@nodetool-ai/node-sdk 0.7.0-rc.23 → 0.8.2

package/dist/sandbox-module-catalog.js

@@ -0,0 +1,402 @@
+import { createHash } from "node:crypto";
+import { sandboxDeliveryRefusal, sandboxGraphFileModuleId, parseSandboxGraphFileModuleId, sanitizeSandboxDescription, SandboxDeliveryMediaType } from "@nodetool-ai/protocol";
+import { isPackTrusted, resolvePackTrust } from "./pack-loader.js";
+/**
+ * Build the runtime catalog from validated, non-executing pack discoveries.
+ *
+ * `hostStatuses` carries diagnostics the host produced before discovery could
+ * run — an unreadable pack, a package name claimed by two roots — so
+ * `diagnostics()` reports one set covering everything the host looked at.
+ */
+export function createSandboxModuleCatalog(discoveries, hostStatuses = [], options = {}) {
+    // Trust is the operator's pack-loader allowlist, resolved once per catalog so
+    // one build cannot disagree with itself about a pack.
+    const isTrusted = options.isTrusted ?? trustFromConfig();
+    const discoveredBySpecifier = new Map();
+    const unavailableSpecifiers = new Set();
+    const statuses = [...hostStatuses];
+    const packNames = new Set();
+    for (const discovery of discoveries) {
+        if (packNames.has(discovery.name)) {
+            throw new Error(`duplicate sandbox pack discovery: ${discovery.name}`);
+        }
+        packNames.add(discovery.name);
+        statuses.push(...discovery.statuses);
+        for (const module of discovery.modules) {
+            if (module.source === undefined && module.bytes === undefined) {
+                unavailableSpecifiers.add(module.specifier);
+                continue;
+            }
+            if (discoveredBySpecifier.has(module.specifier)) {
+                throw new Error(`duplicate sandbox module specifier: ${module.specifier}`);
+            }
+            discoveredBySpecifier.set(module.specifier, { discovery, module });
+        }
+    }
+    const packs = new Map();
+    for (const discovery of discoveries) {
+        packs.set(discovery.name, packDelivery(discovery));
+    }
+    const summaries = [...discoveredBySpecifier.values()]
+        .map(({ discovery, module }) => {
+        // The one-line tier: the skill's own description, flattened and capped.
+        // The body never travels with a summary — that is the tool's job.
+        const description = discovery.skill === undefined
+            ? ""
+            : sanitizeSandboxDescription(discovery.skill.description);
+        const summary = {
+            specifier: module.specifier,
+            packName: discovery.name,
+            kind: module.kind,
+            contentDigest: module.digest
+        };
+        if (discovery.version !== undefined) {
+            summary.packVersion = discovery.version;
+        }
+        if (description !== "") {
+            summary.description = description;
+        }
+        return summary;
+    })
+        .sort((left, right) => left.specifier.localeCompare(right.specifier));
+    const skillsByPack = new Map();
+    for (const discovery of discoveries) {
+        if (discovery.skill === undefined)
+            continue;
+        const disclosure = {
+            ...discovery.skill,
+            packName: discovery.name,
+            trusted: isTrusted(discovery.name)
+        };
+        if (discovery.version !== undefined) {
+            disclosure.packVersion = discovery.version;
+        }
+        skillsByPack.set(discovery.name, disclosure);
+    }
+    return {
+        summaries: () => summaries,
+        diagnostics: () => statuses,
+        packSkill: (packName) => skillsByPack.get(packName),
+        // Asynchronous by contract; the v1 entitlement decision is synchronous.
