@struktoai/mirage-browser 0.0.8-alpha.1 → 0.0.8

package/dist/io/gateway.js

@@ -0,0 +1,238 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { liveEgress, opened } from '@struktoai/mirage-core/io/gateway';
+import { postNetworkGate, preNetworkGate, } from '@struktoai/mirage-core/policy/policies';
+import { REACHING, portOf, routed, watchNetwork } from "./network.js";
+let watching = false;
+/**
+ * The bytes a request body holds, null for a form or a stream, whose size a
+ * page cannot know before it sends them.
+ */
+function measured(body) {
+    if (body === null || body === undefined)
+        return 0;
+    if (typeof body === 'string')
+        return new TextEncoder().encode(body).byteLength;
+    if (body instanceof ArrayBuffer || ArrayBuffer.isView(body))
+        return body.byteLength;
+    if (body instanceof Blob)
+        return body.size;
+    if (body instanceof URLSearchParams)
+        return new TextEncoder().encode(body.toString()).byteLength;
+    return null;
+}
+/**
+ * The page's side of the gateway: each fetch a listening workspace's line
+ * makes asks every live workspace's preNetwork once, by host name, since a
+ * page resolves no address and cannot tell one task's binding from
+ * another's. Its body is counted and cut past the tightest Limit, an upload
+ * past it, or of a size the page cannot know, is refused before it is sent,
+ * and a redirect is refused, since a page cannot see where one goes before
+ * following it. postNetwork hears how it ended, once. The counts are the
+ * bodies' bytes, since a page never sees the wire. Mirrors Python's
+ * `_Gateway`.
+ */
+async function through(send, input, init) {
+    const live = liveEgress();
+    const answers = await Promise.all(live.map((egress) => egress.hooked));
+    // A nested call binds the same workspace's egress again: each workspace
+    // judges a request once.
+    const owners = new Map();
+    live.forEach((egress, at) => {
+        if (answers[at] === true && egress.policies !== null)
+            owners.set(egress.policies, egress);
+    });
+    try {
+        input = routed(input);
+    }
+    catch (err) {
+        console.debug('gateway:', err);
+        throw new TypeError('Failed to fetch');
+    }
+    const target = new URL(input instanceof Request ? input.url : input, globalThis.location.href);
+    if (owners.size === 0 || !REACHING.has(target.protocol))
+        return send(input, init);
+    const host = target.hostname;
+    const port = portOf(target);
+    const started = Date.now();
+    const sent = init?.body !== undefined
+        ? measured(init.body)
+        : input instanceof Request && input.body !== null
+            ? null
+            : 0;
+    const tickets = [];
+    let over = false;
+    // Tell every workspace that let the request through how it went, once.
+    const ended = async (how, out, received) => {
+        if (over)
+            return;
+        over = true;
+        for (const { egress, ctx, passed } of tickets) {
+            if (egress.policies === null)
+                continue;
+            await postNetworkGate(egress.policies, {
+                ...ctx,
+                bytesSent: out,
+                bytesReceived: received,
+                seconds: (Date.now() - started) / 1000,
+                ended: how,
+            }, passed).catch((err) => {
+                console.debug('gateway: postNetwork failed:', err);
+            });
+        }
+    };
+    let cap = null;
+    let deadline = null;
+    for (const [policies, egress] of owners) {
+        const ctx = opened(host, '', port);
+        let answer;
+        try {
+            answer = await preNetworkGate(policies, ctx);
+        }
+        catch (err) {
+            console.debug('gateway: preNetwork failed:', err);
+            await ended('refused', 0, 0);
+            throw new TypeError('Failed to fetch');
+        }
+        tickets.push({ egress, ctx, passed: answer[0] });
+        const limit = answer[1];
+        if (limit?.maxBytes != null)
+            cap = Math.min(cap ?? limit.maxBytes, limit.maxBytes);
+        if (limit?.timeoutSeconds != null) {
+            deadline = Math.min(deadline ?? limit.timeoutSeconds, limit.timeoutSeconds);
+        }
+    }
+    if (cap !== null && (sent === null || sent > cap)) {
+        await ended('limit', 0, 0);
+        throw new TypeError('Failed to fetch');
+    }
+    const stop = new AbortController();
+    const timer = deadline === null
