@takaro/helpers 0.0.0-dev.4dbe15b

package/README.md

@@ -0,0 +1,4 @@
+# @takaro/helpers
+
+A collection of helpers, used inside Takaro Functions.
+Published to npm, and used by `@takaro/module-test` to run module code outside Takaro.

package/dist/.source-hash

@@ -0,0 +1 @@
+f24e906a747ddc057f91ffdd966565e64dc6ab9adc078f80a4340dab80306d9c

package/dist/TakaroUserError.d.ts

@@ -0,0 +1,4 @@
+export declare class TakaroUserError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=TakaroUserError.d.ts.map

package/dist/TakaroUserError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TakaroUserError.d.ts","sourceRoot":"","sources":["../src/TakaroUserError.ts"],"names":[],"mappings":"AAAA,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/TakaroUserError.js

@@ -0,0 +1,7 @@
+export class TakaroUserError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TakaroUserError';
+    }
+}
+//# sourceMappingURL=TakaroUserError.js.map

package/dist/TakaroUserError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TakaroUserError.js","sourceRoot":"","sources":["../src/TakaroUserError.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/dist/checkPermission.d.ts

@@ -0,0 +1,23 @@
+import { type PlayerOnGameserverOutputWithRolesDTO } from '@takaro/apiclient';
+export interface CheckPermissionOptions {
+    /** Name or id of the Module that declares the permission; defaults to the executing Module. */
+    module?: string;
+}
+export declare function checkModulePermission(player: PlayerOnGameserverOutputWithRolesDTO, permission: string, moduleId: string | undefined, options?: CheckPermissionOptions): boolean | {
+    module?: import("@takaro/apiclient").PermissionModuleDTO;
+    version?: import("@takaro/apiclient").PermissionVersionDTO;
+    permission: string;
+    friendlyName: string;
+    description: string;
+    canHaveCount?: boolean;
+    id: string;
+    createdAt: import("@takaro/apiclient").NOTDOMAINSCOPEDTakaroModelDTOCreatedAt;
+    updatedAt: import("@takaro/apiclient").NOTDOMAINSCOPEDTakaroModelDTOCreatedAt;
+    count: number;
+};
+/**
+ * Checks a permission of this Module, or of the Module named in `options.module`.
+ * Returns the permission with its `count` when held, `true` for ROOT, `false` otherwise.
+ */
+export declare function checkPermission(player: PlayerOnGameserverOutputWithRolesDTO, permission: string, options?: CheckPermissionOptions): any;
+//# sourceMappingURL=checkPermission.d.ts.map

package/dist/checkPermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkPermission.d.ts","sourceRoot":"","sources":["../src/checkPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,oCAAoC,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oCAAoC,EAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,CAAC,EAAE,sBAAsB;;;;;;;;;;;EAkBjC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,oCAAoC,EAC5C,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,sBAAsB,GAE/B,GAAG,CAIL"}

package/dist/checkPermission.js

@@ -0,0 +1,26 @@
+// GH #4686: a Module only sees grants on its own permissions, plus ROOT; no moduleId means ROOT only.
+// GH #4898: naming another Module in `options.module` reads that Module's grant instead.
+export function checkModulePermission(player, permission, moduleId, options) {
+    const grants = player.roles.flatMap((assignment) => assignment.role.permissions);
+    const named = options?.module;
+    const ownedBy = (module) => named ? module?.id === named || module?.name === named : !!moduleId && module?.id === moduleId;
+    const held = grants
+        .filter((g) => g.permission.permission === permission && ownedBy(g.permission.module))
+        .sort((a, b) => b.count - a.count)
+        .at(0);
+    if (held) {
+        return { ...held.permission, count: held.count };
+    }
+    if (grants.some((g) => g.permission.permission === 'ROOT' && !g.permission.module)) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Checks a permission of this Module, or of the Module named in `options.module`.
+ * Returns the permission with its `count` when held, `true` for ROOT, `false` otherwise.
+ */
+export function checkPermission(player, permission, options) {
+    throw new Error(`checkPermission(pog ${player.id}, '${permission}', ${JSON.stringify(options)}) only runs inside Module code`);
+}
+//# sourceMappingURL=checkPermission.js.map

