsWith(\"./\") || args.path.startsWith(\"../\")) {\n                // Resolve relative to the importer's path.\n                const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n                // The runner imports `./counter.js`; the actual virtual\n                // file lives at `src/counter.ts`. Strip the `.js` and\n                // try both extensions so users can write either.\n                const stripped = args.path\n                  .replace(/^\\.\\//, \"\")\n                  .replace(/\\.js$/, \"\");\n                const candidates = [\n                  `${importerDir}/${stripped}.ts`,\n                  `${importerDir}/${stripped}.js`,\n                  `${importerDir}/${stripped}`,\n                  // Also try the raw path in case the importer's dir\n                  // resolution misses the leading slash.\n                  `${stripped}.ts`,\n                  `${stripped}.js`,\n                ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n                for (const candidate of candidates) {\n                  if (fileMap.has(candidate)) {\n                    return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n                  }\n                }\n                throw new BundleError(\n                  `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n                );\n              }\n              throw new BundleError(\n                `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n              );\n            });\n            b.onLoad({ filter: /.*/, namespace: VIRTUAL_NAMESPACE }, (args) => {\n              const contents = fileMap.get(args.path);\n              if (contents === undefined) {\n                throw new BundleError(`virtual file missing: ${args.path}`);\n              }\n              // For the entry file, append a trailing assignment so the\n              // runner's top-level `const system = …` binding ends up on\n              // a side-channel global the worker reads after execution.\n              // ESM module exports are sealed, so we can't patch\n              // `createSystem` post-import; instead we lift the binding\n              // out of the entry module's scope here. The convention is\n              // documented by `@directive-run/scaffold`'s `generateRunner`\n              // which always names the local binding `system`.\n              if (args.path === ENTRY_PATH) {\n                const epilogue = [\n                  \"\",\n                  \"// directive-sandbox: lift the runner's `system` binding\",\n                  \"// onto a side-channel global so the worker can read\",\n                  \"// system.facts.$store.toObject() after execution.\",\n                  \"if (typeof system !== 'undefined') {\",\n                  \"  (globalThis).__directiveSandbox_system__ = system;\",\n                  \"}\",\n                ].join(\"\\n\");\n                return { contents: contents + epilogue, loader: \"ts\" };\n              }\n              return { contents, loader: \"ts\" };\n            });\n          },\n        },\n      ],\n    });\n    const rawSource = result.outputFiles[0]?.text;\n    if (!rawSource) {\n      throw new BundleError(\"esbuild produced no output\");\n    }\n    // Inject an early-capture immediately after `createSystem(...)` so\n    // the worker can read facts even when subsequent runner code throws\n    // (e.g. an async settle() rejection from a bad event payload). The\n    // entry-file epilogue (appended in onLoad) only fires on a clean\n    // run; this regex fires regardless. Idempotent — duplicate\n    // assignments to the same global are harmless.\n    const source = injectEarlyCapture(rawSource);\n    return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n  } catch (err) {\n    if (err instanceof BundleError) {\n      throw err;\n    }\n    throw new BundleError(\n      `bundle failed: ${(err as Error).message ?? String(err)}`,\n      err,\n    );\n  }\n}\n","/**\n * Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n *\n * Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n */\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n  SandboxResult,\n  WorkerInputMessage,\n  WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n  // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n  // shim of import.meta exposes a `resolve` that isn't callable, and\n  // `createRequire` works in both real Node ESM and Vitest dev mode.\n  // The worker subpath export points at dist/worker.js; CJS resolution\n  // picks up the \"default\" condition we set in package.json.\n  const { createRequire } = await import(\"node:module\");\n  const require = createRequire(import.meta.url);\n  return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n  bundledSource: string;\n  timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n  constructor(\n    message: string,\n    public readonly code: \"worker-error\" | \"timeout\",\n  ) {\n    super(message);\n    this.name = \"WorkerExecError\";\n  }\n}\n\nfunction clampTimeout(value: number | undefined): number {\n  const raw = value ?? DEFAULT_TIMEOUT_MS;\n  if (!Number.isFinite(raw)) {\n    return DEFAULT_TIMEOUT_MS;\n  }\n  return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/**\n * Resolve the directory the sandbox package's own dist sits in. The\n * temp bundle has to live somewhere Node's ESM resolver can walk UP\n * from to find `@directive-run/core` in node_modules; the sandbox\n * package's dist/ has that path because sandbox declares core as a\n * dependency. Writing the bundle next to dist/worker.js inherits the\n * same resolution chain.\n */\nasync function getSandboxPackageDir(): Promise<string> {\n  // Reuse the worker-resolution path so we land at the same package\n  // regardless of whether the consumer is in production or Vitest dev.\n  const workerPath = await resolveWorkerPath();\n  // dist/worker.js → ../ → package root.\n  return dirname(dirname(workerPath));\n}\n\n/**\n * Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL. Bare specifiers like `@directive-run/core`\n * don't resolve from `data:` URLs (no hierarchical base for\n * node_modules lookup) AND don't resolve from /tmp (no node_modules\n * to walk up to). Writing inside the sandbox package directory\n * inherits its node_modules chain.\n *\n * Caller MUST clean the directory up in a finally block.\n */\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n  bundlePath: string;\n  cleanup: () => void;\n}> {\n  const sandboxDir = await getSandboxPackageDir();\n  const dir = mkdtempSync(join(sandboxDir, \".sandbox-tmp-\"));\n  const bundlePath = join(dir, \"bundle.mjs\");\n  writeFileSync(bundlePath, bundledSource, \"utf8\");\n  return {\n    bundlePath,\n    cleanup: () => {\n      try {\n        rmSync(dir, { recursive: true, force: true });\n      } catch {\n        // best-effort\n      }\n    },\n  };\n}\n\nexport async function execInWorker(\n  input: HostRunInput,\n): Promise<SandboxResult> {\n  const timeoutMs = clampTimeout(input.timeoutMs);\n  const workerPath = await resolveWorkerPath();\n  const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n    input.bundledSource,\n  );\n  const worker = new Worker(workerPath, {\n    // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n    // without crowding the typical demo footprint (~2-5 MB).\n    resourceLimits: {\n      maxOldGenerationSizeMb: 32,\n      maxYoungGenerationSizeMb: 8,\n      codeRangeSizeMb: 16,\n    },\n    // Bypass stderr noise from the worker process showing up in the\n    // host's logs. The transcript captures everything we care about.\n    stderr: false,\n  });\n\n  let timer: NodeJS.Timeout | null = null;\n  let timedOut = false;\n  const startMs = Date.now();\n\n  try {\n    const result = await new Promise<SandboxResult>((resolve, reject) => {\n      let settled = false;\n\n      worker.once(\"message\", (msg: WorkerOutputMessage) => {\n        settled = true;\n        if (msg.ok) {\n          resolve(msg.result);\n        } else {\n          reject(new WorkerExecError(msg.error, \"worker-error\"));\n        }\n      });\n\n      worker.once(\"error\", (err: Error) => {\n        settled = true;\n        reject(new WorkerExecError(err.message, \"worker-error\"));\n      });\n\n      worker.once(\"exit\", (code) => {\n        if (!settled && code !== 0 && code !== null) {\n          reject(\n            new WorkerExecError(\n              `worker exited with code ${code} before responding`,\n              \"worker-error\",\n            ),\n          );\n        }\n      });\n\n      timer = setTimeout(() => {\n        timedOut = true;\n        worker.terminate();\n        reject(\n          new WorkerExecError(\n            `wall-clock budget of ${timeoutMs}ms elapsed`,\n            \"timeout\",\n          ),\n        );\n      }, timeoutMs);\n\n      const message: WorkerInputMessage = {\n        bundlePath: pathToFileURL(bundlePath).href,\n        timeoutMs,\n      };\n      worker.postMessage(message);\n    });\n\n    return result;\n  } catch (err) {\n    if (err instanceof WorkerExecError && err.code === \"timeout\") {\n      // The worker captured nothing because we killed it; surface\n      // structured timeout info to the caller.\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: Date.now() - startMs,\n        timedOut: true,\n      };\n    }\n    throw err;\n  } finally {\n    if (timer) {\n      clearTimeout(timer);\n    }\n    await worker.terminate().catch(() => undefined);\n    cleanupTempDir();\n    void timedOut;\n  }\n}\n","/**\n * Public types for `@directive-run/sandbox`.\n *\n * The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n */\n\nexport interface PlaygroundFile {\n  /**\n   * Relative path inside the project, e.g. \"src/main.ts\" or\n   * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n   * the entry point the runner targets.\n   */\n  path: string;\n  /** File contents. */\n  source: string;\n}\n\nexport interface RunInSandboxInput {\n  /** Single-file shortcut. Mapped onto \"src/main.ts\" internally. */\n  source?: string;\n  /** Multi-file payload (the `generate_module` paired output shape). */\n  files?: PlaygroundFile[];\n  /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */\n  timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n  /**\n   * Captured `console.log` / `console.warn` / `console.error` lines,\n   * in dispatch order. Each entry is the stringified arguments\n   * joined by \" \" (matches Node's default console format).\n   */\n  logs: string[];\n  /**\n   * Final `system.facts.$store.toObject()` snapshot at end-of-run.\n   * Empty when no system was constructed (e.g. validator rejection).\n   */\n  facts: Record<string, unknown>;\n  /**\n   * Structured error messages from validation, bundling, or runtime\n   * exceptions. Empty on a clean run.\n   */\n  errors: string[];\n  /** Elapsed wall-clock duration of the worker execution. */\n  durationMs: number;\n  /** True when the wall-clock budget elapsed before settle()/destroy(). */\n  timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n  | \"validation-failed\"\n  | \"bundle-failed\"\n  | \"worker-error\"\n  | \"timeout\"\n  | \"input-invalid\";\n\nexport class SandboxError extends Error {\n  constructor(\n    message: string,\n    public readonly code: SandboxErrorCode,\n  ) {\n    super(message);\n    this.name = \"SandboxError\";\n  }\n}\n\n/**\n * Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n */\nexport interface WorkerInputMessage {\n  /** `file://` URL of the temp .mjs bundle the host wrote. */\n  bundlePath: string;\n  timeoutMs: number;\n}\n\n/** Wire shape for messages from worker → host. */\nexport type WorkerOutputMessage =\n  | { ok: true; result: SandboxResult }\n  | { ok: false; error: string };\n","/**\n * AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n *\n * Allowlist:\n *\n * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,\n *   `query`) OR a relative path ending in `.js` (the multi-file\n *   payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n *   plus `console.*`, `Math.*`, `JSON.*`. Anything that touches\n *   global Node namespaces (`process`, `require`, `fs`, `child_process`,\n *   `net`, `dgram`, `cluster`, etc.) is rejected.\n *\n * Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n *\n * Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n */\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\nconst ALLOWED_IMPORT_PATTERNS: RegExp[] = [\n  /^@directive-run\\/(core|ai|query)(\\/.+)?$/,\n  /^\\.\\/.+\\.js$/,\n  /^\\.\\.\\/.+\\.js$/,\n];\n\n/**\n * Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n */\nconst ALLOWED_GLOBALS = new Set<string>([\n  // Directive runtime surface\n  \"createSystem\",\n  // We also allow the destructured exports the runner might use:\n  \"system\",\n  // Standard JS we'll let through\n  \"console\",\n  \"Math\",\n  \"JSON\",\n  \"Object\",\n  \"Array\",\n  \"Number\",\n  \"String\",\n  \"Boolean\",\n  \"Symbol\",\n  \"Promise\",\n  \"Error\",\n  \"Date\",\n  \"Map\",\n  \"Set\",\n  \"WeakMap\",\n  \"WeakSet\",\n  \"Reflect\",\n  \"globalThis\",\n  // Top-level await + iteration sugar\n  \"undefined\",\n  \"null\",\n  \"NaN\",\n  \"Infinity\",\n]);\n\n/**\n * Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n */\nconst DENIED_GLOBALS = new Set<string>([\n  \"process\",\n  \"require\",\n  \"module\",\n  \"__dirname\",\n  \"__filename\",\n  \"fetch\",\n  \"XMLHttpRequest\",\n  \"WebSocket\",\n  \"eval\",\n  \"Function\",\n  // The MCP server runs on Node; these are Node-only globals that\n  // bypass workers' resource isolation entirely.