@fabric-harness/sdk 2.1.2 → 2.2.0

package/dist/policy.js

@@ -33,8 +33,12 @@ export function evaluateCommandPolicy(command, policy) {
     if (!policy || !command)
         return { allowed: true };
     const structured = evaluateNamedPolicy(command, policy.commandPolicy, 'command', policy);
-    if (structured)
+    if (structured) {
+        if (structured.allowed && policy.commandPolicy?.allow?.length && hasShellIndirection(command) && !policy.commandPolicy.allow.includes(command)) {
+            return { allowed: false, reason: `Command with shell operators requires an exact allow entry: ${command}` };
+        }
         return structured;
+    }
     const approvalPattern = firstMatchingPattern(command, policy.approvals?.requiredFor, { loose: true });
     if (approvalPattern) {
         return {
@@ -47,8 +51,12 @@ export function evaluateCommandPolicy(command, policy) {
     }
     if (!policy.commands || policy.commands.length === 0)
         return { allowed: true };
-    if (policy.commands.some((pattern) => matchesPattern(command, pattern, { loose: true })))
+    if (policy.commands.some((pattern) => matchesPattern(command, pattern, { loose: true }))) {
+        if (hasShellIndirection(command) && !policy.commands.includes(command)) {
+            return { allowed: false, reason: `Command with shell operators requires an exact allow entry: ${command}` };
+        }
         return { allowed: true };
+    }
     return { allowed: false, reason: `Command denied by policy: ${command}` };
 }
 /**
@@ -68,6 +76,9 @@ export function evaluateNetworkPolicy(input, policy) {
     if (network.mode === 'none') {
         return { allowed: false, reason: 'Network access denied by policy: mode=none' };
     }
+    if (network.allowPrivateNetwork !== true && isPrivateNetworkHost(url.hostname)) {
+        return { allowed: false, reason: `Private network host denied by policy: ${url.hostname}` };
+    }
     const host = url.host;
     if (network.mode === 'denylist') {
         const matched = firstMatchingPattern(host, network.hosts, { loose: true });
@@ -88,29 +99,103 @@ export function evaluateNetworkPolicy(input, policy) {
     // No mode configured and no hosts — fail-open (policy is purely a protocol filter).
     return { allowed: true };
 }
-/**
- * Wrap a `fetch`-like function with `CapabilityPolicy` enforcement. Tools and
- * connectors that make outbound HTTP should accept a custom `fetch` and pass
- * the result of `policiedFetch(fetch, policy)`.
- *
- * Throws a `FabricError` (`POLICY_DENIED`) when a request violates the policy;
- * never sends a forbidden request.
- */
-export function policiedFetch(fetchImpl, policy) {
+export function policiedFetch(fetchImpl, policy, options = {}) {
     if (!policy?.network)
         return fetchImpl;
     return (async (input, init) => {
-        const decision = evaluateNetworkPolicy(input, policy);
-        if (!decision.allowed) {
-            throw new FabricError({
-                code: 'POLICY_DENIED',
-                message: decision.reason ?? 'Network request denied by policy',
-                ...(decision.matchedPattern ? { details: { matchedPattern: decision.matchedPattern } } : {}),
-            });
+        let current = input;
+        let currentInit = init;
+        for (let redirects = 0; redirects <= 10; redirects += 1) {
+            assertNetworkAllowed(current, policy);
+            await assertDnsAnswersAllowed(current, policy, options);
+            const response = await fetchImpl(current, { ...currentInit, redirect: 'manual' });
+            if (![301, 302, 303, 307, 308].includes(response.status))
+                return response;
+            const location = response.headers.get('location');
+            if (!location)
+                return response;
+            if (redirects === 10)
+                throw new FabricError({ code: 'POLICY_DENIED', message: 'Network redirect limit exceeded.' });
+            const base = typeof current === 'string' ? current : current instanceof URL ? current.href : current.url;
+            current = new URL(location, base);
+            if (response.status === 303 || ((response.status === 301 || response.status === 302) && currentInit?.method?.toUpperCase() === 'POST')) {
+                const { body: _body, ...withoutBody } = currentInit ?? {};
+                currentInit = { ...withoutBody, method: 'GET' };
+            }
         }
-        return fetchImpl(input, init);
+        throw new FabricError({ code: 'POLICY_DENIED', message: 'Network redirect limit exceeded.' });
     });
 }
+async function assertDnsAnswersAllowed(input, policy, options) {
+    if (!policy.network?.resolveDns || policy.network.allowPrivateNetwork === true)
+        return;
+    const url = typeof input === 'string' ? new URL(input) : 'url' in input ? new URL(input.url) : input;
+    if (isIpAddress(url.hostname))
+        return;
+    const resolve = options.resolveHostname ?? defaultResolveHostname;
+    const addresses = await resolve(url.hostname);
+    if (addresses.length === 0) {
+        throw new FabricError({ code: 'POLICY_DENIED', message: `Network DNS resolution returned no addresses: ${url.hostname}` });
+    }
+    const privateAnswer = addresses.find(isPrivateNetworkHost);
+    if (privateAnswer) {
+        throw new FabricError({
+            code: 'POLICY_DENIED',
+            message: `Network DNS answer denied by policy: ${url.hostname} resolved to ${privateAnswer}`,
+        });
+    }
+}
+async function defaultResolveHostname(hostname) {
+    try {
+        const dns = await import('node:dns/promises');
+        return (await dns.lookup(hostname, { all: true, verbatim: true })).map((entry) => entry.address);
+    }
+    catch (error) {
+        throw new FabricError({
+            code: 'POLICY_DENIED',
+            message: `Network DNS verification failed for ${hostname}: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}
+function isIpAddress(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host) || host.includes(':');
+}
+function assertNetworkAllowed(input, policy) {
+    const decision = evaluateNetworkPolicy(input, policy);
+    if (decision.allowed)
+        return;
+    throw new FabricError({
+        code: 'POLICY_DENIED',
+        message: decision.reason ?? 'Network request denied by policy',
+        ...(decision.matchedPattern ? { details: { matchedPattern: decision.matchedPattern } } : {}),
+    });
+}
+function hasShellIndirection(command) {
+    return /(?:&&|\|\||[;|\n`]|\$\(|(?:^|\s)[<>](?:\s|$))/.test(command);
+}
+function isPrivateNetworkHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (host === 'localhost' || host.endsWith('.localhost') || host === '::1')
+        return true;
+    if (/^::ffff:\d{1,3}(?:\.\d{1,3}){3}$/.test(host))
+        return isPrivateNetworkHost(host.slice('::ffff:'.length));
