@straiffi/archon 1.8.20 → 1.8.22

package/dist/server/lib/consequentialActions.js

@@ -0,0 +1,231 @@
+import { createHash } from 'node:crypto';
+import { normalizeCheckDefinitions } from './checkDefinitions.js';
+export const CONSEQUENTIAL_ACTION_SCHEMA_VERSION = 1;
+export const MAX_CONSEQUENTIAL_ACTION_BYTES = 64 * 1024;
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+const GIT_OBJECT_ID_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+const LOGICAL_REFERENCE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/@-]*$/;
+const boundedString = (value, name, maxBytes) => {
+    const normalized = value.trim();
+    if (normalized.length === 0 || Buffer.byteLength(normalized, 'utf8') > maxBytes) {
+        throw new Error(`${name} must contain between 1 and ${maxBytes} bytes`);
+    }
+    return normalized;
+};
+const boundedExactString = (value, name, maxBytes) => {
+    if (value.length === 0 || value.includes('\0') || Buffer.byteLength(value, 'utf8') > maxBytes) {
+        throw new Error(`${name} must contain between 1 and ${maxBytes} bytes without null characters`);
+    }
+    return value;
+};
+const fingerprint = (value, name) => {
+    const normalized = boundedString(value, name, 64);
+    if (!SHA256_PATTERN.test(normalized)) {
+        throw new Error(`${name} must be a lowercase SHA-256 fingerprint`);
+    }
+    return normalized;
+};
+const gitObjectId = (value, name) => {
+    const normalized = boundedString(value, name, 64);
+    if (!GIT_OBJECT_ID_PATTERN.test(normalized)) {
+        throw new Error(`${name} must be a lowercase Git object ID`);
+    }
+    return normalized;
+};
+const sortedUnique = (values, name, maxEntries) => {
+    if (values.length > maxEntries) {
+        throw new Error(`${name} may contain at most ${maxEntries} entries`);
+    }
+    const normalized = [...new Set(values.map(value => boundedString(value, name, 200)))].sort();
+    if (normalized.some(value => !LOGICAL_REFERENCE_PATTERN.test(value))) {
+        throw new Error(`${name} contains an invalid logical reference`);
+    }
+    return normalized;
+};
+const uniqueBounded = (values, name, maxEntries, maxBytes) => {
+    if (values.length > maxEntries) {
+        throw new Error(`${name} may contain at most ${maxEntries} entries`);
+    }
+    return [...new Set(values.map(value => boundedString(value, name, maxBytes)))];
+};
+const normalizeCommon = (action) => {
+    const environmentFields = [
+        action.authority.environment_id,
+        action.authority.environment_revision,
+        action.authority.environment_validation_fingerprint,
+    ];
+    if (environmentFields.some(value => value !== null) && environmentFields.some(value => value === null)) {
+        throw new Error('Consequential action environment authority must be wholly present or absent');
+    }
+    if (action.authority.environment_revision !== null
+        && (!Number.isSafeInteger(action.authority.environment_revision) || action.authority.environment_revision < 1)) {
+        throw new Error('Consequential action environment revision must be a positive integer');
+    }
+    if (!Number.isSafeInteger(action.authority.execution_profile_revision) || action.authority.execution_profile_revision < 0) {
+        throw new Error('Consequential action execution profile revision must be a non-negative integer');
+    }
+    if (!['governed', 'legacy_host'].includes(action.authority.execution_profile_compatibility)) {
+        throw new Error('Consequential action execution profile compatibility is invalid');
+    }
+    return {
+        schema_version: CONSEQUENTIAL_ACTION_SCHEMA_VERSION,
+        workspace_git: {
+            workspace_path: boundedExactString(action.workspace_git.workspace_path, 'Workspace path', 4096),
+            branch: action.workspace_git.branch === null
+                ? null
+                : boundedString(action.workspace_git.branch, 'Git branch', 500),
+            head_sha: gitObjectId(action.workspace_git.head_sha, 'Git HEAD'),
+            remote_head_sha: action.workspace_git.remote_head_sha === null
+                ? null
+                : gitObjectId(action.workspace_git.remote_head_sha, 'Remote Git HEAD'),
+            state_fingerprint: fingerprint(action.workspace_git.state_fingerprint, 'Workspace Git state fingerprint'),
+        },
+        authority: {
+            execution_profile_revision_id: boundedString(action.authority.execution_profile_revision_id, 'Execution profile revision ID', 128),
+            execution_profile_revision: action.authority.execution_profile_revision,
+            execution_profile_fingerprint: fingerprint(action.authority.execution_profile_fingerprint, 'Execution profile fingerprint'),
+            execution_profile_compatibility: action.authority.execution_profile_compatibility,
+            effective_capabilities: sortedUnique(action.authority.effective_capabilities, 'Effective capability', 64),
+            environment_id: action.authority.environment_id === null
+                ? null
+                : boundedString(action.authority.environment_id, 'Environment ID', 128),
+            environment_revision: action.authority.environment_revision,
+            environment_validation_fingerprint: action.authority.environment_validation_fingerprint === null
+                ? null
+                : fingerprint(action.authority.environment_validation_fingerprint, 'Environment validation fingerprint'),
+        },
+        logical_secret_references: sortedUnique(action.logical_secret_references, 'Logical secret reference', 64),
