@nebutra/agent-runtime 0.2.2 → 3.0.0

package/dist/pulsar.js

@@ -2,12 +2,12 @@ import {
   Pulsar,
   PulsarBuilder,
   PulsarThread
-} from "./chunk-KCNN4QUQ.js";
+} from "./chunk-5UGIUYJR.js";
 import "./chunk-D4YAPLOW.js";
 import "./chunk-37BBB2P2.js";
-import "./chunk-4Y25ZTKI.js";
 import "./chunk-6EGG2OZC.js";
 import "./chunk-CGRCUKGT.js";
+import "./chunk-4Y25ZTKI.js";
 import "./chunk-424PT5DM.js";
 export {
   Pulsar,

package/dist/sandbox-DfcRttXt.d.ts

@@ -0,0 +1,219 @@
+import { CapabilityPolicy } from './policy.js';
+
+/**
+ * Carina native transport: newline-delimited JSON-RPC 2.0 over a Unix socket
+ * (same wire as @carina/sdk and `carina-daemon -socket`).
+ *
+ * Node-only — not for edge runtimes without `node:net`.
+ */
+declare const defaultCarinaSocketPath: () => string;
+/** Production co-deploy layout on the Sailor ECS api host. */
+declare const CODEPLOY_CARINA_SOCKET_PATH = "/var/carina/run/daemon.sock";
+declare const CODEPLOY_CARINA_WORKSPACE_ROOT = "/var/carina/ws";
+declare const CODEPLOY_CARINA_STATE_DIR = "/var/carina/state";
+declare const CODEPLOY_CARINA_BIN_DIR = "/var/carina/bin";
+declare class CarinaNdjsonError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+type NdjsonRpcClient = {
+    call: <T>(method: string, params: Record<string, unknown>) => Promise<T>;
+    close: () => void;
+};
+/**
+ * Create a reusable NDJSON JSON-RPC client for a Carina unix socket.
+ */
+declare function createCarinaNdjsonClient(socketPath: string, callTimeoutMs?: number): NdjsonRpcClient;
+
+/**
+ * External-sandbox delegation seam (PORT — capability #11).
+ *
+ * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant
+ * web runtime NEVER executes untrusted code itself and introduces no isolation
+ * infrastructure. It only:
+ *   1. carries the capability policy (see ./policy),
+ *   2. delegates execution to an external isolator behind this interface
+ *      (Track B = **Carina** upstream kernel),
+ *   3. records the outcome as a `command_execution` item (see ./model).
+ *
+ * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows
+ * restricted token) are deliberately NOT ported — they are single-host and
+ * out of scope for a multi-tenant web product.
+ *
+ * @see docs/architecture/2026-08-03-carina-track-b-upstream.md
+ */
+
+interface SandboxExecRequest {
+    /** Mandatory tenant scope — every delegated exec is tenant-bound. */
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly command: string;
+    /** The capabilities the external isolator must honor. */
+    readonly capabilityPolicy: CapabilityPolicy;
+    /** Optional inputs the executor should materialize before running. */
+    readonly inputs?: Readonly<Record<string, string>>;
+}
+interface SandboxExecResult {
+    readonly exitCode: number;
+    readonly aggregatedOutput: string;
+    /** Identifier of the isolator that actually ran the command. */
+    readonly executedOn: string;
+    /** Carina permission decision id when present (audit correlation). */
+    readonly decisionId?: string;
+    /** Host correlation id sent on the wire (JSON-RPC id or extension). */
+    readonly correlationId?: string;
+}
+/**
+ * The only thing Track A depends on for execution. Implemented by a decoupled
+ * isolator over Carina's public RPC catalog; never implemented in-process here.
+ */
+interface ExternalSandbox {
+    exec(request: SandboxExecRequest): Promise<SandboxExecResult>;
+}
+/**
+ * Fail-closed default. Wiring this in production requires a real
+ * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.
+ */
+declare class NoExecutorConfiguredError extends Error {