+    const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (mapped?.[1] && mapped[2]) {
+        const high = Number.parseInt(mapped[1], 16);
+        const low = Number.parseInt(mapped[2], 16);
+        return isPrivateNetworkHost(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
+    }
+    if (/^(?:fc|fd)[0-9a-f]{2}:|^fe[89ab][0-9a-f]:/i.test(host))
+        return true;
+    const parts = host.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return false;
+    return parts[0] === 0 || parts[0] === 10 || parts[0] === 127 ||
+        (parts[0] === 169 && parts[1] === 254) ||
+        (parts[0] === 172 && (parts[1] ?? 0) >= 16 && (parts[1] ?? 0) <= 31) ||
+        (parts[0] === 192 && parts[1] === 168);
+}
 export function clampCommandTimeout(timeout, policy) {
     if (!policy?.maxCommandTimeoutMs)
         return timeout;

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA0GzC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACjG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAE9D,MAAM,UAAU,sBAAsB,CAAC,IAAc,EAAE,MAAyB;IAC9E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1D,OAAO,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACpG,OAAO,kBAAkB,CAAC,IAAI,EAAE;YAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5H,EAAE,yBAAyB,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;QAC3D,OAAO,kBAAkB,CAAC,IAAI,EAAE;YAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9H,EAAE,0BAA0B,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA2B,EAAE,MAAyB;IAC1F,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAElD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzF,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,kCAAkC,OAAO,EAAE;YACnD,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC;YACzD,cAAc,EAAE,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,OAAO,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA6B,EAAE,MAAyB;IAC5F,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAE,KAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,KAAa,CAAC;IAE3H,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QAClH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6FAA6F;IAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9G,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,oFAAoF;IACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAAuB,EAAE,MAAyB;IAC9E,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,KAAkC,EAAE,IAAkC,EAAE,EAAE;QACvF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAA+B,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,kCAAkC;gBAC9D,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC,KAAc,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC,CAAiB,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA2B,EAAE,MAAyB;IACxF,IAAI,CAAC,MAAM,EAAE,mBAAmB;QAAE,OAAO,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC;IAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAa,EACb,MAA8C,EAC9C,IAAwB,EACxB,gBAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,mEAAmE;IACnE,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxE,IAAI,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,sBAAsB,KAAK,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAClI,gFAAgF;IAChF,IAAI,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,IAAI;oBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACjB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;wBAC3C,CAAC,CAAC,yBAAyB,IAAI,KAAK,KAAK,cAAc,IAAI,CAAC,QAAQ,GAAG;oBACzE,IAAI,EAAE,gBAAgB,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACnG,cAAc,EAAE,IAAI,CAAC,OAAO;oBAC5B,gBAAgB,EAAE,IAAI,CAAC,QAAQ;oBAC/B,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACvF,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,yBAAyB,IAAI,KAAK,KAAK,EAAE;YACjD,IAAI,EAAE,gBAAgB,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnG,cAAc,EAAE,eAAe;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzE,IAAI,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,sBAAsB,KAAK,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,UAA6E,EAAE,YAAoB,EAAE,MAAwB,EAAE,MAAwB;IAC/L,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9F,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAC/E,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,yBAAyB,MAAM,UAAU,IAAI,EAAE;YACvD,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,cAAc,EAAE,eAAe;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjF,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,GAAW;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,QAA8B,EAAE,UAA+B,EAAE;IAC5G,OAAO,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,mIAAmI,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IACrK,IAAI,2EAA2E,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe,EAAE,UAA+B,EAAE;IACvF,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAK,GAAG,KAAK;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC;YACf,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA8GzC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACjG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAE9D,MAAM,UAAU,sBAAsB,CAAC,IAAc,EAAE,MAAyB;IAC9E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1D,OAAO,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACpG,OAAO,kBAAkB,CAAC,IAAI,EAAE;YAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5H,EAAE,yBAAyB,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;QAC3D,OAAO,kBAAkB,CAAC,IAAI,EAAE;YAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9H,EAAE,0BAA0B,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA2B,EAAE,MAAyB;IAC1F,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAElD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzF,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/I,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+DAA+D,OAAO,EAAE,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,kCAAkC,OAAO,EAAE;YACnD,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC;YACzD,cAAc,EAAE,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+DAA+D,OAAO,EAAE,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,OAAO,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA6B,EAAE,MAAyB;IAC5F,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAE,KAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,KAAa,CAAC;IAE3H,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QAClH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6FAA6F;IAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9G,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,oFAAoF;IACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAcD,MAAM,UAAU,aAAa,CAAC,SAAuB,EAAE,MAAyB,EAAE,UAAgC,EAAE;IAClH,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,KAAkC,EAAE,IAAkC,EAAE,EAAE;QACvF,IAAI,OAAO,GAA2B,KAAK,CAAC;QAC5C,IAAI,WAAW,GAAG,IAAI,CAAC;QACvB,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,IAAI,EAAE,