@nodetool-ai/agents 0.7.0-rc.23 → 0.8.1

package/dist/host-binary-guard.js

@@ -0,0 +1,205 @@
+/**
+ * The boundary around `ffmpeg` and `yt-dlp` — the two capabilities that hand a
+ * model's own strings to a process on the host.
+ *
+ * The argv arrives from guest JavaScript or from an LLM tool call, and the
+ * child runs with the server's identity. In the managed cloud that server also
+ * holds every other tenant's database handle and secret store, so an unbounded
+ * `ffmpeg` is an arbitrary-file reader (`-i /etc/passwd`), an arbitrary-file
+ * writer (`-y ../../app/backend/server.mjs`), and an SSRF client — measured,
+ * not assumed: `ffmpeg -i http://169.254.169.254/…` opens the socket and
+ * reports what came back.
+ *
+ * Three rules, in the order they are cheapest to check:
+ *
+ * 1. **No opener but the filesystem.** Anything naming a protocol or a
+ *    pseudo-file — `://`, `concat:`, `pipe:`, `/dev/…` — is refused, and
+ *    `-protocol_whitelist file,crypto,data` is injected before *every* input
+ *    so a playlist inside the workspace cannot reach the network either.
+ *    ffmpeg applies that option per input, so one copy at the front covers
+ *    only the first `-i` (verified against ffmpeg 6.1).
+ * 2. **Nothing outside the workspace.** Every non-flag argument is resolved
+ *    against the workspace root and refused when it lands outside, symlinks
+ *    resolved. A filter value carries its path inside the token
+ *    (`subtitles=../../etc/x`), and resolving the whole token catches that
+ *    without parsing filter syntax.
+ * 3. **No stdin.** `-nostdin` keeps a child from inheriting and blocking on
+ *    the server's stdin, which outlives any single run.
+ *
+ * The CPU/memory/disk half of the boundary lives in `host-binaries.ts`:
+ * bounded output capture, a concurrency cap, the wall-clock timeout, and the
+ * artifact-size watchdog.
+ */
+import path from "node:path";
+import { isCreatableWithinRoot } from "./workspace-paths.js";
+/** What every `-i` gets: local files, plus the two openers that read bytes we already hold. */
+export const FFMPEG_PROTOCOL_WHITELIST = "file,crypto,data";
+/**
+ * Substrings that name an opener other than a plain path. `://` covers every
+ * network protocol at once; the rest are ffmpeg's own pseudo-files and the
+ * filter sources that read a file without looking like a path.
+ */
+const DENIED_TOKENS = [
+    "://",
+    "concat:",
+    "subfile:",
+    "async:",
+    "cache:",
+    "pipe:",
+    "fd:",
+    "movie=",
+    "amovie=",
+    "/dev/",
+    "/proc/",
+    "/sys/"
+];
+/**
+ * yt-dlp's download ceiling. It is the binary's own `--max-filesize`, which —
+ * unlike ffmpeg's `-fs` — aborts before writing: measured against yt-dlp
+ * 2026.07.04, a 20 MB file under `--max-filesize 1M` produced no output file.
+ */
+export const MAX_DOWNLOAD_BYTES = 2 * 1024 * 1024 * 1024;
+/** An argument the caller must not set: it would widen rule 1. */
+const RESERVED_FLAGS = ["-protocol_whitelist"];
+/** The token that made an argument unacceptable, or undefined when it is fine. */
+function deniedToken(arg) {
+    const lowered = arg.toLowerCase();
+    return DENIED_TOKENS.find((token) => lowered.includes(token));
+}
+/** Where a filtergraph or an option value ends and the next one begins. */
+const VALUE_SEPARATORS = /[=:,;[\]'"\s|]+/;
+/**
+ * The strings in one argument that ffmpeg could open as a file.
