@questpie/sandbox 3.16.0 → 3.17.0

package/dist/adapter-http-Coy4jqsj.mjs

@@ -0,0 +1,865 @@
+import { i as parseSandboxRunResult, n as registerSandboxCustomToolsSession } from "./custom-tools-DxI7JvUn.mjs";
+
+//#region src/net-validation.ts
+/**
+* Parse a `host[:port]` allowlist entry (Deno `--allow-net` syntax).
+* Bracketed IPv6 (`[::1]:443`) and bare IPv6 (`::1`) are both handled.
+*/
+function parseHostEntry(entry) {
+	const trimmed = entry.trim();
+	if (trimmed.startsWith("[")) {
+		const close = trimmed.indexOf("]");
+		if (close === -1) return { host: trimmed };
+		const host = trimmed.slice(1, close);
+		const rest = trimmed.slice(close + 1);
+		if (rest.startsWith(":")) {
+			const port = Number(rest.slice(1));
+			return Number.isInteger(port) ? {
+				host,
+				port
+			} : { host };
+		}
+		return { host };
+	}
+	if ((trimmed.match(/:/g)?.length ?? 0) > 1) return { host: trimmed };
+	const lastColon = trimmed.lastIndexOf(":");
+	if (lastColon !== -1) {
+		const maybePort = Number(trimmed.slice(lastColon + 1));
+		if (Number.isInteger(maybePort)) return {
+			host: trimmed.slice(0, lastColon),
+			port: maybePort
+		};
+	}
+	return { host: trimmed };
+}
+/** True if `s` is a syntactically-valid dotted-quad IPv4 literal. */
+function isIpv4Literal(s) {
+	const parts = s.split(".");
+	if (parts.length !== 4) return false;
+	return parts.every((p) => {
+		if (!/^\d{1,3}$/.test(p)) return false;
+		const n = Number(p);
+		return n >= 0 && n <= 255;
+	});
+}
+/** True if `s` looks like an IPv6 literal (contains a colon, hex/`:`/`.` only). */
+function isIpv6Literal(s) {
+	if (!s.includes(":")) return false;
+	return /^[0-9a-fA-F:.]+$/.test(s);
+}
+/**
+* Classify an IPv4 literal as private/link-local/loopback/metadata/CGNAT.
+* Ranges (all per the task + cloud-metadata convention):
+*   0.0.0.0/8 (this-host), 127/8 (loopback), 10/8, 172.16/12, 192.168/16 (RFC-1918),
+*   169.254/16 (link-local, incl. 169.254.169.254 metadata), 100.64/10 (CGNAT/RFC-6598).
+*/
+function isPrivateIpv4(ip) {
+	const [a, b] = ip.split(".").map(Number);
+	if (a === 0) return true;
+	if (a === 127) return true;
+	if (a === 10) return true;
+	if (a === 172 && b >= 16 && b <= 31) return true;
+	if (a === 192 && b === 168) return true;
+	if (a === 169 && b === 254) return true;
+	if (a === 100 && b >= 64 && b <= 127) return true;
+	return false;
+}
+/** Normalize an IPv6 literal to lowercase, stripping a `%zone` suffix. */
+function normalizeIpv6(ip) {
+	const pct = ip.indexOf("%");
+	return (pct === -1 ? ip : ip.slice(0, pct)).toLowerCase();
+}
+/**
+* Classify an IPv6 literal as private/link-local/loopback/metadata.
+* Covers: ::1 (loopback), :: (unspecified), fc00::/7 (unique-local),
+* fe80::/10 (link-local), and IPv4-mapped/translated forms (::ffff:a.b.c.d,
+* ::a.b.c.d) by delegating their embedded IPv4 to `isPrivateIpv4`.
+*/
+function isPrivateIpv6(raw) {
+	const ip = normalizeIpv6(raw);
+	if (ip === "::1") return true;
+	if (ip === "::" || ip === "") return true;
+	const v4Tail = ip.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+	if (v4Tail && isIpv4Literal(v4Tail[1])) {
+		if (ip.startsWith("::")) return isPrivateIpv4(v4Tail[1]);
+	}
+	const mapped = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+	if (mapped) {
+		const hi = Number.parseInt(mapped[1], 16) & 65535;
+		const lo = Number.parseInt(mapped[2], 16) & 65535;
+		return isPrivateIpv4(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+	}
+	if (/^f[cd][0-9a-f]{0,2}:/.test(ip) || ip.startsWith("fc") || ip.startsWith("fd")) {
+		const first = ip.split(":")[0];
+		if (first.length > 0) {
+			if ((Number.parseInt(first.padStart(4, "0").slice(0, 2), 16) & 254) === 252) return true;
+		}
+	}
+	if (ip.startsWith("fe8") || ip.startsWith("fe9") || ip.startsWith("fea") || ip.startsWith("feb")) return true;
+	return false;
+}
+/**
+* Classify a bare IP literal (v4 or v6) as a blocked egress target.
