@prosopo/provider 4.15.14 → 4.15.16

package/dist/tasks/dataset/datasetTasks.js

@@ -1,30 +1,26 @@
-import { parseCaptchaDataset } from "@prosopo/datasets";
 import { providerValidateDataset } from "./datasetTasksUtils.js";
-class DatasetManager {
-  constructor(config, logger, captchaConfig, db) {
-    this.config = config;
-    this.logger = logger;
-    this.captchaConfig = captchaConfig;
-    this.db = db;
-  }
-  /**
-   * @description Set the provider dataset from a file
-   *
-   * @param file JSON of the captcha dataset
-   */
-  async providerSetDatasetFromFile(file) {
-    const datasetRaw = parseCaptchaDataset(file);
-    return await this.providerSetDataset(datasetRaw);
-  }
-  async providerSetDataset(datasetRaw) {
-    const dataset = await providerValidateDataset(
-      datasetRaw,
-      this.captchaConfig.solved.count,
-      this.captchaConfig.unsolved.count
-    );
-    await this.db?.storeDataset(dataset);
-  }
-}
-export {
-  DatasetManager
+import { parseCaptchaDataset } from "@prosopo/datasets";
+//#region src/tasks/dataset/datasetTasks.ts
+var DatasetManager = class {
+	constructor(config, logger, captchaConfig, db) {
+		this.config = config;
+		this.logger = logger;
+		this.captchaConfig = captchaConfig;
+		this.db = db;
+	}
+	/**
+	* @description Set the provider dataset from a file
+	*
+	* @param file JSON of the captcha dataset
+	*/
+	async providerSetDatasetFromFile(file) {
+		const datasetRaw = parseCaptchaDataset(file);
+		return await this.providerSetDataset(datasetRaw);
+	}
+	async providerSetDataset(datasetRaw) {
+		const dataset = await providerValidateDataset(datasetRaw, this.captchaConfig.solved.count, this.captchaConfig.unsolved.count);
+		await this.db?.storeDataset(dataset);
+	}
 };
+//#endregion
+export { DatasetManager };

package/dist/tasks/dataset/datasetTasksUtils.js

@@ -1,34 +1,18 @@
 import { ProsopoEnvError } from "@prosopo/common";
 import { buildDataset } from "@prosopo/datasets";
-const providerValidateDataset = async (datasetRaw, minSolvedCaptchas, minUnsolvedCaptchas) => {
-  if (datasetRaw.captchas.length < minSolvedCaptchas + minUnsolvedCaptchas) {
-    throw new ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", {
-      context: { failedFuncName: providerValidateDataset.name }
-    });
-  }
-  const solutions = datasetRaw.captchas.map((captcha) => captcha.solution ? 1 : 0).reduce((partialSum, b) => partialSum + b, 0);
-  if (solutions < minSolvedCaptchas) {
-    throw new ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", {
-      context: { failedFuncName: providerValidateDataset.name }
-    });
-  }
-  if (solutions < minUnsolvedCaptchas) {
-    throw new ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", {
-      context: { failedFuncName: providerValidateDataset.name }
-    });
-  }
-  const dataset = await buildDataset(datasetRaw);
-  if (!dataset.datasetId || !dataset.datasetContentId) {
-    throw new ProsopoEnvError("DATASET.DATASET_ID_UNDEFINED", {
-      context: {
-        failedFuncName: providerValidateDataset.name,
-        datasetId: dataset.datasetId,
-        datasetContentId: dataset.datasetContentId
-      }
-    });
-  }
-  return dataset;
-};
-export {
-  providerValidateDataset
+//#region src/tasks/dataset/datasetTasksUtils.ts
+var providerValidateDataset = async (datasetRaw, minSolvedCaptchas, minUnsolvedCaptchas) => {
+	if (datasetRaw.captchas.length < minSolvedCaptchas + minUnsolvedCaptchas) throw new ProsopoEnvError("DATASET.CAPTCHAS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	const solutions = datasetRaw.captchas.map((captcha) => captcha.solution ? 1 : 0).reduce((partialSum, b) => partialSum + b, 0);
+	if (solutions < minSolvedCaptchas) throw new ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	if (solutions < minUnsolvedCaptchas) throw new ProsopoEnvError("DATASET.SOLUTIONS_COUNT_LESS_THAN_CONFIGURED", { context: { failedFuncName: providerValidateDataset.name } });
+	const dataset = await buildDataset(datasetRaw);
+	if (!dataset.datasetId || !dataset.datasetContentId) throw new ProsopoEnvError("DATASET.DATASET_ID_UNDEFINED", { context: {