package/dist/checkPermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkPermission.js","sourceRoot":"","sources":["../src/checkPermission.ts"],"names":[],"mappings":"AAOA,sGAAsG;AACtG,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACnC,MAA4C,EAC5C,UAAkB,EAClB,QAA4B,EAC5B,OAAgC;IAEhC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,MAAqC,EAAE,EAAE,CACxD,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,MAAM,EAAE,EAAE,KAAK,QAAQ,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACrF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,EAAE,CAAC,CAAC,CAAC,CAAC;IAET,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA4C,EAC5C,UAAkB,EAClB,OAAgC;IAGhC,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,CAAC,EAAE,MAAM,UAAU,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,gCAAgC,CAC9G,CAAC;AACJ,CAAC"}

package/dist/egress.d.ts

@@ -0,0 +1,21 @@
+import axios, { type AxiosInstance, type CreateAxiosDefaults } from 'axios';
+export declare const EGRESS_DENIED_REASON = "egress-denied";
+export declare class EgressDeniedError extends Error {
+    constructor(message: string);
+}
+export declare function parseAllowedHosts(raw: string): string[];
+export interface GuardedAxiosOptions {
+    apiUrl: string;
+    allowedHosts: readonly string[];
+    maxResponseBytes?: number;
+    maxConcurrentRequests?: number;
+    egressProxyUrl?: string;
+    onDenied(message: string): void;
+}
+declare const CARRIED_STATICS: readonly ['AxiosError', 'CanceledError', 'Cancel', 'CancelToken', 'isCancel', 'isAxiosError', 'all', 'spread', 'toFormData', 'formToJSON', 'AxiosHeaders', 'HttpStatusCode', 'VERSION'];
+export type GuardedAxiosInstance = AxiosInstance & Pick<typeof axios, (typeof CARRIED_STATICS)[number]> & {
+    create(config?: CreateAxiosDefaults): GuardedAxiosInstance;
+};
+export declare function createGuardedAxios(opts: GuardedAxiosOptions): GuardedAxiosInstance;
+export {};
+//# sourceMappingURL=egress.d.ts.map

package/dist/egress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../src/egress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAqB,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAK/F,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAEpD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAaD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAcvD;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAGD,QAAA,MAAM,eAAe,YACnB,YAAY,EACZ,eAAe,EACf,QAAQ,EACR,aAAa,EACb,UAAU,EACV,cAAc,EACd,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,SAAS,CACD,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAC9C,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG;IACrD,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,oBAAoB,CAAC;CAC5D,CAAC;AAEJ,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,oBAAoB,CA2GlF"}