+* Returns `{ ok:false, reason }` when the IP is private/link-local/loopback/metadata.
+*/
+function classifyIpLiteral(ip) {
+	if (isIpv4Literal(ip)) return isPrivateIpv4(ip) ? {
+		ok: false,
+		reason: `private/link-local/loopback IPv4: ${ip}`
+	} : { ok: true };
+	if (isIpv6Literal(ip)) return isPrivateIpv6(ip) ? {
+		ok: false,
+		reason: `private/link-local/loopback IPv6: ${ip}`
+	} : { ok: true };
+	return { ok: true };
+}
+/** Bound each DNS lookup so a slow/hanging resolver can't stall validation. */
+const DNS_TIMEOUT_MS = 3e3;
+function withDnsTimeout(promise, timeoutMs = DNS_TIMEOUT_MS, signal) {
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const finish = (callback) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+			callback();
+		};
+		const onAbort = () => finish(() => reject(/* @__PURE__ */ new Error("DNS lookup cancelled")));
+		const timer = setTimeout(() => finish(() => reject(/* @__PURE__ */ new Error(`DNS lookup timed out (${timeoutMs}ms)`))), timeoutMs);
+		if (signal?.aborted) onAbort();
+		else signal?.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => finish(() => resolve(value)), (error) => finish(() => reject(error)));
+	});
+}
+/** Lazily load `node:dns/promises` `resolve` (works on both Bun and Deno). */
+let cachedResolver;
+async function defaultResolver(hostname) {
+	if (!cachedResolver) {
+		const dns = await import("node:dns/promises");
+		cachedResolver = async (h) => {
+			const [v4, v6] = await Promise.allSettled([withDnsTimeout(dns.resolve4(h)), withDnsTimeout(dns.resolve6(h))]);
+			const out = [];
+			if (v4.status === "fulfilled") out.push(...v4.value);
+			if (v6.status === "fulfilled") out.push(...v6.value);
+			if (out.length === 0 && v4.status === "rejected" && v6.status === "rejected") throw new Error(`DNS resolution failed (v4: ${reasonOf(v4)}, v6: ${reasonOf(v6)})`);
+			return out;
+		};
+	}
+	return cachedResolver(hostname);
+}
+function reasonOf(settled) {
+	const r = settled.reason;
+	return r instanceof Error ? r.message : String(r);
+}
+/**
+* Validate a single `host[:port]` allowlist entry against the private-IP policy.
+*
+* - IP literals are classified directly (no DNS).
+* - Hostnames are DNS-resolved; if ANY resolved address is private/link-local/
+*   loopback/metadata, the host is REJECTED (DNS-rebind defense at manifest time).
+* - `localhost` and the `.local` mDNS suffix are rejected up-front.
+*
+* `resolve` is injectable for tests / Deno; defaults to `node:dns/promises`.
+*/
+async function validateHostEgress(entry, opts = {}) {
+	if (opts.signal?.aborted) return {
+		ok: false,
+		reason: "DNS lookup cancelled"
+	};
+	const { host } = parseHostEntry(entry);
+	const lower = host.toLowerCase();
+	if (lower.length === 0) return {
+		ok: false,
+		reason: "empty host"
+	};
+	if (lower === "localhost" || lower.endsWith(".localhost") || lower.endsWith(".local")) return {
+		ok: false,
+		reason: `loopback/mDNS hostname not allowed: ${host}`
+	};
+	const literal = classifyIpLiteral(host);
+	if (!literal.ok) return literal;
+	if (isIpv4Literal(host) || isIpv6Literal(host)) return { ok: true };
+	const resolver = opts.resolve ?? defaultResolver;
+	let addrs;
+	try {
+		addrs = await withDnsTimeout(resolver(host), opts.timeoutMs ?? DNS_TIMEOUT_MS, opts.signal);
+	} catch (err) {
+		return {
+			ok: false,
+			reason: `DNS resolution failed for ${host}: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+	if (addrs.length === 0) return {
+		ok: false,
+		reason: `DNS resolution returned no addresses for ${host}`
+	};
+	for (const addr of addrs) {
+		const c = classifyIpLiteral(addr);
+		if (!c.ok) return {
+			ok: false,
+			reason: `${host} resolves to a blocked address (${c.reason})`
+		};
+	}
+	return { ok: true };
+}
+/**
+* Validate ALL `net` + `import` hosts in a capability set.
+* Returns the first rejection found, or `{ ok:true }` if every host passes.
