@validate.qa/runner 1.0.100 → 1.0.101

package/dist/run-write-guard-preload.mjs

@@ -1,293 +1,13 @@
 import {
-  require_run_write_guard
-} from "./chunk-2XD63NU5.mjs";
+  require_run_write_guard_preload
+} from "./chunk-2OKZY3WN.mjs";
+import "./chunk-BBTK6OX6.mjs";
+import "./chunk-SN3PN4G4.mjs";
+import "./chunk-IGXGSDE3.mjs";
 import {
-  require_survey_network_guard
-} from "./chunk-GIIIVO2W.mjs";
-import "./chunk-MBKGTELT.mjs";
-import {
-  __commonJS,
-  __require,
   __toESM
 } from "./chunk-WQXBGQU4.mjs";
 
-// ../runner-core/dist/services/run-write-guard-preload.js
-var require_run_write_guard_preload = __commonJS({
-  "../runner-core/dist/services/run-write-guard-preload.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.VERIFIED_PLAYWRIGHT_CORE = exports.installRunWriteGuard = exports.installNodeFetchGuard = exports.clearRunWriteRelay = exports.addRunWriteBrokerToken = exports.addRunWriteAuthHandler = void 0;
-    exports.describeBuiltRequest = describeBuiltRequest;
-    exports.installHttpGuard = installHttpGuard;
-    exports.installPlaywrightContextGuard = installPlaywrightContextGuard;
-    exports.startRunWriteGuardPreload = startRunWriteGuardPreload;
-    var node_module_1 = __require("module");
-    var node_path_1 = __require("path");
-    var survey_network_guard_js_1 = require_survey_network_guard();
-    var run_write_guard_js_1 = require_run_write_guard();
-    var run_write_guard_js_2 = require_run_write_guard();
-    Object.defineProperty(exports, "addRunWriteAuthHandler", { enumerable: true, get: function() {
-      return run_write_guard_js_2.addRunWriteAuthHandler;
-    } });
-    Object.defineProperty(exports, "addRunWriteBrokerToken", { enumerable: true, get: function() {
-      return run_write_guard_js_2.addRunWriteBrokerToken;
-    } });
-    Object.defineProperty(exports, "clearRunWriteRelay", { enumerable: true, get: function() {
-      return run_write_guard_js_2.clearRunWriteRelay;
-    } });
-    Object.defineProperty(exports, "installNodeFetchGuard", { enumerable: true, get: function() {
-      return run_write_guard_js_2.installNodeFetchGuard;
-    } });
-    Object.defineProperty(exports, "installRunWriteGuard", { enumerable: true, get: function() {
-      return run_write_guard_js_2.installRunWriteGuard;
-    } });
-    var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
-    var MAX_DECIDED_BODY_BYTES = 1024 * 1024;
-    function describeBuiltRequest(req) {
-      const method = typeof req.method === "string" && req.method ? req.method.toUpperCase() : "GET";
-      const protocol = req.protocol === "https:" ? "https:" : "http:";
-      const path = typeof req.path === "string" && req.path.startsWith("/") ? req.path : null;
-      if (path === null)
-        throw new Error("unusable request path");
-      if (typeof req.socketPath === "string" && req.socketPath) {
-        return { method, url: `${protocol}//unix-socket.invalid${path}` };
-      }
-      if (typeof req.host !== "string" || !req.host)
-        throw new Error("unusable request host");
-      const host = req.host.includes(":") && !req.host.startsWith("[") ? `[${req.host}]` : req.host;
-      return { method, url: new URL(`${protocol}//${host}${path}`).href };
-    }
-    function headerString(value) {
-      if (typeof value === "string")
-        return value;
-      if (Array.isArray(value))
-        return value.map(String).join(", ");
-      if (typeof value === "number")
-        return String(value);
-      return null;
-    }
-    function installHttpGuard(policy, opts, mod) {
-      if (policy.mode === "off")
-        return void 0;
-      const original = mod.request;
-      if (typeof original !== "function" || original.__vqaWriteGuarded)
-        return void 0;
-      const guard = new run_write_guard_js_1.RunWriteGuard(policy, opts);
-      const wrapped = function guardedRequest(...args) {
-        const req = original.apply(this, args);
-        const fields = req;
-        const connectedTo = { host: fields.host, socketPath: fields.socketPath, protocol: fields.protocol };
-        const chunks = [];
-        let bytes = 0;
-        let state = "pending";
-        const held = () => state === "held";
-        const originalWrite = req.write.bind(req);
-        const originalEnd = req.end.bind(req);
-        const originalFlushHeaders = req.flushHeaders.bind(req);
-        const take = (chunk, encoding) => {