package/dist/egress.js

@@ -0,0 +1,151 @@
+import axios from 'axios';
+import { HttpsProxyAgent } from 'https-proxy-agent';
+// Author-facing half of sandbox egress (GH #4020, ADR 0027); enforced separately by the
+// CiliumNetworkPolicy in deploy/charts/takaro/templates/module-runner/network-policy.yaml.
+export const EGRESS_DENIED_REASON = 'egress-denied';
+export class EgressDeniedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'EgressDeniedError';
+    }
+}
+// Exact hostnames only: a wildcard would need a Cilium DNS matchPattern, which reopens DNS-label
+// exfiltration (gettakaro/cloud ADR 0014) and splits this check from the network policy.
+const ALLOWED_HOST = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+// The sandbox API URL is written absolute (trailing dot) because of resolver ndots:5; compare past it.
+function normaliseHost(host) {
+    const lower = host.toLowerCase();
+    return lower.endsWith('.') ? lower.slice(0, -1) : lower;
+}
+// Throws on a malformed entry: an allowlist typo must fail boot, not silently narrow egress.
+export function parseAllowedHosts(raw) {
+    return raw
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter((entry) => entry !== '')
+        .map((entry) => {
+        if (!ALLOWED_HOST.test(entry)) {
+            throw new Error(`'${entry}' is not a valid egress allowlist entry: bare, exact, lowercase hostnames only — ` +
+                'no scheme, no port, no path, no wildcard');
+        }
+        return entry;
+    });
+}
+// Deliberately not carried: default, Axios, getAdapter and create; each leads back to an unguarded instance.
+const CARRIED_STATICS = [
+    'AxiosError',
+    'CanceledError',
+    'Cancel',
+    'CancelToken',
+    'isCancel',
+    'isAxiosError',
+    'all',
+    'spread',
+    'toFormData',
+    'formToJSON',
+    'AxiosHeaders',
+    'HttpStatusCode',
+    'VERSION',
+];
+export function createGuardedAxios(opts) {
+    const apiHost = normaliseHost(new URL(opts.apiUrl).hostname);
+    const allowed = new Set([apiHost, ...opts.allowedHosts.map((host) => normaliseHost(host))]);
+    const proxyAgent = opts.egressProxyUrl === undefined ? undefined : new HttpsProxyAgent(opts.egressProxyUrl);
+    // One budget shared by every create() descendant, so a derived instance cannot reset the cap.
+    let inFlight = 0;
+    // Requests past the cap wait their turn rather than fail: built-in Modules fan out with Promise.all.
+    const waiting = [];
+    const acquire = async () => {
+        if (opts.maxConcurrentRequests === undefined || inFlight < opts.maxConcurrentRequests) {
+            inFlight += 1;
+            return;
+        }
+        await new Promise((resolve) => waiting.push(resolve));
+    };
+    // A freed slot passes straight to the next waiter, so a newcomer cannot jump the queue.
+    const release = () => {
+        const next = waiting.shift();
+        if (next) {
+            next();
+        }
+        else {
+            inFlight -= 1;
+        }
+    };
+    // The slot is held around the adapter call itself, so every settled request frees it, whatever it threw.
+    // A re-sent `error.config` carries an adapter wrapped here already; unwrap it, or it would need two slots.
+    const unthrottled = new WeakMap();
+    const throttled = (adapter) => {
+        const inner = unthrottled.get(adapter) ?? adapter;
+        const wrapped = async (config) => {
+            await acquire();
+            try {
+                return await inner(config);
+            }
+            finally {
+                release();
+            }
+        };
+        unthrottled.set(wrapped, inner);
+        return wrapped;
+    };
+    const deny = (message) => {
+        opts.onDenied(message);
+        throw new EgressDeniedError(message);
+    };
+    const build = (defaults) => {
+        const instance = axios.create({
+            ...defaults,
+            maxRedirects: 0,
+            proxy: false,
+            ...(opts.maxResponseBytes === undefined
+                ? {}
+                : { maxContentLength: opts.maxResponseBytes, maxBodyLength: opts.maxResponseBytes }),
+        });
+        instance.interceptors.request.use((config) => {
+            const target = new URL(config.url ?? '', config.baseURL);
+            const host = normaliseHost(target.hostname);
+            if (!allowed.has(host)) {
+                deny(`Host "${host}" is not allowed from Modules. Ask an operator to add it to the Takaro egress allowlist.`);
+            }
+            const proxied = proxyAgent !== undefined && host !== apiHost;
+            // The proxy tunnels TLS and checks its SNI; it refuses everything else.
+            if (proxied && target.protocol !== 'https:') {
+                deny(`"${target.protocol}//${host}" is not allowed from Modules: external hosts are reachable over https:// only.`);
+            }
+            // Re-applied per request: instance defaults and per-call config are caller-controlled.
+            const hardened = config;
+            config.maxRedirects = 0;
+            config.proxy = false;
+            config.adapter = throttled(typeof config.adapter === 'function' ? config.adapter : axios.getAdapter('http'));
+            for (const key of [
+                'socketPath',
+                'httpAgent',
+                'httpsAgent',
+                'transport',
+                'lookup',
+                'beforeRedirect',
+                'httpVersion',
+                'http2Options',
+            ]) {
+                delete hardened[key];
+            }
+            // After the deletion above, so nothing the Module passed can replace it.
+            if (proxied) {
+                config.httpsAgent = proxyAgent;
+            }
+            if (opts.maxResponseBytes !== undefined) {
+                config.maxContentLength = opts.maxResponseBytes;
+                config.maxBodyLength = opts.maxResponseBytes;
+            }
+            return config;
+        });
+        for (const key of CARRIED_STATICS) {
+            Reflect.set(instance, key, Reflect.get(axios, key));
+        }
+        instance.create = (config) => build(config);
+        return instance;
+    };
+    return build();
+}
+//# sourceMappingURL=egress.js.map

