npm - @directive-run/sandbox - Versions diffs - 0.3.0 → 0.3.1 - Mend

@directive-run/sandbox 0.3.0 → 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/index.cjs CHANGED Viewed

@@ -1,6 +1,6 @@
-"use strict";var G=Object.create;var S=Object.defineProperty;var H=Object.getOwnPropertyDescriptor;var X=Object.getOwnPropertyNames;var z=Object.getPrototypeOf,Y=Object.prototype.hasOwnProperty;var J=(e,t)=>{for(var o in t)S(e,o,{get:t[o],enumerable:!0})},I=(e,t,o,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of X(t))!Y.call(e,s)&&s!==o&&S(e,s,{get:()=>t[s],enumerable:!(r=H(t,s))||r.enumerable});return e};var Q=(e,t,o)=>(o=e!=null?G(z(e)):{},I(t||!e||!e.__esModule?S(o,"default",{value:e,enumerable:!0}):o,e)),Z=e=>I(S({},"__esModule",{value:!0}),e);var we={};J(we,{SandboxError:()=>p,runInSandbox:()=>xe});module.exports=Z(we);var M=require("module"),k=require("url"),$=require("esbuild"),re={};function ee(e){try{let o=(0,M.createRequire)(re.url).resolve(e);return(0,k.pathToFileURL)(o).href}catch{return null}}var E="src/main.ts",w="directive-sandbox-vfs",h=class extends Error{constructor(o,r){super(o);this.cause=r;this.name="BundleError"}};function te(e){let t=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,o=e.match(t);if(!o)return e;let r=o[1],n=`
-(globalThis).__directiveSandbox_system__ = ${o[2]};
-`;return e.replace(r,r+n)}async function A(e){if(!e.find(r=>r.path===E))throw new h(`payload must include "${E}" \u2014 that's the entry point the runner targets`);let o=new Map;for(let r of e)o.set(r.path,r.source);try{let s=(await(0,$.build)({entryPoints:[`${w}:${E}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(c){c.onResolve({filter:/.*/},i=>{if(i.kind==="entry-point")return{path:i.path.replace(`${w}:`,""),namespace:w};if(i.namespace!==w)return null;if(i.path.startsWith("@directive-run/")){let a=ee(i.path);return a?{external:!0,path:a}:{external:!0,path:i.path}}if(i.path.startsWith("./")||i.path.startsWith("../")){let a=i.importer.replace(/\/[^/]+$/,""),u=i.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${a}/${u}.ts`,`${a}/${u}.js`,`${a}/${u}`,`${u}.ts`,`${u}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of g)if(o.has(m))return{path:m,namespace:w};throw new h(`cannot resolve "${i.path}" from "${i.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${i.path}" from "${i.importer}" \u2014 only relative or @directive-run/* allowed`)}),c.onLoad({filter:/.*/,namespace:w},i=>{let a=o.get(i.path);if(a===void 0)throw new h(`virtual file missing: ${i.path}`);if(i.path===E){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {","  (globalThis).__directiveSandbox_system__ = system;","}"].join(`
-`);return{contents:a+u,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!s)throw new h("esbuild produced no output");let n=te(s);return{source:n,bytes:Buffer.byteLength(n,"utf8")}}catch(r){throw r instanceof h?r:new h(`bundle failed: ${r.message??String(r)}`,r)}}var x=require("fs"),N=require("os"),b=require("path"),R=require("url"),D=require("worker_threads"),ce={},ne=100,oe=1e4,F=5e3;async function _(){let{createRequire:e}=await import("module");return e(ce.url).resolve("@directive-run/sandbox/worker")}var y=class extends Error{constructor(o,r){super(o);this.code=r;this.name="WorkerExecError"}};function se(e){let t=e??F;return Number.isFinite(t)?Math.min(oe,Math.max(ne,Math.floor(t))):F}async function ie(){let e=(0,N.tmpdir)();if((0,x.existsSync)(e))return e;let t=await _();return(0,b.dirname)((0,b.dirname)(t))}async function ae(e){let t=await ie(),o=(0,x.mkdtempSync)((0,b.join)(t,"directive-sandbox-")),r=(0,b.join)(o,"bundle.mjs");return(0,x.writeFileSync)(r,e,"utf8"),{bundlePath:r,cleanup:()=>{try{(0,x.rmSync)(o,{recursive:!0,force:!0})}catch{}}}}async function O(e){let t=se(e.timeoutMs),o=await _(),{bundlePath:r,cleanup:s}=await ae(e.bundledSource),n=new D.Worker(o,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),c=null,i=!1,a=Date.now();try{return await new Promise((g,m)=>{let f=!1;n.once("message",d=>{f=!0,d.ok?g(d.result):m(new y(d.error,"worker-error"))}),n.once("error",d=>{f=!0,m(new y(d.message,"worker-error"))}),n.once("exit",d=>{!f&&d!==0&&d!==null&&m(new y(`worker exited with code ${d} before responding`,"worker-error"))}),c=setTimeout(()=>{i=!0,n.terminate(),m(new y(`wall-clock budget of ${t}ms elapsed`,"timeout"))},t);let v={bundlePath:(0,R.pathToFileURL)(r).href,timeoutMs:t,derivationKeys:e.derivationKeys};n.postMessage(v)})}catch(u){if(u instanceof y&&u.code==="timeout")return{logs:[],facts:{},derived:{},errors:[u.message],durationMs:Date.now()-a,timedOut:!0};throw u}finally{c&&clearTimeout(c),await n.terminate().catch(()=>{}),s()}}function ue(e,t){let o=0;for(let r=t;r<e.length;r++){let s=e[r];if(s==="{")o+=1;else if(s==="}"&&(o-=1,o===0))return r}return-1}function le(e){let t=[],o=0,r=0,s=0,n=0,c=i=>{let a=e.slice(o,i).trim();if(o=i+1,!a)return;let u=a.match(/^['"]?(\w+)['"]?\s*:/);u&&t.push(u[1])};for(let i=0;i<e.length;i++){let a=e[i];a==="{"?r+=1:a==="}"?r-=1:a==="("?s+=1:a===")"?s-=1:a==="["?n+=1:a==="]"?n-=1:(a===","||a===`
-`)&&r===0&&s===0&&n===0&&c(i)}return c(e.length),t}function j(e,t){let o=new RegExp(`\\b${t}\\s*:\\s*\\{`),r=e.match(o);if(!r||r.index===void 0)return[];let s=e.indexOf("{",r.index);if(s===-1)return[];let n=ue(e,s);return n===-1?[]:le(e.slice(s+1,n))}function L(e){let t=new Set,o=[];for(let r of e){for(let s of j(r.source,"derive"))t.has(s)||(t.add(s),o.push(s));for(let s of j(r.source,"derivations"))t.has(s)||(t.add(s),o.push(s))}return o}var p=class extends Error{constructor(o,r){super(o);this.code=r;this.name="SandboxError"}};var l=require("ts-morph"),W=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),K=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function C(e){let t=e.match(/^@directive-run\/([^/]+)/);return t?t[1]:null}function de(e){if(/^\.{1,2}\/.+\.js$/.test(e))return!0;let t=C(e);return t===null||K.has(t)?!1:W.has(t)}var B=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),P=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function pe(e){let t=C(e);return t&&K.has(t)?`import "${e}" is denied \u2014 @directive-run/${t} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${e}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(W).sort().join(",")}}.`}function fe(e,t,o){let r=t.getSourceFileOrThrow(e);for(let s of r.getImportDeclarations()){let n=s.getModuleSpecifierValue();if(!de(n)){let{line:c,column:i}=r.getLineAndColumnAtPos(s.getStart());o.push({path:e,line:c,column:i,message:pe(n)})}}}function me(e,t,o){let r=t.getSourceFileOrThrow(e);r.forEachDescendant(s=>{if(s.getKind()===l.SyntaxKind.ImportKeyword){let n=s.getParent();if(n&&n.getKind()===l.SyntaxKind.CallExpression){let{line:c,column:i}=r.getLineAndColumnAtPos(s.getStart());o.push({path:e,line:c,column:i,message:"dynamic import() is not allowed in the sandbox"})}}if(s.getKind()===l.SyntaxKind.NewExpression){let n=s.getText();if(/^new\s+Function\s*\(/.test(n)){let{line:c,column:i}=r.getLineAndColumnAtPos(s.getStart());o.push({path:e,line:c,column:i,message:"new Function(...) is not allowed in the sandbox"})}}})}function ge(e,t,o){let r=t.getSourceFileOrThrow(e),s=(c,i)=>{let{line:a,column:u}=r.getLineAndColumnAtPos(c.getStart());o.push({path:e,line:a,column:u,message:i})},n=c=>{let i=c.trim();return i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'")||i.startsWith("`")&&i.endsWith("`")?i.slice(1,-1):null};r.forEachDescendant(c=>{let i=c.getKind();if(i===l.SyntaxKind.PropertyAccessExpression){let a=c.getName?.();if(!a)return;if(a==="constructor"){s(c,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(P.has(a)){s(c,`\`.${a}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(i===l.SyntaxKind.ElementAccessExpression){let a=c.getExpression?.(),u=c.getArgumentExpression?.(),g=a?.getText()??"",m=u?.getText()??"",f=n(m);if(g==="globalThis"&&f!==null){s(c,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(f!==null&&(f==="constructor"||P.has(f))){s(c,`bracket-access \`["${f}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(i===l.SyntaxKind.CallExpression){let u=c.getExpression?.()?.getText()??"";if(u==="Function"){s(c,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let f=c.getArguments?.()??[];if(f.length>=2){let v=f[0].getText(),d=n(f[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(v==="globalThis"||B.has(v))&&d!==null&&(d==="constructor"||P.has(d))&&s(c,`\`${g[1]}.${g[2]}(${v}, "${d}")\` would reach a denied name`)}}}})}function he(e,t,o){let r=t.getSourceFileOrThrow(e),s=new Set;for(let n of r.getImportDeclarations()){for(let a of n.getNamedImports())s.add(a.getName());let c=n.getDefaultImport();c&&s.add(c.getText());let i=n.getNamespaceImport();i&&s.add(i.getText())}for(let n of r.getVariableDeclarations())s.add(n.getName());for(let n of r.getFunctions()){let c=n.getName();c&&s.add(c)}for(let n of r.getClasses()){let c=n.getName();c&&s.add(c)}r.forEachDescendant(n=>{if(n.getKind()!==l.SyntaxKind.Identifier)return;let c=n.getText();if(s.has(c)||B.has(c))return;let i=n.getParent();if(i){let a=i.getKind();if(a===l.SyntaxKind.PropertyAssignment&&i.getNameNode?.()===n||a===l.SyntaxKind.PropertyAccessExpression&&i.getNameNode?.()===n||a===l.SyntaxKind.MethodDeclaration||a===l.SyntaxKind.ImportSpecifier||a===l.SyntaxKind.ExportSpecifier||a===l.SyntaxKind.NamespaceImport||a===l.SyntaxKind.ImportClause||a===l.SyntaxKind.Parameter||a===l.SyntaxKind.TypeReference||a===l.SyntaxKind.TypeQuery)return}if(P.has(c)){let{line:a,column:u}=r.getLineAndColumnAtPos(n.getStart());o.push({path:e,line:a,column:u,message:`identifier "${c}" is denied in the sandbox (FS/network/eval surface)`})}})}function V(e){let t=[],o=new l.Project({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let r of e)o.createSourceFile(r.path,r.source,{overwrite:!0});for(let r of e)fe(r.path,o,t),me(r.path,o,t),ge(r.path,o,t),he(r.path,o,t);return t}var q=2e5,U=10,T="src/main.ts";function ye(e){if(e.files&&e.source)throw new p("pass either `source` or `files`, not both","input-invalid");if(!e.files&&!e.source)throw new p("must pass either `source` or `files`","input-invalid");let t=e.files?e.files:[{path:T,source:e.source??""}];if(t.length===0)throw new p("files array is empty","input-invalid");if(t.length>U)throw new p(`payload exceeds ${U} files`,"input-invalid");let o=0;for(let r of t){if(typeof r.path!="string"||r.path.length===0)throw new p("every file must have a non-empty path","input-invalid");if(typeof r.source!="string"||r.source.length===0)throw new p(`file "${r.path}" has empty source`,"input-invalid");o+=Buffer.byteLength(r.source,"utf8")}if(o>q)throw new p(`total payload is ${o} bytes (max ${q})`,"input-invalid");if(!t.some(r=>r.path===T))throw new p(`payload must include "${T}" \u2014 the runner entry point`,"input-invalid");return t}async function xe(e){let t;try{t=ye(e)}catch(n){if(n instanceof p)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let o=V(t);if(o.length>0)return{logs:[],facts:{},derived:{},errors:o.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let r=L(t),s;try{s=await A(t)}catch(n){if(n instanceof h)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await O({bundledSource:s.source,derivationKeys:r,timeoutMs:e.timeoutMs})}catch(n){if(n instanceof y)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}0&&(module.exports={SandboxError,runInSandbox});
+"use strict";var H=Object.create;var S=Object.defineProperty;var X=Object.getOwnPropertyDescriptor;var z=Object.getOwnPropertyNames;var Y=Object.getPrototypeOf,J=Object.prototype.hasOwnProperty;var Q=(e,r)=>{for(var n in r)S(e,n,{get:r[n],enumerable:!0})},M=(e,r,n,t)=>{if(r&&typeof r=="object"||typeof r=="function")for(let s of z(r))!J.call(e,s)&&s!==n&&S(e,s,{get:()=>r[s],enumerable:!(t=X(r,s))||t.enumerable});return e};var Z=(e,r,n)=>(n=e!=null?H(Y(e)):{},M(r||!e||!e.__esModule?S(n,"default",{value:e,enumerable:!0}):n,e)),ee=e=>M(S({},"__esModule",{value:!0}),e);var we={};Q(we,{SandboxError:()=>p,runInSandbox:()=>xe});module.exports=ee(we);var k=require("module"),$=require("url"),A=require("esbuild"),ne={};function te(e){try{let n=(0,k.createRequire)(ne.url).resolve(e);return(0,$.pathToFileURL)(n).href}catch{return null}}var E="src/main.ts",w="directive-sandbox-vfs",h=class extends Error{constructor(n,t){super(n);this.cause=t;this.name="BundleError"}};function re(e){let r=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,n=e.match(r);if(!n)return e;let t=n[1],o=`
+(globalThis).__directiveSandbox_system__ = ${n[2]};
+`;return e.replace(t,t+o)}async function F(e){if(!e.find(t=>t.path===E))throw new h(`payload must include "${E}" \u2014 that's the entry point the runner targets`);let n=new Map;for(let t of e)n.set(t.path,t.source);try{let s=(await(0,A.build)({entryPoints:[`${w}:${E}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(c){c.onResolve({filter:/.*/},i=>{if(i.kind==="entry-point")return{path:i.path.replace(`${w}:`,""),namespace:w};if(i.namespace!==w)return null;if(i.path.startsWith("@directive-run/")){let a=te(i.path);return a?{external:!0,path:a}:{external:!0,path:i.path}}if(i.path.startsWith("./")||i.path.startsWith("../")){let a=i.importer.replace(/\/[^/]+$/,""),u=i.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${a}/${u}.ts`,`${a}/${u}.js`,`${a}/${u}`,`${u}.ts`,`${u}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of g)if(n.has(m))return{path:m,namespace:w};throw new h(`cannot resolve "${i.path}" from "${i.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${i.path}" from "${i.importer}" \u2014 only relative or @directive-run/* allowed`)}),c.onLoad({filter:/.*/,namespace:w},i=>{let a=n.get(i.path);if(a===void 0)throw new h(`virtual file missing: ${i.path}`);if(i.path===E){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {","  (globalThis).__directiveSandbox_system__ = system;","}"].join(`
+`);return{contents:a+u,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!s)throw new h("esbuild produced no output");let o=re(s);return{source:o,bytes:Buffer.byteLength(o,"utf8")}}catch(t){throw t instanceof h?t:new h(`bundle failed: ${t.message??String(t)}`,t)}}var x=require("fs"),D=require("os"),b=require("path"),P=require("url"),_=require("worker_threads"),N={},oe=100,se=1e4,R=5e3;async function O(){try{let n=new URL("./worker.js",N.url),t=(0,P.fileURLToPath)(n);if((0,x.existsSync)(t))return t}catch{}let{createRequire:e}=await import("module");return e(N.url).resolve("@directive-run/sandbox/worker")}var y=class extends Error{constructor(n,t){super(n);this.code=t;this.name="WorkerExecError"}};function ie(e){let r=e??R;return Number.isFinite(r)?Math.min(se,Math.max(oe,Math.floor(r))):R}async function ae(){let e=(0,D.tmpdir)();if((0,x.existsSync)(e))return e;let r=await O();return(0,b.dirname)((0,b.dirname)(r))}async function ce(e){let r=await ae(),n=(0,x.mkdtempSync)((0,b.join)(r,"directive-sandbox-")),t=(0,b.join)(n,"bundle.mjs");return(0,x.writeFileSync)(t,e,"utf8"),{bundlePath:t,cleanup:()=>{try{(0,x.rmSync)(n,{recursive:!0,force:!0})}catch{}}}}async function L(e){let r=ie(e.timeoutMs),n=await O(),{bundlePath:t,cleanup:s}=await ce(e.bundledSource),o=new _.Worker(n,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),c=null,i=!1,a=Date.now();try{return await new Promise((g,m)=>{let f=!1;o.once("message",d=>{f=!0,d.ok?g(d.result):m(new y(d.error,"worker-error"))}),o.once("error",d=>{f=!0,m(new y(d.message,"worker-error"))}),o.once("exit",d=>{!f&&d!==0&&d!==null&&m(new y(`worker exited with code ${d} before responding`,"worker-error"))}),c=setTimeout(()=>{i=!0,o.terminate(),m(new y(`wall-clock budget of ${r}ms elapsed`,"timeout"))},r);let v={bundlePath:(0,P.pathToFileURL)(t).href,timeoutMs:r,derivationKeys:e.derivationKeys};o.postMessage(v)})}catch(u){if(u instanceof y&&u.code==="timeout")return{logs:[],facts:{},derived:{},errors:[u.message],durationMs:Date.now()-a,timedOut:!0};throw u}finally{c&&clearTimeout(c),await o.terminate().catch(()=>{}),s()}}function ue(e,r){let n=0;for(let t=r;t<e.length;t++){let s=e[t];if(s==="{")n+=1;else if(s==="}"&&(n-=1,n===0))return t}return-1}function le(e){let r=[],n=0,t=0,s=0,o=0,c=i=>{let a=e.slice(n,i).trim();if(n=i+1,!a)return;let u=a.match(/^['"]?(\w+)['"]?\s*:/);u&&r.push(u[1])};for(let i=0;i<e.length;i++){let a=e[i];a==="{"?t+=1:a==="}"?t-=1:a==="("?s+=1:a===")"?s-=1:a==="["?o+=1:a==="]"?o-=1:(a===","||a===`
+`)&&t===0&&s===0&&o===0&&c(i)}return c(e.length),r}function j(e,r){let n=new RegExp(`\\b${r}\\s*:\\s*\\{`),t=e.match(n);if(!t||t.index===void 0)return[];let s=e.indexOf("{",t.index);if(s===-1)return[];let o=ue(e,s);return o===-1?[]:le(e.slice(s+1,o))}function W(e){let r=new Set,n=[];for(let t of e){for(let s of j(t.source,"derive"))r.has(s)||(r.add(s),n.push(s));for(let s of j(t.source,"derivations"))r.has(s)||(r.add(s),n.push(s))}return n}var p=class extends Error{constructor(n,t){super(n);this.code=t;this.name="SandboxError"}};var l=require("ts-morph"),K=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),C=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function B(e){let r=e.match(/^@directive-run\/([^/]+)/);return r?r[1]:null}function de(e){if(/^\.{1,2}\/.+\.js$/.test(e))return!0;let r=B(e);return r===null||C.has(r)?!1:K.has(r)}var V=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),T=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function pe(e){let r=B(e);return r&&C.has(r)?`import "${e}" is denied \u2014 @directive-run/${r} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${e}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(K).sort().join(",")}}.`}function fe(e,r,n){let t=r.getSourceFileOrThrow(e);for(let s of t.getImportDeclarations()){let o=s.getModuleSpecifierValue();if(!de(o)){let{line:c,column:i}=t.getLineAndColumnAtPos(s.getStart());n.push({path:e,line:c,column:i,message:pe(o)})}}}function me(e,r,n){let t=r.getSourceFileOrThrow(e);t.forEachDescendant(s=>{if(s.getKind()===l.SyntaxKind.ImportKeyword){let o=s.getParent();if(o&&o.getKind()===l.SyntaxKind.CallExpression){let{line:c,column:i}=t.getLineAndColumnAtPos(s.getStart());n.push({path:e,line:c,column:i,message:"dynamic import() is not allowed in the sandbox"})}}if(s.getKind()===l.SyntaxKind.NewExpression){let o=s.getText();if(/^new\s+Function\s*\(/.test(o)){let{line:c,column:i}=t.getLineAndColumnAtPos(s.getStart());n.push({path:e,line:c,column:i,message:"new Function(...) is not allowed in the sandbox"})}}})}function ge(e,r,n){let t=r.getSourceFileOrThrow(e),s=(c,i)=>{let{line:a,column:u}=t.getLineAndColumnAtPos(c.getStart());n.push({path:e,line:a,column:u,message:i})},o=c=>{let i=c.trim();return i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'")||i.startsWith("`")&&i.endsWith("`")?i.slice(1,-1):null};t.forEachDescendant(c=>{let i=c.getKind();if(i===l.SyntaxKind.PropertyAccessExpression){let a=c.getName?.();if(!a)return;if(a==="constructor"){s(c,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(T.has(a)){s(c,`\`.${a}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(i===l.SyntaxKind.ElementAccessExpression){let a=c.getExpression?.(),u=c.getArgumentExpression?.(),g=a?.getText()??"",m=u?.getText()??"",f=o(m);if(g==="globalThis"&&f!==null){s(c,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(f!==null&&(f==="constructor"||T.has(f))){s(c,`bracket-access \`["${f}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(i===l.SyntaxKind.CallExpression){let u=c.getExpression?.()?.getText()??"";if(u==="Function"){s(c,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let f=c.getArguments?.()??[];if(f.length>=2){let v=f[0].getText(),d=o(f[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(v==="globalThis"||V.has(v))&&d!==null&&(d==="constructor"||T.has(d))&&s(c,`\`${g[1]}.${g[2]}(${v}, "${d}")\` would reach a denied name`)}}}})}function he(e,r,n){let t=r.getSourceFileOrThrow(e),s=new Set;for(let o of t.getImportDeclarations()){for(let a of o.getNamedImports())s.add(a.getName());let c=o.getDefaultImport();c&&s.add(c.getText());let i=o.getNamespaceImport();i&&s.add(i.getText())}for(let o of t.getVariableDeclarations())s.add(o.getName());for(let o of t.getFunctions()){let c=o.getName();c&&s.add(c)}for(let o of t.getClasses()){let c=o.getName();c&&s.add(c)}t.forEachDescendant(o=>{if(o.getKind()!==l.SyntaxKind.Identifier)return;let c=o.getText();if(s.has(c)||V.has(c))return;let i=o.getParent();if(i){let a=i.getKind();if(a===l.SyntaxKind.PropertyAssignment&&i.getNameNode?.()===o||a===l.SyntaxKind.PropertyAccessExpression&&i.getNameNode?.()===o||a===l.SyntaxKind.MethodDeclaration||a===l.SyntaxKind.ImportSpecifier||a===l.SyntaxKind.ExportSpecifier||a===l.SyntaxKind.NamespaceImport||a===l.SyntaxKind.ImportClause||a===l.SyntaxKind.Parameter||a===l.SyntaxKind.TypeReference||a===l.SyntaxKind.TypeQuery)return}if(T.has(c)){let{line:a,column:u}=t.getLineAndColumnAtPos(o.getStart());n.push({path:e,line:a,column:u,message:`identifier "${c}" is denied in the sandbox (FS/network/eval surface)`})}})}function U(e){let r=[],n=new l.Project({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let t of e)n.createSourceFile(t.path,t.source,{overwrite:!0});for(let t of e)fe(t.path,n,r),me(t.path,n,r),ge(t.path,n,r),he(t.path,n,r);return r}var q=2e5,G=10,I="src/main.ts";function ye(e){if(e.files&&e.source)throw new p("pass either `source` or `files`, not both","input-invalid");if(!e.files&&!e.source)throw new p("must pass either `source` or `files`","input-invalid");let r=e.files?e.files:[{path:I,source:e.source??""}];if(r.length===0)throw new p("files array is empty","input-invalid");if(r.length>G)throw new p(`payload exceeds ${G} files`,"input-invalid");let n=0;for(let t of r){if(typeof t.path!="string"||t.path.length===0)throw new p("every file must have a non-empty path","input-invalid");if(typeof t.source!="string"||t.source.length===0)throw new p(`file "${t.path}" has empty source`,"input-invalid");n+=Buffer.byteLength(t.source,"utf8")}if(n>q)throw new p(`total payload is ${n} bytes (max ${q})`,"input-invalid");if(!r.some(t=>t.path===I))throw new p(`payload must include "${I}" \u2014 the runner entry point`,"input-invalid");return r}async function xe(e){let r;try{r=ye(e)}catch(o){if(o instanceof p)return{logs:[],facts:{},derived:{},errors:[o.message],durationMs:0,timedOut:!1};throw o}let n=U(r);if(n.length>0)return{logs:[],facts:{},derived:{},errors:n.map(o=>`${o.path}:${o.line}:${o.column} \u2014 ${o.message}`),durationMs:0,timedOut:!1};let t=W(r),s;try{s=await F(r)}catch(o){if(o instanceof h)return{logs:[],facts:{},derived:{},errors:[o.message],durationMs:0,timedOut:!1};throw o}try{return await L({bundledSource:s.source,derivationKeys:t,timeoutMs:e.timeoutMs})}catch(o){if(o instanceof y)return{logs:[],facts:{},derived:{},errors:[o.message],durationMs:0,timedOut:o.code==="timeout"};throw o}}0&&(module.exports={SandboxError,runInSandbox});