+ *
+ * The argument itself is always one, but it is not the only one: ffmpeg
+ * resolves a path *inside* a filter token against its own working directory,
+ * so `subtitles=../../etc/passwd` opens `../../etc/passwd` while the whole
+ * token resolves to `<workspace>/etc/passwd` — inside the workspace, and the
+ * wrong question. Splitting on the filtergraph separators asks the right one.
+ *
+ * A part is only a candidate when it carries a separator or names the parent
+ * directory; `scale=1280:-2` yields nothing, which is why filter *values* do
+ * not have to be understood to be judged.
+ */
+function pathCandidates(arg) {
+    const candidates = [arg];
+    for (const part of arg.split(VALUE_SEPARATORS)) {
+        if (part === "" || part === arg)
+            continue;
+        if (part.includes("/") || part === "..")
+            candidates.push(part);
+    }
+    return candidates;
+}
+/**
+ * Refuse argv that reaches past the workspace, or `undefined` when every
+ * argument stays inside it.
+ *
+ * Flags are skipped: a leading `-` is ffmpeg's option marker, so such an
+ * argument is never a path, and a file named `-x` is unusable by ffmpeg
+ * anyway. Everything else — and every path-shaped piece of it, see
+ * {@link pathCandidates} — is resolved against the workspace root, so an
+ * absolute path, a `..` chain, and a path inside a filter token all land
+ * outside it the same way.
+ *
+ * `remedy` is the one sentence the refusal ends on. It defaults to something
+ * true of every host binary; a caller with a way to put the file where the
+ * binary can see it — `ffmpeg`'s `inputs` — names that instead, so the refusal
+ * points at a parameter rather than at an errand the caller cannot run.
+ */
+export async function confineArgvToWorkspace(argv, workspace, remedy = "Stage it in the workspace first, then pass the local path.") {
+    for (const arg of argv) {
+        const token = deniedToken(arg);
+        if (token !== undefined) {
+            return {
+                error: `"${token}" is not allowed in a host media argument (in "${arg}"). ` +
+                    `Only workspace files are readable. ${remedy}`
+            };
+        }
+        if (arg === "" || arg.startsWith("-"))
+            continue;
+        for (const candidate of pathCandidates(arg)) {
+            const resolved = path.resolve(workspace, candidate);
+            if (!(await isCreatableWithinRoot(workspace, resolved))) {
+                return {
+                    error: `"${candidate}" resolves outside the workspace. Paths are ` +
+                        `workspace-relative and cannot escape it.`
+                };
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * The argv actually spawned: `-nostdin`, then the caller's arguments with
+ * `-protocol_whitelist` in front of every input.
+ *
+ * Refuses a caller who sets `-protocol_whitelist` themselves rather than
+ * silently dropping it — the refusal says which flag the host owns.
+ */
+export function hardenFfmpegArgv(argv) {
+    const reserved = argv.find((arg) => RESERVED_FLAGS.includes(arg));
+    if (reserved !== undefined) {
+        return {
+            error: `${reserved} is set by NodeTool and cannot be passed. Inputs may ` +
+                `only open workspace files (${FFMPEG_PROTOCOL_WHITELIST}).`
+        };
+    }
+    const hardened = ["-nostdin"];
+    for (const arg of argv) {
+        if (arg === "-i") {
+            hardened.push("-protocol_whitelist", FFMPEG_PROTOCOL_WHITELIST);
+        }
+        hardened.push(arg);
+    }
+    return { argv: hardened };
+}
+/**
+ * The argv `yt_dlp` spawns.
+ *
+ * Three of these flags are the boundary rather than configuration:
+ *
+ * - **`--ignore-config`** is the one that matters most. yt-dlp reads a
+ *   *portable* config file — `yt-dlp.conf` in its working directory — and its
+ *   working directory is the workspace, which guest code writes freely. A
+ *   guest that writes `--exec "curl … | sh"` into that file and then calls this
+ *   capability gets arbitrary command execution as the server. Reproduced
+ *   against yt-dlp 2026.07.04, and refused with this flag.