+        authorizeDelivery: (moduleId) => Promise.resolve(authorizeDelivery(moduleId, discoveredBySpecifier, unavailableSpecifiers, packs)),
+        resolveForExecution: (declarations) => {
+            const modules = [];
+            const resolutionStatuses = [];
+            const resolvedSpecifiers = new Set();
+            for (const declaration of declarations) {
+                if (resolvedSpecifiers.has(declaration.specifier))
+                    continue;
+                resolvedSpecifiers.add(declaration.specifier);
+                const found = discoveredBySpecifier.get(declaration.specifier);
+                if (found === undefined) {
+                    resolutionStatuses.push({
+                        packName: packNameForSpecifier(declaration.specifier),
+                        specifier: declaration.specifier,
+                        status: "error",
+                        code: unavailableSpecifiers.has(declaration.specifier)
+                            ? "module-unavailable"
+                            : "module-not-found",
+                        message: unavailableSpecifiers.has(declaration.specifier)
+                            ? `Sandbox module ${declaration.specifier} is not available for execution.`
+                            : `Sandbox module ${declaration.specifier} is not installed.`
+                    });
+                    continue;
+                }
+                const { discovery, module } = found;
+                if (declaration.resolvedPackVersion !== undefined &&
+                    declaration.resolvedPackVersion !== discovery.version) {
+                    resolutionStatuses.push({
+                        packName: discovery.name,
+                        specifier: module.specifier,
+                        status: "warning",
+                        code: "version-mismatch",
+                        message: `Sandbox module ${module.specifier} was saved with pack version ${declaration.resolvedPackVersion}, but ${discovery.version ?? "an unversioned pack"} is installed.`
+                    });
+                }
+                if (declaration.contentDigest !== undefined &&
+                    declaration.contentDigest !== module.digest) {
+                    resolutionStatuses.push({
+                        packName: discovery.name,
+                        specifier: module.specifier,
+                        status: "warning",
+                        code: "content-digest-mismatch",
+                        message: `Sandbox module ${module.specifier} has changed since the workflow was saved.`
+                    });
+                }
+                modules.push(toResolvedModule(discovery, module));
+            }
+            return { modules, statuses: resolutionStatuses };
+        }
+    };
+}
+function trustFromConfig() {
+    const trust = resolvePackTrust();
+    return (packName) => isPackTrusted(packName, trust);
+}
+/**
+ * Index one pack's graph for delivery.
+ *
+ * Every file gets the graph digest of the public module that reaches it. A file
+ * shared by two entry modules belongs to both graphs and therefore has two
+ * candidate digests; the lexicographically first specifier wins, so the answer
+ * is stable across processes. The digest identifies the module graph a file was
+ * delivered as part of — it is never a hash of that one file.
+ */
+function packDelivery(discovery) {
+    const filesById = new Map(discovery.graph.map((file) => [file.id, file]));
+    const digestByFileId = new Map();
+    const entries = [...discovery.modules]
+        // A compiled npm entry has no authored file, and a host module has no file
+        // at all — neither contributes a graph file to walk.
+        .filter((module) => module.npm === undefined && module.kind !== "host")
+        .sort((left, right) => left.specifier.localeCompare(right.specifier));
+    for (const module of entries) {
+        const pending = [module.id];
+        const seen = new Set();
+        for (let index = 0; index < pending.length; index += 1) {
+            const id = pending[index];
+            if (id === undefined || seen.has(id))
+                continue;
+            seen.add(id);
+            if (!digestByFileId.has(id))
+                digestByFileId.set(id, module.digest);
+            const file = filesById.get(id);
+            if (file !== undefined)
+                pending.push(...file.dependencies);
+        }
+    }
+    return { discovery, filesById, digestByFileId };
+}
+/**
+ * Resolve one opaque module id to browser-safe content.
+ *
+ * Public entry specifiers and internal graph-file ids are both deliverable: the
+ * browser loader needs the whole graph, not just the entry. v1 entitlement
+ * policy is that any request reaching the catalog is authorized — the seam
+ * exists so a later private-pack rule is a policy change, not new plumbing.
+ */
+function authorizeDelivery(moduleId, discoveredBySpecifier, unavailableSpecifiers, packs) {
+    const entry = discoveredBySpecifier.get(moduleId);
+    if (entry !== undefined) {
+        const { discovery, module } = entry;
+        if (module.npm !== undefined) {
+            return sandboxDeliveryRefusal("unavailable", `Sandbox module ${moduleId} is not available for delivery.`);
+        }
+        if (module.kind === "host") {
+            // The facade is the only artifact a host module has; the client verifies
+            // and caches it like any other JavaScript, and `hostId` lets it rebuild
+            // the resolved module without a second request.