+		failedFuncName: providerValidateDataset.name,
+		datasetId: dataset.datasetId,
+		datasetContentId: dataset.datasetContentId
+	} });
+	return dataset;
 };
+//#endregion
+export { providerValidateDataset };

package/dist/tasks/decisionMachine/decisionMachineRunner.js

@@ -1,309 +1,220 @@
+import { CounterSpecSchema, DecisionMachineDecision, DecisionMachineKind, DecisionMachineOutputSchema, DecisionMachineRuntime, DecisionMachineScope, RoutingMachineOutputSchema } from "@prosopo/types";
 import vm from "node:vm";
-import { DecisionMachineDecision, CounterSpecSchema, DecisionMachineKind, DecisionMachineRuntime, DecisionMachineOutputSchema, RoutingMachineOutputSchema, DecisionMachineScope } from "@prosopo/types";
 import { z } from "zod";
-const LOAD_TIMEOUT_MS = Number.parseInt(process.env.DECISION_MACHINE_LOAD_TIMEOUT_MS ?? "", 10) || 1e3;
-const EXEC_TIMEOUT_MS = Number.parseInt(process.env.DECISION_MACHINE_EXEC_TIMEOUT_MS ?? "", 10) || 2e3;
-const ARTIFACT_CACHE_TTL_MS = Number.parseInt(
-  process.env.DECISION_MACHINE_ARTIFACT_CACHE_TTL_MS ?? "",
-  10
-) || 5 * 60 * 1e3;
-const DEFAULT_DECISION = {
-  decision: DecisionMachineDecision.Allow
-};
-const RequiredCountersSchema = z.array(CounterSpecSchema);
-class DecisionMachineRunner {
-  constructor(db) {
-    this.db = db;
-    this.artifactCache = /* @__PURE__ */ new Map();
-  }
-  /** Build a cache key for a given scope + kind + dappAccount tuple. */
-  static cacheKey(scope, kind, dappAccount) {
-    return `${scope}:${kind}:${dappAccount ?? ""}`;
-  }
-  /** Return a cached artifact if still fresh, or undefined. */
-  getCachedArtifact(scope, kind, dappAccount) {
-    const entry = this.artifactCache.get(
-      DecisionMachineRunner.cacheKey(scope, kind, dappAccount)
-    );
-    if (!entry) return null;
-    if (Date.now() - entry.cachedAt > ARTIFACT_CACHE_TTL_MS) {
-      this.artifactCache.delete(
-        DecisionMachineRunner.cacheKey(scope, kind, dappAccount)
-      );
-      return null;
-    }
-    return entry.artifact;
-  }
-  /** Store an artifact (or undefined for negative cache) in the cache. */
-  setCachedArtifact(scope, kind, dappAccount, artifact) {
-    this.artifactCache.set(
-      DecisionMachineRunner.cacheKey(scope, kind, dappAccount),
-      {
-        artifact,
-        cachedAt: Date.now()
-      }
-    );
-  }
-  /**
-   * Evaluates a single decision machine artifact and returns a decision.
-   * Only one decision machine is selected and executed per request based on scope priority.
-   *
-   * @param input - The decision machine input containing user, dapp, and behavioral data
-   * @param logger - Optional logger for warnings and errors
-   * @returns A decision (allow/deny) with optional metadata
-   */
-  async decide(input, logger) {
-    try {
-      const artifact = await this.selectArtifact(
-        input.dappAccount,
-        DecisionMachineKind.Decision,
-        input.captchaType
-      );
-      if (!artifact) {
-        return DEFAULT_DECISION;
-      }
-      if (artifact.runtime !== DecisionMachineRuntime.Node) {
-        logger?.warn?.(() => ({
-          msg: "Unsupported decision machine runtime, defaulting to allow",
-          data: { runtime: artifact.runtime }
-        }));
-        return DEFAULT_DECISION;
-      }
-      const decision = await this.runArtifactExport(
-        artifact,
-        ["decide", "default"],
-        { input: { ...input, phase: input.phase ?? "verify" } },
-        DecisionMachineOutputSchema
-      );
-      return decision ?? DEFAULT_DECISION;
-    } catch (error) {
-      logger?.error?.(() => ({
-        msg: "Decision machine failed, defaulting to allow",
-        err: error,
-        data: { dappAccount: input.dappAccount }
-      }));
-      return DEFAULT_DECISION;
-    }
-  }
-  /**
-   * Routing phase: ask the configured machine which concrete captcha type to
-   * serve. Returns undefined when no machine is configured, the machine has
-   * no route export, the machine throws or times out, or the output fails
-   * schema validation — caller should fall back to its baseline in any of
-   * these cases.