+    constructor();
+}
+declare const REFUSING_SANDBOX: ExternalSandbox;
+declare class SandboxDelegationError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+declare class CarinaProtocolError extends Error {
+    constructor(message: string);
+}
+/**
+ * Generic HTTP POST of a Sailor-shaped body. Prefer {@link createCarinaSandbox}
+ * for production Track B — Carina owns the kernel and speaks JSON-RPC.
+ */
+declare function createHttpSandbox(baseUrl: string, fetchImpl?: typeof fetch, path?: string): ExternalSandbox;
+/** Minimum `protocol_version` we accept from `gateway.hello` (Carina catalog). */
+declare const CARINA_MIN_PROTOCOL_VERSION = 1;
+type CarinaSandboxOptions = {
+    /**
+     * HTTP JSON-RPC base URL (optional if {@link socketPath} is set).
+     * Prefer unix socket co-deploy on the same host as the gateway.
+     */
+    readonly baseUrl?: string;
+    /**
+     * Native Carina unix socket path (NDJSON JSON-RPC). Preferred for same-host
+     * co-deploy — full command.exec authority (TCP diagnostic is read-limited).
+     */
+    readonly socketPath?: string;
+    /**
+     * Gateway token for HTTP transport only. Never a local owner unlock token.
+     */
+    readonly token?: string;
+    readonly fetchImpl?: typeof fetch;
+    /**
+     * Path under baseUrl for JSON-RPC POST. Default `""` posts to baseUrl itself.
+     */
+    readonly rpcPath?: string;
+    /** Fail closed if hello reports a lower protocol_version. Default {@link CARINA_MIN_PROTOCOL_VERSION}. */
+    readonly minProtocolVersion?: number;
+    /** Skip gateway.hello (tests only). Production should leave this false. */
+    readonly skipHello?: boolean;
+    /** Label when the wire body has no node id. */
+    readonly executedOn?: string;
+    /** Map Sailor thread → Carina `session_id`. Default: `threadId`. */
+    readonly resolveSessionId?: (request: SandboxExecRequest) => string;
+    /**
+     * Optional client metadata sent on hello (discovery only — not an auth grant).
+     */
+    readonly clientId?: string;
+    /**
+     * When true, `command.exec` that returns `requires_approval` will call
+     * `governance.approval.resolve` (approve=true) once and retry. Default false
+     * (fail closed). Operators set via CARINA_AUTO_APPROVE=1 for unattended nodes.
+     */
+    readonly autoApproveOnRequire?: boolean;
+};
+type CarinaEnsureSessionRequest = {
+    /** Sailor thread id — used as cache key and default correlation. */
+    readonly threadId: string;
+    /** Absolute workspace path on the Carina host (catalog-required). */
+    readonly workspaceRoot: string;
+    readonly tenantId?: string;
+    readonly profile?: string;
+    /** Carina session approval_mode when supported by the daemon. */
+    readonly approvalMode?: string;
+};
+/**
+ * Track-B handle: {@link ExternalSandbox} plus host session lifecycle.
+ * `command.exec` requires a Carina session; call {@link CarinaSandbox.ensureSession}
+ * before the first exec for a thread (or let {@link registerCommandExecTool} do it).
+ */
+type CarinaApprovalResolveRequest = {
+    readonly decisionId: string;
+    readonly approve: boolean;
+    readonly approver?: string;
+    readonly scope?: "once" | "session" | "project";
+};
+interface CarinaSandbox extends ExternalSandbox {
+    /**
+     * Create (or reuse cached) Carina session for a Sailor thread.
+     * Maps `threadId` → Carina `session_id` for subsequent `command.exec`.
+     */
+    ensureSession(request: CarinaEnsureSessionRequest): Promise<string>;
+    /** Peek cached Carina session id for a Sailor thread, if any. */
