@sysid/sandbox-runtime-improved 0.0.55-sysid.1 → 0.0.61-sysid.1

package/dist/sandbox/sandbox-config.d.ts

@@ -36,6 +36,127 @@ declare const ParentProxyConfigSchema: z.ZodObject<{
     https?: string | undefined;
     noProxy?: string | undefined;
 }>;
+/**
+ * Schema for the access mode of a declared credential source.
+ *
+ * - `deny` — the sandboxed process cannot read the file / does not see the
+ *   environment variable.
+ * - `mask` — the sandboxed process sees a per-session sentinel value; the
+ *   host proxy substitutes sentinel→real on egress to `injectHosts`.
+ *   For files this is whole-file masking (Linux only; degrades to `deny`
+ *   on macOS — see {@link CredentialFileConfigSchema}).
+ */
+declare const credentialModeSchema: z.ZodEnum<["deny", "mask"]>;
+/**
+ * Schema for a single credential file/directory entry.
+ *
+ * `mode: "mask"` is **whole-file** masking: the entire file content is
+ * replaced inside the sandbox with one sentinel string, and the proxy
+ * substitutes that sentinel back to the real bytes on egress. This works
+ * for files whose content *is* the credential (a token file, a single-line
+ * secret). It does **not** work for structured files a tool parses
+ * (`.netrc`, JSON/YAML configs) — the tool will fail to parse the sentinel.
+ * For those, prefer env-var masking where the tool supports it, or
+ * `mode: "deny"`. Format-aware extraction is a possible future extension.
+ *
+ * On macOS, SBPL cannot redirect reads, so `mode: "mask"` currently
+ * degrades to `mode: "deny"` (the file is unreadable inside the sandbox).
+ */
+export declare const CredentialFileConfigSchema: z.ZodObject<{
+    path: z.ZodString;
+    mode: z.ZodEnum<["deny", "mask"]>;
+    injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    mode: "deny" | "mask";
+    path: string;
+    injectHosts?: string[] | undefined;
+}, {
+    mode: "deny" | "mask";
+    path: string;
+    injectHosts?: string[] | undefined;
+}>;
+/**
+ * Schema for a single credential environment variable entry.
+ */
+export declare const CredentialEnvVarConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    mode: z.ZodEnum<["deny", "mask"]>;
+    injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    mode: "deny" | "mask";
+    name: string;
+    injectHosts?: string[] | undefined;
+}, {
+    mode: "deny" | "mask";
+    name: string;
+    injectHosts?: string[] | undefined;
+}>;
+/**
+ * Credentials configuration schema for validation.
+ *
+ * Declares credential sources (files and environment variables) with a
+ * per-source mode:
+ * - `deny` blocks the source inside the sandbox (file reads are denied via the
+ *   filesystem read-deny mechanism, env vars are unset in the child).
+ *
+ * Additional modes (e.g. `mask`) will be added in future releases.
+ *
+ * Only the sources declared here are affected; the section applies no
+ * implicit restrictions beyond them.