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts","../src/bundler.ts","../src/host.ts","../src/key-extractor.ts","../src/types.ts","../src/validator.ts"],"sourcesContent":["/*\n Public API for `@directive-run/sandbox`.\n \n Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n \n Consumers:\n \n - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n /\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { extractDerivationKeys } from \"./key-extractor.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" \|\| file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" \|\| file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n // Phase A audit P0-DM2: pre-extract derivation key names from the\n // source files so the worker can iterate them after settle. The\n // `system.derive` proxy has no `ownKeys` trap.\n const derivationKeys = extractDerivationKeys(files);\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n derivationKeys,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n","/\n esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n \n `@directive-run/` packages are marked external* — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n \n The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n /\n\nimport { createRequire } from \"node:module\";\nimport { pathToFileURL } from \"node:url\";\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Resolve a `@directive-run/` bare specifier to an absolute file://\n URL using the host process's node_modules. Required because the\n * worker imports the bundle from `/tmp` (Phase A P0-A1) where Node's\n * ESM resolver can't walk up to find `@directive-run/`. By rewriting\n to absolute file URLs at bundle time, the worker doesn't need a\n * node_modules anchor.\n \n Returns null when the package can't be resolved (e.g. consumer has\n * a different install layout); the caller falls back to leaving the\n * bare specifier in place, which works when the worker IS next to\n * node_modules.\n /\nfunction resolveDirectivePackageToFileUrl(specifier: string): string \| null {\n try {\n const require = createRequire(import.meta.url);\n const resolved = require.resolve(specifier);\n return pathToFileURL(resolved).href;\n } catch {\n return null;\n }\n}\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /* Single ESM string ready to evaluate inside the worker. /\n source: string;\n /* Total bytes of the bundled JS (informational). /\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/\n Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n \n esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n \n var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n \n The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n /\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d)\\s=\\screateSystem\\s\$[\\s\\S]?\$\\s;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // The plugin's onResolve below intercepts every `@directive-run/`\n // import and rewrites it to an absolute file:// URL (so the\n // worker can import the bundle from /tmp without needing\n // node_modules above it). The wildcard external is the safety\n // net for any specifier the plugin doesn't recognize.\n external: [\"@directive-run/\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /./ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // Phase A audit P0-A1: rewrite to absolute file:// URL\n // so the worker's `/tmp/.../bundle.mjs` can import the\n // package without needing node_modules above /tmp.\n // Falls back to the bare specifier when resolution\n // fails — the legacy \"write next to node_modules\"\n // pattern still works as a backup.\n const resolved = resolveDirectivePackageToFileUrl(args.path);\n if (resolved) {\n return { external: true, path: resolved };\n }\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") \|\| args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /./, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/\n Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n \n Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n /\n\nimport { existsSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n // shim of import.meta exposes a `resolve` that isn't callable, and\n // `createRequire` works in both real Node ESM and Vitest dev mode.\n // The worker subpath export points at dist/worker.js; CJS resolution\n // picks up the \"default\" condition we set in package.json.\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n /* Derivation key names extracted from the payload's source files. /\n derivationKeys: string[];\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" \| \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number \| undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/\n Try `os.tmpdir()` first (Vercel-friendly: /tmp is the only writable\n * location on serverless functions). Fall back to the sandbox package\n * dir if /tmp ISN'T writable for some reason. The fallback inherits\n * the package's node_modules walking chain so bare specifiers like\n * `@directive-run/core` resolve naturally.\n /\nasync function getTempBundleDir(): Promise<string> {\n const osTmp = tmpdir();\n if (existsSync(osTmp)) {\n return osTmp;\n }\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/\n Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL.\n \n Phase A audit P0-A1: previous versions wrote inside the sandbox\n * package's own directory so Node's resolver could walk up to find\n * `@directive-run/core` in node_modules — but Vercel / AWS Lambda /\n * Cloud Run all ship read-only FS outside `/tmp`. The bundler now\n * rewrites `@directive-run/` imports to ABSOLUTE `file://` URLs of\n the host's resolved paths (see `bundleSandboxFiles`), so the temp\n * file can live in `/tmp` without needing a node_modules anchor.\n \n Caller MUST clean the directory up in a finally block.\n /\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const baseDir = await getTempBundleDir();\n const dir = mkdtempSync(join(baseDir, \"directive-sandbox-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout \| null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n derivationKeys: input.derivationKeys,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/\n Pure regex-based extractor for `derive:` / `derivations:` block keys\n * across a payload of source files. Mirrors the lightweight pattern the\n * docs site's DevTools panel uses for static-structure parsing.\n \n Phase A AE audit (P0-DM2): `system.derive` is a Proxy with no\n * `ownKeys` trap, so the worker can't enumerate derivations from inside\n * the sandbox. Instead, the host pre-scans source files for the\n * declared keys and forwards them to the worker, which then reads\n * `system.derive[key]` for each.\n \n Best-effort: a module that builds derivation keys dynamically (e.g.\n * `derive: Object.fromEntries(keys.map(k => [k, fn]))`) won't be\n * extracted. That's acceptable for the audit's stated goal of\n * \"transcript reflects what the module declared.\"\n /\n\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Find the matching `}` for the `{` at `openBrace`. Returns the index\n * of the close brace, or -1 if unbalanced.\n /\nfunction findMatchingClose(source: string, openBrace: number): number {\n let depth = 0;\n for (let i = openBrace; i < source.length; i++) {\n const ch = source[i];\n if (ch === \"{\") depth += 1;\n else if (ch === \"}\") {\n depth -= 1;\n if (depth === 0) return i;\n }\n }\n return -1;\n}\n\n/\n Pull top-level `key:` segments out of a brace-balanced block. Keys\n * are found between `,` or `\\n` or the block start at brace depth 0\n * AND paren depth 0. Works for both multi-line and compact `{ a: 1,\n * b: 2 }` forms.\n /\nfunction collectTopLevelKeys(block: string): string[] {\n const keys: string[] = [];\n let segStart = 0;\n let braceDepth = 0;\n let parenDepth = 0;\n let bracketDepth = 0;\n\n const flushSegment = (end: number) => {\n const seg = block.slice(segStart, end).trim();\n segStart = end + 1;\n if (!seg) return;\n // Tolerate leading quotes for `\"foo\":` quoted keys.\n const m = seg.match(/^['\"]?(\\w+)['\"]?\\s:/);\n if (m) keys.push(m[1]!);\n };\n\n for (let j = 0; j < block.length; j++) {\n const ch = block[j];\n if (ch === \"{\") braceDepth += 1;\n else if (ch === \"}\") braceDepth -= 1;\n else if (ch === \"(\") parenDepth += 1;\n else if (ch === \")\") parenDepth -= 1;\n else if (ch === \"[\") bracketDepth += 1;\n else if (ch === \"]\") bracketDepth -= 1;\n else if (\n (ch === \",\" \|\| ch === \"\\n\") &&\n braceDepth === 0 &&\n parenDepth === 0 &&\n bracketDepth === 0\n ) {\n flushSegment(j);\n }\n }\n // Final segment (no trailing comma/newline).\n flushSegment(block.length);\n return keys;\n}\n\nfunction extractTopLevelKeys(source: string, sectionName: string): string[] {\n const headerRe = new RegExp(`\\\\b${sectionName}\\\\s:\\\\s\\\\{`);\n const headerMatch = source.match(headerRe);\n if (!headerMatch \|\| headerMatch.index === undefined) {\n return [];\n }\n const openBrace = source.indexOf(\"{\", headerMatch.index);\n if (openBrace === -1) {\n return [];\n }\n const closeBrace = findMatchingClose(source, openBrace);\n if (closeBrace === -1) {\n return [];\n }\n return collectTopLevelKeys(source.slice(openBrace + 1, closeBrace));\n}\n\n/*\n Collect the union of derivation key names declared across all files\n * in the payload. Looks at both `derive:` (module config block) and\n * `derivations:` (schema block). De-duplicates.\n /\nexport function extractDerivationKeys(files: PlaygroundFile[]): string[] {\n const seen = new Set<string>();\n const out: string[] = [];\n for (const file of files) {\n for (const k of extractTopLevelKeys(file.source, \"derive\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n for (const k of extractTopLevelKeys(file.source, \"derivations\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n }\n return out;\n}\n","/\n Public types for `@directive-run/sandbox`.\n \n The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n /\n\nexport interface PlaygroundFile {\n /\n Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n /\n path: string;\n /* File contents. /\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /* Single-file shortcut. Mapped onto \"src/main.ts\" internally. /\n source?: string;\n /* Multi-file payload (the `generate_module` paired output shape). /\n files?: PlaygroundFile[];\n /* Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. /\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /\n Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n /\n logs: string[];\n /\n Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n /\n facts: Record<string, unknown>;\n /\n Final `system.derive` snapshot — every derivation declared in the\n * module config, evaluated by reading `system.derive[key]`. Empty\n * when the module has no `derive:` block or when validation rejected\n * before bundle. The Phase A AE audit (P0-DM2) flagged the original\n * sandbox for snapshotting only facts; modules whose primary product\n * is a derivation (`status`, `isReady`, etc.) returned an empty-\n * looking transcript.\n /\n derived: Record<string, unknown>;\n /\n Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n /\n errors: string[];\n /* Elapsed wall-clock duration of the worker execution. /\n durationMs: number;\n /* True when the wall-clock budget elapsed before settle()/destroy(). /\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n \| \"validation-failed\"\n \| \"bundle-failed\"\n \| \"worker-error\"\n \| \"timeout\"\n \| \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/\n Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n /\nexport interface WorkerInputMessage {\n /* `file://` URL of the temp .mjs bundle the host wrote. /\n bundlePath: string;\n timeoutMs: number;\n /\n Derivation key names the host extracted from the source files.\n * `system.derive` is a Proxy with no `ownKeys` trap, so we can't\n * enumerate from the worker; the host's pre-bundle pass scans the\n * source for `derive:` and `derivations:` blocks and forwards the\n * keys here. Worker reads `system.derive[key]` for each.\n /\n derivationKeys: string[];\n}\n\n/* Wire shape for messages from worker → host. /\nexport type WorkerOutputMessage =\n \| { ok: true; result: SandboxResult }\n \| { ok: false; error: string };\n","/\n AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n \n Allowlist:\n \n - Imports: must match `@directive-run/` (specifically `core`, `ai`,\n `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.`, `Math.`, `JSON.`. Anything that touches\n global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n \n Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n \n Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n /\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n \n Packages deliberately EXCLUDED:\n \n - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n \n The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n /\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/\n Extract the package name segment from a @directive-run/* specifier.\n \n \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n \n Returns null when the specifier doesn't match the scope.\n /\nfunction extractDirectivePackage(specifier: string): string \| null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/\n Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n /\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/\n Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n /\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/*\n The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n \n The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n \n Rules:\n \n 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n */\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string \| null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) \|\|\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) \|\|\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } \| undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" \|\| DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect\|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" \|\| ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" \|\|\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier \|\|\n parentKind === SyntaxKind.ExportSpecifier \|\|\n parentKind === SyntaxKind.NamespaceImport \|\|\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference \|\|\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n"],"mappings":"0jBAAA,IAAAA,GAAA,GAAAC,EAAAD,GAAA,kBAAAE,EAAA,iBAAAC,KAAA,eAAAC,EAAAJ,ICgBA,IAAAK,EAA8B,kBAC9BC,EAA8B,eAC9BC,EAAsB,mBAlBtBC,GAAA,GAkCA,SAASC,GAAiCC,EAAkC,CAC1E,GAAI,CAEF,IAAMC,KADU,iBAAcH,GAAY,GAAG,EACpB,QAAQE,CAAS,EAC1C,SAAO,iBAAcC,CAAQ,EAAE,IACjC,MAAQ,CACN,OAAO,IACT,CACF,CAEA,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,GAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CA0GF,IAAMC,GAzGS,QAAM,SAAM,CACzB,YAAa,CAAC,GAAGf,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAAG,CAO3C,IAAMnB,EAAWF,GAAiCqB,EAAK,IAAI,EAC3D,OAAInB,EACK,CAAE,SAAU,GAAM,KAAMA,CAAS,EAEnC,CAAE,SAAU,GAAM,KAAMmB,EAAK,IAAK,CAC3C,CACA,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,GAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CChOA,IAAAC,EAA+D,cAC/DC,EAAuB,cACvBC,EAA8B,gBAC9BC,EAA8B,eAC9BC,EAAuB,0BAhBvBC,GAAA,GAuBMC,GAAiB,IACjBC,GAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAcL,GAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CASO,IAAMM,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,GAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,GAAgB,KAAK,IAAID,GAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CASA,eAAeS,IAAoC,CACjD,IAAMC,KAAQ,UAAO,EACrB,MAAI,cAAWA,CAAK,EAClB,OAAOA,EAIT,IAAMC,EAAa,MAAMV,EAAkB,EAE3C,SAAO,cAAQ,WAAQU,CAAU,CAAC,CACpC,CAgBA,eAAeC,GAAkBC,EAG9B,CACD,IAAMC,EAAU,MAAML,GAAiB,EACjCM,KAAM,kBAAY,QAAKD,EAAS,oBAAoB,CAAC,EACrDE,KAAa,QAAKD,EAAK,YAAY,EACzC,0BAAcC,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,IACF,UAAOD,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYb,GAAaY,EAAM,SAAS,EACxCP,EAAa,MAAMV,EAAkB,EACrC,CAAE,WAAAe,EAAY,QAASI,CAAe,EAAI,MAAMR,GACpDM,EAAM,aACR,EACMG,EAAS,IAAI,SAAOV,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CAgDF,OA/Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAIvB,EAAgByB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAIvB,EAAgB0B,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAAShB,GAAS,CACxB,CAACsB,GAAWtB,IAAS,GAAKA,IAAS,MACrCqB,EACE,IAAIvB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDiB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAIvB,EACF,wBAAwBgB,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMf,EAA8B,CAClC,cAAY,iBAAcY,CAAU,EAAE,KACtC,UAAAG,EACA,eAAgBD,EAAM,cACxB,EACAG,EAAO,YAAYjB,CAAO,CAC5B,CAAC,CAGH,OAASyB,EAAK,CACZ,GAAIA,aAAe1B,GAAmB0B,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC7LA,SAASU,GAAkBC,EAAgBC,EAA2B,CACpE,IAAIC,EAAQ,EACZ,QAASC,EAAIF,EAAWE,EAAIH,EAAO,OAAQG,IAAK,CAC9C,IAAMC,EAAKJ,EAAOG,CAAC,EACnB,GAAIC,IAAO,IAAKF,GAAS,UAChBE,IAAO,MACdF,GAAS,EACLA,IAAU,GAAG,OAAOC,CAE5B,CACA,MAAO,EACT,CAQA,SAASE,GAAoBC,EAAyB,CACpD,IAAMC,EAAiB,CAAC,EACpBC,EAAW,EACXC,EAAa,EACbC,EAAa,EACbC,EAAe,EAEbC,EAAgBC,GAAgB,CACpC,IAAMC,EAAMR,EAAM,MAAME,EAAUK,CAAG,EAAE,KAAK,EAE5C,GADAL,EAAWK,EAAM,EACb,CAACC,EAAK,OAEV,IAAMC,EAAID,EAAI,MAAM,sBAAsB,EACtCC,GAAGR,EAAK,KAAKQ,EAAE,CAAC,CAAE,CACxB,EAEA,QAASC,EAAI,EAAGA,EAAIV,EAAM,OAAQU,IAAK,CACrC,IAAMZ,EAAKE,EAAMU,CAAC,EACdZ,IAAO,IAAKK,GAAc,EACrBL,IAAO,IAAKK,GAAc,EAC1BL,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKO,GAAgB,EAC5BP,IAAO,IAAKO,GAAgB,GAElCP,IAAO,KAAOA,IAAO;AAAA,IACtBK,IAAe,GACfC,IAAe,GACfC,IAAiB,GAEjBC,EAAaI,CAAC,CAElB,CAEA,OAAAJ,EAAaN,EAAM,MAAM,EAClBC,CACT,CAEA,SAASU,EAAoBjB,EAAgBkB,EAA+B,CAC1E,IAAMC,EAAW,IAAI,OAAO,MAAMD,CAAW,cAAc,EACrDE,EAAcpB,EAAO,MAAMmB,CAAQ,EACzC,GAAI,CAACC,GAAeA,EAAY,QAAU,OACxC,MAAO,CAAC,EAEV,IAAMnB,EAAYD,EAAO,QAAQ,IAAKoB,EAAY,KAAK,EACvD,GAAInB,IAAc,GAChB,MAAO,CAAC,EAEV,IAAMoB,EAAatB,GAAkBC,EAAQC,CAAS,EACtD,OAAIoB,IAAe,GACV,CAAC,EAEHhB,GAAoBL,EAAO,MAAMC,EAAY,EAAGoB,CAAU,CAAC,CACpE,CAOO,SAASC,EAAsBC,EAAmC,CACvE,IAAMC,EAAO,IAAI,IACXC,EAAgB,CAAC,EACvB,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAKV,EAAoBS,EAAK,OAAQ,QAAQ,EAClDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,GAGd,QAAWA,KAAKV,EAAoBS,EAAK,OAAQ,aAAa,EACvDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,EAGhB,CACA,OAAOF,CACT,CClDO,IAAMG,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,ECrDA,IAAAC,EAAoC,oBAuB9BC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,GAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,GAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,GAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,GACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAMC,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAM,aAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAJ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAME,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,GACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS,aAAW,yBAA0B,CAChD,IAAMC,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS,aAAW,wBAAyB,CAC/C,IAAME,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS,aAAW,eAAgB,CAStC,IAAMO,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,WAChC,OAEF,IAAMS,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAe,aAAW,oBAE1B3B,EACA,cAAc,IACKD,GAKnB4B,IAAe,aAAW,0BAE1B3B,EACA,cAAc,IACGD,GAKjB4B,IAAe,aAAW,mBAK5BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,cAKxBA,IAAe,aAAW,WAK5BA,IAAe,aAAW,eAC1BA,IAAe,aAAW,UAE1B,MAEJ,CAEA,GAAIxC,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAI,UAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWuC,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,GAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,GAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,GAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CLnhBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAMF,IAAMC,EAAiBC,EAAsBV,CAAK,EAE9CW,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBZ,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAMF,OALe,MAAMS,EAAa,CAChC,cAAeH,EAAQ,OACvB,eAAAF,EACA,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeU,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACV,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["src_exports","__export","SandboxError","runInSandbox","__toCommonJS","import_node_module","import_node_url","import_esbuild","import_meta","resolveDirectivePackageToFileUrl","specifier","resolved","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","import_node_fs","import_node_os","import_node_path","import_node_url","import_node_worker_threads","import_meta","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getTempBundleDir","osTmp","workerPath","writeBundleToTemp","bundledSource","baseDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","findMatchingClose","source","openBrace","depth","i","ch","collectTopLevelKeys","block","keys","segStart","braceDepth","parenDepth","bracketDepth","flushSegment","end","seg","m","j","extractTopLevelKeys","sectionName","headerRe","headerMatch","closeBrace","extractDerivationKeys","files","seen","out","file","k","SandboxError","message","code","import_ts_morph","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","derivationKeys","extractDerivationKeys","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}
