@tangle-network/cli-agent-registry 0.0.0-stage → 0.15.0

package/dist/cli-auth-placeholder.mjs

@@ -0,0 +1,200 @@
+import { o as resolveCliAuthReference, r as assertCliAuthReferenceSupported, t as AUTH_BUNDLE_PATHS } from "./cli-auth-bundle-C6DtK7GX.mjs";
+import { i as baseProxyToken, r as declaredSecretSlotTokens } from "./harness-D1fTxnDD.mjs";
+import { z } from "zod";
+//#region src/cli-auth-placeholder.ts
+const identity = z.string().regex(/^[A-Za-z0-9_-]{1,256}$/);
+const token = z.string().min(8).max(64 * 1024).regex(/^[^\s\0]+$/);
+const expiry = z.number().int().positive().max(864e13);
+const codexPlan = z.enum([
+	"free",
+	"plus",
+	"pro",
+	"business",
+	"enterprise",
+	"edu",
+	"team"
+]);
+const claudePlan = z.enum([
+	"free",
+	"pro",
+	"max",
+	"team",
+	"enterprise"
+]);
+const metadataSchema = z.object({
+	accountId: identity.optional(),
+	planType: z.union([codexPlan, claudePlan]).optional(),
+	accessTokenExpiresAt: expiry.optional(),
+	hasRefreshToken: z.boolean()
+}).strict();
+const codexBundle = z.object({ tokens: z.object({
+	access_token: token,
+	refresh_token: z.union([token, z.literal("")]).optional(),
+	id_token: token,
+	account_id: identity.nullable().optional()
+}) });
+const codexClaims = z.object({ "https://api.openai.com/auth": z.object({
+	chatgpt_account_id: identity.optional(),
+	chatgpt_plan_type: codexPlan.optional(),
+	chatgpt_account_is_fedramp: z.boolean().optional()
+}).optional() });
+const claudeBundle = z.object({ claudeAiOauth: z.object({
+	accessToken: token,
+	refreshToken: token.nullable().optional(),
+	expiresAt: expiry.nullable().optional(),
+	subscriptionType: claudePlan.nullable().optional()
+}) });
+function invalidMaterial() {
+	throw new Error("Unsupported or invalid native credential material");
+}
+function parseJson(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return invalidMaterial();
+	}
+}
+function jwtClaims(raw) {
+	const parts = raw.split(".");
+	if (parts.length !== 3 || parts.some((part) => !part)) return invalidMaterial();
+	try {
+		const payload = (parts[1] ?? "").replaceAll("-", "+").replaceAll("_", "/");
+		const bytes = Uint8Array.from(atob(payload), (value) => value.charCodeAt(0));
+		return parseJson(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		return invalidMaterial();
+	}
+}
+function accessTokenExpiry(value) {
+	if (value.split(".").length !== 3) return void 0;
+	const parsed = z.object({ exp: z.number().int().positive().optional() }).safeParse(jwtClaims(value));
+	if (!parsed.success) return invalidMaterial();
+	if (parsed.data.exp === void 0) return void 0;
+	const result = expiry.safeParse(parsed.data.exp * 1e3);
+	if (!result.success) return invalidMaterial();
+	return result.data;
+}
+/** Build sandbox-safe native material without accepting any provider token. */
+function buildCliAuthPlaceholderMaterial(input) {
+	const reference = assertCliAuthReferenceSupported(input.backendType, { cliAuth: input.reference });
+	const metadata = metadataSchema.safeParse(input.metadata);
+	const declaredTokens = Object.values(declaredSecretSlotTokens());
+	if (!reference || !metadata.success || !Number.isFinite(input.now.getTime()) || !declaredTokens.includes(baseProxyToken(input.placeholder)) || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.placeholder)) return invalidMaterial();
+	if (input.backendType !== "codex" && input.backendType !== "claude-code") return invalidMaterial();
+	if (input.backendType === "codex" && reference.format === "token") return invalidMaterial();
+	const { accountId, planType, accessTokenExpiresAt, hasRefreshToken } = metadata.data;
+	let content;
+	if (input.backendType === "codex") {
+		if (planType !== void 0 && !codexPlan.safeParse(planType).success) return invalidMaterial();
+		const claims = {
+			sub: input.placeholder,
+			aud: "tangle-sandbox",
+			exp: Math.floor(input.now.getTime() / 1e3)
+		};
+		content = {
+			auth_mode: "chatgpt",
+			OPENAI_API_KEY: null,
+			tokens: {
+				id_token: `e30.${btoa(JSON.stringify(claims)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "")}.tangle-placeholder`,