+*/
+async function validateEgressHosts(hosts, opts = {}) {
+	if (hosts.length === 0) return { ok: true };
+	const controller = new AbortController();
+	const onAbort = () => controller.abort();
+	if (opts.signal?.aborted) controller.abort();
+	else opts.signal?.addEventListener("abort", onAbort, { once: true });
+	const timeoutMs = Math.max(1, Math.min(DNS_TIMEOUT_MS, Math.floor(opts.timeoutMs ?? DNS_TIMEOUT_MS)));
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	const concurrency = Math.max(1, Math.min(8, Math.floor(opts.concurrency ?? 4)));
+	const results = Array.from({ length: hosts.length });
+	let cursor = 0;
+	const worker = async () => {
+		while (cursor < hosts.length) {
+			const index = cursor;
+			cursor += 1;
+			results[index] = await validateHostEgress(hosts[index], {
+				...opts,
+				signal: controller.signal,
+				timeoutMs
+			});
+		}
+	};
+	try {
+		await Promise.all(Array.from({ length: Math.min(concurrency, hosts.length) }, () => worker()));
+	} finally {
+		clearTimeout(timer);
+		opts.signal?.removeEventListener("abort", onAbort);
+	}
+	for (let index = 0; index < results.length; index += 1) {
+		const result = results[index];
+		if (!result.ok) return {
+			ok: false,
+			reason: `host "${hosts[index]}": ${result.reason}`
+		};
+	}
+	return { ok: true };
+}
+
+//#endregion
+//#region src/types.ts
+/** Line prefix marking a framed protocol message on guest stdout. */
+const FRAME_MARKER = "__QP_SANDBOX_MSG__";
+/**
+* Header carrying the per-run scoped token on the supervisor → broker request.
+* Mirrors `questpie`'s `BINDINGS_TOKEN_HEADER`. Supervisor-only; never set by or
+* exposed to guest code.
+*/
+const BINDINGS_TOKEN_HEADER = "x-questpie-sandbox-token";
+/** Host-issued admission binding an authorized workload to one exact request. */
+const WORKLOAD_ADMISSION_HEADER = "x-questpie-workload-admission";
+/** Trusted service identity for the structurally separate direct-host path. */
+const HOST_ADMISSION_HEADER = "x-questpie-sandbox-host-admission";
+
+//#endregion
+//#region src/workload-admission.ts
+const ADMISSION_VERSION = "qpsw1";
+const MINIMUM_SECRET_BYTES = 32;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function encodeBase64Url(value) {
+	let binary = "";
+	for (const byte of value) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function isIdentity(value) {
+	return typeof value === "string" && value.length <= 128 && /^[A-Za-z0-9_-]+$/.test(value);
+}
+function assertSandboxWorkloadAdmissionKey(key) {
+	if (!isIdentity(key.keyId) || !isIdentity(key.instanceId) || key.secret.byteLength < MINIMUM_SECRET_BYTES) throw new Error("Invalid sandbox workload admission configuration.");
+}
+async function importHmacKey(key, usage) {
+	assertSandboxWorkloadAdmissionKey(key);
+	return crypto.subtle.importKey("raw", Uint8Array.from(key.secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, [usage]);
+}
+async function sha256(value) {
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(value));
+	return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sealSandboxWorkloadAdmission(key, claims, requestBody) {
+	const payload = {
+		...claims,
+		requestSha256: await sha256(requestBody)
+	};
+	const signed = `${ADMISSION_VERSION}.${encodeBase64Url(encoder.encode(key.keyId))}.${encodeBase64Url(encoder.encode(JSON.stringify(payload)))}`;
+	const cryptoKey = await importHmacKey(key, "sign");
+	const signature = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(signed));
+	return `${signed}.${encodeBase64Url(new Uint8Array(signature))}`;
+}
+
+//#endregion
+//#region src/workload.ts
+const SANDBOX_WORKLOAD_DENIAL_MESSAGE = "The workload is not authorized for this sandbox operation.";
+var SandboxWorkloadDeniedError = class extends Error {
+	code = "sandbox_authority_denied";
+	constructor() {
+		super(SANDBOX_WORKLOAD_DENIAL_MESSAGE);
+		this.name = "SandboxWorkloadDeniedError";
+	}
+};
+const MAX_SOURCE_BYTES = 1048576;
+const MAX_NAMED_VALUES = 64;
+const MAX_HOSTS_PER_AXIS = 32;
+const MAX_TOTAL_HOSTS = 32;
+const MAX_SECRET_VALUE_BYTES = 65536;
+const MAX_TOTAL_SECRET_BYTES = 262144;
+const MAX_INPUT_DEPTH = 32;
+const MAX_INPUT_NODES = 1e4;
+const MAX_INPUT_BYTES = 1048576;
+const MAX_BINDINGS_URL_BYTES = 2048;
+const MAX_BINDINGS_TOKEN_BYTES = 8192;
+const utf8Encoder = new TextEncoder();
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Copy enumerable data descriptors without invoking getters. Proxy traps and
+* exotic prototypes are rejected by the caller's fail-closed catch.