-          if (chunk === void 0 || chunk === null || typeof chunk === "function")
-            return;
-          const buf = Buffer.isBuffer(chunk) ? chunk : chunk instanceof Uint8Array ? Buffer.from(chunk) : Buffer.from(String(chunk), typeof encoding === "string" ? encoding : "utf8");
-          chunks.push(buf);
-          bytes += buf.length;
-        };
-        const decide = (withBody) => {
-          const builtLine = typeof fields._header === "string" ? /^([A-Z]+) (\S+) HTTP\//.exec(fields._header) : null;
-          let described = null;
-          try {
-            described = describeBuiltRequest({
-              ...connectedTo,
-              method: builtLine ? builtLine[1] : fields.method,
-              path: builtLine ? builtLine[2] : fields.path
-            });
-          } catch {
-            described = null;
-          }
-          const moved = fields.host !== connectedTo.host || fields.socketPath !== connectedTo.socketPath || fields.protocol !== connectedTo.protocol;
-          let decision;
-          try {
-            if (!described || moved || typeof fields._header === "string" && !builtLine)
-              throw new Error("undescribable request");
-            const host = new URL(described.url).hostname.toLowerCase();
-            decision = LOOPBACK_HOSTS.has(host) && !policy.appSites.includes(host) ? { action: "allow", rule: "non-http" } : guard.decide({
-              method: described.method,
-              url: described.url,
-              postData: withBody ? Buffer.concat(chunks).toString("utf8") : null,
-              contentType: headerString(req.getHeader("content-type")),
-              amzTarget: headerString(req.getHeader("x-amz-target"))
-            });
-          } catch {
-            decision = {
-              action: "write",
-              rule: "decision-error",
-              record: { method: described?.method ?? "REQUEST", host: "", path: described ? (0, survey_network_guard_js_1.maskedPath)(described.url) : "(undescribable)", keys: [], rule: "decision-error" }
-            };
-          }
-          if (decision.action === "write" && decision.record) {
-            guard.note(decision.record);
-            if (guard.holds(decision.rule)) {
-              state = "held";
-              chunks.length = 0;
-              req.destroy(new Error(`blocked by the run write guard: ${decision.record.method} ${decision.record.host}${decision.record.path}`));
-              return;
-            }
-          }
-          state = "allowed";
-          for (const buf of chunks.splice(0))
-            originalWrite(buf);
-        };
-        req.write = (chunk, encoding, cb) => {
-          const done = typeof encoding === "function" ? encoding : cb;
-          if (state === "allowed")
-            return originalWrite(chunk, encoding, cb);
-          if (state === "pending") {
-            take(chunk, encoding);
-            if (bytes > MAX_DECIDED_BODY_BYTES)
-              decide(false);
-          }
-          if (held()) {
-            if (done)
-              process.nextTick(done, new Error("blocked by the run write guard"));
-            return false;
-          }
-          if (done)
-            process.nextTick(done);
-          return true;
-        };
-        req.flushHeaders = () => {
-          if (state === "allowed")
-            originalFlushHeaders();
-        };
-        req.end = (chunk, encoding, cb) => {
-          if (state === "allowed")
-            return originalEnd(chunk, encoding, cb);
-          if (state === "held")
-            return req;
-          const done = [chunk, encoding, cb].find((a) => typeof a === "function");
-          if (typeof chunk !== "function")
-            take(chunk, typeof encoding === "function" ? void 0 : encoding);
-          decide(bytes <= MAX_DECIDED_BODY_BYTES);
-          if (held())
-            return req;
-          return originalEnd(done);
-        };
-        return req;
-      };
-      Object.defineProperty(wrapped, "__vqaWriteGuarded", { value: true });
-      const wrappedGet = function guardedGet(...args) {
-        const req = wrapped.apply(this, args);
-        req.end();
-        return req;
-      };
-      Object.defineProperty(wrappedGet, "__vqaWriteGuarded", { value: true });
-      const install = (name, value) => {
-        if (policy.mode === "block") {
-          Object.defineProperty(mod, name, { value, writable: false, configurable: false, enumerable: true });