package/dist/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../src/egress.ts"],"names":[],"mappings":"AAAA,OAAO,KAA0E,MAAM,OAAO,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,wFAAwF;AACxF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAEpD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,iGAAiG;AACjG,yFAAyF;AACzF,MAAM,YAAY,GAAG,mEAAmE,CAAC;AAEzF,uGAAuG;AACvG,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;SAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,IAAI,KAAK,mFAAmF;gBAC1F,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC;AAYD,6GAA6G;AAC7G,MAAM,eAAe,GAAG;IACtB,YAAY;IACZ,eAAe;IACf,QAAQ;IACR,aAAa;IACb,UAAU;IACV,cAAc;IACd,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,SAAS;CACD,CAAC;AAOX,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE5G,8FAA8F;IAC9F,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,qGAAqG;IACrG,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,IAAI,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtF,QAAQ,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,wFAAwF;IACxF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IACF,yGAAyG;IACzG,2GAA2G;IAC3G,MAAM,WAAW,GAAG,IAAI,OAAO,EAA8B,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,OAAqB,EAAgB,EAAE;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QAClD,MAAM,OAAO,GAAiB,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;oBAAS,CAAC;gBACT,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;QACtC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,QAA8B,EAAwB,EAAE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,GAAG,QAAQ;YACX,YAAY,EAAE,CAAC;YACf,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;SACvF,CAAyB,CAAC;QAE3B,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,SAAS,IAAI,0FAA0F,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC;YAC7D,wEAAwE;YACxE,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC5C,IAAI,CACF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,iFAAiF,CAC9G,CAAC;YACJ,CAAC;YACD,uFAAuF;YACvF,MAAM,QAAQ,GAAG,MAA4C,CAAC;YAC9D,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;YACxB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7G,KAAK,MAAM,GAAG,IAAI;gBAChB,YAAY;gBACZ,WAAW;gBACX,YAAY;gBACZ,WAAW;gBACX,QAAQ;gBACR,gBAAgB;gBAChB,aAAa;gBACb,cAAc;aACf,EAAE,CAAC;gBACF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,yEAAyE;YACzE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;YACjC,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;gBAChD,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC;YAC/C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,QAAQ,CAAC,MAAM,GAAG,CAAC,MAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,CAAC;AACjB,CAAC"}

package/dist/executeVM.d.ts

@@ -0,0 +1,28 @@
+import type { Client } from '@takaro/apiclient';
+export interface VMExecutionResult {
+    success: boolean;
+    logs: Array<{
+        msg: string;
+        details?: Record<string, unknown> | string;
+    }>;
+    reason?: string;
+}
+export interface VMExecutionOptions {
+    fn: string;
+    data: Record<string, any>;
+    userModules: Array<{
+        name: string;
+        code: string;
+    }>;
+    clientOverride?: Client;
+    contextOverride?: Record<string, unknown>;
+    apiUrl?: string;
+    allowedHosts?: readonly string[];
+    maxResponseBytes?: number;
+    maxConcurrentRequests?: number;
+    egressProxyUrl?: string;
+    timeoutMs?: number;
+    onLog?: (entry: VMExecutionResult['logs'][number]) => void;
+}
+export declare function executeVM(opts: VMExecutionOptions): Promise<VMExecutionResult>;
+//# sourceMappingURL=executeVM.d.ts.map

package/dist/executeVM.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executeVM.d.ts","sourceRoot":"","sources":["../src/executeVM.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;CAC5D;AAID,wBAAsB,SAAS,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyKpF"}