+    };
+};
+export const normalizeConsequentialAction = (action) => {
+    if (action.schema_version !== CONSEQUENTIAL_ACTION_SCHEMA_VERSION) {
+        throw new Error(`Unsupported consequential action schema version: ${String(action.schema_version)}`);
+    }
+    const common = normalizeCommon(action);
+    let normalized;
+    if (action.kind === 'git_push') {
+        if (typeof action.target.force !== 'boolean') {
+            throw new Error('Git push force classification must be boolean');
+        }
+        if (action.target.source_kind !== undefined && !['project', 'ticket'].includes(action.target.source_kind)) {
+            throw new Error('Unsupported Git push source kind');
+        }
+        if (action.target.target_kind !== undefined && !['repo_root', 'bundle', 'ticket'].includes(action.target.target_kind)) {
+            throw new Error('Unsupported Git push target kind');
+        }
+        if (action.target.expires_at !== undefined && !Number.isFinite(new Date(action.target.expires_at).getTime())) {
+            throw new Error('Git push approval expiry is invalid');
+        }
+        normalized = {
+            ...common,
+            kind: 'git_push',
+            target: {
+                remote_name: boundedString(action.target.remote_name, 'Git remote name', 200),
+                remote_url_fingerprint: fingerprint(action.target.remote_url_fingerprint, 'Git remote URL fingerprint'),
+                ref: boundedString(action.target.ref, 'Git target ref', 500),
+                force: action.target.force,
+                ...(action.target.project_id !== undefined
+                    ? { project_id: boundedString(action.target.project_id, 'Git push project ID', 128) }
+                    : {}),
+                ...(action.target.source_kind !== undefined ? { source_kind: action.target.source_kind } : {}),
+                ...(action.target.source_id !== undefined
+                    ? { source_id: boundedString(action.target.source_id, 'Git push source ID', 128) }
+                    : {}),
+                ...(action.target.target_kind !== undefined ? { target_kind: action.target.target_kind } : {}),
+                ...(action.target.bundle_id !== undefined
+                    ? { bundle_id: action.target.bundle_id === null ? null : boundedString(action.target.bundle_id, 'Git push bundle ID', 128) }
+                    : {}),
+                ...(action.target.effective_git_authority !== undefined
+                    ? { effective_git_authority: boundedString(action.target.effective_git_authority, 'Effective Git authority', 200) }
+                    : {}),
+                ...(action.target.capabilities !== undefined
+                    ? { capabilities: sortedUnique(action.target.capabilities, 'Git push capability', 64) }
+                    : {}),
+                ...(action.target.degradations !== undefined
+                    ? { degradations: uniqueBounded(action.target.degradations, 'Git push degradation', 64, 200).sort() }
+                    : {}),
+                ...(action.target.expires_at !== undefined
+                    ? { expires_at: new Date(action.target.expires_at).toISOString() }
+                    : {}),
+            },
+        };
+    }
+    else if (action.kind === 'custom_check') {
+        if (!['project', 'bundle', 'ticket'].includes(action.target.scope_kind)) {
+            throw new Error('Unsupported custom check scope kind');
+        }
+        if (!['production', 'non_production'].includes(action.target.environment_classification)) {
+            throw new Error('Unsupported custom check environment classification');
+        }
+        const definitionResult = action.target.definition_snapshot
+            ? normalizeCheckDefinitions([action.target.definition_snapshot], { allowOversizedIds: true })
+            : null;
+        if (definitionResult && 'error' in definitionResult) {
+            throw new Error(`Custom check definition snapshot is invalid: ${definitionResult.error}`);
+        }
+        if (action.target.expires_at !== undefined && !Number.isFinite(new Date(action.target.expires_at).getTime())) {
+            throw new Error('Custom check approval expiry is invalid');
+        }
+        if (action.target.target_workspace_identity && (!SHA256_PATTERN.test(action.target.target_workspace_identity.fingerprint)
+            || !GIT_OBJECT_ID_PATTERN.test(action.target.target_workspace_identity.head))) {
+            throw new Error('Custom check target workspace identity is invalid');
+        }
+        const selectedDefinitionIds = action.target.selected_definition_ids
+            ? uniqueBounded(action.target.selected_definition_ids, 'Selected check definition ID', 128, 500)
+            : undefined;
+        normalized = {
+            ...common,
+            kind: 'custom_check',
+            target: {
+                check_definition_id: boundedString(action.target.check_definition_id, 'Check definition ID', 500),
+                check_definition_fingerprint: fingerprint(action.target.check_definition_fingerprint, 'Check definition fingerprint'),
+                scope_kind: action.target.scope_kind,
+                scope_id: boundedString(action.target.scope_id, 'Check scope ID', 128),
+                environment_classification: action.target.environment_classification,
+                ...(definitionResult && 'value' in definitionResult
+                    ? { definition_snapshot: definitionResult.value[0] }