+        ? null
+        : setTimeout(() => {
+            stop.abort();
+        }, deadline * 1000);
+    const asked = init?.signal ?? (input instanceof Request ? input.signal : null);
+    const signal = asked == null ? stop.signal : AbortSignal.any([asked, stop.signal]);
+    // A redirect the page would follow goes where no policy saw, so it is not
+    // followed; one the caller handles itself is handed back as fetch gives it.
+    const redirect = init?.redirect ?? (input instanceof Request ? input.redirect : 'follow');
+    let response;
+    try {
+        response = await send(input, {
+            ...init,
+            signal,
+            redirect: redirect === 'follow' ? 'manual' : redirect,
+        });
+    }
+    catch (err) {
+        if (timer !== null)
+            clearTimeout(timer);
+        await ended(stop.signal.aborted ? 'limit' : 'error', sent ?? 0, 0);
+        throw err;
+    }
+    if (response.type === 'opaqueredirect' && redirect === 'follow') {
+        if (timer !== null)
+            clearTimeout(timer);
+        await ended('refused', sent ?? 0, 0);
+        throw new TypeError('Failed to fetch');
+    }
+    if (response.body === null || [204, 205, 304].includes(response.status)) {
+        if (timer !== null)
+            clearTimeout(timer);
+        await ended('closed', sent ?? 0, 0);
+        return response;
+    }
+    let received = 0;
+    const reader = response.body.getReader();
+    const counted = new ReadableStream({
+        async pull(controller) {
+            let step;
+            try {
+                step = await reader.read();
+            }
+            catch (err) {
+                if (timer !== null)
+                    clearTimeout(timer);
+                await ended(stop.signal.aborted ? 'limit' : 'error', sent ?? 0, received);
+                controller.error(err);
+                return;
+            }
+            if (step.done) {
+                if (timer !== null)
+                    clearTimeout(timer);
+                await ended('closed', sent ?? 0, received);
+                controller.close();
+                return;
+            }
+            if (cap !== null && (sent ?? 0) + received + step.value.byteLength > cap) {
+                const left = Math.max(cap - (sent ?? 0) - received, 0);
+                received += left;
+                controller.enqueue(step.value.subarray(0, left));
+                stop.abort();
+                if (timer !== null)
+                    clearTimeout(timer);
+                await reader.cancel().catch((err) => {
+                    console.debug('gateway: body cancel failed:', err);
+                });
+                await ended('limit', sent ?? 0, received);
+                controller.error(new TypeError('network error'));
+                return;
+            }
+            received += step.value.byteLength;
+            controller.enqueue(step.value);
+        },
+        async cancel(reason) {
+            if (timer !== null)
+                clearTimeout(timer);
+            await reader.cancel(reason);
+            await ended('closed', sent ?? 0, received);
+        },
+    });
+    const relayed = new Response(counted, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+    });
+    Object.defineProperties(relayed, {
+        url: { value: response.url },
+        redirected: { value: response.redirected },
+        type: { value: response.type },
+    });
+    return relayed;
+}
+/**
+ * Send every request the page makes through `through`, once; one with no
+ * listening egress goes on at once. A page cannot hold a WebSocket's
+ * handshake for an async answer, so while a policy listens for connections a
+ * WebSocket is refused. Mirrors Python's `_watch`.
+ */
+export function watch() {
+    if (watching)
+        return;
+    watching = true;
+    watchNetwork();
+    const send = globalThis.fetch.bind(globalThis);
+    globalThis.fetch = (input, init) => through(send, input, init);
+    const Socket = globalThis.WebSocket;
+    globalThis.WebSocket = class extends Socket {
+        constructor(url, protocols) {
+            if (liveEgress().some((egress) => egress.listening !== false && egress.policies !== null)) {
+                throw new DOMException(`A policy listens for connections, so ${String(url)} is refused`, 'SecurityError');
+            }
+            super(url, protocols);
+        }
+    };
+}
+//# sourceMappingURL=gateway.js.map

