@safebrowse/daemon 0.1.3 → 0.1.4

package/dist/parserWorker.js

@@ -1,4 +1,6 @@
+import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
+import os from "node:os";
 import process from "node:process";
 const require = createRequire(import.meta.url);
 function denyNetwork(message = "Parser worker egress denied") {
@@ -41,46 +43,124 @@ async function probeIsolation() {
     catch {
         egressDenied = true;
     }
+    const permissionModelEnabled = Boolean(process.permission);
+    const fsReadRestricted = permissionModelEnabled
+        ? !process.permission.has("fs.read", os.tmpdir()) && !process.permission.has("fs.read", os.homedir())
+        : false;
     return {
+        mode: permissionModelEnabled ? "node_permission_process" : "scrubbed_process",
         envKeys: Object.keys(process.env),
         egressDenied,
-        processIsolated: true
+        processIsolated: true,
+        permissionModelEnabled,
+        fsReadRestricted,
+        childProcessDenied: permissionModelEnabled ? !process.permission.has("child") : false,
+        workerThreadsDenied: permissionModelEnabled ? !process.permission.has("worker") : false
     };
 }
 lockDownEnvironment();
-async function loadCoreRuntime() {
-    if (import.meta.url.endsWith(".ts")) {
-        const sourceEntryUrl = new URL("../../core/src/index.ts", import.meta.url).href;
-        return import(sourceEntryUrl);
+let cachedProbePromise;
+let cachedCoreRuntimePromise;
+let workerRuntimeDefaults;
+let workerAllowlistedEgress = [];
+let workerParserIsolationMode;
+async function getCachedProbe() {
+    if (!cachedProbePromise) {
+        cachedProbePromise = probeIsolation();
     }
-    return import("@safebrowse/core");
+    return cachedProbePromise;
+}
+async function loadCoreRuntime(parserIsolationMode) {
+    if (cachedCoreRuntimePromise) {
+        return cachedCoreRuntimePromise;
+    }
+    cachedCoreRuntimePromise = (async () => {
+        if (import.meta.url.endsWith(".ts")) {
+            if (parserIsolationMode === "node_permission_process") {
+                const distEntryUrl = new URL("../../core/dist/index.js", import.meta.url);
+                if (existsSync(distEntryUrl)) {
+                    return import(distEntryUrl.href);
+                }
+                throw new Error("secure profile parser worker requires a built @safebrowse/core dist runtime");
+            }
+            const sourceEntryUrl = new URL("../../core/src/index.ts", import.meta.url).href;
+            return import(sourceEntryUrl);
+        }
+        return import("@safebrowse/core");
+    })();
+    return cachedCoreRuntimePromise;
+}
+function sendResponse(requestId, message) {
+    process.send?.({
+        requestId,
+        ...message
+    });
 }
 process.on("message", async (message) => {
     try {
-        const { compileObservation } = await loadCoreRuntime();
-        if (message.kind === "probe") {
-            process.send?.({
+        const payload = message.payload;
+        if (payload.kind === "configure") {
+            workerRuntimeDefaults = payload.runtime;
+            workerAllowlistedEgress = payload.allowlistedEgress ?? [];
+            workerParserIsolationMode = payload.parserIsolationMode;
+            await loadCoreRuntime(workerParserIsolationMode);
+            sendResponse(message.requestId, {
+                ok: true
+            });
+            return;
+        }
+        if (payload.kind === "probe") {
+            sendResponse(message.requestId, {
                 ok: true,
-                probe: await probeIsolation()
+                probe: await getCachedProbe()
             });
             return;
         }
-        const result = compileObservation(message.capture, message.runtime ?? {}, {
-            workflowHash: message.workflowHash,
+        const parserIsolationMode = payload.parserIsolationMode ??
+            workerParserIsolationMode ??
+            (await getCachedProbe()).mode;
+        const { compileObservation, compileObservationV5, computeToolManifestHash, computeToolSchemaHash } = await loadCoreRuntime(parserIsolationMode);
+        const compiler = payload.compilerVersion === "v5" ? compileObservationV5 : compileObservation;
+        const probe = await getCachedProbe();
+        const runtime = payload.runtime ?? workerRuntimeDefaults ?? {};
+        const allowlistedEgress = payload.allowlistedEgress ?? workerAllowlistedEgress;
+        const result = compiler(payload.capture, runtime, {
+            workflowHash: payload.workflowHash,
             parserIsolation: {
-                processIsolated: true,
-                secretAccess: false,
-                arbitraryEgress: false,
-                allowlistedEgress: message.allowlistedEgress ?? []
+                mode: probe.mode,
+                processIsolated: probe.processIsolated,
+                envScrubbed: probe.envKeys.length === 0,
+                egressDenied: probe.egressDenied,
+                permissionModelEnabled: probe.permissionModelEnabled,
+                fsReadRestricted: probe.fsReadRestricted,
+                childProcessDenied: probe.childProcessDenied,
+                workerThreadsDenied: probe.workerThreadsDenied,
+                envKeys: probe.envKeys,
+                allowlistedEgress
             }
         });
-        process.send?.({
+        const toolManifestDigests = payload.capture.surfaceType === "tool_manifest"
+            ? {
+                manifestHash: computeToolManifestHash({
+                    toolId: payload.capture.toolId,
+                    description: payload.capture.description,
+                    authType: payload.capture.authType,
+                    requestedScopes: payload.capture.requestedScopes,
+                    callbackUri: payload.capture.callbackUri
+                }),
+                schemaHash: computeToolSchemaHash(payload.capture.schemaDescriptions)
+            }
+            : undefined;
+        sendResponse(message.requestId, {
             ok: true,
-            result
+            result: {
+                ...result,
+                toolManifestDigests
+            }
         });
     }
     catch (error) {
-        process.send?.({
+        sendResponse(message.requestId, {
             ok: false,
             error: error instanceof Error ? error.message : String(error)
         });