\n  \"Buffer\",\n  \"setImmediate\",\n  \"queueMicrotask\",\n  \"setTimeout\",\n  \"setInterval\",\n  \"clearTimeout\",\n  \"clearInterval\",\n]);\n\nexport interface ValidationError {\n  path: string;\n  line: number;\n  column: number;\n  message: string;\n}\n\nfunction checkImports(\n  fileLabel: string,\n  project: Project,\n  errors: ValidationError[],\n): void {\n  const sourceFile = project.getSourceFileOrThrow(fileLabel);\n  for (const decl of sourceFile.getImportDeclarations()) {\n    const moduleSpecifier = decl.getModuleSpecifierValue();\n    const allowed = ALLOWED_IMPORT_PATTERNS.some((re) =>\n      re.test(moduleSpecifier),\n    );\n    if (!allowed) {\n      const { line, column } = sourceFile.getLineAndColumnAtPos(\n        decl.getStart(),\n      );\n      errors.push({\n        path: fileLabel,\n        line,\n        column,\n        message: `import \"${moduleSpecifier}\" is not allowed in the sandbox. Allowed: @directive-run/{core,ai,query} or relative \"./X.js\" paths.`,\n      });\n    }\n  }\n}\n\nfunction checkDynamicImportsAndCalls(\n  fileLabel: string,\n  project: Project,\n  errors: ValidationError[],\n): void {\n  const sourceFile = project.getSourceFileOrThrow(fileLabel);\n  // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n  // `new Function(\"…\")` (string-to-code) at any depth.\n  sourceFile.forEachDescendant((node) => {\n    if (node.getKind() === SyntaxKind.ImportKeyword) {\n      const parent = node.getParent();\n      if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n        const { line, column } = sourceFile.getLineAndColumnAtPos(\n          node.getStart(),\n        );\n        errors.push({\n          path: fileLabel,\n          line,\n          column,\n          message: \"dynamic import() is not allowed in the sandbox\",\n        });\n      }\n    }\n    if (node.getKind() === SyntaxKind.NewExpression) {\n      const text = node.getText();\n      if (/^new\\s+Function\\s*\\(/.test(text)) {\n        const { line, column } = sourceFile.getLineAndColumnAtPos(\n          node.getStart(),\n        );\n        errors.push({\n          path: fileLabel,\n          line,\n          column,\n          message: \"new Function(...) is not allowed in the sandbox\",\n        });\n      }\n    }\n  });\n}\n\nfunction checkGlobalIdentifiers(\n  fileLabel: string,\n  project: Project,\n  errors: ValidationError[],\n): void {\n  const sourceFile = project.getSourceFileOrThrow(fileLabel);\n  // Walk every Identifier and check whether it resolves to a\n  // top-level binding. We only care about the \"free\" identifiers —\n  // ones the snippet didn't declare via import, var/let/const, or\n  // function/class declaration. Those are globals.\n  const localBindings = new Set<string>();\n  for (const decl of sourceFile.getImportDeclarations()) {\n    for (const n of decl.getNamedImports()) {\n      localBindings.add(n.getName());\n    }\n    const def = decl.getDefaultImport();\n    if (def) localBindings.add(def.getText());\n    const ns = decl.getNamespaceImport();\n    if (ns) localBindings.add(ns.getText());\n  }\n  for (const v of sourceFile.getVariableDeclarations()) {\n    localBindings.add(v.getName());\n  }\n  for (const f of sourceFile.getFunctions()) {\n    const name = f.getName();\n    if (name) localBindings.add(name);\n  }\n  for (const c of sourceFile.getClasses()) {\n    const name = c.getName();\n    if (name) localBindings.add(name);\n  }\n\n  sourceFile.forEachDescendant((node) => {\n    if (node.getKind() !== SyntaxKind.Identifier) {\n      return;\n    }\n    const name = node.getText();\n    if (localBindings.has(name)) {\n      return;\n    }\n    if (ALLOWED_GLOBALS.has(name)) {\n      return;\n    }\n\n    // Skip identifiers in non-reference positions where the name is\n    // just a label, not a binding reference:\n    //\n    // - Property-assignment KEYS in object literals: `{ module: x }`\n    //   — the LHS `module` is a label, not a reference to Node's `module`.\n    // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n    // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n    //   ts-morph's ShorthandPropertyAssignment parents that case, so we\n    //   only filter PropertyAssignment.name and PropertyAccessExpression.name.\n    // - Type-annotation positions: `let x: foo` — `foo` is a type.\n    // - Import/export specifier names.\n    const parent = node.getParent();\n    if (parent) {\n      const parentKind = parent.getKind();\n      // `{ module: x }` — name child of a PropertyAssignment.\n      if (parentKind === SyntaxKind.PropertyAssignment) {\n        const propertyName = (\n          parent as { getNameNode?: () => unknown }\n        ).getNameNode?.();\n        if (propertyName === node) {\n          return;\n        }\n      }\n      // `obj.foo` — `foo` is the .name on the right of a dot.\n      if (parentKind === SyntaxKind.PropertyAccessExpression) {\n        const accessName = (\n          parent as { getNameNode?: () => unknown }\n        ).getNameNode?.();\n        if (accessName === node) {\n          return;\n        }\n      }\n      // `{ foo: bar }` LHS for shorthand-style method declarations.\n      if (parentKind === SyntaxKind.MethodDeclaration) {\n        return;\n      }\n      // import { foo } / import { foo as bar } / export { foo }\n      if (\n        parentKind === SyntaxKind.ImportSpecifier ||\n        parentKind === SyntaxKind.ExportSpecifier ||\n        parentKind === SyntaxKind.NamespaceImport ||\n        parentKind === SyntaxKind.ImportClause\n      ) {\n        return;\n      }\n      // Function/method parameter names.\n      if (parentKind === SyntaxKind.Parameter) {\n        return;\n      }\n      // Type references — `let x: foo` etc.\n      if (\n        parentKind === SyntaxKind.TypeReference ||\n        parentKind === SyntaxKind.TypeQuery\n      ) {\n        return;\n      }\n    }\n\n    if (DENIED_GLOBALS.has(name)) {\n      const { line, column } = sourceFile.getLineAndColumnAtPos(\n        node.getStart(),\n      );\n      errors.push({\n        path: fileLabel,\n        line,\n        column,\n        message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n      });\n    }\n    // We don't reject unknown identifiers — they might be legitimate\n    // members of an allowlist-imported binding (e.g. `system.events.foo`\n    // — `foo` is an identifier in property-access position). The\n    // import + denylist + dynamic-import check above already covers\n    // the actual escape paths.\n  });\n}\n\nexport function validateSandboxInput(\n  files: PlaygroundFile[],\n): ValidationError[] {\n  const errors: ValidationError[] = [];\n  const project = new Project({\n    useInMemoryFileSystem: true,\n    compilerOptions: {\n      target: 99, // ESNext\n      module: 99, // ESNext\n      allowJs: true,\n      strict: false,\n    },\n  });\n\n  for (const file of files) {\n    project.createSourceFile(file.path, file.source, { overwrite: true });\n  }\n\n  for (const file of files) {\n    checkImports(file.path, project, errors);\n    checkDynamicImportsAndCalls(file.path, project, errors);\n    checkGlobalIdentifiers(file.path, project, errors);\n  }\n\n  return errors;\n}\n"],"mappings":"0jBAAA,IAAAA,GAAA,GAAAC,EAAAD,GAAA,kBAAAE,EAAA,iBAAAC,KAAA,eAAAC,EAAAJ,ICgBA,IAAAK,EAAsB,mBAGhBC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,EAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CAgGF,IAAMC,GA/FS,QAAM,SAAM,CACzB,YAAa,CAAC,GAAGf,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SACV,SAAU,CACR,sBACA,oBACA,sBACF,EAGA,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAExC,MAAO,CAAE,SAAU,GAAM,KAAMA,EAAK,IAAK,EAE3C,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,EAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CC7LA,IAAAC,EAAmD,cACnDC,EAA8B,gBAC9BC,EAA8B,eAC9BC,EAAuB,0BAfvBC,EAAA,GAsBMC,EAAiB,IACjBC,EAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAcL,EAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CAOO,IAAMM,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,EAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,EAAgB,KAAK,IAAID,EAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CAUA,eAAeS,GAAwC,CAGrD,IAAMC,EAAa,MAAMT,EAAkB,EAE3C,SAAO,cAAQ,WAAQS,CAAU,CAAC,CACpC,CAYA,eAAeC,EAAkBC,EAG9B,CACD,IAAMC,EAAa,MAAMJ,EAAqB,EACxCK,KAAM,kBAAY,QAAKD,EAAY,eAAe,CAAC,EACnDE,KAAa,QAAKD,EAAK,YAAY,EACzC,0BAAcC,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,IACF,UAAOD,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYZ,EAAaW,EAAM,SAAS,EACxCP,EAAa,MAAMT,EAAkB,EACrC,CAAE,WAAAc,EAAY,QAASI,CAAe,EAAI,MAAMR,EACpDM,EAAM,aACR,EACMG,EAAS,IAAI,SAAOV,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CA+CF,OA9Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAItB,EAAgBwB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAItB,EAAgByB,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAASf,GAAS,CACxB,CAACqB,GAAWrB,IAAS,GAAKA,IAAS,MACrCoB,EACE,IAAItB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDgB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAItB,EACF,wBAAwBe,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMd,EAA8B,CAClC,cAAY,iBAAcW,CAAU,EAAE,KACtC,UAAAG,CACF,EACAE,EAAO,YAAYhB,CAAO,CAC5B,CAAC,CAGH,OAASwB,EAAK,CACZ,GAAIA,aAAezB,GAAmByB,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC5IO,IAAMU,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,EC3CA,IAAAC,EAAoC,oBAG9BC,EAAoC,CACxC,2CACA,eACA,gBACF,EAQMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EAIrD,GAAI,CAHYR,EAAwB,KAAMU,GAC5CA,EAAG,KAAKD,CAAe,CACzB,EACc,CACZ,GAAM,CAAE,KAAAE,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,WAAWH,CAAe,sGACrC,CAAC,CACH,CACF,CACF,CAEA,SAASI,GACPT,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBO,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAMC,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAM,aAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAJ,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCO,EAAK,SAAS,CAChB,EACAR,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAME,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCO,EAAK,SAAS,CAChB,EACAR,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAEA,SAASK,GACPb,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnDc,EAAgB,IAAI,IAC1B,QAAWV,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAWY,KAAKX,EAAK,gBAAgB,EACnCU,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAMZ,EAAK,iBAAiB,EAC9BY,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAKb,EAAK,mBAAmB,EAC/Ba,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAKf,EAAW,wBAAwB,EACjDW,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhB,EAAW,aAAa,EAAG,CACzC,IAAMiB,EAAOD,EAAE,QAAQ,EACnBC,GAAMN,EAAc,IAAIM,CAAI,CAClC,CACA,QAAWC,KAAKlB,EAAW,WAAW,EAAG,CACvC,IAAMiB,EAAOC,EAAE,QAAQ,EACnBD,GAAMN,EAAc,IAAIM,CAAI,CAClC,CAEAjB,EAAW,kBAAmBO,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,WAChC,OAEF,IAAMU,EAAOV,EAAK,QAAQ,EAI1B,GAHII,EAAc,IAAIM,CAAI,GAGtBvB,EAAgB,IAAIuB,CAAI,EAC1B,OAcF,IAAMT,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAMW,EAAaX,EAAO,QAAQ,EAqClC,GAnCIW,IAAe,aAAW,oBAE1BX,EACA,cAAc,IACKD,GAKnBY,IAAe,aAAW,0BAE1BX,EACA,cAAc,IACGD,GAKjBY,IAAe,aAAW,mBAK5BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,cAKxBA,IAAe,aAAW,WAK5BA,IAAe,aAAW,eAC1BA,IAAe,aAAW,UAE1B,MAEJ,CAEA,GAAIxB,EAAe,IAAIsB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAb,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCO,EAAK,SAAS,CAChB,EACAR,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,eAAeY,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASG,EACdC,EACmB,CACnB,IAAMtB,EAA4B,CAAC,EAC7BD,EAAU,IAAI,UAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWwB,KAAQD,EACjBvB,EAAQ,iBAAiBwB,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBzB,GAAa0B,EAAK,KAAMxB,EAASC,CAAM,EACvCO,GAA4BgB,EAAK,KAAMxB,EAASC,CAAM,EACtDW,GAAuBY,EAAK,KAAMxB,EAASC,CAAM,EAGnD,OAAOA,CACT,CJzRA,IAAMwB,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAGF,IAAIC,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBV,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeM,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACN,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAKF,OAJe,MAAMO,EAAa,CAChC,cAAeH,EAAQ,OACvB,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["src_exports","__export","SandboxError","runInSandbox","__toCommonJS","import_esbuild","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","import_node_fs","import_node_path","import_node_url","import_node_worker_threads","import_meta","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getSandboxPackageDir","workerPath","writeBundleToTemp","bundledSource","sandboxDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","SandboxError","message","code","import_ts_morph","ALLOWED_IMPORT_PATTERNS","ALLOWED_GLOBALS","DENIED_GLOBALS","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","re","line","column","checkDynamicImportsAndCalls","node","parent","text","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","name","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}

package/dist/index.d.cts

@@ -0,0 +1,107 @@
+/**
+ * Public types for `@directive-run/sandbox`.