package/dist/io/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/io/gateway.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAe,UAAU,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AAEnF,OAAO,EAEL,eAAe,EACf,cAAc,GACf,MAAM,wCAAwC,CAAA;AAG/C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAErE,IAAI,QAAQ,GAAG,KAAK,CAAA;AASpB;;;GAGG;AACH,SAAS,QAAQ,CAAC,IAAiC;IACjD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAA;IAC9E,IAAI,IAAI,YAAY,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,CAAA;IACnF,IAAI,IAAI,YAAY,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IAC1C,IAAI,IAAI,YAAY,eAAe;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAA;IAChG,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,OAAO,CACpB,IAAkB,EAClB,KAAwB,EACxB,IAA6B;IAE7B,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;IACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,wEAAwE;IACxE,yBAAyB;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC1C,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;QAC1B,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC9B,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1B,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,KAAK,YAAY,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAC/C,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,CAAA;IACT,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,uEAAuE;IACvE,MAAM,KAAK,GAAG,KAAK,EAAE,GAAe,EAAE,GAAW,EAAE,QAAgB,EAAiB,EAAE;QACpF,IAAI,IAAI;YAAE,OAAM;QAChB,IAAI,GAAG,IAAI,CAAA;QACX,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAAE,SAAQ;YACtC,MAAM,eAAe,CACnB,MAAM,CAAC,QAAQ,EACf;gBACE,GAAG,GAAG;gBACN,SAAS,EAAE,GAAG;gBACd,aAAa,EAAE,QAAQ;gBACvB,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI;gBACtC,KAAK,EAAE,GAAG;aACX,EACD,MAAM,CACP,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;YACpD,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IACD,IAAI,GAAG,GAAkB,IAAI,CAAA;IAC7B,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAClC,IAAI,MAAgD,CAAA;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;YACjD,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;YAC5B,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,KAAK,EAAE,QAAQ,IAAI,IAAI;YAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAClF,IAAI,KAAK,EAAE,cAAc,IAAI,IAAI,EAAE,CAAC;YAClC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1B,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,KAAK,EAAE,CAAA;QACd,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAA;IACzB,MAAM,KAAK,GAAG,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAClF,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACzF,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;YAC3B,GAAG,IAAI;YACP,MAAM;YACN,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;SACtD,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAClE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,KAAK,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACpC,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACnC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,IAAI,cAAc,CAAa;QAC7C,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,IAA0C,CAAA;YAC9C,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,KAAK,IAAI;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAA;gBACzE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACrB,OAAM;YACR,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAI,KAAK,KAAK,IAAI;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,MAAM,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAA;gBAC1C,UAAU,CAAC,KAAK,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;gBACzE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAA;gBACtD,QAAQ,IAAI,IAAI,CAAA;gBAChB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;gBAChD,IAAI,CAAC,KAAK,EAAE,CAAA;gBACZ,IAAI,KAAK,KAAK,IAAI;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBAC3C,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;gBACpD,CAAC,CAAC,CAAA;gBACF,MAAM,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAA;gBACzC,UAAU,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,eAAe,CAAC,CAAC,CAAA;gBAChD,OAAM;YACR,CAAC;YACD,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAA;YACjC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,KAAK,KAAK,IAAI;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,MAAM,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CAAA;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE;QAC/B,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE;QAC5B,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,EAAE;QAC1C,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE;KAC/B,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK;IACnB,IAAI,QAAQ;QAAE,OAAM;IACpB,QAAQ,GAAG,IAAI,CAAA;IACf,YAAY,EAAE,CAAA;IACd,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC9C,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAA;IACnC,UAAU,CAAC,SAAS,GAAG,KAAM,SAAQ,MAAM;QACzC,YAAY,GAAiB,EAAE,SAA6B;YAC1D,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC1F,MAAM,IAAI,YAAY,CACpB,wCAAwC,MAAM,CAAC,GAAG,CAAC,aAAa,EAChE,eAAe,CAChB,CAAA;YACH,CAAC;YACD,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QACvB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/io/network.d.ts

