@robota-sdk/agent-core 3.0.0-beta.8 → 3.0.0-beta.81

package/dist/node/node.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./command-executor-Aat_q7P2.cjs"),t=require("./http-executor-71JiIdFP.cjs");let n=require("node:fs"),r=require("node:path"),i=require("node:dns/promises"),a=require("node:net");function o(e){if(typeof e!=`string`)throw TypeError(`executionRoot must be a string`);if(e.trim().length===0)throw TypeError(`executionRoot must be a non-empty string`);if(!(0,r.isAbsolute)(e))throw TypeError(`executionRoot must be an absolute path`);let t;try{t=(0,n.realpathSync)(e)}catch{throw TypeError(`executionRoot must name an existing accessible directory`)}if(!(0,n.statSync)(t).isDirectory())throw TypeError(`executionRoot must name a directory`);try{(0,n.accessSync)(t,n.constants.R_OK|n.constants.X_OK)}catch{throw TypeError(`executionRoot directory must be readable and traversable`)}return t}function s(e){let t=[],i=(0,r.resolve)(e);for(;;)try{return(0,r.join)((0,n.realpathSync)(i),...t)}catch{let n=(0,r.dirname)(i);if(n===i)return(0,r.resolve)(e);t.unshift((0,r.basename)(i)),i=n}}function c(e,t){let n=s(e),i=s(t);return i===n||i.startsWith(n+r.sep)}var l=class extends Error{constructor(e){super(e),this.name=`OwnerOnlyModeError`}};function u(e=process.platform){return e===`win32`?`windows-acl`:`posix-mode`}function d(e,t){let n=(0,r.relative)(e,t);if(n.startsWith(`..`)||(0,r.isAbsolute)(n))throw new l(`withinRoot ${e} is not an ancestor of ${t}, so this call cannot own the path between them.`);let i=n.split(r.sep).filter(e=>e.length>0),a=[e],o=e;for(let e of i)o=(0,r.join)(o,e),a.push(o);return a}function f(e,t,r={}){if(u()!==`posix-mode`)return;let i=(r.readMode??(e=>(0,n.statSync)(e).mode&4095))(e);if(i&63)throw new l(`${t} ${e} is mode 0${i.toString(8)} after being set owner-only; group or other permissions survived, so its contents are readable by another account.`)}function p(e,t={}){let r=t.makeDirectory??((e,t)=>{(0,n.mkdirSync)(e,{recursive:!0,mode:t})}),i=t.setMode??((e,t)=>(0,n.chmodSync)(e,t));r(e,448);let a=t.withinRoot===void 0?[e]:d(t.withinRoot,e);for(let e of a)u()===`posix-mode`&&i(e,448),f(e,`directory`,t)}function m(e,t){p((0,r.dirname)(e));let i=`${e}.${process.pid}.tmp`;(0,n.rmSync)(i,{force:!0}),(0,n.writeFileSync)(i,t,{encoding:`utf8`,mode:384,flag:`wx`});try{f(i,`file`),(0,n.renameSync)(i,e)}catch(e){try{(0,n.unlinkSync)(i)}catch{}throw e}f(e,`file`)}function h(e){if(u()!==`posix-mode`)return;let t;try{t=(0,n.statSync)(e).mode&4095}catch{return}t&63&&((0,n.chmodSync)(e,384),f(e,`file`))}function g(e){let t=(0,a.isIP)(e);return t===4?_(e.split(`.`).map(Number)):t!==6||v(e)}function _(e){let[t=0,n=0,r=0]=e;return t===0||t===10||t===127||t===100&&n>=64&&n<=127||t===169&&n===254||t===172&&n>=16&&n<=31||t===192&&n===0&&r===0||t===192&&n===168||t===198&&(n===18||n===19)||t>=224}function v(e){let t=b(e);if(t===void 0)return!0;let[n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0]=t;return n===0&&r===0&&i===0&&a===0&&o===0&&s===65535||n===100&&r===65435&&i===0&&a===0&&o===0&&s===0?_([c>>8,c&255,l>>8,l&255]):n===0&&r===0&&i===0&&a===0&&o===0&&s===0||(n&65024)==64512||(n&65472)==65152||(n&65472)==65216||(n&65280)==65280}function y(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);if(!n.includes(`.`))return e;if(t<0||(0,a.isIP)(n)!==4)return;let[r=0,i=0,o=0,s=0]=n.split(`.`).map(Number),c=(r<<8|i).toString(16),l=(o<<8|s).toString(16);return`${e.slice(0,t+1)}${c}:${l}`}function b(e){let t=y(e.split(`%`)[0]??e);if(t===void 0)return;let n=t.split(`::`);if(n.length>2)return;let r=e=>e.length===0?[]:e.split(`:`).map(e=>Number.parseInt(e,16)),i=r(n[0]??``),a=n.length===2?r(n[1]??``):[],o=8-i.length-a.length;if(o<0||n.length===1&&o!==0)return;let s=[...i,...Array(o).fill(0),...a];return s.some(e=>Number.isNaN(e)||e<0||e>65535)?void 0:s}const x=3e4,S=5e6,C=new Set([301,302,303,307,308]),w=new Set([`localhost`,`metadata`,`metadata.google.internal`,`metadata.goog`,`instance-data`,`instance-data.ec2.internal`]),T=async e=>(await(0,i.lookup)(e,{all:!0,verbatim:!0})).map(e=>e.address);async function E(e,t={},n=T){let r=e.href;if(e.protocol!==`http:`&&e.protocol!==`https:`)return{reason:`unsupported_scheme`,url:r,message:`Only http(s) URLs may be fetched.`};if(t.allowPrivateAddresses===!0)return;let i=e.hostname.replace(/^\[|\]$/g,``).toLowerCase();if(t.allowedHosts?.includes(i))return;if(w.has(i)||i.endsWith(`.localhost`))return{reason:`metadata_host`,url:r,message:`Destination "${i}" is a loopback or cloud-metadata host and is not reachable from tools.`};let o=(0,a.isIP)(i)?[i]:await D(i,n);if(o===void 0||o.length===0)return{reason:`unresolvable`,url:r,message:`Destination "${i}" did not resolve.`};let s=o.find(g);if(s!==void 0)return{reason:`private_destination`,url:r,message:`Destination "${i}" resolves to ${s}, a private, loopback or link-local address, and is not reachable from tools.`}}async function D(e,t){try{return await t(e)}catch{return}}async function O(e,t={},n={},r={}){let i=r.fetch??((e,t)=>globalThis.fetch(e,t)),a=r.lookup??T,o=t.maxResponseBytes??S,s=n.maxRedirects??5,c=AbortSignal.timeout(t.timeoutMs??x),l=t.signal?AbortSignal.any([c,t.signal]):c,u=new URL(e),d={...t.headers??{}};for(let e=0;;e+=1){let t=await E(u,n,a);if(t!==void 0)return{ok:!1,rejection:t};let r=await i(u.href,{headers:d,signal:l,redirect:`manual`});if(!C.has(r.status))return j(r,u.href,o,l);let c=r.headers.get(`location`);if(c===null)return{ok:!1,rejection:{reason:`redirect_without_location`,url:u.href,message:`HTTP ${r.status} without a Location header.`}};if(e>=s)return{ok:!1,rejection:{reason:`redirect_limit`,url:u.href,message:`More than ${s} redirects.`}};let f=new URL(c,u);f.origin!==u.origin&&(d=A(d)),u=f}}async function k(e,t,n={},r={}){let i=r.fetch??((e,t)=>globalThis.fetch(e,t)),a=t.maxResponseBytes??S,o=AbortSignal.timeout(t.timeoutMs??x),s=t.signal?AbortSignal.any([o,t.signal]):o,c=new URL(e),l=await E(c,n,r.lookup??T);if(l!==void 0)return{ok:!1,rejection:l};let u=await i(c.href,{method:`POST`,headers:{...t.headers??{}},body:t.body,signal:s,redirect:`manual`});return u.status>=300&&u.status<400?(await u.body?.cancel().catch(()=>void 0),{ok:!1,rejection:{reason:`redirect_refused`,url:c.href,message:`HTTP ${u.status}: a POST is never redirected.`}}):j(u,c.href,a,s)}function A(e){let t={};for(let[n,r]of Object.entries(e))n.toLowerCase()===`user-agent`&&(t[n]=r);return t}async function j(e,t,n,r){let i=e=>({ok:!1,rejection:{reason:`response_too_large`,url:t,message:`Response exceeds ${n} bytes (${e} seen).`}}),a=Number(e.headers.get(`content-length`));if(Number.isFinite(a)&&a>n)return await e.body?.cancel(),i(a);let o=[],s=0;if(!e.body&&typeof e.arrayBuffer==`function`){let t=new Uint8Array(await e.arrayBuffer());if(t.byteLength>n)return i(t.byteLength);o.push(t),s=t.byteLength}else if(e.body){let t=e.body.getReader();for(;;){r.throwIfAborted();let{done:e,value:a}=await t.read();if(e)break;if(s+=a.byteLength,s>n)return await t.cancel(),i(s);o.push(a)}}let c=new Uint8Array(s),l=0;for(let e of o)c.set(e,l),l+=e.byteLength;return{ok:!0,status:e.status,statusText:e.statusText,headers:e.headers,body:c,finalUrl:t}}exports.BLOCKED_HOSTNAMES=w,exports.CommandExecutor=e.t,exports.HttpExecutor=t.t,exports.OWNER_ONLY_DIRECTORY_MODE=448,exports.OWNER_ONLY_FILE_MODE=384,exports.OwnerOnlyModeError=l,exports.canonicalizePath=s,exports.ensureOwnerOnlyDirectory=p,exports.fetchWithEgressPolicy=O,exports.isPathInside=c,exports.isPrivateAddress=g,exports.ownerOnlyGuarantee=u,exports.postWithEgressPolicy=k,exports.rejectDestination=E,exports.resolveTrustedExecutionRoot=o,exports.tightenExistingFile=h,exports.writeOwnerOnlyFile=m;

package/dist/node/node.d.cts

@@ -0,0 +1,236 @@
+import { c as IHookTypeExecutor, l as IHttpHookDefinition, m as THookOutcome, n as ICommandHookDefinition, s as IHookInput, y as ISubprocessTraceEnv } from "./types-gNrckgFE.cjs";
+//#region src/utils/path-containment.d.ts
+/**
+ * Validate an authority root more strictly than candidate-path canonicalization.
+ *
+ * Candidate write paths may have a missing tail, but an authority root must already exist and be a
+ * traversable directory. Keeping the contracts separate prevents a typo in a root from degrading to
+ * a lexical boundary that the caller did not actually select.
+ */
+declare function resolveTrustedExecutionRoot(input: unknown): string;
+/**
+ * Resolve `p` to its canonical form, following symlinks, tolerating a path that does not exist yet.
+ *
+ * `realpathSync` throws on a missing path, but callers legitimately ask about files they are about to
+ * CREATE (a write or an edit). So we walk up to the deepest ancestor that does exist, canonicalize
+ * that, and re-attach the remaining segments — the re-attached tail cannot itself be a symlink,
+ * because it does not exist.
+ */
+declare function canonicalizePath(p: string): string;
+/**
+ * Whether `candidate` is `root` itself or lies beneath it, decided on the CANONICAL form of both.
+ *
+ * Canonicalizing the root as well as the candidate matters: a root that is itself reached through a
+ * symlink (macOS `/tmp` -> `/private/tmp`, or a workspace under a symlinked home) would otherwise
+ * spuriously reject every path inside it.
+ */
+declare function isPathInside(root: string, candidate: string): boolean;
+//#endregion
+//#region src/utils/owner-only-store.d.ts
+/**
+ * SEC-020 (issue #2021) — creating a host directory or file that only its owner can read.
+ *
+ * A host application persists session records, logs, settings and device credentials under a directory
+ * of its own choosing. They carry prompts, model output, tool results and, in the settings case,
+ * provider credentials. On a shared workstation or a CI host, every other local account reads them
+ * unless the mode says otherwise.
+ *
+ * WHERE that directory is belongs to the host, not here — this module knows only what has to be true
+ * of whatever path it is handed, which is what lets it be tested without a filesystem layout.
+ *
+ * ## Why this is one module and not a constant each caller repeats
+ *
+ * `0o600` and `0o700` were already spelled out in five separate files before this existed, and the
+ * repository had already learned — in `guarded-directory.ts`, for a pairing rendezvous — that the
+ * constants are the easy half. The load-bearing part is that **`mkdirSync(path, { mode })` does not
+ * set the mode of a directory that already exists.** `recursive: true` returns successfully and
+ * silently adopts whatever mode is there. A directory left at 0777 by an earlier version, by a
+ * shared CI checkout, or by another local user who pre-created it, becomes ours with no signal.
+ *
+ * Measured under umask 022 before this module existed: a session log directory pre-created at 0777
+ * stayed 0777 through `mkdirSync(dir, { recursive: true, mode: 0o700 })`, and its 0600 records were
+ * then removable and replaceable by any local account.