package/dist/executeVM.js

@@ -0,0 +1,138 @@
+import { getTakaro } from './getTakaro.js';
+import { checkModulePermission } from './checkPermission.js';
+import { TakaroUserError } from './TakaroUserError.js';
+import { nextCronJobRun } from './nextCronJobRun.js';
+import { createGuardedAxios, EGRESS_DENIED_REASON } from './egress.js';
+import { DEADLINE_EXCEEDED_REASON } from './executionLimits.js';
+import * as _ from 'lodash-es';
+import axios from 'axios';
+import vm from 'node:vm';
+const SCRIPT_TIMEOUT_CODE = 'ERR_SCRIPT_EXECUTION_TIMEOUT';
+export async function executeVM(opts) {
+    const { fn, data, userModules, clientOverride, contextOverride, apiUrl, allowedHosts, maxResponseBytes, maxConcurrentRequests, egressProxyUrl, timeoutMs, onLog, } = opts;
+    const logs = [];
+    const denials = [];
+    function emitLog(entry) {
+        if (onLog) {
+            onLog(entry);
+        }
+        else {
+            logs.push(entry);
+        }
+    }
+    const guardedAxios = apiUrl !== undefined && allowedHosts !== undefined
+        ? createGuardedAxios({
+            apiUrl,
+            allowedHosts,
+            maxResponseBytes,
+            maxConcurrentRequests,
+            egressProxyUrl,
+            onDenied: (message) => {
+                denials.push(message);
+                emitLog({ msg: `${EGRESS_DENIED_REASON}: ${message}`, details: EGRESS_DENIED_REASON });
+            },
+        })
+        : undefined;
+    const moduleAxios = guardedAxios ?? axios;
+    function pushLog(...args) {
+        emitLog({ msg: args[0], details: { args: args.slice(1) } });
+    }
+    const patchedConsole = {
+        log: pushLog,
+        error: pushLog,
+        warn: pushLog,
+        info: pushLog,
+        debug: pushLog,
+    };
+    const contextifiedObject = vm.createContext({
+        console: patchedConsole,
+        ...contextOverride,
+    });
+    const toEval = new vm.SourceTextModule(fn, { context: contextifiedObject });
+    // Deadline covers linking too: a user module's top-level code evaluates during LINKING.
+    const startedAt = Date.now();
+    const evaluateOptions = () => timeoutMs === undefined ? undefined : { timeout: Math.max(1, timeoutMs - (Date.now() - startedAt)) };
+    const deadlineResult = () => {
+        emitLog({
+            msg: `${DEADLINE_EXCEEDED_REASON}: the Execution did not finish within ${timeoutMs} ms`,
+            details: DEADLINE_EXCEEDED_REASON,
+        });
+        return { logs, success: false, reason: DEADLINE_EXCEEDED_REASON };
+    };
+    const { takaro, data: hydratedData } = getTakaro(data, patchedConsole, clientOverride, guardedAxios && ((config) => guardedAxios.create(config)));
+    const monkeyPatchedGetData = () => {
+        return hydratedData;
+    };
+    const monkeyPatchedGetTakaro = function () {
+        return takaro;
+    };
+    const scopedCheckPermission = (pog, permission, options) => checkModulePermission(pog, permission, data.module?.moduleId, options);
+    try {
+        await link();
+    }
+    catch (error) {
+        if (error.code === SCRIPT_TIMEOUT_CODE) {
+            return deadlineResult();
+        }
+        throw error;
+    }
+    function link() {
+        return toEval.link(async (specifier, referencingModule) => {
+            const takaroHelpersModule = new vm.SyntheticModule([
+                'getTakaro',
+                'checkPermission',
+                'TakaroUserError',
+                'getData',
+                'axios',
+                '_',
+                'lodash',
+                'nextCronJobRun',
+                'takaro',
+                'data',
+            ], function () {
+                this.setExport('getTakaro', monkeyPatchedGetTakaro);
+                this.setExport('checkPermission', scopedCheckPermission);
+                this.setExport('TakaroUserError', TakaroUserError);
+                this.setExport('getData', monkeyPatchedGetData);
+                this.setExport('axios', moduleAxios);
+                this.setExport('_', _);
+                this.setExport('lodash', _);
+                this.setExport('nextCronJobRun', nextCronJobRun);
+                this.setExport('takaro', takaro);
+                this.setExport('data', hydratedData);
+            }, { context: referencingModule.context });
+            if (specifier === '@takaro/helpers') {
+                return takaroHelpersModule;
+            }
+            const userModuleData = userModules.find((m) => `./${m.name}.js` === specifier);
+            if (userModuleData) {
+                const userModule = new vm.SourceTextModule(userModuleData.code, { context: referencingModule.context });
+                await userModule.link(() => {
+                    return takaroHelpersModule;
+                });
+                await userModule.evaluate(evaluateOptions());
+                return userModule;
+            }
+            throw new Error(`Unable to resolve dependency: ${specifier}`);
+        });
+    }
+    try {
+        await toEval.evaluate(evaluateOptions());
+        return {
+            logs,
+            success: true,
+        };
+    }
+    catch (error) {
+        emitLog({ msg: error.message, details: error.stack });
+        if (error.code === SCRIPT_TIMEOUT_CODE) {
+            return deadlineResult();
+        }
+        return {
+            logs,
+            success: false,
+            reason: denials.length > 0 ? EGRESS_DENIED_REASON : undefined,
+        };
+    }
+}
+//# sourceMappingURL=executeVM.js.map