+                    : {}),
+                ...(action.target.effective_command !== undefined
+                    ? { effective_command: boundedExactString(action.target.effective_command, 'Effective check command', 16 * 1024) }
+                    : {}),
+                ...(action.target.effective_cwd !== undefined
+                    ? { effective_cwd: boundedExactString(action.target.effective_cwd, 'Effective check working directory', 4096) }
+                    : {}),
+                ...(selectedDefinitionIds ? { selected_definition_ids: selectedDefinitionIds } : {}),
+                ...(action.target.target_workspace_identity
+                    ? { target_workspace_identity: action.target.target_workspace_identity }
+                    : {}),
+                ...(action.target.automation_lineage ? {
+                    automation_lineage: {
+                        batch_run_id: boundedString(action.target.automation_lineage.batch_run_id, 'Check batch run ID', 128),
+                        parent_run_id: action.target.automation_lineage.parent_run_id === null
+                            ? null
+                            : boundedString(action.target.automation_lineage.parent_run_id, 'Automation parent run ID', 128),
+                        boundary_purpose: action.target.automation_lineage.boundary_purpose === null
+                            ? null
+                            : boundedString(action.target.automation_lineage.boundary_purpose, 'Automation boundary purpose', 100),
+                        depth: action.target.automation_lineage.depth,
+                        review_fix_enabled: action.target.automation_lineage.review_fix_enabled,
+                    },
+                } : {}),
+                ...(action.target.expires_at !== undefined
+                    ? { expires_at: new Date(action.target.expires_at).toISOString() }
+                    : {}),
+            },
+        };
+    }
+    else {
+        throw new Error('Unsupported consequential action kind');
+    }
+    const serialized = JSON.stringify(normalized);
+    if (Buffer.byteLength(serialized, 'utf8') > MAX_CONSEQUENTIAL_ACTION_BYTES) {
+        throw new Error('Consequential action snapshot exceeds the durable evidence limit');
+    }
+    return normalized;
+};
+export const serializeConsequentialAction = (action) => (JSON.stringify(normalizeConsequentialAction(action)));
+export const fingerprintConsequentialAction = (action) => createHash('sha256')
+    .update('archon-consequential-action-v1\0', 'utf8')
+    .update(serializeConsequentialAction(action), 'utf8')
+    .digest('hex');
+//# sourceMappingURL=consequentialActions.js.map

package/dist/server/lib/consequentialActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consequentialActions.js","sourceRoot":"","sources":["../../../server/lib/consequentialActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAMxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAU,CAAA;AAC7D,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD,MAAM,cAAc,GAAG,gBAAgB,CAAA;AACvC,MAAM,qBAAqB,GAAG,+BAA+B,CAAA;AAC7D,MAAM,yBAAyB,GAAG,iCAAiC,CAAA;AAEnE,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAE;IACtE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,+BAA+B,QAAQ,QAAQ,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAE;IAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,+BAA+B,QAAQ,gCAAgC,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACjD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oCAAoC,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,MAAyB,EAAE,IAAY,EAAE,UAAkB,EAAE,EAAE;IACnF,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,UAAU,UAAU,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5F,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,MAAyB,EAAE,IAAY,EAAE,UAAkB,EAAE,QAAgB,EAAE,EAAE;IACtG,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,UAAU,UAAU,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAChF,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,MAAmC,EAAE,EAAE;IAC9D,MAAM,iBAAiB,GAAG;QACxB,MAAM,CAAC,SAAS,CAAC,cAAc;QAC/B,MAAM,CAAC,SAAS,CAAC,oBAAoB;QACrC,MAAM,CAAC,SAAS,CAAC,kCAAkC;KACpD,CAAA;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAA;IAChG,CAAC;IACD,IACE,MAAM,CAAC,SAAS,CAAC,oBAAoB,KAAK,IAAI;WAC3C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,oBAAoB,GAAG,CAAC,CAAC,EAC9G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,0BAA0B,GAAG,CAAC,EAAE,CAAC;QAC1H,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,+BAA+B,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IAED,OAAO;QACL,cAAc,EAAE,mCAAmC;QACnD,aAAa,EAAE;YACb,cAAc,EAAE,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC;YAC/F,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI;gBAC1C,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC;YACjE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;YAChE,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,eAAe,KAAK,IAAI;gBAC5D,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC;YACxE,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;SAC1G;QACD,SAAS,EAAE;YACT,6BAA6B,EAAE,aAAa,CAC1C,MAAM,CAAC,SAAS,CAAC,6BAA6B,EAC9C,+BAA+B,EAC/B,GAAG,CACJ;YACD,0BAA0B,EAAE,MAAM,CAAC,SAAS,CAAC,0BAA0B;YACvE,6BAA6B,EAAE,WAAW,CACxC,MAAM,CAAC,SAAS,CAAC,6BAA6B,EAC9C,+BAA+B,CAChC;YACD,+BAA+B,EAAE,MAAM,CAAC,SAAS,CAAC,+BAA+B;YACjF,sBAAsB,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,EAAE,CAAC;YACzG,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI;gBACtD,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC;YACzE,oBAAoB,EAAE,MAAM