+*/
+function snapshotDataRecord(value) {
+	if (!isRecord(value)) return null;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const result = Object.create(null);
+	for (const key of Reflect.ownKeys(value)) {
+		if (typeof key !== "string") return null;
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		if (!descriptor || !descriptor.enumerable || !("value" in descriptor)) return null;
+		result[key] = descriptor.value;
+	}
+	return result;
+}
+function exactOrOptionalKeys(value, required, optional) {
+	const keys = Object.keys(value);
+	return required.every((key) => keys.includes(key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+}
+function normalizeHosts(value) {
+	if (!Array.isArray(value) || value.length > MAX_HOSTS_PER_AXIS) return null;
+	const hosts = [];
+	for (const host of value) {
+		if (typeof host !== "string" || host.length === 0 || host.length > 253 || host.includes("*") || host.includes("/") || /\s/.test(host)) return null;
+		hosts.push(host);
+	}
+	return Object.freeze(hosts);
+}
+function normalizeCapabilities(value) {
+	const record = snapshotDataRecord(value);
+	if (!record || !exactOrOptionalKeys(record, [
+		"net",
+		"import",
+		"timeoutMs",
+		"memoryMb"
+	], [])) return null;
+	const net = normalizeHosts(record.net);
+	const imports = normalizeHosts(record.import);
+	if (!net || !imports || net.length + imports.length > MAX_TOTAL_HOSTS || typeof record.timeoutMs !== "number" || !Number.isInteger(record.timeoutMs) || record.timeoutMs < 1 || record.timeoutMs > 3e4 || typeof record.memoryMb !== "number" || !Number.isInteger(record.memoryMb) || record.memoryMb < 16 || record.memoryMb > 1024) return null;
+	return Object.freeze({
+		net: [...net],
+		import: [...imports],
+		timeoutMs: record.timeoutMs,
+		memoryMb: record.memoryMb
+	});
+}
+function normalizeSecrets(value) {
+	const record = snapshotDataRecord(value);
+	if (!record || Object.keys(record).length > MAX_NAMED_VALUES) return null;
+	const result = Object.create(null);
+	let totalBytes = 0;
+	for (const [name, secret] of Object.entries(record)) {
+		const nameBytes = utf8Encoder.encode(name).byteLength;
+		const secretBytes = typeof secret === "string" ? utf8Encoder.encode(secret).byteLength : Number.POSITIVE_INFINITY;
+		totalBytes += nameBytes + secretBytes;
+		if (!/^[A-Za-z0-9_.-]+$/.test(name) || typeof secret !== "string" || secretBytes > MAX_SECRET_VALUE_BYTES || totalBytes > MAX_TOTAL_SECRET_BYTES) return null;
+		result[name] = secret;
+	}
+	return Object.freeze(result);
+}
+function normalizeBindings(value) {
+	const record = snapshotDataRecord(value);
+	if (!record || !exactOrOptionalKeys(record, ["url", "token"], []) || typeof record.url !== "string" || record.url.length === 0 || utf8Encoder.encode(record.url).byteLength > MAX_BINDINGS_URL_BYTES || typeof record.token !== "string" || record.token.length === 0 || utf8Encoder.encode(record.token).byteLength > MAX_BINDINGS_TOKEN_BYTES) return null;
+	if (!URL.canParse(record.url)) return null;
+	return Object.freeze({
+		url: record.url,
+		token: record.token
+	});
+}
+function consumeJsonBudget(budget, bytes) {
+	budget.nodes += 1;
+	budget.bytes += bytes;
+	return budget.nodes <= MAX_INPUT_NODES && budget.bytes <= MAX_INPUT_BYTES;
+}
+function snapshotJson(value, seen = /* @__PURE__ */ new Set(), budget = {
+	nodes: 0,
+	bytes: 0
+}, depth = 0) {
+	if (depth > MAX_INPUT_DEPTH) return { ok: false };
+	if (value === null || typeof value === "string" || typeof value === "boolean") return consumeJsonBudget(budget, typeof value === "string" ? utf8Encoder.encode(value).byteLength : 5) ? {
+		ok: true,
+		value
+	} : { ok: false };
+	if (typeof value === "number") return Number.isFinite(value) && consumeJsonBudget(budget, 24) ? {
+		ok: true,
+		value
+	} : { ok: false };
+	if (typeof value !== "object" || seen.has(value)) return { ok: false };
+	if (!consumeJsonBudget(budget, 2)) return { ok: false };
+	seen.add(value);
+	if (Array.isArray(value)) {
+		const descriptors = Object.getOwnPropertyDescriptors(value);
+		const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+		const arrayLength = lengthDescriptor && "value" in lengthDescriptor ? lengthDescriptor.value : null;
+		if (typeof arrayLength !== "number" || !Number.isInteger(arrayLength) || arrayLength < 0 || arrayLength > MAX_INPUT_NODES || Object.keys(descriptors).some((key) => key !== "length" && !/^(0|[1-9]\d*)$/.test(key))) return { ok: false };
+		const result$1 = [];
+		for (let index = 0; index < arrayLength; index += 1) {
+			const descriptor = descriptors[String(index)];
+			if (!descriptor) {
+				if (!consumeJsonBudget(budget, 4)) return { ok: false };
+				result$1.push(null);
+				continue;
+			}
+			if (!descriptor.enumerable || !("value" in descriptor)) return { ok: false };
+			const item = snapshotJson(descriptor.value, seen, budget, depth + 1);
+			if (!item.ok) return item;
+			result$1.push(item.value);
+		}