+ */
+export declare const CredentialsConfigSchema: z.ZodObject<{
+    files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        mode: z.ZodEnum<["deny", "mask"]>;
+        injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        mode: "deny" | "mask";
+        path: string;
+        injectHosts?: string[] | undefined;
+    }, {
+        mode: "deny" | "mask";
+        path: string;
+        injectHosts?: string[] | undefined;
+    }>, "many">>;
+    envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        mode: z.ZodEnum<["deny", "mask"]>;
+        injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        mode: "deny" | "mask";
+        name: string;
+        injectHosts?: string[] | undefined;
+    }, {
+        mode: "deny" | "mask";
+        name: string;
+        injectHosts?: string[] | undefined;
+    }>, "many">>;
+    allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    files?: {
+        mode: "deny" | "mask";
+        path: string;
+        injectHosts?: string[] | undefined;
+    }[] | undefined;
+    envVars?: {
+        mode: "deny" | "mask";
+        name: string;
+        injectHosts?: string[] | undefined;
+    }[] | undefined;
+    allowPlaintextInject?: boolean | undefined;
+}, {
+    files?: {
+        mode: "deny" | "mask";
+        path: string;
+        injectHosts?: string[] | undefined;
+    }[] | undefined;
+    envVars?: {
+        mode: "deny" | "mask";
+        name: string;
+        injectHosts?: string[] | undefined;
+    }[] | undefined;
+    allowPlaintextInject?: boolean | undefined;
+}>;
 /**
  * Network configuration schema for validation
  */
@@ -63,18 +184,23 @@ export declare const NetworkConfigSchema: z.ZodObject<{
     tlsTerminate: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         caCertPath: z.ZodOptional<z.ZodString>;
         caKeyPath: z.ZodOptional<z.ZodString>;
+        excludeDomains: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
     }, "strip", z.ZodTypeAny, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
+        excludeDomains?: string[] | undefined;
     }, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
+        excludeDomains?: string[] | undefined;
     }>, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
+        excludeDomains?: string[] | undefined;
     }, {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
+        excludeDomains?: string[] | undefined;
     }>>;
     parentProxy: z.ZodOptional<z.ZodObject<{
         http: z.ZodOptional<z.ZodString>;
@@ -107,6 +233,7 @@ export declare const NetworkConfigSchema: z.ZodObject<{
     tlsTerminate?: {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
+        excludeDomains?: string[] | undefined;
     } | undefined;
     parentProxy?: {
         http?: string | undefined;
@@ -131,6 +258,7 @@ export declare const NetworkConfigSchema: z.ZodObject<{
     tlsTerminate?: {
         caCertPath?: string | undefined;
         caKeyPath?: string | undefined;
+        excludeDomains?: string[] | undefined;
     } | undefined;
     parentProxy?: {
         http?: string | undefined;
@@ -142,6 +270,7 @@ export declare const NetworkConfigSchema: z.ZodObject<{
  * Filesystem configuration schema for validation
  */
 export declare const FilesystemConfigSchema: z.ZodObject<{
+    disabled: z.ZodOptional<z.ZodBoolean>;
     denyRead: z.ZodArray<z.ZodString, "many">;
     allowRead: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     allowWrite: z.ZodArray<z.ZodString, "many">;
@@ -151,12 +280,14 @@ export declare const FilesystemConfigSchema: z.ZodObject<{
     denyRead: string[];
     allowWrite: string[];
     denyWrite: string[];
+    disabled?: boolean | undefined;
     allowRead?: string[] | undefined;
     allowGitConfig?: boolean | undefined;
 }, {
     denyRead: string[];
     allowWrite: string[];
     denyWrite: string[];
+    disabled?: boolean | undefined;
     allowRead?: string[] | undefined;
     allowGitConfig?: boolean | undefined;
 }>;
@@ -190,9 +321,11 @@ export declare const WindowsConfigSchema: z.ZodObject<{
     groupName: z.ZodDefault<z.ZodString>;
     groupSid: z.ZodOptional<z.ZodString>;
     wfpSublayerGuid: z.ZodOptional<z.ZodString>;
+    asSandboxUser: z.ZodDefault<z.ZodBoolean>;
     proxyPortRange: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
 }, "strip", z.ZodTypeAny, {
     groupName: string;
+    asSandboxUser: boolean;
     groupSid?: string | undefined;
     wfpSublayerGuid?: string | undefined;
     proxyPortRange?: [number, number] | undefined;
@@ -200,6 +333,7 @@ export declare const WindowsConfigSchema: z.ZodObject<{
     groupName?: string | undefined;
     groupSid?: string | undefined;
     wfpSublayerGuid?: string | undefined;