,CAAC,SAAS,CAAC,oBAAoB;YAC3D,kCAAkC,EAAE,MAAM,CAAC,SAAS,CAAC,kCAAkC,KAAK,IAAI;gBAC9F,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC,EAAE,oCAAoC,CAAC;SAC3G;QACD,yBAAyB,EAAE,YAAY,CAAC,MAAM,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,EAAE,CAAC;KACjG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,MAAmC,EACN,EAAE;IAC/B,IAAI,MAAM,CAAC,cAAc,KAAK,mCAAmC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,UAAuF,CAAA;IAC3F,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,UAAU,GAAG;YACX,GAAG,MAAM;YACT,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,CAAC;gBAC7E,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC;gBACvG,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC;gBAC5D,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;gBAC1B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,EAAE,GAAG,CAAC,EAAE;oBACrF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,CAAC,EAAE;oBAClF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,CAAC,EAAE;oBAC5H,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS;oBACrD,CAAC,CAAC,EAAE,uBAAuB,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,EAAE,GAAG,CAAC,EAAE;oBACnH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE;oBACvF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACrG,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAA;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB;YACxD,CAAC,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YAC7F,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,gBAAgB,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,gDAAgD,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,yBAAyB,IAAI,CAC7C,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,WAAW,CAAC;eACtE,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAC7E,EAAE,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,uBAAuB;YACjE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,8BAA8B,EAAE,GAAG,EAAE,GAAG,CAAC;YAChG,CAAC,CAAC,SAAS,CAAA;QACb,UAAU,GAAG;YACX,GAAG,MAAM;YACT,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE;gBACN,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,GAAG,CAAC;gBACjG,4BAA4B,EAAE,WAAW,CACvC,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAC1C,8BAA8B,CAC/B;gBACD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;gBACpC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,CAAC;gBACtE,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B;gBACpE,GAAG,CAAC,gBAAgB,IAAI,OAAO,IAAI,gBAAgB;oBACjD,CAAC,CAAC,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAyC,EAAE;oBAC5F,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;oBAC/C,CAAC,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE;oBAClH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;oBAC3C,CAAC,CAAC,EAAE,aAAa,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,mCAAmC,EAAE,IAAI,CAAC,EAAE;oBAC/G,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB;oBACzC,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE;oBACxE,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;oBACrC,kBAAkB,EAAE;wBAClB,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,oBAAoB,EAAE,GAAG,CAAC;wBACrG,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,aAAa,KAAK,IAAI;4BACpE,CAAC,CAAC,IAAI;4BACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE,0BAA0B,EAAE,GAAG,CAAC;wBAClG,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,KAAK,IAAI;4BAC1E,CAAC,CAAC,IAAI;4BACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,GAAG,CAAC;wBACxG,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK;wBAC7C,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB;qBACxE;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,8BAA8B,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAmC,EAAE,EAAE,CAAC,CACnF,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CACrD,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,MAAmC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;KACxG,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC;KAClD,MAAM,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACpD,MAAM,CAAC,KAAK,CAAC,CAAA"}

package/dist/server/lib/dockerSandboxCredentials.js

@@ -12,23 +12,32 @@ const normalizeState = (value) => {
     return 'unknown';
 };
 const normalizeToken = (value) => value.replace(/^\(|\)$/g, '').trim();
+const SERVICE_TABLE_TERMINATOR = /^(?:custom secrets(?:\s|$)|SCOPE\s+TYPE\s+NAME\s+SECRET$)/i;
 export const parseSbxSecretList = (output) => {
-    const lines = output.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
-    if (lines.length === 0 || !SECRET_LIST_HEADER.test(lines[0] ?? '')) {
+    if (Buffer.byteLength(output, 'utf8') > 16 * 1024) {
+        throw new SbxContractFailure('secret list', 'sbx secret list exceeded the redacted inventory limit');
+    }
+    const lines = output.split(/\r?\n/).map(line => line.trim());
+    if (!SECRET_LIST_HEADER.test(lines[0] ?? '')) {
         throw new SbxContractFailure('secret list', 'sbx secret list returned an unrecognized table');
     }
-    return lines.slice(1).map(line => {
+    const credentials = [];
+    for (const line of lines.slice(1)) {
+        if (line === '' || SERVICE_TABLE_TERMINATOR.test(line)) {
+            break;
+        }
         const match = SECRET_LIST_ROW.exec(line);
         if (!match?.groups?.scope || !match.groups.type || !match.groups.service || !match.groups.state) {
             throw new SbxContractFailure('secret list', 'sbx secret list returned an unrecognized row');
         }
-        return {
+        credentials.push({
             scope: normalizeToken(match.groups.scope),