+    resolveMappedSessionId(threadId: string): string | undefined;
+    /**
+     * Host HITL: map product approve/deny → Carina `governance.approval.resolve`.
+     */
+    resolveApproval(request: CarinaApprovalResolveRequest): Promise<unknown>;
+    /** Lightweight connectivity probe (`gateway.hello`). */
+    probe(): Promise<{
+        protocolVersion: number;
+        ok: true;
+    }>;
+}
+/**
+ * Track-B adapter: Sailor control plane → **Carina** public RPC catalog (v0.8.x).
+ *
+ * Mapping (Sailor → Carina, never the reverse ownership):
+ * - `threadId` → `command.exec` `session_id` (via ensureSession cache, else threadId)
+ * - `command` → `argv` via `/bin/sh -c` (kernel still gates the joined command string)
+ * - denied / requires_approval → {@link SandboxDelegationError} (fail closed)
+ * - allowed + CommandResult → {@link SandboxExecResult}
+ * - host lifecycle → `session.create` via {@link CarinaSandbox.ensureSession}
+ *
+ * Kernel protocol is maintained in `Nebutra/carina`. This file only maps.
+ *
+ * @see docs/architecture/2026-08-03-carina-track-b-upstream.md
+ */
+declare function createCarinaSandbox(options: CarinaSandboxOptions): CarinaSandbox;
+/** Guard: reject the most dangerous posture unless explicitly opted in. */
+declare function assertSafePosture(policy: CapabilityPolicy, allowDanger?: boolean): void;
+/** Env bag for Carina host config. Compatible with `process.env`. */
+type CarinaEnv = Readonly<Record<string, string | undefined>>;
+/**
+ * Resolve workspace path for a tenant/thread.
+ * Order: CARINA_WORKSPACE_MAP[tenant] → TEMPLATE → CARINA_WORKSPACE_ROOT.
+ */
+declare function resolveCarinaWorkspaceRoot(tenantId: string, env?: CarinaEnv, threadId?: string): string | undefined;
+/**
+ * Co-deploy is on unless explicitly disabled (`CARINA_CODEPLOY=0|false`).
+ * Same-host default: unix socket {@link CODEPLOY_CARINA_SOCKET_PATH}.
+ */
+declare function isCarinaCodeployEnabled(env?: CarinaEnv): boolean;
+/**
+ * Resolve Track-B sandbox from environment.
+ *
+ * Priority:
+ * 1. `CARINA_JSONRPC_URL` → HTTP JSON-RPC
+ * 2. `CARINA_DAEMON_SOCK` → unix NDJSON
+ * 3. co-deploy default → {@link CODEPLOY_CARINA_SOCKET_PATH}
+ * 4. developer home socket → `~/.carina/daemon.sock` when co-deploy and no prod path intent
+ * 5. otherwise {@link REFUSING_SANDBOX}
+ */
+declare function resolveCarinaSandboxFromEnv(env?: CarinaEnv, overrides?: Partial<CarinaSandboxOptions>): ExternalSandbox;
+/** Default workspace when co-deploy is enabled and no override is set. */
+declare function resolveCarinaWorkspaceRootWithCodeploy(tenantId: string, env?: CarinaEnv, threadId?: string): string | undefined;
+declare function isCarinaSandbox(sandbox: ExternalSandbox): sandbox is CarinaSandbox;
+
+export { CARINA_MIN_PROTOCOL_VERSION as C, type ExternalSandbox as E, type NdjsonRpcClient as N, REFUSING_SANDBOX as R, SandboxDelegationError as S, CODEPLOY_CARINA_BIN_DIR as a, CODEPLOY_CARINA_SOCKET_PATH as b, CODEPLOY_CARINA_STATE_DIR as c, CODEPLOY_CARINA_WORKSPACE_ROOT as d, type CarinaApprovalResolveRequest as e, type CarinaEnsureSessionRequest as f, type CarinaEnv as g, CarinaNdjsonError as h, CarinaProtocolError as i, type CarinaSandbox as j, type CarinaSandboxOptions as k, NoExecutorConfiguredError as l, type SandboxExecRequest as m, type SandboxExecResult as n, assertSafePosture as o, createCarinaNdjsonClient as p, createCarinaSandbox as q, createHttpSandbox as r, defaultCarinaSocketPath as s, isCarinaCodeployEnabled as t, isCarinaSandbox as u, resolveCarinaSandboxFromEnv as v, resolveCarinaWorkspaceRoot as w, resolveCarinaWorkspaceRootWithCodeploy as x };