+ *
+ * The same holds for files. `writeFileSync(path, data, { mode })` applies the mode only when the
+ * file is CREATED; an existing 0644 record keeps 0644 forever, so a store written by an older
+ * version is never repaired by a newer one.
+ *
+ * So: create, then set the mode unconditionally, then VERIFY — and verification is what makes the
+ * first two checkable rather than hopeful. It is also the only step that catches an owner we did not
+ * expect, which `mkdir` and `chmod` between them cannot.
+ *
+ * ## Windows
+ *
+ * `chmodSync` on win32 toggles the read-only attribute and cannot express "owner only"; NTFS ACL
+ * inheritance governs instead, and a user's profile directory is not readable by other unprivileged
+ * accounts by default. The POSIX assertion is therefore not made there, and `ownerOnlyGuarantee()` reports which
+ * guarantee is in force so a caller — and a test — can state the platform's actual claim rather than
+ * assume the POSIX one everywhere. A store directory placed inside a world-writable parent on
+ * Windows is NOT protected by this module, and that is recorded rather than papered over.
+ */
+/** Owner read/write. Nothing for group, nothing for other. */
+declare const OWNER_ONLY_FILE_MODE = 384;
+/** Owner read/write/traverse. The traverse bit is what keeps another account out of the directory. */
+declare const OWNER_ONLY_DIRECTORY_MODE = 448;
+/** Raised when a path cannot be made owner-only. Never swallowed into a weaker mode. */
+declare class OwnerOnlyModeError extends Error {
+  constructor(message: string);
+}
+/**
+ * Which guarantee this platform can actually make.
+ *
+ * `posix-mode` — the mode bits are asserted after every create and every write.
+ * `windows-acl` — inherited NTFS ACLs govern; the POSIX assertion is not made and not claimed.
+ */
+declare function ownerOnlyGuarantee(platform?: string): 'posix-mode' | 'windows-acl';
+/**
+ * Seams for the failure paths, injected for the reason `guarded-directory.ts` states: a filesystem
+ * that silently ignores `chmod` is a real condition — some network and FAT mounts do exactly that —
+ * and it is the ONLY condition the verification step catches that create-then-chmod does not. Without
+ * a seam that case is unreachable from a test, and a guard no test can reach is a guard nobody knows
+ * is there. Measured: with these absent, deleting the verification entirely changed no test result.
+ */
+interface IOwnerOnlyIo {
+  readonly makeDirectory?: (target: string, mode: number) => void;
+  readonly setMode?: (target: string, mode: number) => void;
+  readonly readMode?: (target: string) => number;
+}
+interface IEnsureOwnerOnlyOptions extends IOwnerOnlyIo {
+  /**
+   * An ANCESTOR of `directory` that the caller also owns, tightened along with every segment between
+   * them.
+   *
+   * Needed because `mkdirSync(path, { recursive: true, mode })` applies the mode only to the
+   * directories it CREATES. A store root an older version already made sits at whatever mode it was
+   * given and this call would leave it there — which is the module's own headline defect surviving
+   * one level up, on the very path it exists to protect. Found in review of PR #2224.
+   *
+   * It is a parameter rather than a walk up to some inferred boundary because WHICH ancestors belong
+   * to the caller is the caller's knowledge. This module must not guess that a parent is ours; it
+   * would eventually chmod someone's home directory.
+   */
+  readonly withinRoot?: string;
+}
+/**
+ * Ensure `directory` exists and only its owner can enter it.
+ *
+ * The `chmod` is unconditional because `mkdir` does not touch an existing directory's mode, and the
+ * `stat` afterwards is what turns two hopeful calls into a checked one.
+ */
+declare function ensureOwnerOnlyDirectory(directory: string, options?: IEnsureOwnerOnlyOptions): void;
+/**
+ * Replace `filePath` atomically with content only its owner can read.
+ *
+ * The temp file carries the mode from the moment it is created — writing it at the umask's default
+ * and tightening afterwards leaves a window in which the full content is world-readable on disk, and
+ * `rename` preserves whatever mode the temp file had. The `chmod` after the write is for the case
+ * where the temp path already existed at a wider mode.
+ */
+declare function writeOwnerOnlyFile(filePath: string, content: string): void;
+/**
+ * Tighten a file that already exists — the repair path for a record an older version left at 0644.
+ *
+ * A no-op on a path that does not exist, because "there is nothing to tighten" and "we tightened it"
+ * are the same outcome for the caller, and throwing would make every writer branch on existence.
+ */
+declare function tightenExistingFile(filePath: string): void;
+//#endregion
+//#region src/hooks/executors/command-executor.d.ts
+declare class CommandExecutor implements IHookTypeExecutor {
+  private readonly shellExecutable?;
+  readonly type: "command";
+  constructor(shellExecutable?: string | undefined);
+  /**
+   * `traceEnv` is the prompt's trace for this child, handed separately so it never reaches the
+   * stdin JSON. The child sees `process.env`, then Robota's value, then the hook's own `env`; a hook
+   * that sets its own `TRACEPARENT` wins and gets the ambient environment unchanged.
+   */
+  execute(definition: ICommandHookDefinition, input: IHookInput, traceEnv?: ISubprocessTraceEnv): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/hooks/executors/http-executor.d.ts
+declare class HttpExecutor implements IHookTypeExecutor {
+  readonly type: "http";
+  execute(definition: IHttpHookDefinition, input: IHookInput): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/utils/ip-address.d.ts
+/**
+ * Address classification for the egress boundary (#2026) — the "is this address public unicast?"
+ * half of `egress-policy.ts`, split out so each module holds one job: that one owns the FETCH
+ * (scheme, redirects, headers, deadline, byte cap), this one owns the ARITHMETIC of an address.
+ *
+ * The awkward part lives here on purpose. A literal destination reaches the policy already
+ * normalized by `URL` (`2130706433`, `0x7f.1` and `[::ffff:7f00:1]` all collapse to one hostname),
+ * but a RESOLVED one does not: `dns.lookup` renders an IPv4-mapped AAAA answer through `inet_ntop`,
+ * which prints the dotted spelling `::ffff:127.0.0.1`. So the expansion below accepts BOTH
+ * spellings rather than trusting any normalizer to have run — on the resolution path an attacker
+ * controls the record. Every "cannot parse" answer is `undefined`/`true`, i.e. NOT public: an
+ * address this module cannot read is never treated as reachable.
+ *
+ * Node-only (`node:net`): reached through `egress-policy.ts`, never the browser barrel.
+ */
+/** True when `ip` (v4 or v6 text) is not a public unicast address. */
+declare function isPrivateAddress(ip: string): boolean;
+//#endregion
+//#region src/utils/egress-policy.d.ts
+type TEgressLookup = (hostname: string) => Promise<readonly string[]>;
+interface IEgressPolicy {
+  /** Exact lowercase hostnames that may be reached even when they resolve to a private address. */
+  readonly allowedHosts?: readonly string[];
+  /** Explicit enterprise opt-out from private/loopback/metadata blocking. Default `false`. */
+  readonly allowPrivateAddresses?: boolean;
+  /** Redirect hops followed before refusing. Default 5. */
+  readonly maxRedirects?: number;
+}
+interface IEgressFetchOptions {
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly signal?: AbortSignal;
+  /** Deadline for the WHOLE exchange, redirects and body included. Default 30 000 ms. */
+  readonly timeoutMs?: number;
+  /** Byte cap enforced on `Content-Length` and again while streaming. Default 5 000 000. */
+  readonly maxResponseBytes?: number;
+}
+interface IEgressDeps {
+  readonly fetch?: typeof globalThis.fetch;
+  readonly lookup?: TEgressLookup;
+}
+type TEgressRejectionReason = 'unsupported_scheme' | 'private_destination' | 'metadata_host' | 'unresolvable' | 'redirect_limit' | 'redirect_without_location' | 'redirect_refused' | 'response_too_large';
+interface IEgressRejection {
+  readonly reason: TEgressRejectionReason;
+  readonly url: string;
+  readonly message: string;
+}
+type TEgressFetchResult = {
+  ok: true;
+  status: number;
+  statusText: string;
+  headers: Headers;
+  body: Uint8Array;
+  finalUrl: string;
+} | {
+  ok: false;
+  rejection: IEgressRejection;
+};
+/** Hostnames that are metadata services or loopback by convention, whatever they resolve to. */
+declare const BLOCKED_HOSTNAMES: ReadonlySet<string>;
+/** Validate ONE destination URL against the policy. `undefined` means it may be reached. */
+declare function rejectDestination(url: URL, policy?: IEgressPolicy, lookup?: TEgressLookup): Promise<IEgressRejection | undefined>;
+/**
+ * Fetch `url` under the egress policy. Policy outcomes are RETURNED (`ok: false`); transport errors
+ * (DNS failure at connect, refused connection, TLS, abort) are THROWN, as `fetch` throws them, so the
+ * caller's own error classification keeps working.
+ */
+declare function fetchWithEgressPolicy(url: string, options?: IEgressFetchOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+interface IEgressPostOptions extends IEgressFetchOptions {
+  /** Sent as-is; a `URLSearchParams` or JSON string, never a stream, so it is never re-sent. */
+  readonly body: string | URLSearchParams;
+}
+/**
+ * POST `url` under the egress policy. The destination is validated as for a GET, but a redirect is
+ * REFUSED (`redirect_refused`), never followed: the body is the caller's to send to this URL alone.
+ */
+declare function postWithEgressPolicy(url: string, options: IEgressPostOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+//#endregion
+export { BLOCKED_HOSTNAMES, CommandExecutor, HttpExecutor, type IEgressDeps, type IEgressFetchOptions, type IEgressPolicy, type IEgressPostOptions, type IEgressRejection, type IOwnerOnlyIo, OWNER_ONLY_DIRECTORY_MODE, OWNER_ONLY_FILE_MODE, OwnerOnlyModeError, type TEgressFetchResult, type TEgressLookup, type TEgressRejectionReason, canonicalizePath, ensureOwnerOnlyDirectory, fetchWithEgressPolicy, isPathInside, isPrivateAddress, ownerOnlyGuarantee, postWithEgressPolicy, rejectDestination, resolveTrustedExecutionRoot, tightenExistingFile, writeOwnerOnlyFile };
+//# sourceMappingURL=node.d.cts.map

package/dist/node/node.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.cts","names":[],"sources":["../../src/utils/path-containment.ts","../../src/utils/owner-only-store.ts","../../src/hooks/executors/command-executor.ts","../../src/hooks/executors/http-executor.ts","../../src/utils/ip-address.ts","../../src/utils/egress-policy.ts"],"mappings":";;;;;;;;;iBA2BgB,4BAA4B;;;;;;;;;iBAoC5B,iBAAiB;;;;;;;;iBAwBjB,aAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCjC9B;;cAEA;;cAMA,2BAA2B;EAC1B,YAAA;;;;;;;;iBAYE,mBACd;;;;;;;;UAYe;WACN,iBAAiB,gBAAgB;WACjC,WAAW,gBAAgB;WAC3B,YAAY;;UAGN,gCAAgC;;;;;;;;;;;;;;WActC;;;;;;;;iBAsCK,yBACd,mBACA,UAAS;;;;;;;;;iBA8BK,mBAAmB,kBAAkB;;;;;;;iBA2CrC,oBAAoB;;;cCnIvB,2BAA2B;mBAGT;WAFpB;EAEoB,YAAA;;;;;;EAO7B,QACE,YAAY,wBACZ,OAAO,YACP,WAAW,sBACV,QAAQ;;;;cC1EA,wBAAwB;WAC1B;EAEH,QAAQ,YAAY,qBAAqB,OAAO,aAAa,QAAQ;;;;;;;;;;;;;;;;;;;;iBCP7D,iBAAiB;;;KCSrB,iBAAiB,qBAAqB;UAEjC;;WAEN;;WAEA;;WAEA;;UAGM;WACN,UAAU,SAAS;WACnB,SAAS;;WAET;;WAEA;;UAGM;WACN,eAAe,WAAW;WAC1B,SAAS;;KAGR;UAUK;WACN,QAAQ;WACR;WACA;;KAGC;EAEN;EACA;EACA;EACA,SAAS;EACT,MAAM;EACN;;EAEA;EAAW,WAAW;;;cAWf,mBAAmB;;iBAaV,kBACpB,KAAK,KACL,SAAQ,eACR,SAAQ,gBACP,QAAQ;;;;;;iBAwDW,sBACpB,aACA,UAAS,qBACT,SAAQ,eACR,OAAM,cACL,QAAQ;UA6CM,2BAA2B;;WAEjC,eAAe;;;;;;iBAOJ,qBACpB,aACA,SAAS,oBACT,SAAQ,eACR,OAAM,cACL,QAAQ"}

package/dist/node/node.d.ts

@@ -0,0 +1,236 @@
+import { c as IHookTypeExecutor, l as IHttpHookDefinition, m as THookOutcome, n as ICommandHookDefinition, s as IHookInput, y as ISubprocessTraceEnv } from "./types-gNrckgFE.js";
+//#region src/utils/path-containment.d.ts
+/**
+ * Validate an authority root more strictly than candidate-path canonicalization.
