@directive-run/sandbox 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/dist/index.cjs +4 -3
  2. package/dist/index.cjs.map +1 -1
  3. package/dist/index.d.cts +10 -0
  4. package/dist/index.d.ts +10 -0
  5. package/dist/index.js +5 -4
  6. package/dist/index.js.map +1 -1
  7. package/dist/worker.d.ts +1 -0
  8. package/dist/worker.js +1 -1
  9. package/dist/worker.js.map +1 -1
  10. package/package.json +1 -1
package/dist/index.cjs CHANGED
@@ -1,5 +1,6 @@
1
- "use strict";var B=Object.create;var E=Object.defineProperty;var K=Object.getOwnPropertyDescriptor;var V=Object.getOwnPropertyNames;var q=Object.getPrototypeOf,G=Object.prototype.hasOwnProperty;var U=(e,t)=>{for(var o in t)E(e,o,{get:t[o],enumerable:!0})},M=(e,t,o,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of V(t))!G.call(e,n)&&n!==o&&E(e,n,{get:()=>t[n],enumerable:!(r=K(t,n))||r.enumerable});return e};var H=(e,t,o)=>(o=e!=null?B(q(e)):{},M(t||!e||!e.__esModule?E(o,"default",{value:e,enumerable:!0}):o,e)),X=e=>M(E({},"__esModule",{value:!0}),e);var le={};U(le,{SandboxError:()=>p,runInSandbox:()=>ue});module.exports=X(le);var T=require("esbuild"),v="src/main.ts",y="directive-sandbox-vfs",h=class extends Error{constructor(o,r){super(o);this.cause=r;this.name="BundleError"}};function z(e){let t=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,o=e.match(t);if(!o)return e;let r=o[1],a=`
1
+ "use strict";var G=Object.create;var S=Object.defineProperty;var H=Object.getOwnPropertyDescriptor;var X=Object.getOwnPropertyNames;var z=Object.getPrototypeOf,Y=Object.prototype.hasOwnProperty;var J=(e,t)=>{for(var o in t)S(e,o,{get:t[o],enumerable:!0})},I=(e,t,o,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of X(t))!Y.call(e,s)&&s!==o&&S(e,s,{get:()=>t[s],enumerable:!(r=H(t,s))||r.enumerable});return e};var Q=(e,t,o)=>(o=e!=null?G(z(e)):{},I(t||!e||!e.__esModule?S(o,"default",{value:e,enumerable:!0}):o,e)),Z=e=>I(S({},"__esModule",{value:!0}),e);var we={};J(we,{SandboxError:()=>p,runInSandbox:()=>xe});module.exports=Z(we);var M=require("module"),k=require("url"),$=require("esbuild"),re={};function ee(e){try{let o=(0,M.createRequire)(re.url).resolve(e);return(0,k.pathToFileURL)(o).href}catch{return null}}var E="src/main.ts",w="directive-sandbox-vfs",h=class extends Error{constructor(o,r){super(o);this.cause=r;this.name="BundleError"}};function te(e){let t=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,o=e.match(t);if(!o)return e;let r=o[1],n=`
2
2
  (globalThis).__directiveSandbox_system__ = ${o[2]};
3
- `;return e.replace(r,r+a)}async function k(e){if(!e.find(r=>r.path===v))throw new h(`payload must include "${v}" \u2014 that's the entry point the runner targets`);let o=new Map;for(let r of e)o.set(r.path,r.source);try{let n=(await(0,T.build)({entryPoints:[`${y}:${v}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(i){i.onResolve({filter:/.*/},s=>{if(s.kind==="entry-point")return{path:s.path.replace(`${y}:`,""),namespace:y};if(s.namespace!==y)return null;if(s.path.startsWith("@directive-run/"))return{external:!0,path:s.path};if(s.path.startsWith("./")||s.path.startsWith("../")){let c=s.importer.replace(/\/[^/]+$/,""),u=s.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${c}/${u}.ts`,`${c}/${u}.js`,`${c}/${u}`,`${u}.ts`,`${u}.js`].map(f=>f.replace(/\/+/g,"/"));for(let f of g)if(o.has(f))return{path:f,namespace:y};throw new h(`cannot resolve "${s.path}" from "${s.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${s.path}" from "${s.importer}" \u2014 only relative or @directive-run/* allowed`)}),i.onLoad({filter:/.*/,namespace:y},s=>{let c=o.get(s.path);if(c===void 0)throw new h(`virtual file missing: ${s.path}`);if(s.path===v){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {"," (globalThis).__directiveSandbox_system__ = system;","}"].join(`
4
- `);return{contents:c+u,loader:"ts"}}return{contents:c,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!n)throw new h("esbuild produced no output");let a=z(n);return{source:a,bytes:Buffer.byteLength(a,"utf8")}}catch(r){throw r instanceof h?r:new h(`bundle failed: ${r.message??String(r)}`,r)}}var b=require("fs"),w=require("path"),$=require("url"),F=require("worker_threads"),te={},Y=100,J=1e4,A=5e3;async function N(){let{createRequire:e}=await import("module");return e(te.url).resolve("@directive-run/sandbox/worker")}var x=class extends Error{constructor(o,r){super(o);this.code=r;this.name="WorkerExecError"}};function Q(e){let t=e??A;return Number.isFinite(t)?Math.min(J,Math.max(Y,Math.floor(t))):A}async function Z(){let e=await N();return(0,w.dirname)((0,w.dirname)(e))}async function ee(e){let t=await Z(),o=(0,b.mkdtempSync)((0,w.join)(t,".sandbox-tmp-")),r=(0,w.join)(o,"bundle.mjs");return(0,b.writeFileSync)(r,e,"utf8"),{bundlePath:r,cleanup:()=>{try{(0,b.rmSync)(o,{recursive:!0,force:!0})}catch{}}}}async function _(e){let t=Q(e.timeoutMs),o=await N(),{bundlePath:r,cleanup:n}=await ee(e.bundledSource),a=new F.Worker(o,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),i=null,s=!1,c=Date.now();try{return await new Promise((g,f)=>{let m=!1;a.once("message",d=>{m=!0,d.ok?g(d.result):f(new x(d.error,"worker-error"))}),a.once("error",d=>{m=!0,f(new x(d.message,"worker-error"))}),a.once("exit",d=>{!m&&d!==0&&d!==null&&f(new x(`worker exited with code ${d} before responding`,"worker-error"))}),i=setTimeout(()=>{s=!0,a.terminate(),f(new x(`wall-clock budget of ${t}ms elapsed`,"timeout"))},t);let S={bundlePath:(0,$.pathToFileURL)(r).href,timeoutMs:t};a.postMessage(S)})}catch(u){if(u instanceof x&&u.code==="timeout")return{logs:[],facts:{},errors:[u.message],durationMs:Date.now()-c,timedOut:!0};throw u}finally{i&&clearTimeout(i),await a.terminate().catch(()=>{}),n()}}var p=class extends Error{constructor(o,r){super(o);this.code=r;this.name="SandboxError"}};var l=require("ts-morph"),O=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),R=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function D(e){let t=e.match(/^@directive-run\/([^/]+)/);return t?t[1]:null}function re(e){if(/^\.{1,2}\/.+\.js$/.test(e))return!0;let t=D(e);return t===null||R.has(t)?!1:O.has(t)}var W=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),P=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function ne(e){let t=D(e);return t&&R.has(t)?`import "${e}" is denied \u2014 @directive-run/${t} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${e}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(O).sort().join(",")}}.`}function oe(e,t,o){let r=t.getSourceFileOrThrow(e);for(let n of r.getImportDeclarations()){let a=n.getModuleSpecifierValue();if(!re(a)){let{line:i,column:s}=r.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:i,column:s,message:ne(a)})}}}function se(e,t,o){let r=t.getSourceFileOrThrow(e);r.forEachDescendant(n=>{if(n.getKind()===l.SyntaxKind.ImportKeyword){let a=n.getParent();if(a&&a.getKind()===l.SyntaxKind.CallExpression){let{line:i,column:s}=r.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:i,column:s,message:"dynamic import() is not allowed in the sandbox"})}}if(n.getKind()===l.SyntaxKind.NewExpression){let a=n.getText();if(/^new\s+Function\s*\(/.test(a)){let{line:i,column:s}=r.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:i,column:s,message:"new Function(...) is not allowed in the sandbox"})}}})}function ie(e,t,o){let r=t.getSourceFileOrThrow(e),n=(i,s)=>{let{line:c,column:u}=r.getLineAndColumnAtPos(i.getStart());o.push({path:e,line:c,column:u,message:s})},a=i=>{let s=i.trim();return s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'")||s.startsWith("`")&&s.endsWith("`")?s.slice(1,-1):null};r.forEachDescendant(i=>{let s=i.getKind();if(s===l.SyntaxKind.PropertyAccessExpression){let c=i.getName?.();if(!c)return;if(c==="constructor"){n(i,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(P.has(c)){n(i,`\`.${c}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(s===l.SyntaxKind.ElementAccessExpression){let c=i.getExpression?.(),u=i.getArgumentExpression?.(),g=c?.getText()??"",f=u?.getText()??"",m=a(f);if(g==="globalThis"&&m!==null){n(i,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(m!==null&&(m==="constructor"||P.has(m))){n(i,`bracket-access \`["${m}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(s===l.SyntaxKind.CallExpression){let u=i.getExpression?.()?.getText()??"";if(u==="Function"){n(i,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let m=i.getArguments?.()??[];if(m.length>=2){let S=m[0].getText(),d=a(m[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(S==="globalThis"||W.has(S))&&d!==null&&(d==="constructor"||P.has(d))&&n(i,`\`${g[1]}.${g[2]}(${S}, "${d}")\` would reach a denied name`)}}}})}function ae(e,t,o){let r=t.getSourceFileOrThrow(e),n=new Set;for(let a of r.getImportDeclarations()){for(let c of a.getNamedImports())n.add(c.getName());let i=a.getDefaultImport();i&&n.add(i.getText());let s=a.getNamespaceImport();s&&n.add(s.getText())}for(let a of r.getVariableDeclarations())n.add(a.getName());for(let a of r.getFunctions()){let i=a.getName();i&&n.add(i)}for(let a of r.getClasses()){let i=a.getName();i&&n.add(i)}r.forEachDescendant(a=>{if(a.getKind()!==l.SyntaxKind.Identifier)return;let i=a.getText();if(n.has(i)||W.has(i))return;let s=a.getParent();if(s){let c=s.getKind();if(c===l.SyntaxKind.PropertyAssignment&&s.getNameNode?.()===a||c===l.SyntaxKind.PropertyAccessExpression&&s.getNameNode?.()===a||c===l.SyntaxKind.MethodDeclaration||c===l.SyntaxKind.ImportSpecifier||c===l.SyntaxKind.ExportSpecifier||c===l.SyntaxKind.NamespaceImport||c===l.SyntaxKind.ImportClause||c===l.SyntaxKind.Parameter||c===l.SyntaxKind.TypeReference||c===l.SyntaxKind.TypeQuery)return}if(P.has(i)){let{line:c,column:u}=r.getLineAndColumnAtPos(a.getStart());o.push({path:e,line:c,column:u,message:`identifier "${i}" is denied in the sandbox (FS/network/eval surface)`})}})}function j(e){let t=[],o=new l.Project({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let r of e)o.createSourceFile(r.path,r.source,{overwrite:!0});for(let r of e)oe(r.path,o,t),se(r.path,o,t),ie(r.path,o,t),ae(r.path,o,t);return t}var L=2e5,C=10,I="src/main.ts";function ce(e){if(e.files&&e.source)throw new p("pass either `source` or `files`, not both","input-invalid");if(!e.files&&!e.source)throw new p("must pass either `source` or `files`","input-invalid");let t=e.files?e.files:[{path:I,source:e.source??""}];if(t.length===0)throw new p("files array is empty","input-invalid");if(t.length>C)throw new p(`payload exceeds ${C} files`,"input-invalid");let o=0;for(let r of t){if(typeof r.path!="string"||r.path.length===0)throw new p("every file must have a non-empty path","input-invalid");if(typeof r.source!="string"||r.source.length===0)throw new p(`file "${r.path}" has empty source`,"input-invalid");o+=Buffer.byteLength(r.source,"utf8")}if(o>L)throw new p(`total payload is ${o} bytes (max ${L})`,"input-invalid");if(!t.some(r=>r.path===I))throw new p(`payload must include "${I}" \u2014 the runner entry point`,"input-invalid");return t}async function ue(e){let t;try{t=ce(e)}catch(n){if(n instanceof p)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let o=j(t);if(o.length>0)return{logs:[],facts:{},errors:o.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let r;try{r=await k(t)}catch(n){if(n instanceof h)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await _({bundledSource:r.source,timeoutMs:e.timeoutMs})}catch(n){if(n instanceof x)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}0&&(module.exports={SandboxError,runInSandbox});
3
+ `;return e.replace(r,r+n)}async function A(e){if(!e.find(r=>r.path===E))throw new h(`payload must include "${E}" \u2014 that's the entry point the runner targets`);let o=new Map;for(let r of e)o.set(r.path,r.source);try{let s=(await(0,$.build)({entryPoints:[`${w}:${E}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(c){c.onResolve({filter:/.*/},i=>{if(i.kind==="entry-point")return{path:i.path.replace(`${w}:`,""),namespace:w};if(i.namespace!==w)return null;if(i.path.startsWith("@directive-run/")){let a=ee(i.path);return a?{external:!0,path:a}:{external:!0,path:i.path}}if(i.path.startsWith("./")||i.path.startsWith("../")){let a=i.importer.replace(/\/[^/]+$/,""),u=i.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${a}/${u}.ts`,`${a}/${u}.js`,`${a}/${u}`,`${u}.ts`,`${u}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of g)if(o.has(m))return{path:m,namespace:w};throw new h(`cannot resolve "${i.path}" from "${i.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${i.path}" from "${i.importer}" \u2014 only relative or @directive-run/* allowed`)}),c.onLoad({filter:/.*/,namespace:w},i=>{let a=o.get(i.path);if(a===void 0)throw new h(`virtual file missing: ${i.path}`);if(i.path===E){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {"," (globalThis).__directiveSandbox_system__ = system;","}"].join(`
4
+ `);return{contents:a+u,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!s)throw new h("esbuild produced no output");let n=te(s);return{source:n,bytes:Buffer.byteLength(n,"utf8")}}catch(r){throw r instanceof h?r:new h(`bundle failed: ${r.message??String(r)}`,r)}}var x=require("fs"),N=require("os"),b=require("path"),R=require("url"),D=require("worker_threads"),ce={},ne=100,oe=1e4,F=5e3;async function _(){let{createRequire:e}=await import("module");return e(ce.url).resolve("@directive-run/sandbox/worker")}var y=class extends Error{constructor(o,r){super(o);this.code=r;this.name="WorkerExecError"}};function se(e){let t=e??F;return Number.isFinite(t)?Math.min(oe,Math.max(ne,Math.floor(t))):F}async function ie(){let e=(0,N.tmpdir)();if((0,x.existsSync)(e))return e;let t=await _();return(0,b.dirname)((0,b.dirname)(t))}async function ae(e){let t=await ie(),o=(0,x.mkdtempSync)((0,b.join)(t,"directive-sandbox-")),r=(0,b.join)(o,"bundle.mjs");return(0,x.writeFileSync)(r,e,"utf8"),{bundlePath:r,cleanup:()=>{try{(0,x.rmSync)(o,{recursive:!0,force:!0})}catch{}}}}async function O(e){let t=se(e.timeoutMs),o=await _(),{bundlePath:r,cleanup:s}=await ae(e.bundledSource),n=new D.Worker(o,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),c=null,i=!1,a=Date.now();try{return await new Promise((g,m)=>{let f=!1;n.once("message",d=>{f=!0,d.ok?g(d.result):m(new y(d.error,"worker-error"))}),n.once("error",d=>{f=!0,m(new y(d.message,"worker-error"))}),n.once("exit",d=>{!f&&d!==0&&d!==null&&m(new y(`worker exited with code ${d} before responding`,"worker-error"))}),c=setTimeout(()=>{i=!0,n.terminate(),m(new y(`wall-clock budget of ${t}ms elapsed`,"timeout"))},t);let v={bundlePath:(0,R.pathToFileURL)(r).href,timeoutMs:t,derivationKeys:e.derivationKeys};n.postMessage(v)})}catch(u){if(u instanceof y&&u.code==="timeout")return{logs:[],facts:{},derived:{},errors:[u.message],durationMs:Date.now()-a,timedOut:!0};throw u}finally{c&&clearTimeout(c),await n.terminate().catch(()=>{}),s()}}function ue(e,t){let o=0;for(let r=t;r<e.length;r++){let s=e[r];if(s==="{")o+=1;else if(s==="}"&&(o-=1,o===0))return r}return-1}function le(e){let t=[],o=0,r=0,s=0,n=0,c=i=>{let a=e.slice(o,i).trim();if(o=i+1,!a)return;let u=a.match(/^['"]?(\w+)['"]?\s*:/);u&&t.push(u[1])};for(let i=0;i<e.length;i++){let a=e[i];a==="{"?r+=1:a==="}"?r-=1:a==="("?s+=1:a===")"?s-=1:a==="["?n+=1:a==="]"?n-=1:(a===","||a===`
5
+ `)&&r===0&&s===0&&n===0&&c(i)}return c(e.length),t}function j(e,t){let o=new RegExp(`\\b${t}\\s*:\\s*\\{`),r=e.match(o);if(!r||r.index===void 0)return[];let s=e.indexOf("{",r.index);if(s===-1)return[];let n=ue(e,s);return n===-1?[]:le(e.slice(s+1,n))}function L(e){let t=new Set,o=[];for(let r of e){for(let s of j(r.source,"derive"))t.has(s)||(t.add(s),o.push(s));for(let s of j(r.source,"derivations"))t.has(s)||(t.add(s),o.push(s))}return o}var p=class extends Error{constructor(o,r){super(o);this.code=r;this.name="SandboxError"}};var l=require("ts-morph"),W=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),K=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function C(e){let t=e.match(/^@directive-run\/([^/]+)/);return t?t[1]:null}function de(e){if(/^\.{1,2}\/.+\.js$/.test(e))return!0;let t=C(e);return t===null||K.has(t)?!1:W.has(t)}var B=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),P=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function pe(e){let t=C(e);return t&&K.has(t)?`import "${e}" is denied \u2014 @directive-run/${t} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${e}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(W).sort().join(",")}}.`}function fe(e,t,o){let r=t.getSourceFileOrThrow(e);for(let s of r.getImportDeclarations()){let n=s.getModuleSpecifierValue();if(!de(n)){let{line:c,column:i}=r.getLineAndColumnAtPos(s.getStart());o.push({path:e,line:c,column:i,message:pe(n)})}}}function me(e,t,o){let r=t.getSourceFileOrThrow(e);r.forEachDescendant(s=>{if(s.getKind()===l.SyntaxKind.ImportKeyword){let n=s.getParent();if(n&&n.getKind()===l.SyntaxKind.CallExpression){let{line:c,column:i}=r.getLineAndColumnAtPos(s.getStart());o.push({path:e,line:c,column:i,message:"dynamic import() is not allowed in the sandbox"})}}if(s.getKind()===l.SyntaxKind.NewExpression){let n=s.getText();if(/^new\s+Function\s*\(/.test(n)){let{line:c,column:i}=r.getLineAndColumnAtPos(s.getStart());o.push({path:e,line:c,column:i,message:"new Function(...) is not allowed in the sandbox"})}}})}function ge(e,t,o){let r=t.getSourceFileOrThrow(e),s=(c,i)=>{let{line:a,column:u}=r.getLineAndColumnAtPos(c.getStart());o.push({path:e,line:a,column:u,message:i})},n=c=>{let i=c.trim();return i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'")||i.startsWith("`")&&i.endsWith("`")?i.slice(1,-1):null};r.forEachDescendant(c=>{let i=c.getKind();if(i===l.SyntaxKind.PropertyAccessExpression){let a=c.getName?.();if(!a)return;if(a==="constructor"){s(c,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(P.has(a)){s(c,`\`.${a}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(i===l.SyntaxKind.ElementAccessExpression){let a=c.getExpression?.(),u=c.getArgumentExpression?.(),g=a?.getText()??"",m=u?.getText()??"",f=n(m);if(g==="globalThis"&&f!==null){s(c,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(f!==null&&(f==="constructor"||P.has(f))){s(c,`bracket-access \`["${f}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(i===l.SyntaxKind.CallExpression){let u=c.getExpression?.()?.getText()??"";if(u==="Function"){s(c,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let f=c.getArguments?.()??[];if(f.length>=2){let v=f[0].getText(),d=n(f[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(v==="globalThis"||B.has(v))&&d!==null&&(d==="constructor"||P.has(d))&&s(c,`\`${g[1]}.${g[2]}(${v}, "${d}")\` would reach a denied name`)}}}})}function he(e,t,o){let r=t.getSourceFileOrThrow(e),s=new Set;for(let n of r.getImportDeclarations()){for(let a of n.getNamedImports())s.add(a.getName());let c=n.getDefaultImport();c&&s.add(c.getText());let i=n.getNamespaceImport();i&&s.add(i.getText())}for(let n of r.getVariableDeclarations())s.add(n.getName());for(let n of r.getFunctions()){let c=n.getName();c&&s.add(c)}for(let n of r.getClasses()){let c=n.getName();c&&s.add(c)}r.forEachDescendant(n=>{if(n.getKind()!==l.SyntaxKind.Identifier)return;let c=n.getText();if(s.has(c)||B.has(c))return;let i=n.getParent();if(i){let a=i.getKind();if(a===l.SyntaxKind.PropertyAssignment&&i.getNameNode?.()===n||a===l.SyntaxKind.PropertyAccessExpression&&i.getNameNode?.()===n||a===l.SyntaxKind.MethodDeclaration||a===l.SyntaxKind.ImportSpecifier||a===l.SyntaxKind.ExportSpecifier||a===l.SyntaxKind.NamespaceImport||a===l.SyntaxKind.ImportClause||a===l.SyntaxKind.Parameter||a===l.SyntaxKind.TypeReference||a===l.SyntaxKind.TypeQuery)return}if(P.has(c)){let{line:a,column:u}=r.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:a,column:u,message:`identifier "${c}" is denied in the sandbox (FS/network/eval surface)`})}})}function V(e){let t=[],o=new l.Project({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let r of e)o.createSourceFile(r.path,r.source,{overwrite:!0});for(let r of e)fe(r.path,o,t),me(r.path,o,t),ge(r.path,o,t),he(r.path,o,t);return t}var q=2e5,U=10,T="src/main.ts";function ye(e){if(e.files&&e.source)throw new p("pass either `source` or `files`, not both","input-invalid");if(!e.files&&!e.source)throw new p("must pass either `source` or `files`","input-invalid");let t=e.files?e.files:[{path:T,source:e.source??""}];if(t.length===0)throw new p("files array is empty","input-invalid");if(t.length>U)throw new p(`payload exceeds ${U} files`,"input-invalid");let o=0;for(let r of t){if(typeof r.path!="string"||r.path.length===0)throw new p("every file must have a non-empty path","input-invalid");if(typeof r.source!="string"||r.source.length===0)throw new p(`file "${r.path}" has empty source`,"input-invalid");o+=Buffer.byteLength(r.source,"utf8")}if(o>q)throw new p(`total payload is ${o} bytes (max ${q})`,"input-invalid");if(!t.some(r=>r.path===T))throw new p(`payload must include "${T}" \u2014 the runner entry point`,"input-invalid");return t}async function xe(e){let t;try{t=ye(e)}catch(n){if(n instanceof p)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let o=V(t);if(o.length>0)return{logs:[],facts:{},derived:{},errors:o.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let r=L(t),s;try{s=await A(t)}catch(n){if(n instanceof h)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await O({bundledSource:s.source,derivationKeys:r,timeoutMs:e.timeoutMs})}catch(n){if(n instanceof y)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}0&&(module.exports={SandboxError,runInSandbox});