+				access_token: input.placeholder,
+				refresh_token: hasRefreshToken ? input.placeholder : "",
+				...accountId ? { account_id: accountId } : {}
+			},
+			last_refresh: input.now.toISOString()
+		};
+	} else {
+		if (planType !== void 0 && !claudePlan.safeParse(planType).success) return invalidMaterial();
+		content = { claudeAiOauth: {
+			accessToken: input.placeholder,
+			refreshToken: hasRefreshToken ? input.placeholder : null,
+			expiresAt: accessTokenExpiresAt ?? null,
+			scopes: ["user:inference"],
+			subscriptionType: planType ?? null,
+			rateLimitTier: null
+		} };
+	}
+	return {
+		reference,
+		authFiles: [{
+			path: AUTH_BUNDLE_PATHS[input.backendType],
+			content: JSON.stringify(content),
+			mode: 384
+		}],
+		tokenEnvironment: {}
+	};
+}
+/**
+* TRUSTED OWNER ONLY. The explicit proxyAccessToken result must reach only the
+* host's existing egress holder. Only nativeMaterial may enter the sandbox.
+* The uploaded bundle, ID token and refresh token are never returned.
+*/
+function resolveCliAuthPlaceholder(input) {
+	if (input.secretValue.length > 1024 * 1024) return invalidMaterial();
+	const material = resolveCliAuthReference(input.backendType, { cliAuth: input.reference }, { [input.reference.secretEnv]: input.secretValue });
+	if (!material) return invalidMaterial();
+	let proxyAccessToken;
+	let metadata;
+	let credentials;
+	if (input.backendType === "claude-code" && material.reference.format === "token") {
+		const parsed = token.safeParse(Object.values(material.tokenEnvironment)[0]);
+		if (!parsed.success) return invalidMaterial();
+		proxyAccessToken = parsed.data;
+		credentials = [proxyAccessToken];
+		metadata = { hasRefreshToken: false };
+	} else {
+		const expectedPath = input.backendType === "codex" ? AUTH_BUNDLE_PATHS.codex : AUTH_BUNDLE_PATHS["claude-code"];
+		if (material.authFiles.length !== 1 || material.authFiles[0]?.path !== expectedPath) return invalidMaterial();
+		const bundle = parseJson(material.authFiles[0].content);
+		if (input.backendType === "codex") {
+			const parsed = codexBundle.safeParse(bundle);
+			if (!parsed.success) return invalidMaterial();
+			const tokens = parsed.data.tokens;
+			const parsedClaims = codexClaims.safeParse(jwtClaims(tokens.id_token));
+			if (!parsedClaims.success) return invalidMaterial();
+			const claims = parsedClaims.data["https://api.openai.com/auth"];
+			if (claims?.chatgpt_account_is_fedramp) return invalidMaterial();
+			if (tokens.account_id && claims?.chatgpt_account_id && tokens.account_id !== claims.chatgpt_account_id) return invalidMaterial();
+			proxyAccessToken = tokens.access_token;
+			credentials = [
+				proxyAccessToken,
+				tokens.id_token,
+				tokens.refresh_token ?? ""
+			];
+			metadata = {
+				accountId: tokens.account_id ?? claims?.chatgpt_account_id,
+				planType: claims?.chatgpt_plan_type,
+				accessTokenExpiresAt: accessTokenExpiry(proxyAccessToken),
+				hasRefreshToken: Boolean(tokens.refresh_token)
+			};
+		} else if (input.backendType === "claude-code") {
+			const parsed = claudeBundle.safeParse(bundle);
+			if (!parsed.success) return invalidMaterial();
+			const oauth = parsed.data.claudeAiOauth;
+			proxyAccessToken = oauth.accessToken;
+			credentials = [proxyAccessToken, oauth.refreshToken ?? ""];
+			metadata = {
+				planType: oauth.subscriptionType ?? void 0,
+				accessTokenExpiresAt: oauth.expiresAt ?? void 0,
+				hasRefreshToken: Boolean(oauth.refreshToken)
+			};
+		} else return invalidMaterial();
+	}
+	const nativeMaterial = buildCliAuthPlaceholderMaterial({
+		...input,
+		metadata
+	});
+	const publicOutput = JSON.stringify({
+		nativeMaterial,
+		metadata
+	});
+	if (credentials.some((value) => value && publicOutput.includes(value))) return invalidMaterial();
+	return {
+		proxyAccessToken,
+		nativeMaterial,
+		metadata
+	};
+}
+//#endregion
+export { buildCliAuthPlaceholderMaterial, resolveCliAuthPlaceholder };
+
+//# sourceMappingURL=cli-auth-placeholder.mjs.map