+ *
+ * Candidate write paths may have a missing tail, but an authority root must already exist and be a
+ * traversable directory. Keeping the contracts separate prevents a typo in a root from degrading to
+ * a lexical boundary that the caller did not actually select.
+ */
+declare function resolveTrustedExecutionRoot(input: unknown): string;
+/**
+ * Resolve `p` to its canonical form, following symlinks, tolerating a path that does not exist yet.
+ *
+ * `realpathSync` throws on a missing path, but callers legitimately ask about files they are about to
+ * CREATE (a write or an edit). So we walk up to the deepest ancestor that does exist, canonicalize
+ * that, and re-attach the remaining segments — the re-attached tail cannot itself be a symlink,
+ * because it does not exist.
+ */
+declare function canonicalizePath(p: string): string;
+/**
+ * Whether `candidate` is `root` itself or lies beneath it, decided on the CANONICAL form of both.
+ *
+ * Canonicalizing the root as well as the candidate matters: a root that is itself reached through a
+ * symlink (macOS `/tmp` -> `/private/tmp`, or a workspace under a symlinked home) would otherwise
+ * spuriously reject every path inside it.
+ */
+declare function isPathInside(root: string, candidate: string): boolean;
+//#endregion
+//#region src/utils/owner-only-store.d.ts
+/**
+ * SEC-020 (issue #2021) — creating a host directory or file that only its owner can read.
+ *
+ * A host application persists session records, logs, settings and device credentials under a directory
+ * of its own choosing. They carry prompts, model output, tool results and, in the settings case,
+ * provider credentials. On a shared workstation or a CI host, every other local account reads them
+ * unless the mode says otherwise.
+ *
+ * WHERE that directory is belongs to the host, not here — this module knows only what has to be true
+ * of whatever path it is handed, which is what lets it be tested without a filesystem layout.
+ *
+ * ## Why this is one module and not a constant each caller repeats
+ *
+ * `0o600` and `0o700` were already spelled out in five separate files before this existed, and the
+ * repository had already learned — in `guarded-directory.ts`, for a pairing rendezvous — that the
+ * constants are the easy half. The load-bearing part is that **`mkdirSync(path, { mode })` does not
+ * set the mode of a directory that already exists.** `recursive: true` returns successfully and
+ * silently adopts whatever mode is there. A directory left at 0777 by an earlier version, by a
+ * shared CI checkout, or by another local user who pre-created it, becomes ours with no signal.
+ *
+ * Measured under umask 022 before this module existed: a session log directory pre-created at 0777
+ * stayed 0777 through `mkdirSync(dir, { recursive: true, mode: 0o700 })`, and its 0600 records were
+ * then removable and replaceable by any local account.
+ *
+ * The same holds for files. `writeFileSync(path, data, { mode })` applies the mode only when the
+ * file is CREATED; an existing 0644 record keeps 0644 forever, so a store written by an older
+ * version is never repaired by a newer one.
+ *
+ * So: create, then set the mode unconditionally, then VERIFY — and verification is what makes the
+ * first two checkable rather than hopeful. It is also the only step that catches an owner we did not
+ * expect, which `mkdir` and `chmod` between them cannot.
+ *
+ * ## Windows
+ *
+ * `chmodSync` on win32 toggles the read-only attribute and cannot express "owner only"; NTFS ACL
+ * inheritance governs instead, and a user's profile directory is not readable by other unprivileged
+ * accounts by default. The POSIX assertion is therefore not made there, and `ownerOnlyGuarantee()` reports which
+ * guarantee is in force so a caller — and a test — can state the platform's actual claim rather than
+ * assume the POSIX one everywhere. A store directory placed inside a world-writable parent on
+ * Windows is NOT protected by this module, and that is recorded rather than papered over.
+ */
+/** Owner read/write. Nothing for group, nothing for other. */
+declare const OWNER_ONLY_FILE_MODE = 384;
+/** Owner read/write/traverse. The traverse bit is what keeps another account out of the directory. */
+declare const OWNER_ONLY_DIRECTORY_MODE = 448;
+/** Raised when a path cannot be made owner-only. Never swallowed into a weaker mode. */
+declare class OwnerOnlyModeError extends Error {
+  constructor(message: string);
+}
+/**
+ * Which guarantee this platform can actually make.
+ *
+ * `posix-mode` — the mode bits are asserted after every create and every write.
+ * `windows-acl` — inherited NTFS ACLs govern; the POSIX assertion is not made and not claimed.
+ */
+declare function ownerOnlyGuarantee(platform?: string): 'posix-mode' | 'windows-acl';
+/**
+ * Seams for the failure paths, injected for the reason `guarded-directory.ts` states: a filesystem
+ * that silently ignores `chmod` is a real condition — some network and FAT mounts do exactly that —
+ * and it is the ONLY condition the verification step catches that create-then-chmod does not. Without
+ * a seam that case is unreachable from a test, and a guard no test can reach is a guard nobody knows
+ * is there. Measured: with these absent, deleting the verification entirely changed no test result.
+ */
+interface IOwnerOnlyIo {
+  readonly makeDirectory?: (target: string, mode: number) => void;
+  readonly setMode?: (target: string, mode: number) => void;
+  readonly readMode?: (target: string) => number;
+}
+interface IEnsureOwnerOnlyOptions extends IOwnerOnlyIo {
+  /**
+   * An ANCESTOR of `directory` that the caller also owns, tightened along with every segment between
+   * them.
+   *
+   * Needed because `mkdirSync(path, { recursive: true, mode })` applies the mode only to the
+   * directories it CREATES. A store root an older version already made sits at whatever mode it was
+   * given and this call would leave it there — which is the module's own headline defect surviving
+   * one level up, on the very path it exists to protect. Found in review of PR #2224.
+   *
+   * It is a parameter rather than a walk up to some inferred boundary because WHICH ancestors belong
+   * to the caller is the caller's knowledge. This module must not guess that a parent is ours; it
+   * would eventually chmod someone's home directory.
+   */
+  readonly withinRoot?: string;
+}
+/**
+ * Ensure `directory` exists and only its owner can enter it.
+ *
+ * The `chmod` is unconditional because `mkdir` does not touch an existing directory's mode, and the
+ * `stat` afterwards is what turns two hopeful calls into a checked one.
+ */
+declare function ensureOwnerOnlyDirectory(directory: string, options?: IEnsureOwnerOnlyOptions): void;
+/**
+ * Replace `filePath` atomically with content only its owner can read.
+ *
+ * The temp file carries the mode from the moment it is created — writing it at the umask's default
+ * and tightening afterwards leaves a window in which the full content is world-readable on disk, and
+ * `rename` preserves whatever mode the temp file had. The `chmod` after the write is for the case
+ * where the temp path already existed at a wider mode.
+ */
+declare function writeOwnerOnlyFile(filePath: string, content: string): void;
+/**
+ * Tighten a file that already exists — the repair path for a record an older version left at 0644.
+ *
+ * A no-op on a path that does not exist, because "there is nothing to tighten" and "we tightened it"
+ * are the same outcome for the caller, and throwing would make every writer branch on existence.
+ */
+declare function tightenExistingFile(filePath: string): void;
+//#endregion
+//#region src/hooks/executors/command-executor.d.ts
+declare class CommandExecutor implements IHookTypeExecutor {
+  private readonly shellExecutable?;
+  readonly type: "command";
+  constructor(shellExecutable?: string | undefined);
+  /**
+   * `traceEnv` is the prompt's trace for this child, handed separately so it never reaches the
+   * stdin JSON. The child sees `process.env`, then Robota's value, then the hook's own `env`; a hook
+   * that sets its own `TRACEPARENT` wins and gets the ambient environment unchanged.
+   */
+  execute(definition: ICommandHookDefinition, input: IHookInput, traceEnv?: ISubprocessTraceEnv): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/hooks/executors/http-executor.d.ts
+declare class HttpExecutor implements IHookTypeExecutor {
+  readonly type: "http";
+  execute(definition: IHttpHookDefinition, input: IHookInput): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/utils/ip-address.d.ts
+/**
+ * Address classification for the egress boundary (#2026) — the "is this address public unicast?"
+ * half of `egress-policy.ts`, split out so each module holds one job: that one owns the FETCH
+ * (scheme, redirects, headers, deadline, byte cap), this one owns the ARITHMETIC of an address.
+ *
+ * The awkward part lives here on purpose. A literal destination reaches the policy already
+ * normalized by `URL` (`2130706433`, `0x7f.1` and `[::ffff:7f00:1]` all collapse to one hostname),
+ * but a RESOLVED one does not: `dns.lookup` renders an IPv4-mapped AAAA answer through `inet_ntop`,
+ * which prints the dotted spelling `::ffff:127.0.0.1`. So the expansion below accepts BOTH
+ * spellings rather than trusting any normalizer to have run — on the resolution path an attacker
+ * controls the record. Every "cannot parse" answer is `undefined`/`true`, i.e. NOT public: an
+ * address this module cannot read is never treated as reachable.
+ *
+ * Node-only (`node:net`): reached through `egress-policy.ts`, never the browser barrel.
+ */
+/** True when `ip` (v4 or v6 text) is not a public unicast address. */
+declare function isPrivateAddress(ip: string): boolean;
+//#endregion
+//#region src/utils/egress-policy.d.ts
+type TEgressLookup = (hostname: string) => Promise<readonly string[]>;
+interface IEgressPolicy {
+  /** Exact lowercase hostnames that may be reached even when they resolve to a private address. */
+  readonly allowedHosts?: readonly string[];
+  /** Explicit enterprise opt-out from private/loopback/metadata blocking. Default `false`. */
+  readonly allowPrivateAddresses?: boolean;
+  /** Redirect hops followed before refusing. Default 5. */
+  readonly maxRedirects?: number;
+}
+interface IEgressFetchOptions {
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly signal?: AbortSignal;
+  /** Deadline for the WHOLE exchange, redirects and body included. Default 30 000 ms. */
+  readonly timeoutMs?: number;
+  /** Byte cap enforced on `Content-Length` and again while streaming. Default 5 000 000. */
+  readonly maxResponseBytes?: number;
+}
+interface IEgressDeps {
+  readonly fetch?: typeof globalThis.fetch;
+  readonly lookup?: TEgressLookup;
+}
+type TEgressRejectionReason = 'unsupported_scheme' | 'private_destination' | 'metadata_host' | 'unresolvable' | 'redirect_limit' | 'redirect_without_location' | 'redirect_refused' | 'response_too_large';
+interface IEgressRejection {
+  readonly reason: TEgressRejectionReason;
+  readonly url: string;
+  readonly message: string;
+}
+type TEgressFetchResult = {
+  ok: true;
+  status: number;
+  statusText: string;
+  headers: Headers;
+  body: Uint8Array;
+  finalUrl: string;
+} | {
+  ok: false;
+  rejection: IEgressRejection;
+};
+/** Hostnames that are metadata services or loopback by convention, whatever they resolve to. */
+declare const BLOCKED_HOSTNAMES: ReadonlySet<string>;
+/** Validate ONE destination URL against the policy. `undefined` means it may be reached. */
+declare function rejectDestination(url: URL, policy?: IEgressPolicy, lookup?: TEgressLookup): Promise<IEgressRejection | undefined>;
+/**
+ * Fetch `url` under the egress policy. Policy outcomes are RETURNED (`ok: false`); transport errors
+ * (DNS failure at connect, refused connection, TLS, abort) are THROWN, as `fetch` throws them, so the
+ * caller's own error classification keeps working.
+ */
+declare function fetchWithEgressPolicy(url: string, options?: IEgressFetchOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+interface IEgressPostOptions extends IEgressFetchOptions {
+  /** Sent as-is; a `URLSearchParams` or JSON string, never a stream, so it is never re-sent. */
+  readonly body: string | URLSearchParams;
+}
+/**
+ * POST `url` under the egress policy. The destination is validated as for a GET, but a redirect is
+ * REFUSED (`redirect_refused`), never followed: the body is the caller's to send to this URL alone.