package/dist/sandbox.d.ts

@@ -1,65 +1,3 @@
-import { CapabilityPolicy } from './policy.js';
+import './policy.js';
+export { C as CARINA_MIN_PROTOCOL_VERSION, b as CODEPLOY_CARINA_SOCKET_PATH, d as CODEPLOY_CARINA_WORKSPACE_ROOT, e as CarinaApprovalResolveRequest, f as CarinaEnsureSessionRequest, g as CarinaEnv, i as CarinaProtocolError, j as CarinaSandbox, k as CarinaSandboxOptions, E as ExternalSandbox, l as NoExecutorConfiguredError, R as REFUSING_SANDBOX, S as SandboxDelegationError, m as SandboxExecRequest, n as SandboxExecResult, o as assertSafePosture, q as createCarinaSandbox, r as createHttpSandbox, s as defaultCarinaSocketPath, t as isCarinaCodeployEnabled, u as isCarinaSandbox, v as resolveCarinaSandboxFromEnv, w as resolveCarinaWorkspaceRoot, x as resolveCarinaWorkspaceRootWithCodeploy } from './sandbox-DfcRttXt.js';
 import 'zod';
-
-/**
- * External-sandbox delegation seam (PORT — capability #11).
- *
- * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant
- * web runtime NEVER executes untrusted code itself and introduces no isolation
- * infrastructure. It only:
- *   1. carries the capability policy (see ./policy),
- *   2. delegates execution to an external isolator behind this interface
- *      (a self-hosted kernel sidecar — Track B — or any other executor),
- *   3. records the outcome as a `command_execution` item (see ./model).
- *
- * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows
- * restricted token) are deliberately NOT ported — they are single-host and
- * out of scope for a multi-tenant web product.
- */
-
-interface SandboxExecRequest {
-    /** Mandatory tenant scope — every delegated exec is tenant-bound. */
-    readonly tenantId: string;
-    readonly threadId: string;
-    readonly command: string;
-    /** The capabilities the external isolator must honor. */
-    readonly capabilityPolicy: CapabilityPolicy;
-    /** Optional inputs the executor should materialize before running. */
-    readonly inputs?: Readonly<Record<string, string>>;
-}
-interface SandboxExecResult {
-    readonly exitCode: number;
-    readonly aggregatedOutput: string;
-    /** Identifier of the isolator that actually ran the command. */
-    readonly executedOn: string;
-}
-/**
- * The only thing Track A depends on for execution. Implemented by a decoupled
- * isolator over the ./protocol contract; never implemented in-process here.
- */
-interface ExternalSandbox {
-    exec(request: SandboxExecRequest): Promise<SandboxExecResult>;
-}
-/**
- * Fail-closed default. Wiring this in production requires a real
- * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.
- */
-declare class NoExecutorConfiguredError extends Error {
-    constructor();
-}
-declare const REFUSING_SANDBOX: ExternalSandbox;
-declare class SandboxDelegationError extends Error {
-    readonly status: number;
-    constructor(message: string, status: number);
-}
-/**
- * The concrete Track-B coupling: delegate execution over HTTP to the decoupled
- * Rust isolator (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`). The
- * isolator is fail-closed; a non-2xx (e.g. 403 refusal) is surfaced as an
- * error and never coerced into a fabricated result.
- */
-declare function createHttpSandbox(baseUrl: string, fetchImpl?: typeof fetch): ExternalSandbox;
-/** Guard: reject the most dangerous posture unless explicitly opted in. */
-declare function assertSafePosture(policy: CapabilityPolicy, allowDanger?: boolean): void;
-
-export { type ExternalSandbox, NoExecutorConfiguredError, REFUSING_SANDBOX, SandboxDelegationError, type SandboxExecRequest, type SandboxExecResult, assertSafePosture, createHttpSandbox };

package/dist/sandbox.js

@@ -1,16 +1,38 @@
 import {
+  CARINA_MIN_PROTOCOL_VERSION,
+  CODEPLOY_CARINA_SOCKET_PATH,
+  CODEPLOY_CARINA_WORKSPACE_ROOT,
+  CarinaProtocolError,
   NoExecutorConfiguredError,
   REFUSING_SANDBOX,
   SandboxDelegationError,
   assertSafePosture,
-  createHttpSandbox
-} from "./chunk-R5HOSQUW.js";
+  createCarinaSandbox,
+  createHttpSandbox,
+  defaultCarinaSocketPath,
+  isCarinaCodeployEnabled,
+  isCarinaSandbox,
+  resolveCarinaSandboxFromEnv,
+  resolveCarinaWorkspaceRoot,
+  resolveCarinaWorkspaceRootWithCodeploy
+} from "./chunk-VXILZAXK.js";
 import "./chunk-424PT5DM.js";
 export {
+  CARINA_MIN_PROTOCOL_VERSION,
+  CODEPLOY_CARINA_SOCKET_PATH,
+  CODEPLOY_CARINA_WORKSPACE_ROOT,
+  CarinaProtocolError,
   NoExecutorConfiguredError,
   REFUSING_SANDBOX,
   SandboxDelegationError,
   assertSafePosture,
-  createHttpSandbox
+  createCarinaSandbox,
+  createHttpSandbox,
+  defaultCarinaSocketPath,
+  isCarinaCodeployEnabled,
+  isCarinaSandbox,
+  resolveCarinaSandboxFromEnv,
+  resolveCarinaWorkspaceRoot,
+  resolveCarinaWorkspaceRootWithCodeploy
 };
 //# sourceMappingURL=sandbox.js.map