package/dist/cli-backend-auth-env.d.mts

@@ -0,0 +1,6 @@
+//#region src/cli-backend-auth-env.d.ts
+/** The narrow credential leg shared by the host and sidecar rebind boundary. */
+declare function assertCliBackendAuthEnv(backendType: string | undefined, authEnv: Readonly<Record<string, string>>): void;
+//#endregion
+export { assertCliBackendAuthEnv };
+//# sourceMappingURL=cli-backend-auth-env.d.mts.map

package/dist/cli-backend-auth-env.mjs

@@ -0,0 +1,44 @@
+import { l as getSpec } from "./specs-BBF55TnM.mjs";
+import { i as cliAuthFilesSchema, n as CLI_AUTH_REFERENCE_ENV_VAR, o as resolveCliAuthReference, s as cliAuthReferenceSchema } from "./cli-auth-bundle-C6DtK7GX.mjs";
+import { n as isSafeEnvVarName, t as isForbiddenEnvVarName } from "./harness-D1fTxnDD.mjs";
+//#region src/cli-backend-auth-env.ts
+/** The narrow credential leg shared by the host and sidecar rebind boundary. */
+function assertCliBackendAuthEnv(backendType, authEnv) {
+	if (Object.keys(authEnv).length === 0) return;
+	const spec = backendType ? getSpec(backendType) : void 0;
+	if (!spec) throw new Error("Credential delivery requires a registered backend");
+	const allowed = new Set([
+		spec.envVars.apiKey,
+		spec.envVars.oauthToken,
+		spec.envVars.authFiles
+	].filter((name) => name !== void 0));
+	const rawReference = authEnv[CLI_AUTH_REFERENCE_ENV_VAR];
+	if (rawReference !== void 0) {
+		let parsed;
+		try {
+			parsed = JSON.parse(rawReference);
+		} catch {
+			throw new Error("Invalid native credential reference");
+		}
+		const result = cliAuthReferenceSchema.safeParse(parsed);
+		if (!result.success || !isSafeEnvVarName(result.data.secretEnv) || isForbiddenEnvVarName(result.data.secretEnv)) throw new Error("Invalid native credential reference");
+		allowed.add(CLI_AUTH_REFERENCE_ENV_VAR);
+		allowed.add(result.data.secretEnv);
+		resolveCliAuthReference(spec.name, { cliAuth: result.data }, authEnv);
+	}
+	for (const [name, value] of Object.entries(authEnv)) if (!allowed.has(name) || value.includes("\0")) throw new Error("Invalid backend credential environment");
+	const files = spec.envVars.authFiles && authEnv[spec.envVars.authFiles];
+	if (files !== void 0 && files !== "") {
+		let parsed;
+		try {
+			parsed = JSON.parse(files);
+		} catch {
+			throw new Error("Invalid backend auth files");
+		}
+		if (!(Array.isArray(parsed) && parsed.length === 0) && !cliAuthFilesSchema.safeParse(parsed).success) throw new Error("Invalid backend auth files");
+	}
+}
+//#endregion
+export { assertCliBackendAuthEnv };
+
+//# sourceMappingURL=cli-backend-auth-env.mjs.map