@@ -0,0 +1,21 @@
+export declare const REACHING: Set<string>;
+/** The port a URL reaches, which it leaves unwritten for its scheme's own. */
+export declare function portOf(target: URL): number;
+/**
+ * `input` sent where the bound rule routes its host and port instead, and
+ * judged there; as it is when it routes nowhere. A page checks TLS against
+ * the URL it sends, so a secure route may change the port but not the host.
+ * Throws when it cannot be routed.
+ */
+export declare function routed(input: RequestInfo | URL): RequestInfo | URL;
+/**
+ * Start judging every request the page makes, once: fetch and WebSocket ask
+ * every live workspace's rule by host name, since a page resolves no
+ * address and cannot tell one task's binding from another's, so the
+ * strictest rule wins. A page cannot see where a redirect goes before it
+ * follows one, so under a rule fetch follows none: a request that asked to
+ * follow fails as fetch does. Called as the first workspace with a rule is
+ * built. Mirrors Python's `watch_network`.
+ */
+export declare function watchNetwork(): void;
+//# sourceMappingURL=network.d.ts.map

package/dist/io/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/io/network.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,QAAQ,aAA8C,CAAA;AAInE,8EAA8E;AAC9E,wBAAgB,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAG1C;AAoCD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,GAAG,WAAW,GAAG,GAAG,CAiBlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAoCnC"}

package/dist/io/network.js

@@ -0,0 +1,131 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { liveEgress } from '@struktoai/mirage-core/io/gateway';
+import { networkBound, networkLets, networkRoute } from '@struktoai/mirage-core/io/network';
+// The schemes that reach a host; data:, blob: and the like never leave the page.
+export const REACHING = new Set(['http:', 'https:', 'ws:', 'wss:']);
+let watching = false;
+/** The port a URL reaches, which it leaves unwritten for its scheme's own. */
+export function portOf(target) {
+    if (target.port !== '')
+        return Number(target.port);
+    return target.protocol === 'https:' || target.protocol === 'wss:' ? 443 : 80;
+}
+function lets(url) {
+    const target = new URL(url, globalThis.location.href);
+    return !REACHING.has(target.protocol) || networkLets(target.hostname, '', portOf(target));
+}
+// The schemes whose TLS checks the URL's own host name.
+const SECURE = new Set(['https:', 'wss:']);
+/**
+ * Where a page's request to `host` on `port` goes instead, null for nowhere
+ * else. A page cannot tell one task's binding from another's, so every live
+ * line and file op must route it alike, but for a file op of a session with
+ * a live line, which goes as that line does (a file call inside a line binds
+ * the workspace's own rule over the session's); throws when two do not.
+ */
+function routeOf(host, port) {
+    const live = liveEgress();
+    if (live.length === 0)
+        return networkRoute(host, port);
+    // Whether a line of the session `egress` runs for is live in its workspace.
+    const lined = (egress) => egress.session !== null &&
+        live.some((line) => !line.op && line.session === egress.session && line.policies === egress.policies);
+    const answers = live
+        .filter((egress) => !egress.op || !lined(egress))
+        .map((egress) => egress.rule?.route(host, port) ?? null);
+    const first = answers[0] ?? null;
+    if (answers.some((answer) => answer?.join(':') !== first?.join(':'))) {
+        throw new Error(`network: live calls route ${host}:${String(port)} apart`);
+    }
+    return first;
+}
+/**
+ * `input` sent where the bound rule routes its host and port instead, and
+ * judged there; as it is when it routes nowhere. A page checks TLS against
+ * the URL it sends, so a secure route may change the port but not the host.
+ * Throws when it cannot be routed.
+ */
+export function routed(input) {
+    const target = new URL(input instanceof Request ? input.url : input, globalThis.location.href);
+    if (!REACHING.has(target.protocol))
+        return input;
+    const route = routeOf(target.hostname, portOf(target));
+    if (route === null)
+        return input;
+    const bare = target.hostname
+        .replace(/^\[(.*)\]$/, '$1')
+        .replace(/\.$/, '')
+        .toLowerCase();
+    if (SECURE.has(target.protocol) && route[0] !== bare) {
+        throw new Error(`network: a page cannot route ${target.host} to another host and still check its TLS name`);
+    }
+    target.hostname = route[0].includes(':') ? `[${route[0]}]` : route[0];
+    target.port = String(route[1]);
+    return input instanceof Request ? new Request(target, input) : target;
+}
+/**
+ * Start judging every request the page makes, once: fetch and WebSocket ask
+ * every live workspace's rule by host name, since a page resolves no
+ * address and cannot tell one task's binding from another's, so the
+ * strictest rule wins. A page cannot see where a redirect goes before it
+ * follows one, so under a rule fetch follows none: a request that asked to
+ * follow fails as fetch does. Called as the first workspace with a rule is
+ * built. Mirrors Python's `watch_network`.
+ */
+export function watchNetwork() {
+    if (watching)
+        return;
+    watching = true;
+    const send = globalThis.fetch.bind(globalThis);
+    globalThis.fetch = async (input, init) => {
+        if (networkBound() === null)
+            return send(input, init);
+        try {
+            input = routed(input);
+        }
+        catch (err) {
+            console.debug('network:', err);
+            throw new TypeError('Failed to fetch');
+        }
+        if (!lets(input instanceof Request ? input.url : input))
+            throw new TypeError('Failed to fetch');
+        const redirect = init?.redirect ?? (input instanceof Request ? input.redirect : 'follow');
+        if (redirect !== 'follow')
+            return send(input, init);
+        const response = await send(input, { ...init, redirect: 'manual' });
+        if (response.type === 'opaqueredirect')
+            throw new TypeError('Failed to fetch');
+        return response;
+    };
+    const Socket = globalThis.WebSocket;
+    globalThis.WebSocket = class extends Socket {
+        constructor(url, protocols) {
+            let target = url;
+            if (networkBound() !== null) {
+                try {
+                    target = routed(url);
+                }
+                catch (err) {
+                    throw new DOMException(String(err), 'SecurityError');
+                }
+                if (!lets(target)) {
+                    throw new DOMException(`The network rule refuses ${String(target)}`, 'SecurityError');
+                }
+            }
+            super(target, protocols);
+        }
+    };
+}
+//# sourceMappingURL=network.js.map