+    asSandboxUser?: boolean | undefined;
     proxyPortRange?: [number, number] | undefined;
 }>;
 /**
@@ -218,7 +352,7 @@ export declare const SeccompConfigSchema: z.ZodObject<{
 /**
  * Main configuration schema for Sandbox Runtime validation
  */
-export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
+export declare const SandboxRuntimeConfigSchema: z.ZodEffects<z.ZodObject<{
     network: z.ZodObject<{
         allowedDomains: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
         deniedDomains: z.ZodArray<z.ZodUnion<[z.ZodLiteral<"*">, z.ZodEffects<z.ZodString, string, string>]>, "many">;
@@ -243,18 +377,23 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         tlsTerminate: z.ZodOptional<z.ZodEffects<z.ZodObject<{
             caCertPath: z.ZodOptional<z.ZodString>;
             caKeyPath: z.ZodOptional<z.ZodString>;
+            excludeDomains: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
         }, "strip", z.ZodTypeAny, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         }, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         }>, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         }, {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         }>>;
         parentProxy: z.ZodOptional<z.ZodObject<{
             http: z.ZodOptional<z.ZodString>;
@@ -287,6 +426,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         tlsTerminate?: {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -311,6 +451,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         tlsTerminate?: {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -319,6 +460,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         } | undefined;
     }>;
     filesystem: z.ZodObject<{
+        disabled: z.ZodOptional<z.ZodBoolean>;
         denyRead: z.ZodArray<z.ZodString, "many">;
         allowRead: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         allowWrite: z.ZodArray<z.ZodString, "many">;
@@ -328,15 +470,70 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         denyRead: string[];
         allowWrite: string[];
         denyWrite: string[];
+        disabled?: boolean | undefined;
         allowRead?: string[] | undefined;
         allowGitConfig?: boolean | undefined;
     }, {
         denyRead: string[];
         allowWrite: string[];
         denyWrite: string[];
+        disabled?: boolean | undefined;
         allowRead?: string[] | undefined;
         allowGitConfig?: boolean | undefined;
     }>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            mode: z.ZodEnum<["deny", "mask"]>;
+            injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }, {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }>, "many">>;
+        envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            mode: z.ZodEnum<["deny", "mask"]>;
+            injectHosts: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }, {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }>, "many">>;
+        allowPlaintextInject: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        files?: {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        envVars?: {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        allowPlaintextInject?: boolean | undefined;
+    }, {
+        files?: {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        envVars?: {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        allowPlaintextInject?: boolean | undefined;
+    }>>;
     ignoreViolations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
     enableWeakerNestedSandbox: z.ZodOptional<z.ZodBoolean>;
     enableWeakerNetworkIsolation: z.ZodOptional<z.ZodBoolean>;
@@ -373,9 +570,11 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         groupName: z.ZodDefault<z.ZodString>;
         groupSid: z.ZodOptional<z.ZodString>;
         wfpSublayerGuid: z.ZodOptional<z.ZodString>;
+        asSandboxUser: z.ZodDefault<z.ZodBoolean>;
         proxyPortRange: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
     }, "strip", z.ZodTypeAny, {
         groupName: string;
+        asSandboxUser: boolean;
         groupSid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
         proxyPortRange?: [number, number] | undefined;
@@ -383,6 +582,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         groupName?: string | undefined;
         groupSid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
+        asSandboxUser?: boolean | undefined;
         proxyPortRange?: [number, number] | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
@@ -404,6 +604,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         tlsTerminate?: {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -415,9 +616,23 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         denyRead: string[];