1	+ {"version":3,"sources":["../src/index.ts","../src/bundler.ts","../src/host.ts","../src/key-extractor.ts","../src/types.ts","../src/validator.ts"],"sourcesContent":["/*\n Public API for `@directive-run/sandbox`.\n \n Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n \n Consumers:\n \n - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n /\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { extractDerivationKeys } from \"./key-extractor.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" \|\| file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" \|\| file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n // Phase A audit P0-DM2: pre-extract derivation key names from the\n // source files so the worker can iterate them after settle. The\n // `system.derive` proxy has no `ownKeys` trap.\n const derivationKeys = extractDerivationKeys(files);\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n derivationKeys,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n","/\n esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n \n `@directive-run/` packages are marked external* — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n \n The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n /\n\nimport { createRequire } from \"node:module\";\nimport { pathToFileURL } from \"node:url\";\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Resolve a `@directive-run/` bare specifier to an absolute file://\n URL using the host process's node_modules. Required because the\n * worker imports the bundle from `/tmp` (Phase A P0-A1) where Node's\n * ESM resolver can't walk up to find `@directive-run/`. By rewriting\n to absolute file URLs at bundle time, the worker doesn't need a\n * node_modules anchor.\n \n Returns null when the package can't be resolved (e.g. consumer has\n * a different install layout); the caller falls back to leaving the\n * bare specifier in place, which works when the worker IS next to\n * node_modules.\n /\nfunction resolveDirectivePackageToFileUrl(specifier: string): string \| null {\n try {\n const require = createRequire(import.meta.url);\n const resolved = require.resolve(specifier);\n return pathToFileURL(resolved).href;\n } catch {\n return null;\n }\n}\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /* Single ESM string ready to evaluate inside the worker. /\n source: string;\n /* Total bytes of the bundled JS (informational). /\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/\n Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n \n esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n \n var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n \n The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n /\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d)\\s=\\screateSystem\\s\$[\\s\\S]?\$\\s;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // The plugin's onResolve below intercepts every `@directive-run/`\n // import and rewrites it to an absolute file:// URL (so the\n // worker can import the bundle from /tmp without needing\n // node_modules above it). The wildcard external is the safety\n // net for any specifier the plugin doesn't recognize.\n external: [\"@directive-run/\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /./ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // Phase A audit P0-A1: rewrite to absolute file:// URL\n // so the worker's `/tmp/.../bundle.mjs` can import the\n // package without needing node_modules above /tmp.\n // Falls back to the bare specifier when resolution\n // fails — the legacy \"write next to node_modules\"\n // pattern still works as a backup.\n const resolved = resolveDirectivePackageToFileUrl(args.path);\n if (resolved) {\n return { external: true, path: resolved };\n }\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") \|\| args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /./, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/\n Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n \n Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n /\n\nimport { existsSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // PRIMARY: static URL relative to this module's own file. Bundlers\n // (Next.js outputFileTracing, esbuild, webpack, etc.) follow this\n // static reference at build time and include `worker.js` in the\n // output bundle automatically. Works on Vercel + AWS Lambda + Cloud\n // Run without any consumer-side config.\n //\n // FALLBACK (Vitest dev path): `import.meta.url` resolves to the\n // .ts source file in tests, so `./worker.js` doesn't exist there —\n // fall through to `createRequire(import.meta.url).resolve(...)`\n // which Vitest handles correctly via its SSR loader.\n try {\n const staticUrl = new URL(\"./worker.js\", import.meta.url);\n const path = fileURLToPath(staticUrl);\n if (existsSync(path)) {\n return path;\n }\n } catch {\n // fall through\n }\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n /* Derivation key names extracted from the payload's source files. /\n derivationKeys: string[];\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" \| \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number \| undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/\n Try `os.tmpdir()` first (Vercel-friendly: /tmp is the only writable\n * location on serverless functions). Fall back to the sandbox package\n * dir if /tmp ISN'T writable for some reason. The fallback inherits\n * the package's node_modules walking chain so bare specifiers like\n * `@directive-run/core` resolve naturally.\n /\nasync function getTempBundleDir(): Promise<string> {\n const osTmp = tmpdir();\n if (existsSync(osTmp)) {\n return osTmp;\n }\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/\n Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL.\n \n Phase A audit P0-A1: previous versions wrote inside the sandbox\n * package's own directory so Node's resolver could walk up to find\n * `@directive-run/core` in node_modules — but Vercel / AWS Lambda /\n * Cloud Run all ship read-only FS outside `/tmp`. The bundler now\n * rewrites `@directive-run/` imports to ABSOLUTE `file://` URLs of\n the host's resolved paths (see `bundleSandboxFiles`), so the temp\n * file can live in `/tmp` without needing a node_modules anchor.\n \n Caller MUST clean the directory up in a finally block.\n /\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const baseDir = await getTempBundleDir();\n const dir = mkdtempSync(join(baseDir, \"directive-sandbox-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout \| null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n derivationKeys: input.derivationKeys,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/\n Pure regex-based extractor for `derive:` / `derivations:` block keys\n * across a payload of source files. Mirrors the lightweight pattern the\n * docs site's DevTools panel uses for static-structure parsing.\n \n Phase A AE audit (P0-DM2): `system.derive` is a Proxy with no\n * `ownKeys` trap, so the worker can't enumerate derivations from inside\n * the sandbox. Instead, the host pre-scans source files for the\n * declared keys and forwards them to the worker, which then reads\n * `system.derive[key]` for each.\n \n Best-effort: a module that builds derivation keys dynamically (e.g.\n * `derive: Object.fromEntries(keys.map(k => [k, fn]))`) won't be\n * extracted. That's acceptable for the audit's stated goal of\n * \"transcript reflects what the module declared.\"\n /\n\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Find the matching `}` for the `{` at `openBrace`. Returns the index\n * of the close brace, or -1 if unbalanced.\n /\nfunction findMatchingClose(source: string, openBrace: number): number {\n let depth = 0;\n for (let i = openBrace; i < source.length; i++) {\n const ch = source[i];\n if (ch === \"{\") depth += 1;\n else if (ch === \"}\") {\n depth -= 1;\n if (depth === 0) return i;\n }\n }\n return -1;\n}\n\n/\n Pull top-level `key:` segments out of a brace-balanced block. Keys\n * are found between `,` or `\\n` or the block start at brace depth 0\n * AND paren depth 0. Works for both multi-line and compact `{ a: 1,\n * b: 2 }` forms.\n /\nfunction collectTopLevelKeys(block: string): string[] {\n const keys: string[] = [];\n let segStart = 0;\n let braceDepth = 0;\n let parenDepth = 0;\n let bracketDepth = 0;\n\n const flushSegment = (end: number) => {\n const seg = block.slice(segStart, end).trim();\n segStart = end + 1;\n if (!seg) return;\n // Tolerate leading quotes for `\"foo\":` quoted keys.\n const m = seg.match(/^['\"]?(\\w+)['\"]?\\s:/);\n if (m) keys.push(m[1]!);\n };\n\n for (let j = 0; j < block.length; j++) {\n const ch = block[j];\n if (ch === \"{\") braceDepth += 1;\n else if (ch === \"}\") braceDepth -= 1;\n else if (ch === \"(\") parenDepth += 1;\n else if (ch === \")\") parenDepth -= 1;\n else if (ch === \"[\") bracketDepth += 1;\n else if (ch === \"]\") bracketDepth -= 1;\n else if (\n (ch === \",\" \|\| ch === \"\\n\") &&\n braceDepth === 0 &&\n parenDepth === 0 &&\n bracketDepth === 0\n ) {\n flushSegment(j);\n }\n }\n // Final segment (no trailing comma/newline).\n flushSegment(block.length);\n return keys;\n}\n\nfunction extractTopLevelKeys(source: string, sectionName: string): string[] {\n const headerRe = new RegExp(`\\\\b${sectionName}\\\\s:\\\\s\\\\{`);\n const headerMatch = source.match(headerRe);\n if (!headerMatch \|\| headerMatch.index === undefined) {\n return [];\n }\n const openBrace = source.indexOf(\"{\", headerMatch.index);\n if (openBrace === -1) {\n return [];\n }\n const closeBrace = findMatchingClose(source, openBrace);\n if (closeBrace === -1) {\n return [];\n }\n return collectTopLevelKeys(source.slice(openBrace + 1, closeBrace));\n}\n\n/*\n Collect the union of derivation key names declared across all files\n * in the payload. Looks at both `derive:` (module config block) and\n * `derivations:` (schema block). De-duplicates.\n /\nexport function extractDerivationKeys(files: PlaygroundFile[]): string[] {\n const seen = new Set<string>();\n const out: string[] = [];\n for (const file of files) {\n for (const k of extractTopLevelKeys(file.source, \"derive\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n for (const k of extractTopLevelKeys(file.source, \"derivations\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n }\n return out;\n}\n","/\n Public types for `@directive-run/sandbox`.\n \n The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n /\n\nexport interface PlaygroundFile {\n /\n Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n /\n path: string;\n /* File contents. /\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /* Single-file shortcut. Mapped onto \"src/main.ts\" internally. /\n source?: string;\n /* Multi-file payload (the `generate_module` paired output shape). /\n files?: PlaygroundFile[];\n /* Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. /\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /\n Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n /\n logs: string[];\n /\n Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n /\n facts: Record<string, unknown>;\n /\n Final `system.derive` snapshot — every derivation declared in the\n * module config, evaluated by reading `system.derive[key]`. Empty\n * when the module has no `derive:` block or when validation rejected\n * before bundle. The Phase A AE audit (P0-DM2) flagged the original\n * sandbox for snapshotting only facts; modules whose primary product\n * is a derivation (`status`, `isReady`, etc.) returned an empty-\n * looking transcript.\n /\n derived: Record<string, unknown>;\n /\n Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n /\n errors: string[];\n /* Elapsed wall-clock duration of the worker execution. /\n durationMs: number;\n /* True when the wall-clock budget elapsed before settle()/destroy(). /\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n \| \"validation-failed\"\n \| \"bundle-failed\"\n \| \"worker-error\"\n \| \"timeout\"\n \| \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/\n Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n /\nexport interface WorkerInputMessage {\n /* `file://` URL of the temp .mjs bundle the host wrote. /\n bundlePath: string;\n timeoutMs: number;\n /\n Derivation key names the host extracted from the source files.\n * `system.derive` is a Proxy with no `ownKeys` trap, so we can't\n * enumerate from the worker; the host's pre-bundle pass scans the\n * source for `derive:` and `derivations:` blocks and forwards the\n * keys here. Worker reads `system.derive[key]` for each.\n /\n derivationKeys: string[];\n}\n\n/* Wire shape for messages from worker → host. /\nexport type WorkerOutputMessage =\n \| { ok: true; result: SandboxResult }\n \| { ok: false; error: string };\n","/\n AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n \n Allowlist:\n \n - Imports: must match `@directive-run/` (specifically `core`, `ai`,\n `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.`, `Math.`, `JSON.`. Anything that touches\n global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n \n Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n \n Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n /\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n \n Packages deliberately EXCLUDED:\n \n - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n \n The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n /\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/\n Extract the package name segment from a @directive-run/* specifier.\n \n \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n \n Returns null when the specifier doesn't match the scope.\n /\nfunction extractDirectivePackage(specifier: string): string \| null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/\n Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n /\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/\n Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n /\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/*\n The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n \n The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n \n Rules:\n \n 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n */\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string \| null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) \|\|\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) \|\|\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } \| undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" \|\| DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect\|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" \|\| ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" \|\|\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier \|\|\n parentKind === SyntaxKind.ExportSpecifier \|\|\n parentKind === SyntaxKind.NamespaceImport \|\|\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference \|\|\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n"],"mappings":"2jBAAA,IAAAA,GAAA,GAAAC,EAAAD,GAAA,kBAAAE,EAAA,iBAAAC,KAAA,eAAAC,GAAAJ,ICgBA,IAAAK,EAA8B,kBAC9BC,EAA8B,eAC9BC,EAAsB,mBAlBtBC,GAAA,GAkCA,SAASC,GAAiCC,EAAkC,CAC1E,GAAI,CAEF,IAAMC,KADU,iBAAcH,GAAY,GAAG,EACpB,QAAQE,CAAS,EAC1C,SAAO,iBAAcC,CAAQ,EAAE,IACjC,MAAQ,CACN,OAAO,IACT,CACF,CAEA,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,GAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CA0GF,IAAMC,GAzGS,QAAM,SAAM,CACzB,YAAa,CAAC,GAAGf,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAAG,CAO3C,IAAMnB,EAAWF,GAAiCqB,EAAK,IAAI,EAC3D,OAAInB,EACK,CAAE,SAAU,GAAM,KAAMA,CAAS,EAEnC,CAAE,SAAU,GAAM,KAAMmB,EAAK,IAAK,CAC3C,CACA,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,GAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CChOA,IAAAC,EAA+D,cAC/DC,EAAuB,cACvBC,EAA8B,gBAC9BC,EAA6C,eAC7CC,EAAuB,0BAhBvBC,EAAA,GAuBMC,GAAiB,IACjBC,GAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAWlD,GAAI,CACF,IAAMC,EAAY,IAAI,IAAI,cAAeL,EAAY,GAAG,EAClDM,KAAO,iBAAcD,CAAS,EACpC,MAAI,cAAWC,CAAI,EACjB,OAAOA,CAEX,MAAQ,CAER,CACA,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAcP,EAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CASO,IAAMQ,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,GAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAAST,EACrB,OAAK,OAAO,SAASU,CAAG,EAGjB,KAAK,IAAIX,GAAgB,KAAK,IAAID,GAAgB,KAAK,MAAMY,CAAG,CAAC,CAAC,EAFhEV,CAGX,CASA,eAAeW,IAAoC,CACjD,IAAMC,KAAQ,UAAO,EACrB,MAAI,cAAWA,CAAK,EAClB,OAAOA,EAIT,IAAMC,EAAa,MAAMZ,EAAkB,EAE3C,SAAO,cAAQ,WAAQY,CAAU,CAAC,CACpC,CAgBA,eAAeC,GAAkBC,EAG9B,CACD,IAAMC,EAAU,MAAML,GAAiB,EACjCM,KAAM,kBAAY,QAAKD,EAAS,oBAAoB,CAAC,EACrDE,KAAa,QAAKD,EAAK,YAAY,EACzC,0BAAcC,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,IACF,UAAOD,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYb,GAAaY,EAAM,SAAS,EACxCP,EAAa,MAAMZ,EAAkB,EACrC,CAAE,WAAAiB,EAAY,QAASI,CAAe,EAAI,MAAMR,GACpDM,EAAM,aACR,EACMG,EAAS,IAAI,SAAOV,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CAgDF,OA/Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAIvB,EAAgByB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAIvB,EAAgB0B,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAAShB,GAAS,CACxB,CAACsB,GAAWtB,IAAS,GAAKA,IAAS,MACrCqB,EACE,IAAIvB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDiB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAIvB,EACF,wBAAwBgB,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMf,EAA8B,CAClC,cAAY,iBAAcY,CAAU,EAAE,KACtC,UAAAG,EACA,eAAgBD,EAAM,cACxB,EACAG,EAAO,YAAYjB,CAAO,CAC5B,CAAC,CAGH,OAASyB,EAAK,CACZ,GAAIA,aAAe1B,GAAmB0B,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC3MA,SAASU,GAAkBC,EAAgBC,EAA2B,CACpE,IAAIC,EAAQ,EACZ,QAASC,EAAIF,EAAWE,EAAIH,EAAO,OAAQG,IAAK,CAC9C,IAAMC,EAAKJ,EAAOG,CAAC,EACnB,GAAIC,IAAO,IAAKF,GAAS,UAChBE,IAAO,MACdF,GAAS,EACLA,IAAU,GAAG,OAAOC,CAE5B,CACA,MAAO,EACT,CAQA,SAASE,GAAoBC,EAAyB,CACpD,IAAMC,EAAiB,CAAC,EACpBC,EAAW,EACXC,EAAa,EACbC,EAAa,EACbC,EAAe,EAEbC,EAAgBC,GAAgB,CACpC,IAAMC,EAAMR,EAAM,MAAME,EAAUK,CAAG,EAAE,KAAK,EAE5C,GADAL,EAAWK,EAAM,EACb,CAACC,EAAK,OAEV,IAAMC,EAAID,EAAI,MAAM,sBAAsB,EACtCC,GAAGR,EAAK,KAAKQ,EAAE,CAAC,CAAE,CACxB,EAEA,QAASC,EAAI,EAAGA,EAAIV,EAAM,OAAQU,IAAK,CACrC,IAAMZ,EAAKE,EAAMU,CAAC,EACdZ,IAAO,IAAKK,GAAc,EACrBL,IAAO,IAAKK,GAAc,EAC1BL,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKO,GAAgB,EAC5BP,IAAO,IAAKO,GAAgB,GAElCP,IAAO,KAAOA,IAAO;AAAA,IACtBK,IAAe,GACfC,IAAe,GACfC,IAAiB,GAEjBC,EAAaI,CAAC,CAElB,CAEA,OAAAJ,EAAaN,EAAM,MAAM,EAClBC,CACT,CAEA,SAASU,EAAoBjB,EAAgBkB,EAA+B,CAC1E,IAAMC,EAAW,IAAI,OAAO,MAAMD,CAAW,cAAc,EACrDE,EAAcpB,EAAO,MAAMmB,CAAQ,EACzC,GAAI,CAACC,GAAeA,EAAY,QAAU,OACxC,MAAO,CAAC,EAEV,IAAMnB,EAAYD,EAAO,QAAQ,IAAKoB,EAAY,KAAK,EACvD,GAAInB,IAAc,GAChB,MAAO,CAAC,EAEV,IAAMoB,EAAatB,GAAkBC,EAAQC,CAAS,EACtD,OAAIoB,IAAe,GACV,CAAC,EAEHhB,GAAoBL,EAAO,MAAMC,EAAY,EAAGoB,CAAU,CAAC,CACpE,CAOO,SAASC,EAAsBC,EAAmC,CACvE,IAAMC,EAAO,IAAI,IACXC,EAAgB,CAAC,EACvB,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAKV,EAAoBS,EAAK,OAAQ,QAAQ,EAClDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,GAGd,QAAWA,KAAKV,EAAoBS,EAAK,OAAQ,aAAa,EACvDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,EAGhB,CACA,OAAOF,CACT,CClDO,IAAMG,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,ECrDA,IAAAC,EAAoC,oBAuB9BC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,GAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,GAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,GAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,GACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAMC,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAM,aAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAJ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAM,aAAW,cAAe,CAC/C,IAAME,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,GACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS,aAAW,yBAA0B,CAChD,IAAMC,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS,aAAW,wBAAyB,CAC/C,IAAME,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS,aAAW,eAAgB,CAStC,IAAMO,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAM,aAAW,WAChC,OAEF,IAAMS,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAe,aAAW,oBAE1B3B,EACA,cAAc,IACKD,GAKnB4B,IAAe,aAAW,0BAE1B3B,EACA,cAAc,IACGD,GAKjB4B,IAAe,aAAW,mBAK5BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,iBAC1BA,IAAe,aAAW,cAKxBA,IAAe,aAAW,WAK5BA,IAAe,aAAW,eAC1BA,IAAe,aAAW,UAE1B,MAEJ,CAEA,GAAIxC,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAI,UAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWuC,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,GAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,GAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,GAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CLnhBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAMF,IAAMC,EAAiBC,EAAsBV,CAAK,EAE9CW,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBZ,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAMF,OALe,MAAMS,EAAa,CAChC,cAAeH,EAAQ,OACvB,eAAAF,EACA,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeU,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACV,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["src_exports","__export","SandboxError","runInSandbox","__toCommonJS","import_node_module","import_node_url","import_esbuild","import_meta","resolveDirectivePackageToFileUrl","specifier","resolved","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","import_node_fs","import_node_os","import_node_path","import_node_url","import_node_worker_threads","import_meta","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","staticUrl","path","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getTempBundleDir","osTmp","workerPath","writeBundleToTemp","bundledSource","baseDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","findMatchingClose","source","openBrace","depth","i","ch","collectTopLevelKeys","block","keys","segStart","braceDepth","parenDepth","bracketDepth","flushSegment","end","seg","m","j","extractTopLevelKeys","sectionName","headerRe","headerMatch","closeBrace","extractDerivationKeys","files","seen","out","file","k","SandboxError","message","code","import_ts_morph","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","derivationKeys","extractDerivationKeys","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}