+ */
+declare function postWithEgressPolicy(url: string, options: IEgressPostOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+//#endregion
+export { BLOCKED_HOSTNAMES, CommandExecutor, HttpExecutor, type IEgressDeps, type IEgressFetchOptions, type IEgressPolicy, type IEgressPostOptions, type IEgressRejection, type IOwnerOnlyIo, OWNER_ONLY_DIRECTORY_MODE, OWNER_ONLY_FILE_MODE, OwnerOnlyModeError, type TEgressFetchResult, type TEgressLookup, type TEgressRejectionReason, canonicalizePath, ensureOwnerOnlyDirectory, fetchWithEgressPolicy, isPathInside, isPrivateAddress, ownerOnlyGuarantee, postWithEgressPolicy, rejectDestination, resolveTrustedExecutionRoot, tightenExistingFile, writeOwnerOnlyFile };
+//# sourceMappingURL=node.d.ts.map

package/dist/node/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","names":[],"sources":["../../src/utils/path-containment.ts","../../src/utils/owner-only-store.ts","../../src/hooks/executors/command-executor.ts","../../src/hooks/executors/http-executor.ts","../../src/utils/ip-address.ts","../../src/utils/egress-policy.ts"],"mappings":";;;;;;;;;iBA2BgB,4BAA4B;;;;;;;;;iBAoC5B,iBAAiB;;;;;;;;iBAwBjB,aAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCjC9B;;cAEA;;cAMA,2BAA2B;EAC1B,YAAA;;;;;;;;iBAYE,mBACd;;;;;;;;UAYe;WACN,iBAAiB,gBAAgB;WACjC,WAAW,gBAAgB;WAC3B,YAAY;;UAGN,gCAAgC;;;;;;;;;;;;;;WActC;;;;;;;;iBAsCK,yBACd,mBACA,UAAS;;;;;;;;;iBA8BK,mBAAmB,kBAAkB;;;;;;;iBA2CrC,oBAAoB;;;cCnIvB,2BAA2B;mBAGT;WAFpB;EAEoB,YAAA;;;;;;EAO7B,QACE,YAAY,wBACZ,OAAO,YACP,WAAW,sBACV,QAAQ;;;;cC1EA,wBAAwB;WAC1B;EAEH,QAAQ,YAAY,qBAAqB,OAAO,aAAa,QAAQ;;;;;;;;;;;;;;;;;;;;iBCP7D,iBAAiB;;;KCSrB,iBAAiB,qBAAqB;UAEjC;;WAEN;;WAEA;;WAEA;;UAGM;WACN,UAAU,SAAS;WACnB,SAAS;;WAET;;WAEA;;UAGM;WACN,eAAe,WAAW;WAC1B,SAAS;;KAGR;UAUK;WACN,QAAQ;WACR;WACA;;KAGC;EAEN;EACA;EACA;EACA,SAAS;EACT,MAAM;EACN;;EAEA;EAAW,WAAW;;;cAWf,mBAAmB;;iBAaV,kBACpB,KAAK,KACL,SAAQ,eACR,SAAQ,gBACP,QAAQ;;;;;;iBAwDW,sBACpB,aACA,UAAS,qBACT,SAAQ,eACR,OAAM,cACL,QAAQ;UA6CM,2BAA2B;;WAEjC,eAAe;;;;;;iBAOJ,qBACpB,aACA,SAAS,oBACT,SAAQ,eACR,OAAM,cACL,QAAQ"}

package/dist/node/node.js

@@ -0,0 +1,2 @@
+import{t as e}from"./command-executor-DV-H2oD6.js";import{t}from"./http-executor-cWzI2svn.js";import{accessSync as n,chmodSync as r,constants as i,mkdirSync as a,realpathSync as o,renameSync as s,rmSync as c,statSync as l,unlinkSync as u,writeFileSync as d}from"node:fs";import{basename as f,dirname as p,isAbsolute as m,join as h,relative as g,resolve as _,sep as v}from"node:path";import{lookup as y}from"node:dns/promises";import{isIP as b}from"node:net";function x(e){if(typeof e!=`string`)throw TypeError(`executionRoot must be a string`);if(e.trim().length===0)throw TypeError(`executionRoot must be a non-empty string`);if(!m(e))throw TypeError(`executionRoot must be an absolute path`);let t;try{t=o(e)}catch{throw TypeError(`executionRoot must name an existing accessible directory`)}if(!l(t).isDirectory())throw TypeError(`executionRoot must name a directory`);try{n(t,i.R_OK|i.X_OK)}catch{throw TypeError(`executionRoot directory must be readable and traversable`)}return t}function S(e){let t=[],n=_(e);for(;;)try{return h(o(n),...t)}catch{let r=p(n);if(r===n)return _(e);t.unshift(f(n)),n=r}}function C(e,t){let n=S(e),r=S(t);return r===n||r.startsWith(n+v)}const w=384,T=448;var E=class extends Error{constructor(e){super(e),this.name=`OwnerOnlyModeError`}};function D(e=process.platform){return e===`win32`?`windows-acl`:`posix-mode`}function O(e,t){let n=g(e,t);if(n.startsWith(`..`)||m(n))throw new E(`withinRoot ${e} is not an ancestor of ${t}, so this call cannot own the path between them.`);let r=n.split(v).filter(e=>e.length>0),i=[e],a=e;for(let e of r)a=h(a,e),i.push(a);return i}function k(e,t,n={}){if(D()!==`posix-mode`)return;let r=(n.readMode??(e=>l(e).mode&4095))(e);if(r&63)throw new E(`${t} ${e} is mode 0${r.toString(8)} after being set owner-only; group or other permissions survived, so its contents are readable by another account.`)}function A(e,t={}){let n=t.makeDirectory??((e,t)=>{a(e,{recursive:!0,mode:t})}),i=t.setMode??((e,t)=>r(e,t));n(e,448);let o=t.withinRoot===void 0?[e]:O(t.withinRoot,e);for(let e of o)D()===`posix-mode`&&i(e,448),k(e,`directory`,t)}function j(e,t){A(p(e));let n=`${e}.${process.pid}.tmp`;c(n,{force:!0}),d(n,t,{encoding:`utf8`,mode:384,flag:`wx`});try{k(n,`file`),s(n,e)}catch(e){try{u(n)}catch{}throw e}k(e,`file`)}function M(e){if(D()!==`posix-mode`)return;let t;try{t=l(e).mode&4095}catch{return}t&63&&(r(e,384),k(e,`file`))}function N(e){let t=b(e);return t===4?P(e.split(`.`).map(Number)):t!==6||F(e)}function P(e){let[t=0,n=0,r=0]=e;return t===0||t===10||t===127||t===100&&n>=64&&n<=127||t===169&&n===254||t===172&&n>=16&&n<=31||t===192&&n===0&&r===0||t===192&&n===168||t===198&&(n===18||n===19)||t>=224}function F(e){let t=L(e);if(t===void 0)return!0;let[n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0]=t;return n===0&&r===0&&i===0&&a===0&&o===0&&s===65535||n===100&&r===65435&&i===0&&a===0&&o===0&&s===0?P([c>>8,c&255,l>>8,l&255]):n===0&&r===0&&i===0&&a===0&&o===0&&s===0||(n&65024)==64512||(n&65472)==65152||(n&65472)==65216||(n&65280)==65280}function I(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);if(!n.includes(`.`))return e;if(t<0||b(n)!==4)return;let[r=0,i=0,a=0,o=0]=n.split(`.`).map(Number),s=(r<<8|i).toString(16),c=(a<<8|o).toString(16);return`${e.slice(0,t+1)}${s}:${c}`}function L(e){let t=I(e.split(`%`)[0]??e);if(t===void 0)return;let n=t.split(`::`);if(n.length>2)return;let r=e=>e.length===0?[]:e.split(`:`).map(e=>Number.parseInt(e,16)),i=r(n[0]??``),a=n.length===2?r(n[1]??``):[],o=8-i.length-a.length;if(o<0||n.length===1&&o!==0)return;let s=[...i,...Array(o).fill(0),...a];return s.some(e=>Number.isNaN(e)||e<0||e>65535)?void 0:s}const R=3e4,z=5e6,B=new Set([301,302,303,307,308]),V=new Set([`localhost`,`metadata`,`metadata.google.internal`,`metadata.goog`,`instance-data`,`instance-data.ec2.internal`]),H=async e=>(await y(e,{all:!0,verbatim:!0})).map(e=>e.address);async function U(e,t={},n=H){let r=e.href;if(e.protocol!==`http:`&&e.protocol!==`https:`)return{reason:`unsupported_scheme`,url:r,message:`Only http(s) URLs may be fetched.`};if(t.allowPrivateAddresses===!0)return;let i=e.hostname.replace(/^\[|\]$/g,``).toLowerCase();if(t.allowedHosts?.includes(i))return;if(V.has(i)||i.endsWith(`.localhost`))return{reason:`metadata_host`,url:r,message:`Destination "${i}" is a loopback or cloud-metadata host and is not reachable from tools.`};let a=b(i)?[i]:await W(i,n);if(a===void 0||a.length===0)return{reason:`unresolvable`,url:r,message:`Destination "${i}" did not resolve.`};let o=a.find(N);if(o!==void 0)return{reason:`private_destination`,url:r,message:`Destination "${i}" resolves to ${o}, a private, loopback or link-local address, and is not reachable from tools.`}}async function W(e,t){try{return await t(e)}catch{return}}async function G(e,t={},n={},r={}){let i=r.fetch??((e,t)=>globalThis.fetch(e,t)),a=r.lookup??H,o=t.maxResponseBytes??z,s=n.maxRedirects??5,c=AbortSignal.timeout(t.timeoutMs??R),l=t.signal?AbortSignal.any([c,t.signal]):c,u=new URL(e),d={...t.headers??{}};for(let e=0;;e+=1){let t=await U(u,n,a);if(t!==void 0)return{ok:!1,rejection:t};let r=await i(u.href,{headers:d,signal:l,redirect:`manual`});if(!B.has(r.status))return J(r,u.href,o,l);let c=r.headers.get(`location`);if(c===null)return{ok:!1,rejection:{reason:`redirect_without_location`,url:u.href,message:`HTTP ${r.status} without a Location header.`}};if(e>=s)return{ok:!1,rejection:{reason:`redirect_limit`,url:u.href,message:`More than ${s} redirects.`}};let f=new URL(c,u);f.origin!==u.origin&&(d=q(d)),u=f}}async function K(e,t,n={},r={}){let i=r.fetch??((e,t)=>globalThis.fetch(e,t)),a=t.maxResponseBytes??z,o=AbortSignal.timeout(t.timeoutMs??R),s=t.signal?AbortSignal.any([o,t.signal]):o,c=new URL(e),l=await U(c,n,r.lookup??H);if(l!==void 0)return{ok:!1,rejection:l};let u=await i(c.href,{method:`POST`,headers:{...t.headers??{}},body:t.body,signal:s,redirect:`manual`});return u.status>=300&&u.status<400?(await u.body?.cancel().catch(()=>void 0),{ok:!1,rejection:{reason:`redirect_refused`,url:c.href,message:`HTTP ${u.status}: a POST is never redirected.`}}):J(u,c.href,a,s)}function q(e){let t={};for(let[n,r]of Object.entries(e))n.toLowerCase()===`user-agent`&&(t[n]=r);return t}async function J(e,t,n,r){let i=e=>({ok:!1,rejection:{reason:`response_too_large`,url:t,message:`Response exceeds ${n} bytes (${e} seen).`}}),a=Number(e.headers.get(`content-length`));if(Number.isFinite(a)&&a>n)return await e.body?.cancel(),i(a);let o=[],s=0;if(!e.body&&typeof e.arrayBuffer==`function`){let t=new Uint8Array(await e.arrayBuffer());if(t.byteLength>n)return i(t.byteLength);o.push(t),s=t.byteLength}else if(e.body){let t=e.body.getReader();for(;;){r.throwIfAborted();let{done:e,value:a}=await t.read();if(e)break;if(s+=a.byteLength,s>n)return await t.cancel(),i(s);o.push(a)}}let c=new Uint8Array(s),l=0;for(let e of o)c.set(e,l),l+=e.byteLength;return{ok:!0,status:e.status,statusText:e.statusText,headers:e.headers,body:c,finalUrl:t}}export{V as BLOCKED_HOSTNAMES,e as CommandExecutor,t as HttpExecutor,T as OWNER_ONLY_DIRECTORY_MODE,w as OWNER_ONLY_FILE_MODE,E as OwnerOnlyModeError,S as canonicalizePath,A as ensureOwnerOnlyDirectory,G as fetchWithEgressPolicy,C as isPathInside,N as isPrivateAddress,D as ownerOnlyGuarantee,K as postWithEgressPolicy,U as rejectDestination,x as resolveTrustedExecutionRoot,M as tightenExistingFile,j as writeOwnerOnlyFile};
+//# sourceMappingURL=node.js.map