5
6
  //# sourceMappingURL=index.cjs.map
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts","../src/bundler.ts","../src/host.ts","../src/types.ts","../src/validator.ts"],"sourcesContent":["/**\n * Public API for `@directive-run/sandbox`.\n *\n * Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n *\n * Consumers:\n *\n * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" || file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" || file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n","/**\n * esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n *\n * `@directive-run/*` packages are marked **external** — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n *\n * The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n */\n\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /** Single ESM string ready to evaluate inside the worker. */\n source: string;\n /** Total bytes of the bundled JS (informational). */\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/**\n * Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n *\n * esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n *\n * var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n *\n * The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n */\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d*)\\s*=\\s*createSystem\\s*\\([\\s\\S]*?\\)\\s*;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // Wildcard pattern lets ANY @directive-run/* import the validator\n // permits resolve at worker runtime against the worker's\n // node_modules. The validator gates which packages can be\n // imported in the first place; the bundler just doesn't try to\n // inline them.\n external: [\"@directive-run/*\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /.*/ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // External — let esbuild's external list handle it.\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") || args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /.*/, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/**\n * Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n *\n * Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n */\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n // shim of import.meta exposes a `resolve` that isn't callable, and\n // `createRequire` works in both real Node ESM and Vitest dev mode.\n // The worker subpath export points at dist/worker.js; CJS resolution\n // picks up the \"default\" condition we set in package.json.\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" | \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number | undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/**\n * Resolve the directory the sandbox package's own dist sits in. The\n * temp bundle has to live somewhere Node's ESM resolver can walk UP\n * from to find `@directive-run/core` in node_modules; the sandbox\n * package's dist/ has that path because sandbox declares core as a\n * dependency. Writing the bundle next to dist/worker.js inherits the\n * same resolution chain.\n */\nasync function getSandboxPackageDir(): Promise<string> {\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/**\n * Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL. Bare specifiers like `@directive-run/core`\n * don't resolve from `data:` URLs (no hierarchical base for\n * node_modules lookup) AND don't resolve from /tmp (no node_modules\n * to walk up to). Writing inside the sandbox package directory\n * inherits its node_modules chain.\n *\n * Caller MUST clean the directory up in a finally block.\n */\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const sandboxDir = await getSandboxPackageDir();\n const dir = mkdtempSync(join(sandboxDir, \".sandbox-tmp-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout | null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/**\n * Public types for `@directive-run/sandbox`.\n *\n * The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n */\n\nexport interface PlaygroundFile {\n /**\n * Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n */\n path: string;\n /** File contents. */\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /** Single-file shortcut. Mapped onto \"src/main.ts\" internally. */\n source?: string;\n /** Multi-file payload (the `generate_module` paired output shape). */\n files?: PlaygroundFile[];\n /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /**\n * Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n */\n logs: string[];\n /**\n * Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n */\n facts: Record<string, unknown>;\n /**\n * Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n */\n errors: string[];\n /** Elapsed wall-clock duration of the worker execution. */\n durationMs: number;\n /** True when the wall-clock budget elapsed before settle()/destroy(). */\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n | \"validation-failed\"\n | \"bundle-failed\"\n | \"worker-error\"\n | \"timeout\"\n | \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/**\n * Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n */\nexport interface WorkerInputMessage {\n /** `file://` URL of the temp .mjs bundle the host wrote. */\n bundlePath: string;\n timeoutMs: number;\n}\n\n/** Wire shape for messages from worker → host. */\nexport type WorkerOutputMessage =\n | { ok: true; result: SandboxResult }\n | { ok: false; error: string };\n","/**\n * AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n *\n * Allowlist:\n *\n * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,\n * `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.*`, `Math.*`, `JSON.*`. Anything that touches\n * global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n *\n * Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n *\n * Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n */\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n *\n * Packages deliberately EXCLUDED:\n *\n * - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n *\n * The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n */\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/**\n * Extract the package name segment from a @directive-run/* specifier.\n *\n * \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n *\n * Returns null when the specifier doesn't match the scope.\n */\nfunction extractDirectivePackage(specifier: string): string | null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/**\n * Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n */\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/**\n * Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n */\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s*\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/**\n * The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n *\n * The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n *\n * Rules:\n *\n * 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n */\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string | null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) ||\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) ||\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } | undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" || DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" || ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" ||\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier ||\n parentKind === SyntaxKind.ExportSpecifier ||\n parentKind === SyntaxKind.NamespaceImport ||\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference ||\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n"],"mappings":"0jBAAA,IAAAA,GAAA,GAAAC,EAAAD,GAAA,kBAAAE,EAAA,iBAAAC,KAAA,eAAAC,EAAAJ,ICgBA,IAAAK,EAAsB,mBAGhBC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,EAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CAiGF,IAAMC,GAhGS,QAAM,SAAM,CACzB,YAAa,CAAC,GAAGf,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAExC,MAAO,CAAE,SAAU,GAAM,KAAMA,EAAK,IAAK,EAE3C,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,EAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CC9LA,IAAAC,EAAmD,cACnDC,EAA8B,gBAC9BC,EAA8B,eAC9BC,EAAuB,0BAfvBC,GAAA,GAsBMC,EAAiB,IACjBC,EAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAcL,GAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CAOO,IAAMM,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,EAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,EAAgB,KAAK,IAAID,EAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CAUA,eAAeS,GAAwC,CAGrD,IAAMC,EAAa,MAAMT,EAAkB,EAE3C,SAAO,cAAQ,WAAQS,CAAU,CAAC,CACpC,CAYA,eAAeC,GAAkBC,EAG9B,CACD,IAAMC,EAAa,MAAMJ,EAAqB,EACxCK,KAAM,kBAAY,QAAKD,EAAY,eAAe,CAAC,EACnDE,KAAa,QAAKD,EAAK,YAAY,EACzC,0BAAcC,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,IACF,UAAOD,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYZ,EAAaW,EAAM,SAAS,EACxCP,EAAa,MAAMT,EAAkB,EACrC,CAAE,WAAAc,EAAY,QAASI,CAAe,EAAI,MAAMR,GACpDM,EAAM,aACR,EACMG,EAAS,IAAI,SAAOV,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CA+CF,OA9Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAItB,EAAgBwB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAItB,EAAgByB,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAASf,GAAS,CACxB,CAACqB,GAAWrB,IAAS,GAAKA,IAAS,MACrCoB,EACE,IAAItB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDgB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAItB,EACF,wBAAwBe,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMd,EAA8B,CAClC,cAAY,iBAAcW,CAAU,EAAE,KACtC,UAAAG,CACF,EACAE,EAAO,YAAYhB,CAAO,CAC5B,CAAC,CAGH,OAASwB,EAAK,CACZ,GAAIA,aAAezB,GAAmByB,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC5IO,IAAMU,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,EC3CA,IAAAC,EAAoC,oBAuB9BC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,GAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,GAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,GAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,GACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAMC,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAM,aAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAJ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAME,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,GACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS,aAAW,yBAA0B,CAChD,IAAMC,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS,aAAW,wBAAyB,CAC/C,IAAME,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS,aAAW,eAAgB,CAStC,IAAMO,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,WAChC,OAEF,IAAMS,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAe,aAAW,oBAE1B3B,EACA,cAAc,IACKD,GAKnB4B,IAAe,aAAW,0BAE1B3B,EACA,cAAc,IACGD,GAKjB4B,IAAe,aAAW,mBAK5BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,cAKxBA,IAAe,aAAW,WAK5BA,IAAe,aAAW,eAC1BA,IAAe,aAAW,UAE1B,MAEJ,CAEA,GAAIxC,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAI,UAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWuC,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,GAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,GAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,GAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CJphBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAGF,IAAIC,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBV,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeM,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACN,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAKF,OAJe,MAAMO,EAAa,CAChC,cAAeH,EAAQ,OACvB,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["src_exports","__export","SandboxError","runInSandbox","__toCommonJS","import_esbuild","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","import_node_fs","import_node_path","import_node_url","import_node_worker_threads","import_meta","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getSandboxPackageDir","workerPath","writeBundleToTemp","bundledSource","sandboxDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","SandboxError","message","code","import_ts_morph","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}
1
+ {"version":3,"sources":["../src/index.ts","../src/bundler.ts","../src/host.ts","../src/key-extractor.ts","../src/types.ts","../src/validator.ts"],"sourcesContent":["/**\n * Public API for `@directive-run/sandbox`.\n *\n * Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n *\n * Consumers:\n *\n * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { extractDerivationKeys } from \"./key-extractor.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" || file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" || file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n // Phase A audit P0-DM2: pre-extract derivation key names from the\n // source files so the worker can iterate them after settle. The\n // `system.derive` proxy has no `ownKeys` trap.\n const derivationKeys = extractDerivationKeys(files);\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n derivationKeys,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n","/**\n * esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n *\n * `@directive-run/*` packages are marked **external** — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n *\n * The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n */\n\nimport { createRequire } from \"node:module\";\nimport { pathToFileURL } from \"node:url\";\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Resolve a `@directive-run/*` bare specifier to an absolute file://\n * URL using the host process's node_modules. Required because the\n * worker imports the bundle from `/tmp` (Phase A P0-A1) where Node's\n * ESM resolver can't walk up to find `@directive-run/*`. By rewriting\n * to absolute file URLs at bundle time, the worker doesn't need a\n * node_modules anchor.\n *\n * Returns null when the package can't be resolved (e.g. consumer has\n * a different install layout); the caller falls back to leaving the\n * bare specifier in place, which works when the worker IS next to\n * node_modules.\n */\nfunction resolveDirectivePackageToFileUrl(specifier: string): string | null {\n try {\n const require = createRequire(import.meta.url);\n const resolved = require.resolve(specifier);\n return pathToFileURL(resolved).href;\n } catch {\n return null;\n }\n}\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /** Single ESM string ready to evaluate inside the worker. */\n source: string;\n /** Total bytes of the bundled JS (informational). */\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/**\n * Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n *\n * esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n *\n * var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n *\n * The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n */\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d*)\\s*=\\s*createSystem\\s*\\([\\s\\S]*?\\)\\s*;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // The plugin's onResolve below intercepts every `@directive-run/*`\n // import and rewrites it to an absolute file:// URL (so the\n // worker can import the bundle from /tmp without needing\n // node_modules above it). The wildcard external is the safety\n // net for any specifier the plugin doesn't recognize.\n external: [\"@directive-run/*\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /.*/ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // Phase A audit P0-A1: rewrite to absolute file:// URL\n // so the worker's `/tmp/.../bundle.mjs` can import the\n // package without needing node_modules above /tmp.\n // Falls back to the bare specifier when resolution\n // fails — the legacy \"write next to node_modules\"\n // pattern still works as a backup.\n const resolved = resolveDirectivePackageToFileUrl(args.path);\n if (resolved) {\n return { external: true, path: resolved };\n }\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") || args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /.*/, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/**\n * Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n *\n * Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n */\n\nimport { existsSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n // shim of import.meta exposes a `resolve` that isn't callable, and\n // `createRequire` works in both real Node ESM and Vitest dev mode.