+		seen.delete(value);
+		return {
+			ok: true,
+			value: Object.freeze(result$1)
+		};
+	}
+	const record = snapshotDataRecord(value);
+	if (!record) return { ok: false };
+	const result = Object.create(null);
+	for (const [key, itemValue] of Object.entries(record)) {
+		if (!consumeJsonBudget(budget, utf8Encoder.encode(key).byteLength)) return { ok: false };
+		const item = snapshotJson(itemValue, seen, budget, depth + 1);
+		if (!item.ok) return item;
+		result[key] = item.value;
+	}
+	seen.delete(value);
+	return {
+		ok: true,
+		value: Object.freeze(result)
+	};
+}
+function snapshotSandboxWorkloadPolicy(value, now = /* @__PURE__ */ new Date()) {
+	try {
+		const policy = snapshotDataRecord(value);
+		if (!policy || !exactOrOptionalKeys(policy, ["source", "capabilities"], [
+			"input",
+			"secrets",
+			"bindings",
+			"sandboxTools",
+			"validUntil"
+		]) || typeof policy.source !== "string" || policy.source.length === 0 || new TextEncoder().encode(policy.source).byteLength > MAX_SOURCE_BYTES) return null;
+		const capabilities = normalizeCapabilities(policy.capabilities);
+		const secrets = normalizeSecrets(policy.secrets ?? {});
+		const bindings = policy.bindings === void 0 ? void 0 : normalizeBindings(policy.bindings);
+		const sandboxTools = policy.sandboxTools === void 0 ? void 0 : snapshotDataRecord(policy.sandboxTools);
+		if (!capabilities || !secrets || policy.bindings !== void 0 && !bindings || policy.sandboxTools !== void 0 && (!sandboxTools || !exactOrOptionalKeys(sandboxTools, ["envelope"], []) || sandboxTools.envelope === void 0 || !bindings)) return null;
+		if (policy.validUntil !== void 0 && (typeof policy.validUntil !== "string" || !Number.isFinite(Date.parse(policy.validUntil)) || Date.parse(policy.validUntil) <= now.getTime())) return null;
+		const input = snapshotJson(policy.input ?? null);
+		if (!input.ok) return null;
+		return Object.freeze({
+			source: policy.source,
+			input: input.value,
+			capabilities,
+			secrets,
+			...bindings ? { bindings } : {},
+			...sandboxTools ? { sandboxTools: Object.freeze({ envelope: sandboxTools.envelope }) } : {},
+			...typeof policy.validUntil === "string" ? { validUntil: policy.validUntil } : {}
+		});
+	} catch {
+		return null;
+	}
+}
+function serializeSandboxWorkloadPolicy(policy) {
+	return JSON.stringify({
+		source: policy.source,
+		input: policy.input ?? null,
+		capabilities: policy.capabilities,
+		secrets: policy.secrets ?? {},
+		...policy.bindings ? { bindings: policy.bindings } : {},
+		...policy.validUntil ? { validUntil: policy.validUntil } : {}
+	});
+}
+
+//#endregion
+//#region src/adapter-http.ts
+const DEFAULT_GUEST_TIMEOUT_MS = 5e3;
+const MAX_WORKLOAD_ADMISSION_TTL_MS = 5e3;
+const DEFAULT_AUTHORIZATION_TIMEOUT_MS = 2e3;
+const MAX_AUTHORIZATION_TIMEOUT_MS = 5e3;
+const DEFAULT_AUDIT_TIMEOUT_MS = 250;
+const MAX_AUDIT_TIMEOUT_MS = 1e3;
+const MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
+const MAX_RESPONSE_BODY_BYTES = 2 * 1024 * 1024;
+function opaqueBindingToken() {
+	const bytes = new Uint8Array(32);
+	crypto.getRandomValues(bytes);
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+var OperationDeadlineError = class extends Error {};
+var OperationCancelledError = class extends Error {};
+var ResponseBodyTooLargeError = class extends Error {};
+async function readResponseTextBounded(response, maximumBytes) {
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maximumBytes) {
+			await reader.cancel();
+			throw new ResponseBodyTooLargeError();
+		}
+		chunks.push(value);
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(body);
+}
+function boundedMs(value, fallback, maximum) {
+	return typeof value === "number" && Number.isFinite(value) ? Math.min(maximum, Math.max(1, Math.round(value))) : fallback;
+}
+async function settleWithin(work, timeoutMs, parent) {
+	const controller = new AbortController();
+	const onAbort = () => controller.abort(new OperationCancelledError());
+	if (parent?.aborted) controller.abort(new OperationCancelledError());
+	else parent?.addEventListener("abort", onAbort, { once: true });
+	let timer;
+	try {
+		return await Promise.race([Promise.resolve().then(() => work(controller.signal)), new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				const error = new OperationDeadlineError();
+				controller.abort(error);
+				reject(error);
+			}, timeoutMs);
+			controller.signal.addEventListener("abort", () => reject(controller.signal.reason ?? new OperationCancelledError()), { once: true });
+			if (controller.signal.aborted) reject(controller.signal.reason ?? new OperationCancelledError());
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+		parent?.removeEventListener("abort", onAbort);
+	}
+}
+/**
+* Production sandboxed `ExecutorAdapter` — POSTs the run to the standalone Deno
+* sandbox service over HTTP. The main app (Bun/Node) holds NO Deno; it only
+* speaks this JSON contract.