package/dist/io/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/io/network.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAe,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAE3F,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAEnE,IAAI,QAAQ,GAAG,KAAK,CAAA;AAEpB,8EAA8E;AAC9E,MAAM,UAAU,MAAM,CAAC,MAAW;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,IAAI,CAAC,GAAiB;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,wDAAwD;AACxD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;AAE1C;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtD,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,MAAc,EAAW,EAAE,CACxC,MAAM,CAAC,OAAO,KAAK,IAAI;QACvB,IAAI,CAAC,IAAI,CACP,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAC3F,CAAA;IACH,MAAM,OAAO,GAAG,IAAI;SACjB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAChC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,KAAwB;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ;SACzB,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,WAAW,EAAE,CAAA;IAChB,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,CAAC,IAAI,+CAA+C,CAC3F,CAAA;IACH,CAAC;IACD,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACrE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9B,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,QAAQ;QAAE,OAAM;IACpB,QAAQ,GAAG,IAAI,CAAA;IACf,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC9C,UAAU,CAAC,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,YAAY,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACrD,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;YAC9B,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACxC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACzF,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC9E,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAA;IACnC,UAAU,CAAC,SAAS,GAAG,KAAM,SAAQ,MAAM;QACzC,YAAY,GAAiB,EAAE,SAA6B;YAC1D,IAAI,MAAM,GAAG,GAAG,CAAA;YAChB,IAAI,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,CAAC,GAAG,CAAiB,CAAA;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAA;gBACtD,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClB,MAAM,IAAI,YAAY,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;gBACvF,CAAC;YACH,CAAC;YACD,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/io/spool.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spool.d.ts.map

package/dist/io/spool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spool.d.ts","sourceRoot":"","sources":["../../src/io/spool.ts"],"names":[],"mappings":""}