package/dist/node/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","names":["relative","relativePath","dnsLookup","resolve"],"sources":["../../src/utils/path-containment.ts","../../src/utils/owner-only-store.ts","../../src/utils/ip-address.ts","../../src/utils/egress-policy.ts"],"sourcesContent":["/**\n * SEC-006 — the SSOT for \"is this path inside that root?\" when the answer is a SECURITY decision.\n *\n * `path.resolve` and `path.normalize` are purely lexical: they collapse `.` and `..` textually but do\n * not consult the filesystem, so they cannot see a symlink. A link sitting INSIDE the root and\n * pointing outside it therefore satisfies a `startsWith(root + sep)` check while the syscall that\n * follows — `open`, `readFile`, `writeFile` — follows the link straight out of the boundary.\n *\n * Symlinks are ordinary committed git content and ordinary build-output artifacts, so this is not a\n * theoretical hole: it was exploitable in both the file-tool sandbox and the CLI's monitor asset\n * server. Both now decide containment here, because two containment checks that can disagree are\n * their own defect.\n *\n * Every security-boundary containment check in the repo routes through here — the `agent-*` family\n * and the `dag-*` family alike. The DAG side is not a cross-family exception: `dag-framework`\n * declares `@robota-sdk/agent-core` in its runtime dependencies.\n */\nimport { accessSync, constants, realpathSync, statSync } from 'node:fs';\nimport { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';\n\n/**\n * Validate an authority root more strictly than candidate-path canonicalization.\n *\n * Candidate write paths may have a missing tail, but an authority root must already exist and be a\n * traversable directory. Keeping the contracts separate prevents a typo in a root from degrading to\n * a lexical boundary that the caller did not actually select.\n */\nexport function resolveTrustedExecutionRoot(input: unknown): string {\n  if (typeof input !== 'string') {\n    throw new TypeError('executionRoot must be a string');\n  }\n  if (input.trim().length === 0) {\n    throw new TypeError('executionRoot must be a non-empty string');\n  }\n  if (!isAbsolute(input)) {\n    throw new TypeError('executionRoot must be an absolute path');\n  }\n\n  let canonicalRoot: string;\n  try {\n    canonicalRoot = realpathSync(input);\n  } catch {\n    throw new TypeError('executionRoot must name an existing accessible directory');\n  }\n  if (!statSync(canonicalRoot).isDirectory()) {\n    throw new TypeError('executionRoot must name a directory');\n  }\n  try {\n    accessSync(canonicalRoot, constants.R_OK | constants.X_OK);\n  } catch {\n    throw new TypeError('executionRoot directory must be readable and traversable');\n  }\n  return canonicalRoot;\n}\n\n/**\n * Resolve `p` to its canonical form, following symlinks, tolerating a path that does not exist yet.\n *\n * `realpathSync` throws on a missing path, but callers legitimately ask about files they are about to\n * CREATE (a write or an edit). So we walk up to the deepest ancestor that does exist, canonicalize\n * that, and re-attach the remaining segments — the re-attached tail cannot itself be a symlink,\n * because it does not exist.\n */\nexport function canonicalizePath(p: string): string {\n  const tail: string[] = [];\n  let current = resolve(p);\n  for (;;) {\n    try {\n      return join(realpathSync(current), ...tail);\n    } catch {\n      const parent = dirname(current);\n      // allow-fallback: nothing along the chain exists or is readable — fall back to the lexical\n      // path, which `resolve()` has already fully normalized and which is therefore safe to compare.\n      if (parent === current) return resolve(p);\n      tail.unshift(basename(current));\n      current = parent;\n    }\n  }\n}\n\n/**\n * Whether `candidate` is `root` itself or lies beneath it, decided on the CANONICAL form of both.\n *\n * Canonicalizing the root as well as the candidate matters: a root that is itself reached through a\n * symlink (macOS `/tmp` -> `/private/tmp`, or a workspace under a symlinked home) would otherwise\n * spuriously reject every path inside it.\n */\nexport function isPathInside(root: string, candidate: string): boolean {\n  const canonicalRoot = canonicalizePath(root);\n  const canonicalCandidate = canonicalizePath(candidate);\n  return canonicalCandidate === canonicalRoot || canonicalCandidate.startsWith(canonicalRoot + sep);\n}\n","/**\n * SEC-020 (issue #2021) — creating a host directory or file that only its owner can read.\n *\n * A host application persists session records, logs, settings and device credentials under a directory\n * of its own choosing. They carry prompts, model output, tool results and, in the settings case,\n * provider credentials. On a shared workstation or a CI host, every other local account reads them\n * unless the mode says otherwise.\n *\n * WHERE that directory is belongs to the host, not here — this module knows only what has to be true\n * of whatever path it is handed, which is what lets it be tested without a filesystem layout.\n *\n * ## Why this is one module and not a constant each caller repeats\n *\n * `0o600` and `0o700` were already spelled out in five separate files before this existed, and the\n * repository had already learned — in `guarded-directory.ts`, for a pairing rendezvous — that the\n * constants are the easy half. The load-bearing part is that **`mkdirSync(path, { mode })` does not\n * set the mode of a directory that already exists.** `recursive: true` returns successfully and\n * silently adopts whatever mode is there. A directory left at 0777 by an earlier version, by a\n * shared CI checkout, or by another local user who pre-created it, becomes ours with no signal.\n *\n * Measured under umask 022 before this module existed: a session log directory pre-created at 0777\n * stayed 0777 through `mkdirSync(dir, { recursive: true, mode: 0o700 })`, and its 0600 records were\n * then removable and replaceable by any local account.\n *\n * The same holds for files. `writeFileSync(path, data, { mode })` applies the mode only when the\n * file is CREATED; an existing 0644 record keeps 0644 forever, so a store written by an older\n * version is never repaired by a newer one.\n *\n * So: create, then set the mode unconditionally, then VERIFY — and verification is what makes the\n * first two checkable rather than hopeful. It is also the only step that catches an owner we did not\n * expect, which `mkdir` and `chmod` between them cannot.\n *\n * ## Windows\n *\n * `chmodSync` on win32 toggles the read-only attribute and cannot express \"owner only\"; NTFS ACL\n * inheritance governs instead, and a user's profile directory is not readable by other unprivileged\n * accounts by default. The POSIX assertion is therefore not made there, and `ownerOnlyGuarantee()` reports which\n * guarantee is in force so a caller — and a test — can state the platform's actual claim rather than\n * assume the POSIX one everywhere. A store directory placed inside a world-writable parent on\n * Windows is NOT protected by this module, and that is recorded rather than papered over.\n */\n\nimport {\n  chmodSync,\n  mkdirSync,\n  renameSync,\n  rmSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from 'node:fs';\nimport { dirname, isAbsolute, join, relative as relativePath, sep } from 'node:path';\n\n/** Owner read/write. Nothing for group, nothing for other. */\nexport const OWNER_ONLY_FILE_MODE = 0o600;\n/** Owner read/write/traverse. The traverse bit is what keeps another account out of the directory. */\nexport const OWNER_ONLY_DIRECTORY_MODE = 0o700;\n\n/** The bits that must be clear for the guarantee to hold: every group and other permission. */\nconst FORBIDDEN_BITS = 0o077;\n\n/** Raised when a path cannot be made owner-only. Never swallowed into a weaker mode. */\nexport class OwnerOnlyModeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'OwnerOnlyModeError';\n  }\n}\n\n/**\n * Which guarantee this platform can actually make.\n *\n * `posix-mode` — the mode bits are asserted after every create and every write.\n * `windows-acl` — inherited NTFS ACLs govern; the POSIX assertion is not made and not claimed.\n */\nexport function ownerOnlyGuarantee(\n  platform: string = process.platform,\n): 'posix-mode' | 'windows-acl' {\n  return platform === 'win32' ? 'windows-acl' : 'posix-mode';\n}\n\n/**\n * Seams for the failure paths, injected for the reason `guarded-directory.ts` states: a filesystem\n * that silently ignores `chmod` is a real condition — some network and FAT mounts do exactly that —\n * and it is the ONLY condition the verification step catches that create-then-chmod does not. Without\n * a seam that case is unreachable from a test, and a guard no test can reach is a guard nobody knows\n * is there. Measured: with these absent, deleting the verification entirely changed no test result.\n */\nexport interface IOwnerOnlyIo {\n  readonly makeDirectory?: (target: string, mode: number) => void;\n  readonly setMode?: (target: string, mode: number) => void;\n  readonly readMode?: (target: string) => number;\n}\n\nexport interface IEnsureOwnerOnlyOptions extends IOwnerOnlyIo {\n  /**\n   * An ANCESTOR of `directory` that the caller also owns, tightened along with every segment between\n   * them.\n   *\n   * Needed because `mkdirSync(path, { recursive: true, mode })` applies the mode only to the\n   * directories it CREATES. A store root an older version already made sits at whatever mode it was\n   * given and this call would leave it there — which is the module's own headline defect surviving\n   * one level up, on the very path it exists to protect. Found in review of PR #2224.\n   *\n   * It is a parameter rather than a walk up to some inferred boundary because WHICH ancestors belong\n   * to the caller is the caller's knowledge. This module must not guess that a parent is ours; it\n   * would eventually chmod someone's home directory.\n   */\n  readonly withinRoot?: string;\n}\n\n/** Every directory from `root` down to `target`, outermost first. `root` must be an ancestor. */\nfunction segmentsFromRoot(root: string, target: string): string[] {\n  const relative = relativePath(root, target);\n  if (relative.startsWith('..') || isAbsolute(relative)) {\n    throw new OwnerOnlyModeError(\n      `withinRoot ${root} is not an ancestor of ${target}, so this call cannot own the path between them.`,\n    );\n  }\n  const parts = relative.split(sep).filter((part) => part.length > 0);\n  const chain: string[] = [root];\n  let current = root;\n  for (const part of parts) {\n    current = join(current, part);\n    chain.push(current);\n  }\n  return chain;\n}\n\nfunction assertOwnerOnly(target: string, kind: 'directory' | 'file', io: IOwnerOnlyIo = {}): void {\n  if (ownerOnlyGuarantee() !== 'posix-mode') return;\n  const mode = (io.readMode ?? ((path: string) => statSync(path).mode & 0o7777))(target);\n  if ((mode & FORBIDDEN_BITS) !