             type: match.groups.type,
             service: match.groups.service,
             state: normalizeState(match.groups.state),
-        };
-    });
+        });
+    }
+    return credentials;
 };
 export const listDockerSandboxCredentials = async (runner, options = {}) => {
     const result = await runner.run(['secret', 'list'], {
@@ -49,14 +58,59 @@ const isApplicableScope = (scope, sandboxName) => {
     return normalizedScope === 'global'
         || (sandboxName !== null && normalizedScope === sandboxName.trim().toLowerCase());
 };
-export const findDockerSandboxCredential = (provider, credentials, sandboxName = null) => {
+const classifyScope = (scope, sandboxName) => {
+    const normalizedScope = scope.replace(/^\(|\)$/g, '').trim().toLowerCase();
+    if (normalizedScope === 'global') {
+        return 'global';
+    }
+    return sandboxName !== null && normalizedScope === sandboxName.trim().toLowerCase()
+        ? 'exact_sandbox'
+        : 'unrelated';
+};
+export const observeDockerSandboxCredential = (provider, credentials, sandboxName = null) => {
     if (!provider || !credentials) {
         return null;
     }
     const aliases = serviceAliases(provider);
+    const applicable = credentials.filter(candidate => (candidate.type === 'service'
+        && aliases.has(candidate.service.trim().toLowerCase())
+        && isApplicableScope(candidate.scope, sandboxName)));
+    const exact = applicable.filter(candidate => classifyScope(candidate.scope, sandboxName) === 'exact_sandbox');
+    const preferred = exact.length > 0
+        ? exact
+        : applicable.filter(candidate => classifyScope(candidate.scope, sandboxName) === 'global');
+    if (preferred.length === 0) {
+        return null;
+    }
+    const states = new Set(preferred.map(candidate => candidate.state));
+    const services = new Set(preferred.map(candidate => candidate.service.trim().toLowerCase()));
+    if (states.size !== 1 || services.size !== 1) {
+        return {
+            acquisition: 'available',
+            scope: exact.length > 0 ? 'exact_sandbox' : 'global',
+            state: 'unknown',
+            service: provider.trim().toLowerCase(),
+        };
+    }
+    const credential = [...preferred].sort((left, right) => left.service.localeCompare(right.service))[0];
+    return {
+        acquisition: 'available',
+        scope: classifyScope(credential.scope, sandboxName),
+        state: credential.state,
+        service: credential.service,
+    };
+};
+export const findDockerSandboxCredential = (provider, credentials, sandboxName = null) => {
+    if (!provider || !credentials) {
+        return null;
+    }
+    const observation = observeDockerSandboxCredential(provider, credentials, sandboxName);
+    if (!observation || observation.state === 'unknown') {
+        return null;
+    }
     return credentials.find(credential => (credential.type === 'service'
-        && credential.state !== 'unknown'
-        && isApplicableScope(credential.scope, sandboxName)
-        && aliases.has(credential.service.trim().toLowerCase()))) ?? null;
+        && credential.service === observation.service
+        && credential.state === observation.state
+        && classifyScope(credential.scope, sandboxName) === observation.scope)) ?? null;
 };
 //# sourceMappingURL=dockerSandboxCredentials.js.map

package/dist/server/lib/dockerSandboxCredentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"dockerSandboxCredentials.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAGnB,MAAM,wCAAwC,CAAA;AAS/C,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAC5D,MAAM,eAAe,GAAG,iGAAiG,CAAA;AAEzH,MAAM,cAAc,GAAG,CAAC,KAAa,EAAoC,EAAE;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7C,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAsC,EAAE;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,gDAAgD,CAAC,CAAA;IAC/F,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAChG,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAA;QAC7F,CAAC;QACD,OAAO;YACL,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACzC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;SAC1C,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAC/C,MAAwB,EACxB,UAA6B,EAAE,EACc,EAAE;IAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QAClD,GAAG,OAAO;QACV,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC;KACzE,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,aAAa,EACb,oCAAoC,MAAM,CAAC,QAAQ,EAAE,CACtD,CAAA;IACH,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,EAAE;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,OAAO,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAE,WAA0B,EAAE,EAAE;IACtE,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC1E,OAAO,eAAe,KAAK,QAAQ;WAC9B,CAAC,WAAW,KAAK,IAAI,IAAI,eAAe,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AACrF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAuB,EACvB,WAA2D,EAC3D,cAA6B,IAAI,EACjC,EAAE;IACF,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACxC,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CACpC,UAAU,CAAC,IAAI,KAAK,SAAS;WAC1B,UAAU,CAAC,KAAK,KAAK,SAAS;WAC9B,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC;WAChD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CACxD,CAAC,IAAI,IAAI,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"dockerSandboxCredentials.