package/dist/io/spool.js

@@ -0,0 +1,68 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { setSpoolFactory } from '@struktoai/mirage-core/io/spool';
+/**
+ * A page's spool scratch: spilled bytes as fixed blocks of Blob, which the
+ * browser holds outside the JavaScript heap and may page to disk, so a spool
+ * past its memory limit no longer grows the heap. A write rebuilds only the
+ * blocks it touches, from slices of what they held. Mirrors Node's spool
+ * store.
+ */
+function createStore() {
+    const BLOCK = 256 * 1024;
+    const blocks = [];
+    let length = 0;
+    return Promise.resolve({
+        write(at, data) {
+            let offset = 0;
+            while (offset < data.length) {
+                const index = Math.floor((at + offset) / BLOCK);
+                const start = (at + offset) % BLOCK;
+                const count = Math.min(BLOCK - start, data.length - offset);
+                const held = blocks[index] ?? new Blob();
+                const fresh = data.slice(offset, offset + count);
+                blocks[index] =
+                    start === 0 && count >= held.size
+                        ? new Blob([fresh])
+                        : new Blob([
+                            held.slice(0, start),
+                            new Uint8Array(Math.max(0, start - held.size)),
+                            fresh,
+                            held.slice(start + count),
+                        ]);
+                offset += count;
+            }
+            length = Math.max(length, at + data.length);
+            return Promise.resolve();
+        },
+        async read(offset, size) {
+            const end = Math.min(length, offset + size);
+            if (end <= offset)
+                return new Uint8Array();
+            const first = Math.floor(offset / BLOCK);
+            const window = new Blob(blocks.slice(first, Math.floor((end - 1) / BLOCK) + 1));
+            return new Uint8Array(await window.slice(offset - first * BLOCK, end - first * BLOCK).arrayBuffer());
+        },
+        body() {
+            return Promise.resolve(new Blob(blocks));
+        },
+        close() {
+            blocks.length = 0;
+            length = 0;
+            return Promise.resolve();
+        },
+    });
+}
+setSpoolFactory(createStore);
+//# sourceMappingURL=spool.js.map

package/dist/io/spool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spool.js","sourceRoot":"","sources":["../../src/io/spool.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,eAAe,EAAmB,MAAM,iCAAiC,CAAA;AAElF;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAA;IACxB,MAAM,MAAM,GAAW,EAAE,CAAA;IACzB,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,KAAK,CAAC,EAAE,EAAE,IAAI;YACZ,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAA;gBAC/C,MAAM,KAAK,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAA;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;gBAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAA;gBAChD,MAAM,CAAC,KAAK,CAAC;oBACX,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI;wBAC/B,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;wBACnB,CAAC,CAAC,IAAI,IAAI,CAAC;4BACP,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;4BACpB,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;4BAC9C,KAAK;4BACL,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;yBAC1B,CAAC,CAAA;gBACR,MAAM,IAAI,KAAK,CAAA;YACjB,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAA;YAC3C,IAAI,GAAG,IAAI,MAAM;gBAAE,OAAO,IAAI,UAAU,EAAE,CAAA;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC/E,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,KAAK,EAAE,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAC9E,CAAA;QACH,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1C,CAAC;QACD,KAAK;YACH,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;YACjB,MAAM,GAAG,CAAC,CAAA;YACV,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,eAAe,CAAC,WAAW,CAAC,CAAA"}

package/dist/vfs/aliyun/aliyun.d.ts

@@ -1,8 +1,7 @@
-import { S3AliasVFS, type S3AliasVFSState } from '../s3_alias.ts';
-import { type AliyunConfig, type AliyunConfigRedacted } from './config.ts';
-export type AliyunVFSState = S3AliasVFSState<AliyunConfigRedacted>;
-export declare class AliyunVFS extends S3AliasVFS<AliyunConfig, AliyunConfigRedacted> {
-    readonly prompt: string;
+import type { RedactedSchema } from '@struktoai/mirage-core/vfs/secrets';
+import { S3AliasVFS } from '../s3_alias.ts';
+import { AliyunConfig } from './config.ts';
+export declare class AliyunVFS extends S3AliasVFS<AliyunConfig, RedactedSchema<typeof AliyunConfig>> {
     constructor(config: AliyunConfig);
 }
 //# sourceMappingURL=aliyun.d.ts.map

package/dist/vfs/aliyun/aliyun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aliyun.d.ts","sourceRoot":"","sources":["../../../src/vfs/aliyun/aliyun.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAA;AAGpB,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAA;AAElE,qBAAa,SAAU,SAAQ,UAAU,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC3E,SAAkB,MAAM,EAAE,MAAM,CAAS;gBAE7B,MAAM,EAAE,YAAY;CAGjC"}
+{"version":3,"file":"aliyun.d.ts","sourceRoot":"","sources":["../../../src/vfs/aliyun/aliyun.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,qBAAa,SAAU,SAAQ,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,OAAO,YAAY,CAAC,CAAC;gBAC9E,MAAM,EAAE,YAAY;CAGjC"}