\n // The worker subpath export points at dist/worker.js; CJS resolution\n // picks up the \"default\" condition we set in package.json.\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n /** Derivation key names extracted from the payload's source files. */\n derivationKeys: string[];\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" | \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number | undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/**\n * Try `os.tmpdir()` first (Vercel-friendly: /tmp is the only writable\n * location on serverless functions). Fall back to the sandbox package\n * dir if /tmp ISN'T writable for some reason. The fallback inherits\n * the package's node_modules walking chain so bare specifiers like\n * `@directive-run/core` resolve naturally.\n */\nasync function getTempBundleDir(): Promise<string> {\n const osTmp = tmpdir();\n if (existsSync(osTmp)) {\n return osTmp;\n }\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/**\n * Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL.\n *\n * Phase A audit P0-A1: previous versions wrote inside the sandbox\n * package's own directory so Node's resolver could walk up to find\n * `@directive-run/core` in node_modules — but Vercel / AWS Lambda /\n * Cloud Run all ship read-only FS outside `/tmp`. The bundler now\n * rewrites `@directive-run/*` imports to ABSOLUTE `file://` URLs of\n * the host's resolved paths (see `bundleSandboxFiles`), so the temp\n * file can live in `/tmp` without needing a node_modules anchor.\n *\n * Caller MUST clean the directory up in a finally block.\n */\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const baseDir = await getTempBundleDir();\n const dir = mkdtempSync(join(baseDir, \"directive-sandbox-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout | null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n derivationKeys: input.derivationKeys,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/**\n * Pure regex-based extractor for `derive:` / `derivations:` block keys\n * across a payload of source files. Mirrors the lightweight pattern the\n * docs site's DevTools panel uses for static-structure parsing.\n *\n * Phase A AE audit (P0-DM2): `system.derive` is a Proxy with no\n * `ownKeys` trap, so the worker can't enumerate derivations from inside\n * the sandbox. Instead, the host pre-scans source files for the\n * declared keys and forwards them to the worker, which then reads\n * `system.derive[key]` for each.\n *\n * Best-effort: a module that builds derivation keys dynamically (e.g.\n * `derive: Object.fromEntries(keys.map(k => [k, fn]))`) won't be\n * extracted. That's acceptable for the audit's stated goal of\n * \"transcript reflects what the module declared.\"\n */\n\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Find the matching `}` for the `{` at `openBrace`. Returns the index\n * of the close brace, or -1 if unbalanced.\n */\nfunction findMatchingClose(source: string, openBrace: number): number {\n let depth = 0;\n for (let i = openBrace; i < source.length; i++) {\n const ch = source[i];\n if (ch === \"{\") depth += 1;\n else if (ch === \"}\") {\n depth -= 1;\n if (depth === 0) return i;\n }\n }\n return -1;\n}\n\n/**\n * Pull top-level `key:` segments out of a brace-balanced block. Keys\n * are found between `,` or `\\n` or the block start at brace depth 0\n * AND paren depth 0. Works for both multi-line and compact `{ a: 1,\n * b: 2 }` forms.\n */\nfunction collectTopLevelKeys(block: string): string[] {\n const keys: string[] = [];\n let segStart = 0;\n let braceDepth = 0;\n let parenDepth = 0;\n let bracketDepth = 0;\n\n const flushSegment = (end: number) => {\n const seg = block.slice(segStart, end).trim();\n segStart = end + 1;\n if (!seg) return;\n // Tolerate leading quotes for `\"foo\":` quoted keys.\n const m = seg.match(/^['\"]?(\\w+)['\"]?\\s*:/);\n if (m) keys.push(m[1]!);\n };\n\n for (let j = 0; j < block.length; j++) {\n const ch = block[j];\n if (ch === \"{\") braceDepth += 1;\n else if (ch === \"}\") braceDepth -= 1;\n else if (ch === \"(\") parenDepth += 1;\n else if (ch === \")\") parenDepth -= 1;\n else if (ch === \"[\") bracketDepth += 1;\n else if (ch === \"]\") bracketDepth -= 1;\n else if (\n (ch === \",\" || ch === \"\\n\") &&\n braceDepth === 0 &&\n parenDepth === 0 &&\n bracketDepth === 0\n ) {\n flushSegment(j);\n }\n }\n // Final segment (no trailing comma/newline).\n flushSegment(block.length);\n return keys;\n}\n\nfunction extractTopLevelKeys(source: string, sectionName: string): string[] {\n const headerRe = new RegExp(`\\\\b${sectionName}\\\\s*:\\\\s*\\\\{`);\n const headerMatch = source.match(headerRe);\n if (!headerMatch || headerMatch.index === undefined) {\n return [];\n }\n const openBrace = source.indexOf(\"{\", headerMatch.index);\n if (openBrace === -1) {\n return [];\n }\n const closeBrace = findMatchingClose(source, openBrace);\n if (closeBrace === -1) {\n return [];\n }\n return collectTopLevelKeys(source.slice(openBrace + 1, closeBrace));\n}\n\n/**\n * Collect the union of derivation key names declared across all files\n * in the payload. Looks at both `derive:` (module config block) and\n * `derivations:` (schema block). De-duplicates.\n */\nexport function extractDerivationKeys(files: PlaygroundFile[]): string[] {\n const seen = new Set<string>();\n const out: string[] = [];\n for (const file of files) {\n for (const k of extractTopLevelKeys(file.source, \"derive\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n for (const k of extractTopLevelKeys(file.source, \"derivations\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n }\n return out;\n}\n","/**\n * Public types for `@directive-run/sandbox`.\n *\n * The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n */\n\nexport interface PlaygroundFile {\n /**\n * Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n */\n path: string;\n /** File contents. */\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /** Single-file shortcut. Mapped onto \"src/main.ts\" internally. */\n source?: string;\n /** Multi-file payload (the `generate_module` paired output shape). */\n files?: PlaygroundFile[];\n /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /**\n * Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n */\n logs: string[];\n /**\n * Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n */\n facts: Record<string, unknown>;\n /**\n * Final `system.derive` snapshot — every derivation declared in the\n * module config, evaluated by reading `system.derive[key]`. Empty\n * when the module has no `derive:` block or when validation rejected\n * before bundle. The Phase A AE audit (P0-DM2) flagged the original\n * sandbox for snapshotting only facts; modules whose primary product\n * is a derivation (`status`, `isReady`, etc.) returned an empty-\n * looking transcript.\n */\n derived: Record<string, unknown>;\n /**\n * Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n */\n errors: string[];\n /** Elapsed wall-clock duration of the worker execution. */\n durationMs: number;\n /** True when the wall-clock budget elapsed before settle()/destroy(). */\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n | \"validation-failed\"\n | \"bundle-failed\"\n | \"worker-error\"\n | \"timeout\"\n | \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/**\n * Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n */\nexport interface WorkerInputMessage {\n /** `file://` URL of the temp .mjs bundle the host wrote. */\n bundlePath: string;\n timeoutMs: number;\n /**\n * Derivation key names the host extracted from the source files.\n * `system.derive` is a Proxy with no `ownKeys` trap, so we can't\n * enumerate from the worker; the host's pre-bundle pass scans the\n * source for `derive:` and `derivations:` blocks and forwards the\n * keys here. Worker reads `system.derive[key]` for each.\n */\n derivationKeys: string[];\n}\n\n/** Wire shape for messages from worker → host. */\nexport type WorkerOutputMessage =\n | { ok: true; result: SandboxResult }\n | { ok: false; error: string };\n","/**\n * AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n *\n * Allowlist:\n *\n * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,\n * `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.*`, `Math.*`, `JSON.*`. Anything that touches\n * global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n *\n * Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n *\n * Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n */\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n *\n * Packages deliberately EXCLUDED:\n *\n * - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n *\n * The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n */\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/**\n * Extract the package name segment from a @directive-run/* specifier.\n *\n * \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n *\n * Returns null when the specifier doesn't match the scope.\n */\nfunction extractDirectivePackage(specifier: string): string | null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/**\n * Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n */\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/**\n * Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n */\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s*\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/**\n * The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n *\n * The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n *\n * Rules:\n *\n * 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n */\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string | null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) ||\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) ||\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } | undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" || DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" || ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" ||\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier ||\n parentKind === SyntaxKind.ExportSpecifier ||\n parentKind === SyntaxKind.NamespaceImport ||\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference ||\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n"],"mappings":"0jBAAA,IAAAA,GAAA,GAAAC,EAAAD,GAAA,kBAAAE,EAAA,iBAAAC,KAAA,eAAAC,EAAAJ,ICgBA,IAAAK,EAA8B,kBAC9BC,EAA8B,eAC9BC,EAAsB,mBAlBtBC,GAAA,GAkCA,SAASC,GAAiCC,EAAkC,CAC1E,GAAI,CAEF,IAAMC,KADU,iBAAcH,GAAY,GAAG,EACpB,QAAQE,CAAS,EAC1C,SAAO,iBAAcC,CAAQ,EAAE,IACjC,MAAQ,CACN,OAAO,IACT,CACF,CAEA,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,GAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CA0GF,IAAMC,GAzGS,QAAM,SAAM,CACzB,YAAa,CAAC,GAAGf,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAAG,CAO3C,IAAMnB,EAAWF,GAAiCqB,EAAK,IAAI,EAC3D,OAAInB,EACK,CAAE,SAAU,GAAM,KAAMA,CAAS,EAEnC,CAAE,SAAU,GAAM,KAAMmB,EAAK,IAAK,CAC3C,CACA,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,GAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CChOA,IAAAC,EAA+D,cAC/DC,EAAuB,cACvBC,EAA8B,gBAC9BC,EAA8B,eAC9BC,EAAuB,0BAhBvBC,GAAA,GAuBMC,GAAiB,IACjBC,GAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAcL,GAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CASO,IAAMM,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,GAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,GAAgB,KAAK,IAAID,GAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CASA,eAAeS,IAAoC,CACjD,IAAMC,KAAQ,UAAO,EACrB,MAAI,cAAWA,CAAK,EAClB,OAAOA,EAIT,IAAMC,EAAa,MAAMV,EAAkB,EAE3C,SAAO,cAAQ,WAAQU,CAAU,CAAC,CACpC,CAgBA,eAAeC,GAAkBC,EAG9B,CACD,IAAMC,EAAU,MAAML,GAAiB,EACjCM,KAAM,kBAAY,QAAKD,EAAS,oBAAoB,CAAC,EACrDE,KAAa,QAAKD,EAAK,YAAY,EACzC,0BAAcC,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,IACF,UAAOD,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYb,GAAaY,EAAM,SAAS,EACxCP,EAAa,MAAMV,EAAkB,EACrC,CAAE,WAAAe,EAAY,QAASI,CAAe,EAAI,MAAMR,GACpDM,EAAM,aACR,EACMG,EAAS,IAAI,SAAOV,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CAgDF,OA/Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAIvB,EAAgByB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAIvB,EAAgB0B,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAAShB,GAAS,CACxB,CAACsB,GAAWtB,IAAS,GAAKA,IAAS,MACrCqB,EACE,IAAIvB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDiB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAIvB,EACF,wBAAwBgB,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMf,EAA8B,CAClC,cAAY,iBAAcY,CAAU,EAAE,KACtC,UAAAG,EACA,eAAgBD,EAAM,cACxB,EACAG,EAAO,YAAYjB,CAAO,CAC5B,CAAC,CAGH,OAASyB,EAAK,CACZ,GAAIA,aAAe1B,GAAmB0B,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC7LA,SAASU,GAAkBC,EAAgBC,EAA2B,CACpE,IAAIC,EAAQ,EACZ,QAASC,EAAIF,EAAWE,EAAIH,EAAO,OAAQG,IAAK,CAC9C,IAAMC,EAAKJ,EAAOG,CAAC,EACnB,GAAIC,IAAO,IAAKF,GAAS,UAChBE,IAAO,MACdF,GAAS,EACLA,IAAU,GAAG,OAAOC,CAE5B,CACA,MAAO,EACT,CAQA,SAASE,GAAoBC,EAAyB,CACpD,IAAMC,EAAiB,CAAC,EACpBC,EAAW,EACXC,EAAa,EACbC,EAAa,EACbC,EAAe,EAEbC,EAAgBC,GAAgB,CACpC,IAAMC,EAAMR,EAAM,MAAME,EAAUK,CAAG,EAAE,KAAK,EAE5C,GADAL,EAAWK,EAAM,EACb,CAACC,EAAK,OAEV,IAAMC,EAAID,EAAI,MAAM,sBAAsB,EACtCC,GAAGR,EAAK,KAAKQ,EAAE,CAAC,CAAE,CACxB,EAEA,QAASC,EAAI,EAAGA,EAAIV,EAAM,OAAQU,IAAK,CACrC,IAAMZ,EAAKE,EAAMU,CAAC,EACdZ,IAAO,IAAKK,GAAc,EACrBL,IAAO,IAAKK,GAAc,EAC1BL,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKO,GAAgB,EAC5BP,IAAO,IAAKO,GAAgB,GAElCP,IAAO,KAAOA,IAAO;AAAA,IACtBK,IAAe,GACfC,IAAe,GACfC,IAAiB,GAEjBC,EAAaI,CAAC,CAElB,CAEA,OAAAJ,EAAaN,EAAM,MAAM,EAClBC,CACT,CAEA,SAASU,EAAoBjB,EAAgBkB,EAA+B,CAC1E,IAAMC,EAAW,IAAI,OAAO,MAAMD,CAAW,cAAc,EACrDE,EAAcpB,EAAO,MAAMmB,CAAQ,EACzC,GAAI,CAACC,GAAeA,EAAY,QAAU,OACxC,MAAO,CAAC,EAEV,IAAMnB,EAAYD,EAAO,QAAQ,IAAKoB,EAAY,KAAK,EACvD,GAAInB,IAAc,GAChB,MAAO,CAAC,EAEV,IAAMoB,EAAatB,GAAkBC,EAAQC,CAAS,EACtD,OAAIoB,IAAe,GACV,CAAC,EAEHhB,GAAoBL,EAAO,MAAMC,EAAY,EAAGoB,CAAU,CAAC,CACpE,CAOO,SAASC,EAAsBC,EAAmC,CACvE,IAAMC,EAAO,IAAI,IACXC,EAAgB,CAAC,EACvB,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAKV,EAAoBS,EAAK,OAAQ,QAAQ,EAClDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,GAGd,QAAWA,KAAKV,EAAoBS,EAAK,OAAQ,aAAa,EACvDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,EAGhB,CACA,OAAOF,CACT,CClDO,IAAMG,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,ECrDA,IAAAC,EAAoC,oBAuB9BC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,GAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,GAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,GAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,GACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAMC,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAM,aAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAJ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAME,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,GACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS,aAAW,yBAA0B,CAChD,IAAMC,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS,aAAW,wBAAyB,CAC/C,IAAME,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS,aAAW,eAAgB,CAStC,IAAMO,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,WAChC,OAEF,IAAMS,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAe,aAAW,oBAE1B3B,EACA,cAAc,IACKD,GAKnB4B,IAAe,aAAW,0BAE1B3B,EACA,cAAc,IACGD,GAKjB4B,IAAe,aAAW,mBAK5BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,cAKxBA,IAAe,aAAW,WAK5BA,IAAe,aAAW,eAC1BA,IAAe,aAAW,UAE1B,MAEJ,CAEA,GAAIxC,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAI,UAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWuC,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,GAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,GAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,GAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CLnhBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAMF,IAAMC,EAAiBC,EAAsBV,CAAK,EAE9CW,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBZ,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAMF,OALe,MAAMS,EAAa,CAChC,cAAeH,EAAQ,OACvB,eAAAF,EACA,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeU,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACV,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["src_exports","__export","SandboxError","runInSandbox","__toCommonJS","import_node_module","import_node_url","import_esbuild","import_meta","resolveDirectivePackageToFileUrl","specifier","resolved","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","import_node_fs","import_node_os","import_node_path","import_node_url","import_node_worker_threads","import_meta","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getTempBundleDir","osTmp","workerPath","writeBundleToTemp","bundledSource","baseDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","findMatchingClose","source","openBrace","depth","i","ch","collectTopLevelKeys","block","keys","segStart","braceDepth","parenDepth","bracketDepth","flushSegment","end","seg","m","j","extractTopLevelKeys","sectionName","headerRe","headerMatch","closeBrace","extractDerivationKeys","files","seen","out","file","k","SandboxError","message","code","import_ts_morph","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","derivationKeys","extractDerivationKeys","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}
package/dist/index.d.cts CHANGED
@@ -37,6 +37,16 @@ interface SandboxResult {
37
37
  * Empty when no system was constructed (e.g. validator rejection).
38
38
  */
39
39
  facts: Record<string, unknown>;
40
+ /**
41
+ * Final `system.derive` snapshot — every derivation declared in the
42
+ * module config, evaluated by reading `system.derive[key]`. Empty
43
+ * when the module has no `derive:` block or when validation rejected
44
+ * before bundle. The Phase A AE audit (P0-DM2) flagged the original
45
+ * sandbox for snapshotting only facts; modules whose primary product
46
+ * is a derivation (`status`, `isReady`, etc.) returned an empty-
47
+ * looking transcript.
48
+ */
49
+ derived: Record<string, unknown>;
40
50
  /**
41
51
  * Structured error messages from validation, bundling, or runtime
42
52
  * exceptions. Empty on a clean run.
package/dist/index.d.ts CHANGED
@@ -37,6 +37,16 @@ interface SandboxResult {
37
37
  * Empty when no system was constructed (e.g. validator rejection).
38
38
  */
39
39
  facts: Record<string, unknown>;
40
+ /**
41
+ * Final `system.derive` snapshot — every derivation declared in the
42
+ * module config, evaluated by reading `system.derive[key]`. Empty
43
+ * when the module has no `derive:` block or when validation rejected
44
+ * before bundle. The Phase A AE audit (P0-DM2) flagged the original
45
+ * sandbox for snapshotting only facts; modules whose primary product
46
+ * is a derivation (`status`, `isReady`, etc.) returned an empty-
47
+ * looking transcript.
