@safebrowse/daemon 0.1.3 → 0.1.5

package/dist/modelGuard.js

@@ -0,0 +1,325 @@
+const SUPPORTED_FEATURE_SCHEMA_VERSIONS = new Set(["recipe_v1", "v1"]);
+const DECISION_LABELS = new Set([
+    "allow_read_only",
+    "require_shadow_replay",
+    "require_user_approval",
+    "deny"
+]);
+const ENFORCEMENT_MODES = new Set(["off", "shadow", "tighten"]);
+const MAX_REASON_CODES = 32;
+const MAX_EVIDENCE_CHUNKS = 12;
+const MAX_EVIDENCE_EXCERPT_CHARS = 1_000;
+function normalizeBaseUrl(value) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    let end = trimmed.length;
+    while (end > 0 && trimmed.charCodeAt(end - 1) === 47) {
+        end -= 1;
+    }
+    return trimmed.slice(0, end);
+}
+function defaultHealthSnapshot(configured, enforcementMode, validationError) {
+    return {
+        configured,
+        ready: false,
+        runtimeMode: "python_sidecar",
+        enforcementMode,
+        ...(validationError ? { validationError } : {})
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isFiniteProbability(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+function isFiniteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+function requiredString(value, field) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`invalid model guard ${field}`);
+    }
+    return value;
+}
+function optionalString(value, field) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return requiredString(value, field);
+}
+function validateFeatureSchemaVersion(value) {
+    const version = requiredString(value, "feature schema version");
+    if (!SUPPORTED_FEATURE_SCHEMA_VERSIONS.has(version)) {
+        throw new Error(`unsupported model guard feature schema version: ${version}`);
+    }
+    return version;
+}
+function validateComponentDigests(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isRecord(value)) {
+        throw new Error("invalid model guard component digests");
+    }
+    const digests = {};
+    for (const [key, digest] of Object.entries(value)) {
+        if (!/^[A-Za-z0-9_.:-]{1,80}$/.test(key)) {
+            throw new Error("invalid model guard component digest key");
+        }
+        if (typeof digest !== "string" || !/^[A-Fa-f0-9]{32,128}$/.test(digest)) {
+            throw new Error("invalid model guard component digest value");
+        }
+        digests[key] = digest;
+    }
+    return digests;
+}
+function validateReasonCodes(value) {
+    if (!Array.isArray(value) || value.length > MAX_REASON_CODES) {
+        throw new Error("invalid model guard reason codes");
+    }
+    return value.map((entry) => {
+        if (typeof entry !== "string" || !/^[A-Z0-9_:-]{1,128}$/.test(entry)) {
+            throw new Error("invalid model guard reason code");
+        }
+        return entry;
+    });
+}
+function validateEvidenceChunkIds(value) {
+    if (!Array.isArray(value) || value.length > MAX_EVIDENCE_CHUNKS) {
+        throw new Error("invalid model guard evidence chunk ids");
+    }
+    return value.map((entry) => {
+        if (typeof entry !== "string" || entry.trim().length === 0 || entry.length > 128) {
+            throw new Error("invalid model guard evidence chunk id");
+        }
+        return entry;
+    });
+}
+function validateEvidenceChunks(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value) || value.length > MAX_EVIDENCE_CHUNKS) {
+        throw new Error("invalid model guard evidence chunks");
+    }
+    return value.map((entry) => {
+        if (!isRecord(entry)) {
+            throw new Error("invalid model guard evidence chunk");
+        }
+        const chunkId = requiredString(entry.chunkId, "evidence chunk id");
+        const excerpt = requiredString(entry.excerpt, "evidence chunk excerpt").slice(0, MAX_EVIDENCE_EXCERPT_CHARS);
+        if (entry.score !== undefined && !isFiniteNumber(entry.score)) {
+            throw new Error("invalid model guard evidence chunk score");
+        }
+        return {
+            chunkId,
+            ...(typeof entry.score === "number" ? { score: entry.score } : {}),
+            excerpt
+        };
+    });
+}
+function validateHealthPayload(payload) {
+    if (!isRecord(payload)) {
+        throw new Error("invalid model guard health payload");