+*
+* Use as the `sandboxed` adapter in the executor config:
+*   executor: { sandboxed: httpSandboxAdapter({ url: process.env.SANDBOX_URL }) }
+*/
+var HttpSandboxAdapter = class {
+	fetchImpl;
+	validateEgress;
+	constructor(options = {}) {
+		this.options = options;
+		this.fetchImpl = options.fetch ?? globalThis.fetch;
+		this.validateEgress = options.validateEgress ?? true;
+	}
+	resolveUrl() {
+		const raw = this.options.url ?? (typeof process !== "undefined" ? process.env?.SANDBOX_URL : void 0);
+		if (!raw) throw new Error("HttpSandboxAdapter: no sandbox URL configured. Pass `url` or set SANDBOX_URL.");
+		let url;
+		try {
+			url = new URL(raw);
+		} catch {
+			throw new Error("HttpSandboxAdapter: sandbox URL must be canonical HTTP(S).");
+		}
+		if (url.protocol !== "http:" && url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.hash.length > 0 || url.search.length > 0 || url.pathname !== "/" || raw !== url.origin && raw !== `${url.origin}/`) throw new Error("HttpSandboxAdapter: sandbox URL must be canonical HTTP(S).");
+		return url.origin;
+	}
+	async postRun(requestBody, timeoutMs, headers, signal, sanitizeTransportErrors = false, onResponseStatus) {
+		const fetchTimeoutMs = this.options.fetchTimeoutMs ?? timeoutMs + 1e4;
+		try {
+			if (signal?.aborted) return {
+				ok: false,
+				error: "sandbox request cancelled",
+				logs: []
+			};
+			const { res, text } = await settleWithin(async (requestSignal) => {
+				const res$1 = await this.fetchImpl(`${this.resolveUrl()}/run`, {
+					method: "POST",
+					redirect: "error",
+					headers: {
+						"content-type": "application/json",
+						...headers
+					},
+					body: requestBody,
+					signal: requestSignal
+				});
+				if (!res$1.ok) {
+					await res$1.body?.cancel();
+					return {
+						res: res$1,
+						text: ""
+					};
+				}
+				return {
+					res: res$1,
+					text: await readResponseTextBounded(res$1, MAX_RESPONSE_BODY_BYTES)
+				};
+			}, fetchTimeoutMs, signal);
+			onResponseStatus?.(res.status);
+			if (!res.ok) return {
+				ok: false,
+				error: sanitizeTransportErrors ? "sandbox transport failed" : `sandbox request failed (HTTP ${res.status})`,
+				logs: []
+			};
+			let decoded;
+			try {
+				decoded = JSON.parse(text);
+			} catch {
+				return {
+					ok: false,
+					error: sanitizeTransportErrors ? "sandbox transport returned invalid response" : `sandbox returned non-JSON (HTTP ${res.status}): ${text.slice(0, 200)}`,
+					logs: []
+				};
+			}
+			const parsed = parseSandboxRunResult(decoded);
+			if (!parsed) return {
+				ok: false,
+				error: sanitizeTransportErrors ? "sandbox transport returned invalid response" : "sandbox returned an invalid response",
+				logs: []
+			};
+			return {
+				ok: !!parsed.ok,
+				output: parsed.output,
+				error: parsed.error,
+				logs: Array.isArray(parsed.logs) ? parsed.logs : [],
+				timedOut: parsed.timedOut,
+				ms: parsed.ms
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: signal?.aborted || err instanceof OperationCancelledError ? "sandbox request cancelled" : err instanceof OperationDeadlineError ? sanitizeTransportErrors ? "sandbox transport timed out" : `sandbox request timed out after ${fetchTimeoutMs}ms` : err instanceof ResponseBodyTooLargeError ? sanitizeTransportErrors ? "sandbox transport returned invalid response" : "sandbox returned an invalid response" : sanitizeTransportErrors ? "sandbox transport failed" : `sandbox request failed: ${err instanceof Error ? err.message : String(err)}`,
+				logs: []
+			};
+		}
+	}
+	async run(options) {
+		const caps = options.capabilities ?? {};
+		const net = caps.net ?? [];
+		const importHosts = caps.import ?? [];
+		const timeoutMs = caps.timeoutMs ?? DEFAULT_GUEST_TIMEOUT_MS;
+		if (this.validateEgress) {
