ai-evaluate 2.1.7 → 2.1.8

package/dist/types.d.ts

@@ -22,6 +22,16 @@ export interface SDKConfig {
     /** Cloudflare AI Gateway authentication token */
     aiGatewayToken?: string;
 }
+/**
+ * Network access configuration
+ *
+ * @example
+ * fetch: true           // allow all (default)
+ * fetch: false          // block all
+ * fetch: null           // block all (backwards compat)
+ * fetch: ['api.example.com', '*.trusted.com']  // allowlist with wildcards
+ */
+export type FetchConfig = boolean | null | string[];
 /**
  * Options for evaluate()
  */
@@ -36,8 +46,13 @@ export interface EvaluateOptions {
     timeout?: number | undefined;
     /** Environment variables to pass to the sandbox */
     env?: Record<string, string> | undefined;
-    /** Fetch configuration. Set to null to block network access. Default: allowed */
-    fetch?: null | undefined;
+    /**
+     * Network access control
+     * - true: allow all (default)
+     * - false/null: block all
+     * - string[]: allowlist of domains (wildcards: '*.example.com')
+     */
+    fetch?: FetchConfig;
     /** RPC services to expose via capnweb (URL -> handler) */
     rpc?: Record<string, unknown> | undefined;
     /** Outbound RPC interceptor - intercepts fetch calls to RPC URLs */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC5B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IACxC,iFAAiF;IACjF,KAAK,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IACxB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;IACzC,oEAAoE;IACpE,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,SAAS,CAAA;IAClG,mEAAmE;IACnE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IACrC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,qBAAqB;IACrB,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,8BAA8B;IAC9B,MAAM,EAAE,OAAO,CAAA;IACf,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;CAC/D;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,cAAc,CAAC,EAAE,IAAI,GAAG,OAAO,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,aAAa,IAAI,gBAAgB,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACjD,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;IAC/B,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;IAC5C,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACtD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACxD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACzD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAChD,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/C,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC9C,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3B,KAAK,IAAI,IAAI,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,IAAI,CAAC,EAAE,kBAAkB,CAAA;IACzB,IAAI,CAAC,EAAE,kBAAkB,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC5B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,CAAA;AAEnD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IACxC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;IACzC,oEAAoE;IACpE,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,SAAS,CAAA;IAClG,mEAAmE;IACnE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IACrC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,qBAAqB;IACrB,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,8BAA8B;IAC9B,MAAM,EAAE,OAAO,CAAA;IACf,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;CAC/D;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,cAAc,CAAC,EAAE,IAAI,GAAG,OAAO,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,aAAa,IAAI,gBAAgB,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACjD,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;IAC/B,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;IAC5C,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACtD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACxD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACzD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACxD,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAChD,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/C,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC9C,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3B,KAAK,IAAI,IAAI,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,IAAI,CAAC,EAAE,kBAAkB,CAAA;IACzB,IAAI,CAAC,EAAE,kBAAkB,CAAA;CAC1B"}

package/dist/validation.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Input validation for EvaluateOptions
+ *
+ * Validates options to prevent resource exhaustion and provide clear error messages.
+ */
+import type { EvaluateOptions } from './types.js';
+/**
+ * Validation limits for EvaluateOptions
+ */
+export declare const MAX_SCRIPT_SIZE: number;
+export declare const MAX_IMPORTS = 100;
+export declare const MAX_TIMEOUT = 60000;
+export declare const DEFAULT_TIMEOUT = 5000;
+/**
+ * Validation error thrown when options fail validation
+ */
+export declare class ValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate EvaluateOptions
+ *
+ * @throws ValidationError if any validation fails
+ */
+export declare function validateOptions(options: EvaluateOptions): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD;;GAEG;AACH,eAAO,MAAM,eAAe,QAAc,CAAA;AAC1C,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,eAAO,MAAM,WAAW,QAAQ,CAAA;AAChC,eAAO,MAAM,eAAe,OAAO,CAAA;AAEnC;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAcD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CA4E9D"}