package/dist/vfs/aliyun/aliyun.js

@@ -13,12 +13,10 @@
 // ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
 import { VFSName } from '@struktoai/mirage-core/types';
 import { S3AliasVFS } from "../s3_alias.js";
-import { aliyunToS3Config, redactAliyunConfig, } from "./config.js";
-import { PROMPT } from "./prompt.js";
+import { AliyunConfig } from "./config.js";
 export class AliyunVFS extends S3AliasVFS {
-    prompt = PROMPT;
     constructor(config) {
-        super(VFSName.ALIYUN, config, aliyunToS3Config(config), redactAliyunConfig);
+        super(VFSName.ALIYUN, config, AliyunConfig);
     }
 }
 //# sourceMappingURL=aliyun.js.map

package/dist/vfs/aliyun/aliyun.js.map

@@ -1 +1 @@
-{"version":3,"file":"aliyun.js","sourceRoot":"","sources":["../../../src/vfs/aliyun/aliyun.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AACtD,OAAO,EAAE,UAAU,EAAwB,MAAM,gBAAgB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAIpC,MAAM,OAAO,SAAU,SAAQ,UAA8C;IACzD,MAAM,GAAW,MAAM,CAAA;IAEzC,YAAY,MAAoB;QAC9B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAC7E,CAAC;CACF"}
+{"version":3,"file":"aliyun.js","sourceRoot":"","sources":["../../../src/vfs/aliyun/aliyun.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,MAAM,OAAO,SAAU,SAAQ,UAA6D;IAC1F,YAAY,MAAoB;QAC9B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IAC7C,CAAC;CACF"}

package/dist/vfs/aliyun/config.d.ts

@@ -1,17 +1,28 @@
-import type { ConfigOf, RedactedConfig } from '@struktoai/mirage-core/vfs/secrets';
-declare const AliyunConfigSchema: import("zod").ZodObject<{
+import type { ConfigOf } from '@struktoai/mirage-core/vfs/secrets';
+export declare const AliyunConfig: import("zod").ZodObject<{
+    timeout: import("zod").ZodOptional<import("zod").ZodNumber>;
     bucket: import("zod").ZodString;
-    presignedUrlProvider: import("zod").ZodCustom<import("@struktoai/mirage-core/vfs/s3/config").S3BrowserPresignedUrlProvider, import("@struktoai/mirage-core/vfs/s3/config").S3BrowserPresignedUrlProvider>;
+    presignedUrlProvider: import("@struktoai/mirage-core/vfs/secrets").SecretSchema<import("zod").ZodCustom<import("@struktoai/mirage-core/vfs/s3/config").S3BrowserPresignedUrlProvider, import("@struktoai/mirage-core/vfs/s3/config").S3BrowserPresignedUrlProvider>>;
     region: import("zod").ZodOptional<import("zod").ZodString>;
     endpoint: import("zod").ZodOptional<import("zod").ZodString>;
     defaultContentType: import("zod").ZodOptional<import("zod").ZodString>;
     keyPrefix: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>;
-export type AliyunConfig = ConfigOf<typeof AliyunConfigSchema>;
-export type AliyunConfigRedacted = RedactedConfig<AliyunConfig, 'presignedUrlProvider'>;
-export declare const resolvedAliyunEndpoint: (config: AliyunConfig) => string | undefined;
-export declare const aliyunToS3Config: (config: AliyunConfig) => import("@struktoai/mirage-core/vfs/s3/config").S3Config;
-export declare const redactAliyunConfig: (config: AliyunConfig) => AliyunConfigRedacted;
-export declare const normalizeAliyunConfig: (input: Record<string, unknown>) => AliyunConfig;
-export {};
+}, import("zod/v4/core").$strip> & import("../s3_alias.ts").BrowserAlias<ConfigOf<import("zod").ZodObject<{
+    timeout: import("zod").ZodOptional<import("zod").ZodNumber>;
+    bucket: import("zod").ZodString;
+    presignedUrlProvider: import("@struktoai/mirage-core/vfs/secrets").SecretSchema<import("zod").ZodCustom<import("@struktoai/mirage-core/vfs/s3/config").S3BrowserPresignedUrlProvider, import("@struktoai/mirage-core/vfs/s3/config").S3BrowserPresignedUrlProvider>>;
+    region: import("zod").ZodOptional<import("zod").ZodString>;
+    endpoint: import("zod").ZodOptional<import("zod").ZodString>;
+    defaultContentType: import("zod").ZodOptional<import("zod").ZodString>;
+    keyPrefix: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>> & import("../s3_alias.ts").S3BrowserAliasConfig, {
+    bucket: string;
+    presignedUrlProvider: "<REDACTED>";
+    timeout?: number;
+    region?: string;
+    endpoint?: string;
+    defaultContentType?: string;
+    keyPrefix?: string;
+}, string | undefined>;
+export type AliyunConfig = ConfigOf<typeof AliyunConfig>;
 //# sourceMappingURL=config.d.ts.map