+ * - **`--no-exec`** clears any post-processing command from a source
+ *   `--ignore-config` does not cover.
+ * - **`--`** ends the options, so a URL cannot be read as a flag.
+ *
+ * `--max-filesize` is the disk bound, and `--no-playlist` keeps one URL to one
+ * download.
+ */
+export function buildYtDlpArgv(options) {
+    const argv = [
+        "--ignore-config",
+        "--no-exec",
+        "--no-playlist",
+        "--no-warnings",
+        "--max-filesize",
+        String(options.maxBytes ?? MAX_DOWNLOAD_BYTES),
+        "--print",
+        "after_move:filepath",
+        "-o",
+        options.outputFile
+    ];
+    if (options.format) {
+        argv.push("-f", options.format);
+    }
+    argv.push("--", options.url);
+    return argv;
+}
+/**
+ * Refuse a value that would arrive as another flag rather than as the value of
+ * the option it follows. `label` names the field in the refusal.
+ */
+export function refuseFlagLikeValue(value, label) {
+    if (!value.startsWith("-"))
+        return undefined;
+    return {
+        error: `${label} cannot start with "-": it would be read as an option, not a value.`
+    };
+}
+//# sourceMappingURL=host-binary-guard.js.map

package/dist/host-binary-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-binary-guard.js","sourceRoot":"","sources":["../src/host-binary-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,+FAA+F;AAC/F,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,aAAa,GAAsB;IACvC,KAAK;IACL,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;CACR,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzD,kEAAkE;AAClE,MAAM,cAAc,GAAsB,CAAC,qBAAqB,CAAC,CAAC;AAMlE,kFAAkF;AAClF,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAuB,EACvB,SAAiB,EACjB,MAAM,GAAG,4DAA4D;IAErE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EACH,IAAI,KAAK,kDAAkD,GAAG,MAAM;oBACpE,sCAAsC,MAAM,EAAE;aACjD,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChD,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACxD,OAAO;oBACL,KAAK,EACH,IAAI,SAAS,8CAA8C;wBAC3D,0CAA0C;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EACH,GAAG,QAAQ,uDAAuD;gBAClE,8BAA8B,yBAAyB,IAAI;SAC9D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,CAAC,UAAU,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC;QAClE,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAGD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,OAK9B;IACC,MAAM,IAAI,GAAG;QACX,iBAAiB;QACjB,WAAW;QACX,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC;QAC9C,SAAS;QACT,qBAAqB;QACrB,IAAI;QACJ,OAAO,CAAC,UAAU;KACnB,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,KAAa;IAEb,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,GAAG,KAAK,qEAAqE;KACrF,CAAC;AACJ,CAAC"}

package/dist/host-modules/aws.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `@nodetool-ai/sandbox-aws` — AWS Signature Version 4, on the host.
+ *
+ * The guest can already speak to S3: it is an HTTP API and `fetch` reaches it.
+ * What the guest cannot do is sign the request. SigV4 is an HMAC-SHA256 chain
+ * over a canonical form of the request, and getting the canonical form wrong
+ * fails with a signature mismatch that says nothing about which rule was
+ * broken. So the chain runs here, once, and the guest gets back headers it
+ * hands straight to `fetch`.
+ *
+ * Nothing here performs I/O. The signer takes a request description and
+ * returns a signed one; the network call stays in the guest, behind the fetch
+ * bridge and its SSRF guard, where a run's caps apply to it.
+ */
+/** A signed request, shaped for `fetch(signed.url, signed)`. */
+interface SignedRequest {
+    readonly url: string;
+    readonly method: string;
+    readonly headers: Record<string, string>;
+}
+/**
+ * Sign a request with SigV4, returning it ready for `fetch`.