+            if (module.source === undefined || module.hostId === undefined) {
+                return sandboxDeliveryRefusal("unavailable", `Sandbox module ${moduleId} has no host facade.`);
+            }
+            const hostDelivery = {
+                authorized: true,
+                moduleId,
+                fileId: module.id,
+                internal: false,
+                packName: discovery.name,
+                contentDigest: module.digest,
+                contentSha256: sha256(Buffer.from(module.source, "utf8")),
+                dependencies: [],
+                kind: "host",
+                mediaType: SandboxDeliveryMediaType.JS,
+                hostId: module.hostId,
+                source: module.source
+            };
+            if (discovery.version !== undefined) {
+                hostDelivery.packVersion = discovery.version;
+            }
+            return hostDelivery;
+        }
+        const content = {
+            moduleId,
+            fileId: module.id,
+            // A public entry is the pack's advertised surface, never an internal file.
+            internal: false,
+            digest: module.digest,
+            kind: module.kind,
+            dependencies: module.dependencies
+        };
+        if (module.source !== undefined) {
+            content.source = module.source;
+        }
+        if (module.bytes !== undefined) {
+            content.bytes = module.bytes;
+        }
+        // Only a public entry carries the call contract the facade is built from.
+        if (module.wasm !== undefined) {
+            content.wasm = module.wasm;
+        }
+        return deliveryFor(discovery, content);
+    }
+    if (unavailableSpecifiers.has(moduleId)) {
+        return sandboxDeliveryRefusal("unavailable", `Sandbox module ${moduleId} is not available for delivery.`);
+    }
+    const parsed = parseSandboxGraphFileModuleId(moduleId);
+    const pack = parsed === undefined ? undefined : packs.get(parsed.packName);
+    const file = parsed === undefined || pack === undefined
+        ? undefined
+        : pack.filesById.get(parsed.fileId);
+    const digest = parsed === undefined || pack === undefined
+        ? undefined
+        : pack.digestByFileId.get(parsed.fileId);
+    if (parsed === undefined ||
+        pack === undefined ||
+        file === undefined ||
+        digest === undefined) {
+        return sandboxDeliveryRefusal("not-found", `Sandbox module ${moduleId} is not installed.`);
+    }
+    const content = {
+        moduleId,
+        fileId: parsed.fileId,
+        internal: file.internal,
+        digest,
+        kind: file.kind,
+        dependencies: file.dependencies
+    };
+    if (file.source !== undefined) {
+        content.source = file.source;
+    }
+    if (file.bytes !== undefined) {
+        content.bytes = file.bytes;
+    }
+    return deliveryFor(pack.discovery, content);
+}
+function deliveryFor(discovery, content) {
+    const common = {
+        authorized: true,
+        moduleId: content.moduleId,
+        fileId: content.fileId,
+        internal: content.internal,
+        packName: discovery.name,
+        contentDigest: content.digest,
+        dependencies: content.dependencies.map((dependency) => sandboxGraphFileModuleId(discovery.name, dependency))
+    };
+    if (discovery.version !== undefined) {
+        common.packVersion = discovery.version;
+    }
+    if (content.kind === "js") {
+        if (content.source === undefined) {
+            return sandboxDeliveryRefusal("unavailable", `Sandbox module ${content.moduleId} has no JavaScript source.`);
+        }
+        return {
+            ...common,
+            kind: "js",
+            mediaType: SandboxDeliveryMediaType.JS,
+            contentSha256: sha256(Buffer.from(content.source, "utf8")),
+            source: content.source
+        };
+    }
+    if (content.bytes === undefined) {
+        return sandboxDeliveryRefusal("unavailable", `Sandbox module ${content.moduleId} has no WASM bytes.`);
+    }
+    const wasmDelivery = {
+        ...common,
+        kind: "wasm",
+        mediaType: SandboxDeliveryMediaType.WASM,
+        contentSha256: sha256(content.bytes),
+        bytes: new Uint8Array(content.bytes)
+    };
+    if (content.wasm !== undefined) {
+        wasmDelivery.wasm = content.wasm;
+    }