package/dist/vfs/aliyun/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/vfs/aliyun/config.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGlF,QAAA,MAAM,kBAAkB;;;;;;;gCAAyB,CAAA;AAEjD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE9D,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAA;AAOvF,eAAO,MAAM,sBAAsB,8CAAyB,CAAA;AAC5D,eAAO,MAAM,gBAAgB,mFAAmB,CAAA;AAChD,eAAO,MAAM,kBAAkB,gDAAe,CAAA;AAC9C,eAAO,MAAM,qBAAqB,kDAAkB,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/vfs/aliyun/config.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAGlE,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;sBAGvB,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,YAAY,CAAC,CAAA"}

package/dist/vfs/aliyun/config.js

@@ -12,13 +12,8 @@
 // limitations under the License.
 // ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
 import { browserAliasSchema, derivedEndpoint, makeBrowserS3Alias } from "../s3_alias.js";
-const AliyunConfigSchema = browserAliasSchema({});
-const alias = makeBrowserS3Alias({
-    schema: AliyunConfigSchema,
+export const AliyunConfig = makeBrowserS3Alias({
+    schema: browserAliasSchema({}),
     endpointFor: derivedEndpoint('region', (region) => `https://s3.oss-${region}.aliyuncs.com`),
 });
-export const resolvedAliyunEndpoint = alias.resolvedEndpoint;
-export const aliyunToS3Config = alias.toS3Config;
-export const redactAliyunConfig = alias.redact;
-export const normalizeAliyunConfig = alias.normalize;
 //# sourceMappingURL=config.js.map

package/dist/vfs/aliyun/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/vfs/aliyun/config.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAGvE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAA;AAMjD,MAAM,KAAK,GAAG,kBAAkB,CAAqC;IACnE,MAAM,EAAE,kBAAkB;IAC1B,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,MAAM,eAAe,CAAC;CAC5F,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC,gBAAgB,CAAA;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAA;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAA;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,SAAS,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/vfs/aliyun/config.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAGvE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAC7C,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,MAAM,eAAe,CAAC;CAC5F,CAAC,CAAA"}

package/dist/vfs/backblaze/backblaze.d.ts

@@ -1,8 +1,7 @@
-import { S3AliasVFS, type S3AliasVFSState } from '../s3_alias.ts';
-import { type BackblazeConfig, type BackblazeConfigRedacted } from './config.ts';
-export type BackblazeVFSState = S3AliasVFSState<BackblazeConfigRedacted>;
-export declare class BackblazeVFS extends S3AliasVFS<BackblazeConfig, BackblazeConfigRedacted> {
-    readonly prompt: string;
+import type { RedactedSchema } from '@struktoai/mirage-core/vfs/secrets';
+import { S3AliasVFS } from '../s3_alias.ts';
+import { BackblazeConfig } from './config.ts';
+export declare class BackblazeVFS extends S3AliasVFS<BackblazeConfig, RedactedSchema<typeof BackblazeConfig>> {
     constructor(config: BackblazeConfig);
 }
 //# sourceMappingURL=backblaze.d.ts.map