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;YACxD,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAgB,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC/B,IAAI,SAAS,KAAK,EAAE;gBAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACpH,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACzG,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;gBACvI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,GAAG,WAAW,IAAI,EAAE,CAAC;gBAC1D,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAChG,CAAC,CAAiB,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAA6B,EAAE,MAAwB,EAAE,OAA6B;IAC3H,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,KAAK,IAAI;QAAE,OAAO;IACvF,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAE,KAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAY,CAAC;IACzH,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iDAAiD,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,wCAAwC,GAAG,CAAC,QAAQ,gBAAgB,aAAa,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,uCAAuC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACtH,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA6B,EAAE,MAAwB;IACnF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO;IAC7B,MAAM,IAAI,WAAW,CAAC;QACpB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,kCAAkC;QAC9D,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvF,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,oBAAoB,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChH,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;QAC1D,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QACtC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA2B,EAAE,MAAyB;IACxF,IAAI,CAAC,MAAM,EAAE,mBAAmB;QAAE,OAAO,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC;IAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAa,EACb,MAA8C,EAC9C,IAAwB,EACxB,gBAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,mEAAmE;IACnE,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxE,IAAI,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,sBAAsB,KAAK,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAClI,gFAAgF;IAChF,IAAI,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,IAAI;oBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACjB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;wBAC3C,CAAC,CAAC,yBAAyB,IAAI,KAAK,KAAK,cAAc,IAAI,CAAC,QAAQ,GAAG;oBACzE,IAAI,EAAE,gBAAgB,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACnG,cAAc,EAAE,IAAI,CAAC,OAAO;oBAC5B,gBAAgB,EAAE,IAAI,CAAC,QAAQ;oBAC/B,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACvF,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,yBAAyB,IAAI,KAAK,KAAK,EAAE;YACjD,IAAI,EAAE,gBAAgB,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnG,cAAc,EAAE,eAAe;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzE,IAAI,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,sBAAsB,KAAK,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,UAA6E,EAAE,YAAoB,EAAE,MAAwB,EAAE,MAAwB;IAC/L,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9F,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAC/E,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,yBAAyB,MAAM,UAAU,IAAI,EAAE;YACvD,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,cAAc,EAAE,eAAe;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjF,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,GAAW;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,QAA8B,EAAE,UAA+B,EAAE;IAC5G,OAAO,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,mIAAmI,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IACrK,IAAI,2EAA2E,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe,EAAE,UAA+B,EAAE;IACvF,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAK,GAAG,KAAK;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC;YACf,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC"}

package/dist/redaction.js

@@ -1,5 +1,5 @@
 const DEFAULT_SECRET_KEY_PATTERN = /(?:api[_-]?key|token|secret|password|passwd|credential|authorization|client[_-]?key|private[_-]?key|cert(?:ificate)?)/i;
-const DEFAULT_SECRET_VALUE_PATTERN = /(?:Bearer\s+[A-Za-z0-9._~+/=-]+|sk-[A-Za-z0-9]{16,}|[A-Za-z0-9_\-]{24,}\.[A-Za-z0-9_\-]{12,}\.[A-Za-z0-9_\-]{12,})/g;
+const DEFAULT_SECRET_VALUE_PATTERN = /(?:Bearer\s+[A-Za-z0-9._~+/=-]+|sk-[A-Za-z0-9]{8,}|(?:api[_-]?key|token|secret|password|credential)\s*(?:=|:|\bis\b)?\s+[A-Za-z0-9._~+/=-]{4,}|[A-Za-z0-9_\-]{24,}\.[A-Za-z0-9_\-]{12,}\.[A-Za-z0-9_\-]{12,})/gi;
 export function redactText(value, options = {}) {
     const replacement = options.replacement ?? '[REDACTED]';
     let redacted = value.replace(options.secretValuePattern ?? DEFAULT_SECRET_VALUE_PATTERN, replacement);

package/dist/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAEA,MAAM,0BAA0B,GAAG,wHAAwH,CAAC;AAC5J,MAAM,4BAA4B,GAAG,qHAAqH,CAAC;AAS3J,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,UAA4B,EAAE;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC;IACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,IAAI,4BAA4B,EAAE,WAAW,CAAC,CAAC;IACtG,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,MAAM;YAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAI,KAAQ,EAAE,UAA4B,EAAE;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IAEnC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,GAAY,EAAW,EAAE;QACrD,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC;QACpD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1G,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,KAAK,CAAC,KAAK,CAAM,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,UAA4B,EAAE;IACxE,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,OAAO,CAAe,CAAC;IAC7G,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAe,CAAC;AACrE,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAEA,MAAM,0BAA0B,GAAG,wHAAwH,CAAC;AAC5J,MAAM,4BAA4B,GAAG,iNAAiN,CAAC;AASvP,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,UAA4B,EAAE;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC;IACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,IAAI,4BAA4B,EAAE,WAAW,CAAC,CAAC;IACtG,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,MAAM;YAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAI,KAAQ,EAAE,UAA4B,EAAE;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IAEnC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,GAAY,EAAW,EAAE;QACrD,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC;QACpD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1G,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,KAAK,CAAC,KAAK,CAAM,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,UAA4B,EAAE;IACxE,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,OAAO,CAAe,CAAC;IAC7G,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAe,CAAC;AACrE,CAAC"}

package/dist/sandbox-ref.d.ts

@@ -16,6 +16,8 @@ export interface SandboxRef {
  * maps to a decoder registered via `registerSandboxRefDecoder()`.