+    return wasmDelivery;
+}
+/** Hash of exactly the bytes a client receives, so the client can check them. */
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function toResolvedModule(discovery, module) {
+    const graph = module.kind === "host" ? [] : moduleGraph(discovery.graph, module.id);
+    const common = {
+        specifier: module.specifier,
+        packName: discovery.name,
+        contentDigest: module.digest,
+        moduleId: module.id,
+        graph
+    };
+    if (discovery.version !== undefined) {
+        common.packVersion = discovery.version;
+    }
+    if (module.kind === "host") {
+        if (module.hostId === undefined) {
+            throw new Error(`sandbox module ${module.specifier} has no host module id`);
+        }
+        return { ...common, kind: "host", hostId: module.hostId };
+    }
+    if (module.kind === "js") {
+        if (module.source === undefined) {
+            throw new Error(`sandbox module ${module.specifier} has no JavaScript source`);
+        }
+        return { ...common, kind: "js", source: module.source };
+    }
+    if (module.bytes === undefined) {
+        throw new Error(`sandbox module ${module.specifier} has no WASM bytes`);
+    }
+    if (module.wasm === undefined) {
+        throw new Error(`sandbox module ${module.specifier} has no WASM call contract`);
+    }
+    return {
+        ...common,
+        kind: "wasm",
+        bytes: new Uint8Array(module.bytes),
+        wasm: module.wasm
+    };
+}
+function moduleGraph(graph, rootId) {
+    const filesById = new Map(graph.map((file) => [file.id, file]));
+    const pending = [rootId];
+    const reachable = new Set();
+    for (let index = 0; index < pending.length; index += 1) {
+        const id = pending[index];
+        if (id === undefined || reachable.has(id))
+            continue;
+        const file = filesById.get(id);
+        if (file === undefined) {
+            throw new Error(`sandbox graph is missing ${id}`);
+        }
+        reachable.add(id);
+        pending.push(...file.dependencies);
+    }
+    return [...reachable]
+        .map((id) => {
+        const file = filesById.get(id);
+        if (file === undefined) {
+            throw new Error(`sandbox graph is missing ${id}`);
+        }
+        return toGraphFile(file);
+    })
+        .sort((left, right) => left.id.localeCompare(right.id));
+}
+function toGraphFile(file) {
+    if (file.kind === "js") {
+        if (file.source === undefined) {
+            throw new Error(`sandbox graph file ${file.id} has no JavaScript source`);
+        }
+        return {
+            id: file.id,
+            kind: "js",
+            source: file.source,
+            dependencies: [...file.dependencies],
+            internal: file.internal
+        };
+    }
+    if (file.bytes === undefined) {
+        throw new Error(`sandbox graph file ${file.id} has no WASM bytes`);
+    }
+    return {
+        id: file.id,
+        kind: "wasm",
+        bytes: new Uint8Array(file.bytes),
+        dependencies: [...file.dependencies],
+        internal: file.internal
+    };
+}
+function packNameForSpecifier(specifier) {
+    if (specifier.startsWith("@")) {
+        const [scope, name] = specifier.split("/");
+        return name === undefined ? specifier : `${scope}/${name}`;
+    }
+    return specifier.split("/")[0] ?? specifier;
+}
+//# sourceMappingURL=sandbox-module-catalog.js.map

package/dist/sandbox-module-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-module-catalog.js","sourceRoot":"","sources":["../src/sandbox-module-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,EASzB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQnE;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAA4C,EAC5C,YAAY,GAAmC,EAAE,EACjD,OAAO,GAAkD,EAAE;IAE3D,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;IACzD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAMlC,CAAC;IACJ,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,MAAM,QAAQ,GAA0B,CAAC,GAAG,YAAY,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9D,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,SAAS,EAAE,CAC1D,CAAC;YACJ,CAAC;YACD,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC;SAClD,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAwB,EAAE;QACnD,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