+    }
+    if (payload.status !== "ok" && payload.status !== "error") {
+        throw new Error("invalid model guard health status");
+    }
+    if (typeof payload.ready !== "boolean") {
+        throw new Error("invalid model guard health ready flag");
+    }
+    if (payload.runtimeMode !== "python_sidecar") {
+        throw new Error("invalid model guard runtime mode");
+    }
+    if (!ENFORCEMENT_MODES.has(payload.enforcementMode)) {
+        throw new Error("invalid model guard health enforcement mode");
+    }
+    const ready = payload.status === "ok" && payload.ready;
+    const bundleVersion = optionalString(payload.bundleVersion, "bundle version");
+    const featureSchemaVersion = ready
+        ? validateFeatureSchemaVersion(payload.featureSchemaVersion)
+        : optionalString(payload.featureSchemaVersion, "feature schema version");
+    const bundleDigest = optionalString(payload.bundleDigest, "bundle digest");
+    const componentDigests = validateComponentDigests(payload.componentDigests);
+    return {
+        status: payload.status,
+        ready,
+        runtimeMode: "python_sidecar",
+        enforcementMode: payload.enforcementMode,
+        ...(bundleVersion ? { bundleVersion } : {}),
+        ...(featureSchemaVersion ? { featureSchemaVersion } : {}),
+        ...(bundleDigest ? { bundleDigest } : {}),
+        ...(componentDigests ? { componentDigests } : {})
+    };
+}
+function validateObservationResponsePayload(payload, health, enforcementMode) {
+    if (!isRecord(payload) || !isRecord(payload.assessment)) {
+        throw new Error("invalid model guard observation response");
+    }
+    const assessment = payload.assessment;
+    const decisionLabel = assessment.decisionLabel;
+    const calibratedDecisionLabel = assessment.calibratedDecisionLabel;
+    if (!DECISION_LABELS.has(decisionLabel)) {
+        throw new Error("invalid model guard decision label");
+    }
+    if (!DECISION_LABELS.has(calibratedDecisionLabel)) {
+        throw new Error("invalid model guard calibrated decision label");
+    }
+    if (!isFiniteProbability(assessment.binaryThreatProbability)) {
+        throw new Error("invalid model guard probability");
+    }
+    if (!isRecord(assessment.pipeline)) {
+        throw new Error("invalid model guard pipeline metadata");
+    }
+    const pipeline = assessment.pipeline;
+    if (pipeline.runtimeMode !== "python_sidecar") {
+        throw new Error("invalid model guard assessment runtime mode");
+    }
+    if (typeof pipeline.scoredAt !== "string" || pipeline.scoredAt.trim().length === 0) {
+        throw new Error("invalid model guard scored timestamp");
+    }
+    const bundleVersion = requiredString(assessment.bundleVersion, "bundle version");
+    const featureSchemaVersion = validateFeatureSchemaVersion(assessment.featureSchemaVersion);
+    if (health.bundleVersion && health.bundleVersion !== bundleVersion) {
+        throw new Error("model guard bundle version changed after health check");
+    }
+    if (health.featureSchemaVersion && health.featureSchemaVersion !== featureSchemaVersion) {
+        throw new Error("model guard feature schema version changed after health check");
+    }
+    const bundleDigest = optionalString(assessment.bundleDigest, "bundle digest") ?? health.bundleDigest;
+    const componentDigests = validateComponentDigests(assessment.componentDigests) ?? health.componentDigests;
+    const evidenceChunks = validateEvidenceChunks(payload.evidenceChunks);
+    return {
+        assessment: {
+            assessmentId: requiredString(assessment.assessmentId, "assessment id"),
+            bundleVersion,
+            featureSchemaVersion,
+            ...(bundleDigest ? { bundleDigest } : {}),
+            ...(componentDigests ? { componentDigests } : {}),
+            binaryThreatProbability: assessment.binaryThreatProbability,
+            decisionLabel: decisionLabel,
+            calibratedDecisionLabel: calibratedDecisionLabel,
+            coarseReasonCodes: validateReasonCodes(assessment.coarseReasonCodes),
+            evidenceChunkIds: validateEvidenceChunkIds(assessment.evidenceChunkIds),
+            pipeline: {