48
+ */
49
+ derived: Record<string, unknown>;
40
50
  /**
41
51
  * Structured error messages from validation, bundling, or runtime
42
52
  * exceptions. Empty on a clean run.
package/dist/index.js CHANGED
@@ -1,5 +1,6 @@
1
- import{build as D}from"esbuild";var b="src/main.ts",y="directive-sandbox-vfs",h=class extends Error{constructor(i,e){super(i);this.cause=e;this.name="BundleError"}};function W(t){let r=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,i=t.match(r);if(!i)return t;let e=i[1],a=`
2
- (globalThis).__directiveSandbox_system__ = ${i[2]};
3
- `;return t.replace(e,e+a)}async function v(t){if(!t.find(e=>e.path===b))throw new h(`payload must include "${b}" \u2014 that's the entry point the runner targets`);let i=new Map;for(let e of t)i.set(e.path,e.source);try{let n=(await D({entryPoints:[`${y}:${b}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(s){s.onResolve({filter:/.*/},o=>{if(o.kind==="entry-point")return{path:o.path.replace(`${y}:`,""),namespace:y};if(o.namespace!==y)return null;if(o.path.startsWith("@directive-run/"))return{external:!0,path:o.path};if(o.path.startsWith("./")||o.path.startsWith("../")){let c=o.importer.replace(/\/[^/]+$/,""),u=o.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${c}/${u}.ts`,`${c}/${u}.js`,`${c}/${u}`,`${u}.ts`,`${u}.js`].map(f=>f.replace(/\/+/g,"/"));for(let f of g)if(i.has(f))return{path:f,namespace:y};throw new h(`cannot resolve "${o.path}" from "${o.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${o.path}" from "${o.importer}" \u2014 only relative or @directive-run/* allowed`)}),s.onLoad({filter:/.*/,namespace:y},o=>{let c=i.get(o.path);if(c===void 0)throw new h(`virtual file missing: ${o.path}`);if(o.path===b){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {"," (globalThis).__directiveSandbox_system__ = system;","}"].join(`
4
- `);return{contents:c+u,loader:"ts"}}return{contents:c,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!n)throw new h("esbuild produced no output");let a=W(n);return{source:a,bytes:Buffer.byteLength(a,"utf8")}}catch(e){throw e instanceof h?e:new h(`bundle failed: ${e.message??String(e)}`,e)}}import{mkdtempSync as j,rmSync as L,writeFileSync as C}from"fs";import{dirname as P,join as I}from"path";import{pathToFileURL as B}from"url";import{Worker as K}from"worker_threads";var V=100,q=1e4,M=5e3;async function T(){let{createRequire:t}=await import("module");return t(import.meta.url).resolve("@directive-run/sandbox/worker")}var x=class extends Error{constructor(i,e){super(i);this.code=e;this.name="WorkerExecError"}};function G(t){let r=t??M;return Number.isFinite(r)?Math.min(q,Math.max(V,Math.floor(r))):M}async function U(){let t=await T();return P(P(t))}async function H(t){let r=await U(),i=j(I(r,".sandbox-tmp-")),e=I(i,"bundle.mjs");return C(e,t,"utf8"),{bundlePath:e,cleanup:()=>{try{L(i,{recursive:!0,force:!0})}catch{}}}}async function k(t){let r=G(t.timeoutMs),i=await T(),{bundlePath:e,cleanup:n}=await H(t.bundledSource),a=new K(i,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),s=null,o=!1,c=Date.now();try{return await new Promise((g,f)=>{let p=!1;a.once("message",d=>{p=!0,d.ok?g(d.result):f(new x(d.error,"worker-error"))}),a.once("error",d=>{p=!0,f(new x(d.message,"worker-error"))}),a.once("exit",d=>{!p&&d!==0&&d!==null&&f(new x(`worker exited with code ${d} before responding`,"worker-error"))}),s=setTimeout(()=>{o=!0,a.terminate(),f(new x(`wall-clock budget of ${r}ms elapsed`,"timeout"))},r);let w={bundlePath:B(e).href,timeoutMs:r};a.postMessage(w)})}catch(u){if(u instanceof x&&u.code==="timeout")return{logs:[],facts:{},errors:[u.message],durationMs:Date.now()-c,timedOut:!0};throw u}finally{s&&clearTimeout(s),await a.terminate().catch(()=>{}),n()}}var m=class extends Error{constructor(i,e){super(i);this.code=e;this.name="SandboxError"}};import{Project as X,SyntaxKind as l}from"ts-morph";var A=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),$=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function F(t){let r=t.match(/^@directive-run\/([^/]+)/);return r?r[1]:null}function z(t){if(/^\.{1,2}\/.+\.js$/.test(t))return!0;let r=F(t);return r===null||$.has(r)?!1:A.has(r)}var N=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),S=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function Y(t){let r=F(t);return r&&$.has(r)?`import "${t}" is denied \u2014 @directive-run/${r} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${t}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(A).sort().join(",")}}.`}function J(t,r,i){let e=r.getSourceFileOrThrow(t);for(let n of e.getImportDeclarations()){let a=n.getModuleSpecifierValue();if(!z(a)){let{line:s,column:o}=e.getLineAndColumnAtPos(n.getStart());i.push({path:t,line:s,column:o,message:Y(a)})}}}function Q(t,r,i){let e=r.getSourceFileOrThrow(t);e.forEachDescendant(n=>{if(n.getKind()===l.ImportKeyword){let a=n.getParent();if(a&&a.getKind()===l.CallExpression){let{line:s,column:o}=e.getLineAndColumnAtPos(n.getStart());i.push({path:t,line:s,column:o,message:"dynamic import() is not allowed in the sandbox"})}}if(n.getKind()===l.NewExpression){let a=n.getText();if(/^new\s+Function\s*\(/.test(a)){let{line:s,column:o}=e.getLineAndColumnAtPos(n.getStart());i.push({path:t,line:s,column:o,message:"new Function(...) is not allowed in the sandbox"})}}})}function Z(t,r,i){let e=r.getSourceFileOrThrow(t),n=(s,o)=>{let{line:c,column:u}=e.getLineAndColumnAtPos(s.getStart());i.push({path:t,line:c,column:u,message:o})},a=s=>{let o=s.trim();return o.startsWith('"')&&o.endsWith('"')||o.startsWith("'")&&o.endsWith("'")||o.startsWith("`")&&o.endsWith("`")?o.slice(1,-1):null};e.forEachDescendant(s=>{let o=s.getKind();if(o===l.PropertyAccessExpression){let c=s.getName?.();if(!c)return;if(c==="constructor"){n(s,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(S.has(c)){n(s,`\`.${c}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(o===l.ElementAccessExpression){let c=s.getExpression?.(),u=s.getArgumentExpression?.(),g=c?.getText()??"",f=u?.getText()??"",p=a(f);if(g==="globalThis"&&p!==null){n(s,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(p!==null&&(p==="constructor"||S.has(p))){n(s,`bracket-access \`["${p}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(o===l.CallExpression){let u=s.getExpression?.()?.getText()??"";if(u==="Function"){n(s,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let p=s.getArguments?.()??[];if(p.length>=2){let w=p[0].getText(),d=a(p[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(w==="globalThis"||N.has(w))&&d!==null&&(d==="constructor"||S.has(d))&&n(s,`\`${g[1]}.${g[2]}(${w}, "${d}")\` would reach a denied name`)}}}})}function ee(t,r,i){let e=r.getSourceFileOrThrow(t),n=new Set;for(let a of e.getImportDeclarations()){for(let c of a.getNamedImports())n.add(c.getName());let s=a.getDefaultImport();s&&n.add(s.getText());let o=a.getNamespaceImport();o&&n.add(o.getText())}for(let a of e.getVariableDeclarations())n.add(a.getName());for(let a of e.getFunctions()){let s=a.getName();s&&n.add(s)}for(let a of e.getClasses()){let s=a.getName();s&&n.add(s)}e.forEachDescendant(a=>{if(a.getKind()!==l.Identifier)return;let s=a.getText();if(n.has(s)||N.has(s))return;let o=a.getParent();if(o){let c=o.getKind();if(c===l.PropertyAssignment&&o.getNameNode?.()===a||c===l.PropertyAccessExpression&&o.getNameNode?.()===a||c===l.MethodDeclaration||c===l.ImportSpecifier||c===l.ExportSpecifier||c===l.NamespaceImport||c===l.ImportClause||c===l.Parameter||c===l.TypeReference||c===l.TypeQuery)return}if(S.has(s)){let{line:c,column:u}=e.getLineAndColumnAtPos(a.getStart());i.push({path:t,line:c,column:u,message:`identifier "${s}" is denied in the sandbox (FS/network/eval surface)`})}})}function _(t){let r=[],i=new X({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let e of t)i.createSourceFile(e.path,e.source,{overwrite:!0});for(let e of t)J(e.path,i,r),Q(e.path,i,r),Z(e.path,i,r),ee(e.path,i,r);return r}var O=2e5,R=10,E="src/main.ts";function te(t){if(t.files&&t.source)throw new m("pass either `source` or `files`, not both","input-invalid");if(!t.files&&!t.source)throw new m("must pass either `source` or `files`","input-invalid");let r=t.files?t.files:[{path:E,source:t.source??""}];if(r.length===0)throw new m("files array is empty","input-invalid");if(r.length>R)throw new m(`payload exceeds ${R} files`,"input-invalid");let i=0;for(let e of r){if(typeof e.path!="string"||e.path.length===0)throw new m("every file must have a non-empty path","input-invalid");if(typeof e.source!="string"||e.source.length===0)throw new m(`file "${e.path}" has empty source`,"input-invalid");i+=Buffer.byteLength(e.source,"utf8")}if(i>O)throw new m(`total payload is ${i} bytes (max ${O})`,"input-invalid");if(!r.some(e=>e.path===E))throw new m(`payload must include "${E}" \u2014 the runner entry point`,"input-invalid");return r}async function xe(t){let r;try{r=te(t)}catch(n){if(n instanceof m)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let i=_(r);if(i.length>0)return{logs:[],facts:{},errors:i.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let e;try{e=await v(r)}catch(n){if(n instanceof h)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await k({bundledSource:e.source,timeoutMs:t.timeoutMs})}catch(n){if(n instanceof x)return{logs:[],facts:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}export{m as SandboxError,xe as runInSandbox};
1
+ import{createRequire as L}from"module";import{pathToFileURL as W}from"url";import{build as K}from"esbuild";function C(e){try{let s=L(import.meta.url).resolve(e);return W(s).href}catch{return null}}var b="src/main.ts",x="directive-sandbox-vfs",h=class extends Error{constructor(s,t){super(s);this.cause=t;this.name="BundleError"}};function B(e){let r=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,s=e.match(r);if(!s)return e;let t=s[1],n=`
2
+ (globalThis).__directiveSandbox_system__ = ${s[2]};
3
+ `;return e.replace(t,t+n)}async function E(e){if(!e.find(t=>t.path===b))throw new h(`payload must include "${b}" \u2014 that's the entry point the runner targets`);let s=new Map;for(let t of e)s.set(t.path,t.source);try{let i=(await K({entryPoints:[`${x}:${b}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(c){c.onResolve({filter:/.*/},o=>{if(o.kind==="entry-point")return{path:o.path.replace(`${x}:`,""),namespace:x};if(o.namespace!==x)return null;if(o.path.startsWith("@directive-run/")){let a=C(o.path);return a?{external:!0,path:a}:{external:!0,path:o.path}}if(o.path.startsWith("./")||o.path.startsWith("../")){let a=o.importer.replace(/\/[^/]+$/,""),u=o.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${a}/${u}.ts`,`${a}/${u}.js`,`${a}/${u}`,`${u}.ts`,`${u}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of g)if(s.has(m))return{path:m,namespace:x};throw new h(`cannot resolve "${o.path}" from "${o.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${o.path}" from "${o.importer}" \u2014 only relative or @directive-run/* allowed`)}),c.onLoad({filter:/.*/,namespace:x},o=>{let a=s.get(o.path);if(a===void 0)throw new h(`virtual file missing: ${o.path}`);if(o.path===b){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {"," (globalThis).__directiveSandbox_system__ = system;","}"].join(`
4
+ `);return{contents:a+u,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!i)throw new h("esbuild produced no output");let n=B(i);return{source:n,bytes:Buffer.byteLength(n,"utf8")}}catch(t){throw t instanceof h?t:new h(`bundle failed: ${t.message??String(t)}`,t)}}import{existsSync as V,mkdtempSync as q,rmSync as U,writeFileSync as G}from"fs";import{tmpdir as H}from"os";import{dirname as P,join as T}from"path";import{pathToFileURL as X}from"url";import{Worker as z}from"worker_threads";var Y=100,J=1e4,I=5e3;async function M(){let{createRequire:e}=await import("module");return e(import.meta.url).resolve("@directive-run/sandbox/worker")}var y=class extends Error{constructor(s,t){super(s);this.code=t;this.name="WorkerExecError"}};function Q(e){let r=e??I;return Number.isFinite(r)?Math.min(J,Math.max(Y,Math.floor(r))):I}async function Z(){let e=H();if(V(e))return e;let r=await M();return P(P(r))}async function ee(e){let r=await Z(),s=q(T(r,"directive-sandbox-")),t=T(s,"bundle.mjs");return G(t,e,"utf8"),{bundlePath:t,cleanup:()=>{try{U(s,{recursive:!0,force:!0})}catch{}}}}async function k(e){let r=Q(e.timeoutMs),s=await M(),{bundlePath:t,cleanup:i}=await ee(e.bundledSource),n=new z(s,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),c=null,o=!1,a=Date.now();try{return await new Promise((g,m)=>{let p=!1;n.once("message",d=>{p=!0,d.ok?g(d.result):m(new y(d.error,"worker-error"))}),n.once("error",d=>{p=!0,m(new y(d.message,"worker-error"))}),n.once("exit",d=>{!p&&d!==0&&d!==null&&m(new y(`worker exited with code ${d} before responding`,"worker-error"))}),c=setTimeout(()=>{o=!0,n.terminate(),m(new y(`wall-clock budget of ${r}ms elapsed`,"timeout"))},r);let w={bundlePath:X(t).href,timeoutMs:r,derivationKeys:e.derivationKeys};n.postMessage(w)})}catch(u){if(u instanceof y&&u.code==="timeout")return{logs:[],facts:{},derived:{},errors:[u.message],durationMs:Date.now()-a,timedOut:!0};throw u}finally{c&&clearTimeout(c),await n.terminate().catch(()=>{}),i()}}function te(e,r){let s=0;for(let t=r;t<e.length;t++){let i=e[t];if(i==="{")s+=1;else if(i==="}"&&(s-=1,s===0))return t}return-1}function re(e){let r=[],s=0,t=0,i=0,n=0,c=o=>{let a=e.slice(s,o).trim();if(s=o+1,!a)return;let u=a.match(/^['"]?(\w+)['"]?\s*:/);u&&r.push(u[1])};for(let o=0;o<e.length;o++){let a=e[o];a==="{"?t+=1:a==="}"?t-=1:a==="("?i+=1:a===")"?i-=1:a==="["?n+=1:a==="]"?n-=1:(a===","||a===`
5
+ `)&&t===0&&i===0&&n===0&&c(o)}return c(e.length),r}function $(e,r){let s=new RegExp(`\\b${r}\\s*:\\s*\\{`),t=e.match(s);if(!t||t.index===void 0)return[];let i=e.indexOf("{",t.index);if(i===-1)return[];let n=te(e,i);return n===-1?[]:re(e.slice(i+1,n))}function A(e){let r=new Set,s=[];for(let t of e){for(let i of $(t.source,"derive"))r.has(i)||(r.add(i),s.push(i));for(let i of $(t.source,"derivations"))r.has(i)||(r.add(i),s.push(i))}return s}var f=class extends Error{constructor(s,t){super(s);this.code=t;this.name="SandboxError"}};import{Project as ne,SyntaxKind as l}from"ts-morph";var F=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),N=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function R(e){let r=e.match(/^@directive-run\/([^/]+)/);return r?r[1]:null}function oe(e){if(/^\.{1,2}\/.+\.js$/.test(e))return!0;let r=R(e);return r===null||N.has(r)?!1:F.has(r)}var D=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),v=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function se(e){let r=R(e);return r&&N.has(r)?`import "${e}" is denied \u2014 @directive-run/${r} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${e}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(F).sort().join(",")}}.`}function ie(e,r,s){let t=r.getSourceFileOrThrow(e);for(let i of t.getImportDeclarations()){let n=i.getModuleSpecifierValue();if(!oe(n)){let{line:c,column:o}=t.getLineAndColumnAtPos(i.getStart());s.push({path:e,line:c,column:o,message:se(n)})}}}function ae(e,r,s){let t=r.getSourceFileOrThrow(e);t.forEachDescendant(i=>{if(i.getKind()===l.ImportKeyword){let n=i.getParent();if(n&&n.getKind()===l.CallExpression){let{line:c,column:o}=t.getLineAndColumnAtPos(i.getStart());s.push({path:e,line:c,column:o,message:"dynamic import() is not allowed in the sandbox"})}}if(i.getKind()===l.NewExpression){let n=i.getText();if(/^new\s+Function\s*\(/.test(n)){let{line:c,column:o}=t.getLineAndColumnAtPos(i.getStart());s.push({path:e,line:c,column:o,message:"new Function(...) is not allowed in the sandbox"})}}})}function ce(e,r,s){let t=r.getSourceFileOrThrow(e),i=(c,o)=>{let{line:a,column:u}=t.getLineAndColumnAtPos(c.getStart());s.push({path:e,line:a,column:u,message:o})},n=c=>{let o=c.trim();return o.startsWith('"')&&o.endsWith('"')||o.startsWith("'")&&o.endsWith("'")||o.startsWith("`")&&o.endsWith("`")?o.slice(1,-1):null};t.forEachDescendant(c=>{let o=c.getKind();if(o===l.PropertyAccessExpression){let a=c.getName?.();if(!a)return;if(a==="constructor"){i(c,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(v.has(a)){i(c,`\`.${a}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(o===l.ElementAccessExpression){let a=c.getExpression?.(),u=c.getArgumentExpression?.(),g=a?.getText()??"",m=u?.getText()??"",p=n(m);if(g==="globalThis"&&p!==null){i(c,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(p!==null&&(p==="constructor"||v.has(p))){i(c,`bracket-access \`["${p}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(o===l.CallExpression){let u=c.getExpression?.()?.getText()??"";if(u==="Function"){i(c,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let p=c.getArguments?.()??[];if(p.length>=2){let w=p[0].getText(),d=n(p[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(w==="globalThis"||D.has(w))&&d!==null&&(d==="constructor"||v.has(d))&&i(c,`\`${g[1]}.${g[2]}(${w}, "${d}")\` would reach a denied name`)}}}})}function ue(e,r,s){let t=r.getSourceFileOrThrow(e),i=new Set;for(let n of t.getImportDeclarations()){for(let a of n.getNamedImports())i.add(a.getName());let c=n.getDefaultImport();c&&i.add(c.getText());let o=n.getNamespaceImport();o&&i.add(o.getText())}for(let n of t.getVariableDeclarations())i.add(n.getName());for(let n of t.getFunctions()){let c=n.getName();c&&i.add(c)}for(let n of t.getClasses()){let c=n.getName();c&&i.add(c)}t.forEachDescendant(n=>{if(n.getKind()!==l.Identifier)return;let c=n.getText();if(i.has(c)||D.has(c))return;let o=n.getParent();if(o){let a=o.getKind();if(a===l.PropertyAssignment&&o.getNameNode?.()===n||a===l.PropertyAccessExpression&&o.getNameNode?.()===n||a===l.MethodDeclaration||a===l.ImportSpecifier||a===l.ExportSpecifier||a===l.NamespaceImport||a===l.ImportClause||a===l.Parameter||a===l.TypeReference||a===l.TypeQuery)return}if(v.has(c)){let{line:a,column:u}=t.getLineAndColumnAtPos(n.getStart());s.push({path:e,line:a,column:u,message:`identifier "${c}" is denied in the sandbox (FS/network/eval surface)`})}})}function _(e){let r=[],s=new ne({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let t of e)s.createSourceFile(t.path,t.source,{overwrite:!0});for(let t of e)ie(t.path,s,r),ae(t.path,s,r),ce(t.path,s,r),ue(t.path,s,r);return r}var O=2e5,j=10,S="src/main.ts";function le(e){if(e.files&&e.source)throw new f("pass either `source` or `files`, not both","input-invalid");if(!e.files&&!e.source)throw new f("must pass either `source` or `files`","input-invalid");let r=e.files?e.files:[{path:S,source:e.source??""}];if(r.length===0)throw new f("files array is empty","input-invalid");if(r.length>j)throw new f(`payload exceeds ${j} files`,"input-invalid");let s=0;for(let t of r){if(typeof t.path!="string"||t.path.length===0)throw new f("every file must have a non-empty path","input-invalid");if(typeof t.source!="string"||t.source.length===0)throw new f(`file "${t.path}" has empty source`,"input-invalid");s+=Buffer.byteLength(t.source,"utf8")}if(s>O)throw new f(`total payload is ${s} bytes (max ${O})`,"input-invalid");if(!r.some(t=>t.path===S))throw new f(`payload must include "${S}" \u2014 the runner entry point`,"input-invalid");return r}async function Fe(e){let r;try{r=le(e)}catch(n){if(n instanceof f)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let s=_(r);if(s.length>0)return{logs:[],facts:{},derived:{},errors:s.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let t=A(r),i;try{i=await E(r)}catch(n){if(n instanceof h)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await k({bundledSource:i.source,derivationKeys:t,timeoutMs:e.timeoutMs})}catch(n){if(n instanceof y)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}export{f as SandboxError,Fe as runInSandbox};