,WAAW,GACf,SAAS,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAyB;YACpC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,SAAS,CAAC,IAAI;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC;QACF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;QAC1C,CAAC;QACD,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QACpC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAExE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsC,CAAC;IACnE,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QAC5C,MAAM,UAAU,GAIZ;YACF,GAAG,SAAS,CAAC,KAAK;YAClB,QAAQ,EAAE,SAAS,CAAC,IAAI;YACxB,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;SACnC,CAAC;QACF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,UAAU,CAAC,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;QAC7C,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1B,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ;QAC3B,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnD,wEAAwE;QACxE,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC9B,OAAO,CAAC,OAAO,CACb,iBAAiB,CACf,QAAQ,EACR,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,CACN,CACF;QACH,mBAAmB,EAAE,CAAC,YAAY,EAAE,EAAE;YACpC,MAAM,OAAO,GAA4B,EAAE,CAAC;YAC5C,MAAM,kBAAkB,GAA0B,EAAE,CAAC;YACrD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;YAC7C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAC5D,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,kBAAkB,CAAC,IAAI,CAAC;wBACtB,QAAQ,EAAE,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC;wBACrD,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,MAAM,EAAE,OAAO;wBACf,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BACpD,CAAC,CAAC,oBAAoB;4BACtB,CAAC,CAAC,kBAAkB;wBACtB,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BACvD,CAAC,CAAC,kBAAkB,WAAW,CAAC,SAAS,kCAAkC;4BAC3E,CAAC,CAAC,kBAAkB,WAAW,CAAC,SAAS,oBAAoB;qBAChE,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;gBACpC,IACE,WAAW,CAAC,mBAAmB,KAAK,SAAS;oBAC7C,WAAW,CAAC,mBAAmB,KAAK,SAAS,CAAC,OAAO,EACrD,CAAC;oBACD,kBAAkB,CAAC,IAAI,CAAC;wBACtB,QAAQ,EAAE,SAAS,CAAC,IAAI;wBACxB,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,MAAM,EAAE,SAAS;wBACjB,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,kBAAkB,MAAM,CAAC,SAAS,gCAAgC,WAAW,CAAC,mBAAmB,SAAS,SAAS,CAAC,OAAO,IAAI,qBAAqB,gBAAgB;qBAC9K,CAAC,CAAC;gBACL,CAAC;gBACD,IACE,WAAW,CAAC,aAAa,KAAK,SAAS;oBACvC,WAAW,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,EAC3C,CAAC;oBACD,kBAAkB,CAAC,IAAI,CAAC;wBACtB,QAAQ,EAAE,SAAS,CAAC,IAAI;wBACxB,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,MAAM,EAAE,SAAS;wBACjB,IAAI,EAAE,yBAAyB;wBAC/B,OAAO,EAAE,kBAAkB,MAAM,CAAC,SAAS,4CAA4C;qBACxF,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,SAA+B;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;QACpC,2EAA2E;QAC3E,qDAAqD;SACpD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;SACtE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,QAAgB,EAChB,qBAMC,EACD,qBAA0C,EAC1C,KAAwC;IAExC,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACpC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,sBAAsB,CAC3B,aAAa,EACb,kBAAkB,QAAQ,iCAAiC,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,yEAAyE;YACzE,wEAAwE;YACxE,gDAAgD;YAChD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/D,OAAO,sBAAsB,CAC3B,aAAa,EACb,kBAAkB,QAAQ,sBAAsB,CACjD,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAgC;gBAChD,UAAU,EAAE,IAAI;gBAChB,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,EAAE;gBACjB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,SAAS,CAAC,IAAI;gBACxB,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACzD,YAAY,EAAE,EAAE;gBAChB,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,wBAAwB,CAAC,EAAE;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACpC,YAAY,CAAC,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;YAC/C,CAAC;YACD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAoB;YAC/B,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,2EAA2E;YAC3E,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACjC,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,0EAA0E;QAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,CAAC;QACD,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,sBAAsB,CAC3B,aAAa,EACb,kBAAkB,QAAQ,iCAAiC,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,IAAI,GACR,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QACxC