+                runtimeMode: "python_sidecar",
+                enforcementMode,
+                scoredAt: pipeline.scoredAt,
+                ...(typeof pipeline.latencyMs === "number" && Number.isFinite(pipeline.latencyMs)
+                    ? { latencyMs: pipeline.latencyMs }
+                    : {}),
+                ...(typeof pipeline.sentinelVersion === "string"
+                    ? { sentinelVersion: pipeline.sentinelVersion }
+                    : {}),
+                ...(typeof pipeline.expertVersion === "string"
+                    ? { expertVersion: pipeline.expertVersion }
+                    : {}),
+                ...(typeof pipeline.stackerVersion === "string"
+                    ? { stackerVersion: pipeline.stackerVersion }
+                    : {})
+            }
+        },
+        ...(evidenceChunks ? { evidenceChunks } : {})
+    };
+}
+class DisabledModelGuardClient {
+    enforcementMode;
+    configured = false;
+    constructor(enforcementMode = "off") {
+        this.enforcementMode = enforcementMode;
+    }
+    async scoreObservation() {
+        throw new Error("model guard is not configured");
+    }
+    async getCachedHealth() {
+        return defaultHealthSnapshot(false, this.enforcementMode);
+    }
+    async refreshHealth() {
+        return defaultHealthSnapshot(false, this.enforcementMode);
+    }
+    async close() {
+        return;
+    }
+}
+class HttpModelGuardClient {
+    baseUrl;
+    timeoutMs;
+    enforcementMode;
+    configured = true;
+    cachedHealth;
+    constructor(baseUrl, timeoutMs, enforcementMode) {
+        this.baseUrl = baseUrl;
+        this.timeoutMs = timeoutMs;
+        this.enforcementMode = enforcementMode;
+        this.cachedHealth = defaultHealthSnapshot(true, enforcementMode);
+    }
+    async scoreObservation(request) {
+        if (this.enforcementMode === "off") {
+            throw new Error("model guard scoring is disabled");
+        }
+        if (!this.cachedHealth.ready) {
+            throw new Error("model guard is not ready");
+        }
+        const response = await fetch(`${this.baseUrl}/v1/score/observation`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json"
+            },
+            body: JSON.stringify(request),
+            signal: AbortSignal.timeout(this.timeoutMs)
+        });
+        if (!response.ok) {
+            throw new Error(`model guard returned ${response.status}`);
+        }
+        return validateObservationResponsePayload(await response.json(), this.cachedHealth, this.enforcementMode);
+    }
+    async getCachedHealth() {
+        return this.cachedHealth;
+    }
+    async refreshHealth() {
+        try {
+            const response = await fetch(`${this.baseUrl}/health`, {
+                method: "GET",
+                signal: AbortSignal.timeout(this.timeoutMs)
+            });
+            if (!response.ok) {
+                throw new Error(`model guard returned ${response.status}`);
+            }
+            const payload = validateHealthPayload(await response.json());
+            this.cachedHealth = {
+                configured: true,
+                ready: payload.ready,
+                runtimeMode: payload.runtimeMode,
+                enforcementMode: this.enforcementMode,
+                bundleVersion: payload.bundleVersion,
+                featureSchemaVersion: payload.featureSchemaVersion,
+                bundleDigest: payload.bundleDigest,
+                componentDigests: payload.componentDigests,
+                lastCheckedAt: new Date().toISOString()
+            };
+        }
+        catch (error) {
+            this.cachedHealth = {
+                ...defaultHealthSnapshot(true, this.enforcementMode, error instanceof Error ? error.message : "model guard health check failed"),
+                lastCheckedAt: new Date().toISOString()
+            };
+        }
+        return this.cachedHealth;
+    }
+    async close() {
+        return;
+    }
+}
+export function createModelGuardClient(options = {}) {
+    const baseUrl = normalizeBaseUrl(options.baseUrl);
+    const enforcementMode = options.enforcementMode ?? "off";
+    const timeoutMs = options.timeoutMs ?? 2_500;