+			const egress = await validateEgressHosts([...net, ...importHosts]);
+			if (!egress.ok) return {
+				ok: false,
+				error: `egress blocked: ${egress.reason}`,
+				logs: []
+			};
+		}
+		const sandboxCaps = {
+			net,
+			import: importHosts,
+			timeoutMs,
+			memoryMb: caps.memoryMb ?? 128
+		};
+		const bindings = options.sandboxBindings ?? (options.sandboxTools && options.brokerUrl ? {
+			url: options.brokerUrl,
+			token: opaqueBindingToken()
+		} : void 0);
+		if (options.sandboxTools && !bindings) return {
+			ok: false,
+			error: "sandbox custom tools require broker bindings",
+			logs: []
+		};
+		const toolsSession = options.sandboxTools && bindings ? registerSandboxCustomToolsSession(bindings.token, bindings.url, options.sandboxTools.envelope, timeoutMs + 3e4) : void 0;
+		const hostAdmissionSecret = this.options.hostAdmissionSecret ?? (typeof process !== "undefined" ? process.env?.SANDBOX_HOST_ADMISSION_SECRET : void 0);
+		try {
+			return await this.postRun(JSON.stringify({
+				mode: "host",
+				source: options.source,
+				input: options.input ?? null,
+				capabilities: sandboxCaps,
+				secrets: options.secrets ?? {},
+				...bindings ? { bindings } : {}
+			}), timeoutMs, hostAdmissionSecret ? { [HOST_ADMISSION_HEADER]: hostAdmissionSecret } : void 0);
+		} finally {
+			toolsSession?.revoke();
+		}
+	}
+	async runWorkload(options) {
+		if (options.signal?.aborted) return {
+			ok: false,
+			error: "sandbox request cancelled",
+			logs: []
+		};
+		const configured = this.options.workload;
+		if (!configured) throw new SandboxWorkloadDeniedError();
+		const authorizationTimeoutMs = boundedMs(configured.authorizationTimeoutMs, DEFAULT_AUTHORIZATION_TIMEOUT_MS, MAX_AUTHORIZATION_TIMEOUT_MS);
+		const auditTimeoutMs = boundedMs(configured.auditTimeoutMs, DEFAULT_AUDIT_TIMEOUT_MS, MAX_AUDIT_TIMEOUT_MS);
+		const audit = async (event, required) => {
+			if (!configured.audit) return;
+			try {
+				await settleWithin((signal) => configured.audit(Object.freeze(event), { signal }), auditTimeoutMs, options.signal);
+			} catch {
+				if (required) throw new SandboxWorkloadDeniedError();
+			}
+		};
+		const authorize = async (phase) => {
+			if (options.signal?.aborted) {
+				await audit({
+					boundary: "sandbox.workload",
+					phase,
+					decision: "denied",
+					reason: "cancelled"
+				}, false);
+				throw new SandboxWorkloadDeniedError();
+			}
+			let resolved;
+			try {
+				resolved = await settleWithin((signal) => configured.authorize(options.envelope, {
+					phase,
+					signal
+				}), authorizationTimeoutMs, options.signal);
+			} catch (error) {
+				await audit({
+					boundary: "sandbox.workload",
+					phase,
+					decision: "denied",
+					reason: options.signal?.aborted || error instanceof OperationCancelledError ? "cancelled" : error instanceof OperationDeadlineError ? "authorization_timed_out" : "authorization_failed"
+				}, false);
+				throw new SandboxWorkloadDeniedError();
+			}
+			const policy = snapshotSandboxWorkloadPolicy(resolved);
+			if (!policy) {
+				await audit({
+					boundary: "sandbox.workload",
+					phase,
+					decision: "denied",
+					reason: "policy_invalid"
+				}, false);
+				throw new SandboxWorkloadDeniedError();
+			}
+			return policy;
+		};
+		const prepared = await authorize("prepare");
+		if (this.validateEgress) {
+			let egress;
+			try {
+				egress = await settleWithin((signal) => validateEgressHosts([...prepared.capabilities.net, ...prepared.capabilities.import], {
+					signal,
+					timeoutMs: authorizationTimeoutMs,
+					concurrency: 4
+				}), authorizationTimeoutMs, options.signal);
+			} catch {
+				await audit({
+					boundary: "sandbox.workload",
+					phase: "prepare",
+					decision: "denied",
+					reason: options.signal?.aborted ? "cancelled" : "egress_denied"