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GACV,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QACxC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IACE,MAAM,KAAK,SAAS;QACpB,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,SAAS;QAClB,MAAM,KAAK,SAAS,EACpB,CAAC;QACD,OAAO,sBAAsB,CAC3B,WAAW,EACX,kBAAkB,QAAQ,oBAAoB,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAoB;QAC/B,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAcD,SAAS,WAAW,CAClB,SAA+B,EAC/B,OAAwB;IAYxB,MAAM,MAAM,GAAiB;QAC3B,UAAU,EAAE,IAAa;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,SAAS,CAAC,IAAI;QACxB,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACpD,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CACrD;KACF,CAAC;IACF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,sBAAsB,CAC3B,aAAa,EACb,kBAAkB,OAAO,CAAC,QAAQ,4BAA4B,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,MAAM;YACT,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,wBAAwB,CAAC,EAAE;YACtC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,sBAAsB,CAC3B,aAAa,EACb,kBAAkB,OAAO,CAAC,QAAQ,qBAAqB,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAgC;QAChD,GAAG,MAAM;QACT,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,wBAAwB,CAAC,IAAI;QACxC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;KACrC,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CACvB,SAA+B,EAC/B,MAA+B;IAE/B,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IASxE,MAAM,MAAM,GAAkB;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,SAAS,CAAC,IAAI;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,KAAK;KACN,CAAC;IACF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,SAAS,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,SAAS,2BAA2B,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,SAAS,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,SAAS,4BAA4B,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACnC,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,KAAuC,EACvC,MAAc;IAEd,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC;SAClB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACV,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,IAA2B;IAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC9C,CAAC"}

package/dist/sandbox-npm-artifacts.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The contract between the npm compiler and sandbox pack discovery.
+ *
+ * Discovery is synchronous and engine-free — it never runs esbuild and never
+ * starts QuickJS. A host that *can* do those things compiles ahead of time and
+ * injects the results here, so an npm-backed module joins the source graph the
+ * same way an authored file does. Nothing in this file imports a compiler.
+ */
+/** A compiled npm module, ready to join a pack's source graph. */
+export interface SandboxCompiledNpmArtifact {
+    /** The bundled ESM source, exactly as the guest will evaluate it. */
+    readonly source: string;
+    /** Contract version of the compiler that produced it. */
+    readonly compilerVersion: string;
+    /** Digest of the normalized build options and the esbuild version. */
+    readonly optionsDigest: string;
+    /** Digest of every input file's content that went into the bundle. */
+    readonly inputsDigest: string;
+}
+/**
+ * What a compiler concluded about one npm module declaration.
+ *
+ * A `skipped` outcome is a named reason — an import of a Node builtin, a bundle
+ * over the size cap, a forbidden global, a probe that threw — and it reaches the
+ * catalog as a skip, never as a discovery error.
+ */
+export type SandboxNpmCompileOutcome = {
+    readonly status: "compiled";
+    readonly artifact: SandboxCompiledNpmArtifact;
+    /** Feature-detected forbidden globals: a heads-up, not a promise. */
+    readonly warnings?: readonly string[];
+} | {
+    readonly status: "skipped";
+    readonly code: string;
+    readonly message: string;
+};
+/** What discovery knows about the npm module it is asking about. */
+export interface SandboxNpmCompileRequest {
+    readonly packName: string;
+    readonly packDir: string;
+    readonly specifier: string;
+    readonly npmName: string;
+}
+/**
+ * Injected compiled-artifact lookup.
+ *
+ * `undefined` means "nothing compiled this yet" — discovery reports
+ * `pending-compile` and the module stays unavailable until a host with the
+ * compiler runs.