+    if (!baseUrl) {
+        return new DisabledModelGuardClient(enforcementMode);
+    }
+    return new HttpModelGuardClient(baseUrl, timeoutMs, enforcementMode);
+}
+//# sourceMappingURL=modelGuard.js.map

package/dist/modelGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelGuard.js","sourceRoot":"","sources":["../src/modelGuard.ts"],"names":[],"mappings":"AASA,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AACvE,MAAM,eAAe,GAAG,IAAI,GAAG,CAA0B;IACvD,iBAAiB;IACjB,uBAAuB;IACvB,uBAAuB;IACvB,MAAM;CACP,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAA4B,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3F,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,0BAA0B,GAAG,KAAK,CAAC;AA8BzC,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACrD,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAAmB,EACnB,eAA0C,EAC1C,eAAwB;IAExB,OAAO;QACL,UAAU;QACV,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,gBAAgB;QAC7B,eAAe;QACf,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAChE,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAC3E,CAAC,EACD,0BAA0B,CAC3B,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO;YACL,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,gBAAgB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,eAA4C,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC9E,MAAM,oBAAoB,GAAG,KAAK;QAChC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC5D,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE5E,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK;QACL,WAAW,EAAE,gBAAgB;QAC7B,eAAe,EAAE,OAAO,CAAC,eAA4C;QACrE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAgC,EAChC,eAA0C;IAE1C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAC/C,MAAM,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAwC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,uBAAkD,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACrC,IAAI,QAAQ,CAAC,WAAW,KAAK,gBAAgB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACjF,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,oBAAoB,KAAK,oBAAoB,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC;IACrG,MAAM,gBAAgB,GACpB,wBAAwB,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC;IACnF,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAEtE,OAAO;QACL,UAAU,EAAE;YACV,YAAY,EAAE,cAAc,CAAC,UAAU,CAAC,YAAY,EAAE,eAAe,CAAC;YACtE,aAAa;YACb,oBAAoB;YACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;YAC3D,aAAa,EAAE,aAAwC;YACvD,uBAAuB,EAAE,uBAAkD;YAC3E,iBAAiB,EAAE,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACpE,gBAAgB,EAAE,wBAAwB,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACvE,QAAQ,EAAE;gBACR,WAAW,EAAE,gBAAgB;gBAC7B,eAAe;gBACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,GAAG,CAAC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC/E,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;oBAC9C,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ;oBAC5C,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ;oBAC7C,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,wBAAwB;IAGP;IAFZ,UAAU,GAAG,KAAK,CAAC;IAE5B,YAAqB,kBAA6C,KAAK;QAAlD,oBAAe,GAAf,eAAe,CAAmC;IAAG,CAAC;IAE3E,KAAK,CAAC,gBAAgB;QACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO;IACT,CAAC;CACF;AAED,MAAM,oBAAoB;IAML;IACA;IACR;IAPF,UAAU,GAAG,IAAI,CAAC;IAEnB,YAAY,CAA2B;IAE/C,YACmB,OAAe,EACf,SAAiB,EACzB,eAA0C;QAFlC,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAQ;QACzB,oBAAe,GAAf,eAAe,CAA2B;QAEnD,IAAI,CAAC,YAAY,GAAG,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAqC;QAC1D,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,kCAAkC,CACvC,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,EAAE;gBACrD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,YAAY,GAAG;gBAClB,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAClD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,GAAG;gBAClB,GAAG,qBAAqB,CACtB,IAAI,EACJ,IAAI,CAAC,eAAe,EACpB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,CAC3E;gBACD,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACxC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO;IACT,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC"}

package/dist/parserIsolation.d.ts

@@ -1,12 +1,46 @@