package/dist/validation.js

@@ -0,0 +1,104 @@
+/**
+ * Input validation for EvaluateOptions
+ *
+ * Validates options to prevent resource exhaustion and provide clear error messages.
+ */
+/**
+ * Validation limits for EvaluateOptions
+ */
+export const MAX_SCRIPT_SIZE = 1024 * 1024; // 1MB
+export const MAX_IMPORTS = 100;
+export const MAX_TIMEOUT = 60000; // 60 seconds
+export const DEFAULT_TIMEOUT = 5000; // 5 seconds
+/**
+ * Validation error thrown when options fail validation
+ */
+export class ValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ValidationError';
+    }
+}
+/**
+ * Validate a URL string
+ */
+function isValidUrl(urlString) {
+    try {
+        const url = new URL(urlString);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate EvaluateOptions
+ *
+ * @throws ValidationError if any validation fails
+ */
+export function validateOptions(options) {
+    // Validate timeout
+    if (options.timeout !== undefined) {
+        if (typeof options.timeout !== 'number') {
+            throw new ValidationError('timeout must be a number');
+        }
+        if (!Number.isFinite(options.timeout)) {
+            throw new ValidationError('timeout must be a finite number');
+        }
+        if (options.timeout <= 0) {
+            throw new ValidationError('timeout must be a positive number');
+        }
+        if (options.timeout > MAX_TIMEOUT) {
+            throw new ValidationError(`timeout exceeds maximum allowed value of ${MAX_TIMEOUT}ms`);
+        }
+    }
+    // Validate script length
+    if (options.script !== undefined && options.script !== null) {
+        if (typeof options.script !== 'string') {
+            throw new ValidationError('script must be a string');
+        }
+        const scriptBytes = new TextEncoder().encode(options.script).length;
+        if (scriptBytes > MAX_SCRIPT_SIZE) {
+            throw new ValidationError(`script size (${scriptBytes} bytes) exceeds maximum allowed size of ${MAX_SCRIPT_SIZE} bytes (1MB)`);
+        }
+    }
+    // Validate module length
+    if (options.module !== undefined && options.module !== null) {
+        if (typeof options.module !== 'string') {
+            throw new ValidationError('module must be a string');
+        }
+        const moduleBytes = new TextEncoder().encode(options.module).length;
+        if (moduleBytes > MAX_SCRIPT_SIZE) {
+            throw new ValidationError(`module size (${moduleBytes} bytes) exceeds maximum allowed size of ${MAX_SCRIPT_SIZE} bytes (1MB)`);
+        }
+    }
+    // Validate tests length
+    if (options.tests !== undefined && options.tests !== null) {
+        if (typeof options.tests !== 'string') {
+            throw new ValidationError('tests must be a string');
+        }
+        const testsBytes = new TextEncoder().encode(options.tests).length;
+        if (testsBytes > MAX_SCRIPT_SIZE) {
+            throw new ValidationError(`tests size (${testsBytes} bytes) exceeds maximum allowed size of ${MAX_SCRIPT_SIZE} bytes (1MB)`);
+        }
+    }
+    // Validate imports
+    if (options.imports !== undefined && options.imports !== null) {
+        if (!Array.isArray(options.imports)) {
+            throw new ValidationError('imports must be an array');
+        }
+        if (options.imports.length > MAX_IMPORTS) {
+            throw new ValidationError(`imports count (${options.imports.length}) exceeds maximum allowed count of ${MAX_IMPORTS}`);
+        }
+        for (let i = 0; i < options.imports.length; i++) {
+            const importUrl = options.imports[i];
+            if (typeof importUrl !== 'string') {
+                throw new ValidationError(`imports[${i}] must be a string`);
+            }
+            if (!isValidUrl(importUrl)) {
+                throw new ValidationError(`imports[${i}] is not a valid URL: ${importUrl}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,MAAM;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAA;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAA,CAAC,aAAa;AAC9C,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAA,CAAC,YAAY;AAEhD;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,SAAiB;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,mBAAmB;IACnB,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CAAC,4CAA4C,WAAW,IAAI,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;QACnE,IAAI,WAAW,GAAG,eAAe,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CACvB,gBAAgB,WAAW,2CAA2C,eAAe,cAAc,CACpG,CAAA;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;QACnE,IAAI,WAAW,GAAG,eAAe,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CACvB,gBAAgB,WAAW,2CAA2C,eAAe,cAAc,CACpG,CAAA;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAA;QACjE,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,eAAe,CACvB,eAAe,UAAU,2CAA2C,eAAe,cAAc,CAClG,CAAA;QACH,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,eAAe,CACvB,kBAAkB,OAAO,CAAC,OAAO,CAAC,MAAM,sCAAsC,WAAW,EAAE,CAC5F,CAAA;QACH,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YACpC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAA;YAC7D,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/worker-template/code-transforms.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Module transformation and export detection utilities
+ */
+/**
+ * Transform module code to work in sandbox
+ * Converts ES module exports to CommonJS-style for the sandbox
+ */
+export declare function transformModuleCode(moduleCode: string): string;
+//# sourceMappingURL=code-transforms.d.ts.map