package/dist/parserWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"parserWorker.js","sourceRoot":"","sources":["../src/parserWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,OAAO,MAAM,cAAc,CAAC;AAInC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,SAAS,WAAW,CAAC,OAAO,GAAG,6BAA6B;IAC1D,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;IAClB,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC;IACnB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC9B,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACpB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IACtB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAEtB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,WAAW,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc;IAK3B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,YAAY;QACZ,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,mBAAmB,EAAE,CAAC;AAEtB,KAAK,UAAU,eAAe;IAG5B,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAChF,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACpC,CAAC;AAcD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,OAA4B,EAAE,EAAE;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAEvD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,EAAE,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM,cAAc,EAAE;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE;YACxE,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,eAAe,EAAE;gBACf,eAAe,EAAE,IAAI;gBACrB,YAAY,EAAE,KAAK;gBACnB,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;aACnD;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,EAAE,EAAE,IAAI;YACR,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"parserWorker.js","sourceRoot":"","sources":["../src/parserWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,OAAO,MAAM,cAAc,CAAC;AAInC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,SAAS,WAAW,CAAC,OAAO,GAAG,6BAA6B;IAC1D,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;IAClB,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC;IACnB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC9B,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACpB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IACtB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;IAEtB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,WAAW,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc;IAU3B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,sBAAsB;QAC7C,CAAC,CAAC,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QACvG,CAAC,CAAC,KAAK,CAAC;IACV,OAAO;QACL,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB;QAC7E,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,YAAY;QACZ,eAAe,EAAE,IAAI;QACrB,sBAAsB;QACtB,gBAAgB;QAChB,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK;QACtF,mBAAmB,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK;KACzF,CAAC;AACJ,CAAC;AAED,mBAAmB,EAAE,CAAC;AAEtB,IAAI,kBAAmF,CAAC;AACxF,IAAI,wBAOS,CAAC;AACd,IAAI,qBAA0D,CAAC;AAC/D,IAAI,uBAAuB,GAAa,EAAE,CAAC;AAC3C,IAAI,yBAAqF,CAAC;AAE1F,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kBAAkB,GAAG,cAAc,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,mBAAoE;IAOpE,IAAI,wBAAwB,EAAE,CAAC;QAC7B,OAAO,wBAAwB,CAAC;IAClC,CAAC;IAED,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,mBAAmB,KAAK,yBAAyB,EAAE,CAAC;gBACtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1E,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7B,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAChF,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpC,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,wBAAwB,CAAC;AAClC,CAAC;AA+BD,SAAS,YAAY,CACnB,SAAiB,EACjB,OAiBK;IAEL,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,SAAS;QACT,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,OAA4B,EAAE,EAAE;IAC3D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;YACxC,uBAAuB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC1D,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;YACxD,MAAM,eAAe,CAAC,yBAAyB,CAAC,CAAC;YACjD,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC9B,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC9B,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM,cAAc,EAAE;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB;YAC3B,yBAAyB;YACzB,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC;QAChC,MAAM,EACJ,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACtB,GACC,MAAM,eAAe,CAAC,mBAAmB,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,qBAAqB,IAAI,EAAE,CAAC;QAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,uBAAuB,CAAC;QAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE;YAChD,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,eAAe,EAAE;gBACf,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBACvC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,iBAAiB;aAClB;SACF,CAAC,CAAC;QACH,MAAM,mBAAmB,GACvB,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,eAAe;YAC7C,CAAC,CAAC;gBACE,YAAY,EAAE,uBAAuB,CAAC;oBACpC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;oBAC9B,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;oBACxC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;oBAClC,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;oBAChD,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;iBACzC,CAAC;gBACF,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC;aACtE;YACH,CAAC,CAAC,SAAS,CAAC;QAEhB,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;YAC9B,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,GAAG,MAAM;gBACT,mBAAmB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;YAC9B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/runtime/config/auditor/v5_secure_claim_suite.json