-   */
-  async route(input, logger) {
-    try {
-      const artifact = await this.selectArtifact(
-        input.dappAccount,
-        DecisionMachineKind.Routing
-      );
-      if (!artifact) return void 0;
-      if (artifact.runtime !== DecisionMachineRuntime.Node) {
-        logger?.warn?.(() => ({
-          msg: "Unsupported routing machine runtime, falling back to baseline",
-          data: { runtime: artifact.runtime }
-        }));
-        return void 0;
-      }
-      return await this.runArtifactExport(
-        artifact,
-        ["route"],
-        { input, optional: true },
-        RoutingMachineOutputSchema
-      );
-    } catch (error) {
-      logger?.error?.(() => ({
-        msg: "Routing machine failed, falling back to baseline",
-        err: error,
-        data: { dappAccount: input.dappAccount }
-      }));
-      return void 0;
-    }
-  }
-  /**
-   * Pre-fetch hook: ask the configured machine which counters it needs read
-   * into its input before {@link route} is invoked. Returns [] when no machine
-   * is configured or it doesn't declare any.
-   */
-  async getRequiredCounters(input, logger) {
-    try {
-      const artifact = await this.selectArtifact(
-        input.dappAccount,
-        DecisionMachineKind.Routing
-      );
-      if (!artifact) return [];
-      if (artifact.runtime !== DecisionMachineRuntime.Node) return [];
-      const specs = await this.runArtifactExport(
-        artifact,
-        ["requiredCounters"],
-        { input, optional: true },
-        RequiredCountersSchema
-      );
-      return specs ?? [];
-    } catch (error) {
-      logger?.warn?.(() => ({
-        msg: "requiredCounters() failed, proceeding with no counters",
-        err: error,
-        data: { dappAccount: input.dappAccount }
-      }));
-      return [];
-    }
-  }
-  /**
-   * Selects a single decision machine artifact based on scope priority.
-   * Currently supports two scopes with the following priority:
-   *   1. Dapp-specific: Custom decision machine for a specific dapp account
-   *   2. Global: Default decision machine applied to all dapps
-   *
-   * Decision machines can optionally specify a captchaType filter:
-   *   - If artifact has no captchaType: runs on all captcha types
-   *   - If artifact has captchaType: only runs on matching captcha type
-   *
-   * @param dappAccount - The dapp account identifier to check for dapp-specific artifacts
-   * @param captchaType - The captcha type to filter by (optional)
-   * @returns The single highest-priority artifact, or undefined if none exists
-   */
-  async selectArtifact(dappAccount, kind, captchaType) {
-    const cachedDapp = this.getCachedArtifact(
-      DecisionMachineScope.Dapp,
-      kind,
-      dappAccount
-    );
-    const cachedGlobal = this.getCachedArtifact(
-      DecisionMachineScope.Global,
-      kind
-    );
-    if (cachedDapp !== null && cachedGlobal !== null) {
-      if (cachedDapp && this.matchesCaptchaType(cachedDapp, captchaType)) {
-        return cachedDapp;
-      }
-      if (cachedGlobal && this.matchesCaptchaType(cachedGlobal, captchaType)) {
-        return cachedGlobal;
-      }
-      return void 0;
-    }
-    const [dappArtifact, globalArtifact] = await Promise.all([
-      cachedDapp !== null ? Promise.resolve(cachedDapp) : this.db.getDecisionMachineArtifact(
-        DecisionMachineScope.Dapp,
-        dappAccount,
-        kind
-      ).then((a) => {
-        this.setCachedArtifact(
-          DecisionMachineScope.Dapp,
-          kind,
-          dappAccount,
-          a ?? void 0
-        );
-        return a ?? void 0;
-      }),
-      cachedGlobal !== null ? Promise.resolve(cachedGlobal) : this.db.getDecisionMachineArtifact(
-        DecisionMachineScope.Global,
-        void 0,
-        kind
-      ).then((a) => {
-        this.setCachedArtifact(
-          DecisionMachineScope.Global,
-          kind,
-          void 0,
-          a ?? void 0
-        );
-        return a ?? void 0;
-      })
-    ]);
-    if (dappArtifact && this.matchesCaptchaType(dappArtifact, captchaType)) {
-      return dappArtifact;
-    }
-    if (globalArtifact && this.matchesCaptchaType(globalArtifact, captchaType)) {
-      return globalArtifact;
-    }
-    return void 0;
-  }
-  /**
-   * Checks if a decision machine artifact matches the requested captcha type.