+ *
+ * ```js
+ * const signed = await sigv4({
+ *   method: "GET",
+ *   url: "https://my-bucket.s3.us-east-1.amazonaws.com/?list-type=2",
+ *   region: "us-east-1",
+ *   service: "s3",
+ *   accessKeyId, secretAccessKey
+ * });
+ * const res = await fetch(signed.url, { method: signed.method, headers: signed.headers });
+ * ```
+ *
+ * A body is hashed but never returned — the guest passes the same value to
+ * `fetch` itself, so bytes never make the round trip twice.
+ */
+export declare function sigv4(request?: unknown): Promise<SignedRequest>;
+/**
+ * A presigned URL — the signature in the query string, so the URL alone
+ * authorizes the request for `expiresIn` seconds.
+ *
+ * ```js
+ * const url = await presign({
+ *   method: "GET",
+ *   url: "https://my-bucket.s3.us-east-1.amazonaws.com/report.pdf",
+ *   region: "us-east-1", service: "s3", expiresIn: 3600,
+ *   accessKeyId, secretAccessKey
+ * });
+ * ```
+ *
+ * The payload is unsigned, which is what makes a presigned PUT usable: the
+ * holder supplies the body.
+ */
+export declare function presign(request?: unknown): Promise<string>;
+export {};
+//# sourceMappingURL=aws.d.ts.map

package/dist/host-modules/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/host-modules/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkBH,gEAAgE;AAChE,UAAU,aAAa;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAuND;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAyErE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAwDhE"}

package/dist/host-modules/aws.js

@@ -0,0 +1,309 @@
+/**
+ * `@nodetool-ai/sandbox-aws` — AWS Signature Version 4, on the host.
+ *
+ * The guest can already speak to S3: it is an HTTP API and `fetch` reaches it.
+ * What the guest cannot do is sign the request. SigV4 is an HMAC-SHA256 chain
+ * over a canonical form of the request, and getting the canonical form wrong
+ * fails with a signature mismatch that says nothing about which rule was
+ * broken. So the chain runs here, once, and the guest gets back headers it
+ * hands straight to `fetch`.
+ *
+ * Nothing here performs I/O. The signer takes a request description and
+ * returns a signed one; the network call stays in the guest, behind the fetch
+ * bridge and its SSRF guard, where a run's caps apply to it.
+ */
+import { optionsOf } from "./limits.js";
+import { isNonEmptyString, isString } from "../utils/type-guards.js";
+/** Largest body the signer will hash, in bytes. */
+const MAX_SIGNED_BODY_BYTES = 10 * 1024 * 1024;
+/** The one algorithm SigV4 defines. */
+const ALGORITHM = "AWS4-HMAC-SHA256";
+/** Payload hash for a request whose body is not signed (presigned URLs). */
+const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+/** sha256 of the empty string, the payload hash of a body-less request. */
+const EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+function subtleCrypto(where) {
+    const subtle = globalThis.crypto?.subtle;
+    if (subtle === undefined) {
+        throw new Error(`${where}: WebCrypto is not available in this runtime`);
+    }
+    return subtle;
+}
+const encoder = new TextEncoder();
+function toBytes(value) {
+    return isString(value) ? encoder.encode(value) : value;
+}
+function toHex(bytes) {
+    let out = "";
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, "0");
+    return out;
+}
+async function sha256Hex(where, data) {
+    const digest = await subtleCrypto(where).digest("SHA-256", toBytes(data));
+    return toHex(new Uint8Array(digest));
+}
+async function hmac(where, key, data) {
+    const subtle = subtleCrypto(where);
+    const cryptoKey = await subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await subtle.sign("HMAC", cryptoKey, encoder.encode(data));
+    return new Uint8Array(signature);
+}
+/**
+ * RFC 3986 percent-encoding.
+ *
+ * `encodeURIComponent` leaves `!'()*` alone and AWS does not, which is the
+ * difference between a signature that verifies and one that does not.
+ */
+function encodeRfc3986(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/**
+ * The canonical path.
+ *
+ * S3 signs the path exactly as it appears on the wire — an object key is
+ * already a key, and normalizing it would sign a different object. Every other
+ * service signs the *encoded* form of the already-encoded path, which is the
+ * double-encoding the specification calls for.