5
6
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/bundler.ts","../src/host.ts","../src/types.ts","../src/validator.ts","../src/index.ts"],"sourcesContent":["/**\n * esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n *\n * `@directive-run/*` packages are marked **external** — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n *\n * The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n */\n\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /** Single ESM string ready to evaluate inside the worker. */\n source: string;\n /** Total bytes of the bundled JS (informational). */\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/**\n * Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n *\n * esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n *\n * var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n *\n * The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n */\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d*)\\s*=\\s*createSystem\\s*\\([\\s\\S]*?\\)\\s*;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // Wildcard pattern lets ANY @directive-run/* import the validator\n // permits resolve at worker runtime against the worker's\n // node_modules. The validator gates which packages can be\n // imported in the first place; the bundler just doesn't try to\n // inline them.\n external: [\"@directive-run/*\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /.*/ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // External — let esbuild's external list handle it.\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") || args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /.*/, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/**\n * Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n *\n * Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n */\n\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n // shim of import.meta exposes a `resolve` that isn't callable, and\n // `createRequire` works in both real Node ESM and Vitest dev mode.\n // The worker subpath export points at dist/worker.js; CJS resolution\n // picks up the \"default\" condition we set in package.json.\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" | \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number | undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/**\n * Resolve the directory the sandbox package's own dist sits in. The\n * temp bundle has to live somewhere Node's ESM resolver can walk UP\n * from to find `@directive-run/core` in node_modules; the sandbox\n * package's dist/ has that path because sandbox declares core as a\n * dependency. Writing the bundle next to dist/worker.js inherits the\n * same resolution chain.\n */\nasync function getSandboxPackageDir(): Promise<string> {\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/**\n * Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL. Bare specifiers like `@directive-run/core`\n * don't resolve from `data:` URLs (no hierarchical base for\n * node_modules lookup) AND don't resolve from /tmp (no node_modules\n * to walk up to). Writing inside the sandbox package directory\n * inherits its node_modules chain.\n *\n * Caller MUST clean the directory up in a finally block.\n */\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const sandboxDir = await getSandboxPackageDir();\n const dir = mkdtempSync(join(sandboxDir, \".sandbox-tmp-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout | null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/**\n * Public types for `@directive-run/sandbox`.\n *\n * The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n */\n\nexport interface PlaygroundFile {\n /**\n * Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n */\n path: string;\n /** File contents. */\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /** Single-file shortcut. Mapped onto \"src/main.ts\" internally. */\n source?: string;\n /** Multi-file payload (the `generate_module` paired output shape). */\n files?: PlaygroundFile[];\n /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /**\n * Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n */\n logs: string[];\n /**\n * Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n */\n facts: Record<string, unknown>;\n /**\n * Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n */\n errors: string[];\n /** Elapsed wall-clock duration of the worker execution. */\n durationMs: number;\n /** True when the wall-clock budget elapsed before settle()/destroy(). */\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n | \"validation-failed\"\n | \"bundle-failed\"\n | \"worker-error\"\n | \"timeout\"\n | \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/**\n * Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n */\nexport interface WorkerInputMessage {\n /** `file://` URL of the temp .mjs bundle the host wrote. */\n bundlePath: string;\n timeoutMs: number;\n}\n\n/** Wire shape for messages from worker → host. */\nexport type WorkerOutputMessage =\n | { ok: true; result: SandboxResult }\n | { ok: false; error: string };\n","/**\n * AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n *\n * Allowlist:\n *\n * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,\n * `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.*`, `Math.*`, `JSON.*`. Anything that touches\n * global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n *\n * Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n *\n * Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n */\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n *\n * Packages deliberately EXCLUDED:\n *\n * - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n *\n * The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n */\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/**\n * Extract the package name segment from a @directive-run/* specifier.\n *\n * \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n *\n * Returns null when the specifier doesn't match the scope.\n */\nfunction extractDirectivePackage(specifier: string): string | null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/**\n * Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n */\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/**\n * Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n */\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s*\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/**\n * The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n *\n * The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n *\n * Rules:\n *\n * 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n */\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string | null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) ||\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) ||\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } | undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" || DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" || ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" ||\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier ||\n parentKind === SyntaxKind.ExportSpecifier ||\n parentKind === SyntaxKind.NamespaceImport ||\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference ||\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n","/**\n * Public API for `@directive-run/sandbox`.\n *\n * Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n *\n * Consumers:\n *\n * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" || file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" || file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n"],"mappings":"AAgBA,OAAS,SAAAA,MAAa,UAGtB,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,EAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CAiGF,IAAMC,GAhGS,MAAMjB,EAAM,CACzB,YAAa,CAAC,GAAGE,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAExC,MAAO,CAAE,SAAU,GAAM,KAAMA,EAAK,IAAK,EAE3C,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,EAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CC9LA,OAAS,eAAAC,EAAa,UAAAC,EAAQ,iBAAAC,MAAqB,KACnD,OAAS,WAAAC,EAAS,QAAAC,MAAY,OAC9B,OAAS,iBAAAC,MAAqB,MAC9B,OAAS,UAAAC,MAAc,iBAOvB,IAAMC,EAAiB,IACjBC,EAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAc,YAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CAOO,IAAMC,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,EAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,EAAgB,KAAK,IAAID,EAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CAUA,eAAeS,GAAwC,CAGrD,IAAMC,EAAa,MAAMT,EAAkB,EAE3C,OAAOP,EAAQA,EAAQgB,CAAU,CAAC,CACpC,CAYA,eAAeC,EAAkBC,EAG9B,CACD,IAAMC,EAAa,MAAMJ,EAAqB,EACxCK,EAAMvB,EAAYI,EAAKkB,EAAY,eAAe,CAAC,EACnDE,EAAapB,EAAKmB,EAAK,YAAY,EACzC,OAAArB,EAAcsB,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,CACFvB,EAAOsB,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYZ,EAAaW,EAAM,SAAS,EACxCP,EAAa,MAAMT,EAAkB,EACrC,CAAE,WAAAc,EAAY,QAASI,CAAe,EAAI,MAAMR,EACpDM,EAAM,aACR,EACMG,EAAS,IAAIvB,EAAOa,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CA+CF,OA9Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAItB,EAAgBwB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAItB,EAAgByB,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAASf,GAAS,CACxB,CAACqB,GAAWrB,IAAS,GAAKA,IAAS,MACrCoB,EACE,IAAItB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDgB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAItB,EACF,wBAAwBe,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMd,EAA8B,CAClC,WAAYR,EAAcmB,CAAU,EAAE,KACtC,UAAAG,CACF,EACAE,EAAO,YAAYhB,CAAO,CAC5B,CAAC,CAGH,OAASwB,EAAK,CACZ,GAAIA,aAAezB,GAAmByB,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC5IO,IAAMU,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,EC3CA,OAAS,WAAAC,EAAS,cAAAC,MAAkB,WAuBpC,IAAMC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,EAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,EAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,EACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,EAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,EAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,EACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMsB,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAMtB,EAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAkB,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMuB,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,EACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS7B,EAAW,yBAA0B,CAChD,IAAM8B,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS7B,EAAW,wBAAyB,CAC/C,IAAM+B,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS7B,EAAW,eAAgB,CAStC,IAAMoC,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,WAChC,OAEF,IAAM8B,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAejD,EAAW,oBAE1BsB,EACA,cAAc,IACKD,GAKnB4B,IAAejD,EAAW,0BAE1BsB,EACA,cAAc,IACGD,GAKjB4B,IAAejD,EAAW,mBAK5BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,cAKxBiD,IAAejD,EAAW,WAK5BiD,IAAejD,EAAW,eAC1BiD,IAAejD,EAAW,UAE1B,MAEJ,CAEA,GAAIS,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAId,EAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWqD,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,EAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,EAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,EAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CCphBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAGF,IAAIC,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBV,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeM,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACN,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAKF,OAJe,MAAMO,EAAa,CAChC,cAAeH,EAAQ,OACvB,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["build","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","mkdtempSync","rmSync","writeFileSync","dirname","join","pathToFileURL","Worker","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getSandboxPackageDir","workerPath","writeBundleToTemp","bundledSource","sandboxDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","SandboxError","message","code","Project","SyntaxKind","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}
1
+ {"version":3,"sources":["../src/bundler.ts","../src/host.ts","../src/key-extractor.ts","../src/types.ts","../src/validator.ts","../src/index.ts"],"sourcesContent":["/**\n * esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n *\n * `@directive-run/*` packages are marked **external** — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n *\n * The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n */\n\nimport { createRequire } from \"node:module\";\nimport { pathToFileURL } from \"node:url\";\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Resolve a `@directive-run/*` bare specifier to an absolute file://\n * URL using the host process's node_modules. Required because the\n * worker imports the bundle from `/tmp` (Phase A P0-A1) where Node's\n * ESM resolver can't walk up to find `@directive-run/*`. By rewriting\n * to absolute file URLs at bundle time, the worker doesn't need a\n * node_modules anchor.\n *\n * Returns null when the package can't be resolved (e.g. consumer has\n * a different install layout); the caller falls back to leaving the\n * bare specifier in place, which works when the worker IS next to\n * node_modules.\n */\nfunction resolveDirectivePackageToFileUrl(specifier: string): string | null {\n try {\n const require = createRequire(import.meta.url);\n const resolved = require.resolve(specifier);\n return pathToFileURL(resolved).href;\n } catch {\n return null;\n }\n}\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /** Single ESM string ready to evaluate inside the worker. */\n source: string;\n /** Total bytes of the bundled JS (informational). */\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/**\n * Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n *\n * esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n *\n * var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n *\n * The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n */\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d*)\\s*=\\s*createSystem\\s*\\([\\s\\S]*?\\)\\s*;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // The plugin's onResolve below intercepts every `@directive-run/*`\n // import and rewrites it to an absolute file:// URL (so the\n // worker can import the bundle from /tmp without needing\n // node_modules above it). The wildcard external is the safety\n // net for any specifier the plugin doesn't recognize.\n external: [\"@directive-run/*\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /.*/ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // Phase A audit P0-A1: rewrite to absolute file:// URL\n // so the worker's `/tmp/.../bundle.mjs` can import the\n // package without needing node_modules above /tmp.\n // Falls back to the bare specifier when resolution\n // fails — the legacy \"write next to node_modules\"\n // pattern still works as a backup.\n const resolved = resolveDirectivePackageToFileUrl(args.path);\n if (resolved) {\n return { external: true, path: resolved };\n }\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") || args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /.*/, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/**\n * Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n *\n * Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n */\n\nimport { existsSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n // shim of import.meta exposes a `resolve` that isn't callable, and\n // `createRequire` works in both real Node ESM and Vitest dev mode.\n // The worker subpath export points at dist/worker.js; CJS resolution\n // picks up the \"default\" condition we set in package.json.\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n /** Derivation key names extracted from the payload's source files. */\n derivationKeys: string[];\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" | \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number | undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/**\n * Try `os.tmpdir()` first (Vercel-friendly: /tmp is the only writable\n * location on serverless functions). Fall back to the sandbox package\n * dir if /tmp ISN'T writable for some reason. The fallback inherits\n * the package's node_modules walking chain so bare specifiers like\n * `@directive-run/core` resolve naturally.\n */\nasync function getTempBundleDir(): Promise<string> {\n const osTmp = tmpdir();\n if (existsSync(osTmp)) {\n return osTmp;\n }\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/**\n * Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL.\n *\n * Phase A audit P0-A1: previous versions wrote inside the sandbox\n * package's own directory so Node's resolver could walk up to find\n * `@directive-run/core` in node_modules — but Vercel / AWS Lambda /\n * Cloud Run all ship read-only FS outside `/tmp`. The bundler now\n * rewrites `@directive-run/*` imports to ABSOLUTE `file://` URLs of\n * the host's resolved paths (see `bundleSandboxFiles`), so the temp\n * file can live in `/tmp` without needing a node_modules anchor.\n *\n * Caller MUST clean the directory up in a finally block.\n */\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const baseDir = await getTempBundleDir();\n const dir = mkdtempSync(join(baseDir, \"directive-sandbox-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout | null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n derivationKeys: input.derivationKeys,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/**\n * Pure regex-based extractor for `derive:` / `derivations:` block keys\n * across a payload of source files. Mirrors the lightweight pattern the\n * docs site's DevTools panel uses for static-structure parsing.\n *\n * Phase A AE audit (P0-DM2): `system.derive` is a Proxy with no\n * `ownKeys` trap, so the worker can't enumerate derivations from inside\n * the sandbox. Instead, the host pre-scans source files for the\n * declared keys and forwards them to the worker, which then reads\n * `system.derive[key]` for each.\n *\n * Best-effort: a module that builds derivation keys dynamically (e.g.\n * `derive: Object.fromEntries(keys.map(k => [k, fn]))`) won't be\n * extracted. That's acceptable for the audit's stated goal of\n * \"transcript reflects what the module declared.\"\n */\n\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Find the matching `}` for the `{` at `openBrace`. Returns the index\n * of the close brace, or -1 if unbalanced.\n */\nfunction findMatchingClose(source: string, openBrace: number): number {\n let depth = 0;\n for (let i = openBrace; i < source.length; i++) {\n const ch = source[i];\n if (ch === \"{\") depth += 1;\n else if (ch === \"}\") {\n depth -= 1;\n if (depth === 0) return i;\n }\n }\n return -1;\n}\n\n/**\n * Pull top-level `key:` segments out of a brace-balanced block. Keys\n * are found between `,` or `\\n` or the block start at brace depth 0\n * AND paren depth 0. Works for both multi-line and compact `{ a: 1,\n * b: 2 }` forms.\n */\nfunction collectTopLevelKeys(block: string): string[] {\n const keys: string[] = [];\n let segStart = 0;\n let braceDepth = 0;\n let parenDepth = 0;\n let bracketDepth = 0;\n\n const flushSegment = (end: number) => {\n const seg = block.slice(segStart, end).trim();\n segStart = end + 1;\n if (!seg) return;\n // Tolerate leading quotes for `\"foo\":` quoted keys.\n const m = seg.match(/^['\"]?(\\w+)['\"]?\\s*:/);\n if (m) keys.push(m[1]!);\n };\n\n for (let j = 0; j < block.length; j++) {\n const ch = block[j];\n if (ch === \"{\") braceDepth += 1;\n else if (ch === \"}\") braceDepth -= 1;\n else if (ch === \"(\") parenDepth += 1;\n else if (ch === \")\") parenDepth -= 1;\n else if (ch === \"[\") bracketDepth += 1;\n else if (ch === \"]\") bracketDepth -= 1;\n else if (\n (ch === \",\" || ch === \"\\n\") &&\n braceDepth === 0 &&\n parenDepth === 0 &&\n bracketDepth === 0\n ) {\n flushSegment(j);\n }\n }\n // Final segment (no trailing comma/newline).\n flushSegment(block.length);\n return keys;\n}\n\nfunction extractTopLevelKeys(source: string, sectionName: string): string[] {\n const headerRe = new RegExp(`\\\\b${sectionName}\\\\s*:\\\\s*\\\\{`);\n const headerMatch = source.match(headerRe);\n if (!headerMatch || headerMatch.index === undefined) {\n return [];\n }\n const openBrace = source.indexOf(\"{\", headerMatch.index);\n if (openBrace === -1) {\n return [];\n }\n const closeBrace = findMatchingClose(source, openBrace);\n if (closeBrace === -1) {\n return [];\n }\n return collectTopLevelKeys(source.slice(openBrace + 1, closeBrace));\n}\n\n/**\n * Collect the union of derivation key names declared across all files\n * in the payload. Looks at both `derive:` (module config block) and\n * `derivations:` (schema block). De-duplicates.\n */\nexport function extractDerivationKeys(files: PlaygroundFile[]): string[] {\n const seen = new Set<string>();\n const out: string[] = [];\n for (const file of files) {\n for (const k of extractTopLevelKeys(file.source, \"derive\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n for (const k of extractTopLevelKeys(file.source, \"derivations\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n }\n return out;\n}\n","/**\n * Public types for `@directive-run/sandbox`.\n *\n * The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n */\n\nexport interface PlaygroundFile {\n /**\n * Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n */\n path: string;\n /** File contents. */\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /** Single-file shortcut. Mapped onto \"src/main.ts\" internally. */\n source?: string;\n /** Multi-file payload (the `generate_module` paired output shape). */\n files?: PlaygroundFile[];\n /** Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. */\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /**\n * Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n */\n logs: string[];\n /**\n * Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n */\n facts: Record<string, unknown>;\n /**\n * Final `system.derive` snapshot — every derivation declared in the\n * module config, evaluated by reading `system.derive[key]`. Empty\n * when the module has no `derive:` block or when validation rejected\n * before bundle. The Phase A AE audit (P0-DM2) flagged the original\n * sandbox for snapshotting only facts; modules whose primary product\n * is a derivation (`status`, `isReady`, etc.) returned an empty-\n * looking transcript.\n */\n derived: Record<string, unknown>;\n /**\n * Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n */\n errors: string[];\n /** Elapsed wall-clock duration of the worker execution. */\n durationMs: number;\n /** True when the wall-clock budget elapsed before settle()/destroy(). */\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n | \"validation-failed\"\n | \"bundle-failed\"\n | \"worker-error\"\n | \"timeout\"\n | \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/**\n * Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n */\nexport interface WorkerInputMessage {\n /** `file://` URL of the temp .mjs bundle the host wrote. */\n bundlePath: string;\n timeoutMs: number;\n /**\n * Derivation key names the host extracted from the source files.\n * `system.derive` is a Proxy with no `ownKeys` trap, so we can't\n * enumerate from the worker; the host's pre-bundle pass scans the\n * source for `derive:` and `derivations:` blocks and forwards the\n * keys here. Worker reads `system.derive[key]` for each.\n */\n derivationKeys: string[];\n}\n\n/** Wire shape for messages from worker → host. */\nexport type WorkerOutputMessage =\n | { ok: true; result: SandboxResult }\n | { ok: false; error: string };\n","/**\n * AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n *\n * Allowlist:\n *\n * - Imports: must match `@directive-run/*` (specifically `core`, `ai`,\n * `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.*`, `Math.*`, `JSON.*`. Anything that touches\n * global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n *\n * Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n *\n * Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n */\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/**\n * Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n *\n * Packages deliberately EXCLUDED:\n *\n * - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n *\n * The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n */\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/**\n * Extract the package name segment from a @directive-run/* specifier.\n *\n * \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n *\n * Returns null when the specifier doesn't match the scope.\n */\nfunction extractDirectivePackage(specifier: string): string | null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/**\n * Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n */\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/**\n * Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n */\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s*\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/**\n * The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n *\n * The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n *\n * Rules:\n *\n * 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n */\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string | null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) ||\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) ||\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } | undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" || DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" || ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" ||\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier ||\n parentKind === SyntaxKind.ExportSpecifier ||\n parentKind === SyntaxKind.NamespaceImport ||\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference ||\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n","/**\n * Public API for `@directive-run/sandbox`.\n *\n * Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n *\n * Consumers:\n *\n * - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { extractDerivationKeys } from \"./key-extractor.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" || file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" || file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n // Phase A audit P0-DM2: pre-extract derivation key names from the\n // source files so the worker can iterate them after settle. The\n // `system.derive` proxy has no `ownKeys` trap.\n const derivationKeys = extractDerivationKeys(files);\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n derivationKeys,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n"],"mappings":"AAgBA,OAAS,iBAAAA,MAAqB,SAC9B,OAAS,iBAAAC,MAAqB,MAC9B,OAAS,SAAAC,MAAa,UAgBtB,SAASC,EAAiCC,EAAkC,CAC1E,GAAI,CAEF,IAAMC,EADUL,EAAc,YAAY,GAAG,EACpB,QAAQI,CAAS,EAC1C,OAAOH,EAAcI,CAAQ,EAAE,IACjC,MAAQ,CACN,OAAO,IACT,CACF,CAEA,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,EAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CA0GF,IAAMC,GAzGS,MAAMpB,EAAM,CACzB,YAAa,CAAC,GAAGK,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAAG,CAO3C,IAAMnB,EAAWF,EAAiCqB,EAAK,IAAI,EAC3D,OAAInB,EACK,CAAE,SAAU,GAAM,KAAMA,CAAS,EAEnC,CAAE,SAAU,GAAM,KAAMmB,EAAK,IAAK,CAC3C,CACA,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,EAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CChOA,OAAS,cAAAC,EAAY,eAAAC,EAAa,UAAAC,EAAQ,iBAAAC,MAAqB,KAC/D,OAAS,UAAAC,MAAc,KACvB,OAAS,WAAAC,EAAS,QAAAC,MAAY,OAC9B,OAAS,iBAAAC,MAAqB,MAC9B,OAAS,UAAAC,MAAc,iBAOvB,IAAMC,EAAiB,IACjBC,EAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAc,YAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CASO,IAAMC,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,EAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,EAAgB,KAAK,IAAID,EAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CASA,eAAeS,GAAoC,CACjD,IAAMC,EAAQjB,EAAO,EACrB,GAAIJ,EAAWqB,CAAK,EAClB,OAAOA,EAIT,IAAMC,EAAa,MAAMV,EAAkB,EAE3C,OAAOP,EAAQA,EAAQiB,CAAU,CAAC,CACpC,CAgBA,eAAeC,GAAkBC,EAG9B,CACD,IAAMC,EAAU,MAAML,EAAiB,EACjCM,EAAMzB,EAAYK,EAAKmB,EAAS,oBAAoB,CAAC,EACrDE,EAAarB,EAAKoB,EAAK,YAAY,EACzC,OAAAvB,EAAcwB,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,CACFzB,EAAOwB,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYb,EAAaY,EAAM,SAAS,EACxCP,EAAa,MAAMV,EAAkB,EACrC,CAAE,WAAAe,EAAY,QAASI,CAAe,EAAI,MAAMR,GACpDM,EAAM,aACR,EACMG,EAAS,IAAIxB,EAAOc,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CAgDF,OA/Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAIvB,EAAgByB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAIvB,EAAgB0B,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAAShB,GAAS,CACxB,CAACsB,GAAWtB,IAAS,GAAKA,IAAS,MACrCqB,EACE,IAAIvB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDiB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAIvB,EACF,wBAAwBgB,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMf,EAA8B,CAClC,WAAYR,EAAcoB,CAAU,EAAE,KACtC,UAAAG,EACA,eAAgBD,EAAM,cACxB,EACAG,EAAO,YAAYjB,CAAO,CAC5B,CAAC,CAGH,OAASyB,EAAK,CACZ,GAAIA,aAAe1B,GAAmB0B,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC7LA,SAASU,GAAkBC,EAAgBC,EAA2B,CACpE,IAAIC,EAAQ,EACZ,QAASC,EAAIF,EAAWE,EAAIH,EAAO,OAAQG,IAAK,CAC9C,IAAMC,EAAKJ,EAAOG,CAAC,EACnB,GAAIC,IAAO,IAAKF,GAAS,UAChBE,IAAO,MACdF,GAAS,EACLA,IAAU,GAAG,OAAOC,CAE5B,CACA,MAAO,EACT,CAQA,SAASE,GAAoBC,EAAyB,CACpD,IAAMC,EAAiB,CAAC,EACpBC,EAAW,EACXC,EAAa,EACbC,EAAa,EACbC,EAAe,EAEbC,EAAgBC,GAAgB,CACpC,IAAMC,EAAMR,EAAM,MAAME,EAAUK,CAAG,EAAE,KAAK,EAE5C,GADAL,EAAWK,EAAM,EACb,CAACC,EAAK,OAEV,IAAMC,EAAID,EAAI,MAAM,sBAAsB,EACtCC,GAAGR,EAAK,KAAKQ,EAAE,CAAC,CAAE,CACxB,EAEA,QAASC,EAAI,EAAGA,EAAIV,EAAM,OAAQU,IAAK,CACrC,IAAMZ,EAAKE,EAAMU,CAAC,EACdZ,IAAO,IAAKK,GAAc,EACrBL,IAAO,IAAKK,GAAc,EAC1BL,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKO,GAAgB,EAC5BP,IAAO,IAAKO,GAAgB,GAElCP,IAAO,KAAOA,IAAO;AAAA,IACtBK,IAAe,GACfC,IAAe,GACfC,IAAiB,GAEjBC,EAAaI,CAAC,CAElB,CAEA,OAAAJ,EAAaN,EAAM,MAAM,EAClBC,CACT,CAEA,SAASU,EAAoBjB,EAAgBkB,EAA+B,CAC1E,IAAMC,EAAW,IAAI,OAAO,MAAMD,CAAW,cAAc,EACrDE,EAAcpB,EAAO,MAAMmB,CAAQ,EACzC,GAAI,CAACC,GAAeA,EAAY,QAAU,OACxC,MAAO,CAAC,EAEV,IAAMnB,EAAYD,EAAO,QAAQ,IAAKoB,EAAY,KAAK,EACvD,GAAInB,IAAc,GAChB,MAAO,CAAC,EAEV,IAAMoB,EAAatB,GAAkBC,EAAQC,CAAS,EACtD,OAAIoB,IAAe,GACV,CAAC,EAEHhB,GAAoBL,EAAO,MAAMC,EAAY,EAAGoB,CAAU,CAAC,CACpE,CAOO,SAASC,EAAsBC,EAAmC,CACvE,IAAMC,EAAO,IAAI,IACXC,EAAgB,CAAC,EACvB,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAKV,EAAoBS,EAAK,OAAQ,QAAQ,EAClDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,GAGd,QAAWA,KAAKV,EAAoBS,EAAK,OAAQ,aAAa,EACvDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,EAGhB,CACA,OAAOF,CACT,CClDO,IAAMG,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,ECrDA,OAAS,WAAAC,GAAS,cAAAC,MAAkB,WAuBpC,IAAMC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,GAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,GAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,GAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,GACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMsB,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAMtB,EAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAkB,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMuB,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,GACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS7B,EAAW,yBAA0B,CAChD,IAAM8B,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS7B,EAAW,wBAAyB,CAC/C,IAAM+B,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS7B,EAAW,eAAgB,CAStC,IAAMoC,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,WAChC,OAEF,IAAM8B,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAejD,EAAW,oBAE1BsB,EACA,cAAc,IACKD,GAKnB4B,IAAejD,EAAW,0BAE1BsB,EACA,cAAc,IACGD,GAKjB4B,IAAejD,EAAW,mBAK5BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,cAKxBiD,IAAejD,EAAW,WAK5BiD,IAAejD,EAAW,eAC1BiD,IAAejD,EAAW,UAE1B,MAEJ,CAEA,GAAIS,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAId,GAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWqD,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,GAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,GAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,GAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CCnhBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAMF,IAAMC,EAAiBC,EAAsBV,CAAK,EAE9CW,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBZ,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAMF,OALe,MAAMS,EAAa,CAChC,cAAeH,EAAQ,OACvB,eAAAF,EACA,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeU,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACV,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["createRequire","pathToFileURL","build","resolveDirectivePackageToFileUrl","specifier","resolved","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","existsSync","mkdtempSync","rmSync","writeFileSync","tmpdir","dirname","join","pathToFileURL","Worker","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getTempBundleDir","osTmp","workerPath","writeBundleToTemp","bundledSource","baseDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","findMatchingClose","source","openBrace","depth","i","ch","collectTopLevelKeys","block","keys","segStart","braceDepth","parenDepth","bracketDepth","flushSegment","end","seg","m","j","extractTopLevelKeys","sectionName","headerRe","headerMatch","closeBrace","extractDerivationKeys","files","seen","out","file","k","SandboxError","message","code","Project","SyntaxKind","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","derivationKeys","extractDerivationKeys","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}