-   * - If artifact has no captchaType filter: matches all captcha types
-   * - If artifact has captchaType filter: only matches if types are equal
-   *
-   * @param artifact - The decision machine artifact to check
-   * @param captchaType - The captcha type to match against (optional)
-   * @returns True if the artifact should run for this captcha type
-   */
-  matchesCaptchaType(artifact, captchaType) {
-    if (!artifact.captchaType) {
-      return true;
-    }
-    return artifact.captchaType === captchaType;
-  }
-  /**
-   * Load the artifact source into a fresh vm sandbox, locate a callable
-   * matching one of {exportNames} (or `module.exports` itself if it's a
-   * function), invoke it with {input}, and validate the result with
-   * {schema}. Returns undefined when {options.optional} is true and no
-   * matching export exists. Otherwise throws on missing export, invalid
-   * output, or sandbox failure.
-   */
-  async runArtifactExport(artifact, exportNames, options, schema) {
-    const sandbox = {
-      module: { exports: {} },
-      exports: {}
-    };
-    const context = vm.createContext(sandbox);
-    const script = new vm.Script(artifact.source, {
-      filename: "decision-machine.js"
-    });
-    script.runInContext(context, { timeout: LOAD_TIMEOUT_MS });
-    const exported = sandbox.module.exports;
-    const named = this.findExport(exported, exportNames);
-    if (!named) {
-      if (options.optional) return void 0;
-      throw new Error(
-        `Decision machine must export one of: ${exportNames.join(", ")}`
-      );
-    }
-    const result = await this.withTimeout(
-      Promise.resolve(named.fn(options.input)),
-      EXEC_TIMEOUT_MS
-    );
-    const parsed = schema.safeParse(result);
-    if (!parsed.success) {
-      throw new Error(
-        `Decision machine '${named.name}' output failed validation`
-      );
-    }
-    return parsed.data;
-  }
-  findExport(exported, exportNames) {
-    if (typeof exported === "function" && (exportNames.includes("default") || exportNames.includes("decide"))) {
-      return {
-        name: "default",
-        fn: exported
-      };
-    }
-    for (const name of exportNames) {
-      const candidate = exported?.[name];
-      if (typeof candidate === "function") {
-        return { name, fn: candidate };
-      }
-    }
-    return void 0;
-  }
-  async withTimeout(promise, timeoutMs) {
-    let timeoutId;
-    const timeoutPromise = new Promise((_, reject) => {
-      timeoutId = setTimeout(
-        () => reject(new Error("Decision machine timeout")),
-        timeoutMs
-      );
-    });
-    try {
-      return await Promise.race([promise, timeoutPromise]);
-    } finally {
-      if (timeoutId) {
-        clearTimeout(timeoutId);
-      }
-    }
-  }
-}
-export {
-  DecisionMachineRunner
+//#region src/tasks/decisionMachine/decisionMachineRunner.ts
+var LOAD_TIMEOUT_MS = Number.parseInt(process.env.DECISION_MACHINE_LOAD_TIMEOUT_MS ?? "", 10) || 1e3;
+var EXEC_TIMEOUT_MS = Number.parseInt(process.env.DECISION_MACHINE_EXEC_TIMEOUT_MS ?? "", 10) || 2e3;
+/** How long cached artifacts are considered fresh (ms). */
+var ARTIFACT_CACHE_TTL_MS = Number.parseInt(process.env.DECISION_MACHINE_ARTIFACT_CACHE_TTL_MS ?? "", 10) || 300 * 1e3;
+var DEFAULT_DECISION = { decision: DecisionMachineDecision.Allow };
+var RequiredCountersSchema = z.array(CounterSpecSchema);
+var DecisionMachineRunner = class DecisionMachineRunner {
+	constructor(db) {
+		this.db = db;
+		this.artifactCache = /* @__PURE__ */ new Map();
+	}
+	/** Build a cache key for a given scope + kind + dappAccount tuple. */
+	static cacheKey(scope, kind, dappAccount) {
+		return `${scope}:${kind}:${dappAccount ?? ""}`;
+	}
+	/** Return a cached artifact if still fresh, or undefined. */
+	getCachedArtifact(scope, kind, dappAccount) {
+		const entry = this.artifactCache.get(DecisionMachineRunner.cacheKey(scope, kind, dappAccount));
+		if (!entry) return null;
+		if (Date.now() - entry.cachedAt > ARTIFACT_CACHE_TTL_MS) {
+			this.artifactCache.delete(DecisionMachineRunner.cacheKey(scope, kind, dappAccount));
+			return null;
+		}
+		return entry.artifact;
+	}
+	/** Store an artifact (or undefined for negative cache) in the cache. */
+	setCachedArtifact(scope, kind, dappAccount, artifact) {
+		this.artifactCache.set(DecisionMachineRunner.cacheKey(scope, kind, dappAccount), {
+			artifact,
+			cachedAt: Date.now()
+		});
+	}
+	/**
+	* Evaluates a single decision machine artifact and returns a decision.