+ */
+export type SandboxCompiledNpmLookup = (request: SandboxNpmCompileRequest) => SandboxNpmCompileOutcome | undefined;
+/** The module id a compiled npm entry occupies in a pack's source graph. */
+export declare function npmModuleId(npmName: string): string;
+/** Whether a graph id belongs to an npm-compiled module. */
+export declare function isNpmModuleId(id: string): boolean;
+//# sourceMappingURL=sandbox-npm-artifacts.d.ts.map

package/dist/sandbox-npm-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-npm-artifacts.d.ts","sourceRoot":"","sources":["../src/sandbox-npm-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,kEAAkE;AAClE,MAAM,WAAW,0BAA0B;IACzC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,oEAAoE;AACpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,OAAO,EAAE,wBAAwB,KAC9B,wBAAwB,GAAG,SAAS,CAAC;AAE1C,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEjD"}

package/dist/sandbox-npm-artifacts.js

@@ -0,0 +1,17 @@
+/**
+ * The contract between the npm compiler and sandbox pack discovery.
+ *
+ * Discovery is synchronous and engine-free — it never runs esbuild and never
+ * starts QuickJS. A host that *can* do those things compiles ahead of time and
+ * injects the results here, so an npm-backed module joins the source graph the
+ * same way an authored file does. Nothing in this file imports a compiler.
+ */
+/** The module id a compiled npm entry occupies in a pack's source graph. */
+export function npmModuleId(npmName) {
+    return `npm:${npmName}`;
+}
+/** Whether a graph id belongs to an npm-compiled module. */
+export function isNpmModuleId(id) {
+    return id.startsWith("npm:");
+}
+//# sourceMappingURL=sandbox-npm-artifacts.js.map

package/dist/sandbox-npm-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-npm-artifacts.js","sourceRoot":"","sources":["../src/sandbox-npm-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAqDH,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,OAAO,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/sandbox-pack-discovery.d.ts

@@ -0,0 +1,93 @@
+import { type SandboxModuleManifest, type SandboxPackManifest, type SandboxPackSkill, type SandboxModuleStatus, type SandboxWasmContract } from "@nodetool-ai/protocol";
+import { type SandboxCompiledNpmArtifact, type SandboxCompiledNpmLookup } from "./sandbox-npm-artifacts.js";
+export { normalizeSandboxSpecifier } from "@nodetool-ai/protocol";
+export { npmModuleId, isNpmModuleId, type SandboxCompiledNpmArtifact, type SandboxCompiledNpmLookup, type SandboxNpmCompileOutcome, type SandboxNpmCompileRequest } from "./sandbox-npm-artifacts.js";
+/** Static resource limits enforced while discovering sandbox package artifacts. */
+export declare const SANDBOX_PACKAGE_LIMITS: {
+    readonly authoredJsBytes: number;
+    readonly npmBundledJsBytes: number;
+    readonly wasmBytes: number;
+    readonly packBytes: number;
+    readonly skillBytes: number;
+};
+/** The id a host module carries in a pack's module table. Never a file path. */
+export declare function hostModuleId(hostId: string): string;
+/** One validated file in a discovered sandbox package's module graph. */
+export interface SandboxDiscoveredFile {
+    readonly id: string;
+    readonly kind: "js" | "wasm";
+    readonly source?: string;
+    readonly bytes?: Uint8Array;
+    readonly dependencies: readonly string[];
+    readonly internal: boolean;
+}
+/** A public sandbox entry module discovered without executing pack code. */
+export interface SandboxDiscoveredModule {
+    readonly specifier: string;
+    readonly kind: "js" | "wasm" | "host";
+    readonly id: string;
+    /** Digest of this public module and every transitive source it imports. */
+    readonly digest: string;
+    readonly file?: string;
+    readonly npm?: string;
+    readonly source?: string;
+    readonly bytes?: Uint8Array;
+    /** WASM modules only: the validated scalar call contract the host enforces. */
+    readonly wasm?: SandboxWasmContract;
+    /** Host modules only: the registry id whose implementation serves the calls. */
+    readonly hostId?: string;
+    readonly dependencies: readonly string[];
+}
+/** Validated sandbox artifacts and diagnostics read from one package directory. */
+export interface SandboxPackDiscovery {
+    readonly name: string;
+    readonly version?: string;
+    readonly dir: string;
+    readonly modules: readonly SandboxDiscoveredModule[];
+    /** Complete source graph, including transitive and internal files. */
+    readonly graph: readonly SandboxDiscoveredFile[];
+    readonly internal: readonly string[];
+    readonly digest: string;
+    readonly statuses: readonly SandboxModuleStatus[];
+    /**
+     * The pack's parsed SKILL.md, absent when it is missing or does not parse.