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@nebutra/agent-runtime",
-  "version": "0.2.2",
+  "version": "3.0.0",
   "private": false,
   "license": "MIT",
   "type": "module",
   "nebutra": {
+    "graph": "runtime",
     "status": "wip",
     "productionReady": false,
     "requires": [
@@ -94,12 +95,12 @@
   "dependencies": {
     "p-limit": "^7.3.0",
     "zod": "^4.3.6",
-    "@nebutra/agents": "1.1.2",
-    "@nebutra/ai-primitives": "0.1.2",
-    "@nebutra/graph-model": "0.2.2",
-    "@nebutra/mcp": "0.1.3",
-    "@nebutra/capability-kit": "0.2.2",
-    "@nebutra/execution-policy": "0.1.2"
+    "@nebutra/agents": "3.0.0",
+    "@nebutra/ai-primitives": "0.1.3",
+    "@nebutra/capability-kit": "3.0.0",
+    "@nebutra/execution-policy": "3.0.0",
+    "@nebutra/graph-model": "3.0.0",
+    "@nebutra/mcp": "3.0.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/dist/chunk-R5HOSQUW.js

@@ -1,58 +0,0 @@
-// src/sandbox.ts
-var NoExecutorConfiguredError = class extends Error {
-  constructor() {
-    super(
-      "No ExternalSandbox configured. This runtime never executes untrusted code in-process; delegate to a decoupled isolator (Track B)."
-    );
-    this.name = "NoExecutorConfiguredError";
-  }
-};
-var REFUSING_SANDBOX = {
-  async exec() {
-    throw new NoExecutorConfiguredError();
-  }
-};
-var SandboxDelegationError = class extends Error {
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "SandboxDelegationError";
-  }
-  status;
-};
-function createHttpSandbox(baseUrl, fetchImpl = fetch) {
-  const endpoint = `${baseUrl.replace(/\/$/, "")}/api/v1/sandbox/exec`;
-  return {
-    async exec(request) {
-      const response = await fetchImpl(endpoint, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(request)
-      });
-      if (!response.ok) {
-        const detail = await response.text().catch(() => "");
-        throw new SandboxDelegationError(
-          `Isolator refused execution (${response.status}): ${detail}`,
-          response.status
-        );
-      }
-      return await response.json();
-    }
-  };
-}
-function assertSafePosture(policy, allowDanger = false) {
-  if (policy.kind === "danger_full_access" && !allowDanger) {
-    throw new Error(
-      "danger_full_access capability policy refused: not permitted for multi-tenant delegation without explicit opt-in."
-    );
-  }
-}
-
-export {
-  NoExecutorConfiguredError,
-  REFUSING_SANDBOX,
-  SandboxDelegationError,
-  createHttpSandbox,
-  assertSafePosture
-};
-//# sourceMappingURL=chunk-R5HOSQUW.js.map