package/dist/executeVM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executeVM.js","sourceRoot":"","sources":["../src/executeVM.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAA+B,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAA6B,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,CAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,KAAmC,MAAM,OAAO,CAAC;AACxD,OAAO,EAAE,MAAM,SAAS,CAAC;AA0BzB,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAwB;IACtD,MAAM,EACJ,EAAE,EACF,IAAI,EACJ,WAAW,EACX,cAAc,EACd,eAAe,EACf,MAAM,EACN,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,KAAK,GACN,GAAG,IAAI,CAAC;IAET,MAAM,IAAI,GAA8B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,SAAS,OAAO,CAAC,KAAwC;QACvD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAChB,MAAM,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAChD,CAAC,CAAC,kBAAkB,CAAC;YACjB,MAAM;YACN,YAAY;YACZ,gBAAgB;YAChB,qBAAqB;YACrB,cAAc;YACd,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;gBACpB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,oBAAoB,KAAK,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzF,CAAC;SACF,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,WAAW,GAAG,YAAY,IAAI,KAAK,CAAC;IAE1C,SAAS,OAAO,CAAC,GAAG,IAAc;QAChC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;KACf,CAAC;IAEF,MAAM,kBAAkB,GAAG,EAAE,CAAC,aAAa,CAAC;QAC1C,OAAO,EAAE,cAAc;QACvB,GAAG,eAAe;KACnB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE5E,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,eAAe,GAAG,GAAG,EAAE,CAC3B,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC;IAEvG,MAAM,cAAc,GAAG,GAAsB,EAAE;QAC7C,OAAO,CAAC;YACN,GAAG,EAAE,GAAG,wBAAwB,yCAAyC,SAAS,KAAK;YACvF,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACpE,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,SAAS,CAC9C,IAAI,EACJ,cAAc,EACd,cAAc,EACd,YAAY,IAAI,CAAC,CAAC,MAA2B,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAC/E,CAAC;IAEF,MAAM,oBAAoB,GAAG,GAAG,EAAE;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,sBAAsB,GAAG;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,CAC5B,GAAgD,EAChD,UAAkB,EAClB,OAAgC,EAChC,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE5E,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2B,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC9D,OAAO,cAAc,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,SAAS,IAAI;QACX,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAiB,EAAE,iBAAiB,EAAE,EAAE;YAChE,MAAM,mBAAmB,GAAG,IAAI,EAAE,CAAC,eAAe,CAChD;gBACE,WAAW;gBACX,iBAAiB;gBACjB,iBAAiB;gBACjB,SAAS;gBACT,OAAO;gBACP,GAAG;gBACH,QAAQ;gBACR,gBAAgB;gBAChB,QAAQ;gBACR,MAAM;aACP,EACD;gBACE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;gBACpD,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;gBACzD,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;gBACnD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;gBAChD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACrC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;gBACjD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACjC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACvC,CAAC,EACD,EAAE,OAAO,EAAE,iBAAiB,CAAC,OAAO,EAAE,CACvC,CAAC;YAEF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;gBACpC,OAAO,mBAAmB,CAAC;YAC7B,CAAC;YACD,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC;YAC/E,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;oBACzB,OAAO,mBAAmB,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,MAAM,UAAU,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;gBAC7C,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;QACzC,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,EAAE,GAAG,EAAG,KAAe,CAAC,OAAO,EAAE,OAAO,EAAG,KAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,IAAK,KAA2B,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC9D,OAAO,cAAc,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/executionLimits.d.ts