package/dist/worker.d.ts CHANGED
@@ -36,6 +36,7 @@ interface SandboxSystem {
36
36
  toObject(): Record<string, unknown>;
37
37
  };
38
38
  };
39
+ derive: Record<string, unknown>;
39
40
  destroy(): void;
40
41
  }
41
42
  declare global {
package/dist/worker.js CHANGED
@@ -1,2 +1,2 @@
1
- import{performance as u}from"perf_hooks";import{parentPort as g}from"worker_threads";if(!g)throw new Error("@directive-run/sandbox/worker must be loaded via worker_threads");var i=g;function d(t,r){let e={log:console.log,info:console.info,warn:console.warn,error:console.error,debug:console.debug},s=(o,l)=>{let a=l.map(n=>{if(typeof n=="string")return n;try{return JSON.stringify(n)}catch{return String(n)}}).join(" ");t.push(o?`${o} ${a}`:a)};return console.log=(...o)=>s(r.log,o),console.info=(...o)=>s(r.log,o),console.warn=(...o)=>s(r.warn,o),console.error=(...o)=>s(r.error,o),console.debug=(...o)=>s(r.log,o),()=>{console.log=e.log,console.info=e.info,console.warn=e.warn,console.error=e.error,console.debug=e.debug}}async function m(t){let r=[],e=[],s=d(r,{log:"[log]",warn:"[warn]",error:"[error]"});globalThis.__directiveSandbox_system__=null;let o=u.now();try{await import(t.bundlePath)}catch(c){e.push(c.message??String(c))}finally{s()}let l=u.now()-o,a={},n=globalThis.__directiveSandbox_system__;if(n){try{a=n.facts.$store.toObject()}catch(c){e.push(`facts snapshot failed: ${c.message}`)}try{n.destroy()}catch{}globalThis.__directiveSandbox_system__=null}return{logs:r,facts:a,errors:e,durationMs:l,timedOut:!1}}i.once("message",async t=>{try{let e={ok:!0,result:await m(t)};i.postMessage(e)}catch(r){let e={ok:!1,error:r.stack??r.message??String(r)};i.postMessage(e)}});
1
+ import{performance as g}from"perf_hooks";import{parentPort as p}from"worker_threads";var w=new Set(["http:","https:"]);function f(t){let r=t.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);if(!r)return!1;let e=Number.parseInt(r[1],10),n=Number.parseInt(r[2],10),o=Number.parseInt(r[3],10),s=Number.parseInt(r[4],10);return e>255||n>255||o>255||s>255?!1:e===0||e===127||e===10||e===172&&n>=16&&n<=31||e===192&&n===168||e===169&&n===254||e===100&&n>=64&&n<=127||e>=224&&e<=239||e>=240}function b(t){let r=t.replace(/^\[|\]$/g,"").toLowerCase();if(r==="::1"||r==="::"||r.startsWith("fe80:")||r.startsWith("fe8")||r.startsWith("fc")||r.startsWith("fd"))return!0;let e=r.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);if(e&&f(e[1]))return!0;let n=r.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);if(n){let o=Number.parseInt(n[1],16),s=Number.parseInt(n[2],16);if(Number.isFinite(o)&&Number.isFinite(s)){let i=o>>8&255,l=o&255,c=s>>8&255,a=s&255;if(f(`${i}.${l}.${c}.${a}`))return!0}}return!1}function m(t){let r=t.toLowerCase();return!!(r==="localhost"||r==="localhost.localdomain"||r.endsWith(".local")||r.endsWith(".internal"))}function y(t){let r;try{r=new URL(t)}catch{return{allow:!1,reason:`not a valid URL: "${t}"`}}if(!w.has(r.protocol))return{allow:!1,reason:`protocol "${r.protocol}" is not allowed (only http:, https:)`};let e=r.hostname;return e?m(e)?{allow:!1,reason:`hostname "${e}" resolves to localhost or internal-only`}:f(e)?{allow:!1,reason:`IPv4 ${e} is in a private / loopback / link-local range`}:b(e)?{allow:!1,reason:`IPv6 ${e} is in a private / loopback / link-local range`}:{allow:!0}:{allow:!1,reason:"URL has no hostname"}}function h(){let t=globalThis.fetch??(async()=>{throw new Error("fetch is not available in this Node version")}),r=async(e,n)=>{let o=typeof e=="string"?e:e instanceof URL?e.toString():e.url,s=y(o);if(!s.allow)throw new Error(`sandbox: outbound fetch blocked \u2014 ${s.reason??"denied"}`);return t(e,n)};globalThis.fetch=r}if(!p)throw new Error("@directive-run/sandbox/worker must be loaded via worker_threads");h();var d=p;function k(t){if(typeof t=="string")return t;if(t==null)return String(t);if(typeof t=="object"){let r=t;if(r.$store&&typeof r.$store.toObject=="function")try{return JSON.stringify(r.$store.toObject())}catch{}if(typeof r.$snapshot=="function")try{return JSON.stringify(r.$snapshot())}catch{}}try{return JSON.stringify(t)}catch{return String(t)}}function v(t,r){let e={log:console.log,info:console.info,warn:console.warn,error:console.error,debug:console.debug},n=(o,s)=>{let i=s.map(l=>k(l)).join(" ");t.push(o?`${o} ${i}`:i)};return console.log=(...o)=>n(r.log,o),console.info=(...o)=>n(r.log,o),console.warn=(...o)=>n(r.warn,o),console.error=(...o)=>n(r.error,o),console.debug=(...o)=>n(r.log,o),()=>{console.log=e.log,console.info=e.info,console.warn=e.warn,console.error=e.error,console.debug=e.debug}}async function $(t){let r=[],e=[],n=v(r,{log:"[log]",warn:"[warn]",error:"[error]"});globalThis.__directiveSandbox_system__=null;let o=g.now();try{await import(t.bundlePath)}catch(a){e.push(a.message??String(a))}finally{n()}let s=g.now()-o,i={},l={},c=globalThis.__directiveSandbox_system__;if(c){try{i=c.facts.$store.toObject()}catch(a){e.push(`facts snapshot failed: ${a.message}`)}if(t.derivationKeys.length>0&&c.derive)for(let a of t.derivationKeys)try{let u=c.derive[a];u!==void 0&&(l[a]=u)}catch(u){e.push(`derivation "${a}" snapshot failed: ${u.message}`)}try{c.destroy()}catch{}globalThis.__directiveSandbox_system__=null}return{logs:r,facts:i,derived:l,errors:e,durationMs:s,timedOut:!1}}d.once("message",async t=>{try{let e={ok:!0,result:await $(t)};d.postMessage(e)}catch(r){let e={ok:!1,error:r.stack??r.message??String(r)};d.postMessage(e)}});
2
2
  //# sourceMappingURL=worker.js.map
package/dist/worker.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/worker.ts"],"sourcesContent":["/**\n * Worker-thread entry. Receives a bundled ESM string + timeout, hooks\n * `console.*` to a capture buffer, evaluates the bundle via a data:\n * URL import (Node's native ESM loader handles top-level await for us),\n * then sends the SandboxResult back.\n *\n * The host (`./host.ts`) enforces the wall-clock budget by calling\n * `worker.terminate()` on overrun — there's no cooperative cancellation\n * from inside the worker. This keeps the worker code simple and means\n * even hostile snippets that try to outlast the budget get hard-killed.\n *\n * Why a data: URL import rather than `vm.runInContext`? `vm` doesn't\n * link ESM imports, so a snippet that imports `@directive-run/core`\n * fails at parse time. Data URL imports go through Node's real ESM\n * loader, which DOES link external imports — `@directive-run/core` is\n * already installed in the parent's node_modules, so the worker finds\n * it via standard resolution. The cost: data URL imports happen\n * exactly once per worker (which is what we want — one-shot execution).\n */\n\nimport { performance } from \"node:perf_hooks\";\nimport { parentPort } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nif (!parentPort) {\n throw new Error(\n \"@directive-run/sandbox/worker must be loaded via worker_threads\",\n );\n}\n\nconst port = parentPort;\n\n/**\n * Replace console.{log,info,warn,error,debug} with capture functions\n * that push to a shared buffer. The original references are restored\n * in `finally` so this doesn't leak across hot-reloads in tests.\n */\nfunction captureConsole(\n buffer: string[],\n prefix: { log: string; warn: string; error: string },\n): () => void {\n const originals = {\n log: console.log,\n info: console.info,\n warn: console.warn,\n error: console.error,\n debug: console.debug,\n };\n const format = (label: string, args: unknown[]) => {\n const text = args\n .map((a) => {\n if (typeof a === \"string\") return a;\n try {\n return JSON.stringify(a);\n } catch {\n return String(a);\n }\n })\n .join(\" \");\n buffer.push(label ? `${label} ${text}` : text);\n };\n console.log = (...a: unknown[]) => format(prefix.log, a);\n console.info = (...a: unknown[]) => format(prefix.log, a);\n console.warn = (...a: unknown[]) => format(prefix.warn, a);\n console.error = (...a: unknown[]) => format(prefix.error, a);\n console.debug = (...a: unknown[]) => format(prefix.log, a);\n\n return () => {\n console.log = originals.log;\n console.info = originals.info;\n console.warn = originals.warn;\n console.error = originals.error;\n console.debug = originals.debug;\n };\n}\n\n/**\n * Look for a system on globalThis the snippet attached. The runner\n * scaffold emits `const system = createSystem({...}); system.start();`\n * at top level, but inside an ESM module those bindings are scoped to\n * the module's own scope — we can't read them from the worker.\n *\n * Workaround: the worker patches `createSystem` to also stash the\n * returned system on `globalThis.__directiveSandbox_system__`. After\n * the bundle finishes, we read facts from there.\n *\n * This monkey-patch happens via a tiny ESM module we prepend to the\n * bundle before evaluation (see `wrapForExecution`).\n */\ninterface SandboxSystem {\n facts: { $store: { toObject(): Record<string, unknown> } };\n destroy(): void;\n}\n\ndeclare global {\n // eslint-disable-next-line no-var\n var __directiveSandbox_system__: SandboxSystem | null;\n}\n\nasync function runOne(message: WorkerInputMessage): Promise<SandboxResult> {\n const logs: string[] = [];\n const errors: string[] = [];\n const restoreConsole = captureConsole(logs, {\n log: \"[log]\",\n warn: \"[warn]\",\n error: \"[error]\",\n });\n globalThis.__directiveSandbox_system__ = null;\n const startMs = performance.now();\n try {\n // Import the bundle via file:// URL. Node's ESM loader resolves\n // `@directive-run/core` against node_modules relative to the\n // file path's anchor. The bundler appends a trailing assignment\n // to the entry module that lifts the runner's `system` binding\n // onto `globalThis.__directiveSandbox_system__` so we can read\n // it from here after execution.\n await import(message.bundlePath);\n } catch (err) {\n errors.push((err as Error).message ?? String(err));\n } finally {\n restoreConsole();\n }\n const durationMs = performance.now() - startMs;\n\n let facts: Record<string, unknown> = {};\n // Cast through unknown because TS narrows `globalThis.X` to `null`\n // after the earlier assignment, even though the bundle's epilogue\n // may have populated it before we read here.\n const system = globalThis.__directiveSandbox_system__ as SandboxSystem | null;\n if (system) {\n try {\n facts = system.facts.$store.toObject();\n } catch (err) {\n errors.push(`facts snapshot failed: ${(err as Error).message}`);\n }\n try {\n system.destroy();\n } catch {\n // best-effort\n }\n globalThis.__directiveSandbox_system__ = null;\n }\n\n return {\n logs,\n facts,\n errors,\n durationMs,\n timedOut: false,\n };\n}\n\nport.once(\"message\", async (msg: WorkerInputMessage) => {\n try {\n const result = await runOne(msg);\n const out: WorkerOutputMessage = { ok: true, result };\n port.postMessage(out);\n } catch (err) {\n const out: WorkerOutputMessage = {\n ok: false,\n error: (err as Error).stack ?? (err as Error).message ?? String(err),\n };\n port.postMessage(out);\n }\n});\n"],"mappings":"AAoBA,OAAS,eAAAA,MAAmB,aAC5B,OAAS,cAAAC,MAAkB,iBAO3B,GAAI,CAACA,EACH,MAAM,IAAI,MACR,iEACF,EAGF,IAAMC,EAAOD,EAOb,SAASE,EACPC,EACAC,EACY,CACZ,IAAMC,EAAY,CAChB,IAAK,QAAQ,IACb,KAAM,QAAQ,KACd,KAAM,QAAQ,KACd,MAAO,QAAQ,MACf,MAAO,QAAQ,KACjB,EACMC,EAAS,CAACC,EAAeC,IAAoB,CACjD,IAAMC,EAAOD,EACV,IAAKE,GAAM,CACV,GAAI,OAAOA,GAAM,SAAU,OAAOA,EAClC,GAAI,CACF,OAAO,KAAK,UAAUA,CAAC,CACzB,MAAQ,CACN,OAAO,OAAOA,CAAC,CACjB,CACF,CAAC,EACA,KAAK,GAAG,EACXP,EAAO,KAAKI,EAAQ,GAAGA,CAAK,IAAIE,CAAI,GAAKA,CAAI,CAC/C,EACA,eAAQ,IAAM,IAAIC,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EACvD,QAAQ,KAAO,IAAIA,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EACxD,QAAQ,KAAO,IAAIA,IAAiBJ,EAAOF,EAAO,KAAMM,CAAC,EACzD,QAAQ,MAAQ,IAAIA,IAAiBJ,EAAOF,EAAO,MAAOM,CAAC,EAC3D,QAAQ,MAAQ,IAAIA,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EAElD,IAAM,CACX,QAAQ,IAAML,EAAU,IACxB,QAAQ,KAAOA,EAAU,KACzB,QAAQ,KAAOA,EAAU,KACzB,QAAQ,MAAQA,EAAU,MAC1B,QAAQ,MAAQA,EAAU,KAC5B,CACF,CAyBA,eAAeM,EAAOC,EAAqD,CACzE,IAAMC,EAAiB,CAAC,EAClBC,EAAmB,CAAC,EACpBC,EAAiBb,EAAeW,EAAM,CAC1C,IAAK,QACL,KAAM,SACN,MAAO,SACT,CAAC,EACD,WAAW,4BAA8B,KACzC,IAAMG,EAAUjB,EAAY,IAAI,EAChC,GAAI,CAOF,MAAM,OAAOa,EAAQ,WACvB,OAASK,EAAK,CACZH,EAAO,KAAMG,EAAc,SAAW,OAAOA,CAAG,CAAC,CACnD,QAAE,CACAF,EAAe,CACjB,CACA,IAAMG,EAAanB,EAAY,IAAI,EAAIiB,EAEnCG,EAAiC,CAAC,EAIhCC,EAAS,WAAW,4BAC1B,GAAIA,EAAQ,CACV,GAAI,CACFD,EAAQC,EAAO,MAAM,OAAO,SAAS,CACvC,OAASH,EAAK,CACZH,EAAO,KAAK,0BAA2BG,EAAc,OAAO,EAAE,CAChE,CACA,GAAI,CACFG,EAAO,QAAQ,CACjB,MAAQ,CAER,CACA,WAAW,4BAA8B,IAC3C,CAEA,MAAO,CACL,KAAAP,EACA,MAAAM,EACA,OAAAL,EACA,WAAAI,EACA,SAAU,EACZ,CACF,CAEAjB,EAAK,KAAK,UAAW,MAAOoB,GAA4B,CACtD,GAAI,CAEF,IAAMC,EAA2B,CAAE,GAAI,GAAM,OAD9B,MAAMX,EAAOU,CAAG,CACqB,EACpDpB,EAAK,YAAYqB,CAAG,CACtB,OAASL,EAAK,CACZ,IAAMK,EAA2B,CAC/B,GAAI,GACJ,MAAQL,EAAc,OAAUA,EAAc,SAAW,OAAOA,CAAG,CACrE,EACAhB,EAAK,YAAYqB,CAAG,CACtB,CACF,CAAC","names":["performance","parentPort","port","captureConsole","buffer","prefix","originals","format","label","args","text","a","runOne","message","logs","errors","restoreConsole","startMs","err","durationMs","facts","system","msg","out"]}
1
+ {"version":3,"sources":["../src/worker.ts","../src/fetch-wrapper.ts"],"sourcesContent":["/**\n * Worker-thread entry. Receives a bundled ESM string + timeout, hooks\n * `console.*` to a capture buffer, evaluates the bundle via a data:\n * URL import (Node's native ESM loader handles top-level await for us),\n * then sends the SandboxResult back.\n *\n * The host (`./host.ts`) enforces the wall-clock budget by calling\n * `worker.terminate()` on overrun — there's no cooperative cancellation\n * from inside the worker. This keeps the worker code simple and means\n * even hostile snippets that try to outlast the budget get hard-killed.\n *\n * Why a data: URL import rather than `vm.runInContext`? `vm` doesn't\n * link ESM imports, so a snippet that imports `@directive-run/core`\n * fails at parse time. Data URL imports go through Node's real ESM\n * loader, which DOES link external imports — `@directive-run/core` is\n * already installed in the parent's node_modules, so the worker finds\n * it via standard resolution. The cost: data URL imports happen\n * exactly once per worker (which is what we want — one-shot execution).\n */\n\nimport { performance } from \"node:perf_hooks\";\nimport { parentPort } from \"node:worker_threads\";\nimport { installFetchWrapper } from \"./fetch-wrapper.js\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nif (!parentPort) {\n throw new Error(\n \"@directive-run/sandbox/worker must be loaded via worker_threads\",\n );\n}\n\n// Phase A audit P0-S2: install the SSRF fetch wrapper BEFORE the\n// bundle is imported so @directive-run/query's / @directive-run/ai's\n// internal fetch calls (which the validator can't see because they\n// live in external module bodies) hit the loopback / private-IP /\n// IMDS blocklist.\ninstallFetchWrapper();\n\nconst port = parentPort;\n\n/**\n * Format a single console.log argument. Directive's `system.facts` is\n * a Proxy over a `FactsStore`; the audit (P0-DM1) found that\n * `JSON.stringify(system.facts)` produces `\"{}\"` (or store internals)\n * because the proxy has no `toJSON`. So `console.log(\"[start] facts:\",\n * system.facts)` rendered as `[start] facts: {}` in the transcript\n * while `result.facts` correctly showed the snapshot — two\n * contradictory views in the same response.\n *\n * Fix: detect Directive's facts/derive proxies via the `$store` or\n * `$snapshot` escape hatches the proxy DOES expose, snapshot via the\n * store's `toObject()` (the same call result.facts uses), and JSON-\n * stringify the snapshot. Falls back to JSON.stringify for any value\n * that doesn't look like a Directive proxy.\n */\nfunction serializeArg(arg: unknown): string {\n if (typeof arg === \"string\") {\n return arg;\n }\n if (arg === null || arg === undefined) {\n return String(arg);\n }\n // Directive facts/derive proxy fingerprints. `.$store` is the\n // internal FactsStore; `.$snapshot` is the alternate accessor.\n // Either returns a plain object when called.\n if (typeof arg === \"object\") {\n const obj = arg as {\n $store?: { toObject?: () => Record<string, unknown> };\n $snapshot?: () => Record<string, unknown>;\n };\n if (obj.$store && typeof obj.$store.toObject === \"function\") {\n try {\n return JSON.stringify(obj.$store.toObject());\n } catch {\n // fall through\n }\n }\n if (typeof obj.$snapshot === \"function\") {\n try {\n return JSON.stringify(obj.