package/dist/index.js CHANGED Viewed

@@ -1,6 +1,6 @@
-import{createRequire as L}from"module";import{pathToFileURL as W}from"url";import{build as K}from"esbuild";function C(e){try{let s=L(import.meta.url).resolve(e);return W(s).href}catch{return null}}var b="src/main.ts",x="directive-sandbox-vfs",h=class extends Error{constructor(s,t){super(s);this.cause=t;this.name="BundleError"}};function B(e){let r=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,s=e.match(r);if(!s)return e;let t=s[1],n=`
-(globalThis).__directiveSandbox_system__ = ${s[2]};
-`;return e.replace(t,t+n)}async function E(e){if(!e.find(t=>t.path===b))throw new h(`payload must include "${b}" \u2014 that's the entry point the runner targets`);let s=new Map;for(let t of e)s.set(t.path,t.source);try{let i=(await K({entryPoints:[`${x}:${b}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(c){c.onResolve({filter:/.*/},o=>{if(o.kind==="entry-point")return{path:o.path.replace(`${x}:`,""),namespace:x};if(o.namespace!==x)return null;if(o.path.startsWith("@directive-run/")){let a=C(o.path);return a?{external:!0,path:a}:{external:!0,path:o.path}}if(o.path.startsWith("./")||o.path.startsWith("../")){let a=o.importer.replace(/\/[^/]+$/,""),u=o.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${a}/${u}.ts`,`${a}/${u}.js`,`${a}/${u}`,`${u}.ts`,`${u}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of g)if(s.has(m))return{path:m,namespace:x};throw new h(`cannot resolve "${o.path}" from "${o.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${o.path}" from "${o.importer}" \u2014 only relative or @directive-run/* allowed`)}),c.onLoad({filter:/.*/,namespace:x},o=>{let a=s.get(o.path);if(a===void 0)throw new h(`virtual file missing: ${o.path}`);if(o.path===b){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {","  (globalThis).__directiveSandbox_system__ = system;","}"].join(`
-`);return{contents:a+u,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!i)throw new h("esbuild produced no output");let n=B(i);return{source:n,bytes:Buffer.byteLength(n,"utf8")}}catch(t){throw t instanceof h?t:new h(`bundle failed: ${t.message??String(t)}`,t)}}import{existsSync as V,mkdtempSync as q,rmSync as U,writeFileSync as G}from"fs";import{tmpdir as H}from"os";import{dirname as P,join as T}from"path";import{pathToFileURL as X}from"url";import{Worker as z}from"worker_threads";var Y=100,J=1e4,I=5e3;async function M(){let{createRequire:e}=await import("module");return e(import.meta.url).resolve("@directive-run/sandbox/worker")}var y=class extends Error{constructor(s,t){super(s);this.code=t;this.name="WorkerExecError"}};function Q(e){let r=e??I;return Number.isFinite(r)?Math.min(J,Math.max(Y,Math.floor(r))):I}async function Z(){let e=H();if(V(e))return e;let r=await M();return P(P(r))}async function ee(e){let r=await Z(),s=q(T(r,"directive-sandbox-")),t=T(s,"bundle.mjs");return G(t,e,"utf8"),{bundlePath:t,cleanup:()=>{try{U(s,{recursive:!0,force:!0})}catch{}}}}async function k(e){let r=Q(e.timeoutMs),s=await M(),{bundlePath:t,cleanup:i}=await ee(e.bundledSource),n=new z(s,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),c=null,o=!1,a=Date.now();try{return await new Promise((g,m)=>{let p=!1;n.once("message",d=>{p=!0,d.ok?g(d.result):m(new y(d.error,"worker-error"))}),n.once("error",d=>{p=!0,m(new y(d.message,"worker-error"))}),n.once("exit",d=>{!p&&d!==0&&d!==null&&m(new y(`worker exited with code ${d} before responding`,"worker-error"))}),c=setTimeout(()=>{o=!0,n.terminate(),m(new y(`wall-clock budget of ${r}ms elapsed`,"timeout"))},r);let w={bundlePath:X(t).href,timeoutMs:r,derivationKeys:e.derivationKeys};n.postMessage(w)})}catch(u){if(u instanceof y&&u.code==="timeout")return{logs:[],facts:{},derived:{},errors:[u.message],durationMs:Date.now()-a,timedOut:!0};throw u}finally{c&&clearTimeout(c),await n.terminate().catch(()=>{}),i()}}function te(e,r){let s=0;for(let t=r;t<e.length;t++){let i=e[t];if(i==="{")s+=1;else if(i==="}"&&(s-=1,s===0))return t}return-1}function re(e){let r=[],s=0,t=0,i=0,n=0,c=o=>{let a=e.slice(s,o).trim();if(s=o+1,!a)return;let u=a.match(/^['"]?(\w+)['"]?\s*:/);u&&r.push(u[1])};for(let o=0;o<e.length;o++){let a=e[o];a==="{"?t+=1:a==="}"?t-=1:a==="("?i+=1:a===")"?i-=1:a==="["?n+=1:a==="]"?n-=1:(a===","||a===`
-`)&&t===0&&i===0&&n===0&&c(o)}return c(e.length),r}function $(e,r){let s=new RegExp(`\\b${r}\\s*:\\s*\\{`),t=e.match(s);if(!t||t.index===void 0)return[];let i=e.indexOf("{",t.index);if(i===-1)return[];let n=te(e,i);return n===-1?[]:re(e.slice(i+1,n))}function A(e){let r=new Set,s=[];for(let t of e){for(let i of $(t.source,"derive"))r.has(i)||(r.add(i),s.push(i));for(let i of $(t.source,"derivations"))r.has(i)||(r.add(i),s.push(i))}return s}var f=class extends Error{constructor(s,t){super(s);this.code=t;this.name="SandboxError"}};import{Project as ne,SyntaxKind as l}from"ts-morph";var F=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),N=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function R(e){let r=e.match(/^@directive-run\/([^/]+)/);return r?r[1]:null}function oe(e){if(/^\.{1,2}\/.+\.js$/.test(e))return!0;let r=R(e);return r===null||N.has(r)?!1:F.has(r)}var D=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),v=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function se(e){let r=R(e);return r&&N.has(r)?`import "${e}" is denied \u2014 @directive-run/${r} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${e}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(F).sort().join(",")}}.`}function ie(e,r,s){let t=r.getSourceFileOrThrow(e);for(let i of t.getImportDeclarations()){let n=i.getModuleSpecifierValue();if(!oe(n)){let{line:c,column:o}=t.getLineAndColumnAtPos(i.getStart());s.push({path:e,line:c,column:o,message:se(n)})}}}function ae(e,r,s){let t=r.getSourceFileOrThrow(e);t.forEachDescendant(i=>{if(i.getKind()===l.ImportKeyword){let n=i.getParent();if(n&&n.getKind()===l.CallExpression){let{line:c,column:o}=t.getLineAndColumnAtPos(i.getStart());s.push({path:e,line:c,column:o,message:"dynamic import() is not allowed in the sandbox"})}}if(i.getKind()===l.NewExpression){let n=i.getText();if(/^new\s+Function\s*\(/.test(n)){let{line:c,column:o}=t.getLineAndColumnAtPos(i.getStart());s.push({path:e,line:c,column:o,message:"new Function(...) is not allowed in the sandbox"})}}})}function ce(e,r,s){let t=r.getSourceFileOrThrow(e),i=(c,o)=>{let{line:a,column:u}=t.getLineAndColumnAtPos(c.getStart());s.push({path:e,line:a,column:u,message:o})},n=c=>{let o=c.trim();return o.startsWith('"')&&o.endsWith('"')||o.startsWith("'")&&o.endsWith("'")||o.startsWith("`")&&o.endsWith("`")?o.slice(1,-1):null};t.forEachDescendant(c=>{let o=c.getKind();if(o===l.PropertyAccessExpression){let a=c.getName?.();if(!a)return;if(a==="constructor"){i(c,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(v.has(a)){i(c,`\`.${a}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(o===l.ElementAccessExpression){let a=c.getExpression?.(),u=c.getArgumentExpression?.(),g=a?.getText()??"",m=u?.getText()??"",p=n(m);if(g==="globalThis"&&p!==null){i(c,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(p!==null&&(p==="constructor"||v.has(p))){i(c,`bracket-access \`["${p}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(o===l.CallExpression){let u=c.getExpression?.()?.getText()??"";if(u==="Function"){i(c,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let p=c.getArguments?.()??[];if(p.length>=2){let w=p[0].getText(),d=n(p[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(w==="globalThis"||D.has(w))&&d!==null&&(d==="constructor"||v.has(d))&&i(c,`\`${g[1]}.${g[2]}(${w}, "${d}")\` would reach a denied name`)}}}})}function ue(e,r,s){let t=r.getSourceFileOrThrow(e),i=new Set;for(let n of t.getImportDeclarations()){for(let a of n.getNamedImports())i.add(a.getName());let c=n.getDefaultImport();c&&i.add(c.getText());let o=n.getNamespaceImport();o&&i.add(o.getText())}for(let n of t.getVariableDeclarations())i.add(n.getName());for(let n of t.getFunctions()){let c=n.getName();c&&i.add(c)}for(let n of t.getClasses()){let c=n.getName();c&&i.add(c)}t.forEachDescendant(n=>{if(n.getKind()!==l.Identifier)return;let c=n.getText();if(i.has(c)||D.has(c))return;let o=n.getParent();if(o){let a=o.getKind();if(a===l.PropertyAssignment&&o.getNameNode?.()===n||a===l.PropertyAccessExpression&&o.getNameNode?.()===n||a===l.MethodDeclaration||a===l.ImportSpecifier||a===l.ExportSpecifier||a===l.NamespaceImport||a===l.ImportClause||a===l.Parameter||a===l.TypeReference||a===l.TypeQuery)return}if(v.has(c)){let{line:a,column:u}=t.getLineAndColumnAtPos(n.getStart());s.push({path:e,line:a,column:u,message:`identifier "${c}" is denied in the sandbox (FS/network/eval surface)`})}})}function _(e){let r=[],s=new ne({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let t of e)s.createSourceFile(t.path,t.source,{overwrite:!0});for(let t of e)ie(t.path,s,r),ae(t.path,s,r),ce(t.path,s,r),ue(t.path,s,r);return r}var O=2e5,j=10,S="src/main.ts";function le(e){if(e.files&&e.source)throw new f("pass either `source` or `files`, not both","input-invalid");if(!e.files&&!e.source)throw new f("must pass either `source` or `files`","input-invalid");let r=e.files?e.files:[{path:S,source:e.source??""}];if(r.length===0)throw new f("files array is empty","input-invalid");if(r.length>j)throw new f(`payload exceeds ${j} files`,"input-invalid");let s=0;for(let t of r){if(typeof t.path!="string"||t.path.length===0)throw new f("every file must have a non-empty path","input-invalid");if(typeof t.source!="string"||t.source.length===0)throw new f(`file "${t.path}" has empty source`,"input-invalid");s+=Buffer.byteLength(t.source,"utf8")}if(s>O)throw new f(`total payload is ${s} bytes (max ${O})`,"input-invalid");if(!r.some(t=>t.path===S))throw new f(`payload must include "${S}" \u2014 the runner entry point`,"input-invalid");return r}async function Fe(e){let r;try{r=le(e)}catch(n){if(n instanceof f)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let s=_(r);if(s.length>0)return{logs:[],facts:{},derived:{},errors:s.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let t=A(r),i;try{i=await E(r)}catch(n){if(n instanceof h)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await k({bundledSource:i.source,derivationKeys:t,timeoutMs:e.timeoutMs})}catch(n){if(n instanceof y)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}export{f as SandboxError,Fe as runInSandbox};
+import{createRequire as W}from"module";import{pathToFileURL as K}from"url";import{build as C}from"esbuild";function B(t){try{let o=W(import.meta.url).resolve(t);return K(o).href}catch{return null}}var b="src/main.ts",x="directive-sandbox-vfs",h=class extends Error{constructor(o,e){super(o);this.cause=e;this.name="BundleError"}};function V(t){let r=/(var\s+(system\d*)\s*=\s*createSystem\s*\([\s\S]*?\)\s*;)/,o=t.match(r);if(!o)return t;let e=o[1],n=`
+(globalThis).__directiveSandbox_system__ = ${o[2]};
+`;return t.replace(e,e+n)}async function E(t){if(!t.find(e=>e.path===b))throw new h(`payload must include "${b}" \u2014 that's the entry point the runner targets`);let o=new Map;for(let e of t)o.set(e.path,e.source);try{let i=(await C({entryPoints:[`${x}:${b}`],bundle:!0,format:"esm",target:"node20",platform:"node",write:!1,logLevel:"silent",external:["@directive-run/*"],supported:{"top-level-await":!0},plugins:[{name:"directive-sandbox-vfs",setup(c){c.onResolve({filter:/.*/},s=>{if(s.kind==="entry-point")return{path:s.path.replace(`${x}:`,""),namespace:x};if(s.namespace!==x)return null;if(s.path.startsWith("@directive-run/")){let a=B(s.path);return a?{external:!0,path:a}:{external:!0,path:s.path}}if(s.path.startsWith("./")||s.path.startsWith("../")){let a=s.importer.replace(/\/[^/]+$/,""),u=s.path.replace(/^\.\//,"").replace(/\.js$/,""),g=[`${a}/${u}.ts`,`${a}/${u}.js`,`${a}/${u}`,`${u}.ts`,`${u}.js`].map(m=>m.replace(/\/+/g,"/"));for(let m of g)if(o.has(m))return{path:m,namespace:x};throw new h(`cannot resolve "${s.path}" from "${s.importer}" \u2014 tried ${g.join(", ")}`)}throw new h(`unexpected import "${s.path}" from "${s.importer}" \u2014 only relative or @directive-run/* allowed`)}),c.onLoad({filter:/.*/,namespace:x},s=>{let a=o.get(s.path);if(a===void 0)throw new h(`virtual file missing: ${s.path}`);if(s.path===b){let u=["","// directive-sandbox: lift the runner's `system` binding","// onto a side-channel global so the worker can read","// system.facts.$store.toObject() after execution.","if (typeof system !== 'undefined') {","  (globalThis).__directiveSandbox_system__ = system;","}"].join(`
+`);return{contents:a+u,loader:"ts"}}return{contents:a,loader:"ts"}})}}]})).outputFiles[0]?.text;if(!i)throw new h("esbuild produced no output");let n=V(i);return{source:n,bytes:Buffer.byteLength(n,"utf8")}}catch(e){throw e instanceof h?e:new h(`bundle failed: ${e.message??String(e)}`,e)}}import{existsSync as M,mkdtempSync as U,rmSync as q,writeFileSync as G}from"fs";import{tmpdir as H}from"os";import{dirname as P,join as T}from"path";import{fileURLToPath as X,pathToFileURL as z}from"url";import{Worker as Y}from"worker_threads";var J=100,Q=1e4,I=5e3;async function k(){try{let o=new URL("./worker.js",import.meta.url),e=X(o);if(M(e))return e}catch{}let{createRequire:t}=await import("module");return t(import.meta.url).resolve("@directive-run/sandbox/worker")}var y=class extends Error{constructor(o,e){super(o);this.code=e;this.name="WorkerExecError"}};function Z(t){let r=t??I;return Number.isFinite(r)?Math.min(Q,Math.max(J,Math.floor(r))):I}async function ee(){let t=H();if(M(t))return t;let r=await k();return P(P(r))}async function te(t){let r=await ee(),o=U(T(r,"directive-sandbox-")),e=T(o,"bundle.mjs");return G(e,t,"utf8"),{bundlePath:e,cleanup:()=>{try{q(o,{recursive:!0,force:!0})}catch{}}}}async function $(t){let r=Z(t.timeoutMs),o=await k(),{bundlePath:e,cleanup:i}=await te(t.bundledSource),n=new Y(o,{resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,codeRangeSizeMb:16},stderr:!1}),c=null,s=!1,a=Date.now();try{return await new Promise((g,m)=>{let p=!1;n.once("message",d=>{p=!0,d.ok?g(d.result):m(new y(d.error,"worker-error"))}),n.once("error",d=>{p=!0,m(new y(d.message,"worker-error"))}),n.once("exit",d=>{!p&&d!==0&&d!==null&&m(new y(`worker exited with code ${d} before responding`,"worker-error"))}),c=setTimeout(()=>{s=!0,n.terminate(),m(new y(`wall-clock budget of ${r}ms elapsed`,"timeout"))},r);let w={bundlePath:z(e).href,timeoutMs:r,derivationKeys:t.derivationKeys};n.postMessage(w)})}catch(u){if(u instanceof y&&u.code==="timeout")return{logs:[],facts:{},derived:{},errors:[u.message],durationMs:Date.now()-a,timedOut:!0};throw u}finally{c&&clearTimeout(c),await n.terminate().catch(()=>{}),i()}}function re(t,r){let o=0;for(let e=r;e<t.length;e++){let i=t[e];if(i==="{")o+=1;else if(i==="}"&&(o-=1,o===0))return e}return-1}function ne(t){let r=[],o=0,e=0,i=0,n=0,c=s=>{let a=t.slice(o,s).trim();if(o=s+1,!a)return;let u=a.match(/^['"]?(\w+)['"]?\s*:/);u&&r.push(u[1])};for(let s=0;s<t.length;s++){let a=t[s];a==="{"?e+=1:a==="}"?e-=1:a==="("?i+=1:a===")"?i-=1:a==="["?n+=1:a==="]"?n-=1:(a===","||a===`
+`)&&e===0&&i===0&&n===0&&c(s)}return c(t.length),r}function A(t,r){let o=new RegExp(`\\b${r}\\s*:\\s*\\{`),e=t.match(o);if(!e||e.index===void 0)return[];let i=t.indexOf("{",e.index);if(i===-1)return[];let n=re(t,i);return n===-1?[]:ne(t.slice(i+1,n))}function F(t){let r=new Set,o=[];for(let e of t){for(let i of A(e.source,"derive"))r.has(i)||(r.add(i),o.push(i));for(let i of A(e.source,"derivations"))r.has(i)||(r.add(i),o.push(i))}return o}var f=class extends Error{constructor(o,e){super(o);this.code=e;this.name="SandboxError"}};import{Project as oe,SyntaxKind as l}from"ts-morph";var R=new Set(["core","ai","query","el","react","vue","svelte","solid","lit","optimistic","timeline","mutator","knowledge","scaffold","claude-plugin","lint"]),N=new Set(["cli","mcp","sandbox","vite-plugin-api-proxy"]);function D(t){let r=t.match(/^@directive-run\/([^/]+)/);return r?r[1]:null}function se(t){if(/^\.{1,2}\/.+\.js$/.test(t))return!0;let r=D(t);return r===null||N.has(r)?!1:R.has(r)}var _=new Set(["createSystem","system","console","Math","JSON","Object","Array","Number","String","Boolean","Symbol","Promise","Error","Date","Map","Set","WeakMap","WeakSet","Reflect","globalThis","undefined","null","NaN","Infinity"]),v=new Set(["process","require","module","__dirname","__filename","fetch","XMLHttpRequest","WebSocket","eval","Function","Buffer","setImmediate","queueMicrotask","setTimeout","setInterval","clearTimeout","clearInterval"]);function ie(t){let r=D(t);return r&&N.has(r)?`import "${t}" is denied \u2014 @directive-run/${r} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`:`import "${t}" is not allowed in the sandbox. Allowed: relative "./X.js" paths or any of @directive-run/{${Array.from(R).sort().join(",")}}.`}function ae(t,r,o){let e=r.getSourceFileOrThrow(t);for(let i of e.getImportDeclarations()){let n=i.getModuleSpecifierValue();if(!se(n)){let{line:c,column:s}=e.getLineAndColumnAtPos(i.getStart());o.push({path:t,line:c,column:s,message:ie(n)})}}}function ce(t,r,o){let e=r.getSourceFileOrThrow(t);e.forEachDescendant(i=>{if(i.getKind()===l.ImportKeyword){let n=i.getParent();if(n&&n.getKind()===l.CallExpression){let{line:c,column:s}=e.getLineAndColumnAtPos(i.getStart());o.push({path:t,line:c,column:s,message:"dynamic import() is not allowed in the sandbox"})}}if(i.getKind()===l.NewExpression){let n=i.getText();if(/^new\s+Function\s*\(/.test(n)){let{line:c,column:s}=e.getLineAndColumnAtPos(i.getStart());o.push({path:t,line:c,column:s,message:"new Function(...) is not allowed in the sandbox"})}}})}function ue(t,r,o){let e=r.getSourceFileOrThrow(t),i=(c,s)=>{let{line:a,column:u}=e.getLineAndColumnAtPos(c.getStart());o.push({path:t,line:a,column:u,message:s})},n=c=>{let s=c.trim();return s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'")||s.startsWith("`")&&s.endsWith("`")?s.slice(1,-1):null};e.forEachDescendant(c=>{let s=c.getKind();if(s===l.PropertyAccessExpression){let a=c.getName?.();if(!a)return;if(a==="constructor"){i(c,"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)");return}if(v.has(a)){i(c,`\`.${a}\` access is denied in the sandbox (FS/network/eval surface) \u2014 accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`);return}}if(s===l.ElementAccessExpression){let a=c.getExpression?.(),u=c.getArgumentExpression?.(),g=a?.getText()??"",m=u?.getText()??"",p=n(m);if(g==="globalThis"&&p!==null){i(c,"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)");return}if(p!==null&&(p==="constructor"||v.has(p))){i(c,`bracket-access \`["${p}"]\` is denied in the sandbox (would reach a denied name)`);return}}if(s===l.CallExpression){let u=c.getExpression?.()?.getText()??"";if(u==="Function"){i(c,"`Function(...)` call is denied in the sandbox");return}let g=u.match(/^(Reflect|Object)\.(\w+)$/);if(g){let p=c.getArguments?.()??