@@ -0,0 +1,3 @@
+export declare const DEADLINE_EXCEEDED_REASON = "deadline-exceeded";
+export declare const MEMORY_EXCEEDED_REASON = "memory-exceeded";
+//# sourceMappingURL=executionLimits.d.ts.map

package/dist/executionLimits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionLimits.d.ts","sourceRoot":"","sources":["../src/executionLimits.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,sBAAsB,oBAAoB,CAAC"}

package/dist/executionLimits.js

@@ -0,0 +1,5 @@
+// Execution limit result reasons (GH #4021, ADR 0027); kept equal to the import-free copy in
+// packages/app-api/src/executors/executionReasons.ts by a unit test.
+export const DEADLINE_EXCEEDED_REASON = 'deadline-exceeded';
+export const MEMORY_EXCEEDED_REASON = 'memory-exceeded';
+//# sourceMappingURL=executionLimits.js.map

package/dist/executionLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionLimits.js","sourceRoot":"","sources":["../src/executionLimits.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC"}

package/dist/getTakaro.d.ts

@@ -0,0 +1,7 @@
+import { Client } from '@takaro/apiclient';
+import type { AxiosInstance, AxiosRequestConfig } from 'axios';
+export declare function getTakaro(data: Record<string, any>, logger?: Pick<Console, 'log' | 'debug' | 'error' | 'warn' | 'info'>, clientOverride?: Client, axiosFactory?: (config: AxiosRequestConfig) => AxiosInstance): {
+    takaro: Client;
+    data: Record<string, any>;
+};
+//# sourceMappingURL=getTakaro.d.ts.map

package/dist/getTakaro.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getTakaro.d.ts","sourceRoot":"","sources":["../src/getTakaro.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAE/D,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,EACnE,cAAc,CAAC,EAAE,MAAM,EAEvB,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,aAAa,GAC3D;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAkC/C"}

package/dist/getTakaro.js

@@ -0,0 +1,33 @@
+import { Client } from '@takaro/apiclient';
+export function getTakaro(data, logger, clientOverride, 
+// Sandbox passes its guarded axios, so the GH #4021 caps cover `takaro.*()` too.
+axiosFactory) {
+    const takaro = clientOverride ??
+        new Client({
+            url: data.url,
+            auth: {
+                token: data.token,
+            },
+            log: logger ? logger : console,
+            axiosFactory,
+        });
+    takaro.setHeader('X-Takaro-Module', data.module.moduleId);
+    if (data.pog) {
+        const sendPmToPlayer = async (message) => {
+            return takaro.gameserver.gameServerControllerSendMessage(data.gameServerId, {
+                message,
+                opts: {
+                    recipient: {
+                        gameId: data.pog.gameId,
+                    },
+                },
+            });
+        };
+        data.pog.pm = sendPmToPlayer;
+        if (data.player) {
+            data.player.pm = sendPmToPlayer;
+        }
+    }
+    return { takaro, data };
+}
+//# sourceMappingURL=getTakaro.js.map

package/dist/getTakaro.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getTakaro.js","sourceRoot":"","sources":["../src/getTakaro.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG3C,MAAM,UAAU,SAAS,CACvB,IAAyB,EACzB,MAAmE,EACnE,cAAuB;AACvB,iFAAiF;AACjF,YAA4D;IAE5D,MAAM,MAAM,GACV,cAAc;QACd,IAAI,MAAM,CAAC;YACT,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE;gBACJ,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;YACD,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAC9B,YAAY;SACb,CAAC,CAAC;IAEL,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE1D,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,cAAc,GAAG,KAAK,EAAE,OAAe,EAAE,EAAE;YAC/C,OAAO,MAAM,CAAC,UAAU,CAAC,+BAA+B,CAAC,IAAI,CAAC,YAAY,EAAE;gBAC1E,OAAO;gBACP,IAAI,EAAE;oBACJ,SAAS,EAAE;wBACT,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;qBACxB;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,cAAc,CAAC;QAE7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,16 @@
+import { type Client } from '@takaro/apiclient';
+export { getTakaro } from './getTakaro.js';
+export { checkPermission, checkModulePermission } from './checkPermission.js';
+export { nextCronJobRun } from './nextCronJobRun.js';
+export { TakaroUserError } from './TakaroUserError.js';
+export { executeVM } from './executeVM.js';
+export { userModulesOf } from './userModules.js';
+export type { UserModuleSource, ModuleFunctionsData } from './userModules.js';
+export type { VMExecutionResult, VMExecutionOptions } from './executeVM.js';
+export { EGRESS_DENIED_REASON, EgressDeniedError, parseAllowedHosts, createGuardedAxios } from './egress.js';
+export type { GuardedAxiosOptions, GuardedAxiosInstance } from './egress.js';
+export { DEADLINE_EXCEEDED_REASON, MEMORY_EXCEEDED_REASON } from './executionLimits.js';
+export * as _ from 'lodash-es';
+export { default as axios } from 'axios';
+export declare const takaro: Client;
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7G,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,CAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,OAAO,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC;AAEzC,eAAO,MAAM,MAAM,EAAE,MAAgC,CAAC"}