         allowWrite: string[];
         denyWrite: string[];
+        disabled?: boolean | undefined;
         allowRead?: string[] | undefined;
         allowGitConfig?: boolean | undefined;
     };
+    credentials?: {
+        files?: {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        envVars?: {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        allowPlaintextInject?: boolean | undefined;
+    } | undefined;
     ignoreViolations?: Record<string, string[]> | undefined;
     enableWeakerNestedSandbox?: boolean | undefined;
     enableWeakerNetworkIsolation?: boolean | undefined;
@@ -438,6 +653,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
     socatPath?: string | undefined;
     windows?: {
         groupName: string;
+        asSandboxUser: boolean;
         groupSid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
         proxyPortRange?: [number, number] | undefined;
@@ -461,6 +677,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         tlsTerminate?: {
             caCertPath?: string | undefined;
             caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
         } | undefined;
         parentProxy?: {
             http?: string | undefined;
@@ -472,9 +689,169 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         denyRead: string[];
         allowWrite: string[];
         denyWrite: string[];
+        disabled?: boolean | undefined;
         allowRead?: string[] | undefined;
         allowGitConfig?: boolean | undefined;
     };
+    credentials?: {
+        files?: {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        envVars?: {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        allowPlaintextInject?: boolean | undefined;
+    } | undefined;
+    ignoreViolations?: Record<string, string[]> | undefined;
+    enableWeakerNestedSandbox?: boolean | undefined;
+    enableWeakerNetworkIsolation?: boolean | undefined;
+    allowAppleEvents?: boolean | undefined;
+    ripgrep?: {
+        command: string;
+        args?: string[] | undefined;
+        argv0?: string | undefined;
+    } | undefined;
+    mandatoryDenySearchDepth?: number | undefined;
+    allowPty?: boolean | undefined;
+    allowBrowserProcess?: boolean | undefined;
+    seccomp?: {
+        argv0?: string | undefined;
+        applyPath?: string | undefined;
+    } | undefined;
+    bwrapPath?: string | undefined;
+    socatPath?: string | undefined;
+    windows?: {
+        groupName?: string | undefined;
+        groupSid?: string | undefined;
+        wfpSublayerGuid?: string | undefined;
+        asSandboxUser?: boolean | undefined;
+        proxyPortRange?: [number, number] | undefined;
+    } | undefined;
+}>, {
+    network: {
+        allowedDomains: string[];
+        deniedDomains: string[];
+        strictAllowlist?: boolean | undefined;
+        allowUnixSockets?: string[] | undefined;
+        allowAllUnixSockets?: boolean | undefined;
+        allowLocalBinding?: boolean | undefined;
+        allowMachLookup?: string[] | undefined;
+        httpProxyPort?: number | undefined;
+        socksProxyPort?: number | undefined;
+        mitmProxy?: {
+            socketPath: string;
+            domains: string[];
+        } | undefined;
+        filterRequest?: FilterRequestCallback | undefined;
+        tlsTerminate?: {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
+        } | undefined;
+        parentProxy?: {
+            http?: string | undefined;
+            https?: string | undefined;
+            noProxy?: string | undefined;
+        } | undefined;
+    };
+    filesystem: {
+        denyRead: string[];
+        allowWrite: string[];
+        denyWrite: string[];
+        disabled?: boolean | undefined;
+        allowRead?: string[] | undefined;
+        allowGitConfig?: boolean | undefined;
+    };
+    credentials?: {
+        files?: {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        envVars?: {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        allowPlaintextInject?: boolean | undefined;
+    } | undefined;
+    ignoreViolations?: Record<string, string[]> | undefined;
+    enableWeakerNestedSandbox?: boolean | undefined;
+    enableWeakerNetworkIsolation?: boolean | undefined;
+    allowAppleEvents?: boolean | undefined;
+    ripgrep?: {
+        command: string;
+        args?: string[] | undefined;
+        argv0?: string | undefined;
+    } | undefined;
+    mandatoryDenySearchDepth?: number | undefined;
+    allowPty?: boolean | undefined;
+    allowBrowserProcess?: boolean | undefined;
+    seccomp?: {
+        argv0?: string | undefined;