== 0) {\n    throw new OwnerOnlyModeError(\n      `${kind} ${target} is mode 0${mode.toString(8)} after being set owner-only; ` +\n        'group or other permissions survived, so its contents are readable by another account.',\n    );\n  }\n}\n\n/**\n * Ensure `directory` exists and only its owner can enter it.\n *\n * The `chmod` is unconditional because `mkdir` does not touch an existing directory's mode, and the\n * `stat` afterwards is what turns two hopeful calls into a checked one.\n */\nexport function ensureOwnerOnlyDirectory(\n  directory: string,\n  options: IEnsureOwnerOnlyOptions = {},\n): void {\n  const makeDirectory =\n    options.makeDirectory ??\n    ((target: string, mode: number): void => {\n      mkdirSync(target, { recursive: true, mode });\n    });\n  const setMode =\n    options.setMode ?? ((target: string, mode: number): void => chmodSync(target, mode));\n  makeDirectory(directory, OWNER_ONLY_DIRECTORY_MODE);\n  // Every directory the caller declared it owns, not only the leaf. `mkdir` set the mode on what it\n  // CREATED; a root an older version left at 0755 was created by nobody here and would keep it.\n  const owned =\n    options.withinRoot === undefined\n      ? [directory]\n      : segmentsFromRoot(options.withinRoot, directory);\n  for (const target of owned) {\n    if (ownerOnlyGuarantee() === 'posix-mode') setMode(target, OWNER_ONLY_DIRECTORY_MODE);\n    assertOwnerOnly(target, 'directory', options);\n  }\n}\n\n/**\n * Replace `filePath` atomically with content only its owner can read.\n *\n * The temp file carries the mode from the moment it is created — writing it at the umask's default\n * and tightening afterwards leaves a window in which the full content is world-readable on disk, and\n * `rename` preserves whatever mode the temp file had. The `chmod` after the write is for the case\n * where the temp path already existed at a wider mode.\n */\nexport function writeOwnerOnlyFile(filePath: string, content: string): void {\n  ensureOwnerOnlyDirectory(dirname(filePath));\n  const temporaryPath = `${filePath}.${process.pid}.tmp`;\n  // A stale temp file is REMOVED rather than reused. It can only come from a process that died\n  // mid-write, its contents are meaningless, and — the part that matters here — `writeFileSync` does\n  // not apply `mode` to a file that already exists, so reusing one at 0666 would put the whole\n  // record on disk world-readable before the rename.\n  //\n  // Removed with `force` rather than `if (exists) unlink`: checking and then acting on a path is a\n  // race, and the race is exploitable here — another process can create the path between the two\n  // calls, and the `wx` write below would then fail on a file this call believed it had cleared.\n  // CodeQL flagged the check-then-act form on PR #2224 and it was right to.\n  rmSync(temporaryPath, { force: true });\n  // `wx` guarantees this call CREATES the file, which is the only condition under which `mode` is\n  // applied. There is deliberately no `chmod` after it: tightening a file that was created wide\n  // leaves a window in which the full record is readable, and a `chmod` here would make the mode\n  // above redundant — so a mutation that removed it would change nothing and the window would be\n  // untested. The assertion below is what proves the mode actually took.\n  writeFileSync(temporaryPath, content, {\n    encoding: 'utf8',\n    mode: OWNER_ONLY_FILE_MODE,\n    flag: 'wx',\n  });\n  try {\n    assertOwnerOnly(temporaryPath, 'file');\n    renameSync(temporaryPath, filePath);\n  } catch (error) {\n    try {\n      unlinkSync(temporaryPath);\n    } catch {\n      // allow-fallback: the temp file may already be gone; the original error is the one to report.\n    }\n    throw error;\n  }\n  assertOwnerOnly(filePath, 'file');\n}\n\n/**\n * Tighten a file that already exists — the repair path for a record an older version left at 0644.\n *\n * A no-op on a path that does not exist, because \"there is nothing to tighten\" and \"we tightened it\"\n * are the same outcome for the caller, and throwing would make every writer branch on existence.\n */\nexport function tightenExistingFile(filePath: string): void {\n  if (ownerOnlyGuarantee() !== 'posix-mode') return;\n  let mode: number;\n  try {\n    mode = statSync(filePath).mode & 0o7777;\n  } catch {\n    return; // allow-fallback: nothing to tighten\n  }\n  if ((mode & FORBIDDEN_BITS) === 0) return;\n  chmodSync(filePath, OWNER_ONLY_FILE_MODE);\n  assertOwnerOnly(filePath, 'file');\n}\n","/**\n * Address classification for the egress boundary (#2026) — the \"is this address public unicast?\"\n * half of `egress-policy.ts`, split out so each module holds one job: that one owns the FETCH\n * (scheme, redirects, headers, deadline, byte cap), this one owns the ARITHMETIC of an address.\n *\n * The awkward part lives here on purpose. A literal destination reaches the policy already\n * normalized by `URL` (`2130706433`, `0x7f.1` and `[::ffff:7f00:1]` all collapse to one hostname),\n * but a RESOLVED one does not: `dns.lookup` renders an IPv4-mapped AAAA answer through `inet_ntop`,\n * which prints the dotted spelling `::ffff:127.0.0.1`. So the expansion below accepts BOTH\n * spellings rather than trusting any normalizer to have run — on the resolution path an attacker\n * controls the record. Every \"cannot parse\" answer is `undefined`/`true`, i.e. NOT public: an\n * address this module cannot read is never treated as reachable.\n *\n * Node-only (`node:net`): reached through `egress-policy.ts`, never the browser barrel.\n */\n\nimport { isIP } from 'node:net';\n\n/** What `isIP` answers: 4 for an IPv4 literal, 6 for an IPv6 one, 0 for text that is neither. */\nconst IP_VERSION_V4 = 4;\nconst IP_VERSION_V6 = 6;\n/** An IPv6 group is two octets wide, and is written in hex once a dotted quad is folded into one. */\nconst OCTET_BITS = 8;\nconst HEX_RADIX = 16;\n\n/** True when `ip` (v4 or v6 text) is not a public unicast address. */\nexport function isPrivateAddress(ip: string): boolean {\n  const version = isIP(ip);\n  if (version === IP_VERSION_V4) return isPrivateIpv4(ip.split('.').map(Number));\n  if (version === IP_VERSION_V6) return isPrivateIpv6(ip);\n  return true; // not an address at all: never treat it as public\n}\n\nfunction isPrivateIpv4(o: readonly number[]): boolean {\n  const [a = 0, b = 0, c = 0] = o;\n  return (\n    a === 0 || // \"this\" network\n    a === 10 ||\n    a === 127 ||\n    (a === 100 && b >= 64 && b <= 127) || // CGNAT\n    (a === 169 && b === 254) || // link-local, incl. 169.254.169.254\n    (a === 172 && b >= 16 && b <= 31) ||\n    (a === 192 && b === 0 && c === 0) ||\n    (a === 192 && b === 168) ||\n    (a === 198 && (b === 18 || b === 19)) ||\n    a >= 224 // multicast + reserved + broadcast\n  );\n}\n\nfunction isPrivateIpv6(ip: string): boolean {\n  const groups = expandIpv6(ip);\n  if (groups === undefined) return true;\n  const [g0 = 0, g1 = 0, g2 = 0, g3 = 0, g4 = 0, g5 = 0, g6 = 0, g7 = 0] = groups;\n  const isMapped = g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0xffff;\n  const isNat64 = g0 === 0x64 && g1 === 0xff9b && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0;\n  if (isMapped || isNat64) {\n    return isPrivateIpv4([g6 >> 8, g6 & 0xff, g7 >> 8, g7 & 0xff]);\n  }\n  // ::/96 in one rule: the unspecified address `::`, loopback `::1`, and the DEPRECATED\n  // IPv4-compatible form (`::127.0.0.1`, which `URL` renders as `::7f00:1`) — which embeds an IPv4\n  // address just as a mapped one does. None of that range is public unicast.\n  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0) return true;\n  if ((g0 & 0xfe00) === 0xfc00) return true; // fc00::/7 unique local\n  if ((g0 & 0xffc0) === 0xfe80) return true; // fe80::/10 link-local\n  if ((g0 & 0xffc0) === 0xfec0) return true; // fec0::/10 site-local (deprecated, still routable)\n  if ((g0 & 0xff00) === 0xff00) return true; // ff00::/8 multicast\n  return false;\n}\n\n/**\n * Rewrite a trailing dotted-quad (`::ffff:127.0.0.1`) into the two hex groups it stands for, so the\n * rest of the expansion only ever sees colon groups. `undefined` when the tail is not a valid IPv4\n * address — a refusal, never a guess, because {@link isPrivateIpv6} reads `undefined` as private.\n *\n * This form is not exotic: `URL` normalizes a literal to `[::ffff:7f00:1]`, but `dns.lookup` renders\n * an IPv4-mapped AAAA answer through `inet_ntop`, which prints the dotted form — so it is exactly\n * what arrives on the RESOLUTION path, where an attacker controls the record.\n */\nfunction withoutDottedQuadTail(ip: string): string | undefined {\n  const lastColon = ip.lastIndexOf(':');\n  const tail = ip.slice(lastColon + 1);\n  if (!tail.includes('.')) return ip;\n  if (lastColon < 0 || isIP(tail) !== IP_VERSION_V4) return undefined;\n  const [a = 0, b = 0, c = 0, d = 0] = tail.split('.').map(Number);\n  const high = ((a << OCTET_BITS) | b).toString(HEX_RADIX);\n  const low = ((c << OCTET_BITS) | d).toString(HEX_RADIX);\n  return `${ip.slice(0, lastColon + 1)}${high}:${low}`;\n}\n\n/** Expand an IPv6 literal (as `URL` or a resolver renders it, brackets removed) into 8 16-bit groups. */\nfunction expandIpv6(ip: string): number[] | undefined {\n  const zoneless = ip.split('%')[0] ?? ip;\n  const withoutZone = withoutDottedQuadTail(zoneless);\n  if (withoutZone === undefined) return undefined;\n  const halves = withoutZone.split('::');\n  if (halves.length > 2) return undefined;\n  const parse = (part: string): number[] =>\n    part.length === 0 ? [] : part.split(':').map((g) => Number.parseInt(g, 16));\n  const head = parse(halves[0] ?? '');\n  const tail = halves.length === 2 ? parse(halves[1] ?? '') : [];\n  const missing = 8 - head.length - tail.length;\n  if (missing < 0 || (halves.length === 1 && missing !== 0)) return undefined;\n  const groups = [...head, ...new Array<number>(missing).fill(0), ...tail];\n  return groups.some((g) => Number.isNaN(g) || g < 0 || g > 0xffff) ? undefined : groups;\n}\n","/**\n * The shared outbound-network (egress) boundary (#2026).