+ *
+ * The package executes user-supplied Directive snippets in a bounded
+ * worker_threads sandbox and returns a structured transcript. The
+ * shape below is what the MCP `run_in_sandbox` tool returns to the
+ * AI client and what `directive.run/playground`'s `/api/run-sandbox`
+ * route serializes to JSON.
+ */
+interface PlaygroundFile {
+    /**
+     * Relative path inside the project, e.g. "src/main.ts" or
+     * "src/counter.ts". One file should be "src/main.ts" — that's
+     * the entry point the runner targets.
+     */
+    path: string;
+    /** File contents. */
+    source: string;
+}
+interface RunInSandboxInput {
+    /** Single-file shortcut. Mapped onto "src/main.ts" internally. */
+    source?: string;
+    /** Multi-file payload (the `generate_module` paired output shape). */
+    files?: PlaygroundFile[];
+    /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */
+    timeoutMs?: number;
+}
+interface SandboxResult {
+    /**
+     * Captured `console.log` / `console.warn` / `console.error` lines,
+     * in dispatch order. Each entry is the stringified arguments
+     * joined by " " (matches Node's default console format).
+     */
+    logs: string[];
+    /**
+     * Final `system.facts.$store.toObject()` snapshot at end-of-run.
+     * Empty when no system was constructed (e.g. validator rejection).
+     */
+    facts: Record<string, unknown>;
+    /**
+     * Structured error messages from validation, bundling, or runtime
+     * exceptions. Empty on a clean run.
+     */
+    errors: string[];
+    /** Elapsed wall-clock duration of the worker execution. */
+    durationMs: number;
+    /** True when the wall-clock budget elapsed before settle()/destroy(). */
+    timedOut: boolean;
+}
+type SandboxErrorCode = "validation-failed" | "bundle-failed" | "worker-error" | "timeout" | "input-invalid";
+declare class SandboxError extends Error {
+    readonly code: SandboxErrorCode;
+    constructor(message: string, code: SandboxErrorCode);
+}
+
+/**
+ * AST allowlist validator. Pre-flights every file in the payload
+ * BEFORE the bundler so a hostile snippet never reaches the runtime
+ * surface. Without this layer, `worker_threads` resource limits
+ * (heap-only) leak FS + network access through — a snippet that
+ * `import("node:fs")` would still pwn the host process.
+ *
+ * Allowlist:
+ *
+ * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,
+ *   `query`) OR a relative path ending in `.js` (the multi-file
+ *   payload's own files).
+ * - Identifier accesses: only the allowlisted Directive API surface
+ *   plus `console.*`, `Math.*`, `JSON.*`. Anything that touches
+ *   global Node namespaces (`process`, `require`, `fs`, `child_process`,
+ *   `net`, `dgram`, `cluster`, etc.) is rejected.
+ *
+ * Strict by default — we'd rather reject a valid pattern (and learn
+ * about it via a real-world report) than ship a "mostly safe" sandbox.
+ * The Phase 2 plan calls out that we expand based on actual failures.
+ *
+ * Returns the list of validation errors; an empty list means safe to
+ * bundle + execute. Callers should bail on any non-empty result.
+ */
+
+interface ValidationError {
+    path: string;
+    line: number;
+    column: number;
+    message: string;
+}
+
+/**
+ * Public API for `@directive-run/sandbox`.
+ *
+ * Single entry point: `runInSandbox({files, timeoutMs})` validates the
+ * payload against the AST allowlist, bundles the multi-file payload via
+ * esbuild, and executes the result in a bounded worker_threads sandbox.
+ * Returns a structured `SandboxResult` with captured logs, the final
+ * facts snapshot, and any errors that occurred at any stage.
+ *
+ * Consumers:
+ *
+ * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the
+ *   result to AI clients alongside a `playground_link` URL.
+ * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this
+ *   for the playground page's live DevTools transcript view.
+ */
+
+declare function runInSandbox(input: RunInSandboxInput): Promise<SandboxResult>;
+
+export { type PlaygroundFile, type RunInSandboxInput, SandboxError, type SandboxResult, type ValidationError, runInSandbox };

package/dist/index.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Public types for `@directive-run/sandbox`.
+ *
+ * The package executes user-supplied Directive snippets in a bounded
+ * worker_threads sandbox and returns a structured transcript. The
+ * shape below is what the MCP `run_in_sandbox` tool returns to the
+ * AI client and what `directive.run/playground`'s `/api/run-sandbox`
+ * route serializes to JSON.
+ */
+interface PlaygroundFile {
+    /**
+     * Relative path inside the project, e.g. "src/main.ts" or
+     * "src/counter.ts". One file should be "src/main.ts" — that's
+     * the entry point the runner targets.
+     */
+    path: string;
+    /** File contents. */
+    source: string;
+}
+interface RunInSandboxInput {
+    /** Single-file shortcut. Mapped onto "src/main.ts" internally. */
+    source?: string;
+    /** Multi-file payload (the `generate_module` paired output shape). */
+    files?: PlaygroundFile[];
+    /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */
+    timeoutMs?: number;
+}
+interface SandboxResult {
+    /**
+     * Captured `console.log` / `console.warn` / `console.error` lines,
+     * in dispatch order. Each entry is the stringified arguments
+     * joined by " " (matches Node's default console format).
+     */
+    logs: string[];
+    /**
+     * Final `system.facts.$store.toObject()` snapshot at end-of-run.
+     * Empty when no system was constructed (e.g. validator rejection).
+     */
+    facts: Record<string, unknown>;
+    /**
+     * Structured error messages from validation, bundling, or runtime
+     * exceptions. Empty on a clean run.
+     */
+    errors: string[];
+    /** Elapsed wall-clock duration of the worker execution. */
+    durationMs: number;
+    /** True when the wall-clock budget elapsed before settle()/destroy(). */
+    timedOut: boolean;
+}
+type SandboxErrorCode = "validation-failed" | "bundle-failed" | "worker-error" | "timeout" | "input-invalid";
+declare class SandboxError extends Error {
+    readonly code: SandboxErrorCode;
+    constructor(message: string, code: SandboxErrorCode);
+}
+
+/**
+ * AST allowlist validator. Pre-flights every file in the payload
+ * BEFORE the bundler so a hostile snippet never reaches the runtime
+ * surface. Without this layer, `worker_threads` resource limits
+ * (heap-only) leak FS + network access through — a snippet that
+ * `import("node:fs")` would still pwn the host process.
+ *
+ * Allowlist:
+ *
+ * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,
+ *   `query`) OR a relative path ending in `.js` (the multi-file
+ *   payload's own files).
+ * - Identifier accesses: only the allowlisted Directive API surface
+ *   plus `console.*`, `Math.*`, `JSON.*`. Anything that touches
+ *   global Node namespaces (`process`, `require`, `fs`, `child_process`,
+ *   `net`, `dgram`, `cluster`, etc.) is rejected.
+ *
+ * Strict by default — we'd rather reject a valid pattern (and learn
+ * about it via a real-world report) than ship a "mostly safe" sandbox.
+ * The Phase 2 plan calls out that we expand based on actual failures.
+ *
+ * Returns the list of validation errors; an empty list means safe to
+ * bundle + execute. Callers should bail on any non-empty result.
+ */
+
+interface ValidationError {
+    path: string;
+    line: number;
+    column: number;
+    message: string;
+}
+
+/**
+ * Public API for `@directive-run/sandbox`.
+ *
+ * Single entry point: `runInSandbox({files, timeoutMs})` validates the
+ * payload against the AST allowlist, bundles the multi-file payload via
+ * esbuild, and executes the result in a bounded worker_threads sandbox.
+ * Returns a structured `SandboxResult` with captured logs, the final
+ * facts snapshot, and any errors that occurred at any stage.
+ *
+ * Consumers:
+ *
+ * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the
+ *   result to AI clients alongside a `playground_link` URL.
+ * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this
+ *   for the playground page's live DevTools transcript view.