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAGnB,MAAM,wCAAwC,CAAA;AAgB/C,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAC5D,MAAM,eAAe,GAAG,iGAAiG,CAAA;AAEzH,MAAM,cAAc,GAAG,CAAC,KAAa,EAAoC,EAAE;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7C,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;AAE9E,MAAM,wBAAwB,GAAG,4DAA4D,CAAA;AAE7F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAsC,EAAE;IACvF,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,gDAAgD,CAAC,CAAA;IAC/F,CAAC;IAED,MAAM,WAAW,GAA8B,EAAE,CAAA;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,EAAE,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAK;QACP,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAChG,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAA;QAC7F,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACzC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;SAC1C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAC/C,MAAwB,EACxB,UAA6B,EAAE,EACc,EAAE;IAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QAClD,GAAG,OAAO;QACV,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC;KACzE,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,aAAa,EACb,oCAAoC,MAAM,CAAC,QAAQ,EAAE,CACtD,CAAA;IACH,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,EAAE;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,OAAO,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAE,WAA0B,EAAE,EAAE;IACtE,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC1E,OAAO,eAAe,KAAK,QAAQ;WAC9B,CAAC,WAAW,KAAK,IAAI,IAAI,eAAe,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AACrF,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,WAA0B,EAA+C,EAAE;IAC/G,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC1E,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,WAAW,KAAK,IAAI,IAAI,eAAe,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACjF,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,WAAW,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAuB,EACvB,WAA2D,EAC3D,cAA6B,IAAI,EACU,EAAE;IAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CACjD,SAAS,CAAC,IAAI,KAAK,SAAS;WACzB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;WACnD,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CACnD,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,eAAe,CAAC,CAAA;IAC7G,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;QAChC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAA;IAC5F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAC5F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,WAAW,EAAE,WAAW;YACxB,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;YACpD,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrG,OAAO;QACL,WAAW,EAAE,WAAW;QACxB,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC;QACnD,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAuB,EACvB,WAA2D,EAC3D,cAA6B,IAAI,EACjC,EAAE;IACF,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,WAAW,GAAG,8BAA8B,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IACtF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CACpC,UAAU,CAAC,IAAI,KAAK,SAAS;WAC1B,UAAU,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO;WAC1C,UAAU,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK;WACtC,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,WAAW,CAAC,KAAK,CACtE,CAAC,IAAI,IAAI,CAAA;AACZ,CAAC,CAAA"}

package/dist/server/lib/dockerSandboxEnvironmentOperations.js

@@ -1,9 +1,17 @@
 import { QUALIFIED_DOCKER_SANDBOX_TEMPLATES, DockerSandboxCollisionFailure, DockerSandboxStopVerificationFailure, createDockerSandboxAdapter, createSbxCommandRunner, } from './dockerSandboxExecutionEnvironment.js';
+import { applyScopedNetworkRules, checkDestinationAccess, inspectSandboxNetworkRules, removeScopedNetworkRules, } from './dockerSandboxNetworkPolicy.js';
 import { createDockerSandboxRuntimeController, } from './dockerSandboxRuntimeController.js';
+import { appendExecutionEnvironmentEvent, listExecutionEnvironmentEvents, } from './executionEnvironments.js';
 const runner = createSbxCommandRunner();
 export const dockerSandboxAdapter = createDockerSandboxAdapter(runner);
 export const dockerSandboxRuntimeController = createDockerSandboxRuntimeController({ runner });
 export const dockerSandboxRunner = runner;
+export const dockerSandboxNetworkPolicyOperations = {
+    applyScopedNetworkRules: (sandboxName, resources, options) => applyScopedNetworkRules(runner, sandboxName, resources, options),
+    inspectSandboxNetworkRules: (sandboxName, options) => (inspectSandboxNetworkRules(runner, sandboxName, options)),
+    checkDestinationAccess: (sandboxName, target, options) => (checkDestinationAccess(runner, sandboxName, target, options)),
+    removeScopedNetworkRules: (sandboxName, ruleIds, options) => (removeScopedNetworkRules(runner, sandboxName, ruleIds, options)),
+};
 export const defaultDockerSandboxEnvironmentDependencies = {
     adapter: dockerSandboxAdapter,
     runtimeController: dockerSandboxRuntimeController,
@@ -32,12 +40,123 @@ export const reconnectAndInspectDockerSandbox = async (environment, dependencies
     }
     return reconnected;
 };
+export const resolveArchonOwnedNetworkRuleIds = (environment) => {
+    const sandboxName = resolveExpectedDockerSandboxIdentity(environment).name;
+    const events = listExecutionEnvironmentEvents(environment.project_id, environment.id);
+    const ownedRuleIds = new Set();
+    for (const event of events) {
+        if (event.event_type !== 'environment_network_rules_applied') {
+            continue;
+        }
+        if (event.metadata?.sandboxName !== sandboxName) {
+            continue;
+        }
+        const appliedRuleIds = event.metadata?.appliedRuleIds;
+        if (!Array.isArray(appliedRuleIds)) {
+            continue;
+        }