@@ -0,0 +1,70 @@
+{
+  "suite_id": "safebrowse-v5-secure-claim-suite",
+  "claim_profile": "secure_v5",
+  "cases": [
+    {
+      "id": "V5-01",
+      "title": "Hidden anchor on first observation does not mint capability",
+      "kind": "hidden_html",
+      "html": "<main>Visible docs only.</main><div hidden><a href=\"https://docs.python.org/3/tutorial/\">continuity path</a></div>",
+      "visible_text": "Visible docs only.",
+      "expected": {
+        "decision": "BLOCK_OR_FACTS_ONLY",
+        "capabilities": []
+      }
+    },
+    {
+      "id": "V5-02",
+      "title": "Visible allowlisted anchor mints one navigate capability",
+      "kind": "visible_navigation",
+      "html": "<main>Visible docs only.</main><a href=\"https://docs.python.org/3/tutorial/\">Docs</a>",
+      "visible_text": "Visible docs only. Docs",
+      "expected": {
+        "decision": "ALLOW",
+        "capabilities": ["navigate"]
+      }
+    },
+    {
+      "id": "V5-03",
+      "title": "Visible navigate capability cannot authorize connector onboarding",
+      "kind": "navigate_cannot_issue_connector_approval",
+      "html": "<main>Visible docs only.</main><a href=\"https://docs.python.org/3/tutorial/\">Docs</a>",
+      "visible_text": "Visible docs only. Docs",
+      "expected": {
+        "decision": "BLOCK"
+      }
+    },
+    {
+      "id": "V5-04",
+      "title": "Unsigned broker approval is rejected",
+      "kind": "unsigned_connector_approval",
+      "expected": {
+        "decision": "BLOCK"
+      }
+    },
+    {
+      "id": "V5-05",
+      "title": "Signed connector approval prepares onboarding",
+      "kind": "signed_connector_prepare",
+      "expected": {
+        "decision": "ALLOW"
+      }
+    },
+    {
+      "id": "V5-06",
+      "title": "Callback mismatch is rejected",
+      "kind": "callback_mismatch",
+      "expected": {
+        "decision": "BLOCK"
+      }
+    },
+    {
+      "id": "V5-07",
+      "title": "Secure profile disables legacy routes",
+      "kind": "legacy_route_disabled",
+      "expected": {
+        "decision": "BLOCK"
+      }
+    }
+  ]
+}

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 import { type Server } from "node:http";
-import { type KnowledgeBaseContext, type PolicyPack } from "@safebrowse/core";
+import { type KnowledgeBaseContext, type ParserIsolationMode, type PolicyPack } from "@safebrowse/core";
 import type { VerifiedRegistryBundle } from "@safebrowse/core";
 export interface SafeBrowseDaemonOptions {
     host?: string;
@@ -9,6 +9,11 @@ export interface SafeBrowseDaemonOptions {
     knowledgeBase?: KnowledgeBaseContext;
     verifiedRegistry?: VerifiedRegistryBundle;
     parserAllowlistedEgress?: string[];
+    parserIsolationMode?: ParserIsolationMode;
+    deploymentProfile?: "development" | "secure_v5" | "secure_v6";
+    approvalBrokerPublicKeyPath?: string;
+    approvalBrokerPublicKeyPem?: string;
+    approvalBrokerMode?: "signature_verification" | "external_service";
 }
 export declare function createSafeBrowseServer(options?: SafeBrowseDaemonOptions): Promise<Server>;
 export declare function startSafeBrowseDaemon(options?: SafeBrowseDaemonOptions): Promise<Server>;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EA4BL,KAAK,oBAAoB,EAKzB,KAAK,UAAU,EAShB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,KAAK,EAAE,sBAAsB,EAAyB,MAAM,kBAAkB,CAAC;AAEtF,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAgYD,wBAAsB,sBAAsB,CAC1C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CA+fjB;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAWjB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAiDL,KAAK,oBAAoB,EAazB,KAAK,mBAAmB,EAExB,KAAK,UAAU,EAWhB,MAAM,kBAAkB,CAAC;AAW1B,OAAO,KAAK,EAAE,sBAAsB,EAAyB,MAAM,kBAAkB,CAAC;AAEtF,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,iBAAiB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,WAAW,CAAC;IAC9D,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kBAAkB,CAAC,EAAE,wBAAwB,GAAG,kBAAkB,CAAC;CACpE;AAg3BD,wBAAsB,sBAAsB,CAC1C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAooEjB;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAWjB"}