+ */
+
+declare function runInSandbox(input: RunInSandboxInput): Promise<SandboxResult>;
+
+export { type PlaygroundFile, type RunInSandboxInput, SandboxError, type SandboxResult, type ValidationError, runInSandbox };

package/dist/index.js

@@ -0,0 +1,5 @@
+import{build as _}from"esbuild";var w="src/main.ts",g="directive-sandbox-vfs",p=class extends Error{constructor(n,e){super(n);this.cause=e;this.name="BundleError"}};function F(t){let o=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,n=t.match(o);if(!n)return t;let e=n[1],s=`
+(globalThis).__directiveSandbox_system__ = ${n[2]};
+`;return t.replace(e,e+s)}async function S(t){if(!t.find(e=>e.path===w))throw new p(`payload must include "${w}" \u2014 that's the entry point the runner targets`);let n=new Map;for(let e of t)n.set(e.path,e.source);try{let r=(await _({entryPoints:[`${g}:${w}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/core","@directive-run/ai","@directive-run/query"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(u){u.onResolve({filter:/.*/},i=>{if(i.kind==="entry-point")return{path:i.path.replace(`${g}:`,""),namespace:g};if(i.namespace!==g)return null;if(i.path.startsWith("@directive-run/"))return{external:!0,path:i.path};if(i.path.startsWith("./")||i.path.startsWith("../")){let a=i.importer.replace(/\/[^/]+$/,""),c=i.path.replace(/^\.\//,"").replace(/\.js$/,""),y=[`${a}/${c}.ts`,`${a}/${c}.js`,`${a}/${c}`,`${c}.ts`,`${c}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of y)if(n.has(m))return{path:m,namespace:g};throw new p(`cannot resolve "${i.path}" from "${i.importer}" \u2014 tried ${y.join(", ")}`)}throw new p(`unexpected import "${i.path}" from "${i.importer}" \u2014 only relative or @directive-run/* allowed`)}),u.onLoad({filter:/.*/,namespace:g},i=>{let a=n.get(i.path);if(a===void 0)throw new p(`virtual file missing: ${i.path}`);if(i.path===w){let c=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {","  (globalThis).__directiveSandbox_system__ = system;","}"].join(`
+`);return{contents:a+c,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!r)throw new p("esbuild produced no output");let s=F(r);return{source:s,bytes:Buffer.byteLength(s,"utf8")}}catch(e){throw e instanceof p?e:new p(`bundle failed: ${e.message??String(e)}`,e)}}import{mkdtempSync as A,rmSync as R,writeFileSync as O}from"fs";import{dirname as v,join as M}from"path";import{pathToFileURL as D}from"url";import{Worker as j}from"worker_threads";var L=100,W=1e4,I=5e3;async function P(){let{createRequire:t}=await import("module");return t(import.meta.url).resolve("@directive-run/sandbox/worker")}var h=class extends Error{constructor(n,e){super(n);this.code=e;this.name="WorkerExecError"}};function B(t){let o=t??I;return Number.isFinite(o)?Math.min(W,Math.max(L,Math.floor(o))):I}async function C(){let t=await P();return v(v(t))}async function V(t){let o=await C(),n=A(M(o,".sandbox-tmp-")),e=M(n,"bundle.mjs");return O(e,t,"utf8"),{bundlePath:e,cleanup:()=>{try{R(n,{recursive:!0,force:!0})}catch{}}}}async function E(t){let o=B(t.timeoutMs),n=await P(),{bundlePath:e,cleanup:r}=await V(t.bundledSource),s=new j(n,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),u=null,i=!1,a=Date.now();try{return await new Promise((y,m)=>{let b=!1;s.once("message",f=>{b=!0,f.ok?y(f.result):m(new h(f.error,"worker-error"))}),s.once("error",f=>{b=!0,m(new h(f.message,"worker-error"))}),s.once("exit",f=>{!b&&f!==0&&f!==null&&m(new h(`worker exited with code ${f} before responding`,"worker-error"))}),u=setTimeout(()=>{i=!0,s.terminate(),m(new h(`wall-clock budget of ${o}ms elapsed`,"timeout"))},o);let N={bundlePath:D(e).href,timeoutMs:o};s.postMessage(N)})}catch(c){if(c instanceof h&&c.code==="timeout")return{logs:[],facts:{},errors:[c.message],durationMs:Date.now()-a,timedOut:!0};throw c}finally{u&&clearTimeout(u),await s.terminate().catch(()=>{}),r()}}var d=class extends Error{constructor(n,e){super(n);this.code=e;this.name="SandboxError"}};import{Project as q,SyntaxKind as l}from"ts-morph";var K=[/^@directive-run\/(core|ai|query)(\/.+)?$/,/^\.\/.+\.js$/,/^\.\.\/.+\.js$/],U=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),G=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function H(t,o,n){let e=o.getSourceFileOrThrow(t);for(let r of e.getImportDeclarations()){let s=r.getModuleSpecifierValue();if(!K.some(i=>i.test(s))){let{line:i,column:a}=e.getLineAndColumnAtPos(r.getStart());n.push({path:t,line:i,column:a,message:`import "${s}" is not allowed in the sandbox. Allowed: @directive-run/{core,ai,query} or relative "./X.js" paths.`})}}}function X(t,o,n){let e=o.getSourceFileOrThrow(t);e.forEachDescendant(r=>{if(r.getKind()===l.ImportKeyword){let s=r.getParent();if(s&&s.getKind()===l.CallExpression){let{line:u,column:i}=e.getLineAndColumnAtPos(r.getStart());n.push({path:t,line:u,column:i,message:"dynamic import() is not allowed in the sandbox"})}}if(r.getKind()===l.NewExpression){let s=r.getText();if(/^new\s+Function\s*\(/.test(s)){let{line:u,column:i}=e.getLineAndColumnAtPos(r.getStart());n.push({path:t,line:u,column:i,message:"new Function(...) is not allowed in the sandbox"})}}})}function z(t,o,n){let e=o.getSourceFileOrThrow(t),r=new Set;for(let s of e.getImportDeclarations()){for(let a of s.getNamedImports())r.add(a.getName());let u=s.getDefaultImport();u&&r.add(u.getText());let i=s.getNamespaceImport();i&&r.add(i.getText())}for(let s of e.getVariableDeclarations())r.add(s.getName());for(let s of e.getFunctions()){let u=s.getName();u&&r.add(u)}for(let s of e.getClasses()){let u=s.getName();u&&r.add(u)}e.forEachDescendant(s=>{if(s.getKind()!==l.Identifier)return;let u=s.getText();if(r.has(u)||U.has(u))return;let i=s.getParent();if(i){let a=i.getKind();if(a===l.PropertyAssignment&&i.getNameNode?.()===s||a===l.PropertyAccessExpression&&i.getNameNode?.()===s||a===l.MethodDeclaration||a===l.ImportSpecifier||a===l.ExportSpecifier||a===l.NamespaceImport||a===l.ImportClause||a===l.Parameter||a===l.TypeReference||a===l.TypeQuery)return}if(G.has(u)){let{line:a,column:c}=e.getLineAndColumnAtPos(s.getStart());n.push({path:t,line:a,column:c,message:`identifier "${u}" is denied in the sandbox (FS/network/eval surface)`})}})}function k(t){let o=[],n=new q({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let e of t)n.createSourceFile(e.path,e.source,{overwrite:!0});for(let e of t)H(e.path,n,o),X(e.path,n,o),z(e.path,n,o);return o}var $=2e5,T=10,x="src/main.ts";function Y(t){if(t.files&&t.source)throw new d("pass either `source` or `files`, not both","input-invalid");if(!t.files&&!t.source)throw new d("must pass either `source` or `files`","input-invalid");let o=t.files?t.files:[{path:x,source:t.source??""}];if(o.length===0)throw new d("files array is empty","input-invalid");if(o.length>T)throw new d(`payload exceeds ${T} files`,"input-invalid");let n=0;for(let e of o){if(typeof e.path!="string"||e.path.length===0)throw new d("every file must have a non-empty path","input-invalid");if(typeof e.source!="string"||e.source.length===0)throw new d(`file "${e.path}" has empty source`,"input-invalid");n+=Buffer.byteLength(e.source,"utf8")}if(n>$)throw new d(`total payload is ${n} bytes (max ${$})`,"input-invalid");if(!o.some(e=>e.path===x))throw new d(`payload must include "${x}" \u2014 the runner entry point`,"input-invalid");return o}async function de(t){let o;try{o=Y(t)}catch(r){if(r instanceof d)return{logs:[],facts:{},errors:[r.message],durationMs:0,timedOut:!1};throw r}let n=k(o);if(n.length>0)return{logs:[],facts:{},errors:n.map(r=>`${r.path}:${r.line}:${r.column} \u2014 ${r.message}`),durationMs:0,timedOut:!1};let e;try{e=await S(o)}catch(r){if(r instanceof p)return{logs:[],facts:{},errors:[r.message],durationMs:0,timedOut:!1};throw r}try{return await E({bundledSource:e.source,timeoutMs:t.timeoutMs})}catch(r){if(r instanceof h)return{logs:[],facts:{},errors:[r.message],durationMs:0,timedOut:r.code==="timeout"};throw r}}export{d as SandboxError,de as runInSandbox};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bundler.ts","../src/host.ts","../src/types.ts","../src/validator.ts","../src/index.ts"],"sourcesContent":["/**\n * esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n *\n * `@directive-run/*` packages are marked **external** — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n *\n * The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n */\n\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n  /** Single ESM string ready to evaluate inside the worker. */\n  source: string;\n  /** Total bytes of the bundled JS (informational). */\n  bytes: number;\n}\n\nexport class BundleError extends Error {\n  constructor(\n    message: string,\n    public readonly cause?: unknown,\n  ) {\n    super(message);\n    this.name = \"BundleError\";\n  }\n}\n\n/**\n * Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n *\n * esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n *\n *   var system = createSystem({ ... });\n *   var system2 = createSystem({ ... });   // when \"system\" collides\n *\n * The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n */\nfunction injectEarlyCapture(bundled: string): string {\n  const re = /(var\\s+(system\\d*)\\s*=\\s*createSystem\\s*\\([\\s\\S]*?\\)\\s*;)/;\n  const match = bundled.match(re);\n  if (!match) {\n    return bundled;\n  }\n  const decl = match[1]!;\n  const localName = match[2]!;\n  const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n  return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n  files: PlaygroundFile[],\n): Promise<BundleResult> {\n  const entry = files.find((f) => f.path === ENTRY_PATH);\n  if (!entry) {\n    throw new BundleError(\n      `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n    );\n  }\n\n  const fileMap = new Map<string, string>();\n  for (const file of files) {\n    fileMap.set(file.path, file.source);\n  }\n\n  try {\n    const result = await build({\n      entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n      bundle: true,\n      format: \"esm\",\n      target: \"node20\",\n      platform: \"node\",\n      write: false,\n      logLevel: \"silent\",\n      external: [\n        \"@directive-run/core\",\n        \"@directive-run/ai\",\n        \"@directive-run/query\",\n      ],\n      // Top-level await is required (the runner does `await system.settle()`)\n      // and node20 supports it natively.\n      supported: { \"top-level-await\": true },\n      plugins: [\n        {\n          name: \"directive-sandbox-vfs\",\n          setup(b) {\n            b.onResolve({ filter: /.*/ }, (args) => {\n              if (args.kind === \"entry-point\") {\n                const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n                return { path, namespace: VIRTUAL_NAMESPACE };\n              }\n              if (args.namespace !