+	* Only one decision machine is selected and executed per request based on scope priority.
+	*
+	* @param input - The decision machine input containing user, dapp, and behavioral data
+	* @param logger - Optional logger for warnings and errors
+	* @returns A decision (allow/deny) with optional metadata
+	*/
+	async decide(input, logger) {
+		try {
+			const artifact = await this.selectArtifact(input.dappAccount, DecisionMachineKind.Decision, input.captchaType);
+			if (!artifact) return DEFAULT_DECISION;
+			if (artifact.runtime !== DecisionMachineRuntime.Node) {
+				logger?.warn?.(() => ({
+					msg: "Unsupported decision machine runtime, defaulting to allow",
+					data: { runtime: artifact.runtime }
+				}));
+				return DEFAULT_DECISION;
+			}
+			return await this.runArtifactExport(artifact, ["decide", "default"], { input: {
+				...input,
+				phase: input.phase ?? "verify"
+			} }, DecisionMachineOutputSchema) ?? DEFAULT_DECISION;
+		} catch (error) {
+			logger?.error?.(() => ({
+				msg: "Decision machine failed, defaulting to allow",
+				err: error,
+				data: { dappAccount: input.dappAccount }
+			}));
+			return DEFAULT_DECISION;
+		}
+	}
+	/**
+	* Routing phase: ask the configured machine which concrete captcha type to
+	* serve. Returns undefined when no machine is configured, the machine has
+	* no route export, the machine throws or times out, or the output fails
+	* schema validation — caller should fall back to its baseline in any of
+	* these cases.
+	*/
+	async route(input, logger) {
+		try {
+			const artifact = await this.selectArtifact(input.dappAccount, DecisionMachineKind.Routing);
+			if (!artifact) return void 0;
+			if (artifact.runtime !== DecisionMachineRuntime.Node) {
+				logger?.warn?.(() => ({
+					msg: "Unsupported routing machine runtime, falling back to baseline",
+					data: { runtime: artifact.runtime }
+				}));
+				return;
+			}
+			return await this.runArtifactExport(artifact, ["route"], {
+				input,
+				optional: true
+			}, RoutingMachineOutputSchema);
+		} catch (error) {
+			logger?.error?.(() => ({
+				msg: "Routing machine failed, falling back to baseline",
+				err: error,
+				data: { dappAccount: input.dappAccount }
+			}));
+			return;
+		}
+	}
+	/**
+	* Pre-fetch hook: ask the configured machine which counters it needs read
+	* into its input before {@link route} is invoked. Returns [] when no machine
+	* is configured or it doesn't declare any.
+	*/
+	async getRequiredCounters(input, logger) {
+		try {
+			const artifact = await this.selectArtifact(input.dappAccount, DecisionMachineKind.Routing);
+			if (!artifact) return [];
+			if (artifact.runtime !== DecisionMachineRuntime.Node) return [];
+			return await this.runArtifactExport(artifact, ["requiredCounters"], {
+				input,
+				optional: true
+			}, RequiredCountersSchema) ?? [];
+		} catch (error) {
+			logger?.warn?.(() => ({
+				msg: "requiredCounters() failed, proceeding with no counters",
+				err: error,
+				data: { dappAccount: input.dappAccount }
+			}));
+			return [];
+		}
+	}
+	/**
+	* Selects a single decision machine artifact based on scope priority.