+     * A skill is documentation: a frontmatter typo is a warning, never a reason
+     * to withhold modules that are otherwise valid.
+     */
+    readonly skill?: SandboxPackSkill;
+}
+/** Raised when a sandbox package's static artifacts violate the discovery contract. */
+export declare class SandboxPackDiscoveryError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Host-supplied input discovery cannot produce on its own. */
+export interface SandboxPackDiscoveryOptions {
+    /**
+     * Compiled npm artifacts, keyed by pack and dependency name.
+     *
+     * Discovery stays synchronous and engine-free: it never runs esbuild and
+     * never starts QuickJS. A host that already compiled injects the results
+     * here; without them an npm entry is reported as `pending-compile`.
+     */
+    readonly compiled?: SandboxCompiledNpmLookup;
+}
+/** Discover a single installed pack without importing or executing pack code. */
+export declare function discoverSandboxPack(packDir: string, options?: SandboxPackDiscoveryOptions): SandboxPackDiscovery | undefined;
+/** Discover sandbox modules from package directories without ambiguous pack ownership. */
+export declare function discoverSandboxPacks(packageDirs: readonly string[], options?: SandboxPackDiscoveryOptions): SandboxPackDiscovery[];
+/** Compute the canonical digest for a complete sandbox package graph. */
+export declare function computeSandboxModuleGraphDigest(modules: readonly SandboxDiscoveredModule[], files: ReadonlyMap<string, {
+    bytes: Uint8Array;
+    kind?: "js" | "wasm";
+}>, internal: ReadonlySet<string>, metadata?: {
+    manifest?: SandboxPackManifest;
+    packageName?: string;
+    packageVersion?: string;
+    /** Compiler identity per compiled npm module id, keyed by graph id. */
+    npmArtifacts?: ReadonlyMap<string, SandboxCompiledNpmArtifact>;
+}): string;
+/** Parse one untrusted sandbox-module declaration at the package boundary. */
+export declare function sandboxModuleManifest(value: unknown): SandboxModuleManifest;
+//# sourceMappingURL=sandbox-pack-discovery.d.ts.map

package/dist/sandbox-pack-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-pack-discovery.d.ts","sourceRoot":"","sources":["../src/sandbox-pack-discovery.ts"],"names":[],"mappings":"AAWA,OAAO,EAkBL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,WAAW,EACX,aAAa,EACb,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC9B,MAAM,4BAA4B,CAAC;AAMpC,mFAAmF;AACnF,eAAO,MAAM,sBAAsB;aACjC,eAAe;aACf,iBAAiB;aACjB,SAAS;aACT,SAAS;aACT,UAAU;CACF,CAAC;AAEX,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AASD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACrD,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACnC;AAED,uFAAuF;AACvF,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAiBD,+DAA+D;AAC/D,MAAM,WAAW,2BAA2B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,wBAAwB,CAAC;CAC9C;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,2BAAgC,GACxC,oBAAoB,GAAG,SAAS,CAsWlC;AAcD,0FAA0F;AAC1F,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,GAAE,2BAAgC,GACxC,oBAAoB,EAAE,CAaxB;AAED,yEAAyE;AACzE,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,SAAS,uBAAuB,EAAE,EAC3C,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CAAE,CAAC,EACvE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAC7B,QAAQ,CAAC,EAAE;IACT,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CAChE,GACA,MAAM,CAUR;AAwmBD,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAE3E"}