== VIRTUAL_NAMESPACE) {\n                return null;\n              }\n              if (args.path.startsWith(\"@directive-run/\")) {\n                // External — let esbuild's external list handle it.\n                return { external: true, path: args.path };\n              }\n              if (args.path.startsWith(\"./\") || args.path.startsWith(\"../\")) {\n                // Resolve relative to the importer's path.\n                const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n                // The runner imports `./counter.js`; the actual virtual\n                // file lives at `src/counter.ts`. Strip the `.js` and\n                // try both extensions so users can write either.\n                const stripped = args.path\n                  .replace(/^\\.\\//, \"\")\n                  .replace(/\\.js$/, \"\");\n                const candidates = [\n                  `${importerDir}/${stripped}.ts`,\n                  `${importerDir}/${stripped}.js`,\n                  `${importerDir}/${stripped}`,\n                  // Also try the raw path in case the importer's dir\n                  // resolution misses the leading slash.\n                  `${stripped}.ts`,\n                  `${stripped}.js`,\n                ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n                for (const candidate of candidates) {\n                  if (fileMap.has(candidate)) {\n                    return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n                  }\n                }\n                throw new BundleError(\n                  `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n                );\n              }\n              throw new BundleError(\n                `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n              );\n            });\n            b.onLoad({ filter: /.*/, namespace: VIRTUAL_NAMESPACE }, (args) => {\n              const contents = fileMap.get(args.path);\n              if (contents === undefined) {\n                throw new BundleError(`virtual file missing: ${args.path}`);\n              }\n              // For the entry file, append a trailing assignment so the\n              // runner's top-level `const system = …` binding ends up on\n              // a side-channel global the worker reads after execution.\n              // ESM module exports are sealed, so we can't patch\n              // `createSystem` post-import; instead we lift the binding\n              // out of the entry module's scope here. The convention is\n              // documented by `@directive-run/scaffold`'s `generateRunner`\n              // which always names the local binding `system`.\n              if (args.path === ENTRY_PATH) {\n                const epilogue = [\n                  \"\",\n                  \"// directive-sandbox: lift the runner's `system` binding\",\n                  \"// onto a side-channel global so the worker can read\",\n                  \"// system.facts.$store.toObject() after execution.\",\n                  \"if (typeof system !== 'undefined') {\",\n                  \"  (globalThis).__directiveSandbox_system__ = system;\",\n                  \"}\",\n                ].join(\"\\n\");\n                return { contents: contents + epilogue, loader: \"ts\" };\n              }\n              return { contents, loader: \"ts\" };\n            });\n          },\n        },\n      ],\n    });\n    const rawSource = result.outputFiles[0]?.text;\n    if (!rawSource) {\n      throw new BundleError(\"esbuild produced no output\");\n    }\n    // Inject an early-capture immediately after `createSystem(...)` so\n    // the worker can read facts even when subsequent runner code throws\n    // (e.g. an async settle() rejection from a bad event payload). The\n    // entry-file epilogue (appended in onLoad) only fires on a clean\n    // run; this regex fires regardless. Idempotent — duplicate\n    // assignments to the same global are harmless.\n    const source = injectEarlyCapture(rawSource);\n    return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n  } catch (err) {\n    if (err instanceof BundleError) {\n      throw err;\n    }\n    throw new BundleError(\n      `bundle failed: ${(err as Error).message ?? String(err)}`,\n      err,\n    );\n  }\n}\n","/**\n * Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n *\n * Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n */\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n  SandboxResult,\n  WorkerInputMessage,\n  WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n  // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n  // shim of import.meta exposes a `resolve` that isn't callable, and\n  // `createRequire` works in both real Node ESM and Vitest dev mode.\n  // The worker subpath export points at dist/worker.js; CJS resolution\n  // picks up the \"default\" condition we set in package.json.\n  const { createRequire } = await import(\"node:module\");\n  const require = createRequire(import.meta.url);\n  return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n  bundledSource: string;\n  timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n  constructor(\n    message: string,\n    public readonly code: \"worker-error\" | \"timeout\",\n  ) {\n    super(message);\n    this.name = \"WorkerExecError\";\n  }\n}\n\nfunction clampTimeout(value: number | undefined): number {\n  const raw = value ?? DEFAULT_TIMEOUT_MS;\n  if (!Number.isFinite(raw)) {\n    return DEFAULT_TIMEOUT_MS;\n  }\n  return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/**\n * Resolve the directory the sandbox package's own dist sits in. The\n * temp bundle has to live somewhere Node's ESM resolver can walk UP\n * from to find `@directive-run/core` in node_modules; the sandbox\n * package's dist/ has that path because sandbox declares core as a\n * dependency. Writing the bundle next to dist/worker.js inherits the\n * same resolution chain.\n */\nasync function getSandboxPackageDir(): Promise<string> {\n  // Reuse the worker-resolution path so we land at the same package\n  // regardless of whether the consumer is in production or Vitest dev.\n  const workerPath = await resolveWorkerPath();\n  // dist/worker.js → ../ → package root.\n  return dirname(dirname(workerPath));\n}\n\n/**\n * Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL. Bare specifiers like `@directive-run/core`\n * don't resolve from `data:` URLs (no hierarchical base for\n * node_modules lookup) AND don't resolve from /tmp (no node_modules\n * to walk up to). Writing inside the sandbox package directory\n * inherits its node_modules chain.\n *\n * Caller MUST clean the directory up in a finally block.\n */\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n  bundlePath: string;\n  cleanup: () => void;\n}> {\n  const sandboxDir = await getSandboxPackageDir();\n  const dir = mkdtempSync(join(sandboxDir, \".sandbox-tmp-\"));\n  const bundlePath = join(dir, \"bundle.mjs\");\n  writeFileSync(bundlePath, bundledSource, \"utf8\");\n  return {\n    bundlePath,\n    cleanup: () => {\n      try {\n        rmSync(dir, { recursive: true, force: true });\n      } catch {\n        // best-effort\n      }\n    },\n  };\n}\n\nexport async function execInWorker(\n  input: HostRunInput,\n): Promise<SandboxResult> {\n  const timeoutMs = clampTimeout(input.timeoutMs);\n  const workerPath = await resolveWorkerPath();\n  const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n    input.bundledSource,\n  );\n  const worker = new Worker(workerPath, {\n    // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n    // without crowding the typical demo footprint (~2-5 MB).\n    resourceLimits: {\n      maxOldGenerationSizeMb: 32,\n      maxYoungGenerationSizeMb: 8,\n      codeRangeSizeMb: 16,\n    },\n    // Bypass stderr noise from the worker process showing up in the\n    // host's logs. The transcript captures everything we care about.\n    stderr: false,\n  });\n\n  let timer: NodeJS.Timeout | null = null;\n  let timedOut = false;\n  const startMs = Date.now();\n\n  try {\n    const result = await new Promise<SandboxResult>((resolve, reject) => {\n      let settled = false;\n\n      worker.once(\"message\", (msg: WorkerOutputMessage) => {\n        settled = true;\n        if (msg.ok) {\n          resolve(msg.result);\n        } else {\n          reject(new WorkerExecError(msg.error, \"worker-error\"));\n        }\n      });\n\n      worker.once(\"error\", (err: Error) => {\n        settled = true;\n        reject(new WorkerExecError(err.message, \"worker-error\"));\n      });\n\n      worker.once(\"exit\", (code) => {\n        if (!settled && code !== 0 && code !== null) {\n          reject(\n            new WorkerExecError(\n              `worker exited with code ${code} before responding`,\n              \"worker-error\",\n            ),\n          );\n        }\n      });\n\n      timer = setTimeout(() => {\n        timedOut = true;\n        worker.terminate();\n        reject(\n          new WorkerExecError(\n            `wall-clock budget of ${timeoutMs}ms elapsed`,\n            \"timeout\",\n          ),\n        );\n      }, timeoutMs);\n\n      const message: WorkerInputMessage = {\n        bundlePath: pathToFileURL(bundlePath).href,\n        timeoutMs,\n      };\n      worker.postMessage(message);\n    });\n\n    return result;\n  } catch (err) {\n    if (err instanceof WorkerExecError && err.code === \"timeout\") {\n      // The worker captured nothing because we killed it; surface\n      // structured timeout info to the caller.\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: Date.now() - startMs,\n        timedOut: true,\n      };\n    }\n    throw err;\n  } finally {\n    if (timer) {\n      clearTimeout(timer);\n    }\n    await worker.terminate().catch(() => undefined);\n    cleanupTempDir();\n    void timedOut;\n  }\n}\n","/**\n * Public types for `@directive-run/sandbox`.\n *\n * The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n */\n\nexport interface PlaygroundFile {\n  /**\n   * Relative path inside the project, e.g. \"src/main.ts\" or\n   * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n   * the entry point the runner targets.\n   */\n  path: string;\n  /** File contents. */\n  source: string;\n}\n\nexport interface RunInSandboxInput {\n  /** Single-file shortcut. Mapped onto \"src/main.ts\" internally. */\n  source?: string;\n  /** Multi-file payload (the `generate_module` paired output shape). */\n  files?: PlaygroundFile[];\n  /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */\n  timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n  /**\n   * Captured `console.log` / `console.warn` / `console.error` lines,\n   * in dispatch order. Each entry is the stringified arguments\n   * joined by \" \" (matches Node's default console format).