  */
 export interface SerializedSandboxRef {
+    /** Stable identity used for ownership leases and audit correlation. */
+    referenceId?: string;
     /** Provider identifier — must match a registered decoder. */
     provider: string;
     /** Provider-specific routing data (sandbox/workspace/pod ID, region, etc.). */
@@ -26,9 +28,40 @@ export interface SerializedSandboxRef {
     capabilities?: SandboxCapabilities;
     /** Owner session id, for audit trails. */
     ownerSessionId?: string;
+    /** Tenant that owns this sandbox. Attach requires the same tenant when set. */
+    tenantId?: string;
     /** ISO timestamp of encoding. */
     encodedAt: string;
 }
+export type SandboxContinuityMode = 'reconnect' | 'snapshot' | 'restore' | 'fork' | 'none';
+export interface SandboxContinuityCapabilities {
+    reconnect: boolean;
+    snapshot: boolean;
+    restore: boolean;
+    fork: boolean;
+    modes: SandboxContinuityMode[];
+}
+/** Report the continuity operations that a backend or serialized ref can support. */
+export declare function negotiateSandboxContinuity(value: SandboxEnv | SandboxRef | SerializedSandboxRef): SandboxContinuityCapabilities;
+export interface SandboxOwnershipLeaseStore {
+    prepare?(): Promise<void>;
+    claim(key: string, ownerId: string, expiresAt: number, now: number): Promise<boolean>;
+    renew(key: string, ownerId: string, expiresAt: number, now: number): Promise<boolean>;
+    release(key: string, ownerId: string): Promise<void>;
+}
+export interface SandboxOwnershipOptions {
+    store: SandboxOwnershipLeaseStore;
+    /** Unique worker/replica identity. Reusing this value across workers defeats fencing. */
+    ownerId: string;
+    leaseMs?: number;
+    now?: () => number;
+}
+export interface AttachSandboxOptions {
+    tenantId?: string;
+    ownership?: SandboxOwnershipOptions;
+}
+/** Process-local lease store for tests and single-replica durable workers. */
+export declare function memorySandboxOwnershipLeaseStore(): SandboxOwnershipLeaseStore;
 /**
  * Decoder for a `SerializedSandboxRef.provider`. Returns a SandboxFactory
  * that, when invoked, produces a SandboxEnv connected to the existing
@@ -76,13 +109,15 @@ export declare function unregisterSandbox(refId: string): void;
  * require a decoder registered for `serialized.provider` via
  * `registerSandboxRefDecoder()`.
  */
-export declare function attachSandbox(ref: SandboxRef | SerializedSandboxRef): SandboxFactory;
+export declare function attachSandbox(ref: SandboxRef | SerializedSandboxRef, options?: AttachSandboxOptions): SandboxFactory;
 /**
  * Serialize an in-process `SandboxRef` into the cross-process form.
  * Requires the underlying sandbox to implement `encodeRef()`. Throws
  * `SANDBOX_UNAVAILABLE` if the backend is in-process-only.
  */
-export declare function serializeSandboxRef(ref: SandboxRef, ownerSessionId?: string): SerializedSandboxRef;
+export declare function serializeSandboxRef(ref: SandboxRef, ownerSessionId?: string, tenantId?: string): SerializedSandboxRef;
+/** Claim exclusive ownership of an already-connected portable sandbox. */
+export declare function claimSandboxOwnership(ref: SerializedSandboxRef, env: SandboxEnv, options: SandboxOwnershipOptions): Promise<SandboxEnv>;
 /** Test-only: clear the registry. */
 export declare function _resetSandboxRegistry(): void;
 //# sourceMappingURL=sandbox-ref.d.ts.map

package/dist/sandbox-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-ref.d.ts","sourceRoot":"","sources":["../src/sandbox-ref.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,mBAAmB,EACnB,UAAU,EAEV,cAAc,EAGf,MAAM,cAAc,CAAC;AAGtB,MAAM,WAAW,UAAU;IACzB,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,YAAY,EAAE,OAAO,EACrB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,mBAAmB,CAAA;CAAE,KACzD,cAAc,CAAC;AAIpB;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAE5F;AAED,uCAAuC;AACvC,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAElE;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAYD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,UAAU,CAgBtG;AAoBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,oBAAoB,GAAG,cAAc,CAkBpF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAyBlG;AAuED,qCAAqC;AACrC,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}