+        applyPath?: string | undefined;
+    } | undefined;
+    bwrapPath?: string | undefined;
+    socatPath?: string | undefined;
+    windows?: {
+        groupName: string;
+        asSandboxUser: boolean;
+        groupSid?: string | undefined;
+        wfpSublayerGuid?: string | undefined;
+        proxyPortRange?: [number, number] | undefined;
+    } | undefined;
+}, {
+    network: {
+        allowedDomains: string[];
+        deniedDomains: string[];
+        strictAllowlist?: boolean | undefined;
+        allowUnixSockets?: string[] | undefined;
+        allowAllUnixSockets?: boolean | undefined;
+        allowLocalBinding?: boolean | undefined;
+        allowMachLookup?: string[] | undefined;
+        httpProxyPort?: number | undefined;
+        socksProxyPort?: number | undefined;
+        mitmProxy?: {
+            socketPath: string;
+            domains: string[];
+        } | undefined;
+        filterRequest?: FilterRequestCallback | undefined;
+        tlsTerminate?: {
+            caCertPath?: string | undefined;
+            caKeyPath?: string | undefined;
+            excludeDomains?: string[] | undefined;
+        } | undefined;
+        parentProxy?: {
+            http?: string | undefined;
+            https?: string | undefined;
+            noProxy?: string | undefined;
+        } | undefined;
+    };
+    filesystem: {
+        denyRead: string[];
+        allowWrite: string[];
+        denyWrite: string[];
+        disabled?: boolean | undefined;
+        allowRead?: string[] | undefined;
+        allowGitConfig?: boolean | undefined;
+    };
+    credentials?: {
+        files?: {
+            mode: "deny" | "mask";
+            path: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        envVars?: {
+            mode: "deny" | "mask";
+            name: string;
+            injectHosts?: string[] | undefined;
+        }[] | undefined;
+        allowPlaintextInject?: boolean | undefined;
+    } | undefined;
     ignoreViolations?: Record<string, string[]> | undefined;
     enableWeakerNestedSandbox?: boolean | undefined;
     enableWeakerNetworkIsolation?: boolean | undefined;
@@ -497,6 +874,7 @@ export declare const SandboxRuntimeConfigSchema: z.ZodObject<{
         groupName?: string | undefined;
         groupSid?: string | undefined;
         wfpSublayerGuid?: string | undefined;
+        asSandboxUser?: boolean | undefined;
         proxyPortRange?: [number, number] | undefined;
     } | undefined;
 }>;
@@ -504,6 +882,10 @@ export type MitmProxyConfig = z.infer<typeof MitmProxyConfigSchema>;
 export type ParentProxyConfig = z.infer<typeof ParentProxyConfigSchema>;
 export type NetworkConfig = z.infer<typeof NetworkConfigSchema>;
 export type FilesystemConfig = z.infer<typeof FilesystemConfigSchema>;
+export type CredentialMode = z.infer<typeof credentialModeSchema>;
+export type CredentialFileConfig = z.infer<typeof CredentialFileConfigSchema>;
+export type CredentialEnvVarConfig = z.infer<typeof CredentialEnvVarConfigSchema>;
+export type CredentialsConfig = z.infer<typeof CredentialsConfigSchema>;
 export type IgnoreViolationsConfig = z.infer<typeof IgnoreViolationsConfigSchema>;
 export type RipgrepConfig = z.infer<typeof RipgrepConfigSchema>;
 export type SeccompConfig = z.infer<typeof SeccompConfigSchema>;

package/dist/sandbox/sandbox-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAgEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoH9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;EAqBjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAsC9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6ErC,CAAA;AAGF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}
+{"version":3,"file":"sandbox-config.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandbox-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAiEvB;;;GAGG;AACH,QAAA,MAAM,qBAAqB;;;;;;;;;EAQzB,CAAA;AAEF;;;;GAIG;AACH,QAAA,MAAM,uBAAuB;;;;;;;;;;;;EAoB3B,CAAA;AAEF;;;;;;;;;GASG;AACH,QAAA,MAAM,oBAAoB,6BAA2B,CAAA;AAcrD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAerC,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;EAcvC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBzB,CAAA;AAEX;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqI9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;EAgCjC,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,2DAItC,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAY9B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;EAgD9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;EAa9B,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2NnC,CAAA;AAGJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACjE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA"}