\n   */\n  logs: string[];\n  /**\n   * Final `system.facts.$store.toObject()` snapshot at end-of-run.\n   * Empty when no system was constructed (e.g. validator rejection).\n   */\n  facts: Record<string, unknown>;\n  /**\n   * Structured error messages from validation, bundling, or runtime\n   * exceptions. Empty on a clean run.\n   */\n  errors: string[];\n  /** Elapsed wall-clock duration of the worker execution. */\n  durationMs: number;\n  /** True when the wall-clock budget elapsed before settle()/destroy(). */\n  timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n  | \"validation-failed\"\n  | \"bundle-failed\"\n  | \"worker-error\"\n  | \"timeout\"\n  | \"input-invalid\";\n\nexport class SandboxError extends Error {\n  constructor(\n    message: string,\n    public readonly code: SandboxErrorCode,\n  ) {\n    super(message);\n    this.name = \"SandboxError\";\n  }\n}\n\n/**\n * Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n */\nexport interface WorkerInputMessage {\n  /** `file://` URL of the temp .mjs bundle the host wrote. */\n  bundlePath: string;\n  timeoutMs: number;\n}\n\n/** Wire shape for messages from worker → host. */\nexport type WorkerOutputMessage =\n  | { ok: true; result: SandboxResult }\n  | { ok: false; error: string };\n","/**\n * AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n *\n * Allowlist:\n *\n * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,\n *   `query`) OR a relative path ending in `.js` (the multi-file\n *   payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n *   plus `console.*`, `Math.*`, `JSON.*`. Anything that touches\n *   global Node namespaces (`process`, `require`, `fs`, `child_process`,\n *   `net`, `dgram`, `cluster`, etc.) is rejected.\n *\n * Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n *\n * Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n */\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\nconst ALLOWED_IMPORT_PATTERNS: RegExp[] = [\n  /^@directive-run\\/(core|ai|query)(\\/.+)?$/,\n  /^\\.\\/.+\\.js$/,\n  /^\\.\\.\\/.+\\.js$/,\n];\n\n/**\n * Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n */\nconst ALLOWED_GLOBALS = new Set<string>([\n  // Directive runtime surface\n  \"createSystem\",\n  // We also allow the destructured exports the runner might use:\n  \"system\",\n  // Standard JS we'll let through\n  \"console\",\n  \"Math\",\n  \"JSON\",\n  \"Object\",\n  \"Array\",\n  \"Number\",\n  \"String\",\n  \"Boolean\",\n  \"Symbol\",\n  \"Promise\",\n  \"Error\",\n  \"Date\",\n  \"Map\",\n  \"Set\",\n  \"WeakMap\",\n  \"WeakSet\",\n  \"Reflect\",\n  \"globalThis\",\n  // Top-level await + iteration sugar\n  \"undefined\",\n  \"null\",\n  \"NaN\",\n  \"Infinity\",\n]);\n\n/**\n * Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n */\nconst DENIED_GLOBALS = new Set<string>([\n  \"process\",\n  \"require\",\n  \"module\",\n  \"__dirname\",\n  \"__filename\",\n  \"fetch\",\n  \"XMLHttpRequest\",\n  \"WebSocket\",\n  \"eval\",\n  \"Function\",\n  // The MCP server runs on Node; these are Node-only globals that\n  // bypass workers' resource isolation entirely.\n  \"Buffer\",\n  \"setImmediate\",\n  \"queueMicrotask\",\n  \"setTimeout\",\n  \"setInterval\",\n  \"clearTimeout\",\n  \"clearInterval\",\n]);\n\nexport interface ValidationError {\n  path: string;\n  line: number;\n  column: number;\n  message: string;\n}\n\nfunction checkImports(\n  fileLabel: string,\n  project: Project,\n  errors: ValidationError[],\n): void {\n  const sourceFile = project.getSourceFileOrThrow(fileLabel);\n  for (const decl of sourceFile.getImportDeclarations()) {\n    const moduleSpecifier = decl.getModuleSpecifierValue();\n    const allowed = ALLOWED_IMPORT_PATTERNS.some((re) =>\n      re.test(moduleSpecifier),\n    );\n    if (!allowed) {\n      const { line, column } = sourceFile.getLineAndColumnAtPos(\n        decl.getStart(),\n      );\n      errors.push({\n        path: fileLabel,\n        line,\n        column,\n        message: `import \"${moduleSpecifier}\" is not allowed in the sandbox. Allowed: @directive-run/{core,ai,query} or relative \"./X.js\" paths.`,\n      });\n    }\n  }\n}\n\nfunction checkDynamicImportsAndCalls(\n  fileLabel: string,\n  project: Project,\n  errors: ValidationError[],\n): void {\n  const sourceFile = project.getSourceFileOrThrow(fileLabel);\n  // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n  // `new Function(\"…\")` (string-to-code) at any depth.\n  sourceFile.forEachDescendant((node) => {\n    if (node.getKind() === SyntaxKind.ImportKeyword) {\n      const parent = node.getParent();\n      if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n        const { line, column } = sourceFile.getLineAndColumnAtPos(\n          node.getStart(),\n        );\n        errors.push({\n          path: fileLabel,\n          line,\n          column,\n          message: \"dynamic import() is not allowed in the sandbox\",\n        });\n      }\n    }\n    if (node.getKind() === SyntaxKind.NewExpression) {\n      const text = node.getText();\n      if (/^new\\s+Function\\s*\\(/.test(text)) {\n        const { line, column } = sourceFile.getLineAndColumnAtPos(\n          node.getStart(),\n        );\n        errors.push({\n          path: fileLabel,\n          line,\n          column,\n          message: \"new Function(...) is not allowed in the sandbox\",\n        });\n      }\n    }\n  });\n}\n\nfunction checkGlobalIdentifiers(\n  fileLabel: string,\n  project: Project,\n  errors: ValidationError[],\n): void {\n  const sourceFile = project.getSourceFileOrThrow(fileLabel);\n  // Walk every Identifier and check whether it resolves to a\n  // top-level binding. We only care about the \"free\" identifiers —\n  // ones the snippet didn't declare via import, var/let/const, or\n  // function/class declaration. Those are globals.\n  const localBindings = new Set<string>();\n  for (const decl of sourceFile.getImportDeclarations()) {\n    for (const n of decl.getNamedImports()) {\n      localBindings.add(n.getName());\n    }\n    const def = decl.getDefaultImport();\n    if (def) localBindings.add(def.getText());\n    const ns = decl.getNamespaceImport();\n    if (ns) localBindings.add(ns.getText());\n  }\n  for (const v of sourceFile.getVariableDeclarations()) {\n    localBindings.add(v.getName());\n  }\n  for (const f of sourceFile.getFunctions()) {\n    const name = f.getName();\n    if (name) localBindings.add(name);\n  }\n  for (const c of sourceFile.getClasses()) {\n    const name = c.getName();\n    if (name) localBindings.add(name);\n  }\n\n  sourceFile.forEachDescendant((node) => {\n    if (node.getKind() !== SyntaxKind.Identifier) {\n      return;\n    }\n    const name = node.getText();\n    if (localBindings.has(name)) {\n      return;\n    }\n    if (ALLOWED_GLOBALS.has(name)) {\n      return;\n    }\n\n    // Skip identifiers in non-reference positions where the name is\n    // just a label, not a binding reference:\n    //\n    // - Property-assignment KEYS in object literals: `{ module: x }`\n    //   — the LHS `module` is a label, not a reference to Node's `module`.\n    // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n    // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n    //   ts-morph's ShorthandPropertyAssignment parents that case, so we\n    //   only filter PropertyAssignment.name and PropertyAccessExpression.name.\n    // - Type-annotation positions: `let x: foo` — `foo` is a type.\n    // - Import/export specifier names.\n    const parent = node.getParent();\n    if (parent) {\n      const parentKind = parent.getKind();\n      // `{ module: x }` — name child of a PropertyAssignment.\n      if (parentKind === SyntaxKind.PropertyAssignment) {\n        const propertyName = (\n          parent as { getNameNode?: () => unknown }\n        ).getNameNode?.();\n        if (propertyName === node) {\n          return;\n        }\n      }\n      // `obj.foo` — `foo` is the .name on the right of a dot.\n      if (parentKind === SyntaxKind.PropertyAccessExpression) {\n        const accessName = (\n          parent as { getNameNode?: () => unknown }\n        ).getNameNode?.();\n        if (accessName === node) {\n          return;\n        }\n      }\n      // `{ foo: bar }` LHS for shorthand-style method declarations.\n      if (parentKind === SyntaxKind.MethodDeclaration) {\n        return;\n      }\n      // import { foo } / import { foo as bar } / export { foo }\n      if (\n        parentKind === SyntaxKind.ImportSpecifier ||\n        parentKind === SyntaxKind.ExportSpecifier ||\n        parentKind === SyntaxKind.NamespaceImport ||\n        parentKind === SyntaxKind.ImportClause\n      ) {\n        return;\n      }\n      // Function/method parameter names.\n      if (parentKind === SyntaxKind.Parameter) {\n        return;\n      }\n      // Type references — `let x: foo` etc.\n      if (\n        parentKind === SyntaxKind.TypeReference ||\n        parentKind === SyntaxKind.TypeQuery\n      ) {\n        return;\n      }\n    }\n\n    if (DENIED_GLOBALS.has(name)) {\n      const { line, column } = sourceFile.getLineAndColumnAtPos(\n        node.getStart(),\n      );\n      errors.push({\n        path: fileLabel,\n        line,\n        column,\n        message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n      });\n    }\n    // We don't reject unknown identifiers — they might be legitimate\n    // members of an allowlist-imported binding (e.g. `system.events.foo`\n    // — `foo` is an identifier in property-access position). The\n    // import + denylist + dynamic-import check above already covers\n    // the actual escape paths.\n  });\n}\n\nexport function validateSandboxInput(\n  files: PlaygroundFile[],\n): ValidationError[] {\n  const errors: ValidationError[] = [];\n  const project = new Project({\n    useInMemoryFileSystem: true,\n    compilerOptions: {\n      target: 99, // ESNext\n      module: 99, // ESNext\n      allowJs: true,\n      strict: false,\n    },\n  });\n\n  for (const file of files) {\n    project.createSourceFile(file.path, file.source, { overwrite: true });\n  }\n\n  for (const file of files) {\n    checkImports(file.path, project, errors);\n    checkDynamicImportsAndCalls(file.path, project, errors);\n    checkGlobalIdentifiers(file.path, project, errors);\n  }\n\n  return errors;\n}\n","/**\n * Public API for `@directive-run/sandbox`.