+ */
+function canonicalUri(pathname, service) {
+    const path = pathname === "" ? "/" : pathname;
+    if (service === "s3")
+        return path;
+    return path
+        .split("/")
+        .map((segment) => {
+        let decoded = segment;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            // A segment that is not valid percent-encoding is signed as written.
+        }
+        return encodeRfc3986(decoded);
+    })
+        .join("/");
+}
+/** Query parameters, encoded and sorted by key then value. */
+function canonicalQuery(params) {
+    const pairs = [];
+    for (const [key, value] of params) {
+        pairs.push([encodeRfc3986(key), encodeRfc3986(value)]);
+    }
+    pairs.sort((a, b) => a[0] === b[0] ? (a[1] < b[1] ? -1 : 1) : a[0] < b[0] ? -1 : 1);
+    return pairs.map(([key, value]) => `${key}=${value}`).join("&");
+}
+/** `20240115T093000Z` and its `20240115` date part. */
+function amzDate(now) {
+    const stamp = `${now
+        .toISOString()
+        .replace(/[:-]|\.\d{3}/g, "")
+        .slice(0, 15)}Z`;
+    return { stamp, date: stamp.slice(0, 8) };
+}
+function readCredentials(where, opts) {
+    const accessKeyId = String(opts.accessKeyId ?? "");
+    const secretAccessKey = String(opts.secretAccessKey ?? "");
+    if (accessKeyId === "" || secretAccessKey === "") {
+        throw new Error(`${where}: accessKeyId and secretAccessKey are required — read them with nodetool.secrets.get("AWS_ACCESS_KEY_ID")`);
+    }
+    const sessionToken = opts.sessionToken;
+    if (isNonEmptyString(sessionToken)) {
+        return { accessKeyId, secretAccessKey, sessionToken };
+    }
+    return { accessKeyId, secretAccessKey };
+}
+function readUrl(where, opts) {
+    const raw = String(opts.url ?? "");
+    if (raw === "")
+        throw new Error(`${where}: url is required`);
+    try {
+        return new URL(raw);
+    }
+    catch {
+        throw new Error(`${where}: url is not a valid absolute URL`);
+    }
+}
+function readHeaders(where, value) {
+    const out = {};
+    const source = optionsOf(value);
+    for (const [name, headerValue] of Object.entries(source)) {
+        if (headerValue === undefined || headerValue === null)
+            continue;
+        if (typeof headerValue === "object") {
+            throw new Error(`${where}: header "${name}" must be a string`);
+        }
+        out[name] = String(headerValue);
+    }
+    return out;
+}
+function readBody(where, value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (isString(value)) {
+        if (encoder.encode(value).length > MAX_SIGNED_BODY_BYTES) {
+            throw new Error(`${where}: body exceeds the ${MAX_SIGNED_BODY_BYTES} byte signing limit`);
+        }
+        return value;
+    }
+    if (value instanceof Uint8Array) {
+        if (value.length > MAX_SIGNED_BODY_BYTES) {
+            throw new Error(`${where}: body exceeds the ${MAX_SIGNED_BODY_BYTES} byte signing limit`);
+        }
+        // Copied onto a plain ArrayBuffer: a guest array may sit on a
+        // SharedArrayBuffer, which WebCrypto's `BufferSource` does not accept.
+        return new Uint8Array(value);
+    }
+    throw new Error(`${where}: body must be a string or Uint8Array`);
+}
+/** The `date/region/service/aws4_request` scope a signature is bound to. */
+function credentialScope(date, region, service) {
+    return `${date}/${region}/${service}/aws4_request`;
+}
+async function signingKey(where, secret, date, region, service) {
+    const kDate = await hmac(where, encoder.encode(`AWS4${secret}`), date);
+    const kRegion = await hmac(where, kDate, region);
+    const kService = await hmac(where, kRegion, service);
+    return hmac(where, kService, "aws4_request");
+}
+/**
+ * Sign a request with SigV4, returning it ready for `fetch`.