package/dist/chunk-R5HOSQUW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sandbox.ts"],"sourcesContent":["/**\n * External-sandbox delegation seam (PORT — capability #11).\n *\n * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant\n * web runtime NEVER executes untrusted code itself and introduces no isolation\n * infrastructure. It only:\n *   1. carries the capability policy (see ./policy),\n *   2. delegates execution to an external isolator behind this interface\n *      (a self-hosted kernel sidecar — Track B — or any other executor),\n *   3. records the outcome as a `command_execution` item (see ./model).\n *\n * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows\n * restricted token) are deliberately NOT ported — they are single-host and\n * out of scope for a multi-tenant web product.\n */\n\nimport type { CapabilityPolicy } from \"./policy\";\n\nexport interface SandboxExecRequest {\n  /** Mandatory tenant scope — every delegated exec is tenant-bound. */\n  readonly tenantId: string;\n  readonly threadId: string;\n  readonly command: string;\n  /** The capabilities the external isolator must honor. */\n  readonly capabilityPolicy: CapabilityPolicy;\n  /** Optional inputs the executor should materialize before running. */\n  readonly inputs?: Readonly<Record<string, string>>;\n}\n\nexport interface SandboxExecResult {\n  readonly exitCode: number;\n  readonly aggregatedOutput: string;\n  /** Identifier of the isolator that actually ran the command. */\n  readonly executedOn: string;\n}\n\n/**\n * The only thing Track A depends on for execution. Implemented by a decoupled\n * isolator over the ./protocol contract; never implemented in-process here.\n */\nexport interface ExternalSandbox {\n  exec(request: SandboxExecRequest): Promise<SandboxExecResult>;\n}\n\n/**\n * Fail-closed default. Wiring this in production requires a real\n * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.\n */\nexport class NoExecutorConfiguredError extends Error {\n  constructor() {\n    super(\n      \"No ExternalSandbox configured. This runtime never executes untrusted \" +\n        \"code in-process; delegate to a decoupled isolator (Track B).\",\n    );\n    this.name = \"NoExecutorConfiguredError\";\n  }\n}\n\nexport const REFUSING_SANDBOX: ExternalSandbox = {\n  async exec(): Promise<SandboxExecResult> {\n    throw new NoExecutorConfiguredError();\n  },\n};\n\nexport class SandboxDelegationError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n  ) {\n    super(message);\n    this.name = \"SandboxDelegationError\";\n  }\n}\n\n/**\n * The concrete Track-B coupling: delegate execution over HTTP to the decoupled\n * Rust isolator (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`). The\n * isolator is fail-closed; a non-2xx (e.g. 403 refusal) is surfaced as an\n * error and never coerced into a fabricated result.\n */\nexport function createHttpSandbox(\n  baseUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): ExternalSandbox {\n  const endpoint = `${baseUrl.replace(/\\/$/, \"\")}/api/v1/sandbox/exec`;\n  return {\n    async exec(request: SandboxExecRequest): Promise<SandboxExecResult> {\n      const response = await fetchImpl(endpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        body: JSON.stringify(request),\n      });\n      if (!response.ok) {\n        const detail = await response.text().catch(() => \"\");\n        throw new SandboxDelegationError(\n          `Isolator refused execution (${response.status}): ${detail}`,\n          response.status,\n        );\n      }\n      return (await response.json()) as SandboxExecResult;\n    },\n  };\n}\n\n/** Guard: reject the most dangerous posture unless explicitly opted in. */\nexport function assertSafePosture(policy: CapabilityPolicy, allowDanger = false): void {\n  if (policy.kind === \"danger_full_access\" && !allowDanger) {\n    throw new Error(\n      \"danger_full_access capability policy refused: not permitted for \" +\n        \"multi-tenant delegation without explicit opt-in.\",\n    );\n  }\n}\n"],"mappings":";AAgDO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,cAAc;AACZ;AAAA,MACE;AAAA,IAEF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAoC;AAAA,EAC/C,MAAM,OAAmC;AACvC,UAAM,IAAI,0BAA0B;AAAA,EACtC;AACF;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EAJW;AAKb;AAQO,SAAS,kBACd,SACA,YAA0B,OACT;AACjB,QAAM,WAAW,GAAG,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAC9C,SAAO;AAAA,IACL,MAAM,KAAK,SAAyD;AAClE,YAAM,WAAW,MAAM,UAAU,UAAU;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,SAAS,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACnD,cAAM,IAAI;AAAA,UACR,+BAA+B,SAAS,MAAM,MAAM,MAAM;AAAA,UAC1D,SAAS;AAAA,QACX;AAAA,MACF;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAGO,SAAS,kBAAkB,QAA0B,cAAc,OAAa;AACrF,MAAI,OAAO,SAAS,wBAAwB,CAAC,aAAa;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACF;","names":[]}