\n *\n * Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n *\n * Consumers:\n *\n * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n *   result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n *   for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n  PlaygroundFile,\n  RunInSandboxInput,\n  SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n  SandboxError,\n  type PlaygroundFile,\n  type RunInSandboxInput,\n  type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n  if (input.files && input.source) {\n    throw new SandboxError(\n      \"pass either `source` or `files`, not both\",\n      \"input-invalid\",\n    );\n  }\n  if (!input.files && !input.source) {\n    throw new SandboxError(\n      \"must pass either `source` or `files`\",\n      \"input-invalid\",\n    );\n  }\n  const files: PlaygroundFile[] = input.files\n    ? input.files\n    : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n  if (files.length === 0) {\n    throw new SandboxError(\"files array is empty\", \"input-invalid\");\n  }\n  if (files.length > MAX_FILES) {\n    throw new SandboxError(\n      `payload exceeds ${MAX_FILES} files`,\n      \"input-invalid\",\n    );\n  }\n  let totalBytes = 0;\n  for (const file of files) {\n    if (typeof file.path !== \"string\" || file.path.length === 0) {\n      throw new SandboxError(\n        \"every file must have a non-empty path\",\n        \"input-invalid\",\n      );\n    }\n    if (typeof file.source !== \"string\" || file.source.length === 0) {\n      throw new SandboxError(\n        `file \"${file.path}\" has empty source`,\n        \"input-invalid\",\n      );\n    }\n    totalBytes += Buffer.byteLength(file.source, \"utf8\");\n  }\n  if (totalBytes > MAX_PAYLOAD_BYTES) {\n    throw new SandboxError(\n      `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n      \"input-invalid\",\n    );\n  }\n  // Ensure src/main.ts is present — that's the runner / entry point.\n  if (!files.some((f) => f.path === MAIN_PATH)) {\n    throw new SandboxError(\n      `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n      \"input-invalid\",\n    );\n  }\n  return files;\n}\n\nexport async function runInSandbox(\n  input: RunInSandboxInput,\n): Promise<SandboxResult> {\n  let files: PlaygroundFile[];\n  try {\n    files = normalizeInput(input);\n  } catch (err) {\n    if (err instanceof SandboxError) {\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: 0,\n        timedOut: false,\n      };\n    }\n    throw err;\n  }\n\n  const validationErrors = validateSandboxInput(files);\n  if (validationErrors.length > 0) {\n    return {\n      logs: [],\n      facts: {},\n      errors: validationErrors.map(\n        (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n      ),\n      durationMs: 0,\n      timedOut: false,\n    };\n  }\n\n  let bundled: { source: string; bytes: number };\n  try {\n    bundled = await bundleSandboxFiles(files);\n  } catch (err) {\n    if (err instanceof BundleError) {\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: 0,\n        timedOut: false,\n      };\n    }\n    throw err;\n  }\n\n  try {\n    const result = await execInWorker({\n      bundledSource: bundled.source,\n      timeoutMs: input.timeoutMs,\n    });\n    return result;\n  } catch (err) {\n    if (err instanceof WorkerExecError) {\n      return {\n        logs: [],\n        facts: {},\n        errors: [err.message],\n        durationMs: 0,\n        timedOut: err.code === \"timeout\",\n      };\n    }\n    throw err;\n  }\n}\n"],"mappings":"AAgBA,OAAS,SAAAA,MAAa,UAGtB,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,EAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CAgGF,IAAMC,GA/FS,MAAMjB,EAAM,CACzB,YAAa,CAAC,GAAGE,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SACV,SAAU,CACR,sBACA,oBACA,sBACF,EAGA,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAExC,MAAO,CAAE,SAAU,GAAM,KAAMA,EAAK,IAAK,EAE3C,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,EAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CC7LA,OAAS,eAAAC,EAAa,UAAAC,EAAQ,iBAAAC,MAAqB,KACnD,OAAS,WAAAC,EAAS,QAAAC,MAAY,OAC9B,OAAS,iBAAAC,MAAqB,MAC9B,OAAS,UAAAC,MAAc,iBAOvB,IAAMC,EAAiB,IACjBC,EAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAc,YAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CAOO,IAAMC,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,EAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,EAAgB,KAAK,IAAID,EAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CAUA,eAAeS,GAAwC,CAGrD,IAAMC,EAAa,MAAMT,EAAkB,EAE3C,OAAOP,EAAQA,EAAQgB,CAAU,CAAC,CACpC,CAYA,eAAeC,EAAkBC,EAG9B,CACD,IAAMC,EAAa,MAAMJ,EAAqB,EACxCK,EAAMvB,EAAYI,EAAKkB,EAAY,eAAe,CAAC,EACnDE,EAAapB,EAAKmB,EAAK,YAAY,EACzC,OAAArB,EAAcsB,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,CACFvB,EAAOsB,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYZ,EAAaW,EAAM,SAAS,EACxCP,EAAa,MAAMT,EAAkB,EACrC,CAAE,WAAAc,EAAY,QAASI,CAAe,EAAI,MAAMR,EACpDM,EAAM,aACR,EACMG,EAAS,IAAIvB,EAAOa,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CA+CF,OA9Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAItB,EAAgBwB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAItB,EAAgByB,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAASf,GAAS,CACxB,CAACqB,GAAWrB,IAAS,GAAKA,IAAS,MACrCoB,EACE,IAAItB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDgB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAItB,EACF,wBAAwBe,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMd,EAA8B,CAClC,WAAYR,EAAcmB,CAAU,EAAE,KACtC,UAAAG,CACF,EACAE,EAAO,YAAYhB,CAAO,CAC5B,CAAC,CAGH,OAASwB,EAAK,CACZ,GAAIA,aAAezB,GAAmByB,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC5IO,IAAMU,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,EC3CA,OAAS,WAAAC,EAAS,cAAAC,MAAkB,WAGpC,IAAMC,EAAoC,CACxC,2CACA,eACA,gBACF,EAQMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,EACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EAIrD,GAAI,CAHYR,EAAwB,KAAMU,GAC5CA,EAAG,KAAKD,CAAe,CACzB,EACc,CACZ,GAAM,CAAE,KAAAE,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,WAAWH,CAAe,sGACrC,CAAC,CACH,CACF,CACF,CAEA,SAASI,EACPT,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBO,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMf,EAAW,cAAe,CAC/C,IAAMgB,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAMhB,EAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAY,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCO,EAAK,SAAS,CAChB,EACAR,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAMf,EAAW,cAAe,CAC/C,IAAMiB,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCO,EAAK,SAAS,CAChB,EACAR,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAEA,SAASK,EACPb,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnDc,EAAgB,IAAI,IAC1B,QAAWV,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAWY,KAAKX,EAAK,gBAAgB,EACnCU,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAMZ,EAAK,iBAAiB,EAC9BY,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAKb,EAAK,mBAAmB,EAC/Ba,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAKf,EAAW,wBAAwB,EACjDW,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhB,EAAW,aAAa,EAAG,CACzC,IAAMiB,EAAOD,EAAE,QAAQ,EACnBC,GAAMN,EAAc,IAAIM,CAAI,CAClC,CACA,QAAWC,KAAKlB,EAAW,WAAW,EAAG,CACvC,IAAMiB,EAAOC,EAAE,QAAQ,EACnBD,GAAMN,EAAc,IAAIM,CAAI,CAClC,CAEAjB,EAAW,kBAAmBO,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMf,EAAW,WAChC,OAEF,IAAMyB,EAAOV,EAAK,QAAQ,EAI1B,GAHII,EAAc,IAAIM,CAAI,GAGtBvB,EAAgB,IAAIuB,CAAI,EAC1B,OAcF,IAAMT,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAMW,EAAaX,EAAO,QAAQ,EAqClC,GAnCIW,IAAe3B,EAAW,oBAE1BgB,EACA,cAAc,IACKD,GAKnBY,IAAe3B,EAAW,0BAE1BgB,EACA,cAAc,IACGD,GAKjBY,IAAe3B,EAAW,mBAK5B2B,IAAe3B,EAAW,iBAC1B2B,IAAe3B,EAAW,iBAC1B2B,IAAe3B,EAAW,iBAC1B2B,IAAe3B,EAAW,cAKxB2B,IAAe3B,EAAW,WAK5B2B,IAAe3B,EAAW,eAC1B2B,IAAe3B,EAAW,UAE1B,MAEJ,CAEA,GAAIG,EAAe,IAAIsB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAb,EAAM,OAAAC,CAAO,EAAIL,EAAW,sBAClCO,EAAK,SAAS,CAChB,EACAR,EAAO,KAAK,CACV,KAAMF,EACN,KAAAO,EACA,OAAAC,EACA,QAAS,eAAeY,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASG,EACdC,EACmB,CACnB,IAAMtB,EAA4B,CAAC,EAC7BD,EAAU,IAAIP,EAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAW+B,KAAQD,EACjBvB,EAAQ,iBAAiBwB,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBzB,EAAa0B,EAAK,KAAMxB,EAASC,CAAM,EACvCO,EAA4BgB,EAAK,KAAMxB,EAASC,CAAM,EACtDW,EAAuBY,EAAK,KAAMxB,EAASC,CAAM,EAGnD,OAAOA,CACT,CCzRA,IAAMwB,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,EAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,EAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAGF,IAAIC,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBV,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeM,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACN,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAKF,OAJe,MAAMO,EAAa,CAChC,cAAeH,EAAQ,OACvB,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["build","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","mkdtempSync","rmSync","writeFileSync","dirname","join","pathToFileURL","Worker","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getSandboxPackageDir","workerPath","writeBundleToTemp","bundledSource","sandboxDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","SandboxError","message","code","Project","SyntaxKind","ALLOWED_IMPORT_PATTERNS","ALLOWED_GLOBALS","DENIED_GLOBALS","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","re","line","column","checkDynamicImportsAndCalls","node","parent","text","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","name","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}

package/dist/worker.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Worker-thread entry. Receives a bundled ESM string + timeout, hooks
+ * `console.*` to a capture buffer, evaluates the bundle via a data:
+ * URL import (Node's native ESM loader handles top-level await for us),
+ * then sends the SandboxResult back.
+ *
+ * The host (`./host.ts`) enforces the wall-clock budget by calling
+ * `worker.terminate()` on overrun — there's no cooperative cancellation
+ * from inside the worker. This keeps the worker code simple and means
+ * even hostile snippets that try to outlast the budget get hard-killed.
+ *
+ * Why a data: URL import rather than `vm.runInContext`? `vm` doesn't
+ * link ESM imports, so a snippet that imports `@directive-run/core`
+ * fails at parse time. Data URL imports go through Node's real ESM
+ * loader, which DOES link external imports — `@directive-run/core` is
+ * already installed in the parent's node_modules, so the worker finds
+ * it via standard resolution. The cost: data URL imports happen
+ * exactly once per worker (which is what we want — one-shot execution).
+ */
+/**
+ * Look for a system on globalThis the snippet attached. The runner
+ * scaffold emits `const system = createSystem({...}); system.start();`
+ * at top level, but inside an ESM module those bindings are scoped to
+ * the module's own scope — we can't read them from the worker.
+ *
+ * Workaround: the worker patches `createSystem` to also stash the
+ * returned system on `globalThis.__directiveSandbox_system__`. After
+ * the bundle finishes, we read facts from there.
+ *
+ * This monkey-patch happens via a tiny ESM module we prepend to the
+ * bundle before evaluation (see `wrapForExecution`).