+	* Currently supports two scopes with the following priority:
+	*   1. Dapp-specific: Custom decision machine for a specific dapp account
+	*   2. Global: Default decision machine applied to all dapps
+	*
+	* Decision machines can optionally specify a captchaType filter:
+	*   - If artifact has no captchaType: runs on all captcha types
+	*   - If artifact has captchaType: only runs on matching captcha type
+	*
+	* @param dappAccount - The dapp account identifier to check for dapp-specific artifacts
+	* @param captchaType - The captcha type to filter by (optional)
+	* @returns The single highest-priority artifact, or undefined if none exists
+	*/
+	async selectArtifact(dappAccount, kind, captchaType) {
+		const cachedDapp = this.getCachedArtifact(DecisionMachineScope.Dapp, kind, dappAccount);
+		const cachedGlobal = this.getCachedArtifact(DecisionMachineScope.Global, kind);
+		if (cachedDapp !== null && cachedGlobal !== null) {
+			if (cachedDapp && this.matchesCaptchaType(cachedDapp, captchaType)) return cachedDapp;
+			if (cachedGlobal && this.matchesCaptchaType(cachedGlobal, captchaType)) return cachedGlobal;
+			return;
+		}
+		const [dappArtifact, globalArtifact] = await Promise.all([cachedDapp !== null ? Promise.resolve(cachedDapp) : this.db.getDecisionMachineArtifact(DecisionMachineScope.Dapp, dappAccount, kind).then((a) => {
+			this.setCachedArtifact(DecisionMachineScope.Dapp, kind, dappAccount, a ?? void 0);
+			return a ?? void 0;
+		}), cachedGlobal !== null ? Promise.resolve(cachedGlobal) : this.db.getDecisionMachineArtifact(DecisionMachineScope.Global, void 0, kind).then((a) => {
+			this.setCachedArtifact(DecisionMachineScope.Global, kind, void 0, a ?? void 0);
+			return a ?? void 0;
+		})]);
+		if (dappArtifact && this.matchesCaptchaType(dappArtifact, captchaType)) return dappArtifact;
+		if (globalArtifact && this.matchesCaptchaType(globalArtifact, captchaType)) return globalArtifact;
+	}
+	/**
+	* Checks if a decision machine artifact matches the requested captcha type.
+	* - If artifact has no captchaType filter: matches all captcha types
+	* - If artifact has captchaType filter: only matches if types are equal
+	*
+	* @param artifact - The decision machine artifact to check
+	* @param captchaType - The captcha type to match against (optional)
+	* @returns True if the artifact should run for this captcha type
+	*/
+	matchesCaptchaType(artifact, captchaType) {
+		if (!artifact.captchaType) return true;
+		return artifact.captchaType === captchaType;
+	}
+	/**
+	* Load the artifact source into a fresh vm sandbox, locate a callable
+	* matching one of {exportNames} (or `module.exports` itself if it's a
+	* function), invoke it with {input}, and validate the result with
+	* {schema}. Returns undefined when {options.optional} is true and no
+	* matching export exists. Otherwise throws on missing export, invalid
+	* output, or sandbox failure.
+	*/
+	async runArtifactExport(artifact, exportNames, options, schema) {
+		const sandbox = {
+			module: { exports: {} },
+			exports: {}
+		};
+		const context = vm.createContext(sandbox);
+		new vm.Script(artifact.source, { filename: "decision-machine.js" }).runInContext(context, { timeout: LOAD_TIMEOUT_MS });
+		const exported = sandbox.module.exports;
+		const named = this.findExport(exported, exportNames);
+		if (!named) {
+			if (options.optional) return void 0;
+			throw new Error(`Decision machine must export one of: ${exportNames.join(", ")}`);
+		}
+		const result = await this.withTimeout(Promise.resolve(named.fn(options.input)), EXEC_TIMEOUT_MS);
+		const parsed = schema.safeParse(result);
+		if (!parsed.success) throw new Error(`Decision machine '${named.name}' output failed validation`);
+		return parsed.data;
+	}
+	findExport(exported, exportNames) {
+		if (typeof exported === "function" && (exportNames.includes("default") || exportNames.includes("decide"))) return {
+			name: "default",
+			fn: exported
+		};
+		for (const name of exportNames) {
+			const candidate = exported?.[name];
+			if (typeof candidate === "function") return {
+				name,
+				fn: candidate
+			};
+		}
+	}
+	async withTimeout(promise, timeoutMs) {
+		let timeoutId;
+		const timeoutPromise = new Promise((_, reject) => {
+			timeoutId = setTimeout(() => reject(/* @__PURE__ */ new Error("Decision machine timeout")), timeoutMs);
+		});
+		try {
+			return await Promise.race([promise, timeoutPromise]);
+		} finally {
+			if (timeoutId) clearTimeout(timeoutId);
+		}
+	}
 };
+//#endregion
+export { DecisionMachineRunner };