[];if(p.length>=2){let w=p[0].getText(),d=n(p[1].getText());new Set(["get","has","getOwnPropertyDescriptor","getOwnPropertyDescriptors","ownKeys","getPrototypeOf"]).has(g[2])&&(w==="globalThis"||_.has(w))&&d!==null&&(d==="constructor"||v.has(d))&&i(c,`\`${g[1]}.${g[2]}(${w}, "${d}")\` would reach a denied name`)}}}})}function le(t,r,o){let e=r.getSourceFileOrThrow(t),i=new Set;for(let n of e.getImportDeclarations()){for(let a of n.getNamedImports())i.add(a.getName());let c=n.getDefaultImport();c&&i.add(c.getText());let s=n.getNamespaceImport();s&&i.add(s.getText())}for(let n of e.getVariableDeclarations())i.add(n.getName());for(let n of e.getFunctions()){let c=n.getName();c&&i.add(c)}for(let n of e.getClasses()){let c=n.getName();c&&i.add(c)}e.forEachDescendant(n=>{if(n.getKind()!==l.Identifier)return;let c=n.getText();if(i.has(c)||_.has(c))return;let s=n.getParent();if(s){let a=s.getKind();if(a===l.PropertyAssignment&&s.getNameNode?.()===n||a===l.PropertyAccessExpression&&s.getNameNode?.()===n||a===l.MethodDeclaration||a===l.ImportSpecifier||a===l.ExportSpecifier||a===l.NamespaceImport||a===l.ImportClause||a===l.Parameter||a===l.TypeReference||a===l.TypeQuery)return}if(v.has(c)){let{line:a,column:u}=e.getLineAndColumnAtPos(n.getStart());o.push({path:t,line:a,column:u,message:`identifier "${c}" is denied in the sandbox (FS/network/eval surface)`})}})}function O(t){let r=[],o=new oe({useInMemoryFileSystem:!0,compilerOptions:{target:99,module:99,allowJs:!0,strict:!1}});for(let e of t)o.createSourceFile(e.path,e.source,{overwrite:!0});for(let e of t)ae(e.path,o,r),ce(e.path,o,r),ue(e.path,o,r),le(e.path,o,r);return r}var L=2e5,j=10,S="src/main.ts";function de(t){if(t.files&&t.source)throw new f("pass either `source` or `files`, not both","input-invalid");if(!t.files&&!t.source)throw new f("must pass either `source` or `files`","input-invalid");let r=t.files?t.files:[{path:S,source:t.source??""}];if(r.length===0)throw new f("files array is empty","input-invalid");if(r.length>j)throw new f(`payload exceeds ${j} files`,"input-invalid");let o=0;for(let e of r){if(typeof e.path!="string"||e.path.length===0)throw new f("every file must have a non-empty path","input-invalid");if(typeof e.source!="string"||e.source.length===0)throw new f(`file "${e.path}" has empty source`,"input-invalid");o+=Buffer.byteLength(e.source,"utf8")}if(o>L)throw new f(`total payload is ${o} bytes (max ${L})`,"input-invalid");if(!r.some(e=>e.path===S))throw new f(`payload must include "${S}" \u2014 the runner entry point`,"input-invalid");return r}async function Re(t){let r;try{r=de(t)}catch(n){if(n instanceof f)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}let o=O(r);if(o.length>0)return{logs:[],facts:{},derived:{},errors:o.map(n=>`${n.path}:${n.line}:${n.column} \u2014 ${n.message}`),durationMs:0,timedOut:!1};let e=F(r),i;try{i=await E(r)}catch(n){if(n instanceof h)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:!1};throw n}try{return await $({bundledSource:i.source,derivationKeys:e,timeoutMs:t.timeoutMs})}catch(n){if(n instanceof y)return{logs:[],facts:{},derived:{},errors:[n.message],durationMs:0,timedOut:n.code==="timeout"};throw n}}export{f as SandboxError,Re as runInSandbox};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/bundler.ts","../src/host.ts","../src/key-extractor.ts","../src/types.ts","../src/validator.ts","../src/index.ts"],"sourcesContent":["/*\n esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n \n `@directive-run/` packages are marked external* — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n \n The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n /\n\nimport { createRequire } from \"node:module\";\nimport { pathToFileURL } from \"node:url\";\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Resolve a `@directive-run/` bare specifier to an absolute file://\n URL using the host process's node_modules. Required because the\n * worker imports the bundle from `/tmp` (Phase A P0-A1) where Node's\n * ESM resolver can't walk up to find `@directive-run/`. By rewriting\n to absolute file URLs at bundle time, the worker doesn't need a\n * node_modules anchor.\n \n Returns null when the package can't be resolved (e.g. consumer has\n * a different install layout); the caller falls back to leaving the\n * bare specifier in place, which works when the worker IS next to\n * node_modules.\n /\nfunction resolveDirectivePackageToFileUrl(specifier: string): string \| null {\n try {\n const require = createRequire(import.meta.url);\n const resolved = require.resolve(specifier);\n return pathToFileURL(resolved).href;\n } catch {\n return null;\n }\n}\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /* Single ESM string ready to evaluate inside the worker. /\n source: string;\n /* Total bytes of the bundled JS (informational). /\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/\n Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n \n esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n \n var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n \n The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n /\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d)\\s=\\screateSystem\\s\$[\\s\\S]?\$\\s;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // The plugin's onResolve below intercepts every `@directive-run/`\n // import and rewrites it to an absolute file:// URL (so the\n // worker can import the bundle from /tmp without needing\n // node_modules above it). The wildcard external is the safety\n // net for any specifier the plugin doesn't recognize.\n external: [\"@directive-run/\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /./ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // Phase A audit P0-A1: rewrite to absolute file:// URL\n // so the worker's `/tmp/.../bundle.mjs` can import the\n // package without needing node_modules above /tmp.\n // Falls back to the bare specifier when resolution\n // fails — the legacy \"write next to node_modules\"\n // pattern still works as a backup.\n const resolved = resolveDirectivePackageToFileUrl(args.path);\n if (resolved) {\n return { external: true, path: resolved };\n }\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") \|\| args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /./, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/\n Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n \n Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n /\n\nimport { existsSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // Use createRequire instead of `import.meta.resolve` — Vitest's SSR\n // shim of import.meta exposes a `resolve` that isn't callable, and\n // `createRequire` works in both real Node ESM and Vitest dev mode.\n // The worker subpath export points at dist/worker.js; CJS resolution\n // picks up the \"default\" condition we set in package.json.\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n /* Derivation key names extracted from the payload's source files. /\n derivationKeys: string[];\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" \| \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number \| undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/\n Try `os.tmpdir()` first (Vercel-friendly: /tmp is the only writable\n * location on serverless functions). Fall back to the sandbox package\n * dir if /tmp ISN'T writable for some reason. The fallback inherits\n * the package's node_modules walking chain so bare specifiers like\n * `@directive-run/core` resolve naturally.\n /\nasync function getTempBundleDir(): Promise<string> {\n const osTmp = tmpdir();\n if (existsSync(osTmp)) {\n return osTmp;\n }\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/\n Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL.\n \n Phase A audit P0-A1: previous versions wrote inside the sandbox\n * package's own directory so Node's resolver could walk up to find\n * `@directive-run/core` in node_modules — but Vercel / AWS Lambda /\n * Cloud Run all ship read-only FS outside `/tmp`. The bundler now\n * rewrites `@directive-run/` imports to ABSOLUTE `file://` URLs of\n the host's resolved paths (see `bundleSandboxFiles`), so the temp\n * file can live in `/tmp` without needing a node_modules anchor.\n \n Caller MUST clean the directory up in a finally block.\n /\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const baseDir = await getTempBundleDir();\n const dir = mkdtempSync(join(baseDir, \"directive-sandbox-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout \| null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n derivationKeys: input.derivationKeys,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/\n Pure regex-based extractor for `derive:` / `derivations:` block keys\n * across a payload of source files. Mirrors the lightweight pattern the\n * docs site's DevTools panel uses for static-structure parsing.\n \n Phase A AE audit (P0-DM2): `system.derive` is a Proxy with no\n * `ownKeys` trap, so the worker can't enumerate derivations from inside\n * the sandbox. Instead, the host pre-scans source files for the\n * declared keys and forwards them to the worker, which then reads\n * `system.derive[key]` for each.\n \n Best-effort: a module that builds derivation keys dynamically (e.g.\n * `derive: Object.fromEntries(keys.map(k => [k, fn]))`) won't be\n * extracted. That's acceptable for the audit's stated goal of\n * \"transcript reflects what the module declared.\"\n /\n\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Find the matching `}` for the `{` at `openBrace`. Returns the index\n * of the close brace, or -1 if unbalanced.\n /\nfunction findMatchingClose(source: string, openBrace: number): number {\n let depth = 0;\n for (let i = openBrace; i < source.length; i++) {\n const ch = source[i];\n if (ch === \"{\") depth += 1;\n else if (ch === \"}\") {\n depth -= 1;\n if (depth === 0) return i;\n }\n }\n return -1;\n}\n\n/\n Pull top-level `key:` segments out of a brace-balanced block. Keys\n * are found between `,` or `\\n` or the block start at brace depth 0\n * AND paren depth 0. Works for both multi-line and compact `{ a: 1,\n * b: 2 }` forms.\n /\nfunction collectTopLevelKeys(block: string): string[] {\n const keys: string[] = [];\n let segStart = 0;\n let braceDepth = 0;\n let parenDepth = 0;\n let bracketDepth = 0;\n\n const flushSegment = (end: number) => {\n const seg = block.slice(segStart, end).trim();\n segStart = end + 1;\n if (!seg) return;\n // Tolerate leading quotes for `\"foo\":` quoted keys.\n const m = seg.match(/^['\"]?(\\w+)['\"]?\\s:/);\n if (m) keys.push(m[1]!);\n };\n\n for (let j = 0; j < block.length; j++) {\n const ch = block[j];\n if (ch === \"{\") braceDepth += 1;\n else if (ch === \"}\") braceDepth -= 1;\n else if (ch === \"(\") parenDepth += 1;\n else if (ch === \")\") parenDepth -= 1;\n else if (ch === \"[\") bracketDepth += 1;\n else if (ch === \"]\") bracketDepth -= 1;\n else if (\n (ch === \",\" \|\| ch === \"\\n\") &&\n braceDepth === 0 &&\n parenDepth === 0 &&\n bracketDepth === 0\n ) {\n flushSegment(j);\n }\n }\n // Final segment (no trailing comma/newline).\n flushSegment(block.length);\n return keys;\n}\n\nfunction extractTopLevelKeys(source: string, sectionName: string): string[] {\n const headerRe = new RegExp(`\\\\b${sectionName}\\\\s:\\\\s\\\\{`);\n const headerMatch = source.match(headerRe);\n if (!headerMatch \|\| headerMatch.index === undefined) {\n return [];\n }\n const openBrace = source.indexOf(\"{\", headerMatch.index);\n if (openBrace === -1) {\n return [];\n }\n const closeBrace = findMatchingClose(source, openBrace);\n if (closeBrace === -1) {\n return [];\n }\n return collectTopLevelKeys(source.slice(openBrace + 1, closeBrace));\n}\n\n/*\n Collect the union of derivation key names declared across all files\n * in the payload. Looks at both `derive:` (module config block) and\n * `derivations:` (schema block). De-duplicates.\n /\nexport function extractDerivationKeys(files: PlaygroundFile[]): string[] {\n const seen = new Set<string>();\n const out: string[] = [];\n for (const file of files) {\n for (const k of extractTopLevelKeys(file.source, \"derive\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n for (const k of extractTopLevelKeys(file.source, \"derivations\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n }\n return out;\n}\n","/\n Public types for `@directive-run/sandbox`.\n \n The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n /\n\nexport interface PlaygroundFile {\n /\n Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n /\n path: string;\n /* File contents. /\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /* Single-file shortcut. Mapped onto \"src/main.ts\" internally. /\n source?: string;\n /* Multi-file payload (the `generate_module` paired output shape). /\n files?: PlaygroundFile[];\n /* Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. /\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /\n Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n /\n logs: string[];\n /\n Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n /\n facts: Record<string, unknown>;\n /\n Final `system.derive` snapshot — every derivation declared in the\n * module config, evaluated by reading `system.derive[key]`. Empty\n * when the module has no `derive:` block or when validation rejected\n * before bundle. The Phase A AE audit (P0-DM2) flagged the original\n * sandbox for snapshotting only facts; modules whose primary product\n * is a derivation (`status`, `isReady`, etc.) returned an empty-\n * looking transcript.\n /\n derived: Record<string, unknown>;\n /\n Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n /\n errors: string[];\n /* Elapsed wall-clock duration of the worker execution. /\n durationMs: number;\n /* True when the wall-clock budget elapsed before settle()/destroy(). /\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n \| \"validation-failed\"\n \| \"bundle-failed\"\n \| \"worker-error\"\n \| \"timeout\"\n \| \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/\n Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n /\nexport interface WorkerInputMessage {\n /* `file://` URL of the temp .mjs bundle the host wrote. /\n bundlePath: string;\n timeoutMs: number;\n /\n Derivation key names the host extracted from the source files.\n * `system.derive` is a Proxy with no `ownKeys` trap, so we can't\n * enumerate from the worker; the host's pre-bundle pass scans the\n * source for `derive:` and `derivations:` blocks and forwards the\n * keys here. Worker reads `system.derive[key]` for each.\n /\n derivationKeys: string[];\n}\n\n/* Wire shape for messages from worker → host. /\nexport type WorkerOutputMessage =\n \| { ok: true; result: SandboxResult }\n \| { ok: false; error: string };\n","/\n AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n \n Allowlist:\n \n - Imports: must match `@directive-run/` (specifically `core`, `ai`,\n `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.`, `Math.`, `JSON.`. Anything that touches\n global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n \n Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n \n Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n /\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n \n Packages deliberately EXCLUDED:\n \n - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n \n The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n /\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/\n Extract the package name segment from a @directive-run/* specifier.\n \n \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n \n Returns null when the specifier doesn't match the scope.\n /\nfunction extractDirectivePackage(specifier: string): string \| null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/\n Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n /\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/\n Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n /\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/*\n The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n \n The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n \n Rules:\n \n 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n /\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string \| null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) \|\|\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) \|\|\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } \| undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" \|\| DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect\|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" \|\| ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" \|\|\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier \|\|\n parentKind === SyntaxKind.ExportSpecifier \|\|\n parentKind === SyntaxKind.NamespaceImport \|\|\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference \|\|\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n","/\n Public API for `@directive-run/sandbox`.\n \n Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n \n Consumers:\n \n - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { extractDerivationKeys } from \"./key-extractor.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" \|\| file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" \|\| file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n // Phase A audit P0-DM2: pre-extract derivation key names from the\n // source files so the worker can iterate them after settle. The\n // `system.derive` proxy has no `ownKeys` trap.\n const derivationKeys = extractDerivationKeys(files);\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n derivationKeys,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n"],"mappings":"AAgBA,OAAS,iBAAAA,MAAqB,SAC9B,OAAS,iBAAAC,MAAqB,MAC9B,OAAS,SAAAC,MAAa,UAgBtB,SAASC,EAAiCC,EAAkC,CAC1E,GAAI,CAEF,IAAMC,EADUL,EAAc,YAAY,GAAG,EACpB,QAAQI,CAAS,EAC1C,OAAOH,EAAcI,CAAQ,EAAE,IACjC,MAAQ,CACN,OAAO,IACT,CACF,CAEA,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,EAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CA0GF,IAAMC,GAzGS,MAAMpB,EAAM,CACzB,YAAa,CAAC,GAAGK,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAAG,CAO3C,IAAMnB,EAAWF,EAAiCqB,EAAK,IAAI,EAC3D,OAAInB,EACK,CAAE,SAAU,GAAM,KAAMA,CAAS,EAEnC,CAAE,SAAU,GAAM,KAAMmB,EAAK,IAAK,CAC3C,CACA,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,EAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CChOA,OAAS,cAAAC,EAAY,eAAAC,EAAa,UAAAC,EAAQ,iBAAAC,MAAqB,KAC/D,OAAS,UAAAC,MAAc,KACvB,OAAS,WAAAC,EAAS,QAAAC,MAAY,OAC9B,OAAS,iBAAAC,MAAqB,MAC9B,OAAS,UAAAC,MAAc,iBAOvB,IAAMC,EAAiB,IACjBC,EAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAMlD,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAc,YAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CASO,IAAMC,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,EAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAASP,EACrB,OAAK,OAAO,SAASQ,CAAG,EAGjB,KAAK,IAAIT,EAAgB,KAAK,IAAID,EAAgB,KAAK,MAAMU,CAAG,CAAC,CAAC,EAFhER,CAGX,CASA,eAAeS,GAAoC,CACjD,IAAMC,EAAQjB,EAAO,EACrB,GAAIJ,EAAWqB,CAAK,EAClB,OAAOA,EAIT,IAAMC,EAAa,MAAMV,EAAkB,EAE3C,OAAOP,EAAQA,EAAQiB,CAAU,CAAC,CACpC,CAgBA,eAAeC,GAAkBC,EAG9B,CACD,IAAMC,EAAU,MAAML,EAAiB,EACjCM,EAAMzB,EAAYK,EAAKmB,EAAS,oBAAoB,CAAC,EACrDE,EAAarB,EAAKoB,EAAK,YAAY,EACzC,OAAAvB,EAAcwB,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,CACFzB,EAAOwB,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYb,EAAaY,EAAM,SAAS,EACxCP,EAAa,MAAMV,EAAkB,EACrC,CAAE,WAAAe,EAAY,QAASI,CAAe,EAAI,MAAMR,GACpDM,EAAM,aACR,EACMG,EAAS,IAAIxB,EAAOc,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CAgDF,OA/Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAIvB,EAAgByB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAIvB,EAAgB0B,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAAShB,GAAS,CACxB,CAACsB,GAAWtB,IAAS,GAAKA,IAAS,MACrCqB,EACE,IAAIvB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDiB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAIvB,EACF,wBAAwBgB,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMf,EAA8B,CAClC,WAAYR,EAAcoB,CAAU,EAAE,KACtC,UAAAG,EACA,eAAgBD,EAAM,cACxB,EACAG,EAAO,YAAYjB,CAAO,CAC5B,CAAC,CAGH,OAASyB,EAAK,CACZ,GAAIA,aAAe1B,GAAmB0B,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC7LA,SAASU,GAAkBC,EAAgBC,EAA2B,CACpE,IAAIC,EAAQ,EACZ,QAASC,EAAIF,EAAWE,EAAIH,EAAO,OAAQG,IAAK,CAC9C,IAAMC,EAAKJ,EAAOG,CAAC,EACnB,GAAIC,IAAO,IAAKF,GAAS,UAChBE,IAAO,MACdF,GAAS,EACLA,IAAU,GAAG,OAAOC,CAE5B,CACA,MAAO,EACT,CAQA,SAASE,GAAoBC,EAAyB,CACpD,IAAMC,EAAiB,CAAC,EACpBC,EAAW,EACXC,EAAa,EACbC,EAAa,EACbC,EAAe,EAEbC,EAAgBC,GAAgB,CACpC,IAAMC,EAAMR,EAAM,MAAME,EAAUK,CAAG,EAAE,KAAK,EAE5C,GADAL,EAAWK,EAAM,EACb,CAACC,EAAK,OAEV,IAAMC,EAAID,EAAI,MAAM,sBAAsB,EACtCC,GAAGR,EAAK,KAAKQ,EAAE,CAAC,CAAE,CACxB,EAEA,QAASC,EAAI,EAAGA,EAAIV,EAAM,OAAQU,IAAK,CACrC,IAAMZ,EAAKE,EAAMU,CAAC,EACdZ,IAAO,IAAKK,GAAc,EACrBL,IAAO,IAAKK,GAAc,EAC1BL,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKO,GAAgB,EAC5BP,IAAO,IAAKO,GAAgB,GAElCP,IAAO,KAAOA,IAAO;AAAA,IACtBK,IAAe,GACfC,IAAe,GACfC,IAAiB,GAEjBC,EAAaI,CAAC,CAElB,CAEA,OAAAJ,EAAaN,EAAM,MAAM,EAClBC,CACT,CAEA,SAASU,EAAoBjB,EAAgBkB,EAA+B,CAC1E,IAAMC,EAAW,IAAI,OAAO,MAAMD,CAAW,cAAc,EACrDE,EAAcpB,EAAO,MAAMmB,CAAQ,EACzC,GAAI,CAACC,GAAeA,EAAY,QAAU,OACxC,MAAO,CAAC,EAEV,IAAMnB,EAAYD,EAAO,QAAQ,IAAKoB,EAAY,KAAK,EACvD,GAAInB,IAAc,GAChB,MAAO,CAAC,EAEV,IAAMoB,EAAatB,GAAkBC,EAAQC