-import type { CompiledObservation, ParserWorkerProbe, RuntimeContext, StructuredPlannerInput, SurfaceCapture } from "@safebrowse/core";
+import type { CompiledObservationV6, ParserIsolationMode, ParserWorkerProbe, PlannerViewV6, RuntimeContext, SurfaceCapture } from "@safebrowse/core";
+type ToolManifestDigests = {
+    manifestHash?: string;
+    schemaHash?: string;
+};
+export interface ParserIsolationProbeSnapshot {
+    probe: ParserWorkerProbe;
+    lastCheckedAt: string;
+}
+export interface ParserIsolationService {
+    compileObservation(input: {
+        capture: SurfaceCapture;
+        workflowHash?: string;
+        allowlistedEgress?: string[];
+        runtime?: Partial<RuntimeContext>;
+        compilerVersion?: "v6";
+        parserIsolationMode?: ParserIsolationMode;
+    }): Promise<{
+        compiledObservation: CompiledObservationV6;
+        plannerView?: PlannerViewV6;
+        toolManifestDigests?: ToolManifestDigests;
+    }>;
+    getCachedProbe(): Promise<ParserIsolationProbeSnapshot>;
+    refreshProbe(): Promise<ParserIsolationProbeSnapshot>;
+    close(): Promise<void>;
+}
+interface ParserIsolationServiceOptions {
+    allowlistedEgress?: string[];
+    runtime?: Partial<RuntimeContext>;
+}
+export declare function createParserIsolationService(parserIsolationMode?: ParserIsolationMode, options?: ParserIsolationServiceOptions): ParserIsolationService;
 export declare function compileObservationInIsolation(input: {
     capture: SurfaceCapture;
     workflowHash?: string;
     allowlistedEgress?: string[];
     runtime?: Partial<RuntimeContext>;
+    compilerVersion?: "v6";
+    parserIsolationMode?: ParserIsolationMode;
 }): Promise<{
-    compiledObservation: CompiledObservation;
-    plannerInput: StructuredPlannerInput;
+    compiledObservation: CompiledObservationV6;
+    plannerView?: PlannerViewV6;
+    toolManifestDigests?: ToolManifestDigests;
 }>;
-export declare function probeParserIsolation(): Promise<ParserWorkerProbe>;
+export declare function probeParserIsolation(parserIsolationMode?: ParserIsolationMode): Promise<ParserWorkerProbe>;
+export {};
 //# sourceMappingURL=parserIsolation.d.ts.map

package/dist/parserIsolation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parserIsolation.d.ts","sourceRoot":"","sources":["../src/parserIsolation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACf,MAAM,kBAAkB,CAAC;AAwE1B,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC,GAAG,OAAO,CAAC;IACV,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,sBAAsB,CAAC;CACtC,CAAC,CAQD;AAED,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAIjE"}
+{"version":3,"file":"parserIsolation.d.ts","sourceRoot":"","sources":["../src/parserIsolation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,cAAc,EACf,MAAM,kBAAkB,CAAC;AAgC1B,KAAK,mBAAmB,GAAG;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAmBF,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,iBAAiB,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,cAAc,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAClC,eAAe,CAAC,EAAE,IAAI,CAAC;QACvB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;KAC3C,GAAG,OAAO,CAAC;QACV,mBAAmB,EAAE,qBAAqB,CAAC;QAC3C,WAAW,CAAC,EAAE,aAAa,CAAC;QAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;KAC3C,CAAC,CAAC;IACH,cAAc,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACxD,YAAY,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,6BAA6B;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC;AAoPD,wBAAgB,4BAA4B,CAC1C,mBAAmB,GAAE,mBAAwC,EAC7D,OAAO,GAAE,6BAAkC,GAC1C,sBAAsB,CAExB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClC,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,OAAO,CAAC;IACV,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC,CAMD;AAED,wBAAgB,oBAAoB,CAClC,mBAAmB,GAAE,mBAAwC,GAC5D,OAAO,CAAC,iBAAiB,CAAC,CAI5B"}

package/dist/parserIsolation.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
 import { fork } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -6,52 +7,201 @@ const moduleDir = dirname(fileURLToPath(import.meta.url));
 const compiledWorkerPath = resolve(moduleDir, "parserWorker.js");
 const sourceWorkerPath = resolve(moduleDir, "parserWorker.ts");