+				}, false);
+				throw new SandboxWorkloadDeniedError();
+			}
+			if (!egress.ok) {
+				await audit({
+					boundary: "sandbox.workload",
+					phase: "prepare",
+					decision: "denied",
+					reason: "egress_denied"
+				}, false);
+				throw new SandboxWorkloadDeniedError();
+			}
+		}
+		const current = await authorize("dispatch");
+		if (serializeSandboxWorkloadPolicy(prepared) !== serializeSandboxWorkloadPolicy(current) || prepared.sandboxTools?.envelope !== current.sandboxTools?.envelope) {
+			await audit({
+				boundary: "sandbox.workload",
+				phase: "dispatch",
+				decision: "denied",
+				reason: "policy_changed"
+			}, false);
+			throw new SandboxWorkloadDeniedError();
+		}
+		await audit({
+			boundary: "sandbox.workload",
+			phase: "dispatch",
+			decision: "allowed",
+			reason: "authorization_succeeded"
+		}, true);
+		let result;
+		let responseStatus;
+		try {
+			if (options.signal?.aborted) result = {
+				ok: false,
+				error: "sandbox request cancelled",
+				logs: []
+			};
+			else {
+				const requestBody = JSON.stringify({
+					mode: "workload",
+					source: current.source,
+					input: current.input ?? null,
+					capabilities: current.capabilities,
+					secrets: current.secrets ?? {},
+					...current.bindings ? { bindings: current.bindings } : {}
+				});
+				if (new TextEncoder().encode(requestBody).byteLength > MAX_REQUEST_BODY_BYTES) throw new SandboxWorkloadDeniedError();
+				const now = Date.now();
+				const expiresAt = new Date(Math.min(current.validUntil ? Date.parse(current.validUntil) : Number.POSITIVE_INFINITY, now + MAX_WORKLOAD_ADMISSION_TTL_MS)).toISOString();
+				const admission = await sealSandboxWorkloadAdmission(configured.admission, {
+					kind: "sandbox_workload_admission",
+					version: 1,
+					admissionId: crypto.randomUUID(),
+					supervisorInstanceId: configured.admission.instanceId,
+					expiresAt
+				}, requestBody);
+				const toolsSession = current.sandboxTools && current.bindings ? registerSandboxCustomToolsSession(current.bindings.token, current.bindings.url, current.sandboxTools.envelope, current.capabilities.timeoutMs + 3e4) : void 0;
+				try {
+					result = await this.postRun(requestBody, current.capabilities.timeoutMs, { [WORKLOAD_ADMISSION_HEADER]: admission }, options.signal, true, (status) => {
+						responseStatus = status;
+					});
+				} finally {
+					toolsSession?.revoke();
+				}
+			}
+		} catch {
+			await audit({
+				boundary: "sandbox.workload",
+				phase: "transport",
+				decision: "denied",
+				reason: "transport_failed"
+			}, false);
+			throw new SandboxWorkloadDeniedError();
+		}
+		const terminal = responseStatus !== void 0 && (responseStatus < 200 || responseStatus >= 300) ? "transport_denied" : result.error === "sandbox request cancelled" ? "transport_cancelled" : result.error === "sandbox transport timed out" ? "transport_timed_out" : result.error === "sandbox transport returned invalid response" ? "transport_invalid_response" : result.error === "sandbox transport failed" ? "transport_failed" : "transport_completed";
+		await audit({
+			boundary: "sandbox.workload",
+			phase: "transport",
+			decision: terminal === "transport_completed" ? "allowed" : "denied",
+			reason: terminal
+		}, false);
+		return result;
+	}
+};
+/** Factory for the production sandboxed adapter. */
+function httpSandboxAdapter(options = {}) {
+	return new HttpSandboxAdapter(options);
+}
+
+//#endregion
+export { BINDINGS_TOKEN_HEADER as a, WORKLOAD_ADMISSION_HEADER as c, validateEgressHosts as d, validateHostEgress as f, SandboxWorkloadDeniedError as i, classifyIpLiteral as l, httpSandboxAdapter as n, FRAME_MARKER as o, SANDBOX_WORKLOAD_DENIAL_MESSAGE as r, HOST_ADMISSION_HEADER as s, HttpSandboxAdapter as t, parseHostEntry as u };