+{"version":3,"file":"sandbox-ref.d.ts","sourceRoot":"","sources":["../src/sandbox-ref.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,mBAAmB,EACnB,UAAU,EAEV,cAAc,EAGf,MAAM,cAAc,CAAC;AAGtB,MAAM,WAAW,UAAU;IACzB,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3F,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,oBAAoB,GACpD,6BAA6B,CAa/B;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,0BAA0B,CAAC;IAClC,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,IAAI,0BAA0B,CAmB7E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,YAAY,EAAE,OAAO,EACrB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,mBAAmB,CAAA;CAAE,KACzD,cAAc,CAAC;AAIpB;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAE5F;AAED,uCAAuC;AACvC,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAElE;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAYD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,UAAU,CAgBtG;AAoBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,oBAAoB,EAAE,OAAO,GAAE,oBAAyB,GAAG,cAAc,CAyBxH;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,oBAAoB,CA2BrH;AAED,0EAA0E;AAC1E,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,oBAAoB,EACzB,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,UAAU,CAAC,CAQrB;AAkKD,qCAAqC;AACrC,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}

package/dist/sandbox-ref.js

@@ -1,5 +1,49 @@
 import path from 'node:path';
 import { FabricError } from './error.js';
+/** Report the continuity operations that a backend or serialized ref can support. */
+export function negotiateSandboxContinuity(value) {
+    const capabilities = value.capabilities;
+    const reconnect = 'provider' in value || capabilities?.reconnect === true || ('encodeRef' in value && typeof value.encodeRef === 'function');
+    const snapshot = capabilities?.snapshots === true || ('snapshot' in value && typeof value.snapshot === 'function');
+    const restore = capabilities?.restore === true || ('restore' in value && typeof value.restore === 'function');
+    const fork = capabilities?.fork === true || ('fork' in value && typeof value.fork === 'function');
+    const modes = [];
+    if (reconnect)
+        modes.push('reconnect');
+    if (snapshot)
+        modes.push('snapshot');
+    if (restore)
+        modes.push('restore');
+    if (fork)
+        modes.push('fork');
+    if (modes.length === 0)
+        modes.push('none');
+    return { reconnect, snapshot, restore, fork, modes };
+}
+/** Process-local lease store for tests and single-replica durable workers. */
+export function memorySandboxOwnershipLeaseStore() {
+    const leases = new Map();
+    return {
+        async claim(key, ownerId, expiresAt, now) {
+            const current = leases.get(key);
+            if (current && current.expiresAt > now)
+                return false;
+            leases.set(key, { ownerId, expiresAt });
+            return true;
+        },
+        async renew(key, ownerId, expiresAt, now) {
+            const current = leases.get(key);
+            if (!current || current.ownerId !== ownerId || current.expiresAt <= now)
+                return false;
+            leases.set(key, { ownerId, expiresAt });
+            return true;
+        },
+        async release(key, ownerId) {
+            if (leases.get(key)?.ownerId === ownerId)
+                leases.delete(key);
+        },
+    };
+}
 const decoders = new Map();
 /**
  * Register a decoder for `provider` so `attachSandbox(serialized)` can
@@ -83,9 +127,10 @@ export function unregisterSandbox(refId) {
  * require a decoder registered for `serialized.provider` via
  * `registerSandboxRefDecoder()`.
  */
-export function attachSandbox(ref) {
+export function attachSandbox(ref, options = {}) {
     if ('provider' in ref) {
         const serialized = ref;
+        assertTenant(serialized, options.tenantId);
         const decoder = decoders.get(serialized.provider);
         if (!decoder) {
             throw new FabricError({
@@ -93,10 +138,16 @@ export function attachSandbox(ref) {
                 message: `No sandbox ref decoder registered for provider '${serialized.provider}'. Register one with registerSandboxRefDecoder('${serialized.provider}', ...) before calling attachSandbox().`,
             });
         }
-        return decoder(serialized.providerData, {
+        const decoded = decoder(serialized.providerData, {
             cwd: serialized.cwd,
             ...(serialized.capabilities ? { capabilities: serialized.capabilities } : {}),
         });
+        return async (factoryOptions = {}) => {
+            const env = await decoded(factoryOptions);
+            return options.ownership
+                ? claimSandboxOwnership(serialized, env, options.ownership)
+                : env;
+        };
     }
     return (_options = {}) => {
         return new AttachedSandboxEnv(ref);
@@ -107,7 +158,7 @@ export function attachSandbox(ref) {
  * Requires the underlying sandbox to implement `encodeRef()`. Throws
  * `SANDBOX_UNAVAILABLE` if the backend is in-process-only.