 const workerPath = existsSync(compiledWorkerPath) ? compiledWorkerPath : sourceWorkerPath;
-function runWorker(payload) {
-    return new Promise((resolvePromise, rejectPromise) => {
-        const child = fork(workerPath, [], {
-            env: {},
-            stdio: ["ignore", "ignore", "ignore", "ipc"],
-            execArgv: workerPath.endsWith(".ts")
-                ? [...process.execArgv, "--import", "tsx"]
-                : process.execArgv
+function parserReadRoots() {
+    return [...new Set([resolve(process.cwd()), resolve(dirname(workerPath), "..", "..")])];
+}
+function buildExecArgv(mode) {
+    const baseArgs = workerPath.endsWith(".ts")
+        ? mode === "node_permission_process"
+            ? ["--experimental-strip-types"]
+            : ["--import", "tsx"]
+        : [];
+    if (mode !== "node_permission_process") {
+        return baseArgs;
+    }
+    return [
+        "--permission",
+        ...parserReadRoots().map((root) => `--allow-fs-read=${root}`),
+        ...baseArgs
+    ];
+}
+class ParserIsolationServiceImpl {
+    mode;
+    options;
+    child;
+    closed = false;
+    cachedProbe;
+    startup;
+    pending = new Map();
+    constructor(mode, options = {}) {
+        this.mode = mode;
+        this.options = options;
+    }
+    async compileObservation(input) {
+        const result = await this.sendRequest({
+            kind: "parse",
+            compilerVersion: input.compilerVersion,
+            parserIsolationMode: input.parserIsolationMode ?? this.mode,
+            capture: input.capture,
+            workflowHash: input.workflowHash,
+            allowlistedEgress: input.allowlistedEgress ?? this.options.allowlistedEgress,
+            runtime: input.runtime ?? this.options.runtime
         });
-        const finish = (error, value) => {
-            child.removeAllListeners();
-            child.kill();
-            if (error) {
-                rejectPromise(error);
-                return;
-            }
-            resolvePromise(value);
+        return result;
+    }
+    async getCachedProbe() {
+        if (this.cachedProbe) {
+            return this.cachedProbe;
+        }
+        return this.refreshProbe();
+    }
+    async refreshProbe() {
+        const probe = await this.sendRequest({
+            kind: "probe"
+        });
+        this.cachedProbe = {
+            probe,
+            lastCheckedAt: new Date().toISOString()
         };
-        child.once("error", (error) => finish(error));
-        child.once("message", (message) => {
-            if (!message.ok) {
-                finish(new Error(message.error));
-                return;
+        return this.cachedProbe;
+    }
+    async close() {
+        this.closed = true;
+        this.cachedProbe = undefined;
+        const pendingError = new Error("parser isolation service closed");
+        for (const [requestId, pending] of this.pending.entries()) {
+            this.pending.delete(requestId);
+            pending.reject(pendingError);
+        }
+        this.startup = undefined;
+        const child = this.child;
+        this.child = undefined;
+        if (!child) {
+            return;
+        }
+        await new Promise((resolvePromise) => {
+            child.once("close", () => resolvePromise());
+            child.kill();
+        });
+    }
+    async ensureWorker() {
+        if (this.closed) {
+            throw new Error("parser isolation service closed");
+        }
+        if (this.child?.connected) {
+            return;
+        }
+        if (this.startup) {
+            return this.startup;
+        }
+        this.startup = (async () => {
+            const child = fork(workerPath, [], {
+                env: workerPath.endsWith(".ts") && this.mode !== "node_permission_process"
+                    ? { TSX_DISABLE_CACHE: "1" }
+                    : {},
+                stdio: ["ignore", "ignore", "ignore", "ipc"],
+                execArgv: buildExecArgv(this.mode)
+            });
+            child.unref();
+            child.on("message", (message) => this.handleMessage(message));
+            child.on("error", (error) => this.handleWorkerFailure(error));
+            child.on("exit", (code, signal) => {