+ *
+ * ```js
+ * const signed = await sigv4({
+ *   method: "GET",
+ *   url: "https://my-bucket.s3.us-east-1.amazonaws.com/?list-type=2",
+ *   region: "us-east-1",
+ *   service: "s3",
+ *   accessKeyId, secretAccessKey
+ * });
+ * const res = await fetch(signed.url, { method: signed.method, headers: signed.headers });
+ * ```
+ *
+ * A body is hashed but never returned — the guest passes the same value to
+ * `fetch` itself, so bytes never make the round trip twice.
+ */
+export async function sigv4(request) {
+    const where = "aws.sigv4";
+    const opts = optionsOf(request);
+    const url = readUrl(where, opts);
+    const method = String(opts.method ?? "GET").toUpperCase();
+    const service = String(opts.service ?? "s3");
+    const region = String(opts.region ?? "us-east-1");
+    const credentials = readCredentials(where, opts);
+    const body = readBody(where, opts.body);
+    const { stamp, date } = amzDate(new Date());
+    const payloadHash = isNonEmptyString(opts.payloadHash)
+        ? opts.payloadHash
+        : body === undefined
+            ? EMPTY_SHA256
+            : await sha256Hex(where, body);
+    const headers = {
+        ...readHeaders(where, opts.headers),
+        host: url.host,
+        "x-amz-date": stamp
+    };
+    if (service === "s3")
+        headers["x-amz-content-sha256"] = payloadHash;
+    if (credentials.sessionToken !== undefined) {
+        headers["x-amz-security-token"] = credentials.sessionToken;
+    }
+    const normalized = Object.entries(headers)
+        .map(([name, value]) => [
+        name.toLowerCase(),
+        value.trim().replace(/\s+/g, " ")
+    ])
+        .sort((a, b) => (a[0] < b[0] ? -1 : 1));
+    const signedHeaders = normalized.map(([name]) => name).join(";");
+    const canonicalHeaders = normalized
+        .map(([name, value]) => `${name}:${value}\n`)
+        .join("");
+    const canonicalRequest = [
+        method,
+        canonicalUri(url.pathname, service),
+        canonicalQuery(url.searchParams),
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash
+    ].join("\n");
+    const scope = credentialScope(date, region, service);
+    const stringToSign = [
+        ALGORITHM,
+        stamp,
+        scope,
+        await sha256Hex(where, canonicalRequest)
+    ].join("\n");
+    const key = await signingKey(where, credentials.secretAccessKey, date, region, service);
+    const signature = toHex(await hmac(where, key, stringToSign));
+    return {
+        url: url.toString(),
+        method,
+        headers: {
+            ...headers,
+            Authorization: `${ALGORITHM} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+        }
+    };
+}
+/**
+ * A presigned URL — the signature in the query string, so the URL alone
+ * authorizes the request for `expiresIn` seconds.
+ *
+ * ```js
+ * const url = await presign({
+ *   method: "GET",
+ *   url: "https://my-bucket.s3.us-east-1.amazonaws.com/report.pdf",
+ *   region: "us-east-1", service: "s3", expiresIn: 3600,
+ *   accessKeyId, secretAccessKey
+ * });
+ * ```
+ *
+ * The payload is unsigned, which is what makes a presigned PUT usable: the
+ * holder supplies the body.