  */
-export function serializeSandboxRef(ref, ownerSessionId) {
+export function serializeSandboxRef(ref, ownerSessionId, tenantId) {
     const entry = lookupAlive(ref.id);
     if (!entry.env.encodeRef) {
         throw new FabricError({
@@ -123,6 +174,7 @@ export function serializeSandboxRef(ref, ownerSessionId) {
         });
     }
     const serialized = {
+        referenceId: portableReferenceId(encoded.provider, encoded.providerData, ownerSessionId ?? entry.ownerSessionId),
         provider: encoded.provider,
         providerData: encoded.providerData,
         cwd: ref.cwd,
@@ -133,8 +185,117 @@ export function serializeSandboxRef(ref, ownerSessionId) {
     const owner = ownerSessionId ?? entry.ownerSessionId;
     if (owner)
         serialized.ownerSessionId = owner;
+    if (tenantId)
+        serialized.tenantId = tenantId;
     return serialized;
 }
+/** Claim exclusive ownership of an already-connected portable sandbox. */
+export async function claimSandboxOwnership(ref, env, options) {
+    const now = options.now ?? Date.now;
+    const leaseMs = Math.max(1, options.leaseMs ?? 60_000);
+    await options.store.prepare?.();
+    const referenceId = serializedReferenceId(ref);
+    const claimed = await options.store.claim(referenceId, options.ownerId, now() + leaseMs, now());
+    if (!claimed)
+        throw ownershipError(referenceId);
+    return new OwnedSandboxEnv(ref, env, options, leaseMs, now);
+}
+class OwnedSandboxEnv {
+    ref;
+    env;
+    ownership;
+    leaseMs;
+    now;
+    cwd;
+    capabilities;
+    constructor(ref, env, ownership, leaseMs, now) {
+        this.ref = ref;
+        this.env = env;
+        this.ownership = ownership;
+        this.leaseMs = leaseMs;
+        this.now = now;
+        this.cwd = env.cwd;
+        if (env.capabilities)
+            this.capabilities = env.capabilities;
+    }
+    async owned(operation) {
+        const current = this.now();
+        const referenceId = serializedReferenceId(this.ref);
+        const renewed = await this.ownership.store.renew(referenceId, this.ownership.ownerId, current + this.leaseMs, current);
+        if (!renewed)
+            throw ownershipError(referenceId);
+        return operation();
+    }
+    exec(command, options) { return this.owned(() => this.env.exec(command, options)); }
+    readFile(p) { return this.owned(() => this.env.readFile(p)); }
+    readFileBuffer(p) { return this.owned(() => this.env.readFileBuffer(p)); }
+    writeFile(p, content) { return this.owned(() => this.env.writeFile(p, content)); }
+    stat(p) { return this.owned(() => this.env.stat(p)); }
+    readdir(p) { return this.owned(() => this.env.readdir(p)); }
+    exists(p) { return this.owned(() => this.env.exists(p)); }
+    mkdir(p, options) { return this.owned(() => this.env.mkdir(p, options)); }
+    rm(p, options) { return this.owned(() => this.env.rm(p, options)); }
+    resolvePath(p) { return this.env.resolvePath(p); }
+    snapshot() { return this.owned(async () => { if (!this.env.snapshot)
+        throw unsupported('snapshot'); return this.env.snapshot(); }); }
+    restore(snapshot) { return this.owned(async () => { if (!this.env.restore)
+        throw unsupported('restore'); await this.env.restore(snapshot); }); }
+    fork(snapshot) { return this.owned(async () => { if (!this.env.fork)
+        throw unsupported('fork'); return this.env.fork(snapshot); }); }
+    suspend() { return this.owned(async () => { if (!this.env.suspend)
+        throw unsupported('suspend'); await this.env.suspend(); }); }
+    resume() { return this.owned(async () => { if (!this.env.resume)
+        throw unsupported('resume'); await this.env.resume(); }); }
+    encodeRef() { return this.env.encodeRef?.(); }
+    __runWithPolicyApproval(call, operation) {
+        return this.owned(() => this.env.__runWithPolicyApproval ? this.env.__runWithPolicyApproval(call, operation) : operation());
+    }
+    async cleanup() {
+        await this.ownership.store.release(serializedReferenceId(this.ref), this.ownership.ownerId);
+        await this.env.cleanup();
+    }
+}
+function assertTenant(ref, tenantId) {
+    if (ref.tenantId === undefined)
+        return;
+    if (tenantId === ref.tenantId)
+        return;
+    throw new FabricError({
+        code: 'POLICY_DENIED',
+        message: `Sandbox reference belongs to tenant '${ref.tenantId}' and cannot be attached by tenant '${tenantId ?? '(unset)'}'.`,
+        publicMessage: 'Sandbox reference is not available to this tenant.',
+    });
+}
+function portableReferenceId(provider, providerData, ownerSessionId) {
+    const serialized = stableStringify(providerData);
+    let hash = 2166136261;
+    for (const char of `${provider}\u0000${serialized}\u0000${ownerSessionId ?? ''}`) {
+        hash ^= char.charCodeAt(0);
+        hash = Math.imul(hash, 16777619);
+    }
+    return `sbx-${provider}-${(hash >>> 0).toString(16).padStart(8, '0')}`;
+}
+function serializedReferenceId(ref) {
+    return ref.referenceId ?? portableReferenceId(ref.provider, ref.providerData, ref.ownerSessionId);
+}
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'undefined';
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(',')}]`;
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, child]) => `${JSON.stringify(key)}:${stableStringify(child)}`).join(',')}}`;
+}
+function ownershipError(referenceId) {
+    return new FabricError({
+        code: 'SANDBOX_UNAVAILABLE',
+        message: `Sandbox ownership lease is held by another worker or expired: ${referenceId}.`,
+        publicMessage: 'Sandbox is currently owned by another worker.',
+        retryable: true,
+    });
+}
+function unsupported(operation) {
+    return new FabricError({ code: 'SANDBOX_UNAVAILABLE', message: `Underlying sandbox does not support ${operation}.` });
+}
 class AttachedSandboxEnv {
     ref;
     cwd;