,CAAS,EACtD,OAAIoB,IAAe,GACV,CAAC,EAEHhB,GAAoBL,EAAO,MAAMC,EAAY,EAAGoB,CAAU,CAAC,CACpE,CAOO,SAASC,EAAsBC,EAAmC,CACvE,IAAMC,EAAO,IAAI,IACXC,EAAgB,CAAC,EACvB,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAKV,EAAoBS,EAAK,OAAQ,QAAQ,EAClDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,GAGd,QAAWA,KAAKV,EAAoBS,EAAK,OAAQ,aAAa,EACvDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,EAGhB,CACA,OAAOF,CACT,CClDO,IAAMG,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,ECrDA,OAAS,WAAAC,GAAS,cAAAC,MAAkB,WAuBpC,IAAMC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,GAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,GAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,GAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,GACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMsB,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAMtB,EAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAkB,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMuB,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,GACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS7B,EAAW,yBAA0B,CAChD,IAAM8B,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS7B,EAAW,wBAAyB,CAC/C,IAAM+B,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS7B,EAAW,eAAgB,CAStC,IAAMoC,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,WAChC,OAEF,IAAM8B,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAejD,EAAW,oBAE1BsB,EACA,cAAc,IACKD,GAKnB4B,IAAejD,EAAW,0BAE1BsB,EACA,cAAc,IACGD,GAKjB4B,IAAejD,EAAW,mBAK5BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,cAKxBiD,IAAejD,EAAW,WAK5BiD,IAAejD,EAAW,eAC1BiD,IAAejD,EAAW,UAE1B,MAEJ,CAEA,GAAIS,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAId,GAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWqD,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,GAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,GAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,GAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CCnhBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAMF,IAAMC,EAAiBC,EAAsBV,CAAK,EAE9CW,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBZ,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAMF,OALe,MAAMS,EAAa,CAChC,cAAeH,EAAQ,OACvB,eAAAF,EACA,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeU,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACV,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["createRequire","pathToFileURL","build","resolveDirectivePackageToFileUrl","specifier","resolved","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","existsSync","mkdtempSync","rmSync","writeFileSync","tmpdir","dirname","join","pathToFileURL","Worker","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getTempBundleDir","osTmp","workerPath","writeBundleToTemp","bundledSource","baseDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","findMatchingClose","source","openBrace","depth","i","ch","collectTopLevelKeys","block","keys","segStart","braceDepth","parenDepth","bracketDepth","flushSegment","end","seg","m","j","extractTopLevelKeys","sectionName","headerRe","headerMatch","closeBrace","extractDerivationKeys","files","seen","out","file","k","SandboxError","message","code","Project","SyntaxKind","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","derivationKeys","extractDerivationKeys","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}
1	+ {"version":3,"sources":["../src/bundler.ts","../src/host.ts","../src/key-extractor.ts","../src/types.ts","../src/validator.ts","../src/index.ts"],"sourcesContent":["/*\n esbuild adapter for the sandbox. Takes the user's multi-file payload\n * and produces a single ESM string the worker can evaluate.\n \n `@directive-run/` packages are marked external* — the worker\n * imports them at runtime via Node's normal ESM resolver, which finds\n * them in `node_modules`. We don't inline them because (a) bundle size\n * would explode, (b) they're already cached in the parent process so\n * the runtime resolver is fast.\n \n The bundler uses the in-memory plugin pattern: every file in the\n * payload is registered as a virtual entry, and relative imports\n * resolve against the in-memory map. esbuild handles TS → JS, top-\n * level await, and ESM linking in one pass.\n /\n\nimport { createRequire } from \"node:module\";\nimport { pathToFileURL } from \"node:url\";\nimport { build } from \"esbuild\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Resolve a `@directive-run/` bare specifier to an absolute file://\n URL using the host process's node_modules. Required because the\n * worker imports the bundle from `/tmp` (Phase A P0-A1) where Node's\n * ESM resolver can't walk up to find `@directive-run/`. By rewriting\n to absolute file URLs at bundle time, the worker doesn't need a\n * node_modules anchor.\n \n Returns null when the package can't be resolved (e.g. consumer has\n * a different install layout); the caller falls back to leaving the\n * bare specifier in place, which works when the worker IS next to\n * node_modules.\n /\nfunction resolveDirectivePackageToFileUrl(specifier: string): string \| null {\n try {\n const require = createRequire(import.meta.url);\n const resolved = require.resolve(specifier);\n return pathToFileURL(resolved).href;\n } catch {\n return null;\n }\n}\n\nconst ENTRY_PATH = \"src/main.ts\";\nconst VIRTUAL_NAMESPACE = \"directive-sandbox-vfs\";\n\nexport interface BundleResult {\n /* Single ESM string ready to evaluate inside the worker. /\n source: string;\n /* Total bytes of the bundled JS (informational). /\n bytes: number;\n}\n\nexport class BundleError extends Error {\n constructor(\n message: string,\n public readonly cause?: unknown,\n ) {\n super(message);\n this.name = \"BundleError\";\n }\n}\n\n/\n Find the `var system = createSystem(...)` declaration esbuild\n * emits for the runner and inject a side-channel global assignment\n * immediately after it. Captures the system BEFORE any subsequent\n * `system.start()`, dispatches, or `await system.settle()` can\n * throw — so the worker can post-mortem facts even on a runtime\n * error inside the user's runner.\n \n esbuild's output uses `var` for hoisted top-level bindings, and\n * the entry's `const system = createSystem(...)` becomes one of:\n \n var system = createSystem({ ... });\n * var system2 = createSystem({ ... }); // when \"system\" collides\n \n The regex tolerates both. If no match, returns the source\n * unchanged (the entry-file epilogue still handles the clean-run\n * case via the appended assignment).\n /\nfunction injectEarlyCapture(bundled: string): string {\n const re = /(var\\s+(system\\d)\\s=\\screateSystem\\s\$[\\s\\S]?\$\\s;)/;\n const match = bundled.match(re);\n if (!match) {\n return bundled;\n }\n const decl = match[1]!;\n const localName = match[2]!;\n const capture = `\\n(globalThis).__directiveSandbox_system__ = ${localName};\\n`;\n return bundled.replace(decl, decl + capture);\n}\n\nexport async function bundleSandboxFiles(\n files: PlaygroundFile[],\n): Promise<BundleResult> {\n const entry = files.find((f) => f.path === ENTRY_PATH);\n if (!entry) {\n throw new BundleError(\n `payload must include \"${ENTRY_PATH}\" — that's the entry point the runner targets`,\n );\n }\n\n const fileMap = new Map<string, string>();\n for (const file of files) {\n fileMap.set(file.path, file.source);\n }\n\n try {\n const result = await build({\n entryPoints: [`${VIRTUAL_NAMESPACE}:${ENTRY_PATH}`],\n bundle: true,\n format: \"esm\",\n target: \"node20\",\n platform: \"node\",\n write: false,\n logLevel: \"silent\",\n // The plugin's onResolve below intercepts every `@directive-run/`\n // import and rewrites it to an absolute file:// URL (so the\n // worker can import the bundle from /tmp without needing\n // node_modules above it). The wildcard external is the safety\n // net for any specifier the plugin doesn't recognize.\n external: [\"@directive-run/\"],\n // Top-level await is required (the runner does `await system.settle()`)\n // and node20 supports it natively.\n supported: { \"top-level-await\": true },\n plugins: [\n {\n name: \"directive-sandbox-vfs\",\n setup(b) {\n b.onResolve({ filter: /./ }, (args) => {\n if (args.kind === \"entry-point\") {\n const path = args.path.replace(`${VIRTUAL_NAMESPACE}:`, \"\");\n return { path, namespace: VIRTUAL_NAMESPACE };\n }\n if (args.namespace !== VIRTUAL_NAMESPACE) {\n return null;\n }\n if (args.path.startsWith(\"@directive-run/\")) {\n // Phase A audit P0-A1: rewrite to absolute file:// URL\n // so the worker's `/tmp/.../bundle.mjs` can import the\n // package without needing node_modules above /tmp.\n // Falls back to the bare specifier when resolution\n // fails — the legacy \"write next to node_modules\"\n // pattern still works as a backup.\n const resolved = resolveDirectivePackageToFileUrl(args.path);\n if (resolved) {\n return { external: true, path: resolved };\n }\n return { external: true, path: args.path };\n }\n if (args.path.startsWith(\"./\") \|\| args.path.startsWith(\"../\")) {\n // Resolve relative to the importer's path.\n const importerDir = args.importer.replace(/\\/[^/]+$/, \"\");\n // The runner imports `./counter.js`; the actual virtual\n // file lives at `src/counter.ts`. Strip the `.js` and\n // try both extensions so users can write either.\n const stripped = args.path\n .replace(/^\\.\\//, \"\")\n .replace(/\\.js$/, \"\");\n const candidates = [\n `${importerDir}/${stripped}.ts`,\n `${importerDir}/${stripped}.js`,\n `${importerDir}/${stripped}`,\n // Also try the raw path in case the importer's dir\n // resolution misses the leading slash.\n `${stripped}.ts`,\n `${stripped}.js`,\n ].map((p) => p.replace(/\\/+/g, \"/\"));\n\n for (const candidate of candidates) {\n if (fileMap.has(candidate)) {\n return { path: candidate, namespace: VIRTUAL_NAMESPACE };\n }\n }\n throw new BundleError(\n `cannot resolve \"${args.path}\" from \"${args.importer}\" — tried ${candidates.join(\", \")}`,\n );\n }\n throw new BundleError(\n `unexpected import \"${args.path}\" from \"${args.importer}\" — only relative or @directive-run/* allowed`,\n );\n });\n b.onLoad({ filter: /./, namespace: VIRTUAL_NAMESPACE }, (args) => {\n const contents = fileMap.get(args.path);\n if (contents === undefined) {\n throw new BundleError(`virtual file missing: ${args.path}`);\n }\n // For the entry file, append a trailing assignment so the\n // runner's top-level `const system = …` binding ends up on\n // a side-channel global the worker reads after execution.\n // ESM module exports are sealed, so we can't patch\n // `createSystem` post-import; instead we lift the binding\n // out of the entry module's scope here. The convention is\n // documented by `@directive-run/scaffold`'s `generateRunner`\n // which always names the local binding `system`.\n if (args.path === ENTRY_PATH) {\n const epilogue = [\n \"\",\n \"// directive-sandbox: lift the runner's `system` binding\",\n \"// onto a side-channel global so the worker can read\",\n \"// system.facts.$store.toObject() after execution.\",\n \"if (typeof system !== 'undefined') {\",\n \" (globalThis).__directiveSandbox_system__ = system;\",\n \"}\",\n ].join(\"\\n\");\n return { contents: contents + epilogue, loader: \"ts\" };\n }\n return { contents, loader: \"ts\" };\n });\n },\n },\n ],\n });\n const rawSource = result.outputFiles[0]?.text;\n if (!rawSource) {\n throw new BundleError(\"esbuild produced no output\");\n }\n // Inject an early-capture immediately after `createSystem(...)` so\n // the worker can read facts even when subsequent runner code throws\n // (e.g. an async settle() rejection from a bad event payload). The\n // entry-file epilogue (appended in onLoad) only fires on a clean\n // run; this regex fires regardless. Idempotent — duplicate\n // assignments to the same global are harmless.\n const source = injectEarlyCapture(rawSource);\n return { source, bytes: Buffer.byteLength(source, \"utf8\") };\n } catch (err) {\n if (err instanceof BundleError) {\n throw err;\n }\n throw new BundleError(\n `bundle failed: ${(err as Error).message ?? String(err)}`,\n err,\n );\n }\n}\n","/\n Host-side worker_threads orchestration. Mirrors the lint-runner\n * pattern in `@directive-run/mcp`: spawn a fresh worker per call,\n * race the response against a wall-clock timer, terminate on overrun.\n \n Workers are NOT pooled. Each call gets a clean process state — no\n * carry-over globals between snippets, no shared `console` patches,\n * no leaked timers from a prior run. Cold-start is ~5ms which is\n * cheap relative to the 50-200ms a typical Directive demo actually\n * spends in `system.settle()`.\n /\n\nimport { existsSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Worker } from \"node:worker_threads\";\nimport type {\n SandboxResult,\n WorkerInputMessage,\n WorkerOutputMessage,\n} from \"./types.js\";\n\nconst MIN_TIMEOUT_MS = 100;\nconst MAX_TIMEOUT_MS = 10_000;\nconst DEFAULT_TIMEOUT_MS = 5_000;\n\nasync function resolveWorkerPath(): Promise<string> {\n // PRIMARY: static URL relative to this module's own file. Bundlers\n // (Next.js outputFileTracing, esbuild, webpack, etc.) follow this\n // static reference at build time and include `worker.js` in the\n // output bundle automatically. Works on Vercel + AWS Lambda + Cloud\n // Run without any consumer-side config.\n //\n // FALLBACK (Vitest dev path): `import.meta.url` resolves to the\n // .ts source file in tests, so `./worker.js` doesn't exist there —\n // fall through to `createRequire(import.meta.url).resolve(...)`\n // which Vitest handles correctly via its SSR loader.\n try {\n const staticUrl = new URL(\"./worker.js\", import.meta.url);\n const path = fileURLToPath(staticUrl);\n if (existsSync(path)) {\n return path;\n }\n } catch {\n // fall through\n }\n const { createRequire } = await import(\"node:module\");\n const require = createRequire(import.meta.url);\n return require.resolve(\"@directive-run/sandbox/worker\");\n}\n\nexport interface HostRunInput {\n bundledSource: string;\n /* Derivation key names extracted from the payload's source files. /\n derivationKeys: string[];\n timeoutMs?: number;\n}\n\nexport class WorkerExecError extends Error {\n constructor(\n message: string,\n public readonly code: \"worker-error\" \| \"timeout\",\n ) {\n super(message);\n this.name = \"WorkerExecError\";\n }\n}\n\nfunction clampTimeout(value: number \| undefined): number {\n const raw = value ?? DEFAULT_TIMEOUT_MS;\n if (!Number.isFinite(raw)) {\n return DEFAULT_TIMEOUT_MS;\n }\n return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(raw)));\n}\n\n/\n Try `os.tmpdir()` first (Vercel-friendly: /tmp is the only writable\n * location on serverless functions). Fall back to the sandbox package\n * dir if /tmp ISN'T writable for some reason. The fallback inherits\n * the package's node_modules walking chain so bare specifiers like\n * `@directive-run/core` resolve naturally.\n /\nasync function getTempBundleDir(): Promise<string> {\n const osTmp = tmpdir();\n if (existsSync(osTmp)) {\n return osTmp;\n }\n // Reuse the worker-resolution path so we land at the same package\n // regardless of whether the consumer is in production or Vitest dev.\n const workerPath = await resolveWorkerPath();\n // dist/worker.js → ../ → package root.\n return dirname(dirname(workerPath));\n}\n\n/\n Write the bundled snippet to a temp file Node's ESM loader can\n * import via a file:// URL.\n \n Phase A audit P0-A1: previous versions wrote inside the sandbox\n * package's own directory so Node's resolver could walk up to find\n * `@directive-run/core` in node_modules — but Vercel / AWS Lambda /\n * Cloud Run all ship read-only FS outside `/tmp`. The bundler now\n * rewrites `@directive-run/` imports to ABSOLUTE `file://` URLs of\n the host's resolved paths (see `bundleSandboxFiles`), so the temp\n * file can live in `/tmp` without needing a node_modules anchor.\n \n Caller MUST clean the directory up in a finally block.\n /\nasync function writeBundleToTemp(bundledSource: string): Promise<{\n bundlePath: string;\n cleanup: () => void;\n}> {\n const baseDir = await getTempBundleDir();\n const dir = mkdtempSync(join(baseDir, \"directive-sandbox-\"));\n const bundlePath = join(dir, \"bundle.mjs\");\n writeFileSync(bundlePath, bundledSource, \"utf8\");\n return {\n bundlePath,\n cleanup: () => {\n try {\n rmSync(dir, { recursive: true, force: true });\n } catch {\n // best-effort\n }\n },\n };\n}\n\nexport async function execInWorker(\n input: HostRunInput,\n): Promise<SandboxResult> {\n const timeoutMs = clampTimeout(input.timeoutMs);\n const workerPath = await resolveWorkerPath();\n const { bundlePath, cleanup: cleanupTempDir } = await writeBundleToTemp(\n input.bundledSource,\n );\n const worker = new Worker(workerPath, {\n // 32 MB heap ceiling — bounded enough to prevent runaway allocations\n // without crowding the typical demo footprint (~2-5 MB).\n resourceLimits: {\n maxOldGenerationSizeMb: 32,\n maxYoungGenerationSizeMb: 8,\n codeRangeSizeMb: 16,\n },\n // Bypass stderr noise from the worker process showing up in the\n // host's logs. The transcript captures everything we care about.\n stderr: false,\n });\n\n let timer: NodeJS.Timeout \| null = null;\n let timedOut = false;\n const startMs = Date.now();\n\n try {\n const result = await new Promise<SandboxResult>((resolve, reject) => {\n let settled = false;\n\n worker.once(\"message\", (msg: WorkerOutputMessage) => {\n settled = true;\n if (msg.ok) {\n resolve(msg.result);\n } else {\n reject(new WorkerExecError(msg.error, \"worker-error\"));\n }\n });\n\n worker.once(\"error\", (err: Error) => {\n settled = true;\n reject(new WorkerExecError(err.message, \"worker-error\"));\n });\n\n worker.once(\"exit\", (code) => {\n if (!settled && code !== 0 && code !== null) {\n reject(\n new WorkerExecError(\n `worker exited with code ${code} before responding`,\n \"worker-error\",\n ),\n );\n }\n });\n\n timer = setTimeout(() => {\n timedOut = true;\n worker.terminate();\n reject(\n new WorkerExecError(\n `wall-clock budget of ${timeoutMs}ms elapsed`,\n \"timeout\",\n ),\n );\n }, timeoutMs);\n\n const message: WorkerInputMessage = {\n bundlePath: pathToFileURL(bundlePath).href,\n timeoutMs,\n derivationKeys: input.derivationKeys,\n };\n worker.postMessage(message);\n });\n\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError && err.code === \"timeout\") {\n // The worker captured nothing because we killed it; surface\n // structured timeout info to the caller.\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: Date.now() - startMs,\n timedOut: true,\n };\n }\n throw err;\n } finally {\n if (timer) {\n clearTimeout(timer);\n }\n await worker.terminate().catch(() => undefined);\n cleanupTempDir();\n void timedOut;\n }\n}\n","/\n Pure regex-based extractor for `derive:` / `derivations:` block keys\n * across a payload of source files. Mirrors the lightweight pattern the\n * docs site's DevTools panel uses for static-structure parsing.\n \n Phase A AE audit (P0-DM2): `system.derive` is a Proxy with no\n * `ownKeys` trap, so the worker can't enumerate derivations from inside\n * the sandbox. Instead, the host pre-scans source files for the\n * declared keys and forwards them to the worker, which then reads\n * `system.derive[key]` for each.\n \n Best-effort: a module that builds derivation keys dynamically (e.g.\n * `derive: Object.fromEntries(keys.map(k => [k, fn]))`) won't be\n * extracted. That's acceptable for the audit's stated goal of\n * \"transcript reflects what the module declared.\"\n /\n\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Find the matching `}` for the `{` at `openBrace`. Returns the index\n * of the close brace, or -1 if unbalanced.\n /\nfunction findMatchingClose(source: string, openBrace: number): number {\n let depth = 0;\n for (let i = openBrace; i < source.length; i++) {\n const ch = source[i];\n if (ch === \"{\") depth += 1;\n else if (ch === \"}\") {\n depth -= 1;\n if (depth === 0) return i;\n }\n }\n return -1;\n}\n\n/\n Pull top-level `key:` segments out of a brace-balanced block. Keys\n * are found between `,` or `\\n` or the block start at brace depth 0\n * AND paren depth 0. Works for both multi-line and compact `{ a: 1,\n * b: 2 }` forms.\n /\nfunction collectTopLevelKeys(block: string): string[] {\n const keys: string[] = [];\n let segStart = 0;\n let braceDepth = 0;\n let parenDepth = 0;\n let bracketDepth = 0;\n\n const flushSegment = (end: number) => {\n const seg = block.slice(segStart, end).trim();\n segStart = end + 1;\n if (!seg) return;\n // Tolerate leading quotes for `\"foo\":` quoted keys.\n const m = seg.match(/^['\"]?(\\w+)['\"]?\\s:/);\n if (m) keys.push(m[1]!);\n };\n\n for (let j = 0; j < block.length; j++) {\n const ch = block[j];\n if (ch === \"{\") braceDepth += 1;\n else if (ch === \"}\") braceDepth -= 1;\n else if (ch === \"(\") parenDepth += 1;\n else if (ch === \")\") parenDepth -= 1;\n else if (ch === \"[\") bracketDepth += 1;\n else if (ch === \"]\") bracketDepth -= 1;\n else if (\n (ch === \",\" \|\| ch === \"\\n\") &&\n braceDepth === 0 &&\n parenDepth === 0 &&\n bracketDepth === 0\n ) {\n flushSegment(j);\n }\n }\n // Final segment (no trailing comma/newline).