package/dist/default-backend.d.mts

@@ -0,0 +1,24 @@
+import { r as BackendType } from "./backend-types-DRmLR1e0.mjs";
+//#region src/default-backend.d.ts
+/**
+ * Platform-wide default agent backend, read from `DEFAULT_AGENT_BACKEND`.
+ *
+ * Every "no backend type was supplied" path resolves
+ * through — request bodies, container labels, session records, env-driven
+ * boot. Deployment config (env files, Dockerfile ENV, test setup) names the
+ * default exactly once; code never carries a vendor literal.
+ *
+ * Fail-closed: throws when the variable is unset or names an unregistered
+ * backend. A silent literal here would weld one vendor backend into the
+ * platform and mask misconfigured deployments.
+ *
+ * Published as its own `./default-backend` entry: it pulls only `./specs.js`
+ * (data-only), so Cloudflare Worker / edge bundles can consume it without the
+ * Node-only barrel (adapter bindings, local CLI auth). Workers have no
+ * `process.env` — they MUST pass their bindings record explicitly; the
+ * `process.env` default only fires when the argument is omitted.
+ */
+declare function resolveDefaultBackend(env?: Record<string, string | undefined>): BackendType;
+//#endregion
+export { resolveDefaultBackend };
+//# sourceMappingURL=default-backend.d.mts.map

package/dist/default-backend.mjs

@@ -0,0 +1,31 @@
+import { i as isBackendType, t as ALL_BACKEND_TYPES } from "./backend-types-CNo_Zj_K.mjs";
+import "./specs-BBF55TnM.mjs";
+//#region src/default-backend.ts
+/**
+* Platform-wide default agent backend, read from `DEFAULT_AGENT_BACKEND`.
+*
+* Every "no backend type was supplied" path resolves
+* through — request bodies, container labels, session records, env-driven
+* boot. Deployment config (env files, Dockerfile ENV, test setup) names the
+* default exactly once; code never carries a vendor literal.
+*
+* Fail-closed: throws when the variable is unset or names an unregistered
+* backend. A silent literal here would weld one vendor backend into the
+* platform and mask misconfigured deployments.
+*
+* Published as its own `./default-backend` entry: it pulls only `./specs.js`
+* (data-only), so Cloudflare Worker / edge bundles can consume it without the
+* Node-only barrel (adapter bindings, local CLI auth). Workers have no
+* `process.env` — they MUST pass their bindings record explicitly; the
+* `process.env` default only fires when the argument is omitted.
+*/
+function resolveDefaultBackend(env = process.env) {
+	const raw = env.DEFAULT_AGENT_BACKEND;
+	if (raw === void 0 || raw === "") throw new Error(`DEFAULT_AGENT_BACKEND is not set. A backend type was omitted and no platform default is configured. Set DEFAULT_AGENT_BACKEND to one of: ${ALL_BACKEND_TYPES.join(", ")}`);
+	if (!isBackendType(raw)) throw new Error(`DEFAULT_AGENT_BACKEND="${raw}" is not a registered backend. Registered backends: ${ALL_BACKEND_TYPES.join(", ")}`);
+	return raw;
+}
+//#endregion
+export { resolveDefaultBackend };
+
+//# sourceMappingURL=default-backend.mjs.map