package/dist/sandbox-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-ref.js","sourceRoot":"","sources":["../src/sandbox-ref.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyDzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAA0B;IACpF,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9B,CAAC;AASD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAClD,IAAI,SAAS,GAAG,CAAC,CAAC;AAElB;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,UAAuC,EAAE;IACxF,2DAA2D;IAC3D,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAkB;QAC3B,GAAG;QACH,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5F,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,iGAAiG;AACjG,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0BAA0B,KAAK,sEAAsE;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,eAAe,KAAK,0CAA0C;SACxE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,0EAA0E;IAC1E,2EAA2E;IAC3E,wDAAwD;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,GAAsC;IAClE,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,mDAAmD,UAAU,CAAC,QAAQ,mDAAmD,UAAU,CAAC,QAAQ,yCAAyC;aAC/L,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE;YACtC,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,WAAkC,EAAE,EAAE,EAAE;QAC9C,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAe,EAAE,cAAuB;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,uDAAuD,GAAG,CAAC,EAAE,iDAAiD;SACxH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,yDAAyD,GAAG,CAAC,EAAE,wCAAwC;SACjH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAyB;QACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,GAAG,CAAC,YAAY;QAAE,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACjE,MAAM,KAAK,GAAG,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,KAAK;QAAE,UAAU,CAAC,cAAc,GAAG,KAAK,CAAC;IAC7C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,kBAAkB;IAKO;IAJpB,GAAG,CAAS;IACZ,YAAY,CAAuB;IAC3B,eAAe,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAEvE,YAA6B,GAAe;QAAf,QAAG,GAAH,GAAG,CAAY;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACnB,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QACvE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED,IAAY,GAAG;QACb,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IACtC,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAA4B,IAA0B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3H,KAAK,CAAC,QAAQ,CAAC,CAAS,IAAqB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,cAAc,CAAC,CAAS,IAAyB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,KAAK,CAAC,SAAS,CAAC,CAAS,EAAE,OAA4B,IAAmB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjH,KAAK,CAAC,IAAI,CAAC,CAAS,IAAuB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,OAAO,CAAC,CAAS,IAAuB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,MAAM,CAAC,CAAS,IAAsB,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,KAAK,CAAC,CAAS,EAAE,OAAiC,IAAmB,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9G,KAAK,CAAC,EAAE,CAAC,CAAS,EAAE,OAAkD,IAAmB,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEzH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACzI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QACvI,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAyB;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACjI,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QACvI,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACrI,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,4EAA4E;QAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,KAAoB;IAChD,MAAM,GAAG,GAAe,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IACnD,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,qBAAqB;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC"}
+{"version":3,"file":"sandbox-ref.js","sourceRoot":"","sources":["../src/sandbox-ref.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA0DzC,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CACxC,KAAqD;IAErD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,IAAI,KAAK,IAAI,YAAY,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC;IAC7I,MAAM,QAAQ,GAAG,YAAY,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG,YAAY,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAClG,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAsBD,8EAA8E;AAC9E,MAAM,UAAU,gCAAgC;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkD,CAAC;IACzE,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG;YACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG;YACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG;gBAAE,OAAO,KAAK,CAAC;YACtF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO;YACxB,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAA0B;IACpF,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9B,CAAC;AASD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAClD,IAAI,SAAS,GAAG,CAAC,CAAC;AAElB;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,UAAuC,EAAE;IACxF,2DAA2D;IAC3D,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAkB;QAC3B,GAAG;QACH,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5F,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,iGAAiG;AACjG,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0BAA0B,KAAK,sEAAsE;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,eAAe,KAAK,0CAA0C;SACxE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,0EAA0E;IAC1E,2EAA2E;IAC3E,wDAAwD;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,GAAsC,EAAE,UAAgC,EAAE;IACtG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,CAAC;QACvB,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,mDAAmD,UAAU,CAAC,QAAQ,mDAAmD,UAAU,CAAC,QAAQ,yCAAyC;aAC/L,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE;YAC/C,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,OAAO,KAAK,EAAE,iBAAwC,EAAE,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;YAC1C,OAAO,OAAO,CAAC,SAAS;gBACtB,CAAC,CAAC,qBAAqB,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC;gBAC3D,CAAC,CAAC,GAAG,CAAC;QACV,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,WAAkC,EAAE,EAAE,EAAE;QAC9C,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAe,EAAE,cAAuB,EAAE,QAAiB;IAC7F,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,uDAAuD,GAAG,CAAC,EAAE,iDAAiD;SACxH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,yDAAyD,GAAG,CAAC,EAAE,wCAAwC;SACjH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAyB;QACvC,WAAW,EAAE,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC;QAChH,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,GAAG,CAAC,YAAY;QAAE,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACjE,MAAM,KAAK,GAAG,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,KAAK;QAAE,UAAU,CAAC,cAAc,GAAG,KAAK,CAAC;IAC7C,IAAI,QAAQ;QAAE,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAyB,EACzB,GAAe,EACf,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,OAAO;QAAE,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,eAAe;IAKA;IACA;IACA;IACA;IACA;IARV,GAAG,CAAS;IACZ,YAAY,CAAuB;IAE5C,YACmB,GAAyB,EACzB,GAAe,EACf,SAAkC,EAClC,OAAe,EACf,GAAiB;QAJjB,QAAG,GAAH,GAAG,CAAsB;QACzB,QAAG,GAAH,GAAG,CAAY;QACf,cAAS,GAAT,SAAS,CAAyB;QAClC,YAAO,GAAP,OAAO,CAAQ;QACf,QAAG,GAAH,GAAG,CAAc;QAElC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACnB,IAAI,GAAG,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAI,SAA2B;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvH,IAAI,CAAC,OAAO;YAAE,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,OAA4B,IAA0B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvI,QAAQ,CAAC,CAAS,IAAqB