package/dist/main.js

@@ -0,0 +1,12 @@
+export { getTakaro } from './getTakaro.js';
+export { checkPermission, checkModulePermission } from './checkPermission.js';
+export { nextCronJobRun } from './nextCronJobRun.js';
+export { TakaroUserError } from './TakaroUserError.js';
+export { executeVM } from './executeVM.js';
+export { userModulesOf } from './userModules.js';
+export { EGRESS_DENIED_REASON, EgressDeniedError, parseAllowedHosts, createGuardedAxios } from './egress.js';
+export { DEADLINE_EXCEEDED_REASON, MEMORY_EXCEEDED_REASON } from './executionLimits.js';
+export * as _ from 'lodash-es';
+export { default as axios } from 'axios';
+export const takaro = {};
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7G,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,CAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,OAAO,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC;AAEzC,MAAM,CAAC,MAAM,MAAM,GAAW,EAAuB,CAAC"}

package/dist/nextCronJobRun.d.ts

@@ -0,0 +1,2 @@
+export declare const nextCronJobRun: (cron: string) => Date | null;
+//# sourceMappingURL=nextCronJobRun.d.ts.map

package/dist/nextCronJobRun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextCronJobRun.d.ts","sourceRoot":"","sources":["../src/nextCronJobRun.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,IAAI,GAAG,IAEpD,CAAC"}

package/dist/nextCronJobRun.js

@@ -0,0 +1,5 @@
+import croner from 'croner';
+export const nextCronJobRun = (cron) => {
+    return croner.Cron(cron).nextRun();
+};
+//# sourceMappingURL=nextCronJobRun.js.map

package/dist/nextCronJobRun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextCronJobRun.js","sourceRoot":"","sources":["../src/nextCronJobRun.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAe,EAAE;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACrC,CAAC,CAAC"}

package/dist/userModules.d.ts

@@ -0,0 +1,16 @@
+export interface UserModuleSource {
+    name: string;
+    code: string;
+}
+export interface ModuleFunctionsData {
+    module: {
+        version: {
+            functions: ReadonlyArray<{
+                name?: string | null;
+                code: string;
+            }>;
+        };
+    };
+}
+export declare function userModulesOf(data: ModuleFunctionsData): UserModuleSource[];
+//# sourceMappingURL=userModules.d.ts.map

package/dist/userModules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userModules.d.ts","sourceRoot":"","sources":["../src/userModules.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,OAAO,EAAE;YAAE,SAAS,EAAE,aAAa,CAAC;gBAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;CAC3F;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,gBAAgB,EAAE,CAE3E"}

package/dist/userModules.js

@@ -0,0 +1,4 @@
+export function userModulesOf(data) {
+    return data.module.version.functions.filter((f) => f.name).map((f) => ({ name: f.name, code: f.code }));
+}
+//# sourceMappingURL=userModules.js.map

package/dist/userModules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userModules.js","sourceRoot":"","sources":["../src/userModules.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,aAAa,CAAC,IAAyB;IACrD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACpH,CAAC"}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@takaro/helpers",
+  "description": "A collection of helpers, used inside Takaro Functions",
+  "version": "0.0.0-dev.4dbe15b",
+  "author": "",
+  "dependencies": {
+    "@takaro/apiclient": "0.0.0-dev.4dbe15b",
+    "@types/lodash-es": "4.17.12",
+    "axios": "1.7.7",
+    "croner": "8.1.2",
+    "https-proxy-agent": "9.1.0",
+    "lodash-es": "4.17.23"
+  },
+  "keywords": [],
+  "license": "ISC",
+  "main": "dist/main.js",
+  "type": "module",
+  "types": "dist/main.d.ts",
+  "devDependencies": {
+    "@types/node": "24.19.2",
+    "@typescript/native": "npm:typescript@7.0.2",
+    "typescript": "npm:@typescript/typescript6@6.0.2"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p ./tsconfig.build.json",
+    "start:dev": ":"
+  }
+}