package/dist/worker-template/code-transforms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-transforms.d.ts","sourceRoot":"","sources":["../../src/worker-template/code-transforms.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAuB9D"}

package/dist/worker-template/code-transforms.js

@@ -0,0 +1,28 @@
+/**
+ * Module transformation and export detection utilities
+ */
+/**
+ * Transform module code to work in sandbox
+ * Converts ES module exports to CommonJS-style for the sandbox
+ */
+export function transformModuleCode(moduleCode) {
+    let code = moduleCode;
+    // Transform: export const foo = ... -> const foo = ...; exports.foo = foo;
+    code = code.replace(/export\s+(const|let|var)\s+(\w+)\s*=/g, '$1 $2 = exports.$2 =');
+    // Transform: export function foo(...) -> function foo(...) exports.foo = foo;
+    // Also handles async generators: export async function* foo
+    code = code.replace(/export\s+(async\s+)?function(\*?)\s+(\w+)/g, '$1function$2 $3');
+    // Add exports for functions after their definition
+    const funcNames = [...moduleCode.matchAll(/export\s+(?:async\s+)?function\*?\s+(\w+)/g)];
+    for (const [, name] of funcNames) {
+        code += `\nexports.${name} = ${name};`;
+    }
+    // Transform: export class Foo -> class Foo; exports.Foo = Foo;
+    code = code.replace(/export\s+class\s+(\w+)/g, 'class $1');
+    const classNames = [...moduleCode.matchAll(/export\s+class\s+(\w+)/g)];
+    for (const [, name] of classNames) {
+        code += `\nexports.${name} = ${name};`;
+    }
+    return code;
+}
+//# sourceMappingURL=code-transforms.js.map

package/dist/worker-template/code-transforms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-transforms.js","sourceRoot":"","sources":["../../src/worker-template/code-transforms.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,IAAI,IAAI,GAAG,UAAU,CAAA;IAErB,2EAA2E;IAC3E,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,sBAAsB,CAAC,CAAA;IAEpF,8EAA8E;IAC9E,4DAA4D;IAC5D,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4CAA4C,EAAE,iBAAiB,CAAC,CAAA;IACpF,mDAAmD;IACnD,MAAM,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAAC,CAAA;IACxF,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,IAAI,aAAa,IAAI,MAAM,IAAI,GAAG,CAAA;IACxC,CAAC;IAED,+DAA+D;IAC/D,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC,CAAA;IAC1D,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAA;IACtE,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,IAAI,aAAa,IAAI,MAAM,IAAI,GAAG,CAAA;IACxC,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/{src/worker-template.d.ts → dist/worker-template/core.d.ts}

@@ -1,19 +1,10 @@
 /**
- * Worker template for sandbox execution
+ * Worker scaffold and main template generation
  *
- * This code is stringified and sent to the worker loader.
- * It uses the TEST service binding (ai-tests) for assertions and test running.
- *
- * The user's code (module, tests, script) is embedded directly into
- * the worker source - no eval() or new Function() needed. The security
- * comes from running in an isolated V8 context via worker_loaders.
- *
- * Routes:
- * - POST /execute - Run tests and scripts, return results
- * - POST /rpc or WebSocket upgrade - capnweb RPC to module exports
- * - GET / - Return info about available exports
+ * This module contains the main generateWorkerCode and generateDevWorkerCode functions
+ * that produce the complete worker code for sandbox execution.
  */
-import type { SDKConfig } from './types.js';
+import type { SDKConfig, FetchConfig } from '../types.js';
 /**
  * Generate worker code for production (uses RPC to ai-tests)
  */
@@ -23,6 +14,7 @@ export declare function generateWorkerCode(options: {
     script?: string | undefined;
     sdk?: SDKConfig | boolean | undefined;
     imports?: string[] | undefined;
+    fetch?: FetchConfig;
 }): string;
 /**
  * Generate worker code for development (embedded test framework)
@@ -36,6 +28,6 @@ export declare function generateDevWorkerCode(options: {
     script?: string | undefined;
     sdk?: SDKConfig | boolean | undefined;
     imports?: string[] | undefined;
-    fetch?: null | undefined;
+    fetch?: null | FetchConfig | undefined;
 }): string;
-//# sourceMappingURL=worker-template.d.ts.map
+//# sourceMappingURL=core.d.ts.map

package/dist/worker-template/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/worker-template/core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAOzD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAC9B,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GAAG,MAAM,CA0QT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAC9B,KAAK,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,SAAS,CAAA;CACvC,GAAG,MAAM,CAoPT"}