+                const suffix = signal ? ` (${signal})` : "";
+                this.handleWorkerFailure(code && code !== 0 ? new Error(`parser worker exited with code ${code}${suffix}`) : undefined);
+            });
+            this.child = child;
+            if (this.options.allowlistedEgress || this.options.runtime) {
+                await this.sendRequest({
+                    kind: "configure",
+                    parserIsolationMode: this.mode,
+                    allowlistedEgress: this.options.allowlistedEgress,
+                    runtime: this.options.runtime
+                });
             }
-            finish(undefined, (message.probe ?? message.result));
+        })().finally(() => {
+            this.startup = undefined;
         });
-        child.once("exit", (code) => {
-            if (code && code !== 0) {
-                finish(new Error(`parser worker exited with code ${code}`));
+        return this.startup;
+    }
+    handleMessage(message) {
+        if (!message || typeof message !== "object" || !("requestId" in message)) {
+            return;
+        }
+        const response = message;
+        const pending = this.pending.get(response.requestId);
+        if (!pending) {
+            return;
+        }
+        this.pending.delete(response.requestId);
+        if (!response.ok) {
+            pending.reject(new Error(response.error));
+            return;
+        }
+        pending.resolve((response.probe ?? response.result));
+    }
+    handleWorkerFailure(error) {
+        this.cachedProbe = undefined;
+        const child = this.child;
+        this.child = undefined;
+        if (child) {
+            child.removeAllListeners();
+        }
+        if (this.closed && this.pending.size === 0) {
+            return;
+        }
+        const failure = error ?? new Error("parser worker exited unexpectedly");
+        for (const [requestId, pending] of this.pending.entries()) {
+            this.pending.delete(requestId);
+            pending.reject(failure);
+        }
+    }
+    async sendRequest(payload) {
+        await this.ensureWorker();
+        const child = this.child;
+        if (!child?.connected) {
+            throw new Error("parser worker is not connected");
+        }
+        return new Promise((resolvePromise, rejectPromise) => {
+            const requestId = randomUUID();
+            this.pending.set(requestId, {
+                resolve: (value) => resolvePromise(value),
+                reject: rejectPromise
+            });
+            try {
+                child.send({
+                    requestId,
+                    payload
+                });
+            }
+            catch (error) {
+                this.pending.delete(requestId);
+                rejectPromise(error instanceof Error ? error : new Error(String(error)));
             }
         });
-        child.send(payload);
-    });
+    }
+}
+const defaultServices = new Map();
+function defaultServiceForMode(mode) {
+    let service = defaultServices.get(mode);
+    if (!service) {
+        service = createParserIsolationService(mode);
+        defaultServices.set(mode, service);
+    }
+    return service;
+}
+export function createParserIsolationService(parserIsolationMode = "scrubbed_process", options = {}) {
+    return new ParserIsolationServiceImpl(parserIsolationMode, options);
 }
 export function compileObservationInIsolation(input) {
-    return runWorker({
-        kind: "parse",
-        capture: input.capture,
-        workflowHash: input.workflowHash,
-        allowlistedEgress: input.allowlistedEgress,
-        runtime: input.runtime
+    const mode = input.parserIsolationMode ?? "scrubbed_process";
+    return defaultServiceForMode(mode).compileObservation({
+        ...input,
+        parserIsolationMode: mode
     });
 }
-export function probeParserIsolation() {
-    return runWorker({
-        kind: "probe"
-    });
+export function probeParserIsolation(parserIsolationMode = "scrubbed_process") {
+    return defaultServiceForMode(parserIsolationMode)
+        .refreshProbe()
+        .then((snapshot) => snapshot.probe);
 }
 //# sourceMappingURL=parserIsolation.js.map