package/dist/harness-D1fTxnDD.mjs

@@ -0,0 +1,199 @@
+import { n as HARNESS_WARM_TRANSPORT_ENV } from "./harness-contracts-BZoECCMc.mjs";
+import { ProxySecretBindingSchema, ProxySecretGrantSchema, ProxySecretReceiptSchema, ProxySecretUpdateControlsSchema, ProxySecretsSchema, isProxySecretScopeAttenuation, ownPropertyRecordSchema, proxySecretPresentationsEqual } from "@tangle-network/agent-interface";
+import { z } from "zod";
+function baseProxyToken(token) {
+	const i = token.indexOf(".");
+	return i === -1 ? token : token.slice(0, i);
+}
+const MODEL_PROXY_TOKENS = {
+	OPENCODE_MODEL_API_KEY: "proxy-model-token",
+	OPENAI_API_KEY: "proxy-openai-token",
+	ANTHROPIC_API_KEY: "proxy-anthropic-token",
+	OPENROUTER_API_KEY: "proxy-openrouter-token",
+	TANGLE_INFERENCE_KEY: "proxy-openai-token",
+	ZAI_API_KEY: "proxy-zai-token",
+	ZHIPU_API_KEY: "proxy-zai-token"
+};
+new Set(Object.values(MODEL_PROXY_TOKENS));
+new Set([
+	...Object.keys(MODEL_PROXY_TOKENS),
+	"TANGLE_API_KEY",
+	"GITHUB_TOKEN",
+	"GH_TOKEN"
+]);
+/** Proxy-private slot names shared by legacy and canonical bindings. */
+function declaredSecretSlotEnvVar(index) {
+	return `TANGLE_DECLARED_SLOT_${index}`;
+}
+/** True for a slot name, which exists at the proxy and never in a box env. */
+function isDeclaredSecretSlotEnvVar(name) {
+	return /^TANGLE_DECLARED_SLOT_\d+$/.test(name);
+}
+/** The base placeholder for the slot at `index`; the box holds it salted. */
+function declaredSecretBaseToken(index) {
+	return `proxy-declared-${index}-token`;
+}
+/** Every slot name mapped to its base placeholder. */
+function declaredSecretSlotTokens() {
+	const slots = {};
+	for (let index = 0; index < 16; index++) slots[declaredSecretSlotEnvVar(index)] = declaredSecretBaseToken(index);
+	return slots;
+}
+//#endregion
+//#region ../runtime-contracts/dist/proxy-secret-materialization.js
+const syntheticHeader = {
+	alg: "HS256",
+	typ: "JWT"
+};
+const encode = (value) => btoa(value instanceof Uint8Array ? String.fromCharCode(...value) : JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+function placeholderPrefix(slot, format, expiresAt) {
+	return format === "jwt" ? `${encode(syntheticHeader)}.${encode({
+		sub: "sandbox-placeholder",
+		aud: "proxy-secret-placeholder",
+		exp: Math.floor(Date.parse(expiresAt) / 1e3)
+	})}.` : `proxy-declared-${slot.slice(21)}-token-`;
+}
+function isSyntheticPlaceholder(material) {
+	const prefix = placeholderPrefix(material.slot, material.grant.placeholderFormat, material.issuerExpiresAt);
+	return material.placeholder.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/.test(material.placeholder.slice(prefix.length));
+}
+z.array(z.strictObject({
+	binding: ProxySecretBindingSchema,
+	grant: ProxySecretGrantSchema,
+	placeholder: z.string().min(1),
+	slot: z.string().refine(isDeclaredSecretSlotEnvVar),
+	issuerExpiresAt: z.iso.datetime(),
+	native: z.unknown().optional()
+})).superRefine((materials, ctx) => {
+	const bindings = ProxySecretsSchema.safeParse(materials.map((m) => m.binding));
+	const unique = (values) => new Set(values).size === values.length;
+	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
+		code: "custom",
+		message: "Invalid proxy secret materialization"
+	});
+});
+ProxySecretUpdateControlsSchema.extend({
+	resolvedSecrets: ownPropertyRecordSchema(z.string().min(1), { maxEntries: Number.MAX_SAFE_INTEGER }).default({}),
+	proxySecretGrants: ProxySecretReceiptSchema.options[0].shape.bindings,
+	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration.unwrap()
+}).strict().refine((body) => new Set(body.proxySecretGrants.map((b) => b.envName)).size === body.proxySecretGrants.length);