$snapshot());\n } catch {\n // fall through\n }\n }\n }\n try {\n return JSON.stringify(arg);\n } catch {\n return String(arg);\n }\n}\n\n/**\n * Replace console.{log,info,warn,error,debug} with capture functions\n * that push to a shared buffer. The original references are restored\n * in `finally` so this doesn't leak across hot-reloads in tests.\n */\nfunction captureConsole(\n buffer: string[],\n prefix: { log: string; warn: string; error: string },\n): () => void {\n const originals = {\n log: console.log,\n info: console.info,\n warn: console.warn,\n error: console.error,\n debug: console.debug,\n };\n const format = (label: string, args: unknown[]) => {\n const text = args.map((a) => serializeArg(a)).join(\" \");\n buffer.push(label ? `${label} ${text}` : text);\n };\n console.log = (...a: unknown[]) => format(prefix.log, a);\n console.info = (...a: unknown[]) => format(prefix.log, a);\n console.warn = (...a: unknown[]) => format(prefix.warn, a);\n console.error = (...a: unknown[]) => format(prefix.error, a);\n console.debug = (...a: unknown[]) => format(prefix.log, a);\n\n return () => {\n console.log = originals.log;\n console.info = originals.info;\n console.warn = originals.warn;\n console.error = originals.error;\n console.debug = originals.debug;\n };\n}\n\n/**\n * Look for a system on globalThis the snippet attached. The runner\n * scaffold emits `const system = createSystem({...}); system.start();`\n * at top level, but inside an ESM module those bindings are scoped to\n * the module's own scope — we can't read them from the worker.\n *\n * Workaround: the worker patches `createSystem` to also stash the\n * returned system on `globalThis.__directiveSandbox_system__`. After\n * the bundle finishes, we read facts from there.\n *\n * This monkey-patch happens via a tiny ESM module we prepend to the\n * bundle before evaluation (see `wrapForExecution`).\n */\ninterface SandboxSystem {\n facts: { $store: { toObject(): Record<string, unknown> } };\n derive: Record<string, unknown>;\n destroy(): void;\n}\n\ndeclare global {\n // eslint-disable-next-line no-var\n var __directiveSandbox_system__: SandboxSystem | null;\n}\n\nasync function runOne(message: WorkerInputMessage): Promise<SandboxResult> {\n const logs: string[] = [];\n const errors: string[] = [];\n const restoreConsole = captureConsole(logs, {\n log: \"[log]\",\n warn: \"[warn]\",\n error: \"[error]\",\n });\n globalThis.__directiveSandbox_system__ = null;\n const startMs = performance.now();\n try {\n // Import the bundle via file:// URL. Node's ESM loader resolves\n // `@directive-run/core` against node_modules relative to the\n // file path's anchor. The bundler appends a trailing assignment\n // to the entry module that lifts the runner's `system` binding\n // onto `globalThis.__directiveSandbox_system__` so we can read\n // it from here after execution.\n await import(message.bundlePath);\n } catch (err) {\n errors.push((err as Error).message ?? String(err));\n } finally {\n restoreConsole();\n }\n const durationMs = performance.now() - startMs;\n\n let facts: Record<string, unknown> = {};\n const derived: Record<string, unknown> = {};\n // Cast through unknown because TS narrows `globalThis.X` to `null`\n // after the earlier assignment, even though the bundle's epilogue\n // may have populated it before we read here.\n const system = globalThis.__directiveSandbox_system__ as SandboxSystem | null;\n if (system) {\n try {\n facts = system.facts.$store.toObject();\n } catch (err) {\n errors.push(`facts snapshot failed: ${(err as Error).message}`);\n }\n // Phase A audit P0-DM2: snapshot derivations. The host pre-extracts\n // the key names from the source files (system.derive's proxy has no\n // ownKeys trap) and passes them via message.derivationKeys; we read\n // each via `system.derive[key]`, swallowing per-key errors so one\n // bad derivation doesn't kill the whole snapshot.\n if (message.derivationKeys.length > 0 && system.derive) {\n for (const key of message.derivationKeys) {\n try {\n const value = (system.derive as Record<string, unknown>)[key];\n if (value !== undefined) {\n derived[key] = value;\n }\n } catch (err) {\n errors.push(\n `derivation \"${key}\" snapshot failed: ${(err as Error).message}`,\n );\n }\n }\n }\n try {\n system.destroy();\n } catch {\n // best-effort\n }\n globalThis.__directiveSandbox_system__ = null;\n }\n\n return {\n logs,\n facts,\n derived,\n errors,\n durationMs,\n timedOut: false,\n };\n}\n\nport.once(\"message\", async (msg: WorkerInputMessage) => {\n try {\n const result = await runOne(msg);\n const out: WorkerOutputMessage = { ok: true, result };\n port.postMessage(out);\n } catch (err) {\n const out: WorkerOutputMessage = {\n ok: false,\n error: (err as Error).stack ?? (err as Error).message ?? String(err),\n };\n port.postMessage(out);\n }\n});\n","/**\n * Outbound fetch wrapper installed in the worker BEFORE the user's\n * bundle imports anything. The validator already blocks `fetch` as a\n * free identifier AND `globalThis.fetch` property access, so the\n * user's snippet can't call fetch directly. But `@directive-run/query`\n * and `@directive-run/ai` are in the allowlist and their package code\n * calls global `fetch` internally — the validator never sees those\n * calls because they live in external module bodies.\n *\n * Phase A audit P0-S2: a snippet that builds a `createBaseQuery({\n * baseUrl: \"http://169.254.169.254\" })` triggers an outbound HTTP\n * request from the worker to AWS IMDS. On the directive.run/api/run-\n * sandbox Vercel surface, that's SSRF from a privileged egress.\n *\n * This wrapper rejects:\n *\n * - Loopback (127.0.0.0/8, [::1], localhost)\n * - Link-local (169.254.0.0/16 — includes IMDS at .169.254)\n * - RFC-1918 private (10.x, 172.16-31.x, 192.168.x)\n * - Multicast / broadcast / reserved ranges\n * - Non-HTTP(S) protocols (file://, ftp://, gopher://, data://, blob://)\n * - URLs without a hostname (relative paths, javascript:, etc.)\n *\n * Allows:\n *\n * - Any public IPv4 / IPv6 address\n * - Any hostname that resolves to public (resolution happens at request\n * time; we don't pre-resolve because Node's fetch doesn't expose the\n * resolved IP before sending. The host header is parsed for the\n * surface-level check; DNS rebinding is theoretical here because\n * external attackers can't control internal DNS, but documented as\n * a known gap.)\n */\n\nconst ALLOWED_PROTOCOLS = new Set([\"http:\", \"https:\"]);\n\nfunction isPrivateIPv4(host: string): boolean {\n // Match IPv4 dotted-quad. We don't accept octal/hex forms — Node's\n // URL parser rejects those for hostnames anyway.\n const m = host.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);\n if (!m) return false;\n const a = Number.parseInt(m[1]!, 10);\n const b = Number.parseInt(m[2]!, 10);\n const c = Number.parseInt(m[3]!, 10);\n const d = Number.parseInt(m[4]!, 10);\n if (a > 255 || b > 255 || c > 255 || d > 255) {\n // Malformed — let it through; Node's fetch will reject the URL.\n return false;\n }\n // 0.0.0.0/8 — \"this network\", treated as unrouted/private here.\n if (a === 0) return true;\n // 127.0.0.0/8 — loopback.\n if (a === 127) return true;\n // 10.0.0.0/8 — RFC-1918 Class A.\n if (a === 10) return true;\n // 172.16.0.0/12 — RFC-1918 Class B.\n if (a === 172 && b >= 16 && b <= 31) return true;\n // 192.168.0.0/16 — RFC-1918 Class C.\n if (a === 192 && b === 168) return true;\n // 169.254.0.0/16 — link-local, includes AWS/GCP/Azure IMDS at\n // 169.254.169.254. THIS is the SSRF target we care most about.\n if (a === 169 && b === 254) return true;\n // 100.64.0.0/10 — carrier-grade NAT, not internet-routable.\n if (a === 100 && b >= 64 && b <= 127) return true;\n // 224.0.0.0/4 — multicast.\n if (a >= 224 && a <= 239) return true;\n // 240.0.0.0/4 — reserved / experimental.\n if (a >= 240) return true;\n return false;\n}\n\nfunction isPrivateIPv6(host: string): boolean {\n // Strip brackets the URL parser leaves in place.\n const stripped = host.replace(/^\\[|\\]$/g, \"\").toLowerCase();\n // Loopback.\n if (stripped === \"::1\") return true;\n // Unspecified / \"any\".\n if (stripped === \"::\") return true;\n // Link-local fe80::/10\n if (stripped.startsWith(\"fe80:\") || stripped.startsWith(\"fe8\")) return true;\n // Unique local fc00::/7 (fc and fd prefixes).\n if (stripped.startsWith(\"fc\") || stripped.startsWith(\"fd\")) return true;\n // IPv4-mapped IPv6 (::ffff:169.254.169.254) — extract the v4 tail\n // and re-check. Node's URL parser may normalize the literal-IPv4\n // form to its hex equivalent (`::ffff:a9fe:a9fe`), so handle both.\n const mappedV4 = stripped.match(/::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n if (mappedV4 && isPrivateIPv4(mappedV4[1]!)) {\n return true;\n }\n const mappedHex = stripped.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n if (mappedHex) {\n const hi = Number.parseInt(mappedHex[1]!, 16);\n const lo = Number.parseInt(mappedHex[2]!, 16);\n if (Number.isFinite(hi) && Number.isFinite(lo)) {\n const a = (hi >> 8) & 0xff;\n const b = hi & 0xff;\n const c = (lo >> 8) & 0xff;\n const d = lo & 0xff;\n if (isPrivateIPv4(`${a}.${b}.${c}.${d}`)) {\n return true;\n }\n }\n }\n return false;\n}\n\nfunction isLocalHostname(host: string): boolean {\n const lower = host.toLowerCase();\n if (lower === \"localhost\") return true;\n if (lower === \"localhost.localdomain\") return true;\n if (lower.endsWith(\".local\")) return true;\n if (lower.endsWith(\".internal\")) return true;\n return false;\n}\n\ninterface UrlCheck {\n allow: boolean;\n reason?: string;\n}\n\nexport function checkSandboxFetchUrl(rawUrl: string): UrlCheck {\n let parsed: URL;\n try {\n parsed = new URL(rawUrl);\n } catch {\n return { allow: false, reason: `not a valid URL: \"${rawUrl}\"` };\n }\n if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) {\n return {\n allow: false,\n reason: `protocol \"${parsed.protocol}\" is not allowed (only http:, https:)`,\n };\n }\n const host = parsed.hostname;\n if (!host) {\n return { allow: false, reason: \"URL has no hostname\" };\n }\n if (isLocalHostname(host)) {\n return {\n allow: false,\n reason: `hostname \"${host}\" resolves to localhost or internal-only`,\n };\n }\n if (isPrivateIPv4(host)) {\n return {\n allow: false,\n reason: `IPv4 ${host} is in a private / loopback / link-local range`,\n };\n }\n if (isPrivateIPv6(host)) {\n return {\n allow: false,\n reason: `IPv6 ${host} is in a private / loopback / link-local range`,\n };\n }\n return { allow: true };\n}\n\n/**\n * Install the wrapper on `globalThis.fetch`. Called from the worker\n * BEFORE the bundle is imported so any `fetch` calls inside the user's\n * code or inside allowlisted packages (`@directive-run/query`,\n * `@directive-run/ai`) hit the wrapper.\n *\n * Safe to call when `fetch` is undefined (older Node); just installs\n * the rejection wrapper.\n */\nexport function installFetchWrapper(): void {\n const original =\n (globalThis as { fetch?: typeof fetch }).fetch ??\n ((async () => {\n throw new Error(\"fetch is not available in this Node version\");\n }) as typeof fetch);\n\n const wrapped: typeof fetch = async (\n input: RequestInfo | URL,\n init?: RequestInit,\n ): Promise<Response> => {\n const rawUrl =\n typeof input === \"string\"\n ? input\n : input instanceof URL\n ? input.toString()\n : (input as Request).url;\n const decision = checkSandboxFetchUrl(rawUrl);\n if (!decision.allow) {\n throw new Error(\n `sandbox: outbound fetch blocked — ${decision.reason ?? \"denied\"}`,\n );\n }\n return original(input, init);\n };\n\n (globalThis as { fetch: typeof fetch }).fetch = wrapped;\n}\n"],"mappings":"AAoBA,OAAS,eAAAA,MAAmB,aAC5B,OAAS,cAAAC,MAAkB,iBCa3B,IAAMC,EAAoB,IAAI,IAAI,CAAC,QAAS,QAAQ,CAAC,EAErD,SAASC,EAAcC,EAAuB,CAG5C,IAAMC,EAAID,EAAK,MAAM,8CAA8C,EACnE,GAAI,CAACC,EAAG,MAAO,GACf,IAAMC,EAAI,OAAO,SAASD,EAAE,CAAC,EAAI,EAAE,EAC7BE,EAAI,OAAO,SAASF,EAAE,CAAC,EAAI,EAAE,EAC7BG,EAAI,OAAO,SAASH,EAAE,CAAC,EAAI,EAAE,EAC7BI,EAAI,OAAO,SAASJ,EAAE,CAAC,EAAI,EAAE,EACnC,OAAIC,EAAI,KAAOC,EAAI,KAAOC,EAAI,KAAOC,EAAI,IAEhC,GAGLH,IAAM,GAENA,IAAM,KAENA,IAAM,IAENA,IAAM,KAAOC,GAAK,IAAMA,GAAK,IAE7BD,IAAM,KAAOC,IAAM,KAGnBD,IAAM,KAAOC,IAAM,KAEnBD,IAAM,KAAOC,GAAK,IAAMA,GAAK,KAE7BD,GAAK,KAAOA,GAAK,KAEjBA,GAAK,GAEX,CAEA,SAASI,EAAcN,EAAuB,CAE5C,IAAMO,EAAWP,EAAK,QAAQ,WAAY,EAAE,EAAE,YAAY,EAQ1D,GANIO,IAAa,OAEbA,IAAa,MAEbA,EAAS,WAAW,OAAO,GAAKA,EAAS,WAAW,KAAK,GAEzDA,EAAS,WAAW,IAAI,GAAKA,EAAS,WAAW,IAAI,EAAG,MAAO,GAInE,IAAMC,EAAWD,EAAS,MAAM,8BAA8B,EAC9D,GAAIC,GAAYT,EAAcS,EAAS,CAAC,CAAE,EACxC,MAAO,GAET,IAAMC,EAAYF,EAAS,MAAM,yCAAyC,EAC1E,GAAIE,EAAW,CACb,IAAMC,EAAK,OAAO,SAASD,EAAU,CAAC,EAAI,EAAE,EACtCE,EAAK,OAAO,SAASF,EAAU,CAAC,EAAI,EAAE,EAC5C,GAAI,OAAO,SAASC,CAAE,GAAK,OAAO,SAASC,CAAE,EAAG,CAC9C,IAAMT,EAAKQ,GAAM,EAAK,IAChBP,EAAIO,EAAK,IACT,EAAKC,GAAM,EAAK,IAChBN,EAAIM,EAAK,IACf,GAAIZ,EAAc,GAAGG,CAAC,IAAIC,CAAC,IAAI,CAAC,IAAIE,CAAC,EAAE,EACrC,MAAO,EAEX,CACF,CACA,MAAO,EACT,CAEA,SAASO,EAAgBZ,EAAuB,CAC9C,IAAMa,EAAQb,EAAK,YAAY,EAI/B,MAHI,GAAAa,IAAU,aACVA,IAAU,yBACVA,EAAM,SAAS,QAAQ,GACvBA,EAAM,SAAS,WAAW,EAEhC,CAOO,SAASC,EAAqBC,EAA0B,CAC7D,IAAIC,EACJ,GAAI,CACFA,EAAS,IAAI,IAAID,CAAM,CACzB,MAAQ,CACN,MAAO,CAAE,MAAO,GAAO,OAAQ,qBAAqBA,CAAM,GAAI,CAChE,CACA,GAAI,CAACjB,EAAkB,IAAIkB,EAAO,QAAQ,EACxC,MAAO,CACL,MAAO,GACP,OAAQ,aAAaA,EAAO,QAAQ,uCACtC,EAEF,IAAMhB,EAAOgB,EAAO,SACpB,OAAKhB,EAGDY,EAAgBZ,CAAI,EACf,CACL,MAAO,GACP,OAAQ,aAAaA,CAAI,0CAC3B,EAEED,EAAcC,CAAI,EACb,CACL,MAAO,GACP,OAAQ,QAAQA,CAAI,gDACtB,EAEEM,EAAcN,CAAI,EACb,CACL,MAAO,GACP,OAAQ,QAAQA,CAAI,gDACtB,EAEK,CAAE,MAAO,EAAK,EApBZ,CAAE,MAAO,GAAO,OAAQ,qBAAsB,CAqBzD,CAWO,SAASiB,GAA4B,CAC1C,IAAMC,EACH,WAAwC,QACvC,SAAY,CACZ,MAAM,IAAI,MAAM,6CAA6C,CAC/D,GAEIC,EAAwB,MAC5BC,EACAC,IACsB,CACtB,IAAMN,EACJ,OAAOK,GAAU,SACbA,EACAA,aAAiB,IACfA,EAAM,SAAS,EACdA,EAAkB,IACrBE,EAAWR,EAAqBC,CAAM,EAC5C,GAAI,CAACO,EAAS,MACZ,MAAM,IAAI,MACR,0CAAqCA,EAAS,QAAU,QAAQ,EAClE,EAEF,OAAOJ,EAASE,EAAOC,CAAI,CAC7B,EAEC,WAAuC,MAAQF,CAClD,CDrKA,GAAI,CAACI,EACH,MAAM,IAAI,MACR,iEACF,EAQFC,EAAoB,EAEpB,IAAMC,EAAOF,EAiBb,SAASG,EAAaC,EAAsB,CAC1C,GAAI,OAAOA,GAAQ,SACjB,OAAOA,EAET,GAAIA,GAAQ,KACV,OAAO,OAAOA,CAAG,EAKnB,GAAI,OAAOA,GAAQ,SAAU,CAC3B,IAAMC,EAAMD,EAIZ,GAAIC,EAAI,QAAU,OAAOA,EAAI,OAAO,UAAa,WAC/C,GAAI,CACF,OAAO,KAAK,UAAUA,EAAI,OAAO,SAAS,CAAC,CAC7C,MAAQ,CAER,CAEF,GAAI,OAAOA,EAAI,WAAc,WAC3B,GAAI,CACF,OAAO,KAAK,UAAUA,EAAI,UAAU,CAAC,CACvC,MAAQ,CAER,CAEJ,CACA,GAAI,CACF,OAAO,KAAK,UAAUD,CAAG,CAC3B,MAAQ,CACN,OAAO,OAAOA,CAAG,CACnB,CACF,CAOA,SAASE,EACPC,EACAC,EACY,CACZ,IAAMC,EAAY,CAChB,IAAK,QAAQ,IACb,KAAM,QAAQ,KACd,KAAM,QAAQ,KACd,MAAO,QAAQ,MACf,MAAO,QAAQ,KACjB,EACMC,EAAS,CAACC,EAAeC,IAAoB,CACjD,IAAMC,EAAOD,EAAK,IAAKE,GAAMX,EAAaW,CAAC,CAAC,EAAE,KAAK,GAAG,EACtDP,EAAO,KAAKI,EAAQ,GAAGA,CAAK,IAAIE,CAAI,GAAKA,CAAI,CAC/C,EACA,eAAQ,IAAM,IAAIC,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EACvD,QAAQ,KAAO,IAAIA,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EACxD,QAAQ,KAAO,IAAIA,IAAiBJ,EAAOF,EAAO,KAAMM,CAAC,EACzD,QAAQ,MAAQ,IAAIA,IAAiBJ,EAAOF,EAAO,MAAOM,CAAC,EAC3D,QAAQ,MAAQ,IAAIA,IAAiBJ,EAAOF,EAAO,IAAKM,CAAC,EAElD,IAAM,CACX,QAAQ,IAAML,EAAU,IACxB,QAAQ,KAAOA,EAAU,KACzB,QAAQ,KAAOA,EAAU,KACzB,QAAQ,MAAQA,EAAU,MAC1B,QAAQ,MAAQA,EAAU,KAC5B,CACF,CA0BA,eAAeM,EAAOC,EAAqD,CACzE,IAAMC,EAAiB,CAAC,EAClBC,EAAmB,CAAC,EACpBC,EAAiBb,EAAeW,EAAM,CAC1C,IAAK,QACL,KAAM,SACN,MAAO,SACT,CAAC,EACD,WAAW,4BAA8B,KACzC,IAAMG,EAAUC,EAAY,IAAI,EAChC,GAAI,CAOF,MAAM,OAAOL,EAAQ,WACvB,OAASM,EAAK,CACZJ,EAAO,KAAMI,EAAc,SAAW,OAAOA,CAAG,CAAC,CACnD,QAAE,CACAH,EAAe,CACjB,CACA,IAAMI,EAAaF,EAAY,IAAI,EAAID,EAEnCI,EAAiC,CAAC,EAChCC,EAAmC,CAAC,EAIpCC,EAAS,WAAW,4BAC1B,GAAIA,EAAQ,CACV,GAAI,CACFF,EAAQE,EAAO,MAAM,OAAO,SAAS,CACvC,OAASJ,EAAK,CACZJ,EAAO,KAAK,0BAA2BI,EAAc,OAAO,EAAE,CAChE,CAMA,GAAIN,EAAQ,eAAe,OAAS,GAAKU,EAAO,OAC9C,QAAWC,KAAOX,EAAQ,eACxB,GAAI,CACF,IAAMY,EAASF,EAAO,OAAmCC,CAAG,EACxDC,IAAU,SACZH,EAAQE,CAAG,EAAIC,EAEnB,OAASN,EAAK,CACZJ,EAAO,KACL,eAAeS,CAAG,sBAAuBL,EAAc,OAAO,EAChE,CACF,CAGJ,GAAI,CACFI,EAAO,QAAQ,CACjB,MAAQ,CAER,CACA,WAAW,4BAA8B,IAC3C,CAEA,MAAO,CACL,KAAAT,EACA,MAAAO,EACA,QAAAC,EACA,OAAAP,EACA,WAAAK,EACA,SAAU,EACZ,CACF,CAEArB,EAAK,KAAK,UAAW,MAAO2B,GAA4B,CACtD,GAAI,CAEF,IAAMC,EAA2B,CAAE,GAAI,GAAM,OAD9B,MAAMf,EAAOc,CAAG,CACqB,EACpD3B,EAAK,YAAY4B,CAAG,CACtB,OAASR,EAAK,CACZ,IAAMQ,EAA2B,CAC/B,GAAI,GACJ,MAAQR,EAAc,OAAUA,EAAc,SAAW,OAAOA,CAAG,CACrE,EACApB,EAAK,YAAY4B,CAAG,CACtB,CACF,CAAC","names":["performance","parentPort","ALLOWED_PROTOCOLS","isPrivateIPv4","host","m","a","b","c","d","isPrivateIPv6","stripped","mappedV4","mappedHex","hi","lo","isLocalHostname","lower","checkSandboxFetchUrl","rawUrl","parsed","installFetchWrapper","original","wrapped","input","init","decision","parentPort","installFetchWrapper","port","serializeArg","arg","obj","captureConsole","buffer","prefix","originals","format","label","args","text","a","runOne","message","logs","errors","restoreConsole","startMs","performance","err","durationMs","facts","derived","system","key","value","msg","out"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@directive-run/sandbox",
3
- "version": "0.2.0",
3
+ "version": "0.3.0",
4
4
  "description": "Execute Directive snippets server-side and return a structured transcript (logs + facts + errors). Consumed by @directive-run/mcp's run_in_sandbox tool and directive.run/playground's live DevTools panel. Uses worker_threads + esbuild bundling + an AST allowlist validator so user-supplied TypeScript runs with a bounded surface (allowlisted imports, allowlisted API calls, 5s wall clock, 32 MB heap).",
5
5
  "license": "(MIT OR Apache-2.0)",
6
6
  "author": "Jason Comes",