\n *\n * Every built-in, provider helper and node runtime that fetches a caller- or model-supplied URL goes\n * through {@link fetchWithEgressPolicy}. It owns, in one place:\n *\n * - DESTINATION safety: only `http:`/`https:`; literal and RESOLVED addresses are refused when they are\n *   loopback, private, link-local, multicast, unspecified or reserved — for IPv4, IPv6, and IPv4-mapped /\n *   IPv4-compatible / NAT64-embedded forms — plus the well-known cloud metadata hostnames. `URL`\n *   normalization is what collapses alternate encodings (`2130706433`, `0x7f.1`, `[::ffff:7f00:1]`)\n *   into one hostname on the LITERAL path; the RESOLVED path has no such normalizer, and an embedded\n *   IPv4 arrives from `dns.lookup` in the dotted spelling `inet_ntop` prints (`::ffff:127.0.0.1`), so\n *   the classifier accepts both spellings rather than trusting `URL` to have canonicalised anything.\n * - REDIRECTS: followed manually, every hop re-validated, and caller-supplied plus credential-bearing\n *   headers dropped on a cross-origin hop. A POST ({@link postWithEgressPolicy}) never follows one:\n *   its body can carry a credential — an authorization code, a client secret, a refresh token — and\n *   a redirect would hand it to a destination the caller never chose.\n * - RESOURCE policy: the caller's `AbortSignal` composed with an explicit deadline, and the response\n *   byte cap enforced WHILE STREAMING (and from `Content-Length` first), never after a whole-body\n *   allocation.\n * - ESCAPE HATCHES: `allowedHosts` (exact hostnames that may resolve privately) and\n *   `allowPrivateAddresses` (an explicit enterprise opt-out), both declared by the composition root.\n *\n * What it does NOT yet do: pin the connection to the validated address (Node's global `fetch` exposes\n * no connect-time lookup hook without the `undici` package). Resolve-then-validate on every hop narrows\n * the DNS-rebinding window; it does not close it, and this comment is the record of that gap.\n *\n * Node-only (`node:dns`, `node:net`): exported from `@robota-sdk/agent-core/node`, never the browser barrel.\n */\n\nimport { lookup as dnsLookup } from 'node:dns/promises';\nimport { isIP } from 'node:net';\n\nimport { isPrivateAddress } from './ip-address.js';\n\nexport type TEgressLookup = (hostname: string) => Promise<readonly string[]>;\n\nexport interface IEgressPolicy {\n  /** Exact lowercase hostnames that may be reached even when they resolve to a private address. */\n  readonly allowedHosts?: readonly string[];\n  /** Explicit enterprise opt-out from private/loopback/metadata blocking. Default `false`. */\n  readonly allowPrivateAddresses?: boolean;\n  /** Redirect hops followed before refusing. Default 5. */\n  readonly maxRedirects?: number;\n}\n\nexport interface IEgressFetchOptions {\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly signal?: AbortSignal;\n  /** Deadline for the WHOLE exchange, redirects and body included. Default 30 000 ms. */\n  readonly timeoutMs?: number;\n  /** Byte cap enforced on `Content-Length` and again while streaming. Default 5 000 000. */\n  readonly maxResponseBytes?: number;\n}\n\nexport interface IEgressDeps {\n  readonly fetch?: typeof globalThis.fetch;\n  readonly lookup?: TEgressLookup;\n}\n\nexport type TEgressRejectionReason =\n  | 'unsupported_scheme'\n  | 'private_destination'\n  | 'metadata_host'\n  | 'unresolvable'\n  | 'redirect_limit'\n  | 'redirect_without_location'\n  | 'redirect_refused'\n  | 'response_too_large';\n\nexport interface IEgressRejection {\n  readonly reason: TEgressRejectionReason;\n  readonly url: string;\n  readonly message: string;\n}\n\nexport type TEgressFetchResult =\n  | {\n      ok: true;\n      status: number;\n      statusText: string;\n      headers: Headers;\n      body: Uint8Array;\n      finalUrl: string;\n    }\n  | { ok: false; rejection: IEgressRejection };\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_RESPONSE_BYTES = 5_000_000;\nconst DEFAULT_MAX_REDIRECTS = 5;\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** The address classifier, re-exported so the egress boundary stays one import for callers. */\nexport { isPrivateAddress };\n\n/** Hostnames that are metadata services or loopback by convention, whatever they resolve to. */\nexport const BLOCKED_HOSTNAMES: ReadonlySet<string> = new Set([\n  'localhost',\n  'metadata',\n  'metadata.google.internal',\n  'metadata.goog',\n  'instance-data',\n  'instance-data.ec2.internal',\n]);\n\nconst defaultLookup: TEgressLookup = async (hostname) =>\n  (await dnsLookup(hostname, { all: true, verbatim: true })).map((entry) => entry.address);\n\n/** Validate ONE destination URL against the policy. `undefined` means it may be reached. */\nexport async function rejectDestination(\n  url: URL,\n  policy: IEgressPolicy = {},\n  lookup: TEgressLookup = defaultLookup,\n): Promise<IEgressRejection | undefined> {\n  const href = url.href;\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    return {\n      reason: 'unsupported_scheme',\n      url: href,\n      message: `Only http(s) URLs may be fetched.`,\n    };\n  }\n  if (policy.allowPrivateAddresses === true) return undefined;\n  const hostname = url.hostname.replace(/^\\[|\\]$/g, '').toLowerCase();\n  if (policy.allowedHosts?.includes(hostname)) return undefined;\n  if (BLOCKED_HOSTNAMES.has(hostname) || hostname.endsWith('.localhost')) {\n    return {\n      reason: 'metadata_host',\n      url: href,\n      message: `Destination \"${hostname}\" is a loopback or cloud-metadata host and is not reachable from tools.`,\n    };\n  }\n  const addresses = isIP(hostname) ? [hostname] : await resolve(hostname, lookup);\n  if (addresses === undefined || addresses.length === 0) {\n    return {\n      reason: 'unresolvable',\n      url: href,\n      message: `Destination \"${hostname}\" did not resolve.`,\n    };\n  }\n  const blocked = addresses.find(isPrivateAddress);\n  if (blocked !== undefined) {\n    return {\n      reason: 'private_destination',\n      url: href,\n      message: `Destination \"${hostname}\" resolves to ${blocked}, a private, loopback or link-local address, and is not reachable from tools.`,\n    };\n  }\n  return undefined;\n}\n\nasync function resolve(\n  hostname: string,\n  lookup: TEgressLookup,\n): Promise<readonly string[] | undefined> {\n  try {\n    return await lookup(hostname);\n  } catch {\n    // allow-fallback: an unresolvable host is a POLICY outcome (\"unresolvable\"), reported to the\n    // caller as a rejection with its reason — not a hidden success.\n    return undefined;\n  }\n}\n\n/**\n * Fetch `url` under the egress policy. Policy outcomes are RETURNED (`ok: false`); transport errors\n * (DNS failure at connect, refused connection, TLS, abort) are THROWN, as `fetch` throws them, so the\n * caller's own error classification keeps working.\n */\nexport async function fetchWithEgressPolicy(\n  url: string,\n  options: IEgressFetchOptions = {},\n  policy: IEgressPolicy = {},\n  deps: IEgressDeps = {},\n): Promise<TEgressFetchResult> {\n  const doFetch = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));\n  const lookup = deps.lookup ?? defaultLookup;\n  const maxBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;\n  const maxRedirects = policy.maxRedirects ?? DEFAULT_MAX_REDIRECTS;\n  const deadline = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);\n  const signal = options.signal ? AbortSignal.any([deadline, options.signal]) : deadline;\n\n  let current = new URL(url);\n  let headers: Record<string, string> = { ...(options.headers ?? {}) };\n  for (let hop = 0; ; hop += 1) {\n    const rejection = await rejectDestination(current, policy, lookup);\n    if (rejection !== undefined) return { ok: false, rejection };\n\n    const response = await doFetch(current.href, { headers, signal, redirect: 'manual' });\n    if (!REDIRECT_STATUSES.has(response.status)) {\n      return readUnderCap(response, current.href, maxBytes, signal);\n    }\n    const location = response.headers.get('location');\n    if (location === null) {\n      return {\n        ok: false,\n        rejection: {\n          reason: 'redirect_without_location',\n          url: current.href,\n          message: `HTTP ${response.status} without a Location header.`,\n        },\n      };\n    }\n    if (hop >= maxRedirects) {\n      return {\n        ok: false,\n        rejection: {\n          reason: 'redirect_limit',\n          url: current.href,\n          message: `More than ${maxRedirects} redirects.`,\n        },\n      };\n    }\n    const next = new URL(location, current);\n    if (next.origin !== current.origin) headers = stripSensitiveHeaders(headers);\n    current = next;\n  }\n}\n\nexport interface IEgressPostOptions extends IEgressFetchOptions {\n  /** Sent as-is; a `URLSearchParams` or JSON string, never a stream, so it is never re-sent. */\n  readonly body: string | URLSearchParams;\n}\n\n/**\n * POST `url` under the egress policy. The destination is validated as for a GET, but a redirect is\n * REFUSED (`redirect_refused`), never followed: the body is the caller's to send to this URL alone.\n */\nexport async function postWithEgressPolicy(\n  url: string,\n  options: IEgressPostOptions,\n  policy: IEgressPolicy = {},\n  deps: IEgressDeps = {},\n): Promise<TEgressFetchResult> {\n  const doFetch = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));\n  const maxBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;\n  const deadline = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);\n  const signal = options.signal ? AbortSignal.any([deadline, options.signal]) : deadline;\n  const target = new URL(url);\n  const rejection = await rejectDestination(target, policy, deps.lookup ?? defaultLookup);\n  if (rejection !== undefined) return { ok: false, rejection };\n  const response = await doFetch(target.href, {\n    method: 'POST',\n    headers: { ...(options.headers ?? {}) },\n    body: options.body,\n    signal,\n    redirect: 'manual',\n  });\n  if (response.status >= 300 && response.status < 400) {\n    await response.body?.cancel().catch(() => undefined);\n    return {\n      ok: false,\n      rejection: {\n        reason: 'redirect_refused',\n        url: target.href,\n        message: `HTTP ${response.status}: a POST is never redirected.