+ */
+export async function presign(request) {
+    const where = "aws.presign";
+    const opts = optionsOf(request);
+    const url = readUrl(where, opts);
+    const method = String(opts.method ?? "GET").toUpperCase();
+    const service = String(opts.service ?? "s3");
+    const region = String(opts.region ?? "us-east-1");
+    const credentials = readCredentials(where, opts);
+    const rawExpires = Number(opts.expiresIn ?? 3600);
+    const expiresIn = Number.isFinite(rawExpires)
+        ? Math.min(Math.max(Math.floor(rawExpires), 1), 604800)
+        : 3600;
+    const { stamp, date } = amzDate(new Date());
+    const scope = credentialScope(date, region, service);
+    const query = new URLSearchParams(url.searchParams);
+    query.set("X-Amz-Algorithm", ALGORITHM);
+    query.set("X-Amz-Credential", `${credentials.accessKeyId}/${scope}`);
+    query.set("X-Amz-Date", stamp);
+    query.set("X-Amz-Expires", String(expiresIn));
+    query.set("X-Amz-SignedHeaders", "host");
+    if (credentials.sessionToken !== undefined) {
+        query.set("X-Amz-Security-Token", credentials.sessionToken);
+    }
+    // The signed query string is what has to reach the wire, character for
+    // character: `URLSearchParams.toString()` writes a space as `+` and the
+    // canonical form writes `%20`, so the canonical form is the one we keep.
+    const signedQuery = canonicalQuery(query);
+    const canonicalRequest = [
+        method,
+        canonicalUri(url.pathname, service),
+        signedQuery,
+        `host:${url.host}\n`,
+        "host",
+        UNSIGNED_PAYLOAD
+    ].join("\n");
+    const stringToSign = [
+        ALGORITHM,
+        stamp,
+        scope,
+        await sha256Hex(where, canonicalRequest)
+    ].join("\n");
+    const key = await signingKey(where, credentials.secretAccessKey, date, region, service);
+    const signature = toHex(await hmac(where, key, stringToSign));
+    url.search = `${signedQuery}&X-Amz-Signature=${signature}`;
+    return url.toString();
+}
+//# sourceMappingURL=aws.js.map

package/dist/host-modules/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/host-modules/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAErE,mDAAmD;AACnD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,uCAAuC;AACvC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,YAAY,GAChB,kEAAkE,CAAC;AASrE,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AASlC,SAAS,OAAO,CAAC,KAAqB;IACpC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,KAAa,EACb,IAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAC7C,SAAS,EACT,OAAO,CAAC,IAAI,CAAC,CACd,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,KAAa,EACb,GAAU,EACV,IAAY;IAEZ,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,MAAM,EACN,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACtC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe;IACrD,MAAM,IAAI,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;QACD,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,uDAAuD;AACvD,SAAS,OAAO,CAAC,GAAS;IACxB,MAAM,KAAK,GAAG,GAAG,GAAG;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IACnB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAQD,SAAS,eAAe,CACtB,KAAa,EACb,IAA6B;IAE7B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,WAAW,KAAK,EAAE,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2GAA2G,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,IAA6B;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAc;IAChD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;YAAE,SAAS;QAChE,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,IAAI,oBAAoB,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CACf,KAAa,EACb,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,sBAAsB,qBAAqB,qBAAqB,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,sBAAsB,qBAAqB,qBAAqB,CACzE,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,uEAAuE;QACvE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;AACnE,CAAC;AAED,4EAA4E;AAC5E,SAAS,eAAe,CACtB,IAAY,EACZ,MAAc,EACd,OAAe;IAEf,OAAO,GAAG,IAAI,IAAI,MAAM,IAAI,OAAO,eAAe,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAa,EACb,MAAc,EACd,IAAY,EACZ,MAAc,EACd,OAAe;IAEf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAiB;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC;IAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,WAAW,GACf,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,IAAI,KAAK,SAAS;YAClB,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAErC,MAAM,OAAO,GAA2B;QACtC,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,KAAK;KACpB,CAAC;IACF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAC;IACpE,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC;IAC7D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,EAAE;QAClB,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;KAClC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,UAAU;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;SAC5C,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,MAAM,gBAAgB,GAAG;QACvB,MAAM;QACN,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG;QACnB,SAAS;QACT,KAAK;QACL,KAAK;QACL,MAAM,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,KAAK,EACL,WAAW,CAAC,eAAe,EAC3B,IAAI,EACJ,MAAM,EACN,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAE9D,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;QACnB,MAAM;QACN,OAAO,EAAE;YACP,GAAG,OAAO;YACV,aAAa,EAAE,GAAG,SAAS,eAAe,WAAW,CAAC,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE;SACrI;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAiB;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpD,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACxC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,WAAW,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC;IACrE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/B,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG;QACvB,MAAM;QACN,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnC,WAAW;QACX,QAAQ,GAAG,CAAC,IAAI,IAAI;QACpB,MAAM;QACN,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,YAAY,GAAG;QACnB,SAAS;QACT,KAAK;QACL,KAAK;QACL,MAAM,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,KAAK,EACL,WAAW,CAAC,eAAe,EAC3B,IAAI,EACJ,MAAM,EACN,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAE9D,GAAG,CAAC,MAAM,GAAG,GAAG,WAAW,oBAAoB,SAAS,EAAE,CAAC;IAC3D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/host-modules/chrono.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `@nodetool-ai/sandbox-chrono` — chrono-node, on the host.