+        for (const ruleId of appliedRuleIds) {
+            if (typeof ruleId === 'string' && ruleId.length > 0) {
+                ownedRuleIds.add(ruleId);
+            }
+        }
+    }
+    return [...ownedRuleIds];
+};
+export const removeScopedRulesBestEffort = async (environment, dependencies = defaultDockerSandboxEnvironmentDependencies) => {
+    const sandboxName = resolveExpectedDockerSandboxIdentity(environment).name;
+    let ownedRuleIds;
+    try {
+        ownedRuleIds = resolveArchonOwnedNetworkRuleIds(environment);
+    }
+    catch (error) {
+        return {
+            sandboxName,
+            removedRuleIds: [],
+            failures: [{
+                    ruleId: '*',
+                    message: error instanceof Error ? error.message : 'Archon-created network rules could not be resolved.',
+                }],
+        };
+    }
+    if (ownedRuleIds.length === 0) {
+        return { sandboxName, removedRuleIds: [], failures: [] };
+    }
+    let scopedRuleIds;
+    try {
+        scopedRuleIds = new Set((await dependencies.adapter.inspectSandboxNetworkRules(sandboxName)).map(rule => rule.id));
+    }
+    catch (error) {
+        return {
+            sandboxName,
+            removedRuleIds: [],
+            failures: [{
+                    ruleId: '*',
+                    message: error instanceof Error ? error.message : 'Scoped network rules could not be inspected.',
+                }],
+        };
+    }
+    const removedRuleIds = [];
+    const failures = [];
+    for (const ruleId of ownedRuleIds) {
+        if (!scopedRuleIds.has(ruleId)) {
+            continue;
+        }
+        try {
+            await dependencies.adapter.removeScopedNetworkRules(sandboxName, [ruleId]);
+            removedRuleIds.push(ruleId);
+        }
+        catch (error) {
+            failures.push({
+                ruleId,
+                message: error instanceof Error ? error.message : `Scoped network rule ${ruleId} could not be removed.`,
+            });
+        }
+    }
+    return { sandboxName, removedRuleIds, failures };
+};
+const recordNetworkRuleCleanupFailure = (environment, outcome) => {
+    if (outcome.failures.length === 0) {
+        return;
+    }
+    try {
+        appendExecutionEnvironmentEvent({
+            projectId: environment.project_id,
+            environmentId: environment.id,
+            eventType: 'environment_network_rule_cleanup_pending',
+            fromState: environment.lifecycle_state,
+            toState: environment.lifecycle_state,
+            message: `Archon-created scoped network rules could not be fully cleaned up for ${outcome.sandboxName}.`,
+            metadata: {
+                sandboxName: outcome.sandboxName,
+                removedRuleIds: outcome.removedRuleIds,
+                failures: outcome.failures,
+            },
+        });
+    }
+    catch {
+        // Best-effort evidence only; cleanup failure must never block termination.
+    }
+};
 export const stopAndVerifyDockerSandbox = async (environment, dependencies = defaultDockerSandboxEnvironmentDependencies) => {
     const expected = resolveExpectedDockerSandboxIdentity(environment);
     const observed = await dependencies.adapter.inspect(expected.name);
     if (!observed) {
         return 'absent';
     }
+    if (observed.name !== expected.name
+        || observed.agent !== expected.agent
+        || observed.workspacePath !== expected.workspacePath
+        || observed.template !== expected.template) {
+        throw new DockerSandboxCollisionFailure(expected.name, `Docker Sandbox ${expected.name} identity does not match the persisted environment`);
+    }
+    try {
+        const networkCleanup = await removeScopedRulesBestEffort(environment, dependencies);
+        recordNetworkRuleCleanupFailure(environment, networkCleanup);
+    }
+    catch {
+        // Best-effort rule cleanup must never block sandbox termination.
+    }
     await dependencies.adapter.stop(expected);
     const after = await dependencies.adapter.inspect(expected.name);
     if (after && (after.name !== expected.name

package/dist/server/lib/dockerSandboxEnvironmentOperations.js.map

@@ -1 +1 @@
-{"version":3,"file":"dockerSandboxEnvironmentOperations.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxEnvironmentOperations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,oCAAoC,EACpC,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,oCAAoC,GAErC,MAAM,qCAAqC,CAAA;AAG5C,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAQzC,MAAM,CAAC,MAAM,2CAA2C,GAAyC;IAC/F,OAAO,EAAE,oBAAoB;IAC7B,iBAAiB,EAAE,8BAA8B;IACjD,MAAM;CACP,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,WAAiC,EACK,EAAE;IACxC,IACE,WAAW,CAAC,aAAa,KAAK,gBAAgB;WAC3C,CAAC,WAAW,CAAC,WAAW;WACxB,CAAC,WAAW,CAAC,cAAc;WAC3B,WAAW,CAAC,iBAAiB,KAAK,kCAAkC,CAAC,WAAW,CAAC,cAAc,CAAC,EACnG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,WAAW;QAC7B,KAAK,EAAE,WAAW,CAAC,cAAc;QACjC,aAAa,EAAE,WAAW,CAAC,qBAAqB;QAChD,QAAQ,EAAE,WAAW,CAAC,iBAAiB;KACxC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,EAClD,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAE3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,EACnD,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9E,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,uBAAuB,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAiB,CAAA;IAC1B,CAAC;IACD,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC/D,IAAI,KAAK,IAAI,CACX,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WACzB,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WAC9B,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WAC9C,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC,EAAE,CAAC;QACF,MAAM,IAAI,6BAA6B,CACrC,QAAQ,CAAC,IAAI,EACb,kBAAkB,QAAQ,CAAC,IAAI,mDAAmD,CACnF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oCAAoC,CAC5C,kBAAkB,QAAQ,CAAC,IAAI,oCAAoC,CACpE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,QAAiB,CAAA;AACvD,CAAC,CAAA"}