`,\n      },\n    };\n  }\n  return readUnderCap(response, target.href, maxBytes, signal);\n}\n\n/** On a cross-origin hop nothing the caller supplied travels on — only the identifying User-Agent. */\nfunction stripSensitiveHeaders(headers: Record<string, string>): Record<string, string> {\n  const kept: Record<string, string> = {};\n  for (const [name, value] of Object.entries(headers)) {\n    if (name.toLowerCase() === 'user-agent') kept[name] = value;\n  }\n  return kept;\n}\n\nasync function readUnderCap(\n  response: Response,\n  finalUrl: string,\n  maxBytes: number,\n  signal: AbortSignal,\n): Promise<TEgressFetchResult> {\n  const tooLarge = (seen: number): TEgressFetchResult => ({\n    ok: false,\n    rejection: {\n      reason: 'response_too_large',\n      url: finalUrl,\n      message: `Response exceeds ${maxBytes} bytes (${seen} seen).`,\n    },\n  });\n  const declared = Number(response.headers.get('content-length'));\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    await response.body?.cancel();\n    return tooLarge(declared);\n  }\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  if (!response.body && typeof response.arrayBuffer === 'function') {\n    // A carrier with no readable stream (a body-less Response, or a non-streaming fetch\n    // implementation) can only be read whole; the cap is then checked on what it handed over.\n    const whole = new Uint8Array(await response.arrayBuffer());\n    if (whole.byteLength > maxBytes) return tooLarge(whole.byteLength);\n    chunks.push(whole);\n    total = whole.byteLength;\n  } else if (response.body) {\n    const reader = response.body.getReader();\n    for (;;) {\n      signal.throwIfAborted();\n      const { done, value } = await reader.read();\n      if (done) break;\n      total += value.byteLength;\n      if (total > maxBytes) {\n        await reader.cancel();\n        return tooLarge(total);\n      }\n      chunks.push(value);\n    }\n  }\n  const body = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return {\n    ok: true,\n    status: response.status,\n    statusText: response.statusText,\n    headers: response.headers,\n    body,\n    finalUrl,\n  };\n}\n"],"mappings":"0cA2BA,SAAgB,EAA4B,EAAwB,CAClE,GAAI,OAAO,GAAU,SACnB,MAAU,UAAU,gCAAgC,EAEtD,GAAI,EAAM,KAAK,CAAC,CAAC,SAAW,EAC1B,MAAU,UAAU,0CAA0C,EAEhE,GAAI,CAAC,EAAW,CAAK,EACnB,MAAU,UAAU,wCAAwC,EAG9D,IAAI,EACJ,GAAI,CACF,EAAgB,EAAa,CAAK,CACpC,MAAQ,CACN,MAAU,UAAU,0DAA0D,CAChF,CACA,GAAI,CAAC,EAAS,CAAa,CAAC,CAAC,YAAY,EACvC,MAAU,UAAU,qCAAqC,EAE3D,GAAI,CACF,EAAW,EAAe,EAAU,KAAO,EAAU,IAAI,CAC3D,MAAQ,CACN,MAAU,UAAU,0DAA0D,CAChF,CACA,OAAO,CACT,CAUA,SAAgB,EAAiB,EAAmB,CAClD,IAAM,EAAiB,CAAC,EACpB,EAAU,EAAQ,CAAC,EACvB,OACE,GAAI,CACF,OAAO,EAAK,EAAa,CAAO,EAAG,GAAG,CAAI,CAC5C,MAAQ,CACN,IAAM,EAAS,EAAQ,CAAO,EAG9B,GAAI,IAAW,EAAS,OAAO,EAAQ,CAAC,EACxC,EAAK,QAAQ,EAAS,CAAO,CAAC,EAC9B,EAAU,CACZ,CAEJ,CASA,SAAgB,EAAa,EAAc,EAA4B,CACrE,IAAM,EAAgB,EAAiB,CAAI,EACrC,EAAqB,EAAiB,CAAS,EACrD,OAAO,IAAuB,GAAiB,EAAmB,WAAW,EAAgB,CAAG,CAClG,CCrCA,MAAa,EAAuB,IAEvB,EAA4B,IAMzC,IAAa,EAAb,cAAwC,KAAM,CAC5C,YAAY,EAAiB,CAC3B,MAAM,CAAO,EACb,KAAK,KAAO,oBACd,CACF,EAQA,SAAgB,EACd,EAAmB,QAAQ,SACG,CAC9B,OAAO,IAAa,QAAU,cAAgB,YAChD,CAiCA,SAAS,EAAiB,EAAc,EAA0B,CAChE,IAAMA,EAAWC,EAAa,EAAM,CAAM,EAC1C,GAAID,EAAS,WAAW,IAAI,GAAK,EAAWA,CAAQ,EAClD,MAAM,IAAI,EACR,cAAc,EAAK,yBAAyB,EAAO,iDACrD,EAEF,IAAM,EAAQA,EAAS,MAAM,CAAG,CAAC,CAAC,OAAQ,GAAS,EAAK,OAAS,CAAC,EAC5D,EAAkB,CAAC,CAAI,EACzB,EAAU,EACd,IAAK,IAAM,KAAQ,EACjB,EAAU,EAAK,EAAS,CAAI,EAC5B,EAAM,KAAK,CAAO,EAEpB,OAAO,CACT,CAEA,SAAS,EAAgB,EAAgB,EAA4B,EAAmB,CAAC,EAAS,CAChG,GAAI,EAAmB,IAAM,aAAc,OAC3C,IAAM,GAAQ,EAAG,WAAc,GAAiB,EAAS,CAAI,CAAC,CAAC,KAAO,MAAA,CAAS,CAAM,EACrF,GAAK,EAAO,GACV,MAAM,IAAI,EACR,GAAG,EAAK,GAAG,EAAO,YAAY,EAAK,SAAS,CAAC,EAAE,mHAEjD,CAEJ,CAQA,SAAgB,EACd,EACA,EAAmC,CAAC,EAC9B,CACN,IAAM,EACJ,EAAQ,iBACN,EAAgB,IAAuB,CACvC,EAAU,EAAQ,CAAE,UAAW,GAAM,MAAK,CAAC,CAC7C,GACI,EACJ,EAAQ,WAAa,EAAgB,IAAuB,EAAU,EAAQ,CAAI,GACpF,EAAc,EAAA,GAAoC,EAGlD,IAAM,EACJ,EAAQ,aAAe,IAAA,GACnB,CAAC,CAAS,EACV,EAAiB,EAAQ,WAAY,CAAS,EACpD,IAAK,IAAM,KAAU,EACf,EAAmB,IAAM,cAAc,EAAQ,EAAA,GAAiC,EACpF,EAAgB,EAAQ,YAAa,CAAO,CAEhD,CAUA,SAAgB,EAAmB,EAAkB,EAAuB,CAC1E,EAAyB,EAAQ,CAAQ,CAAC,EAC1C,IAAM,EAAgB,GAAG,EAAS,GAAG,QAAQ,IAAI,MAUjD,EAAO,EAAe,CAAE,MAAO,EAAK,CAAC,EAMrC,EAAc,EAAe,EAAS,CACpC,SAAU,OACV,KAAA,IACA,KAAM,IACR,CAAC,EACD,GAAI,CACF,EAAgB,EAAe,MAAM,EACrC,EAAW,EAAe,CAAQ,CACpC,OAAS,EAAO,CACd,GAAI,CACF,EAAW,CAAa,CAC1B,MAAQ,CAER,CACA,MAAM,CACR,CACA,EAAgB,EAAU,MAAM,CAClC,CAQA,SAAgB,EAAoB,EAAwB,CAC1D,GAAI,EAAmB,IAAM,aAAc,OAC3C,IAAI,EACJ,GAAI,CACF,EAAO,EAAS,CAAQ,CAAC,CAAC,KAAO,IACnC,MAAQ,CACN,MACF,CACK,EAAO,KACZ,EAAU,EAAA,GAA8B,EACxC,EAAgB,EAAU,MAAM,EAClC,CC9MA,SAAgB,EAAiB,EAAqB,CACpD,IAAM,EAAU,EAAK,CAAE,EAGvB,OAFI,IAAY,EAAsB,EAAc,EAAG,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,EACzE,IAAY,GAAsB,EAAc,CAAE,CAExD,CAEA,SAAS,EAAc,EAA+B,CACpD,GAAM,CAAC,EAAI,EAAG,EAAI,EAAG,EAAI,GAAK,EAC9B,OACE,IAAM,GACN,IAAM,IACN,IAAM,KACL,IAAM,KAAO,GAAK,IAAM,GAAK,KAC7B,IAAM,KAAO,IAAM,KACnB,IAAM,KAAO,GAAK,IAAM,GAAK,IAC7B,IAAM,KAAO,IAAM,GAAK,IAAM,GAC9B,IAAM,KAAO,IAAM,KACnB,IAAM,MAAQ,IAAM,IAAM,IAAM,KACjC,GAAK,GAET,CAEA,SAAS,EAAc,EAAqB,CAC1C,IAAM,EAAS,EAAW,CAAE,EAC5B,GAAI,IAAW,IAAA,GAAW,MAAO,GACjC,GAAM,CAAC,EAAK,EAAG,EAAK,EAAG,EAAK,EAAG,EAAK,EAAG,EAAK,EAAG,EAAK,EAAG,EAAK,EAAG,EAAK,GAAK,EAczE,OAbiB,IAAO,GAAK,IAAO,GAAK,IAAO,GAAK,IAAO,GAAK,IAAO,GAAK,IAAO,OACpE,IAAO,KAAQ,IAAO,OAAU,IAAO,GAAK,IAAO,GAAK,IAAO,GAAK,IAAO,EAElF,EAAc,CAAC,GAAM,EAAG,EAAK,IAAM,GAAM,EAAG,EAAK,GAAI,CAAC,EAK3D,IAAO,GAAK,IAAO,GAAK,IAAO,GAAK,IAAO,GAAK,IAAO,GAAK,IAAO,IAClE,EAAK,QAAY,QACjB,EAAK,QAAY,QACjB,EAAK,QAAY,QACjB,EAAK,QAAY,KAExB,CAWA,SAAS,EAAsB,EAAgC,CAC7D,IAAM,EAAY,EAAG,YAAY,GAAG,EAC9B,EAAO,EAAG,MAAM,EAAY,CAAC,EACnC,GAAI,CAAC,EAAK,SAAS,GAAG,EAAG,OAAO,EAChC,GAAI,EAAY,GAAK,EAAK,CAAI,IAAM,EAAe,OACnD,GAAM,CAAC,EAAI,EAAG,EAAI,EAAG,EAAI,EAAG,EAAI,GAAK,EAAK,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,EACzD,GAAS,GAAK,EAAc,EAAA,CAAG,SAAS,EAAS,EACjD,GAAQ,GAAK,EAAc,EAAA,CAAG,SAAS,EAAS,EACtD,MAAO,GAAG,EAAG,MAAM,EAAG,EAAY,CAAC,IAAI,EAAK,GAAG,GACjD,CAGA,SAAS,EAAW,EAAkC,CAEpD,IAAM,EAAc,EADH,EAAG,MAAM,GAAG,CAAC,CAAC,IAAM,CACa,EAClD,GAAI,IAAgB,IAAA,GAAW,OAC/B,IAAM,EAAS,EAAY,MAAM,IAAI,EACrC,GAAI,EAAO,OAAS,EAAG,OACvB,IAAM,EAAS,GACb,EAAK,SAAW,EAAI,CAAC,EAAI,EAAK,MAAM,GAAG,CAAC,CAAC,IAAK,GAAM,OAAO,SAAS,EAAG,EAAE,CAAC,EACtE,EAAO,EAAM,EAAO,IAAM,EAAE,EAC5B,EAAO,EAAO,SAAW,EAAI,EAAM,EAAO,IAAM,EAAE,EAAI,CAAC,EACvD,EAAU,EAAI,EAAK,OAAS,EAAK,OACvC,GAAI,EAAU,GAAM,EAAO,SAAW,GAAK,IAAY,EAAI,OAC3D,IAAM,EAAS,CAAC,GAAG,EAAM,GAAO,MAAc,CAAO,CAAC,CAAC,KAAK,CAAC,EAAG,GAAG,CAAI,EACvE,OAAO,EAAO,KAAM,GAAM,OAAO,MAAM,CAAC,GAAK,EAAI,GAAK,EAAI,KAAM,EAAI,IAAA,GAAY,CAClF,CCjBA,MAAM,EAAqB,IACrB,EAA6B,IAE7B,EAAoB,IAAI,IAAI,CAAC,IAAK,IAAK,IAAK,IAAK,GAAG,CAAC,EAM9C,EAAyC,IAAI,IAAI,CAC5D,YACA,WACA,2BACA,gBACA,gBACA,4BACF,CAAC,EAEK,EAA+B,KAAO,KACzC,MAAME,EAAU,EAAU,CAAE,IAAK,GAAM,SAAU,EAAK,CAAC,EAAA,CAAG,IAAK,GAAU,EAAM,OAAO,EAGzF,eAAsB,EACpB,EACA,EAAwB,CAAC,EACzB,EAAwB,EACe,CACvC,IAAM,EAAO,EAAI,KACjB,GAAI,EAAI,WAAa,SAAW,EAAI,WAAa,SAC/C,MAAO,CACL,OAAQ,qBACR,IAAK,EACL,QAAS,mCACX,EAEF,GAAI,EAAO,wBAA0B,GAAM,OAC3C,IAAM,EAAW,EAAI,SAAS,QAAQ,WAAY,EAAE,CAAC,CAAC,YAAY,EAClE,GAAI,EAAO,cAAc,SAAS,CAAQ,EAAG,OAC7C,GAAI,EAAkB,IAAI,CAAQ,GAAK,EAAS,SAAS,YAAY,EACnE,MAAO,CACL,OAAQ,gBACR,IAAK,EACL,QAAS,gBAAgB,EAAS,wEACpC,EAEF,IAAM,EAAY,EAAK,CAAQ,EAAI,CAAC,CAAQ,EAAI,MAAMC,EAAQ,EAAU,CAAM,EAC9E,GAAI,IAAc,IAAA,IAAa,EAAU,SAAW,EAClD,MAAO,CACL,OAAQ,eACR,IAAK,EACL,QAAS,gBAAgB,EAAS,mBACpC,EAEF,IAAM,EAAU,EAAU,KAAK,CAAgB,EAC/C,GAAI,IAAY,IAAA,GACd,MAAO,CACL,OAAQ,sBACR,IAAK,EACL,QAAS,gBAAgB,EAAS,gBAAgB,EAAQ,8EAC5D,CAGJ,CAEA,eAAeA,EACb,EACA,EACwC,CACxC,GAAI,CACF,OAAO,MAAM,EAAO,CAAQ,CAC9B,MAAQ,CAGN,MACF,CACF,CAOA,eAAsB,EACpB,EACA,EAA+B,CAAC,EAChC,EAAwB,CAAC,EACzB,EAAoB,CAAC,EACQ,CAC7B,IAAM,EAAU,EAAK,SAAW,EAAO,IAAS,WAAW,MAAM,EAAO,CAAI,GACtE,EAAS,EAAK,QAAU,EACxB,EAAW,EAAQ,kBAAoB,EACvC,EAAe,EAAO,cAAgB,EACtC,EAAW,YAAY,QAAQ,EAAQ,WAAa,CAAkB,EACtE,EAAS,EAAQ,OAAS,YAAY,IAAI,CAAC,EAAU,EAAQ,MAAM,CAAC,EAAI,EAE1E,EAAU,IAAI,IAAI,CAAG,EACrB,EAAkC,CAAE,GAAI,EAAQ,SAAW,CAAC,CAAG,EACnE,IAAK,IAAI,EAAM,GAAK,GAAO,EAAG,CAC5B,IAAM,EAAY,MAAM,EAAkB,EAAS,EAAQ,CAAM,EACjE,GAAI,IAAc,IAAA,GAAW,MAAO,CAAE,GAAI,GAAO,WAAU,EAE3D,IAAM,EAAW,MAAM,EAAQ,EAAQ,KAAM,CAAE,UAAS,SAAQ,SAAU,QAAS,CAAC,EACpF,GAAI,CAAC,EAAkB,IAAI,EAAS,MAAM,EACxC,OAAO,EAAa,EAAU,EAAQ,KAAM,EAAU,CAAM,EAE9D,IAAM,EAAW,EAAS,QAAQ,IAAI,UAAU,EAChD,GAAI,IAAa,KACf,MAAO,CACL,GAAI,GACJ,UAAW,CACT,OAAQ,4BACR,IAAK,EAAQ,KACb,QAAS,QAAQ,EAAS,OAAO,4BACnC,CACF,EAEF,GAAI,GAAO,EACT,MAAO,CACL,GAAI,GACJ,UAAW,CACT,OAAQ,iBACR,IAAK,EAAQ,KACb,QAAS,aAAa,EAAa,YACrC,CACF,EAEF,IAAM,EAAO,IAAI,IAAI,EAAU,CAAO,EAClC,EAAK,SAAW,EAAQ,SAAQ,EAAU,EAAsB,CAAO,GAC3E,EAAU,CACZ,CACF,CAWA,eAAsB,EACpB,EACA,EACA,EAAwB,CAAC,EACzB,EAAoB,CAAC,EACQ,CAC7B,IAAM,EAAU,EAAK,SAAW,EAAO,IAAS,WAAW,MAAM,EAAO,CAAI,GACtE,EAAW,EAAQ,kBAAoB,EACvC,EAAW,YAAY,QAAQ,EAAQ,WAAa,CAAkB,EACtE,EAAS,EAAQ,OAAS,YAAY,IAAI,CAAC,EAAU,EAAQ,MAAM,CAAC,EAAI,EACxE,EAAS,IAAI,IAAI,CAAG,EACpB,EAAY,MAAM,EAAkB,EAAQ,EAAQ,EAAK,QAAU,CAAa,EACtF,GAAI,IAAc,IAAA,GAAW,MAAO,CAAE,GAAI,GAAO,WAAU,EAC3D,IAAM,EAAW,MAAM,EAAQ,EAAO,KAAM,CAC1C,OAAQ,OACR,QAAS,CAAE,GAAI,EAAQ,SAAW,CAAC,CAAG,EACtC,KAAM,EAAQ,KACd,SACA,SAAU,QACZ,CAAC,EAYD,OAXI,EAAS,QAAU,KAAO,EAAS,OAAS,KAC9C,MAAM,EAAS,MAAM,OAAO,CAAC,CAAC,UAAY,IAAA,EAAS,EAC5C,CACL,GAAI,GACJ,UAAW,CACT,OAAQ,mBACR,IAAK,EAAO,KACZ,QAAS,QAAQ,EAAS,OAAO,8BACnC,CACF,GAEK,EAAa,EAAU,EAAO,KAAM,EAAU,CAAM,CAC7D,CAGA,SAAS,EAAsB,EAAyD,CACtF,IAAM,EAA+B,CAAC,EACtC,IAAK,GAAM,CAAC,EAAM,KAAU,OAAO,QAAQ,CAAO,EAC5C,EAAK,YAAY,IAAM,eAAc,EAAK,GAAQ,GAExD,OAAO,CACT,CAEA,eAAe,EACb,EACA,EACA,EACA,EAC6B,CAC7B,IAAM,EAAY,IAAsC,CACtD,GAAI,GACJ,UAAW,CACT,OAAQ,qBACR,IAAK,EACL,QAAS,oBAAoB,EAAS,UAAU,EAAK,QACvD,CACF,GACM,EAAW,OAAO,EAAS,QAAQ,IAAI,gBAAgB,CAAC,EAC9D,GAAI,OAAO,SAAS,CAAQ,GAAK,EAAW,EAE1C,OADA,MAAM,EAAS,MAAM,OAAO,EACrB,EAAS,CAAQ,EAE1B,IAAM,EAAuB,CAAC,EAC1B,EAAQ,EACZ,GAAI,CAAC,EAAS,MAAQ,OAAO,EAAS,aAAgB,WAAY,CAGhE,IAAM,EAAQ,IAAI,WAAW,MAAM,EAAS,YAAY,CAAC,EACzD,GAAI,EAAM,WAAa,EAAU,OAAO,EAAS,EAAM,UAAU,EACjE,EAAO,KAAK,CAAK,EACjB,EAAQ,EAAM,UAChB,MAAO,GAAI,EAAS,KAAM,CACxB,IAAM,EAAS,EAAS,KAAK,UAAU,EACvC,OAAS,CACP,EAAO,eAAe,EACtB,GAAM,CAAE,OAAM,SAAU,MAAM,EAAO,KAAK,EAC1C,GAAI,EAAM,MAEV,GADA,GAAS,EAAM,WACX,EAAQ,EAEV,OADA,MAAM,EAAO,OAAO,EACb,EAAS,CAAK,EAEvB,EAAO,KAAK,CAAK,CACnB,CACF,CACA,IAAM,EAAO,IAAI,WAAW,CAAK,EAC7B,EAAS,EACb,IAAK,IAAM,KAAS,EAClB,EAAK,IAAI,EAAO,CAAM,EACtB,GAAU,EAAM,WAElB,MAAO,CACL,GAAI,GACJ,OAAQ,EAAS,OACjB,WAAY,EAAS,WACrB,QAAS,EAAS,QAClB,OACA,UACF,CACF"}