\n flushSegment(block.length);\n return keys;\n}\n\nfunction extractTopLevelKeys(source: string, sectionName: string): string[] {\n const headerRe = new RegExp(`\\\\b${sectionName}\\\\s:\\\\s\\\\{`);\n const headerMatch = source.match(headerRe);\n if (!headerMatch \|\| headerMatch.index === undefined) {\n return [];\n }\n const openBrace = source.indexOf(\"{\", headerMatch.index);\n if (openBrace === -1) {\n return [];\n }\n const closeBrace = findMatchingClose(source, openBrace);\n if (closeBrace === -1) {\n return [];\n }\n return collectTopLevelKeys(source.slice(openBrace + 1, closeBrace));\n}\n\n/*\n Collect the union of derivation key names declared across all files\n * in the payload. Looks at both `derive:` (module config block) and\n * `derivations:` (schema block). De-duplicates.\n /\nexport function extractDerivationKeys(files: PlaygroundFile[]): string[] {\n const seen = new Set<string>();\n const out: string[] = [];\n for (const file of files) {\n for (const k of extractTopLevelKeys(file.source, \"derive\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n for (const k of extractTopLevelKeys(file.source, \"derivations\")) {\n if (!seen.has(k)) {\n seen.add(k);\n out.push(k);\n }\n }\n }\n return out;\n}\n","/\n Public types for `@directive-run/sandbox`.\n \n The package executes user-supplied Directive snippets in a bounded\n * worker_threads sandbox and returns a structured transcript. The\n * shape below is what the MCP `run_in_sandbox` tool returns to the\n * AI client and what `directive.run/playground`'s `/api/run-sandbox`\n * route serializes to JSON.\n /\n\nexport interface PlaygroundFile {\n /\n Relative path inside the project, e.g. \"src/main.ts\" or\n * \"src/counter.ts\". One file should be \"src/main.ts\" — that's\n * the entry point the runner targets.\n /\n path: string;\n /* File contents. /\n source: string;\n}\n\nexport interface RunInSandboxInput {\n /* Single-file shortcut. Mapped onto \"src/main.ts\" internally. /\n source?: string;\n /* Multi-file payload (the `generate_module` paired output shape). /\n files?: PlaygroundFile[];\n /* Wall-clock timeout in milliseconds. Defaults to 5000. Clamped to [100, 10000]. /\n timeoutMs?: number;\n}\n\nexport interface SandboxResult {\n /\n Captured `console.log` / `console.warn` / `console.error` lines,\n * in dispatch order. Each entry is the stringified arguments\n * joined by \" \" (matches Node's default console format).\n /\n logs: string[];\n /\n Final `system.facts.$store.toObject()` snapshot at end-of-run.\n * Empty when no system was constructed (e.g. validator rejection).\n /\n facts: Record<string, unknown>;\n /\n Final `system.derive` snapshot — every derivation declared in the\n * module config, evaluated by reading `system.derive[key]`. Empty\n * when the module has no `derive:` block or when validation rejected\n * before bundle. The Phase A AE audit (P0-DM2) flagged the original\n * sandbox for snapshotting only facts; modules whose primary product\n * is a derivation (`status`, `isReady`, etc.) returned an empty-\n * looking transcript.\n /\n derived: Record<string, unknown>;\n /\n Structured error messages from validation, bundling, or runtime\n * exceptions. Empty on a clean run.\n /\n errors: string[];\n /* Elapsed wall-clock duration of the worker execution. /\n durationMs: number;\n /* True when the wall-clock budget elapsed before settle()/destroy(). /\n timedOut: boolean;\n}\n\nexport type SandboxErrorCode =\n \| \"validation-failed\"\n \| \"bundle-failed\"\n \| \"worker-error\"\n \| \"timeout\"\n \| \"input-invalid\";\n\nexport class SandboxError extends Error {\n constructor(\n message: string,\n public readonly code: SandboxErrorCode,\n ) {\n super(message);\n this.name = \"SandboxError\";\n }\n}\n\n/\n Wire shape for messages from host → worker. The host writes the\n * bundled snippet to a temp file (so Node's ESM loader can resolve\n * `@directive-run/core` against the parent's node_modules; bare\n * specifiers don't resolve from data: URLs) and passes the file URL.\n * Replies on the same channel with a `SandboxResult`.\n /\nexport interface WorkerInputMessage {\n /* `file://` URL of the temp .mjs bundle the host wrote. /\n bundlePath: string;\n timeoutMs: number;\n /\n Derivation key names the host extracted from the source files.\n * `system.derive` is a Proxy with no `ownKeys` trap, so we can't\n * enumerate from the worker; the host's pre-bundle pass scans the\n * source for `derive:` and `derivations:` blocks and forwards the\n * keys here. Worker reads `system.derive[key]` for each.\n /\n derivationKeys: string[];\n}\n\n/* Wire shape for messages from worker → host. /\nexport type WorkerOutputMessage =\n \| { ok: true; result: SandboxResult }\n \| { ok: false; error: string };\n","/\n AST allowlist validator. Pre-flights every file in the payload\n * BEFORE the bundler so a hostile snippet never reaches the runtime\n * surface. Without this layer, `worker_threads` resource limits\n * (heap-only) leak FS + network access through — a snippet that\n * `import(\"node:fs\")` would still pwn the host process.\n \n Allowlist:\n \n - Imports: must match `@directive-run/` (specifically `core`, `ai`,\n `query`) OR a relative path ending in `.js` (the multi-file\n * payload's own files).\n * - Identifier accesses: only the allowlisted Directive API surface\n * plus `console.`, `Math.`, `JSON.`. Anything that touches\n global Node namespaces (`process`, `require`, `fs`, `child_process`,\n * `net`, `dgram`, `cluster`, etc.) is rejected.\n \n Strict by default — we'd rather reject a valid pattern (and learn\n * about it via a real-world report) than ship a \"mostly safe\" sandbox.\n * The Phase 2 plan calls out that we expand based on actual failures.\n \n Returns the list of validation errors; an empty list means safe to\n * bundle + execute. Callers should bail on any non-empty result.\n /\n\nimport { Project, SyntaxKind } from \"ts-morph\";\nimport type { PlaygroundFile } from \"./types.js\";\n\n/\n Consumer-safe @directive-run/* packages. These are the things a\n * realistic Directive demo might import: the runtime + UI adapters +\n * data primitives. Each has been audited for whether it can pull in a\n * sandbox-escape surface (process, fs, child_process, etc.); the ones\n * listed here can't.\n \n Packages deliberately EXCLUDED:\n \n - `@directive-run/cli` — uses process.argv + fs.write.\n * - `@directive-run/mcp` — speaks MCP over process.stdin/stdout; we\n * don't want sandboxed snippets opening a transport.\n * - `@directive-run/sandbox` — sandbox-in-sandbox; needs esbuild +\n * worker_threads. No legitimate use case.\n * - `@directive-run/vite-plugin-api-proxy` — build tooling, expects a\n * vite config that isn't present.\n \n The denylist below catches anyone who tries to import one of these\n * by pattern; the allowlist catches everything else.\n /\nconst ALLOWED_DIRECTIVE_PACKAGES = new Set<string>([\n \"core\",\n \"ai\",\n \"query\",\n \"el\",\n \"react\",\n \"vue\",\n \"svelte\",\n \"solid\",\n \"lit\",\n \"optimistic\",\n \"timeline\",\n \"mutator\",\n \"knowledge\",\n \"scaffold\",\n \"claude-plugin\",\n \"lint\",\n]);\n\nconst DENIED_DIRECTIVE_PACKAGES = new Set<string>([\n \"cli\",\n \"mcp\",\n \"sandbox\",\n \"vite-plugin-api-proxy\",\n]);\n\n/\n Extract the package name segment from a @directive-run/* specifier.\n \n \"@directive-run/core\" → \"core\"\n * \"@directive-run/ai/openai\" → \"ai\"\n * \"@directive-run/react/hooks\" → \"react\"\n \n Returns null when the specifier doesn't match the scope.\n /\nfunction extractDirectivePackage(specifier: string): string \| null {\n const match = specifier.match(/^@directive-run\\/([^/]+)/);\n return match ? match[1]! : null;\n}\n\nfunction isAllowedImport(specifier: string): boolean {\n if (/^\\.{1,2}\\/.+\\.js$/.test(specifier)) {\n return true;\n }\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg === null) {\n return false;\n }\n if (DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return false;\n }\n return ALLOWED_DIRECTIVE_PACKAGES.has(dpkg);\n}\n\n/\n Globals/identifiers the snippet may touch at top level. The runner\n * shape `generateRunner` emits + idiomatic Directive demos. Anything\n * else (process, require, fetch, fs, child_process, net, etc.) is a\n * sandbox escape attempt.\n /\nconst ALLOWED_GLOBALS = new Set<string>([\n // Directive runtime surface\n \"createSystem\",\n // We also allow the destructured exports the runner might use:\n \"system\",\n // Standard JS we'll let through\n \"console\",\n \"Math\",\n \"JSON\",\n \"Object\",\n \"Array\",\n \"Number\",\n \"String\",\n \"Boolean\",\n \"Symbol\",\n \"Promise\",\n \"Error\",\n \"Date\",\n \"Map\",\n \"Set\",\n \"WeakMap\",\n \"WeakSet\",\n \"Reflect\",\n \"globalThis\",\n // Top-level await + iteration sugar\n \"undefined\",\n \"null\",\n \"NaN\",\n \"Infinity\",\n]);\n\n/\n Identifiers that ALWAYS represent a sandbox escape — even if they'd\n * be allowed in some other context. Listed explicitly so a reader of\n * the validator can audit the threat model in one place.\n /\nconst DENIED_GLOBALS = new Set<string>([\n \"process\",\n \"require\",\n \"module\",\n \"__dirname\",\n \"__filename\",\n \"fetch\",\n \"XMLHttpRequest\",\n \"WebSocket\",\n \"eval\",\n \"Function\",\n // The MCP server runs on Node; these are Node-only globals that\n // bypass workers' resource isolation entirely.\n \"Buffer\",\n \"setImmediate\",\n \"queueMicrotask\",\n \"setTimeout\",\n \"setInterval\",\n \"clearTimeout\",\n \"clearInterval\",\n]);\n\nexport interface ValidationError {\n path: string;\n line: number;\n column: number;\n message: string;\n}\n\nfunction importRejectionMessage(specifier: string): string {\n const dpkg = extractDirectivePackage(specifier);\n if (dpkg && DENIED_DIRECTIVE_PACKAGES.has(dpkg)) {\n return `import \"${specifier}\" is denied — @directive-run/${dpkg} is a build/CLI/sandbox tool, not for use inside a sandboxed demo`;\n }\n return `import \"${specifier}\" is not allowed in the sandbox. Allowed: relative \"./X.js\" paths or any of @directive-run/{${Array.from(\n ALLOWED_DIRECTIVE_PACKAGES,\n )\n .sort()\n .join(\",\")}}.`;\n}\n\nfunction checkImports(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n for (const decl of sourceFile.getImportDeclarations()) {\n const moduleSpecifier = decl.getModuleSpecifierValue();\n if (!isAllowedImport(moduleSpecifier)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n decl.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: importRejectionMessage(moduleSpecifier),\n });\n }\n }\n}\n\nfunction checkDynamicImportsAndCalls(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Reject `import(\"…\")` (dynamic), `require(\"…\")` (CommonJS), and\n // `new Function(\"…\")` (string-to-code) at any depth.\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() === SyntaxKind.ImportKeyword) {\n const parent = node.getParent();\n if (parent && parent.getKind() === SyntaxKind.CallExpression) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"dynamic import() is not allowed in the sandbox\",\n });\n }\n }\n if (node.getKind() === SyntaxKind.NewExpression) {\n const text = node.getText();\n if (/^new\\s+Function\\s\\(/.test(text)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: \"new Function(...) is not allowed in the sandbox\",\n });\n }\n }\n });\n}\n\n/*\n The Phase A AE security audit (docs/AE-AUDIT-SANDBOX.md) found that\n * the original \"skip identifiers in property-access position\" rule\n * (added to avoid `{module: x}` false-positives) was a TOTAL bypass:\n * `globalThis.process.exit()` worked because `process` was a property\n * name and got skipped. This pass closes that hole.\n \n The threat model: an allowed receiver (`globalThis`, `Object`,\n * `Reflect`, an allowed class) is reached freely, but accessing any\n * denied identifier name on it OR `.constructor` on any value OR\n * calling Function via property-access must be rejected.\n \n Rules:\n \n 1. Property access (`a.b`) where `b` is in DENIED_GLOBALS — reject.\n * Catches `globalThis.process`, `globalThis.fetch`, `obj.eval`,\n * `mod.Function`, etc.\n * 2. Property access where `b` is `constructor` — reject. Catches the\n * `({}).constructor.constructor(\"...\")()` Function-smuggle chain.\n * No legitimate Directive use.\n * 3. Element access (`a[\"b\"]`) where `b` is a STRING LITERAL matching\n * a denied name — reject. Catches `globalThis[\"process\"]`,\n * `globalThis[\"fetch\"]`, etc. String concatenation\n * (`globalThis[\"proc\" + \"ess\"]`) isn't catchable at AST time;\n * documented as a known gap.\n * 4. Element access on `globalThis` with ANY string literal — reject.\n * Stricter than (3); `globalThis[\"Object\"]` is denied even though\n * `Object` is allowlisted because there's no legitimate reason\n * to reach Object via bracket syntax.\n * 5. Call expression where callee is `Function` (free identifier or\n * property access on globalThis/Object) — reject. Catches\n * `Function(\"return process\")()` without `new`.\n * 6. `Reflect.get(globalThis, \"X\")` / `Reflect.has(globalThis, \"X\")` /\n * `Object.getOwnPropertyDescriptor(globalThis, \"X\")` — reject when\n * first arg is `globalThis` (or any allowed global) and second arg\n * is a string literal matching a denied name OR `constructor`.\n /\nfunction checkPropertyAccessEscapes(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n\n const report = (node: import(\"ts-morph\").Node, message: string) => {\n const { line, column } = sourceFile.getLineAndColumnAtPos(node.getStart());\n errors.push({ path: fileLabel, line, column, message });\n };\n\n const stripStringLiteral = (text: string): string \| null => {\n const trimmed = text.trim();\n if (\n (trimmed.startsWith('\"') && trimmed.endsWith('\"')) \|\|\n (trimmed.startsWith(\"'\") && trimmed.endsWith(\"'\")) \|\|\n (trimmed.startsWith(\"`\") && trimmed.endsWith(\"`\"))\n ) {\n return trimmed.slice(1, -1);\n }\n return null;\n };\n\n sourceFile.forEachDescendant((node) => {\n const kind = node.getKind();\n\n // Rule 1 + 2: PropertyAccessExpression — receiver.name\n if (kind === SyntaxKind.PropertyAccessExpression) {\n const name = (node as { getName?: () => string }).getName?.();\n if (!name) {\n return;\n }\n if (name === \"constructor\") {\n report(\n node,\n \"`.constructor` access is denied in the sandbox (Function-constructor smuggle vector)\",\n );\n return;\n }\n if (DENIED_GLOBALS.has(name)) {\n report(\n node,\n `\\`.${name}\\` access is denied in the sandbox (FS/network/eval surface) — accessing a denied global via property syntax was the property-access bypass closed in v0.3.0`,\n );\n return;\n }\n }\n\n // Rule 3 + 4: ElementAccessExpression — receiver[\"string-literal\"]\n if (kind === SyntaxKind.ElementAccessExpression) {\n const expression = (\n node as { getExpression?: () => { getText: () => string } }\n ).getExpression?.();\n const argument = (\n node as {\n getArgumentExpression?: () => { getText: () => string } \| undefined;\n }\n ).getArgumentExpression?.();\n const receiverText = expression?.getText() ?? \"\";\n const argText = argument?.getText() ?? \"\";\n const literal = stripStringLiteral(argText);\n\n // Rule 4: ANY bracket access on globalThis with a string literal.\n if (receiverText === \"globalThis\" && literal !== null) {\n report(\n node,\n \"bracket-access on `globalThis` with a string literal is denied in the sandbox (use direct identifier reference for allowlisted names)\",\n );\n return;\n }\n // Rule 3: bracket access whose literal matches a denied name OR\n // `constructor`, on ANY receiver.\n if (literal !== null) {\n if (literal === \"constructor\" \|\| DENIED_GLOBALS.has(literal)) {\n report(\n node,\n `bracket-access \\`[\"${literal}\"]\\` is denied in the sandbox (would reach a denied name)`,\n );\n return;\n }\n }\n }\n\n // Rule 5: CallExpression with callee `Function(...)` (no `new`).\n if (kind === SyntaxKind.CallExpression) {\n const expression = (\n node as {\n getExpression?: () => {\n getKind: () => number;\n getText: () => string;\n };\n }\n ).getExpression?.();\n const exprText = expression?.getText() ?? \"\";\n if (exprText === \"Function\") {\n report(node, \"`Function(...)` call is denied in the sandbox\");\n return;\n }\n // Rule 6: Reflect.get / Reflect.has / Object.getOwnPropertyDescriptor\n // with `globalThis` (or any allowed global) + denied string-literal.\n const reflectAccess = exprText.match(/^(Reflect\|Object)\\.(\\w+)$/);\n if (reflectAccess) {\n const callExpr = node as {\n getArguments?: () => { getText: () => string }[];\n };\n const args = callExpr.getArguments?.() ?? [];\n if (args.length >= 2) {\n const firstArg = args[0]!.getText();\n const secondArgLiteral = stripStringLiteral(args[1]!.getText());\n const denyMethods = new Set([\n \"get\",\n \"has\",\n \"getOwnPropertyDescriptor\",\n \"getOwnPropertyDescriptors\",\n \"ownKeys\",\n \"getPrototypeOf\",\n ]);\n if (\n denyMethods.has(reflectAccess[2]!) &&\n (firstArg === \"globalThis\" \|\| ALLOWED_GLOBALS.has(firstArg)) &&\n secondArgLiteral !== null &&\n (secondArgLiteral === \"constructor\" \|\|\n DENIED_GLOBALS.has(secondArgLiteral))\n ) {\n report(\n node,\n `\\`${reflectAccess[1]}.${reflectAccess[2]}(${firstArg}, \"${secondArgLiteral}\")\\` would reach a denied name`,\n );\n }\n }\n }\n }\n });\n}\n\nfunction checkGlobalIdentifiers(\n fileLabel: string,\n project: Project,\n errors: ValidationError[],\n): void {\n const sourceFile = project.getSourceFileOrThrow(fileLabel);\n // Walk every Identifier and check whether it resolves to a\n // top-level binding. We only care about the \"free\" identifiers —\n // ones the snippet didn't declare via import, var/let/const, or\n // function/class declaration. Those are globals.\n const localBindings = new Set<string>();\n for (const decl of sourceFile.getImportDeclarations()) {\n for (const n of decl.getNamedImports()) {\n localBindings.add(n.getName());\n }\n const def = decl.getDefaultImport();\n if (def) localBindings.add(def.getText());\n const ns = decl.getNamespaceImport();\n if (ns) localBindings.add(ns.getText());\n }\n for (const v of sourceFile.getVariableDeclarations()) {\n localBindings.add(v.getName());\n }\n for (const f of sourceFile.getFunctions()) {\n const name = f.getName();\n if (name) localBindings.add(name);\n }\n for (const c of sourceFile.getClasses()) {\n const name = c.getName();\n if (name) localBindings.add(name);\n }\n\n sourceFile.forEachDescendant((node) => {\n if (node.getKind() !== SyntaxKind.Identifier) {\n return;\n }\n const name = node.getText();\n if (localBindings.has(name)) {\n return;\n }\n if (ALLOWED_GLOBALS.has(name)) {\n return;\n }\n\n // Skip identifiers in non-reference positions where the name is\n // just a label, not a binding reference:\n //\n // - Property-assignment KEYS in object literals: `{ module: x }`\n // — the LHS `module` is a label, not a reference to Node's `module`.\n // - Property-access NAMES: `obj.foo` — `foo` is a property selector.\n // - Property-access in shorthand: `{ foo }` — `foo` IS a reference;\n // ts-morph's ShorthandPropertyAssignment parents that case, so we\n // only filter PropertyAssignment.name and PropertyAccessExpression.name.\n // - Type-annotation positions: `let x: foo` — `foo` is a type.\n // - Import/export specifier names.\n const parent = node.getParent();\n if (parent) {\n const parentKind = parent.getKind();\n // `{ module: x }` — name child of a PropertyAssignment.\n if (parentKind === SyntaxKind.PropertyAssignment) {\n const propertyName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (propertyName === node) {\n return;\n }\n }\n // `obj.foo` — `foo` is the .name on the right of a dot.\n if (parentKind === SyntaxKind.PropertyAccessExpression) {\n const accessName = (\n parent as { getNameNode?: () => unknown }\n ).getNameNode?.();\n if (accessName === node) {\n return;\n }\n }\n // `{ foo: bar }` LHS for shorthand-style method declarations.\n if (parentKind === SyntaxKind.MethodDeclaration) {\n return;\n }\n // import { foo } / import { foo as bar } / export { foo }\n if (\n parentKind === SyntaxKind.ImportSpecifier \|\|\n parentKind === SyntaxKind.ExportSpecifier \|\|\n parentKind === SyntaxKind.NamespaceImport \|\|\n parentKind === SyntaxKind.ImportClause\n ) {\n return;\n }\n // Function/method parameter names.\n if (parentKind === SyntaxKind.Parameter) {\n return;\n }\n // Type references — `let x: foo` etc.\n if (\n parentKind === SyntaxKind.TypeReference \|\|\n parentKind === SyntaxKind.TypeQuery\n ) {\n return;\n }\n }\n\n if (DENIED_GLOBALS.has(name)) {\n const { line, column } = sourceFile.getLineAndColumnAtPos(\n node.getStart(),\n );\n errors.push({\n path: fileLabel,\n line,\n column,\n message: `identifier \"${name}\" is denied in the sandbox (FS/network/eval surface)`,\n });\n }\n // We don't reject unknown identifiers — they might be legitimate\n // members of an allowlist-imported binding (e.g. `system.events.foo`\n // — `foo` is an identifier in property-access position). The\n // import + denylist + dynamic-import check above already covers\n // the actual escape paths.