-        } else {
-          mod[name] = value;
-        }
-      };
-      install("request", wrapped);
-      if (typeof mod.get === "function")
-        install("get", wrappedGet);
-      return guard;
-    }
-    exports.VERIFIED_PLAYWRIGHT_CORE = /^1\.64\./;
-    function installPlaywrightContextGuard(policy, opts, from = __filename) {
-      if (policy.mode === "off")
-        return true;
-      let pw;
-      let version = "";
-      try {
-        const req = (0, node_module_1.createRequire)(from);
-        let base = from;
-        try {
-          base = (0, node_path_1.dirname)(req.resolve("@playwright/test/package.json"));
-        } catch {
-        }
-        try {
-          base = (0, node_path_1.dirname)((0, node_module_1.createRequire)(`${base}/`).resolve("playwright/package.json"));
-        } catch {
-        }
-        const fromPlaywright = (0, node_module_1.createRequire)(`${base}/`);
-        version = String(fromPlaywright("playwright-core/package.json").version ?? "");
-        pw = fromPlaywright("playwright-core");
-      } catch {
-        return false;
-      }
-      if (!exports.VERIFIED_PLAYWRIGHT_CORE.test(version)) {
-        if (policy.mode === "block")
-          return false;
-        opts.onLog?.(`[run-write-guard] observe: playwright-core ${version || "(unknown)"} is not a version the context hook was verified on`);
-      }
-      const add = pw?._instrumentation?.addListener;
-      if (typeof add !== "function")
-        return false;
-      add.call(pw._instrumentation, {
-        // Block mode: the context's service workers are off (design §4), whatever the test asked for.
-        // Playwright passes the options object it builds the context from (browser.newContext,
-        // launchPersistentContext); a context whose options cannot be set is still routed below.
-        runBeforeCreateBrowserContext: async (options) => {
-          if (options && typeof options === "object")
-            Object.assign(options, (0, run_write_guard_js_1.runWriteContextOptions)(policy));
-        },
-        runAfterCreateBrowserContext: async (context) => {
-          await (0, run_write_guard_js_1.installRunWriteGuard)(context, policy, opts);
-        }
-      });
-      return true;
-    }
-    function startRunWriteGuardPreload(env = process.env) {
-      const raw = env[run_write_guard_js_1.RUN_WRITE_POLICY_ENV];
-      if (!raw)
-        return [];
-      let policy = null;
-      try {
-        policy = (0, run_write_guard_js_1.parseRunWritePolicy)(JSON.parse(raw));
-      } catch {
-        policy = null;
-      }
-      if (!policy) {
-        console.log(`${run_write_guard_js_1.RUN_WRITE_UNAVAILABLE_LINE}the run write policy could not be read`);
-        return ["policy"];
-      }
-      if (policy.mode === "off")
-        return [];
-      const names = (env[run_write_guard_js_1.RUN_WRITE_SIGNIN_VARS_ENV] ?? "").split(",").map((n) => n.trim()).filter((n) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(n)).slice(0, 16);
-      const signInSecrets = names.map((n) => env[n]).filter((v) => typeof v === "string");
-      const opts = { onLog: (line) => console.log(line), signInSecrets };
-      const missing = [];
-      try {
-        (0, run_write_guard_js_1.installNodeFetchGuard)(policy, opts);
-      } catch {
-        missing.push("fetch");
-      }
-      const nodeRequire = (0, node_module_1.createRequire)(__filename);
-      try {
-        installHttpGuard(policy, opts, nodeRequire("node:http"));
-      } catch {
-        missing.push("http");
-      }
-      try {
-        installHttpGuard(policy, opts, nodeRequire("node:https"));
-      } catch {
-        missing.push("https");
-      }
-      try {
-        (0, node_module_1.syncBuiltinESMExports)();
-      } catch {
-      }
-      if (!installPlaywrightContextGuard(policy, opts))
-        missing.push("browser contexts");
-      for (const piece of missing)
-        console.log(`${run_write_guard_js_1.RUN_WRITE_UNAVAILABLE_LINE}the preload could not guard ${piece}`);
-      return missing;
-    }
-    if (process.env[run_write_guard_js_1.RUN_WRITE_POLICY_ENV])
-      startRunWriteGuardPreload();
-  }
-});
-
 // src/run-write-guard-preload.ts
 var import_run_write_guard_preload = __toESM(require_run_write_guard_preload());
 var export_addRunWriteAuthHandler = import_run_write_guard_preload.addRunWriteAuthHandler;