+{"version":3,"file":"dockerSandboxEnvironmentOperations.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxEnvironmentOperations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,oCAAoC,EACpC,0BAA0B,EAC1B,sBAAsB,GAKvB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,oCAAoC,GAErC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,4BAA4B,CAAA;AAGnC,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAEzC,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,uBAAuB,EAAE,CACvB,WAAmB,EACnB,SAA4B,EAC5B,OAA2B,EAC3B,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;IACrE,0BAA0B,EAAE,CAAC,WAAmB,EAAE,OAA2B,EAAE,EAAE,CAAC,CAChF,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CACzD;IACD,sBAAsB,EAAE,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA2B,EAAE,EAAE,CAAC,CAC5F,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAC7D;IACD,wBAAwB,EAAE,CAAC,WAAmB,EAAE,OAA0B,EAAE,OAA2B,EAAE,EAAE,CAAC,CAC1G,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAChE;CACF,CAAA;AAQD,MAAM,CAAC,MAAM,2CAA2C,GAAyC;IAC/F,OAAO,EAAE,oBAAoB;IAC7B,iBAAiB,EAAE,8BAA8B;IACjD,MAAM;CACP,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,WAAiC,EACK,EAAE;IACxC,IACE,WAAW,CAAC,aAAa,KAAK,gBAAgB;WAC3C,CAAC,WAAW,CAAC,WAAW;WACxB,CAAC,WAAW,CAAC,cAAc;WAC3B,WAAW,CAAC,iBAAiB,KAAK,kCAAkC,CAAC,WAAW,CAAC,cAAc,CAAC,EACnG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,WAAW;QAC7B,KAAK,EAAE,WAAW,CAAC,cAAc;QACjC,aAAa,EAAE,WAAW,CAAC,qBAAqB;QAChD,QAAQ,EAAE,WAAW,CAAC,iBAAiB;KACxC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,EAClD,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAE3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,EACnD,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,MAAoB,EACpB,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9E,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,uBAAuB,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,WAAiC,EACd,EAAE;IACrB,MAAM,WAAW,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAA;IAC1E,MAAM,MAAM,GAAG,8BAA8B,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,CAAA;IACrF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,mCAAmC,EAAE,CAAC;YAC7D,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YAChD,SAAQ;QACV,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAA;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,CAAC,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,WAAiC,EACjC,eAAqD,2CAA2C,EACtD,EAAE;IAC5C,MAAM,WAAW,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,YAA+B,CAAA;IACnC,IAAI,CAAC;QACH,YAAY,GAAG,gCAAgC,CAAC,WAAW,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,WAAW;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,CAAC;oBACT,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD;iBACxG,CAAC;SACH,CAAA;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC1D,CAAC;IACD,IAAI,aAAkC,CAAA;IACtC,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,GAAG,CACrB,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC1F,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,WAAW;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,CAAC;oBACT,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8CAA8C;iBACjG,CAAC;SACH,CAAA;IACH,CAAC;IACD,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,QAAQ,GAA0C,EAAE,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,OAAO,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;YAC1E,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,MAAM,wBAAwB;aACxG,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAA;AAClD,CAAC,CAAA;AAED,MAAM,+BAA+B,GAAG,CACtC,WAAiC,EACjC,OAAwC,EACxC,EAAE;IACF,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,+BAA+B,CAAC;YAC9B,SAAS,EAAE,WAAW,CAAC,UAAU;YACjC,aAAa,EAAE,WAAW,CAAC,EAAE;YAC7B,SAAS,EAAE,0CAA0C;YACrD,SAAS,EAAE,WAAW,CAAC,eAAe;YACtC,OAAO,EAAE,WAAW,CAAC,eAAe;YACpC,OAAO,EAAE,yEAAyE,OAAO,CAAC,WAAW,GAAG;YACxG,QAAQ,EAAE;gBACR,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,WAAiC,EACjC,eAAqD,2CAA2C,EAChG,EAAE;IACF,MAAM,QAAQ,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAiB,CAAA;IAC1B,CAAC;IACD,IACE,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WAC5B,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WACjC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WACjD,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAC1C,CAAC;QACD,MAAM,IAAI,6BAA6B,CACrC,QAAQ,CAAC,IAAI,EACb,kBAAkB,QAAQ,CAAC,IAAI,oDAAoD,CACpF,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,2BAA2B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QACnF,+BAA+B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IACD,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC/D,IAAI,KAAK,IAAI,CACX,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WACzB,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WAC9B,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WAC9C,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC,EAAE,CAAC;QACF,MAAM,IAAI,6BAA6B,CACrC,QAAQ,CAAC,IAAI,EACb,kBAAkB,QAAQ,CAAC,IAAI,mDAAmD,CACnF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oCAAoC,CAC5C,kBAAkB,QAAQ,CAAC,IAAI,oCAAoC,CACpE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,QAAiB,CAAA;AACvD,CAAC,CAAA"}