+ *
+ * chrono-node pulls locale tables and Date internals the guest probe refuses.
+ * The guest sends text; this module returns ISO strings.
+ */
+interface ChronoHit {
+    text: string;
+    start: string;
+    end: string | null;
+}
+export declare function parseDate(text: unknown, now?: unknown): Promise<string | null>;
+export declare function parse(text: unknown, now?: unknown): Promise<ChronoHit[]>;
+export {};
+//# sourceMappingURL=chrono.d.ts.map

package/dist/host-modules/chrono.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chrono.d.ts","sourceRoot":"","sources":["../../src/host-modules/chrono.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAgCD,wBAAsB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKpF;AAED,wBAAsB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAQ9E"}

package/dist/host-modules/chrono.js

@@ -0,0 +1,35 @@
+/**
+ * `@nodetool-ai/sandbox-chrono` — chrono-node, on the host.
+ *
+ * chrono-node pulls locale tables and Date internals the guest probe refuses.
+ * The guest sends text; this module returns ISO strings.
+ */
+import { requireText, unwrapLibrary } from "./limits.js";
+import { isFunction, isNumber, isString } from "../utils/type-guards.js";
+async function loadChrono(where) {
+    const mod = await import("chrono-node");
+    return unwrapLibrary(mod, where, "chrono-node", (v) => isFunction(v?.parseDate));
+}
+function refDate(value) {
+    if (isString(value) || isNumber(value)) {
+        const d = new Date(value);
+        return Number.isNaN(d.getTime()) ? undefined : d;
+    }
+    return undefined;
+}
+export async function parseDate(text, now) {
+    const where = "chrono.parseDate";
+    const chrono = await loadChrono(where);
+    const when = chrono.parseDate(requireText(where, text), refDate(now));
+    return when ? when.toISOString() : null;
+}
+export async function parse(text, now) {
+    const where = "chrono.parse";
+    const chrono = await loadChrono(where);
+    return chrono.parse(requireText(where, text), refDate(now)).map((hit) => ({
+        text: hit.text,
+        start: hit.start.date().toISOString(),
+        end: hit.end ? hit.end.date().toISOString() : null
+    }));
+}
+//# sourceMappingURL=chrono.js.map

package/dist/host-modules/chrono.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chrono.js","sourceRoot":"","sources":["../../src/host-modules/chrono.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,EACT,MAAM,yBAAyB,CAAC;AAoBjC,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,GAAG,GAAY,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,aAAa,CAClB,GAAG,EACH,KAAK,EACL,aAAa,EACb,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAE,CAA4B,EAAE,SAAS,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAa,EAAE,GAAa;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAa,EAAE,GAAa;IACtD,MAAM,KAAK,GAAG,cAAc,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KACnD,CAAC,CAAC,CAAC;AACN,CAAC"}