+//#endregion
+//#region ../runtime-contracts/dist/runtime-environment.js
+const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isSafeEnvVarName(name) {
+	if (typeof name !== "string") return false;
+	if (name.length === 0 || name.length > 256) return false;
+	return SAFE_ENV_VAR_NAME_RE.test(name);
+}
+/** Client proxy URLs first, then bypass names. */
+const EGRESS_PROXY_ENV_NAMES = [
+	"HTTPS_PROXY",
+	"https_proxy",
+	"HTTP_PROXY",
+	"http_proxy",
+	"NO_PROXY",
+	"no_proxy"
+];
+const CA_TRUST_ENV_NAMES = [
+	"NODE_EXTRA_CA_CERTS",
+	"SSL_CERT_FILE",
+	"CURL_CA_BUNDLE",
+	"GIT_SSL_CAINFO",
+	"NIX_SSL_CERT_FILE"
+];
+[...EGRESS_PROXY_ENV_NAMES, ...CA_TRUST_ENV_NAMES];
+const FORBIDDEN_ENV_VAR_NAMES = new Set([
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"DYLD_INSERT_LIBRARIES",
+	"DYLD_LIBRARY_PATH",
+	"DYLD_FALLBACK_LIBRARY_PATH",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"PATH",
+	"NIX_BIN_PATH",
+	"EGRESS_EDGE_POOL_ENABLED",
+	"EDGE_BIND_ID",
+	"PRIVACY_EGRESS",
+	"LOG_REDACT",
+	"IFS",
+	"BASH_ENV",
+	"ENV",
+	"SHELL",
+	"SHELLOPTS",
+	"PROMPT_COMMAND",
+	"HOME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_STATE_HOME",
+	"XDG_RUNTIME_DIR",
+	"HTTPS_PROXY",
+	"HTTP_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"https_proxy",
+	"http_proxy",
+	"all_proxy",
+	"no_proxy",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"HOSTNAME",
+	"CONTAINER_ID",
+	"AGENT_WORKSPACE_ROOT",
+	"WORKSPACE_PATH",
+	"STORAGE_PATH",
+	"WORKSPACE_FILE_API_ROOT_ONLY",
+	"WORKSPACE_ALLOWED_ABSOLUTE_PATHS",
+	"TANGLE_PLAN_CALLBACK_ALLOWED_ORIGINS"
+]);
+const FORBIDDEN_ENV_VAR_PREFIXES = [
+	"SIDECAR_",
+	"ORCHESTRATOR_",
+	"AGENT_INTERNAL_",
+	"SANDBOX_DEV_",
+	"AGENT_SUBPROCESS_",
+	"TEE_ATTESTATION_"
+];
+const RUNTIME_CALLER_ALLOWED_ENV_NAMES = new Set(["SIDECAR_CAPABILITIES", "SIDECAR_PLATFORM_CONTROL_RUNTIME"]);
+new Set(Object.values(HARNESS_WARM_TRANSPORT_ENV).flatMap(({ warmServer, prewarm }) => [warmServer, prewarm]));
+function isForbiddenEnvVarName(name) {
+	if (RUNTIME_CALLER_ALLOWED_ENV_NAMES.has(name)) return false;
+	if (FORBIDDEN_ENV_VAR_NAMES.has(name)) return true;
+	for (const prefix of FORBIDDEN_ENV_VAR_PREFIXES) if (name.startsWith(prefix)) return true;
+	return false;
+}
+/**
+* POSIX names for caller-owned container env. Runtime process.env merges must additionally enforce
+* isForbiddenEnvVarName, including project provisioning and Sidecar config.
+*/
+const safeEnvRecordSchema = ownPropertyRecordSchema(z.string(), { maxEntries: Number.MAX_SAFE_INTEGER }).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
+/** Names only: the caller must keep a separate source and pass values to resume({ env }). */
+const sandboxEnvRecoverySchema = z.object({ callerResupplies: z.array(z.string().max(256).refine(isSafeEnvVarName, { message: "invalid env var name" })).max(128).refine((keys) => new Set(keys).size === keys.length, { message: "callerResupplies must contain unique keys" }) }).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	dryRun: z.boolean().optional()
+}).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	eligibleCallerResupplyKeys: z.array(z.string()),
+	requiredOnColdResumeKeys: z.array(z.string()),
+	automaticCredentialRecovery: z.literal(false),
+	dryRun: z.boolean()
+}).strict();
+safeEnvRecordSchema.refine((value) => Object.keys(value).every((key) => !isForbiddenEnvVarName(key) && !key.startsWith("SIDECAR_")), { message: "runtime-owned env var name cannot be set by callers" });
+//#endregion
+export { baseProxyToken as i, isSafeEnvVarName as n, declaredSecretSlotTokens as r, isForbiddenEnvVarName as t };
+
+//# sourceMappingURL=harness-D1fTxnDD.mjs.map