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,cAAc,CAAC,CAAS,IAAyB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,SAAS,CAAC,CAAS,EAAE,OAA4B,IAAmB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAS,IAAuB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,CAAS,IAAuB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,CAAS,IAAsB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,CAAC,CAAS,EAAE,OAAiC,IAAmB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3H,EAAE,CAAC,CAAS,EAAE,OAAkD,IAAmB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,WAAW,CAAC,CAAS,IAAY,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,QAAQ,KAA+B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/J,OAAO,CAAC,QAAyB,IAAmB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChL,IAAI,CAAC,QAAyB,IAAyB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3K,OAAO,KAAoB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/I,MAAM,KAAoB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,SAAS,KAA8D,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACvG,uBAAuB,CAAI,IAAmC,EAAE,SAA2B;QACzF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5F,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,YAAY,CAAC,GAAyB,EAAE,QAA4B;IAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO;IACvC,IAAI,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO;IACtC,MAAM,IAAI,WAAW,CAAC;QACpB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,wCAAwC,GAAG,CAAC,QAAQ,uCAAuC,QAAQ,IAAI,SAAS,IAAI;QAC7H,aAAa,EAAE,oDAAoD;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,YAAqB,EAAE,cAAuB;IAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,GAAG,QAAQ,SAAS,UAAU,SAAS,cAAc,IAAI,EAAE,EAAE,EAAE,CAAC;QACjF,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAyB;IACtD,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC;IAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5L,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB;IACzC,OAAO,IAAI,WAAW,CAAC;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,iEAAiE,WAAW,GAAG;QACxF,aAAa,EAAE,+CAA+C;QAC9D,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,uCAAuC,SAAS,GAAG,EAAE,CAAC,CAAC;AACxH,CAAC;AAED,MAAM,kBAAkB;IAKO;IAJpB,GAAG,CAAS;IACZ,YAAY,CAAuB;IAC3B,eAAe,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAEvE,YAA6B,GAAe;QAAf,QAAG,GAAH,GAAG,CAAY;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACnB,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QACvE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED,IAAY,GAAG;QACb,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IACtC,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAA4B,IAA0B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3H,KAAK,CAAC,QAAQ,CAAC,CAAS,IAAqB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,cAAc,CAAC,CAAS,IAAyB,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,KAAK,CAAC,SAAS,CAAC,CAAS,EAAE,OAA4B,IAAmB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjH,KAAK,CAAC,IAAI,CAAC,CAAS,IAAuB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,OAAO,CAAC,CAAS,IAAuB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,MAAM,CAAC,CAAS,IAAsB,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,KAAK,CAAC,CAAS,EAAE,OAAiC,IAAmB,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9G,KAAK,CAAC,EAAE,CAAC,CAAS,EAAE,OAAkD,IAAmB,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEzH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACzI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QACvI,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAyB;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACjI,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QACvI,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACrI,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,4EAA4E;QAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,KAAoB;IAChD,MAAM,GAAG,GAAe,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IACnD,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,qBAAqB;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC"}

package/dist/sandbox.d.ts

@@ -23,6 +23,10 @@ export interface SandboxExecOptions {
     env?: Record<string, string>;
     timeout?: number;
     signal?: AbortSignal;
+    /** Receives stdout chunks while the provider is executing the command. */
+    onStdout?: (chunk: string) => void;
+    /** Receives stderr chunks while the provider is executing the command. */
+    onStderr?: (chunk: string) => void;
 }
 export interface SandboxCapabilities {
     exec: boolean;
@@ -30,12 +34,23 @@ export interface SandboxCapabilities {
     binaryFiles: boolean;
     snapshots: boolean;
     restore: boolean;
+    /** True when a portable reference can reconnect to the same running sandbox. */
+    reconnect?: boolean;
     /** True when the sandbox can be forked from a snapshot into independent branches. */
     fork?: boolean;
     /** True when the sandbox can be suspended (paused) and later resumed without losing state. */
     suspend?: boolean;
     resume?: boolean;
     network: 'none' | 'restricted' | 'egress' | 'provider-managed';
+    /**
+     * Strongest layer that enforces the advertised network restriction.
+     * `process` policy is defense in depth only: code running in the sandbox can
+     * bypass it with a direct socket. Production allowlists should use a
+     * container, cluster, or provider boundary.
+     */
+    networkEnforcement?: 'none' | 'process' | 'container' | 'cluster' | 'provider';
+    /** Non-secret operator reference, such as a Docker network or NetworkPolicy name. */
+    networkBoundary?: string;
     persistence: 'ephemeral' | 'session' | 'durable';
     isolation: 'process' | 'container' | 'microvm' | 'provider';
 }
@@ -88,6 +103,8 @@ export interface SandboxEnv {
         provider: string;
         providerData: unknown;
     } | undefined;
+    /** @internal Scoped grant used only after the session approval machinery resolves a call. */
+    __runWithPolicyApproval?<T>(call: import('./tools.js').ToolCall, operation: () => Promise<T>): Promise<T>;
     cleanup(): Promise<void>;
 }
 export interface SandboxFactoryOptions {
@@ -236,6 +253,15 @@ export interface DockerSandboxOptions {
     image?: string;
     env?: Record<string, string>;
     network?: 'none' | 'bridge' | 'host' | string | boolean;
+    /**
+     * Assert that a named Docker network is `--internal` and routes outbound
+     * traffic only through an independently enforced egress proxy. Ignored for
+     * `network=none`, which is already enforced by Docker.
+     */
+    networkBoundary?: {
+        enforcement: 'container';
+        reference: string;
+    };
     user?: string;
     cpus?: string | number;
     memory?: string;