\n });\n}\n\nexport function validateSandboxInput(\n files: PlaygroundFile[],\n): ValidationError[] {\n const errors: ValidationError[] = [];\n const project = new Project({\n useInMemoryFileSystem: true,\n compilerOptions: {\n target: 99, // ESNext\n module: 99, // ESNext\n allowJs: true,\n strict: false,\n },\n });\n\n for (const file of files) {\n project.createSourceFile(file.path, file.source, { overwrite: true });\n }\n\n for (const file of files) {\n checkImports(file.path, project, errors);\n checkDynamicImportsAndCalls(file.path, project, errors);\n checkPropertyAccessEscapes(file.path, project, errors);\n checkGlobalIdentifiers(file.path, project, errors);\n }\n\n return errors;\n}\n","/\n Public API for `@directive-run/sandbox`.\n \n Single entry point: `runInSandbox({files, timeoutMs})` validates the\n * payload against the AST allowlist, bundles the multi-file payload via\n * esbuild, and executes the result in a bounded worker_threads sandbox.\n * Returns a structured `SandboxResult` with captured logs, the final\n * facts snapshot, and any errors that occurred at any stage.\n \n Consumers:\n \n - `@directive-run/mcp` — the `run_in_sandbox` MCP tool returns the\n * result to AI clients alongside a `playground_link` URL.\n * - `directive-docs` — the `/api/run-sandbox` Next.js route wraps this\n * for the playground page's live DevTools transcript view.\n */\n\nimport { BundleError, bundleSandboxFiles } from \"./bundler.js\";\nimport { WorkerExecError, execInWorker } from \"./host.js\";\nimport { extractDerivationKeys } from \"./key-extractor.js\";\nimport { SandboxError } from \"./types.js\";\nimport type {\n PlaygroundFile,\n RunInSandboxInput,\n SandboxResult,\n} from \"./types.js\";\nimport { validateSandboxInput } from \"./validator.js\";\n\nexport {\n SandboxError,\n type PlaygroundFile,\n type RunInSandboxInput,\n type SandboxResult,\n} from \"./types.js\";\nexport type { ValidationError } from \"./validator.js\";\n\nconst MAX_PAYLOAD_BYTES = 200_000;\nconst MAX_FILES = 10;\nconst MAIN_PATH = \"src/main.ts\";\n\nfunction normalizeInput(input: RunInSandboxInput): PlaygroundFile[] {\n if (input.files && input.source) {\n throw new SandboxError(\n \"pass either `source` or `files`, not both\",\n \"input-invalid\",\n );\n }\n if (!input.files && !input.source) {\n throw new SandboxError(\n \"must pass either `source` or `files`\",\n \"input-invalid\",\n );\n }\n const files: PlaygroundFile[] = input.files\n ? input.files\n : [{ path: MAIN_PATH, source: input.source ?? \"\" }];\n\n if (files.length === 0) {\n throw new SandboxError(\"files array is empty\", \"input-invalid\");\n }\n if (files.length > MAX_FILES) {\n throw new SandboxError(\n `payload exceeds ${MAX_FILES} files`,\n \"input-invalid\",\n );\n }\n let totalBytes = 0;\n for (const file of files) {\n if (typeof file.path !== \"string\" \|\| file.path.length === 0) {\n throw new SandboxError(\n \"every file must have a non-empty path\",\n \"input-invalid\",\n );\n }\n if (typeof file.source !== \"string\" \|\| file.source.length === 0) {\n throw new SandboxError(\n `file \"${file.path}\" has empty source`,\n \"input-invalid\",\n );\n }\n totalBytes += Buffer.byteLength(file.source, \"utf8\");\n }\n if (totalBytes > MAX_PAYLOAD_BYTES) {\n throw new SandboxError(\n `total payload is ${totalBytes} bytes (max ${MAX_PAYLOAD_BYTES})`,\n \"input-invalid\",\n );\n }\n // Ensure src/main.ts is present — that's the runner / entry point.\n if (!files.some((f) => f.path === MAIN_PATH)) {\n throw new SandboxError(\n `payload must include \"${MAIN_PATH}\" — the runner entry point`,\n \"input-invalid\",\n );\n }\n return files;\n}\n\nexport async function runInSandbox(\n input: RunInSandboxInput,\n): Promise<SandboxResult> {\n let files: PlaygroundFile[];\n try {\n files = normalizeInput(input);\n } catch (err) {\n if (err instanceof SandboxError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n const validationErrors = validateSandboxInput(files);\n if (validationErrors.length > 0) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: validationErrors.map(\n (e) => `${e.path}:${e.line}:${e.column} — ${e.message}`,\n ),\n durationMs: 0,\n timedOut: false,\n };\n }\n\n // Phase A audit P0-DM2: pre-extract derivation key names from the\n // source files so the worker can iterate them after settle. The\n // `system.derive` proxy has no `ownKeys` trap.\n const derivationKeys = extractDerivationKeys(files);\n\n let bundled: { source: string; bytes: number };\n try {\n bundled = await bundleSandboxFiles(files);\n } catch (err) {\n if (err instanceof BundleError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: false,\n };\n }\n throw err;\n }\n\n try {\n const result = await execInWorker({\n bundledSource: bundled.source,\n derivationKeys,\n timeoutMs: input.timeoutMs,\n });\n return result;\n } catch (err) {\n if (err instanceof WorkerExecError) {\n return {\n logs: [],\n facts: {},\n derived: {},\n errors: [err.message],\n durationMs: 0,\n timedOut: err.code === \"timeout\",\n };\n }\n throw err;\n }\n}\n"],"mappings":"AAgBA,OAAS,iBAAAA,MAAqB,SAC9B,OAAS,iBAAAC,MAAqB,MAC9B,OAAS,SAAAC,MAAa,UAgBtB,SAASC,EAAiCC,EAAkC,CAC1E,GAAI,CAEF,IAAMC,EADUL,EAAc,YAAY,GAAG,EACpB,QAAQI,CAAS,EAC1C,OAAOH,EAAcI,CAAQ,EAAE,IACjC,MAAQ,CACN,OAAO,IACT,CACF,CAEA,IAAMC,EAAa,cACbC,EAAoB,wBASbC,EAAN,cAA0B,KAAM,CACrC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,WAAAC,EAGhB,KAAK,KAAO,aACd,CACF,EAoBA,SAASC,EAAmBC,EAAyB,CACnD,IAAMC,EAAK,4DACLC,EAAQF,EAAQ,MAAMC,CAAE,EAC9B,GAAI,CAACC,EACH,OAAOF,EAET,IAAMG,EAAOD,EAAM,CAAC,EAEdE,EAAU;AAAA,6CADEF,EAAM,CAAC,CACgD;AAAA,EACzE,OAAOF,EAAQ,QAAQG,EAAMA,EAAOC,CAAO,CAC7C,CAEA,eAAsBC,EACpBC,EACuB,CAEvB,GAAI,CADUA,EAAM,KAAMC,GAAMA,EAAE,OAASb,CAAU,EAEnD,MAAM,IAAIE,EACR,yBAAyBF,CAAU,oDACrC,EAGF,IAAMc,EAAU,IAAI,IACpB,QAAWC,KAAQH,EACjBE,EAAQ,IAAIC,EAAK,KAAMA,EAAK,MAAM,EAGpC,GAAI,CA0GF,IAAMC,GAzGS,MAAMpB,EAAM,CACzB,YAAa,CAAC,GAAGK,CAAiB,IAAID,CAAU,EAAE,EAClD,OAAQ,GACR,OAAQ,MACR,OAAQ,SACR,SAAU,OACV,MAAO,GACP,SAAU,SAMV,SAAU,CAAC,kBAAkB,EAG7B,UAAW,CAAE,kBAAmB,EAAK,EACrC,QAAS,CACP,CACE,KAAM,wBACN,MAAMiB,EAAG,CACPA,EAAE,UAAU,CAAE,OAAQ,IAAK,EAAIC,GAAS,CACtC,GAAIA,EAAK,OAAS,cAEhB,MAAO,CAAE,KADIA,EAAK,KAAK,QAAQ,GAAGjB,CAAiB,IAAK,EAAE,EAC3C,UAAWA,CAAkB,EAE9C,GAAIiB,EAAK,YAAcjB,EACrB,OAAO,KAET,GAAIiB,EAAK,KAAK,WAAW,iBAAiB,EAAG,CAO3C,IAAMnB,EAAWF,EAAiCqB,EAAK,IAAI,EAC3D,OAAInB,EACK,CAAE,SAAU,GAAM,KAAMA,CAAS,EAEnC,CAAE,SAAU,GAAM,KAAMmB,EAAK,IAAK,CAC3C,CACA,GAAIA,EAAK,KAAK,WAAW,IAAI,GAAKA,EAAK,KAAK,WAAW,KAAK,EAAG,CAE7D,IAAMC,EAAcD,EAAK,SAAS,QAAQ,WAAY,EAAE,EAIlDE,EAAWF,EAAK,KACnB,QAAQ,QAAS,EAAE,EACnB,QAAQ,QAAS,EAAE,EAChBG,EAAa,CACjB,GAAGF,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,MAC1B,GAAGD,CAAW,IAAIC,CAAQ,GAG1B,GAAGA,CAAQ,MACX,GAAGA,CAAQ,KACb,EAAE,IAAKE,GAAMA,EAAE,QAAQ,OAAQ,GAAG,CAAC,EAEnC,QAAWC,KAAaF,EACtB,GAAIP,EAAQ,IAAIS,CAAS,EACvB,MAAO,CAAE,KAAMA,EAAW,UAAWtB,CAAkB,EAG3D,MAAM,IAAIC,EACR,mBAAmBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,kBAAaG,EAAW,KAAK,IAAI,CAAC,EACxF,CACF,CACA,MAAM,IAAInB,EACR,sBAAsBgB,EAAK,IAAI,WAAWA,EAAK,QAAQ,oDACzD,CACF,CAAC,EACDD,EAAE,OAAO,CAAE,OAAQ,KAAM,UAAWhB,CAAkB,EAAIiB,GAAS,CACjE,IAAMM,EAAWV,EAAQ,IAAII,EAAK,IAAI,EACtC,GAAIM,IAAa,OACf,MAAM,IAAItB,EAAY,yBAAyBgB,EAAK,IAAI,EAAE,EAU5D,GAAIA,EAAK,OAASlB,EAAY,CAC5B,IAAMyB,EAAW,CACf,GACA,2DACA,uDACA,qDACA,uCACA,uDACA,GACF,EAAE,KAAK;AAAA,CAAI,EACX,MAAO,CAAE,SAAUD,EAAWC,EAAU,OAAQ,IAAK,CACvD,CACA,MAAO,CAAE,SAAAD,EAAU,OAAQ,IAAK,CAClC,CAAC,CACH,CACF,CACF,CACF,CAAC,GACwB,YAAY,CAAC,GAAG,KACzC,GAAI,CAACR,EACH,MAAM,IAAId,EAAY,4BAA4B,EAQpD,IAAMwB,EAASrB,EAAmBW,CAAS,EAC3C,MAAO,CAAE,OAAAU,EAAQ,MAAO,OAAO,WAAWA,EAAQ,MAAM,CAAE,CAC5D,OAASC,EAAK,CACZ,MAAIA,aAAezB,EACXyB,EAEF,IAAIzB,EACR,kBAAmByB,EAAc,SAAW,OAAOA,CAAG,CAAC,GACvDA,CACF,CACF,CACF,CChOA,OAAS,cAAAC,EAAY,eAAAC,EAAa,UAAAC,EAAQ,iBAAAC,MAAqB,KAC/D,OAAS,UAAAC,MAAc,KACvB,OAAS,WAAAC,EAAS,QAAAC,MAAY,OAC9B,OAAS,iBAAAC,EAAe,iBAAAC,MAAqB,MAC7C,OAAS,UAAAC,MAAc,iBAOvB,IAAMC,EAAiB,IACjBC,EAAiB,IACjBC,EAAqB,IAE3B,eAAeC,GAAqC,CAWlD,GAAI,CACF,IAAMC,EAAY,IAAI,IAAI,cAAe,YAAY,GAAG,EAClDC,EAAOR,EAAcO,CAAS,EACpC,GAAId,EAAWe,CAAI,EACjB,OAAOA,CAEX,MAAQ,CAER,CACA,GAAM,CAAE,cAAAC,CAAc,EAAI,KAAM,QAAO,QAAa,EAEpD,OADgBA,EAAc,YAAY,GAAG,EAC9B,QAAQ,+BAA+B,CACxD,CASO,IAAMC,EAAN,cAA8B,KAAM,CACzC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,iBACd,CACF,EAEA,SAASC,EAAaC,EAAmC,CACvD,IAAMC,EAAMD,GAAST,EACrB,OAAK,OAAO,SAASU,CAAG,EAGjB,KAAK,IAAIX,EAAgB,KAAK,IAAID,EAAgB,KAAK,MAAMY,CAAG,CAAC,CAAC,EAFhEV,CAGX,CASA,eAAeW,IAAoC,CACjD,IAAMC,EAAQpB,EAAO,EACrB,GAAIJ,EAAWwB,CAAK,EAClB,OAAOA,EAIT,IAAMC,EAAa,MAAMZ,EAAkB,EAE3C,OAAOR,EAAQA,EAAQoB,CAAU,CAAC,CACpC,CAgBA,eAAeC,GAAkBC,EAG9B,CACD,IAAMC,EAAU,MAAML,GAAiB,EACjCM,EAAM5B,EAAYK,EAAKsB,EAAS,oBAAoB,CAAC,EACrDE,EAAaxB,EAAKuB,EAAK,YAAY,EACzC,OAAA1B,EAAc2B,EAAYH,EAAe,MAAM,EACxC,CACL,WAAAG,EACA,QAAS,IAAM,CACb,GAAI,CACF5B,EAAO2B,EAAK,CAAE,UAAW,GAAM,MAAO,EAAK,CAAC,CAC9C,MAAQ,CAER,CACF,CACF,CACF,CAEA,eAAsBE,EACpBC,EACwB,CACxB,IAAMC,EAAYb,EAAaY,EAAM,SAAS,EACxCP,EAAa,MAAMZ,EAAkB,EACrC,CAAE,WAAAiB,EAAY,QAASI,CAAe,EAAI,MAAMR,GACpDM,EAAM,aACR,EACMG,EAAS,IAAI1B,EAAOgB,EAAY,CAGpC,eAAgB,CACd,uBAAwB,GACxB,yBAA0B,EAC1B,gBAAiB,EACnB,EAGA,OAAQ,EACV,CAAC,EAEGW,EAA+B,KAC/BC,EAAW,GACTC,EAAU,KAAK,IAAI,EAEzB,GAAI,CAgDF,OA/Ce,MAAM,IAAI,QAAuB,CAACC,EAASC,IAAW,CACnE,IAAIC,EAAU,GAEdN,EAAO,KAAK,UAAYO,GAA6B,CACnDD,EAAU,GACNC,EAAI,GACNH,EAAQG,EAAI,MAAM,EAElBF,EAAO,IAAIvB,EAAgByB,EAAI,MAAO,cAAc,CAAC,CAEzD,CAAC,EAEDP,EAAO,KAAK,QAAUQ,GAAe,CACnCF,EAAU,GACVD,EAAO,IAAIvB,EAAgB0B,EAAI,QAAS,cAAc,CAAC,CACzD,CAAC,EAEDR,EAAO,KAAK,OAAShB,GAAS,CACxB,CAACsB,GAAWtB,IAAS,GAAKA,IAAS,MACrCqB,EACE,IAAIvB,EACF,2BAA2BE,CAAI,qBAC/B,cACF,CACF,CAEJ,CAAC,EAEDiB,EAAQ,WAAW,IAAM,CACvBC,EAAW,GACXF,EAAO,UAAU,EACjBK,EACE,IAAIvB,EACF,wBAAwBgB,CAAS,aACjC,SACF,CACF,CACF,EAAGA,CAAS,EAEZ,IAAMf,EAA8B,CAClC,WAAYV,EAAcsB,CAAU,EAAE,KACtC,UAAAG,EACA,eAAgBD,EAAM,cACxB,EACAG,EAAO,YAAYjB,CAAO,CAC5B,CAAC,CAGH,OAASyB,EAAK,CACZ,GAAIA,aAAe1B,GAAmB0B,EAAI,OAAS,UAGjD,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACA,EAAI,OAAO,EACpB,WAAY,KAAK,IAAI,EAAIL,EACzB,SAAU,EACZ,EAEF,MAAMK,CACR,QAAE,CACIP,GACF,aAAaA,CAAK,EAEpB,MAAMD,EAAO,UAAU,EAAE,MAAM,IAAG,EAAY,EAC9CD,EAAe,CAEjB,CACF,CC3MA,SAASU,GAAkBC,EAAgBC,EAA2B,CACpE,IAAIC,EAAQ,EACZ,QAASC,EAAIF,EAAWE,EAAIH,EAAO,OAAQG,IAAK,CAC9C,IAAMC,EAAKJ,EAAOG,CAAC,EACnB,GAAIC,IAAO,IAAKF,GAAS,UAChBE,IAAO,MACdF,GAAS,EACLA,IAAU,GAAG,OAAOC,CAE5B,CACA,MAAO,EACT,CAQA,SAASE,GAAoBC,EAAyB,CACpD,IAAMC,EAAiB,CAAC,EACpBC,EAAW,EACXC,EAAa,EACbC,EAAa,EACbC,EAAe,EAEbC,EAAgBC,GAAgB,CACpC,IAAMC,EAAMR,EAAM,MAAME,EAAUK,CAAG,EAAE,KAAK,EAE5C,GADAL,EAAWK,EAAM,EACb,CAACC,EAAK,OAEV,IAAMC,EAAID,EAAI,MAAM,sBAAsB,EACtCC,GAAGR,EAAK,KAAKQ,EAAE,CAAC,CAAE,CACxB,EAEA,QAASC,EAAI,EAAGA,EAAIV,EAAM,OAAQU,IAAK,CACrC,IAAMZ,EAAKE,EAAMU,CAAC,EACdZ,IAAO,IAAKK,GAAc,EACrBL,IAAO,IAAKK,GAAc,EAC1BL,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKM,GAAc,EAC1BN,IAAO,IAAKO,GAAgB,EAC5BP,IAAO,IAAKO,GAAgB,GAElCP,IAAO,KAAOA,IAAO;AAAA,IACtBK,IAAe,GACfC,IAAe,GACfC,IAAiB,GAEjBC,EAAaI,CAAC,CAElB,CAEA,OAAAJ,EAAaN,EAAM,MAAM,EAClBC,CACT,CAEA,SAASU,EAAoBjB,EAAgBkB,EAA+B,CAC1E,IAAMC,EAAW,IAAI,OAAO,MAAMD,CAAW,cAAc,EACrDE,EAAcpB,EAAO,MAAMmB,CAAQ,EACzC,GAAI,CAACC,GAAeA,EAAY,QAAU,OACxC,MAAO,CAAC,EAEV,IAAMnB,EAAYD,EAAO,QAAQ,IAAKoB,EAAY,KAAK,EACvD,GAAInB,IAAc,GAChB,MAAO,CAAC,EAEV,IAAMoB,EAAatB,GAAkBC,EAAQC,CAAS,EACtD,OAAIoB,IAAe,GACV,CAAC,EAEHhB,GAAoBL,EAAO,MAAMC,EAAY,EAAGoB,CAAU,CAAC,CACpE,CAOO,SAASC,EAAsBC,EAAmC,CACvE,IAAMC,EAAO,IAAI,IACXC,EAAgB,CAAC,EACvB,QAAWC,KAAQH,EAAO,CACxB,QAAWI,KAAKV,EAAoBS,EAAK,OAAQ,QAAQ,EAClDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,GAGd,QAAWA,KAAKV,EAAoBS,EAAK,OAAQ,aAAa,EACvDF,EAAK,IAAIG,CAAC,IACbH,EAAK,IAAIG,CAAC,EACVF,EAAI,KAAKE,CAAC,EAGhB,CACA,OAAOF,CACT,CClDO,IAAMG,EAAN,cAA2B,KAAM,CACtC,YACEC,EACgBC,EAChB,CACA,MAAMD,CAAO,EAFG,UAAAC,EAGhB,KAAK,KAAO,cACd,CACF,ECrDA,OAAS,WAAAC,GAAS,cAAAC,MAAkB,WAuBpC,IAAMC,EAA6B,IAAI,IAAY,CACjD,OACA,KACA,QACA,KACA,QACA,MACA,SACA,QACA,MACA,aACA,WACA,UACA,YACA,WACA,gBACA,MACF,CAAC,EAEKC,EAA4B,IAAI,IAAY,CAChD,MACA,MACA,UACA,uBACF,CAAC,EAWD,SAASC,EAAwBC,EAAkC,CACjE,IAAMC,EAAQD,EAAU,MAAM,0BAA0B,EACxD,OAAOC,EAAQA,EAAM,CAAC,EAAK,IAC7B,CAEA,SAASC,GAAgBF,EAA4B,CACnD,GAAI,oBAAoB,KAAKA,CAAS,EACpC,MAAO,GAET,IAAMG,EAAOJ,EAAwBC,CAAS,EAI9C,OAHIG,IAAS,MAGTL,EAA0B,IAAIK,CAAI,EAC7B,GAEFN,EAA2B,IAAIM,CAAI,CAC5C,CAQA,IAAMC,EAAkB,IAAI,IAAY,CAEtC,eAEA,SAEA,UACA,OACA,OACA,SACA,QACA,SACA,SACA,UACA,SACA,UACA,QACA,OACA,MACA,MACA,UACA,UACA,UACA,aAEA,YACA,OACA,MACA,UACF,CAAC,EAOKC,EAAiB,IAAI,IAAY,CACrC,UACA,UACA,SACA,YACA,aACA,QACA,iBACA,YACA,OACA,WAGA,SACA,eACA,iBACA,aACA,cACA,eACA,eACF,CAAC,EASD,SAASC,GAAuBN,EAA2B,CACzD,IAAMG,EAAOJ,EAAwBC,CAAS,EAC9C,OAAIG,GAAQL,EAA0B,IAAIK,CAAI,EACrC,WAAWH,CAAS,qCAAgCG,CAAI,oEAE1D,WAAWH,CAAS,+FAA+F,MAAM,KAC9HH,CACF,EACG,KAAK,EACL,KAAK,GAAG,CAAC,IACd,CAEA,SAASU,GACPC,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EACzD,QAAWI,KAAQD,EAAW,sBAAsB,EAAG,CACrD,IAAME,EAAkBD,EAAK,wBAAwB,EACrD,GAAI,CAACV,GAAgBW,CAAe,EAAG,CACrC,GAAM,CAAE,KAAAC,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCC,EAAK,SAAS,CAChB,EACAF,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAST,GAAuBO,CAAe,CACjD,CAAC,CACH,CACF,CACF,CAEA,SAASG,GACPR,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAGzDG,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMsB,EAASD,EAAK,UAAU,EAC9B,GAAIC,GAAUA,EAAO,QAAQ,IAAMtB,EAAW,eAAgB,CAC5D,GAAM,CAAE,KAAAkB,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,gDACX,CAAC,CACH,CACF,CACA,GAAIE,EAAK,QAAQ,IAAMrB,EAAW,cAAe,CAC/C,IAAMuB,EAAOF,EAAK,QAAQ,EAC1B,GAAI,uBAAuB,KAAKE,CAAI,EAAG,CACrC,GAAM,CAAE,KAAAL,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,iDACX,CAAC,CACH,CACF,CACF,CAAC,CACH,CAuCA,SAASK,GACPZ,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAEnDa,EAAS,CAACJ,EAA+BK,IAAoB,CACjE,GAAM,CAAE,KAAAR,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAAsBM,EAAK,SAAS,CAAC,EACzEP,EAAO,KAAK,CAAE,KAAMF,EAAW,KAAAM,EAAM,OAAAC,EAAQ,QAAAO,CAAQ,CAAC,CACxD,EAEMC,EAAsBJ,GAAgC,CAC1D,IAAMK,EAAUL,EAAK,KAAK,EAC1B,OACGK,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,GAC/CA,EAAQ,WAAW,GAAG,GAAKA,EAAQ,SAAS,GAAG,EAEzCA,EAAQ,MAAM,EAAG,EAAE,EAErB,IACT,EAEAb,EAAW,kBAAmBM,GAAS,CACrC,IAAMQ,EAAOR,EAAK,QAAQ,EAG1B,GAAIQ,IAAS7B,EAAW,yBAA0B,CAChD,IAAM8B,EAAQT,EAAoC,UAAU,EAC5D,GAAI,CAACS,EACH,OAEF,GAAIA,IAAS,cAAe,CAC1BL,EACEJ,EACA,sFACF,EACA,MACF,CACA,GAAIZ,EAAe,IAAIqB,CAAI,EAAG,CAC5BL,EACEJ,EACA,MAAMS,CAAI,mKACZ,EACA,MACF,CACF,CAGA,GAAID,IAAS7B,EAAW,wBAAyB,CAC/C,IAAM+B,EACJV,EACA,gBAAgB,EACZW,EACJX,EAGA,wBAAwB,EACpBY,EAAeF,GAAY,QAAQ,GAAK,GACxCG,EAAUF,GAAU,QAAQ,GAAK,GACjCG,EAAUR,EAAmBO,CAAO,EAG1C,GAAID,IAAiB,cAAgBE,IAAY,KAAM,CACrDV,EACEJ,EACA,uIACF,EACA,MACF,CAGA,GAAIc,IAAY,OACVA,IAAY,eAAiB1B,EAAe,IAAI0B,CAAO,GAAG,CAC5DV,EACEJ,EACA,sBAAsBc,CAAO,2DAC/B,EACA,MACF,CAEJ,CAGA,GAAIN,IAAS7B,EAAW,eAAgB,CAStC,IAAMoC,EAPJf,EAMA,gBAAgB,GACW,QAAQ,GAAK,GAC1C,GAAIe,IAAa,WAAY,CAC3BX,EAAOJ,EAAM,+CAA+C,EAC5D,MACF,CAGA,IAAMgB,EAAgBD,EAAS,MAAM,2BAA2B,EAChE,GAAIC,EAAe,CAIjB,IAAMC,EAHWjB,EAGK,eAAe,GAAK,CAAC,EAC3C,GAAIiB,EAAK,QAAU,EAAG,CACpB,IAAMC,EAAWD,EAAK,CAAC,EAAG,QAAQ,EAC5BE,EAAmBb,EAAmBW,EAAK,CAAC,EAAG,QAAQ,CAAC,EAC1C,IAAI,IAAI,CAC1B,MACA,MACA,2BACA,4BACA,UACA,gBACF,CAAC,EAEa,IAAID,EAAc,CAAC,CAAE,IAChCE,IAAa,cAAgB/B,EAAgB,IAAI+B,CAAQ,IAC1DC,IAAqB,OACpBA,IAAqB,eACpB/B,EAAe,IAAI+B,CAAgB,IAErCf,EACEJ,EACA,KAAKgB,EAAc,CAAC,CAAC,IAAIA,EAAc,CAAC,CAAC,IAAIE,CAAQ,MAAMC,CAAgB,gCAC7E,CAEJ,CACF,CACF,CACF,CAAC,CACH,CAEA,SAASC,GACP7B,EACAC,EACAC,EACM,CACN,IAAMC,EAAaF,EAAQ,qBAAqBD,CAAS,EAKnD8B,EAAgB,IAAI,IAC1B,QAAW1B,KAAQD,EAAW,sBAAsB,EAAG,CACrD,QAAW4B,KAAK3B,EAAK,gBAAgB,EACnC0B,EAAc,IAAIC,EAAE,QAAQ,CAAC,EAE/B,IAAMC,EAAM5B,EAAK,iBAAiB,EAC9B4B,GAAKF,EAAc,IAAIE,EAAI,QAAQ,CAAC,EACxC,IAAMC,EAAK7B,EAAK,mBAAmB,EAC/B6B,GAAIH,EAAc,IAAIG,EAAG,QAAQ,CAAC,CACxC,CACA,QAAWC,KAAK/B,EAAW,wBAAwB,EACjD2B,EAAc,IAAII,EAAE,QAAQ,CAAC,EAE/B,QAAWC,KAAKhC,EAAW,aAAa,EAAG,CACzC,IAAMe,EAAOiB,EAAE,QAAQ,EACnBjB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CACA,QAAWkB,KAAKjC,EAAW,WAAW,EAAG,CACvC,IAAMe,EAAOkB,EAAE,QAAQ,EACnBlB,GAAMY,EAAc,IAAIZ,CAAI,CAClC,CAEAf,EAAW,kBAAmBM,GAAS,CACrC,GAAIA,EAAK,QAAQ,IAAMrB,EAAW,WAChC,OAEF,IAAM8B,EAAOT,EAAK,QAAQ,EAI1B,GAHIqB,EAAc,IAAIZ,CAAI,GAGtBtB,EAAgB,IAAIsB,CAAI,EAC1B,OAcF,IAAMR,EAASD,EAAK,UAAU,EAC9B,GAAIC,EAAQ,CACV,IAAM2B,EAAa3B,EAAO,QAAQ,EAqClC,GAnCI2B,IAAejD,EAAW,oBAE1BsB,EACA,cAAc,IACKD,GAKnB4B,IAAejD,EAAW,0BAE1BsB,EACA,cAAc,IACGD,GAKjB4B,IAAejD,EAAW,mBAK5BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,iBAC1BiD,IAAejD,EAAW,cAKxBiD,IAAejD,EAAW,WAK5BiD,IAAejD,EAAW,eAC1BiD,IAAejD,EAAW,UAE1B,MAEJ,CAEA,GAAIS,EAAe,IAAIqB,CAAI,EAAG,CAC5B,GAAM,CAAE,KAAAZ,EAAM,OAAAC,CAAO,EAAIJ,EAAW,sBAClCM,EAAK,SAAS,CAChB,EACAP,EAAO,KAAK,CACV,KAAMF,EACN,KAAAM,EACA,OAAAC,EACA,QAAS,eAAeW,CAAI,sDAC9B,CAAC,CACH,CAMF,CAAC,CACH,CAEO,SAASoB,EACdC,EACmB,CACnB,IAAMrC,EAA4B,CAAC,EAC7BD,EAAU,IAAId,GAAQ,CAC1B,sBAAuB,GACvB,gBAAiB,CACf,OAAQ,GACR,OAAQ,GACR,QAAS,GACT,OAAQ,EACV,CACF,CAAC,EAED,QAAWqD,KAAQD,EACjBtC,EAAQ,iBAAiBuC,EAAK,KAAMA,EAAK,OAAQ,CAAE,UAAW,EAAK,CAAC,EAGtE,QAAWA,KAAQD,EACjBxC,GAAayC,EAAK,KAAMvC,EAASC,CAAM,EACvCM,GAA4BgC,EAAK,KAAMvC,EAASC,CAAM,EACtDU,GAA2B4B,EAAK,KAAMvC,EAASC,CAAM,EACrD2B,GAAuBW,EAAK,KAAMvC,EAASC,CAAM,EAGnD,OAAOA,CACT,CCnhBA,IAAMuC,EAAoB,IACpBC,EAAY,GACZC,EAAY,cAElB,SAASC,GAAeC,EAA4C,CAClE,GAAIA,EAAM,OAASA,EAAM,OACvB,MAAM,IAAIC,EACR,4CACA,eACF,EAEF,GAAI,CAACD,EAAM,OAAS,CAACA,EAAM,OACzB,MAAM,IAAIC,EACR,uCACA,eACF,EAEF,IAAMC,EAA0BF,EAAM,MAClCA,EAAM,MACN,CAAC,CAAE,KAAMF,EAAW,OAAQE,EAAM,QAAU,EAAG,CAAC,EAEpD,GAAIE,EAAM,SAAW,EACnB,MAAM,IAAID,EAAa,uBAAwB,eAAe,EAEhE,GAAIC,EAAM,OAASL,EACjB,MAAM,IAAII,EACR,mBAAmBJ,CAAS,SAC5B,eACF,EAEF,IAAIM,EAAa,EACjB,QAAWC,KAAQF,EAAO,CACxB,GAAI,OAAOE,EAAK,MAAS,UAAYA,EAAK,KAAK,SAAW,EACxD,MAAM,IAAIH,EACR,wCACA,eACF,EAEF,GAAI,OAAOG,EAAK,QAAW,UAAYA,EAAK,OAAO,SAAW,EAC5D,MAAM,IAAIH,EACR,SAASG,EAAK,IAAI,qBAClB,eACF,EAEFD,GAAc,OAAO,WAAWC,EAAK,OAAQ,MAAM,CACrD,CACA,GAAID,EAAaP,EACf,MAAM,IAAIK,EACR,oBAAoBE,CAAU,eAAeP,CAAiB,IAC9D,eACF,EAGF,GAAI,CAACM,EAAM,KAAMG,GAAMA,EAAE,OAASP,CAAS,EACzC,MAAM,IAAIG,EACR,yBAAyBH,CAAS,kCAClC,eACF,EAEF,OAAOI,CACT,CAEA,eAAsBI,GACpBN,EACwB,CACxB,IAAIE,EACJ,GAAI,CACFA,EAAQH,GAAeC,CAAK,CAC9B,OAASO,EAAK,CACZ,GAAIA,aAAeN,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACM,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,IAAMC,EAAmBC,EAAqBP,CAAK,EACnD,GAAIM,EAAiB,OAAS,EAC5B,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQA,EAAiB,IACtBE,GAAM,GAAGA,EAAE,IAAI,IAAIA,EAAE,IAAI,IAAIA,EAAE,MAAM,WAAMA,EAAE,OAAO,EACvD,EACA,WAAY,EACZ,SAAU,EACZ,EAMF,IAAMC,EAAiBC,EAAsBV,CAAK,EAE9CW,EACJ,GAAI,CACFA,EAAU,MAAMC,EAAmBZ,CAAK,CAC1C,OAASK,EAAK,CACZ,GAAIA,aAAeQ,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACR,EAAI,OAAO,EACpB,WAAY,EACZ,SAAU,EACZ,EAEF,MAAMA,CACR,CAEA,GAAI,CAMF,OALe,MAAMS,EAAa,CAChC,cAAeH,EAAQ,OACvB,eAAAF,EACA,UAAWX,EAAM,SACnB,CAAC,CAEH,OAASO,EAAK,CACZ,GAAIA,aAAeU,EACjB,MAAO,CACL,KAAM,CAAC,EACP,MAAO,CAAC,EACR,QAAS,CAAC,EACV,OAAQ,CAACV,EAAI,OAAO,EACpB,WAAY,EACZ,SAAUA,EAAI,OAAS,SACzB,EAEF,MAAMA,CACR,CACF","names":["createRequire","pathToFileURL","build","resolveDirectivePackageToFileUrl","specifier","resolved","ENTRY_PATH","VIRTUAL_NAMESPACE","BundleError","message","cause","injectEarlyCapture","bundled","re","match","decl","capture","bundleSandboxFiles","files","f","fileMap","file","rawSource","b","args","importerDir","stripped","candidates","p","candidate","contents","epilogue","source","err","existsSync","mkdtempSync","rmSync","writeFileSync","tmpdir","dirname","join","fileURLToPath","pathToFileURL","Worker","MIN_TIMEOUT_MS","MAX_TIMEOUT_MS","DEFAULT_TIMEOUT_MS","resolveWorkerPath","staticUrl","path","createRequire","WorkerExecError","message","code","clampTimeout","value","raw","getTempBundleDir","osTmp","workerPath","writeBundleToTemp","bundledSource","baseDir","dir","bundlePath","execInWorker","input","timeoutMs","cleanupTempDir","worker","timer","timedOut","startMs","resolve","reject","settled","msg","err","findMatchingClose","source","openBrace","depth","i","ch","collectTopLevelKeys","block","keys","segStart","braceDepth","parenDepth","bracketDepth","flushSegment","end","seg","m","j","extractTopLevelKeys","sectionName","headerRe","headerMatch","closeBrace","extractDerivationKeys","files","seen","out","file","k","SandboxError","message","code","Project","SyntaxKind","ALLOWED_DIRECTIVE_PACKAGES","DENIED_DIRECTIVE_PACKAGES","extractDirectivePackage","specifier","match","isAllowedImport","dpkg","ALLOWED_GLOBALS","DENIED_GLOBALS","importRejectionMessage","checkImports","fileLabel","project","errors","sourceFile","decl","moduleSpecifier","line","column","checkDynamicImportsAndCalls","node","parent","text","checkPropertyAccessEscapes","report","message","stripStringLiteral","trimmed","kind","name","expression","argument","receiverText","argText","literal","exprText","reflectAccess","args","firstArg","secondArgLiteral","checkGlobalIdentifiers","localBindings","n","def","ns","v","f","c","parentKind","validateSandboxInput","files","file","MAX_PAYLOAD_BYTES","MAX_FILES","MAIN_PATH","normalizeInput","input","SandboxError","files","totalBytes","file","f","runInSandbox","err","validationErrors","validateSandboxInput","e","derivationKeys","extractDerivationKeys","bundled","bundleSandboxFiles","BundleError","execInWorker","WorkerExecError"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@directive-run/sandbox",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Execute Directive snippets server-side and return a structured transcript (logs + facts + errors). Consumed by @directive-run/mcp's run_in_sandbox tool and directive.run/playground's live DevTools panel. Uses worker_threads + esbuild bundling + an AST allowlist validator so user-supplied TypeScript runs with a bounded surface (allowlisted imports, allowlisted API calls, 5s wall clock, 32 MB heap).",
   "license": "(MIT OR Apache-2.0)",
   "author": "Jason Comes",