+ */
+interface SandboxSystem {
+    facts: {
+        $store: {
+            toObject(): Record<string, unknown>;
+        };
+    };
+    destroy(): void;
+}
+declare global {
+    var __directiveSandbox_system__: SandboxSystem | null;
+}

package/dist/worker.js

@@ -0,0 +1,2 @@
+import{performance as u}from"perf_hooks";import{parentPort as g}from"worker_threads";if(!g)throw new Error("@directive-run/sandbox/worker must be loaded via worker_threads");var i=g;function d(t,r){let e={log:console.log,info:console.info,warn:console.warn,error:console.error,debug:console.debug},s=(o,l)=>{let a=l.map(n=>{if(typeof n=="string")return n;try{return JSON.stringify(n)}catch{return String(n)}}).join(" ");t.push(o?`${o} ${a}`:a)};return console.log=(...o)=>s(r.log,o),console.info=(...o)=>s(r.log,o),console.warn=(...o)=>s(r.warn,o),console.error=(...o)=>s(r.error,o),console.debug=(...o)=>s(r.log,o),()=>{console.log=e.log,console.info=e.info,console.warn=e.warn,console.error=e.error,console.debug=e.debug}}async function m(t){let r=[],e=[],s=d(r,{log:"[log]",warn:"[warn]",error:"[error]"});globalThis.__directiveSandbox_system__=null;let o=u.now();try{await import(t.bundlePath)}catch(c){e.push(c.message??String(c))}finally{s()}let l=u.now()-o,a={},n=globalThis.__directiveSandbox_system__;if(n){try{a=n.facts.$store.toObject()}catch(c){e.push(`facts snapshot failed: ${c.message}`)}try{n.destroy()}catch{}globalThis.__directiveSandbox_system__=null}return{logs:r,facts:a,errors:e,durationMs:l,timedOut:!1}}i.once("message",async t=>{try{let e={ok:!0,result:await m(t)};i.postMessage(e)}catch(r){let e={ok:!1,error:r.stack??r.message??String(r)};i.postMessage(e)}});
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/worker.ts"],"sourcesContent":["/**\n * Worker-thread entry. Receives a bundled ESM string + timeout, hooks\n * `console.*` to a capture buffer, evaluates the bundle via a data:\n * URL import (Node's native ESM loader handles top-level await for us),\n * then sends the SandboxResult back.\n *\n * The host (`./host.ts`) enforces the wall-clock budget by calling\n * `worker.terminate()` on overrun — there's no cooperative cancellation\n * from inside the worker. This keeps the worker code simple and means\n * even hostile snippets that try to outlast the budget get hard-killed.\n *\n * Why a data: URL import rather than `vm.runInContext`? `vm` doesn't\n * link ESM imports, so a snippet that imports `@directive-run/core`\n * fails at parse time. Data URL imports go through Node's real ESM\n * loader, which DOES link external imports — `@directive-run/core` is\n * already installed in the parent's node_modules, so the worker finds\n * it via standard resolution. The cost: data URL imports happen\n * exactly once per worker (which is what we want — one-shot execution).\n */\n\nimport { performance } from \"node:perf_hooks\";\nimport { parentPort } from \"node:worker_threads\";\nimport type {\n  SandboxResult,\n  WorkerInputMessage,\n  WorkerOutputMessage,\n} from \"./types.js\";\n\nif (!parentPort) {\n  throw new Error(\n    \"@directive-run/sandbox/worker must be loaded via worker_threads\",\n  );\n}\n\nconst port = parentPort;\n\n/**\n * Replace console.{log,info,warn,error,debug} with capture functions\n * that push to a shared buffer. The original references are restored\n * in `finally` so this doesn't leak across hot-reloads in tests.\n */\nfunction captureConsole(\n  buffer: string[],\n  prefix: { log: string; warn: string; error: string },\n): () => void {\n  const originals = {\n    log: console.log,\n    info: console.info,\n    warn: console.warn,\n    error: console.error,\n    debug: console.debug,\n  };\n  const format = (label: string, args: unknown[]) => {\n    const text = args\n      .map((a) => {\n        if (typeof a === \"string\") return a;\n        try {\n          return JSON.stringify(a);\n        } catch {\n          return String(a);\n        }\n      })\n      .join(\" \");\n    buffer.push(label ? `${label} ${text}` : text);\n  };\n  console.log = (...a: unknown[]) => format(prefix.log, a);\n  console.info = (...a: unknown[]) => format(prefix.log, a);\n  console.warn = (...a: unknown[]) => format(prefix.warn, a);\n  console.error = (...a: unknown[]) => format(prefix.error, a);\n  console.debug = (...a: unknown[]) => format(prefix.log, a);\n\n  return () => {\n    console.log = originals.log;\n    console.info = originals.info;\n    console.warn = originals.warn;\n    console.error = originals.error;\n    console.debug = originals.debug;\n  };\n}\n\n/**\n * Look for a system on globalThis the snippet attached. The runner\n * scaffold emits `const system = createSystem({...}); system.start();`\n * at top level, but inside an ESM module those bindings are scoped to\n * the module's own scope — we can't read them from the worker.\n *\n * Workaround: the worker patches `createSystem` to also stash the\n * returned system on `globalThis.__directiveSandbox_system__`. After\n * the bundle finishes, we read facts from there.\n *\n * This monkey-patch happens via a tiny ESM module we prepend to the\n * bundle before evaluation (see `wrapForExecution`).\n */\ninterface SandboxSystem {\n  facts: { $store: { toObject(): Record<string, unknown> } };\n  destroy(): void;\n}\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __directiveSandbox_system__: SandboxSystem | null;\n}\n\nasync function runOne(message: WorkerInputMessage): Promise<SandboxResult> {\n  const logs: string[] = [];\n  const errors: string[] = [];\n  const restoreConsole = captureConsole(logs, {\n    log: \"[log]\",\n    warn: \"[warn]\",\n    error: \"[error]\",\n  });\n  globalThis.__directiveSandbox_system__ = null;\n  const startMs = performance.now();\n  try {\n    // Import the bundle via file:// URL. Node's ESM loader resolves\n    // `@directive-run/core` against node_modules relative to the\n    // file path's anchor. The bundler appends a trailing assignment\n    // to the entry module that lifts the runner's `system` binding\n    // onto `globalThis.__directiveSandbox_system__` so we can read\n    // it from here after execution.\n    await import(message.bundlePath);\n  } catch (err) {\n    errors.push((err as Error).message ?? String(err));\n  } finally {\n    restoreConsole();\n  }\n  const durationMs = performance.now() - startMs;\n\n  let facts: Record<string, unknown> = {};\n  // Cast through unknown because TS narrows `globalThis.X` to `null`\n  // after the earlier assignment, even though the bundle's epilogue\n  // may have populated it before we read here.\n  const system = globalThis.__directiveSandbox_system__ as SandboxSystem | null;\n  if (system) {\n    try {\n      facts = system.facts.$store.toObject();\n    } catch (err) {\n      errors.push(`facts snapshot failed: ${(err as Error).message}`);\n    }\n    try {\n      system.destroy();\n    } catch {\n      // best-effort\n    }\n    globalThis.__directiveSandbox_system__ = null;\n  }\n\n  return {\n    logs,\n    facts,\n    errors,\n    durationMs,\n    timedOut: false,\n  };\n}\n\nport.once(\"message\", async (msg: WorkerInputMessage) => {\n  try {\n    const result = await runOne(msg);\n    const out: WorkerOutputMessage = { ok: true, result };\n    port.postMessage(out);\n  } catch (err) {\n    const out: WorkerOutputMessage = {\n      ok: false,\n      error: (err as Error).stack ?? (err as Error).message ?? String(err),\n    };\n    port.postMessage(out);\n  }\n});\n"],"mappings":"AAoBA,OAAS,eAAAA,MAAmB,aAC5B,OAAS,cAAAC,MAAkB,iBAO3B,GAAI,CAACA,EACH,MAAM,IAAI,MACR,iEACF,EAGF,IAAMC,EAAOD,EAOb,SAASE,EACPC,EACAC,EACY,CACZ,IAAMC,EAAY,CAChB,IAAK,QAAQ,IACb,KAAM,QAAQ,KACd,KAAM,QAAQ,KACd,MAAO,QAAQ,MACf,MAAO,QAAQ,KACjB,EACMC,EAAS,CAACC,EAAeC,IAAoB,CACjD,IAAMC,EAAOD,EACV,IAAKE,GAAM,CACV,GAAI,OAAOA,GAAM,SAAU,OAAOA,EAClC,GAAI,CACF,OAAO,KAAK,UAAUA,CAAC,CACzB,MAAQ,CACN,OAAO,OAAOA,CAAC,CACjB,CACF,CAAC,EACA,KAAK,GAAG,EACXP,EAAO,KAAKI,EAAQ,GAAGA,CAAK,IAAIE,CAAI,GAAKA,CAAI,CAC/C,EACA,eAAQ,IAAM,IAAIC,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EACvD,QAAQ,KAAO,IAAIA,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EACxD,QAAQ,KAAO,IAAIA,IAAiBJ,EAAOF,EAAO,KAAMM,CAAC,EACzD,QAAQ,MAAQ,IAAIA,IAAiBJ,EAAOF,EAAO,MAAOM,CAAC,EAC3D,QAAQ,MAAQ,IAAIA,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EAElD,IAAM,CACX,QAAQ,IAAML,EAAU,IACxB,QAAQ,KAAOA,EAAU,KACzB,QAAQ,KAAOA,EAAU,KACzB,QAAQ,MAAQA,EAAU,MAC1B,QAAQ,MAAQA,EAAU,KAC5B,CACF,CAyBA,eAAeM,EAAOC,EAAqD,CACzE,IAAMC,EAAiB,CAAC,EAClBC,EAAmB,CAAC,EACpBC,EAAiBb,EAAeW,EAAM,CAC1C,IAAK,QACL,KAAM,SACN,MAAO,SACT,CAAC,EACD,WAAW,4BAA8B,KACzC,IAAMG,EAAUjB,EAAY,IAAI,EAChC,GAAI,CAOF,MAAM,OAAOa,EAAQ,WACvB,OAASK,EAAK,CACZH,EAAO,KAAMG,EAAc,SAAW,OAAOA,CAAG,CAAC,CACnD,QAAE,CACAF,EAAe,CACjB,CACA,IAAMG,EAAanB,EAAY,IAAI,EAAIiB,EAEnCG,EAAiC,CAAC,EAIhCC,EAAS,WAAW,4BAC1B,GAAIA,EAAQ,CACV,GAAI,CACFD,EAAQC,EAAO,MAAM,OAAO,SAAS,CACvC,OAASH,EAAK,CACZH,EAAO,KAAK,0BAA2BG,EAAc,OAAO,EAAE,CAChE,CACA,GAAI,CACFG,EAAO,QAAQ,CACjB,MAAQ,CAER,CACA,WAAW,4BAA8B,IAC3C,CAEA,MAAO,CACL,KAAAP,EACA,MAAAM,EACA,OAAAL,EACA,WAAAI,EACA,SAAU,EACZ,CACF,CAEAjB,EAAK,KAAK,UAAW,MAAOoB,GAA4B,CACtD,GAAI,CAEF,IAAMC,EAA2B,CAAE,GAAI,GAAM,OAD9B,MAAMX,EAAOU,CAAG,CACqB,EACpDpB,EAAK,YAAYqB,CAAG,CACtB,OAASL,EAAK,CACZ,IAAMK,EAA2B,CAC/B,GAAI,GACJ,MAAQL,EAAc,OAAUA,EAAc,SAAW,OAAOA,CAAG,CACrE,EACAhB,EAAK,YAAYqB,CAAG,CACtB,CACF,CAAC","names":["performance","parentPort","port","captureConsole","buffer","prefix","originals","format","label","args","text","a","runOne","message","logs","errors","restoreConsole","startMs","err","durationMs","facts","system","msg","out"]}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@directive-run/sandbox",
+  "version": "0.1.0",
+  "description": "Execute Directive snippets server-side and return a structured transcript (logs + facts + errors). Consumed by @directive-run/mcp's run_in_sandbox tool and directive.run/playground's live DevTools panel. Uses worker_threads + esbuild bundling + an AST allowlist validator so user-supplied TypeScript runs with a bounded surface (allowlisted imports, allowlisted API calls, 5s wall clock, 32 MB heap).",
+  "license": "(MIT OR Apache-2.0)",
+  "author": "Jason Comes",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/directive-run/directive",
+    "directory": "packages/sandbox"
+  },
+  "homepage": "https://directive.run/docs/ide-integration",
+  "bugs": {
+    "url": "https://github.com/directive-run/directive/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "directive",
+    "sandbox",
+    "worker-threads",
+    "execute",
+    "transcript"
+  ],
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.cjs",
+      "import": "./dist/index.js"
+    },
+    "./worker": {
+      "types": "./dist/worker.d.ts",
+      "import": "./dist/worker.js",
+      "default": "./dist/worker.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@directive-run/core": "1.17.2"
+  },
+  "optionalDependencies": {
+    "esbuild": "^0.24.0",
+    "ts-morph": "^25.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.2.0",
+    "esbuild": "^0.24.0",
+    "ts-morph": "^25.0.0",
+    "tsup": "^8.3.5",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}